drivers/net/wireless/mediatek/mt76/mt7915/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2020 MediaTek Inc. */
   3
   4 #include <linux/firmware.h>
   5 #include <linux/fs.h>
   6 #include "mt7915.h"
   7 #include "mcu.h"
   8 #include "mac.h"
   9 #include "eeprom.h"
  10
  11 struct mt7915_patch_hdr {
  12         char build_date[16];
  13         char platform[4];
  14         __be32 hw_sw_ver;
  15         __be32 patch_ver;
  16         __be16 checksum;
  17         u16 reserved;
  18         struct {
  19                 __be32 patch_ver;
  20                 __be32 subsys;
  21                 __be32 feature;
  22                 __be32 n_region;
  23                 __be32 crc;
  24                 u32 reserved[11];
  25         } desc;
  26 } __packed;
  27
  28 struct mt7915_patch_sec {
  29         __be32 type;
  30         __be32 offs;
  31         __be32 size;
  32         union {
  33                 __be32 spec[13];
  34                 struct {
  35                         __be32 addr;
  36                         __be32 len;
  37                         __be32 sec_key_idx;
  38                         __be32 align_len;
  39                         u32 reserved[9];
  40                 } info;
  41         };
  42 } __packed;
  43
  44 struct mt7915_fw_trailer {
  45         u8 chip_id;
  46         u8 eco_code;
  47         u8 n_region;
  48         u8 format_ver;
  49         u8 format_flag;
  50         u8 reserved[2];
  51         char fw_ver[10];
  52         char build_date[15];
  53         u32 crc;
  54 } __packed;
  55
  56 struct mt7915_fw_region {
  57         __le32 decomp_crc;
  58         __le32 decomp_len;
  59         __le32 decomp_blk_sz;
  60         u8 reserved[4];
  61         __le32 addr;
  62         __le32 len;
  63         u8 feature_set;
  64         u8 reserved1[15];
  65 } __packed;
  66
  67 #define MCU_PATCH_ADDRESS               0x200000
  68
  69 #define FW_FEATURE_SET_ENCRYPT          BIT(0)
  70 #define FW_FEATURE_SET_KEY_IDX          GENMASK(2, 1)
  71 #define FW_FEATURE_OVERRIDE_ADDR        BIT(5)
  72
  73 #define DL_MODE_ENCRYPT                 BIT(0)
  74 #define DL_MODE_KEY_IDX                 GENMASK(2, 1)
  75 #define DL_MODE_RESET_SEC_IV            BIT(3)
  76 #define DL_MODE_WORKING_PDA_CR4         BIT(4)
  77 #define DL_MODE_NEED_RSP                BIT(31)
  78
  79 #define FW_START_OVERRIDE               BIT(0)
  80 #define FW_START_WORKING_PDA_CR4        BIT(2)
  81
  82 #define PATCH_SEC_TYPE_MASK             GENMASK(15, 0)
  83 #define PATCH_SEC_TYPE_INFO             0x2
  84
  85 #define to_wcid_lo(id)                  FIELD_GET(GENMASK(7, 0), (u16)id)
  86 #define to_wcid_hi(id)                  FIELD_GET(GENMASK(9, 8), (u16)id)
  87
  88 #define HE_PHY(p, c)                    u8_get_bits(c, IEEE80211_HE_PHY_##p)
  89 #define HE_MAC(m, c)                    u8_get_bits(c, IEEE80211_HE_MAC_##m)
  90
  91 static enum mcu_cipher_type
  92 mt7915_mcu_get_cipher(int cipher)
  93 {
  94         switch (cipher) {
  95         case WLAN_CIPHER_SUITE_WEP40:
  96                 return MCU_CIPHER_WEP40;
  97         case WLAN_CIPHER_SUITE_WEP104:
  98                 return MCU_CIPHER_WEP104;
  99         case WLAN_CIPHER_SUITE_TKIP:
 100                 return MCU_CIPHER_TKIP;
 101         case WLAN_CIPHER_SUITE_AES_CMAC:
 102                 return MCU_CIPHER_BIP_CMAC_128;
 103         case WLAN_CIPHER_SUITE_CCMP:
 104                 return MCU_CIPHER_AES_CCMP;
 105         case WLAN_CIPHER_SUITE_CCMP_256:
 106                 return MCU_CIPHER_CCMP_256;
 107         case WLAN_CIPHER_SUITE_GCMP:
 108                 return MCU_CIPHER_GCMP;
 109         case WLAN_CIPHER_SUITE_GCMP_256:
 110                 return MCU_CIPHER_GCMP_256;
 111         case WLAN_CIPHER_SUITE_SMS4:
 112                 return MCU_CIPHER_WAPI;
 113         default:
 114                 return MT_CIPHER_NONE;
 115         }
 116 }
 117
 118 static u8 mt7915_mcu_chan_bw(struct cfg80211_chan_def *chandef)
 119 {
 120         static const u8 width_to_bw[] = {
 121                 [NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
 122                 [NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
 123                 [NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
 124                 [NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
 125                 [NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
 126                 [NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
 127                 [NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
 128                 [NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
 129         };
 130
 131         if (chandef->width >= ARRAY_SIZE(width_to_bw))
 132                 return 0;
 133
 134         return width_to_bw[chandef->width];
 135 }
 136
 137 static const struct ieee80211_sta_he_cap *
 138 mt7915_get_he_phy_cap(struct mt7915_phy *phy, struct ieee80211_vif *vif)
 139 {
 140         struct ieee80211_supported_band *sband;
 141         enum nl80211_band band;
 142
 143         band = phy->mt76->chandef.chan->band;
 144         sband = phy->mt76->hw->wiphy->bands[band];
 145
 146         return ieee80211_get_he_iftype_cap(sband, vif->type);
 147 }
 148
 149 static u8
 150 mt7915_get_phy_mode(struct ieee80211_vif *vif, struct ieee80211_sta *sta)
 151 {
 152         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 153         enum nl80211_band band = mvif->phy->mt76->chandef.chan->band;
 154         struct ieee80211_sta_ht_cap *ht_cap;
 155         struct ieee80211_sta_vht_cap *vht_cap;
 156         const struct ieee80211_sta_he_cap *he_cap;
 157         u8 mode = 0;
 158
 159         if (sta) {
 160                 ht_cap = &sta->ht_cap;
 161                 vht_cap = &sta->vht_cap;
 162                 he_cap = &sta->he_cap;
 163         } else {
 164                 struct ieee80211_supported_band *sband;
 165
 166                 sband = mvif->phy->mt76->hw->wiphy->bands[band];
 167
 168                 ht_cap = &sband->ht_cap;
 169                 vht_cap = &sband->vht_cap;
 170                 he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
 171         }
 172
 173         if (band == NL80211_BAND_2GHZ) {
 174                 mode |= PHY_MODE_B | PHY_MODE_G;
 175
 176                 if (ht_cap->ht_supported)
 177                         mode |= PHY_MODE_GN;
 178
 179                 if (he_cap->has_he)
 180                         mode |= PHY_MODE_AX_24G;
 181         } else if (band == NL80211_BAND_5GHZ) {
 182                 mode |= PHY_MODE_A;
 183
 184                 if (ht_cap->ht_supported)
 185                         mode |= PHY_MODE_AN;
 186
 187                 if (vht_cap->vht_supported)
 188                         mode |= PHY_MODE_AC;
 189
 190                 if (he_cap->has_he)
 191                         mode |= PHY_MODE_AX_5G;
 192         }
 193
 194         return mode;
 195 }
 196
 197 static u8
 198 mt7915_mcu_get_sta_nss(u16 mcs_map)
 199 {
 200         u8 nss;
 201
 202         for (nss = 8; nss > 0; nss--) {
 203                 u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
 204
 205                 if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
 206                         break;
 207         }
 208
 209         return nss - 1;
 210 }
 211
 212 static void
 213 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
 214                           const u16 *mask)
 215 {
 216         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
 217         struct cfg80211_chan_def *chandef = &msta->vif->phy->mt76->chandef;
 218         int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
 219         u16 mcs_map;
 220
 221         switch (chandef->width) {
 222         case NL80211_CHAN_WIDTH_80P80:
 223                 mcs_map = le16_to_cpu(sta->he_cap.he_mcs_nss_supp.rx_mcs_80p80);
 224                 break;
 225         case NL80211_CHAN_WIDTH_160:
 226                 mcs_map = le16_to_cpu(sta->he_cap.he_mcs_nss_supp.rx_mcs_160);
 227                 break;
 228         default:
 229                 mcs_map = le16_to_cpu(sta->he_cap.he_mcs_nss_supp.rx_mcs_80);
 230                 break;
 231         }
 232
 233         for (nss = 0; nss < max_nss; nss++) {
 234                 int mcs;
 235
 236                 switch ((mcs_map >> (2 * nss)) & 0x3) {
 237                 case IEEE80211_HE_MCS_SUPPORT_0_11:
 238                         mcs = GENMASK(11, 0);
 239                         break;
 240                 case IEEE80211_HE_MCS_SUPPORT_0_9:
 241                         mcs = GENMASK(9, 0);
 242                         break;
 243                 case IEEE80211_HE_MCS_SUPPORT_0_7:
 244                         mcs = GENMASK(7, 0);
 245                         break;
 246                 default:
 247                         mcs = 0;
 248                 }
 249
 250                 mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
 251
 252                 switch (mcs) {
 253                 case 0 ... 7:
 254                         mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
 255                         break;
 256                 case 8 ... 9:
 257                         mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
 258                         break;
 259                 case 10 ... 11:
 260                         mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
 261                         break;
 262                 default:
 263                         mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
 264                         break;
 265                 }
 266                 mcs_map &= ~(0x3 << (nss * 2));
 267                 mcs_map |= mcs << (nss * 2);
 268
 269                 /* only support 2ss on 160MHz */
 270                 if (nss > 1 && (sta->bandwidth == IEEE80211_STA_RX_BW_160))
 271                         break;
 272         }
 273
 274         *he_mcs = cpu_to_le16(mcs_map);
 275 }
 276
 277 static void
 278 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
 279                            const u16 *mask)
 280 {
 281         u16 mcs_map = le16_to_cpu(sta->vht_cap.vht_mcs.rx_mcs_map);
 282         int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
 283         u16 mcs;
 284
 285         for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
 286                 switch (mcs_map & 0x3) {
 287                 case IEEE80211_VHT_MCS_SUPPORT_0_9:
 288                         mcs = GENMASK(9, 0);
 289                         break;
 290                 case IEEE80211_VHT_MCS_SUPPORT_0_8:
 291                         mcs = GENMASK(8, 0);
 292                         break;
 293                 case IEEE80211_VHT_MCS_SUPPORT_0_7:
 294                         mcs = GENMASK(7, 0);
 295                         break;
 296                 default:
 297                         mcs = 0;
 298                 }
 299
 300                 vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
 301
 302                 /* only support 2ss on 160MHz */
 303                 if (nss > 1 && (sta->bandwidth == IEEE80211_STA_RX_BW_160))
 304                         break;
 305         }
 306 }
 307
 308 static void
 309 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
 310                           const u8 *mask)
 311 {
 312         int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
 313
 314         for (nss = 0; nss < max_nss; nss++)
 315                 ht_mcs[nss] = sta->ht_cap.mcs.rx_mask[nss] & mask[nss];
 316 }
 317
 318 static int
 319 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 320                           struct sk_buff *skb, int seq)
 321 {
 322         struct mt7915_mcu_rxd *rxd;
 323         int ret = 0;
 324
 325         if (!skb) {
 326                 dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
 327                         cmd, seq);
 328                 return -ETIMEDOUT;
 329         }
 330
 331         rxd = (struct mt7915_mcu_rxd *)skb->data;
 332         if (seq != rxd->seq)
 333                 return -EAGAIN;
 334
 335         if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
 336                 skb_pull(skb, sizeof(*rxd) - 4);
 337                 ret = *skb->data;
 338         } else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
 339                 skb_pull(skb, sizeof(*rxd) + 4);
 340                 ret = le32_to_cpu(*(__le32 *)skb->data);
 341         } else {
 342                 skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
 343         }
 344
 345         return ret;
 346 }
 347
 348 static int
 349 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 350                         int cmd, int *wait_seq)
 351 {
 352         struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
 353         struct mt7915_mcu_txd *mcu_txd;
 354         enum mt76_mcuq_id qid;
 355         __le32 *txd;
 356         u32 val;
 357         u8 seq;
 358
 359         /* TODO: make dynamic based on msg type */
 360         mdev->mcu.timeout = 20 * HZ;
 361
 362         seq = ++dev->mt76.mcu.msg_seq & 0xf;
 363         if (!seq)
 364                 seq = ++dev->mt76.mcu.msg_seq & 0xf;
 365
 366         if (cmd == MCU_CMD(FW_SCATTER)) {
 367                 qid = MT_MCUQ_FWDL;
 368                 goto exit;
 369         }
 370
 371         mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
 372         if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 373                 qid = MT_MCUQ_WA;
 374         else
 375                 qid = MT_MCUQ_WM;
 376
 377         txd = mcu_txd->txd;
 378
 379         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
 380               FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
 381               FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
 382         txd[0] = cpu_to_le32(val);
 383
 384         val = MT_TXD1_LONG_FORMAT |
 385               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
 386         txd[1] = cpu_to_le32(val);
 387
 388         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 389         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
 390                                                MT_TX_MCU_PORT_RX_Q0));
 391         mcu_txd->pkt_type = MCU_PKT_ID;
 392         mcu_txd->seq = seq;
 393
 394         mcu_txd->cid = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
 395         mcu_txd->set_query = MCU_Q_NA;
 396         mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
 397         if (mcu_txd->ext_cid) {
 398                 mcu_txd->ext_cid_ack = 1;
 399
 400                 /* do not use Q_SET for efuse */
 401                 if (cmd & __MCU_CMD_FIELD_QUERY)
 402                         mcu_txd->set_query = MCU_Q_QUERY;
 403                 else
 404                         mcu_txd->set_query = MCU_Q_SET;
 405         }
 406
 407         if (cmd & __MCU_CMD_FIELD_WA)
 408                 mcu_txd->s2d_index = MCU_S2D_H2C;
 409         else
 410                 mcu_txd->s2d_index = MCU_S2D_H2N;
 411
 412 exit:
 413         if (wait_seq)
 414                 *wait_seq = seq;
 415
 416         return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
 417 }
 418
 419 static void
 420 mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
 421 {
 422         struct {
 423                 __le32 args[3];
 424         } req = {
 425                 .args = {
 426                         cpu_to_le32(a1),
 427                         cpu_to_le32(a2),
 428                         cpu_to_le32(a3),
 429                 },
 430         };
 431
 432         mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
 433 }
 434
 435 static void
 436 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 437 {
 438         if (vif->csa_active)
 439                 ieee80211_csa_finish(vif);
 440 }
 441
 442 static void
 443 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
 444 {
 445         struct mt76_phy *mphy = &dev->mt76.phy;
 446         struct mt7915_mcu_csa_notify *c;
 447
 448         c = (struct mt7915_mcu_csa_notify *)skb->data;
 449
 450         if (c->band_idx && dev->mt76.phy2)
 451                 mphy = dev->mt76.phy2;
 452
 453         ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 454                         IEEE80211_IFACE_ITER_RESUME_ALL,
 455                         mt7915_mcu_csa_finish, mphy->hw);
 456 }
 457
 458 static void
 459 mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb)
 460 {
 461         struct mt76_phy *mphy = &dev->mt76.phy;
 462         struct mt7915_mcu_thermal_notify *t;
 463         struct mt7915_phy *phy;
 464
 465         t = (struct mt7915_mcu_thermal_notify *)skb->data;
 466         if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)
 467                 return;
 468
 469         if (t->ctrl.band_idx && dev->mt76.phy2)
 470                 mphy = dev->mt76.phy2;
 471
 472         phy = (struct mt7915_phy *)mphy->priv;
 473         phy->throttle_state = t->ctrl.duty.duty_cycle;
 474 }
 475
 476 static void
 477 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
 478 {
 479         struct mt76_phy *mphy = &dev->mt76.phy;
 480         struct mt7915_mcu_rdd_report *r;
 481
 482         r = (struct mt7915_mcu_rdd_report *)skb->data;
 483
 484         if (r->band_idx && dev->mt76.phy2)
 485                 mphy = dev->mt76.phy2;
 486
 487         ieee80211_radar_detected(mphy->hw);
 488         dev->hw_pattern++;
 489 }
 490
 491 static int
 492 mt7915_mcu_tx_rate_parse(struct mt76_phy *mphy, struct mt7915_mcu_ra_info *ra,
 493                          struct rate_info *rate, u16 r)
 494 {
 495         struct ieee80211_supported_band *sband;
 496         u16 ru_idx = le16_to_cpu(ra->ru_idx);
 497         bool cck = false;
 498
 499         rate->mcs = FIELD_GET(MT_RA_RATE_MCS, r);
 500         rate->nss = FIELD_GET(MT_RA_RATE_NSS, r) + 1;
 501
 502         switch (FIELD_GET(MT_RA_RATE_TX_MODE, r)) {
 503         case MT_PHY_TYPE_CCK:
 504                 cck = true;
 505                 fallthrough;
 506         case MT_PHY_TYPE_OFDM:
 507                 if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
 508                         sband = &mphy->sband_5g.sband;
 509                 else
 510                         sband = &mphy->sband_2g.sband;
 511
 512                 rate->mcs = mt76_get_rate(mphy->dev, sband, rate->mcs, cck);
 513                 rate->legacy = sband->bitrates[rate->mcs].bitrate;
 514                 break;
 515         case MT_PHY_TYPE_HT:
 516         case MT_PHY_TYPE_HT_GF:
 517                 rate->mcs += (rate->nss - 1) * 8;
 518                 if (rate->mcs > 31)
 519                         return -EINVAL;
 520
 521                 rate->flags = RATE_INFO_FLAGS_MCS;
 522                 if (ra->gi)
 523                         rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
 524                 break;
 525         case MT_PHY_TYPE_VHT:
 526                 if (rate->mcs > 9)
 527                         return -EINVAL;
 528
 529                 rate->flags = RATE_INFO_FLAGS_VHT_MCS;
 530                 if (ra->gi)
 531                         rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
 532                 break;
 533         case MT_PHY_TYPE_HE_SU:
 534         case MT_PHY_TYPE_HE_EXT_SU:
 535         case MT_PHY_TYPE_HE_TB:
 536         case MT_PHY_TYPE_HE_MU:
 537                 if (ra->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11)
 538                         return -EINVAL;
 539
 540                 rate->he_gi = ra->gi;
 541                 rate->he_dcm = FIELD_GET(MT_RA_RATE_DCM_EN, r);
 542                 rate->flags = RATE_INFO_FLAGS_HE_MCS;
 543                 break;
 544         default:
 545                 return -EINVAL;
 546         }
 547
 548         if (ru_idx) {
 549                 switch (ru_idx) {
 550                 case 1 ... 2:
 551                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_996;
 552                         break;
 553                 case 3 ... 6:
 554                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_484;
 555                         break;
 556                 case 7 ... 14:
 557                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_242;
 558                         break;
 559                 default:
 560                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_106;
 561                         break;
 562                 }
 563                 rate->bw = RATE_INFO_BW_HE_RU;
 564         } else {
 565                 u8 bw = mt7915_mcu_chan_bw(&mphy->chandef) -
 566                         FIELD_GET(MT_RA_RATE_BW, r);
 567
 568                 switch (bw) {
 569                 case IEEE80211_STA_RX_BW_160:
 570                         rate->bw = RATE_INFO_BW_160;
 571                         break;
 572                 case IEEE80211_STA_RX_BW_80:
 573                         rate->bw = RATE_INFO_BW_80;
 574                         break;
 575                 case IEEE80211_STA_RX_BW_40:
 576                         rate->bw = RATE_INFO_BW_40;
 577                         break;
 578                 default:
 579                         rate->bw = RATE_INFO_BW_20;
 580                         break;
 581                 }
 582         }
 583
 584         return 0;
 585 }
 586
 587 static void
 588 mt7915_mcu_tx_rate_report(struct mt7915_dev *dev, struct sk_buff *skb)
 589 {
 590         struct mt7915_mcu_ra_info *ra = (struct mt7915_mcu_ra_info *)skb->data;
 591         struct rate_info rate = {}, prob_rate = {};
 592         u16 probe = le16_to_cpu(ra->prob_up_rate);
 593         u16 attempts = le16_to_cpu(ra->attempts);
 594         u16 curr = le16_to_cpu(ra->curr_rate);
 595         u16 wcidx = le16_to_cpu(ra->wlan_idx);
 596         struct ieee80211_tx_status status = {};
 597         struct mt76_phy *mphy = &dev->mphy;
 598         struct mt7915_sta_stats *stats;
 599         struct mt7915_sta *msta;
 600         struct mt76_wcid *wcid;
 601
 602         if (wcidx >= MT76_N_WCIDS)
 603                 return;
 604
 605         wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
 606         if (!wcid)
 607                 return;
 608
 609         msta = container_of(wcid, struct mt7915_sta, wcid);
 610         stats = &msta->stats;
 611
 612         if (msta->wcid.ext_phy && dev->mt76.phy2)
 613                 mphy = dev->mt76.phy2;
 614
 615         /* current rate */
 616         if (!mt7915_mcu_tx_rate_parse(mphy, ra, &rate, curr))
 617                 stats->tx_rate = rate;
 618
 619         /* probing rate */
 620         if (!mt7915_mcu_tx_rate_parse(mphy, ra, &prob_rate, probe))
 621                 stats->prob_rate = prob_rate;
 622
 623         if (attempts) {
 624                 u16 success = le16_to_cpu(ra->success);
 625
 626                 stats->per = 1000 * (attempts - success) / attempts;
 627         }
 628
 629         status.sta = wcid_to_sta(wcid);
 630         if (!status.sta)
 631                 return;
 632
 633         status.rate = &stats->tx_rate;
 634         ieee80211_tx_status_ext(mphy->hw, &status);
 635 }
 636
 637 static void
 638 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
 639 {
 640         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 641         const char *data = (char *)&rxd[1];
 642         const char *type;
 643
 644         switch (rxd->s2d_index) {
 645         case 0:
 646                 type = "WM";
 647                 break;
 648         case 2:
 649                 type = "WA";
 650                 break;
 651         default:
 652                 type = "unknown";
 653                 break;
 654         }
 655
 656         wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type,
 657                    (int)(skb->len - sizeof(*rxd)), data);
 658 }
 659
 660 static void
 661 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
 662 {
 663         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 664
 665         switch (rxd->ext_eid) {
 666         case MCU_EXT_EVENT_THERMAL_PROTECT:
 667                 mt7915_mcu_rx_thermal_notify(dev, skb);
 668                 break;
 669         case MCU_EXT_EVENT_RDD_REPORT:
 670                 mt7915_mcu_rx_radar_detected(dev, skb);
 671                 break;
 672         case MCU_EXT_EVENT_CSA_NOTIFY:
 673                 mt7915_mcu_rx_csa_notify(dev, skb);
 674                 break;
 675         case MCU_EXT_EVENT_RATE_REPORT:
 676                 mt7915_mcu_tx_rate_report(dev, skb);
 677                 break;
 678         case MCU_EXT_EVENT_FW_LOG_2_HOST:
 679                 mt7915_mcu_rx_log_message(dev, skb);
 680                 break;
 681         default:
 682                 break;
 683         }
 684 }
 685
 686 static void
 687 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
 688 {
 689         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 690
 691         switch (rxd->eid) {
 692         case MCU_EVENT_EXT:
 693                 mt7915_mcu_rx_ext_event(dev, skb);
 694                 break;
 695         default:
 696                 break;
 697         }
 698         dev_kfree_skb(skb);
 699 }
 700
 701 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
 702 {
 703         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 704
 705         if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
 706             rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 707             rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
 708             rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
 709             rxd->ext_eid == MCU_EXT_EVENT_RATE_REPORT ||
 710             !rxd->seq)
 711                 mt7915_mcu_rx_unsolicited_event(dev, skb);
 712         else
 713                 mt76_mcu_rx_event(&dev->mt76, skb);
 714 }
 715
 716 static struct sk_buff *
 717 mt7915_mcu_alloc_sta_req(struct mt7915_dev *dev, struct mt7915_vif *mvif,
 718                          struct mt7915_sta *msta, int len)
 719 {
 720         struct sta_req_hdr hdr = {
 721                 .bss_idx = mvif->idx,
 722                 .wlan_idx_lo = msta ? to_wcid_lo(msta->wcid.idx) : 0,
 723                 .wlan_idx_hi = msta ? to_wcid_hi(msta->wcid.idx) : 0,
 724                 .muar_idx = msta ? mvif->omac_idx : 0,
 725                 .is_tlv_append = 1,
 726         };
 727         struct sk_buff *skb;
 728
 729         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
 730         if (!skb)
 731                 return ERR_PTR(-ENOMEM);
 732
 733         skb_put_data(skb, &hdr, sizeof(hdr));
 734
 735         return skb;
 736 }
 737
 738 static struct wtbl_req_hdr *
 739 mt7915_mcu_alloc_wtbl_req(struct mt7915_dev *dev, struct mt7915_sta *msta,
 740                           int cmd, void *sta_wtbl, struct sk_buff **skb)
 741 {
 742         struct tlv *sta_hdr = sta_wtbl;
 743         struct wtbl_req_hdr hdr = {
 744                 .wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
 745                 .wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
 746                 .operation = cmd,
 747         };
 748         struct sk_buff *nskb = *skb;
 749
 750         if (!nskb) {
 751                 nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
 752                                           MT7915_WTBL_UPDATE_MAX_SIZE);
 753                 if (!nskb)
 754                         return ERR_PTR(-ENOMEM);
 755
 756                 *skb = nskb;
 757         }
 758
 759         if (sta_hdr)
 760                 sta_hdr->len = cpu_to_le16(sizeof(hdr));
 761
 762         return skb_put_data(nskb, &hdr, sizeof(hdr));
 763 }
 764
 765 static struct tlv *
 766 mt7915_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
 767                           void *sta_ntlv, void *sta_wtbl)
 768 {
 769         struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
 770         struct tlv *sta_hdr = sta_wtbl;
 771         struct tlv *ptlv, tlv = {
 772                 .tag = cpu_to_le16(tag),
 773                 .len = cpu_to_le16(len),
 774         };
 775         u16 ntlv;
 776
 777         ptlv = skb_put(skb, len);
 778         memcpy(ptlv, &tlv, sizeof(tlv));
 779
 780         ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
 781         ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
 782
 783         if (sta_hdr) {
 784                 u16 size = le16_to_cpu(sta_hdr->len);
 785
 786                 sta_hdr->len = cpu_to_le16(size + len);
 787         }
 788
 789         return ptlv;
 790 }
 791
 792 static struct tlv *
 793 mt7915_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
 794 {
 795         return mt7915_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
 796 }
 797
 798 static struct tlv *
 799 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
 800                              __le16 *sub_ntlv, __le16 *len)
 801 {
 802         struct tlv *ptlv, tlv = {
 803                 .tag = cpu_to_le16(sub_tag),
 804                 .len = cpu_to_le16(sub_len),
 805         };
 806
 807         ptlv = skb_put(skb, sub_len);
 808         memcpy(ptlv, &tlv, sizeof(tlv));
 809
 810         le16_add_cpu(sub_ntlv, 1);
 811         le16_add_cpu(len, sub_len);
 812
 813         return ptlv;
 814 }
 815
 816 /** bss info **/
 817 static int
 818 mt7915_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 819                          struct mt7915_phy *phy, bool enable)
 820 {
 821         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 822         struct bss_info_basic *bss;
 823         u16 wlan_idx = mvif->sta.wcid.idx;
 824         u32 type = NETWORK_INFRA;
 825         struct tlv *tlv;
 826
 827         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
 828
 829         switch (vif->type) {
 830         case NL80211_IFTYPE_MESH_POINT:
 831         case NL80211_IFTYPE_AP:
 832         case NL80211_IFTYPE_MONITOR:
 833                 break;
 834         case NL80211_IFTYPE_STATION:
 835                 /* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
 836                 if (enable) {
 837                         struct ieee80211_sta *sta;
 838                         struct mt7915_sta *msta;
 839
 840                         rcu_read_lock();
 841                         sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
 842                         if (!sta) {
 843                                 rcu_read_unlock();
 844                                 return -EINVAL;
 845                         }
 846
 847                         msta = (struct mt7915_sta *)sta->drv_priv;
 848                         wlan_idx = msta->wcid.idx;
 849                         rcu_read_unlock();
 850                 }
 851                 break;
 852         case NL80211_IFTYPE_ADHOC:
 853                 type = NETWORK_IBSS;
 854                 break;
 855         default:
 856                 WARN_ON(1);
 857                 break;
 858         }
 859
 860         bss = (struct bss_info_basic *)tlv;
 861         bss->network_type = cpu_to_le32(type);
 862         bss->bmc_wcid_lo = to_wcid_lo(wlan_idx);
 863         bss->bmc_wcid_hi = to_wcid_hi(wlan_idx);
 864         bss->wmm_idx = mvif->wmm_idx;
 865         bss->active = enable;
 866
 867         if (vif->type != NL80211_IFTYPE_MONITOR) {
 868                 memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
 869                 bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
 870                 bss->dtim_period = vif->bss_conf.dtim_period;
 871                 bss->phy_mode = mt7915_get_phy_mode(vif, NULL);
 872         } else {
 873                 memcpy(bss->bssid, phy->mt76->macaddr, ETH_ALEN);
 874         }
 875
 876         return 0;
 877 }
 878
 879 static void
 880 mt7915_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
 881 {
 882         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 883         struct bss_info_omac *omac;
 884         struct tlv *tlv;
 885         u32 type = 0;
 886         u8 idx;
 887
 888         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
 889
 890         switch (vif->type) {
 891         case NL80211_IFTYPE_MONITOR:
 892         case NL80211_IFTYPE_MESH_POINT:
 893         case NL80211_IFTYPE_AP:
 894                 type = CONNECTION_INFRA_AP;
 895                 break;
 896         case NL80211_IFTYPE_STATION:
 897                 type = CONNECTION_INFRA_STA;
 898                 break;
 899         case NL80211_IFTYPE_ADHOC:
 900                 type = CONNECTION_IBSS_ADHOC;
 901                 break;
 902         default:
 903                 WARN_ON(1);
 904                 break;
 905         }
 906
 907         omac = (struct bss_info_omac *)tlv;
 908         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
 909         omac->conn_type = cpu_to_le32(type);
 910         omac->omac_idx = mvif->omac_idx;
 911         omac->band_idx = mvif->band_idx;
 912         omac->hw_bss_idx = idx;
 913 }
 914
 915 struct mt7915_he_obss_narrow_bw_ru_data {
 916         bool tolerated;
 917 };
 918
 919 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
 920                                                    struct cfg80211_bss *bss,
 921                                                    void *_data)
 922 {
 923         struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
 924         const struct element *elem;
 925
 926         elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
 927
 928         if (!elem || elem->datalen < 10 ||
 929             !(elem->data[10] &
 930               WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
 931                 data->tolerated = false;
 932 }
 933
 934 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
 935                                               struct ieee80211_vif *vif)
 936 {
 937         struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
 938                 .tolerated = true,
 939         };
 940
 941         if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
 942                 return false;
 943
 944         cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
 945                           mt7915_check_he_obss_narrow_bw_ru_iter,
 946                           &iter_data);
 947
 948         /*
 949          * If there is at least one AP on radar channel that cannot
 950          * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
 951          */
 952         return !iter_data.tolerated;
 953 }
 954
 955 static void
 956 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 957                         struct mt7915_phy *phy)
 958 {
 959         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 960         struct bss_info_rf_ch *ch;
 961         struct tlv *tlv;
 962         int freq1 = chandef->center_freq1;
 963
 964         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
 965
 966         ch = (struct bss_info_rf_ch *)tlv;
 967         ch->pri_ch = chandef->chan->hw_value;
 968         ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
 969         ch->bw = mt7915_mcu_chan_bw(chandef);
 970
 971         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
 972                 int freq2 = chandef->center_freq2;
 973
 974                 ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
 975         }
 976
 977         if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
 978                 struct mt7915_dev *dev = phy->dev;
 979                 struct mt76_phy *mphy = &dev->mt76.phy;
 980                 bool ext_phy = phy != &dev->phy;
 981
 982                 if (ext_phy && dev->mt76.phy2)
 983                         mphy = dev->mt76.phy2;
 984
 985                 ch->he_ru26_block =
 986                         mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
 987                 ch->he_all_disable = false;
 988         } else {
 989                 ch->he_all_disable = true;
 990         }
 991 }
 992
 993 static void
 994 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 995                       struct mt7915_phy *phy)
 996 {
 997         int max_nss = hweight8(phy->mt76->chainmask);
 998         struct bss_info_ra *ra;
 999         struct tlv *tlv;
1000
1001         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
1002
1003         ra = (struct bss_info_ra *)tlv;
1004         ra->op_mode = vif->type == NL80211_IFTYPE_AP;
1005         ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
1006         ra->short_preamble = true;
1007         ra->tx_streams = max_nss;
1008         ra->rx_streams = max_nss;
1009         ra->algo = 4;
1010         ra->train_up_rule = 2;
1011         ra->train_up_high_thres = 110;
1012         ra->train_up_rule_rssi = -70;
1013         ra->low_traffic_thres = 2;
1014         ra->phy_cap = cpu_to_le32(0xfdf);
1015         ra->interval = cpu_to_le32(500);
1016         ra->fast_interval = cpu_to_le32(100);
1017 }
1018
1019 static void
1020 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1021                       struct mt7915_phy *phy)
1022 {
1023 #define DEFAULT_HE_PE_DURATION          4
1024 #define DEFAULT_HE_DURATION_RTS_THRES   1023
1025         const struct ieee80211_sta_he_cap *cap;
1026         struct bss_info_he *he;
1027         struct tlv *tlv;
1028
1029         cap = mt7915_get_he_phy_cap(phy, vif);
1030
1031         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
1032
1033         he = (struct bss_info_he *)tlv;
1034         he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
1035         if (!he->he_pe_duration)
1036                 he->he_pe_duration = DEFAULT_HE_PE_DURATION;
1037
1038         he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
1039         if (!he->he_rts_thres)
1040                 he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
1041
1042         he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
1043         he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
1044         he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
1045 }
1046
1047 static void
1048 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
1049 {
1050 #define TXD_CMP_MAP1            GENMASK(15, 0)
1051 #define TXD_CMP_MAP2            (GENMASK(31, 0) & ~BIT(23))
1052         struct bss_info_hw_amsdu *amsdu;
1053         struct tlv *tlv;
1054
1055         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
1056
1057         amsdu = (struct bss_info_hw_amsdu *)tlv;
1058         amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
1059         amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
1060         amsdu->trig_thres = cpu_to_le16(2);
1061         amsdu->enable = true;
1062 }
1063
1064 static void
1065 mt7915_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7915_vif *mvif)
1066 {
1067 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
1068 #define BCN_TX_ESTIMATE_TIME    (4096 + 20)
1069         struct bss_info_ext_bss *ext;
1070         int ext_bss_idx, tsf_offset;
1071         struct tlv *tlv;
1072
1073         ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
1074         if (ext_bss_idx < 0)
1075                 return;
1076
1077         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
1078
1079         ext = (struct bss_info_ext_bss *)tlv;
1080         tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
1081         ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
1082 }
1083
1084 static void
1085 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
1086 {
1087         struct bss_info_bmc_rate *bmc;
1088         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
1089         enum nl80211_band band = chandef->chan->band;
1090         struct tlv *tlv;
1091
1092         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
1093
1094         bmc = (struct bss_info_bmc_rate *)tlv;
1095         if (band == NL80211_BAND_2GHZ) {
1096                 bmc->short_preamble = true;
1097         } else {
1098                 bmc->bc_trans = cpu_to_le16(0x2000);
1099                 bmc->mc_trans = cpu_to_le16(0x2080);
1100         }
1101 }
1102
1103 static int
1104 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1105                        bool bssid, bool enable)
1106 {
1107         struct mt7915_dev *dev = phy->dev;
1108         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1109         u32 idx = mvif->omac_idx - REPEATER_BSSID_START;
1110         u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
1111         const u8 *addr = vif->addr;
1112         struct {
1113                 u8 mode;
1114                 u8 force_clear;
1115                 u8 clear_bitmap[8];
1116                 u8 entry_count;
1117                 u8 write;
1118                 u8 band;
1119
1120                 u8 index;
1121                 u8 bssid;
1122                 u8 addr[ETH_ALEN];
1123         } __packed req = {
1124                 .mode = !!mask || enable,
1125                 .entry_count = 1,
1126                 .write = 1,
1127                 .band = phy != &dev->phy,
1128                 .index = idx * 2 + bssid,
1129         };
1130
1131         if (bssid)
1132                 addr = vif->bss_conf.bssid;
1133
1134         if (enable)
1135                 ether_addr_copy(req.addr, addr);
1136
1137         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
1138                                  sizeof(req), true);
1139 }
1140
1141 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
1142                             struct ieee80211_vif *vif, int enable)
1143 {
1144         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1145         struct sk_buff *skb;
1146
1147         if (mvif->omac_idx >= REPEATER_BSSID_START) {
1148                 mt7915_mcu_muar_config(phy, vif, false, enable);
1149                 mt7915_mcu_muar_config(phy, vif, true, enable);
1150         }
1151
1152         skb = mt7915_mcu_alloc_sta_req(phy->dev, mvif, NULL,
1153                                        MT7915_BSS_UPDATE_MAX_SIZE);
1154         if (IS_ERR(skb))
1155                 return PTR_ERR(skb);
1156
1157         /* bss_omac must be first */
1158         if (enable)
1159                 mt7915_mcu_bss_omac_tlv(skb, vif);
1160
1161         mt7915_mcu_bss_basic_tlv(skb, vif, phy, enable);
1162
1163         if (vif->type == NL80211_IFTYPE_MONITOR)
1164                 goto out;
1165
1166         if (enable) {
1167                 mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
1168                 mt7915_mcu_bss_bmc_tlv(skb, phy);
1169                 mt7915_mcu_bss_ra_tlv(skb, vif, phy);
1170                 mt7915_mcu_bss_hw_amsdu_tlv(skb);
1171
1172                 if (vif->bss_conf.he_support)
1173                         mt7915_mcu_bss_he_tlv(skb, vif, phy);
1174
1175                 if (mvif->omac_idx >= EXT_BSSID_START &&
1176                     mvif->omac_idx < REPEATER_BSSID_START)
1177                         mt7915_mcu_bss_ext_tlv(skb, mvif);
1178         }
1179 out:
1180         return mt76_mcu_skb_send_msg(&phy->dev->mt76, skb,
1181                                      MCU_EXT_CMD(BSS_INFO_UPDATE), true);
1182 }
1183
1184 /** starec & wtbl **/
1185 static int
1186 mt7915_mcu_sta_key_tlv(struct mt7915_sta *msta, struct sk_buff *skb,
1187                        struct ieee80211_key_conf *key, enum set_key_cmd cmd)
1188 {
1189         struct mt7915_sta_key_conf *bip = &msta->bip;
1190         struct sta_rec_sec *sec;
1191         struct tlv *tlv;
1192         u32 len = sizeof(*sec);
1193
1194         tlv = mt7915_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
1195
1196         sec = (struct sta_rec_sec *)tlv;
1197         sec->add = cmd;
1198
1199         if (cmd == SET_KEY) {
1200                 struct sec_key *sec_key;
1201                 u8 cipher;
1202
1203                 cipher = mt7915_mcu_get_cipher(key->cipher);
1204                 if (cipher == MT_CIPHER_NONE)
1205                         return -EOPNOTSUPP;
1206
1207                 sec_key = &sec->key[0];
1208                 sec_key->cipher_len = sizeof(*sec_key);
1209
1210                 if (cipher == MCU_CIPHER_BIP_CMAC_128) {
1211                         sec_key->cipher_id = MCU_CIPHER_AES_CCMP;
1212                         sec_key->key_id = bip->keyidx;
1213                         sec_key->key_len = 16;
1214                         memcpy(sec_key->key, bip->key, 16);
1215
1216                         sec_key = &sec->key[1];
1217                         sec_key->cipher_id = MCU_CIPHER_BIP_CMAC_128;
1218                         sec_key->cipher_len = sizeof(*sec_key);
1219                         sec_key->key_len = 16;
1220                         memcpy(sec_key->key, key->key, 16);
1221
1222                         sec->n_cipher = 2;
1223                 } else {
1224                         sec_key->cipher_id = cipher;
1225                         sec_key->key_id = key->keyidx;
1226                         sec_key->key_len = key->keylen;
1227                         memcpy(sec_key->key, key->key, key->keylen);
1228
1229                         if (cipher == MCU_CIPHER_TKIP) {
1230                                 /* Rx/Tx MIC keys are swapped */
1231                                 memcpy(sec_key->key + 16, key->key + 24, 8);
1232                                 memcpy(sec_key->key + 24, key->key + 16, 8);
1233                         }
1234
1235                         /* store key_conf for BIP batch update */
1236                         if (cipher == MCU_CIPHER_AES_CCMP) {
1237                                 memcpy(bip->key, key->key, key->keylen);
1238                                 bip->keyidx = key->keyidx;
1239                         }
1240
1241                         len -= sizeof(*sec_key);
1242                         sec->n_cipher = 1;
1243                 }
1244         } else {
1245                 len -= sizeof(sec->key);
1246                 sec->n_cipher = 0;
1247         }
1248         sec->len = cpu_to_le16(len);
1249
1250         return 0;
1251 }
1252
1253 int mt7915_mcu_add_key(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1254                        struct mt7915_sta *msta, struct ieee80211_key_conf *key,
1255                        enum set_key_cmd cmd)
1256 {
1257         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1258         struct sk_buff *skb;
1259         int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_sec);
1260         int ret;
1261
1262         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1263         if (IS_ERR(skb))
1264                 return PTR_ERR(skb);
1265
1266         ret = mt7915_mcu_sta_key_tlv(msta, skb, key, cmd);
1267         if (ret)
1268                 return ret;
1269
1270         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1271                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1272 }
1273
1274 static void
1275 mt7915_mcu_sta_ba_tlv(struct sk_buff *skb,
1276                       struct ieee80211_ampdu_params *params,
1277                       bool enable, bool tx)
1278 {
1279         struct sta_rec_ba *ba;
1280         struct tlv *tlv;
1281
1282         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
1283
1284         ba = (struct sta_rec_ba *)tlv;
1285         ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
1286         ba->winsize = cpu_to_le16(params->buf_size);
1287         ba->ssn = cpu_to_le16(params->ssn);
1288         ba->ba_en = enable << params->tid;
1289         ba->amsdu = params->amsdu;
1290         ba->tid = params->tid;
1291 }
1292
1293 static void
1294 mt7915_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1295                        struct ieee80211_ampdu_params *params,
1296                        bool enable, bool tx, void *sta_wtbl,
1297                        void *wtbl_tlv)
1298 {
1299         struct wtbl_ba *ba;
1300         struct tlv *tlv;
1301
1302         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1303                                         wtbl_tlv, sta_wtbl);
1304
1305         ba = (struct wtbl_ba *)tlv;
1306         ba->tid = params->tid;
1307
1308         if (tx) {
1309                 ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1310                 ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1311                 ba->ba_en = enable;
1312         } else {
1313                 memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1314                 ba->ba_type = MT_BA_TYPE_RECIPIENT;
1315                 ba->rst_ba_tid = params->tid;
1316                 ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1317                 ba->rst_ba_sb = 1;
1318         }
1319
1320         if (enable && tx)
1321                 ba->ba_winsize = cpu_to_le16(params->buf_size);
1322 }
1323
1324 static int
1325 mt7915_mcu_sta_ba(struct mt7915_dev *dev,
1326                   struct ieee80211_ampdu_params *params,
1327                   bool enable, bool tx)
1328 {
1329         struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
1330         struct mt7915_vif *mvif = msta->vif;
1331         struct wtbl_req_hdr *wtbl_hdr;
1332         struct tlv *sta_wtbl;
1333         struct sk_buff *skb;
1334         int ret;
1335
1336         if (enable && tx && !params->amsdu)
1337                 msta->wcid.amsdu = false;
1338
1339         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1340                                        MT7915_STA_UPDATE_MAX_SIZE);
1341         if (IS_ERR(skb))
1342                 return PTR_ERR(skb);
1343
1344         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1345
1346         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1347                                              &skb);
1348         if (IS_ERR(wtbl_hdr))
1349                 return PTR_ERR(wtbl_hdr);
1350
1351         mt7915_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1352
1353         ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1354                                     MCU_EXT_CMD(STA_REC_UPDATE), true);
1355         if (ret)
1356                 return ret;
1357
1358         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1359                                        MT7915_STA_UPDATE_MAX_SIZE);
1360         if (IS_ERR(skb))
1361                 return PTR_ERR(skb);
1362
1363         mt7915_mcu_sta_ba_tlv(skb, params, enable, tx);
1364
1365         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1366                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1367 }
1368
1369 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
1370                          struct ieee80211_ampdu_params *params,
1371                          bool enable)
1372 {
1373         return mt7915_mcu_sta_ba(dev, params, enable, true);
1374 }
1375
1376 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
1377                          struct ieee80211_ampdu_params *params,
1378                          bool enable)
1379 {
1380         return mt7915_mcu_sta_ba(dev, params, enable, false);
1381 }
1382
1383 static void
1384 mt7915_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1385                             struct ieee80211_sta *sta, void *sta_wtbl,
1386                             void *wtbl_tlv)
1387 {
1388         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1389         struct wtbl_generic *generic;
1390         struct wtbl_rx *rx;
1391         struct tlv *tlv;
1392
1393         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1394                                         wtbl_tlv, sta_wtbl);
1395
1396         generic = (struct wtbl_generic *)tlv;
1397
1398         if (sta) {
1399                 memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1400                 generic->partial_aid = cpu_to_le16(sta->aid);
1401                 generic->muar_idx = mvif->omac_idx;
1402                 generic->qos = sta->wme;
1403         } else {
1404                 /* use BSSID in station mode */
1405                 if (vif->type == NL80211_IFTYPE_STATION)
1406                         memcpy(generic->peer_addr, vif->bss_conf.bssid,
1407                                ETH_ALEN);
1408                 else
1409                         eth_broadcast_addr(generic->peer_addr);
1410
1411                 generic->muar_idx = 0xe;
1412         }
1413
1414         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1415                                         wtbl_tlv, sta_wtbl);
1416
1417         rx = (struct wtbl_rx *)tlv;
1418         rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1419         rx->rca2 = 1;
1420         rx->rv = 1;
1421 }
1422
1423 static void
1424 mt7915_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1425                          struct ieee80211_sta *sta, bool enable)
1426 {
1427 #define EXTRA_INFO_VER          BIT(0)
1428 #define EXTRA_INFO_NEW          BIT(1)
1429         struct sta_rec_basic *basic;
1430         struct tlv *tlv;
1431
1432         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
1433
1434         basic = (struct sta_rec_basic *)tlv;
1435         basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
1436
1437         if (enable) {
1438                 basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
1439                 basic->conn_state = CONN_STATE_PORT_SECURE;
1440         } else {
1441                 basic->conn_state = CONN_STATE_DISCONNECT;
1442         }
1443
1444         if (!sta) {
1445                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
1446                 eth_broadcast_addr(basic->peer_addr);
1447                 return;
1448         }
1449
1450         switch (vif->type) {
1451         case NL80211_IFTYPE_MESH_POINT:
1452         case NL80211_IFTYPE_AP:
1453                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1454                 break;
1455         case NL80211_IFTYPE_STATION:
1456                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1457                 break;
1458         case NL80211_IFTYPE_ADHOC:
1459                 basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1460                 break;
1461         default:
1462                 WARN_ON(1);
1463                 break;
1464         }
1465
1466         memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
1467         basic->aid = cpu_to_le16(sta->aid);
1468         basic->qos = sta->wme;
1469 }
1470
1471 static void
1472 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1473 {
1474         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1475         struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1476         struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1477         enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
1478         const u16 *mcs_mask = msta->vif->bitrate_mask.control[band].he_mcs;
1479         struct sta_rec_he *he;
1480         struct tlv *tlv;
1481         u32 cap = 0;
1482
1483         tlv = mt7915_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
1484
1485         he = (struct sta_rec_he *)tlv;
1486
1487         if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
1488                 cap |= STA_REC_HE_CAP_HTC;
1489
1490         if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
1491                 cap |= STA_REC_HE_CAP_BSR;
1492
1493         if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
1494                 cap |= STA_REC_HE_CAP_OM;
1495
1496         if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
1497                 cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
1498
1499         if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
1500                 cap |= STA_REC_HE_CAP_BQR;
1501
1502         if (elem->phy_cap_info[0] &
1503             (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
1504              IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
1505                 cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
1506
1507         if (elem->phy_cap_info[1] &
1508             IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD)
1509                 cap |= STA_REC_HE_CAP_LDPC;
1510
1511         if (elem->phy_cap_info[1] &
1512             IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
1513                 cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
1514
1515         if (elem->phy_cap_info[2] &
1516             IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
1517                 cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
1518
1519         if (elem->phy_cap_info[2] &
1520             IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
1521                 cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
1522
1523         if (elem->phy_cap_info[2] &
1524             IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
1525                 cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
1526
1527         if (elem->phy_cap_info[6] &
1528             IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
1529                 cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
1530
1531         if (elem->phy_cap_info[7] &
1532             IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
1533                 cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
1534
1535         if (elem->phy_cap_info[7] &
1536             IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
1537                 cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
1538
1539         if (elem->phy_cap_info[7] &
1540             IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
1541                 cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
1542
1543         if (elem->phy_cap_info[8] &
1544             IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
1545                 cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
1546
1547         if (elem->phy_cap_info[8] &
1548             IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
1549                 cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
1550
1551         if (elem->phy_cap_info[9] &
1552             IEEE80211_HE_PHY_CAP9_NON_TRIGGERED_CQI_FEEDBACK)
1553                 cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
1554
1555         if (elem->phy_cap_info[9] &
1556             IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
1557                 cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
1558
1559         if (elem->phy_cap_info[9] &
1560             IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
1561                 cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
1562
1563         he->he_cap = cpu_to_le32(cap);
1564
1565         switch (sta->bandwidth) {
1566         case IEEE80211_STA_RX_BW_160:
1567                 if (elem->phy_cap_info[0] &
1568                     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
1569                         mt7915_mcu_set_sta_he_mcs(sta,
1570                                                   &he->max_nss_mcs[CMD_HE_MCS_BW8080],
1571                                                   mcs_mask);
1572
1573                 mt7915_mcu_set_sta_he_mcs(sta,
1574                                           &he->max_nss_mcs[CMD_HE_MCS_BW160],
1575                                           mcs_mask);
1576                 fallthrough;
1577         default:
1578                 mt7915_mcu_set_sta_he_mcs(sta,
1579                                           &he->max_nss_mcs[CMD_HE_MCS_BW80],
1580                                           mcs_mask);
1581                 break;
1582         }
1583
1584         he->t_frame_dur =
1585                 HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1586         he->max_ampdu_exp =
1587                 HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
1588
1589         he->bw_set =
1590                 HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
1591         he->device_class =
1592                 HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
1593         he->punc_pream_rx =
1594                 HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1595
1596         he->dcm_tx_mode =
1597                 HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
1598         he->dcm_tx_max_nss =
1599                 HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
1600         he->dcm_rx_mode =
1601                 HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
1602         he->dcm_rx_max_nss =
1603                 HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
1604         he->dcm_rx_max_nss =
1605                 HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
1606
1607         he->pkt_ext = 2;
1608 }
1609
1610 static void
1611 mt7915_mcu_sta_uapsd_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1612                      struct ieee80211_vif *vif)
1613 {
1614         struct sta_rec_uapsd *uapsd;
1615         struct tlv *tlv;
1616
1617         if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
1618                 return;
1619
1620         tlv = mt7915_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
1621         uapsd = (struct sta_rec_uapsd *)tlv;
1622
1623         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
1624                 uapsd->dac_map |= BIT(3);
1625                 uapsd->tac_map |= BIT(3);
1626         }
1627         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
1628                 uapsd->dac_map |= BIT(2);
1629                 uapsd->tac_map |= BIT(2);
1630         }
1631         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
1632                 uapsd->dac_map |= BIT(1);
1633                 uapsd->tac_map |= BIT(1);
1634         }
1635         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
1636                 uapsd->dac_map |= BIT(0);
1637                 uapsd->tac_map |= BIT(0);
1638         }
1639         uapsd->max_sp = sta->max_sp;
1640 }
1641
1642 static void
1643 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1644 {
1645         struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1646         struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1647         struct sta_rec_muru *muru;
1648         struct tlv *tlv;
1649
1650         tlv = mt7915_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
1651
1652         muru = (struct sta_rec_muru *)tlv;
1653         muru->cfg.ofdma_dl_en = true;
1654         muru->cfg.mimo_dl_en = true;
1655
1656         muru->ofdma_dl.punc_pream_rx =
1657                 HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1658         muru->ofdma_dl.he_20m_in_40m_2g =
1659                 HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
1660         muru->ofdma_dl.he_20m_in_160m =
1661                 HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1662         muru->ofdma_dl.he_80m_in_160m =
1663                 HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1664         muru->ofdma_dl.lt16_sigb = 0;
1665         muru->ofdma_dl.rx_su_comp_sigb = 0;
1666         muru->ofdma_dl.rx_su_non_comp_sigb = 0;
1667
1668         muru->ofdma_ul.t_frame_dur =
1669                 HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1670         muru->ofdma_ul.mu_cascading =
1671                 HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
1672         muru->ofdma_ul.uo_ra =
1673                 HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
1674         muru->ofdma_ul.he_2x996_tone = 0;
1675         muru->ofdma_ul.rx_t_frame_11ac = 0;
1676
1677         muru->mimo_dl.vht_mu_bfee =
1678                 !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1679         muru->mimo_dl.partial_bw_dl_mimo =
1680                 HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
1681
1682         muru->mimo_ul.full_ul_mimo =
1683                 HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
1684         muru->mimo_ul.partial_ul_mimo =
1685                 HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
1686 }
1687
1688 static void
1689 mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1690 {
1691         struct sta_rec_vht *vht;
1692         struct tlv *tlv;
1693
1694         tlv = mt7915_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1695
1696         vht = (struct sta_rec_vht *)tlv;
1697         vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1698         vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1699         vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1700 }
1701
1702 static void
1703 mt7915_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1704 {
1705         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1706         struct sta_rec_amsdu *amsdu;
1707         struct tlv *tlv;
1708
1709         if (!sta->max_amsdu_len)
1710             return;
1711
1712         tlv = mt7915_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1713         amsdu = (struct sta_rec_amsdu *)tlv;
1714         amsdu->max_amsdu_num = 8;
1715         amsdu->amsdu_en = true;
1716         amsdu->max_mpdu_size = sta->max_amsdu_len >=
1717                                IEEE80211_MAX_MPDU_LEN_VHT_7991;
1718         msta->wcid.amsdu = true;
1719 }
1720
1721 static bool
1722 mt7915_hw_amsdu_supported(struct ieee80211_vif *vif)
1723 {
1724         switch (vif->type) {
1725         case NL80211_IFTYPE_AP:
1726         case NL80211_IFTYPE_STATION:
1727                 return true;
1728         default:
1729                 return false;
1730         }
1731 }
1732
1733 static void
1734 mt7915_mcu_sta_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1735                    struct ieee80211_sta *sta, struct ieee80211_vif *vif)
1736 {
1737         struct tlv *tlv;
1738
1739         /* starec ht */
1740         if (sta->ht_cap.ht_supported) {
1741                 struct sta_rec_ht *ht;
1742
1743                 tlv = mt7915_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1744                 ht = (struct sta_rec_ht *)tlv;
1745                 ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1746
1747                 if (mt7915_hw_amsdu_supported(vif))
1748                         mt7915_mcu_sta_amsdu_tlv(skb, sta);
1749         }
1750
1751         /* starec he */
1752         if (sta->he_cap.has_he)
1753                 mt7915_mcu_sta_he_tlv(skb, sta);
1754
1755         /* starec uapsd */
1756         mt7915_mcu_sta_uapsd_tlv(skb, sta, vif);
1757 }
1758
1759 static void
1760 mt7915_mcu_wtbl_smps_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1761                          void *sta_wtbl, void *wtbl_tlv)
1762 {
1763         struct wtbl_smps *smps;
1764         struct tlv *tlv;
1765
1766         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1767                                         wtbl_tlv, sta_wtbl);
1768         smps = (struct wtbl_smps *)tlv;
1769
1770         if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC)
1771                 smps->smps = true;
1772 }
1773
1774 static void
1775 mt7915_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1776                        void *sta_wtbl, void *wtbl_tlv)
1777 {
1778         struct wtbl_ht *ht = NULL;
1779         struct tlv *tlv;
1780
1781         /* wtbl ht */
1782         if (sta->ht_cap.ht_supported) {
1783                 tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1784                                                 wtbl_tlv, sta_wtbl);
1785                 ht = (struct wtbl_ht *)tlv;
1786                 ht->ldpc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
1787                 ht->af = sta->ht_cap.ampdu_factor;
1788                 ht->mm = sta->ht_cap.ampdu_density;
1789                 ht->ht = true;
1790         }
1791
1792         /* wtbl vht */
1793         if (sta->vht_cap.vht_supported) {
1794                 struct wtbl_vht *vht;
1795                 u8 af;
1796
1797                 tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1798                                                 wtbl_tlv, sta_wtbl);
1799                 vht = (struct wtbl_vht *)tlv;
1800                 vht->ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
1801                 vht->vht = true;
1802
1803                 af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1804                                sta->vht_cap.cap);
1805                 if (ht)
1806                         ht->af = max_t(u8, ht->af, af);
1807         }
1808
1809         mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_tlv);
1810 }
1811
1812 static void
1813 mt7915_mcu_wtbl_hdr_trans_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1814                               struct ieee80211_sta *sta,
1815                               void *sta_wtbl, void *wtbl_tlv)
1816 {
1817         struct mt7915_sta *msta;
1818         struct wtbl_hdr_trans *htr = NULL;
1819         struct tlv *tlv;
1820
1821         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HDR_TRANS, sizeof(*htr),
1822                                         wtbl_tlv, sta_wtbl);
1823         htr = (struct wtbl_hdr_trans *)tlv;
1824         htr->no_rx_trans = true;
1825         if (vif->type == NL80211_IFTYPE_STATION)
1826                 htr->to_ds = true;
1827         else
1828                 htr->from_ds = true;
1829
1830         if (!sta)
1831                 return;
1832
1833         msta = (struct mt7915_sta *)sta->drv_priv;
1834         htr->no_rx_trans = !test_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
1835         if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags)) {
1836                 htr->to_ds = true;
1837                 htr->from_ds = true;
1838         }
1839 }
1840
1841 int mt7915_mcu_sta_update_hdr_trans(struct mt7915_dev *dev,
1842                                     struct ieee80211_vif *vif,
1843                                     struct ieee80211_sta *sta)
1844 {
1845         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1846         struct wtbl_req_hdr *wtbl_hdr;
1847         struct sk_buff *skb;
1848
1849         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, MT7915_WTBL_UPDATE_MAX_SIZE);
1850         if (!skb)
1851                 return -ENOMEM;
1852
1853         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1854         if (IS_ERR(wtbl_hdr))
1855                 return PTR_ERR(wtbl_hdr);
1856
1857         mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, NULL, wtbl_hdr);
1858
1859         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD(WTBL_UPDATE),
1860                                      true);
1861 }
1862
1863 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1864                         struct ieee80211_sta *sta)
1865 {
1866         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1867         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1868         struct wtbl_req_hdr *wtbl_hdr;
1869         struct tlv *sta_wtbl;
1870         struct sk_buff *skb;
1871
1872         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1873                                        MT7915_STA_UPDATE_MAX_SIZE);
1874         if (IS_ERR(skb))
1875                 return PTR_ERR(skb);
1876
1877         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1878
1879         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1880                                              &skb);
1881         if (IS_ERR(wtbl_hdr))
1882                 return PTR_ERR(wtbl_hdr);
1883
1884         mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1885
1886         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1887                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1888 }
1889
1890 static void
1891 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1892 {
1893         bf->bf_cap = MT_EBF;
1894         bf->sounding_phy = MT_PHY_TYPE_OFDM;
1895         bf->ndp_rate = 0;                               /* mcs0 */
1896         bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;      /* ofdm 24m */
1897         bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT; /* ofdm 24m */
1898 }
1899
1900 static void
1901 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1902                        struct sta_rec_bf *bf)
1903 {
1904         struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
1905         u8 n = 0;
1906
1907         bf->tx_mode = MT_PHY_TYPE_HT;
1908         bf->bf_cap = MT_IBF;
1909
1910         if (mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF &&
1911             (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1912                 n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1913                               mcs->tx_params);
1914         else if (mcs->rx_mask[3])
1915                 n = 3;
1916         else if (mcs->rx_mask[2])
1917                 n = 2;
1918         else if (mcs->rx_mask[1])
1919                 n = 1;
1920
1921         bf->nr = hweight8(phy->mt76->chainmask) - 1;
1922         bf->nc = min_t(u8, bf->nr, n);
1923         bf->ibf_ncol = n;
1924 }
1925
1926 static void
1927 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1928                         struct sta_rec_bf *bf, bool explicit)
1929 {
1930         struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1931         struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1932         u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1933         u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1934         u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1935
1936         bf->tx_mode = MT_PHY_TYPE_VHT;
1937
1938         if (explicit) {
1939                 u8 bfee_nr, bfer_nr;
1940
1941                 mt7915_mcu_sta_sounding_rate(bf);
1942                 bfee_nr = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1943                                     pc->cap);
1944                 bfer_nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1945                                     vc->cap);
1946                 bf->nr = min_t(u8, min_t(u8, bfer_nr, bfee_nr), tx_ant);
1947                 bf->nc = min_t(u8, nss_mcs, bf->nr);
1948                 bf->ibf_ncol = bf->nc;
1949
1950                 if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1951                         bf->nr = 1;
1952         } else {
1953                 bf->bf_cap = MT_IBF;
1954                 bf->nr = tx_ant;
1955                 bf->nc = min_t(u8, nss_mcs, bf->nr);
1956                 bf->ibf_ncol = nss_mcs;
1957
1958                 if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1959                         bf->ibf_nrow = 1;
1960         }
1961 }
1962
1963 static void
1964 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1965                        struct mt7915_phy *phy, struct sta_rec_bf *bf)
1966 {
1967         struct ieee80211_sta_he_cap *pc = &sta->he_cap;
1968         struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1969         const struct ieee80211_sta_he_cap *vc = mt7915_get_he_phy_cap(phy, vif);
1970         const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1971         u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1972         u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1973         u8 bfee_nr, bfer_nr;
1974
1975         bf->tx_mode = MT_PHY_TYPE_HE_SU;
1976         mt7915_mcu_sta_sounding_rate(bf);
1977         bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1978                                 pe->phy_cap_info[6]);
1979         bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1980                                 pe->phy_cap_info[6]);
1981         bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1982                          ve->phy_cap_info[5]);
1983         bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1984                          pe->phy_cap_info[4]);
1985         bf->nr = min_t(u8, bfer_nr, bfee_nr);
1986         bf->nc = min_t(u8, nss_mcs, bf->nr);
1987         bf->ibf_ncol = bf->nc;
1988
1989         if (sta->bandwidth != IEEE80211_STA_RX_BW_160)
1990                 return;
1991
1992         /* go over for 160MHz and 80p80 */
1993         if (pe->phy_cap_info[0] &
1994             IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1995                 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1996                 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1997
1998                 bf->nc_bw160 = nss_mcs;
1999         }
2000
2001         if (pe->phy_cap_info[0] &
2002             IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
2003                 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
2004                 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
2005
2006                 if (bf->nc_bw160)
2007                         bf->nc_bw160 = min_t(u8, bf->nc_bw160, nss_mcs);
2008                 else
2009                         bf->nc_bw160 = nss_mcs;
2010         }
2011
2012         bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
2013                          ve->phy_cap_info[5]);
2014         bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
2015                          pe->phy_cap_info[4]);
2016
2017         bf->nr_bw160 = min_t(int, bfer_nr, bfee_nr);
2018 }
2019
2020 static void
2021 mt7915_mcu_sta_bfer_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
2022                         struct ieee80211_vif *vif, struct mt7915_phy *phy,
2023                         bool enable, bool explicit)
2024 {
2025         int tx_ant = hweight8(phy->mt76->chainmask) - 1;
2026         struct sta_rec_bf *bf;
2027         struct tlv *tlv;
2028         const u8 matrix[4][4] = {
2029                 {0, 0, 0, 0},
2030                 {1, 1, 0, 0},   /* 2x1, 2x2, 2x3, 2x4 */
2031                 {2, 4, 4, 0},   /* 3x1, 3x2, 3x3, 3x4 */
2032                 {3, 5, 6, 0}    /* 4x1, 4x2, 4x3, 4x4 */
2033         };
2034
2035 #define MT_BFER_FREE            cpu_to_le16(GENMASK(15, 0))
2036
2037         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
2038         bf = (struct sta_rec_bf *)tlv;
2039
2040         if (!enable) {
2041                 bf->pfmu = MT_BFER_FREE;
2042                 return;
2043         }
2044
2045         /* he: eBF only, in accordance with spec
2046          * vht: support eBF and iBF
2047          * ht: iBF only, since mac80211 lacks of eBF support
2048          */
2049         if (sta->he_cap.has_he && explicit)
2050                 mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
2051         else if (sta->vht_cap.vht_supported)
2052                 mt7915_mcu_sta_bfer_vht(sta, phy, bf, explicit);
2053         else if (sta->ht_cap.ht_supported)
2054                 mt7915_mcu_sta_bfer_ht(sta, phy, bf);
2055         else
2056                 return;
2057
2058         bf->bw = sta->bandwidth;
2059         bf->ibf_dbw = sta->bandwidth;
2060         bf->ibf_nrow = tx_ant;
2061
2062         if (!explicit && sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->nc)
2063                 bf->ibf_timeout = 0x48;
2064         else
2065                 bf->ibf_timeout = 0x18;
2066
2067         if (explicit && bf->nr != tx_ant)
2068                 bf->mem_20m = matrix[tx_ant][bf->nc];
2069         else
2070                 bf->mem_20m = matrix[bf->nr][bf->nc];
2071
2072         switch (sta->bandwidth) {
2073         case IEEE80211_STA_RX_BW_160:
2074         case IEEE80211_STA_RX_BW_80:
2075                 bf->mem_total = bf->mem_20m * 2;
2076                 break;
2077         case IEEE80211_STA_RX_BW_40:
2078                 bf->mem_total = bf->mem_20m;
2079                 break;
2080         case IEEE80211_STA_RX_BW_20:
2081         default:
2082                 break;
2083         }
2084 }
2085
2086 static void
2087 mt7915_mcu_sta_bfee_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
2088                         struct mt7915_phy *phy)
2089 {
2090         int tx_ant = hweight8(phy->mt76->chainmask) - 1;
2091         struct sta_rec_bfee *bfee;
2092         struct tlv *tlv;
2093         u8 nr = 0;
2094
2095         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
2096         bfee = (struct sta_rec_bfee *)tlv;
2097
2098         if (sta->he_cap.has_he) {
2099                 struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
2100
2101                 nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
2102                             pe->phy_cap_info[5]);
2103         } else if (sta->vht_cap.vht_supported) {
2104                 struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
2105
2106                 nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
2107                                pc->cap);
2108         }
2109
2110         /* reply with identity matrix to avoid 2x2 BF negative gain */
2111         bfee->fb_identity_matrix = !!(nr == 1 && tx_ant == 2);
2112 }
2113
2114 static int
2115 mt7915_mcu_add_txbf(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2116                     struct ieee80211_sta *sta, bool enable)
2117 {
2118         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2119         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2120         struct mt7915_phy *phy;
2121         struct sk_buff *skb;
2122         int r, len;
2123         bool ebfee = 0, ebf = 0;
2124
2125         if (vif->type != NL80211_IFTYPE_STATION &&
2126             vif->type != NL80211_IFTYPE_AP)
2127                 return 0;
2128
2129         phy = mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
2130
2131         if (sta->he_cap.has_he) {
2132                 struct ieee80211_he_cap_elem *pe;
2133                 const struct ieee80211_he_cap_elem *ve;
2134                 const struct ieee80211_sta_he_cap *vc;
2135
2136                 pe = &sta->he_cap.he_cap_elem;
2137                 vc = mt7915_get_he_phy_cap(phy, vif);
2138                 ve = &vc->he_cap_elem;
2139
2140                 ebfee = !!(HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]) &&
2141                            HE_PHY(CAP4_SU_BEAMFORMEE, ve->phy_cap_info[4]));
2142                 ebf = !!(HE_PHY(CAP3_SU_BEAMFORMER, ve->phy_cap_info[3]) &&
2143                          HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]));
2144         } else if (sta->vht_cap.vht_supported) {
2145                 struct ieee80211_sta_vht_cap *pc;
2146                 struct ieee80211_sta_vht_cap *vc;
2147
2148                 pc = &sta->vht_cap;
2149                 vc = &phy->mt76->sband_5g.sband.vht_cap;
2150
2151                 ebfee = !!((pc->cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE) &&
2152                            (vc->cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE));
2153                 ebf = !!((vc->cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE) &&
2154                          (pc->cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE));
2155         }
2156
2157         /* must keep each tag independent */
2158
2159         /* starec bf */
2160         if (ebf || dev->ibf) {
2161                 len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bf);
2162
2163                 skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2164                 if (IS_ERR(skb))
2165                         return PTR_ERR(skb);
2166
2167                 mt7915_mcu_sta_bfer_tlv(skb, sta, vif, phy, enable, ebf);
2168
2169                 r = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2170                                           MCU_EXT_CMD(STA_REC_UPDATE), true);
2171                 if (r)
2172                         return r;
2173         }
2174
2175         /* starec bfee */
2176         if (ebfee) {
2177                 len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bfee);
2178
2179                 skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2180                 if (IS_ERR(skb))
2181                         return PTR_ERR(skb);
2182
2183                 mt7915_mcu_sta_bfee_tlv(skb, sta, phy);
2184
2185                 r = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2186                                           MCU_EXT_CMD(STA_REC_UPDATE), true);
2187                 if (r)
2188                         return r;
2189         }
2190
2191         return 0;
2192 }
2193
2194 static void
2195 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
2196                              struct ieee80211_vif *vif, struct ieee80211_sta *sta)
2197 {
2198         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2199         struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
2200         struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
2201         enum nl80211_band band = chandef->chan->band;
2202         struct sta_rec_ra *ra;
2203         struct tlv *tlv;
2204         u32 supp_rate = sta->supp_rates[band];
2205         u32 cap = sta->wme ? STA_CAP_WMM : 0;
2206
2207         tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
2208         ra = (struct sta_rec_ra *)tlv;
2209
2210         ra->valid = true;
2211         ra->auto_rate = true;
2212         ra->phy_mode = mt7915_get_phy_mode(vif, sta);
2213         ra->channel = chandef->chan->hw_value;
2214         ra->bw = sta->bandwidth;
2215         ra->phy.bw = sta->bandwidth;
2216
2217         if (supp_rate) {
2218                 supp_rate &= mask->control[band].legacy;
2219                 ra->rate_len = hweight32(supp_rate);
2220
2221                 if (band == NL80211_BAND_2GHZ) {
2222                         ra->supp_mode = MODE_CCK;
2223                         ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
2224
2225                         if (ra->rate_len > 4) {
2226                                 ra->supp_mode |= MODE_OFDM;
2227                                 ra->supp_ofdm_rate = supp_rate >> 4;
2228                         }
2229                 } else {
2230                         ra->supp_mode = MODE_OFDM;
2231                         ra->supp_ofdm_rate = supp_rate;
2232                 }
2233         }
2234
2235         if (sta->ht_cap.ht_supported) {
2236                 const u8 *mcs_mask = mask->control[band].ht_mcs;
2237
2238                 ra->supp_mode |= MODE_HT;
2239                 ra->af = sta->ht_cap.ampdu_factor;
2240                 ra->ht_gf = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
2241
2242                 cap |= STA_CAP_HT;
2243                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
2244                         cap |= STA_CAP_SGI_20;
2245                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
2246                         cap |= STA_CAP_SGI_40;
2247                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
2248                         cap |= STA_CAP_TX_STBC;
2249                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
2250                         cap |= STA_CAP_RX_STBC;
2251                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING)
2252                         cap |= STA_CAP_LDPC;
2253
2254                 mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs, mcs_mask);
2255                 ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
2256         }
2257
2258         if (sta->vht_cap.vht_supported) {
2259                 const u16 *mcs_mask = mask->control[band].vht_mcs;
2260                 u8 af;
2261
2262                 ra->supp_mode |= MODE_VHT;
2263                 af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
2264                                sta->vht_cap.cap);
2265                 ra->af = max_t(u8, ra->af, af);
2266
2267                 cap |= STA_CAP_VHT;
2268                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
2269                         cap |= STA_CAP_VHT_SGI_80;
2270                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
2271                         cap |= STA_CAP_VHT_SGI_160;
2272                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
2273                         cap |= STA_CAP_VHT_TX_STBC;
2274                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
2275                         cap |= STA_CAP_VHT_RX_STBC;
2276                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC)
2277                         cap |= STA_CAP_VHT_LDPC;
2278
2279                 mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs, mcs_mask);
2280         }
2281
2282         if (sta->he_cap.has_he) {
2283                 ra->supp_mode |= MODE_HE;
2284                 cap |= STA_CAP_HE;
2285         }
2286
2287         ra->sta_cap = cpu_to_le32(cap);
2288 }
2289
2290 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2291                              struct ieee80211_sta *sta)
2292 {
2293         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2294         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2295         struct sk_buff *skb;
2296         int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_ra);
2297
2298         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2299         if (IS_ERR(skb))
2300                 return PTR_ERR(skb);
2301
2302         mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
2303
2304         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2305                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
2306 }
2307
2308 int mt7915_mcu_add_he(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2309                       struct ieee80211_sta *sta)
2310 {
2311         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2312         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2313         struct sk_buff *skb;
2314         int len;
2315
2316         if (!sta->he_cap.has_he)
2317                 return 0;
2318
2319         len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_he);
2320
2321         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2322         if (IS_ERR(skb))
2323                 return PTR_ERR(skb);
2324
2325         mt7915_mcu_sta_he_tlv(skb, sta);
2326
2327         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2328                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
2329 }
2330
2331 static int
2332 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2333                      struct ieee80211_sta *sta)
2334 {
2335 #define MT_STA_BSS_GROUP                1
2336         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2337         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2338         struct {
2339                 __le32 action;
2340                 u8 wlan_idx_lo;
2341                 u8 status;
2342                 u8 wlan_idx_hi;
2343                 u8 rsv0[5];
2344                 __le32 val;
2345                 u8 rsv1[8];
2346         } __packed req = {
2347                 .action = cpu_to_le32(MT_STA_BSS_GROUP),
2348                 .wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
2349                 .wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
2350                 .val = cpu_to_le32(mvif->idx % 16),
2351         };
2352
2353         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL), &req,
2354                                  sizeof(req), true);
2355 }
2356
2357 static int
2358 mt7915_mcu_add_mu(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2359                   struct ieee80211_sta *sta)
2360 {
2361         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2362         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2363         struct sk_buff *skb;
2364         int ret;
2365
2366         if (!sta->vht_cap.vht_supported && !sta->he_cap.has_he)
2367                 return 0;
2368
2369         ret = mt7915_mcu_add_group(dev, vif, sta);
2370         if (ret)
2371                 return ret;
2372
2373         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
2374                                        MT7915_STA_UPDATE_MAX_SIZE);
2375         if (IS_ERR(skb))
2376                 return PTR_ERR(skb);
2377
2378         /* wait until TxBF and MU ready to update stare vht */
2379
2380         /* starec muru */
2381         mt7915_mcu_sta_muru_tlv(skb, sta);
2382         /* starec vht */
2383         mt7915_mcu_sta_vht_tlv(skb, sta);
2384
2385         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2386                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
2387 }
2388
2389 int mt7915_mcu_add_sta_adv(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2390                            struct ieee80211_sta *sta, bool enable)
2391 {
2392         int ret;
2393
2394         if (!sta)
2395                 return 0;
2396
2397         /* must keep the order */
2398         ret = mt7915_mcu_add_txbf(dev, vif, sta, enable);
2399         if (ret || !enable)
2400                 return ret;
2401
2402         ret = mt7915_mcu_add_mu(dev, vif, sta);
2403         if (ret)
2404                 return ret;
2405
2406         return mt7915_mcu_add_rate_ctrl(dev, vif, sta);
2407 }
2408
2409 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2410                        struct ieee80211_sta *sta, bool enable)
2411 {
2412         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2413         struct wtbl_req_hdr *wtbl_hdr;
2414         struct mt7915_sta *msta;
2415         struct tlv *sta_wtbl;
2416         struct sk_buff *skb;
2417
2418         msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
2419
2420         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
2421                                        MT7915_STA_UPDATE_MAX_SIZE);
2422         if (IS_ERR(skb))
2423                 return PTR_ERR(skb);
2424
2425         mt7915_mcu_sta_basic_tlv(skb, vif, sta, enable);
2426         if (enable && sta)
2427                 mt7915_mcu_sta_tlv(dev, skb, sta, vif);
2428
2429         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
2430
2431         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
2432                                              sta_wtbl, &skb);
2433         if (IS_ERR(wtbl_hdr))
2434                 return PTR_ERR(wtbl_hdr);
2435
2436         if (enable) {
2437                 mt7915_mcu_wtbl_generic_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2438                 mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2439                 if (sta)
2440                         mt7915_mcu_wtbl_ht_tlv(skb, sta, sta_wtbl, wtbl_hdr);
2441         }
2442
2443         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2444                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
2445 }
2446
2447 int mt7915_mcu_set_fixed_rate(struct mt7915_dev *dev,
2448                               struct ieee80211_sta *sta, u32 rate)
2449 {
2450         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2451         struct mt7915_vif *mvif = msta->vif;
2452         struct sta_rec_ra_fixed *ra;
2453         struct sk_buff *skb;
2454         struct tlv *tlv;
2455         int len = sizeof(struct sta_req_hdr) + sizeof(*ra);
2456
2457         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2458         if (IS_ERR(skb))
2459                 return PTR_ERR(skb);
2460
2461         tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
2462         ra = (struct sta_rec_ra_fixed *)tlv;
2463
2464         if (!rate) {
2465                 ra->field = cpu_to_le32(RATE_PARAM_AUTO);
2466                 goto out;
2467         } else {
2468                 ra->field = cpu_to_le32(RATE_PARAM_FIXED);
2469         }
2470
2471         ra->phy.type = FIELD_GET(RATE_CFG_PHY_TYPE, rate);
2472         ra->phy.bw = FIELD_GET(RATE_CFG_BW, rate);
2473         ra->phy.nss = FIELD_GET(RATE_CFG_NSS, rate);
2474         ra->phy.mcs = FIELD_GET(RATE_CFG_MCS, rate);
2475         ra->phy.stbc = FIELD_GET(RATE_CFG_STBC, rate);
2476
2477         if (ra->phy.bw)
2478                 ra->phy.ldpc = 7;
2479         else
2480                 ra->phy.ldpc = FIELD_GET(RATE_CFG_LDPC, rate) * 7;
2481
2482         /* HT/VHT - SGI: 1, LGI: 0; HE - SGI: 0, MGI: 1, LGI: 2 */
2483         if (ra->phy.type > MT_PHY_TYPE_VHT)
2484                 ra->phy.sgi = ra->phy.mcs * 85;
2485         else
2486                 ra->phy.sgi = ra->phy.mcs * 15;
2487
2488 out:
2489         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2490                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
2491 }
2492
2493 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
2494                             struct ieee80211_vif *vif, bool enable)
2495 {
2496         struct mt7915_dev *dev = phy->dev;
2497         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2498         struct {
2499                 struct req_hdr {
2500                         u8 omac_idx;
2501                         u8 dbdc_idx;
2502                         __le16 tlv_num;
2503                         u8 is_tlv_append;
2504                         u8 rsv[3];
2505                 } __packed hdr;
2506                 struct req_tlv {
2507                         __le16 tag;
2508                         __le16 len;
2509                         u8 active;
2510                         u8 dbdc_idx;
2511                         u8 omac_addr[ETH_ALEN];
2512                 } __packed tlv;
2513         } data = {
2514                 .hdr = {
2515                         .omac_idx = mvif->omac_idx,
2516                         .dbdc_idx = mvif->band_idx,
2517                         .tlv_num = cpu_to_le16(1),
2518                         .is_tlv_append = 1,
2519                 },
2520                 .tlv = {
2521                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
2522                         .len = cpu_to_le16(sizeof(struct req_tlv)),
2523                         .active = enable,
2524                         .dbdc_idx = mvif->band_idx,
2525                 },
2526         };
2527
2528         if (mvif->omac_idx >= REPEATER_BSSID_START)
2529                 return mt7915_mcu_muar_config(phy, vif, false, enable);
2530
2531         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
2532         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
2533                                  &data, sizeof(data), true);
2534 }
2535
2536 static void
2537 mt7915_mcu_beacon_csa(struct sk_buff *rskb, struct sk_buff *skb,
2538                       struct bss_info_bcn *bcn,
2539                       struct ieee80211_mutable_offsets *offs)
2540 {
2541         if (offs->cntdwn_counter_offs[0]) {
2542                 struct tlv *tlv;
2543                 struct bss_info_bcn_csa *csa;
2544
2545                 tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CSA,
2546                                                    sizeof(*csa), &bcn->sub_ntlv,
2547                                                    &bcn->len);
2548                 csa = (struct bss_info_bcn_csa *)tlv;
2549                 csa->cnt = skb->data[offs->cntdwn_counter_offs[0]];
2550         }
2551 }
2552
2553 static void
2554 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct sk_buff *rskb,
2555                        struct sk_buff *skb, struct bss_info_bcn *bcn,
2556                        struct ieee80211_mutable_offsets *offs)
2557 {
2558         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
2559         struct bss_info_bcn_cont *cont;
2560         struct tlv *tlv;
2561         u8 *buf;
2562         int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
2563
2564         tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
2565                                            len, &bcn->sub_ntlv, &bcn->len);
2566
2567         cont = (struct bss_info_bcn_cont *)tlv;
2568         cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2569         cont->tim_ofs = cpu_to_le16(offs->tim_offset);
2570
2571         if (offs->cntdwn_counter_offs[0])
2572                 cont->csa_ofs = cpu_to_le16(offs->cntdwn_counter_offs[0] - 4);
2573
2574         buf = (u8 *)tlv + sizeof(*cont);
2575         mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
2576                               true);
2577         memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2578 }
2579
2580 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
2581                           struct ieee80211_vif *vif, int en)
2582 {
2583 #define MAX_BEACON_SIZE 512
2584         struct mt7915_dev *dev = mt7915_hw_dev(hw);
2585         struct mt7915_phy *phy = mt7915_hw_phy(hw);
2586         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2587         struct ieee80211_mutable_offsets offs;
2588         struct ieee80211_tx_info *info;
2589         struct sk_buff *skb, *rskb;
2590         struct tlv *tlv;
2591         struct bss_info_bcn *bcn;
2592         int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
2593
2594         rskb = mt7915_mcu_alloc_sta_req(dev, mvif, NULL, len);
2595         if (IS_ERR(rskb))
2596                 return PTR_ERR(rskb);
2597
2598         tlv = mt7915_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2599         bcn = (struct bss_info_bcn *)tlv;
2600         bcn->enable = en;
2601
2602         if (!en)
2603                 goto out;
2604
2605         skb = ieee80211_beacon_get_template(hw, vif, &offs);
2606         if (!skb)
2607                 return -EINVAL;
2608
2609         if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
2610                 dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2611                 dev_kfree_skb(skb);
2612                 return -EINVAL;
2613         }
2614
2615         if (mvif->band_idx) {
2616                 info = IEEE80211_SKB_CB(skb);
2617                 info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2618         }
2619
2620         /* TODO: subtag - bss color count & 11v MBSSID */
2621         mt7915_mcu_beacon_csa(rskb, skb, bcn, &offs);
2622         mt7915_mcu_beacon_cont(dev, rskb, skb, bcn, &offs);
2623         dev_kfree_skb(skb);
2624
2625 out:
2626         return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2627                                      MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2628 }
2629
2630 static int mt7915_mcu_start_firmware(struct mt7915_dev *dev, u32 addr,
2631                                      u32 option)
2632 {
2633         struct {
2634                 __le32 option;
2635                 __le32 addr;
2636         } req = {
2637                 .option = cpu_to_le32(option),
2638                 .addr = cpu_to_le32(addr),
2639         };
2640
2641         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(FW_START_REQ), &req,
2642                                  sizeof(req), true);
2643 }
2644
2645 static int mt7915_mcu_restart(struct mt76_dev *dev)
2646 {
2647         struct {
2648                 u8 power_mode;
2649                 u8 rsv[3];
2650         } req = {
2651                 .power_mode = 1,
2652         };
2653
2654         return mt76_mcu_send_msg(dev, MCU_CMD(NIC_POWER_CTRL), &req,
2655                                  sizeof(req), false);
2656 }
2657
2658 static int mt7915_mcu_patch_sem_ctrl(struct mt7915_dev *dev, bool get)
2659 {
2660         struct {
2661                 __le32 op;
2662         } req = {
2663                 .op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
2664         };
2665
2666         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(PATCH_SEM_CONTROL), &req,
2667                                  sizeof(req), true);
2668 }
2669
2670 static int mt7915_mcu_start_patch(struct mt7915_dev *dev)
2671 {
2672         struct {
2673                 u8 check_crc;
2674                 u8 reserved[3];
2675         } req = {
2676                 .check_crc = 0,
2677         };
2678
2679         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(PATCH_FINISH_REQ), &req,
2680                                  sizeof(req), true);
2681 }
2682
2683 static int mt7915_driver_own(struct mt7915_dev *dev)
2684 {
2685         mt76_wr(dev, MT_TOP_LPCR_HOST_BAND0, MT_TOP_LPCR_HOST_DRV_OWN);
2686         if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND0,
2687                             MT_TOP_LPCR_HOST_FW_OWN, 0, 500)) {
2688                 dev_err(dev->mt76.dev, "Timeout for driver own\n");
2689                 return -EIO;
2690         }
2691
2692         return 0;
2693 }
2694
2695 static int mt7915_mcu_init_download(struct mt7915_dev *dev, u32 addr,
2696                                     u32 len, u32 mode)
2697 {
2698         struct {
2699                 __le32 addr;
2700                 __le32 len;
2701                 __le32 mode;
2702         } req = {
2703                 .addr = cpu_to_le32(addr),
2704                 .len = cpu_to_le32(len),
2705                 .mode = cpu_to_le32(mode),
2706         };
2707         int attr;
2708
2709         if (req.addr == cpu_to_le32(MCU_PATCH_ADDRESS))
2710                 attr = MCU_CMD(PATCH_START_REQ);
2711         else
2712                 attr = MCU_CMD(TARGET_ADDRESS_LEN_REQ);
2713
2714         return mt76_mcu_send_msg(&dev->mt76, attr, &req, sizeof(req), true);
2715 }
2716
2717 static int mt7915_load_patch(struct mt7915_dev *dev)
2718 {
2719         const struct mt7915_patch_hdr *hdr;
2720         const struct firmware *fw = NULL;
2721         int i, ret, sem;
2722
2723         sem = mt7915_mcu_patch_sem_ctrl(dev, 1);
2724         switch (sem) {
2725         case PATCH_IS_DL:
2726                 return 0;
2727         case PATCH_NOT_DL_SEM_SUCCESS:
2728                 break;
2729         default:
2730                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2731                 return -EAGAIN;
2732         }
2733
2734         ret = request_firmware(&fw, MT7915_ROM_PATCH, dev->mt76.dev);
2735         if (ret)
2736                 goto out;
2737
2738         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2739                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2740                 ret = -EINVAL;
2741                 goto out;
2742         }
2743
2744         hdr = (const struct mt7915_patch_hdr *)(fw->data);
2745
2746         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2747                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2748
2749         for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2750                 struct mt7915_patch_sec *sec;
2751                 const u8 *dl;
2752                 u32 len, addr;
2753
2754                 sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2755                                                   i * sizeof(*sec));
2756                 if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2757                     PATCH_SEC_TYPE_INFO) {
2758                         ret = -EINVAL;
2759                         goto out;
2760                 }
2761
2762                 addr = be32_to_cpu(sec->info.addr);
2763                 len = be32_to_cpu(sec->info.len);
2764                 dl = fw->data + be32_to_cpu(sec->offs);
2765
2766                 ret = mt7915_mcu_init_download(dev, addr, len,
2767                                                DL_MODE_NEED_RSP);
2768                 if (ret) {
2769                         dev_err(dev->mt76.dev, "Download request failed\n");
2770                         goto out;
2771                 }
2772
2773                 ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2774                                              dl, len);
2775                 if (ret) {
2776                         dev_err(dev->mt76.dev, "Failed to send patch\n");
2777                         goto out;
2778                 }
2779         }
2780
2781         ret = mt7915_mcu_start_patch(dev);
2782         if (ret)
2783                 dev_err(dev->mt76.dev, "Failed to start patch\n");
2784
2785 out:
2786         sem = mt7915_mcu_patch_sem_ctrl(dev, 0);
2787         switch (sem) {
2788         case PATCH_REL_SEM_SUCCESS:
2789                 break;
2790         default:
2791                 ret = -EAGAIN;
2792                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2793                 goto out;
2794         }
2795         release_firmware(fw);
2796
2797         return ret;
2798 }
2799
2800 static u32 mt7915_mcu_gen_dl_mode(u8 feature_set, bool is_wa)
2801 {
2802         u32 ret = 0;
2803
2804         ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2805                (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2806         ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2807                           FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2808         ret |= DL_MODE_NEED_RSP;
2809         ret |= is_wa ? DL_MODE_WORKING_PDA_CR4 : 0;
2810
2811         return ret;
2812 }
2813
2814 static int
2815 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2816                              const struct mt7915_fw_trailer *hdr,
2817                              const u8 *data, bool is_wa)
2818 {
2819         int i, offset = 0;
2820         u32 override = 0, option = 0;
2821
2822         for (i = 0; i < hdr->n_region; i++) {
2823                 const struct mt7915_fw_region *region;
2824                 int err;
2825                 u32 len, addr, mode;
2826
2827                 region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2828                          (hdr->n_region - i) * sizeof(*region));
2829                 mode = mt7915_mcu_gen_dl_mode(region->feature_set, is_wa);
2830                 len = le32_to_cpu(region->len);
2831                 addr = le32_to_cpu(region->addr);
2832
2833                 if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2834                         override = addr;
2835
2836                 err = mt7915_mcu_init_download(dev, addr, len, mode);
2837                 if (err) {
2838                         dev_err(dev->mt76.dev, "Download request failed\n");
2839                         return err;
2840                 }
2841
2842                 err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2843                                              data + offset, len);
2844                 if (err) {
2845                         dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2846                         return err;
2847                 }
2848
2849                 offset += len;
2850         }
2851
2852         if (override)
2853                 option |= FW_START_OVERRIDE;
2854
2855         if (is_wa)
2856                 option |= FW_START_WORKING_PDA_CR4;
2857
2858         return mt7915_mcu_start_firmware(dev, override, option);
2859 }
2860
2861 static int mt7915_load_ram(struct mt7915_dev *dev)
2862 {
2863         const struct mt7915_fw_trailer *hdr;
2864         const struct firmware *fw;
2865         int ret;
2866
2867         ret = request_firmware(&fw, MT7915_FIRMWARE_WM, dev->mt76.dev);
2868         if (ret)
2869                 return ret;
2870
2871         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2872                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2873                 ret = -EINVAL;
2874                 goto out;
2875         }
2876
2877         hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2878                                         sizeof(*hdr));
2879
2880         dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2881                  hdr->fw_ver, hdr->build_date);
2882
2883         ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2884         if (ret) {
2885                 dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2886                 goto out;
2887         }
2888
2889         release_firmware(fw);
2890
2891         ret = request_firmware(&fw, MT7915_FIRMWARE_WA, dev->mt76.dev);
2892         if (ret)
2893                 return ret;
2894
2895         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2896                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2897                 ret = -EINVAL;
2898                 goto out;
2899         }
2900
2901         hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2902                                         sizeof(*hdr));
2903
2904         dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2905                  hdr->fw_ver, hdr->build_date);
2906
2907         ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2908         if (ret) {
2909                 dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2910                 goto out;
2911         }
2912
2913         snprintf(dev->mt76.hw->wiphy->fw_version,
2914                  sizeof(dev->mt76.hw->wiphy->fw_version),
2915                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2916
2917 out:
2918         release_firmware(fw);
2919
2920         return ret;
2921 }
2922
2923 static int mt7915_load_firmware(struct mt7915_dev *dev)
2924 {
2925         int ret;
2926
2927         ret = mt7915_load_patch(dev);
2928         if (ret)
2929                 return ret;
2930
2931         ret = mt7915_load_ram(dev);
2932         if (ret)
2933                 return ret;
2934
2935         if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2936                             FIELD_PREP(MT_TOP_MISC_FW_STATE,
2937                                        FW_STATE_WACPU_RDY), 1000)) {
2938                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2939                 return -EIO;
2940         }
2941
2942         mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2943
2944         dev_dbg(dev->mt76.dev, "Firmware init done\n");
2945
2946         return 0;
2947 }
2948
2949 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 ctrl)
2950 {
2951         struct {
2952                 u8 ctrl_val;
2953                 u8 pad[3];
2954         } data = {
2955                 .ctrl_val = ctrl
2956         };
2957
2958         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2959                                  sizeof(data), true);
2960 }
2961
2962 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2963 {
2964         struct {
2965                 u8 ver;
2966                 u8 pad;
2967                 __le16 len;
2968                 u8 level;
2969                 u8 rsv[3];
2970                 __le32 module_idx;
2971         } data = {
2972                 .module_idx = cpu_to_le32(module),
2973                 .level = level,
2974         };
2975
2976         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2977                                  sizeof(data), false);
2978 }
2979
2980 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2981 {
2982         struct {
2983                 u8 enable;
2984                 u8 _rsv[3];
2985         } __packed req = {
2986                 .enable = enabled
2987         };
2988
2989         return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2990                                  sizeof(req), false);
2991 }
2992
2993 int mt7915_mcu_init(struct mt7915_dev *dev)
2994 {
2995         static const struct mt76_mcu_ops mt7915_mcu_ops = {
2996                 .headroom = sizeof(struct mt7915_mcu_txd),
2997                 .mcu_skb_send_msg = mt7915_mcu_send_message,
2998                 .mcu_parse_response = mt7915_mcu_parse_response,
2999                 .mcu_restart = mt7915_mcu_restart,
3000         };
3001         int ret;
3002
3003         dev->mt76.mcu_ops = &mt7915_mcu_ops;
3004
3005         ret = mt7915_driver_own(dev);
3006         if (ret)
3007                 return ret;
3008
3009         ret = mt7915_load_firmware(dev);
3010         if (ret)
3011                 return ret;
3012
3013         set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
3014         mt7915_mcu_fw_log_2_host(dev, 0);
3015         mt7915_mcu_set_mwds(dev, 1);
3016         mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET), MCU_WA_PARAM_RED, 0, 0);
3017
3018         return 0;
3019 }
3020
3021 void mt7915_mcu_exit(struct mt7915_dev *dev)
3022 {
3023         __mt76_mcu_restart(&dev->mt76);
3024         if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
3025                             FIELD_PREP(MT_TOP_MISC_FW_STATE,
3026                                        FW_STATE_FW_DOWNLOAD), 1000)) {
3027                 dev_err(dev->mt76.dev, "Failed to exit mcu\n");
3028                 return;
3029         }
3030
3031         mt76_wr(dev, MT_TOP_LPCR_HOST_BAND0, MT_TOP_LPCR_HOST_FW_OWN);
3032         skb_queue_purge(&dev->mt76.mcu.res_q);
3033 }
3034
3035 static int
3036 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
3037 {
3038         struct {
3039                 u8 operation;
3040                 u8 count;
3041                 u8 _rsv[2];
3042                 u8 index;
3043                 u8 enable;
3044                 __le16 etype;
3045         } req = {
3046                 .operation = 1,
3047                 .count = 1,
3048                 .enable = 1,
3049                 .etype = cpu_to_le16(ETH_P_PAE),
3050         };
3051
3052         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
3053                                  &req, sizeof(req), false);
3054 }
3055
3056 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
3057                        bool enable, bool hdr_trans)
3058 {
3059         struct {
3060                 u8 operation;
3061                 u8 enable;
3062                 u8 check_bssid;
3063                 u8 insert_vlan;
3064                 u8 remove_vlan;
3065                 u8 tid;
3066                 u8 mode;
3067                 u8 rsv;
3068         } __packed req_trans = {
3069                 .enable = hdr_trans,
3070         };
3071         struct {
3072                 u8 enable;
3073                 u8 band;
3074                 u8 rsv[2];
3075         } __packed req_mac = {
3076                 .enable = enable,
3077                 .band = band,
3078         };
3079         int ret;
3080
3081         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
3082                                 &req_trans, sizeof(req_trans), false);
3083         if (ret)
3084                 return ret;
3085
3086         if (hdr_trans)
3087                 mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
3088
3089         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
3090                                  &req_mac, sizeof(req_mac), true);
3091 }
3092
3093 int mt7915_mcu_set_scs(struct mt7915_dev *dev, u8 band, bool enable)
3094 {
3095         struct {
3096                 __le32 cmd;
3097                 u8 band;
3098                 u8 enable;
3099         } __packed req = {
3100                 .cmd = cpu_to_le32(SCS_ENABLE),
3101                 .band = band,
3102                 .enable = enable + 1,
3103         };
3104
3105         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SCS_CTRL), &req,
3106                                  sizeof(req), false);
3107 }
3108
3109 int mt7915_mcu_set_rts_thresh(struct mt7915_phy *phy, u32 val)
3110 {
3111         struct mt7915_dev *dev = phy->dev;
3112         struct {
3113                 u8 prot_idx;
3114                 u8 band;
3115                 u8 rsv[2];
3116                 __le32 len_thresh;
3117                 __le32 pkt_thresh;
3118         } __packed req = {
3119                 .prot_idx = 1,
3120                 .band = phy != &dev->phy,
3121                 .len_thresh = cpu_to_le32(val),
3122                 .pkt_thresh = cpu_to_le32(0x2),
3123         };
3124
3125         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(PROTECT_CTRL), &req,
3126                                  sizeof(req), true);
3127 }
3128
3129 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
3130 {
3131         struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
3132         u8 num = req->total;
3133         size_t len = sizeof(*req) -
3134                      (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
3135
3136         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
3137                                  len, true);
3138 }
3139
3140 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
3141 {
3142 #define TX_CMD_MODE             1
3143         struct mt7915_mcu_tx req = {
3144                 .valid = true,
3145                 .mode = TX_CMD_MODE,
3146                 .total = IEEE80211_NUM_ACS,
3147         };
3148         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3149         int ac;
3150
3151         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
3152                 struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
3153                 struct edca *e = &req.edca[ac];
3154
3155                 e->set = WMM_PARAM_SET;
3156                 e->queue = ac + mvif->wmm_idx * MT7915_MAX_WMM_SETS;
3157                 e->aifs = q->aifs;
3158                 e->txop = cpu_to_le16(q->txop);
3159
3160                 if (q->cw_min)
3161                         e->cw_min = fls(q->cw_min);
3162                 else
3163                         e->cw_min = 5;
3164
3165                 if (q->cw_max)
3166                         e->cw_max = cpu_to_le16(fls(q->cw_max));
3167                 else
3168                         e->cw_max = cpu_to_le16(10);
3169         }
3170
3171         return mt7915_mcu_update_edca(dev, &req);
3172 }
3173
3174 int mt7915_mcu_set_pm(struct mt7915_dev *dev, int band, int enter)
3175 {
3176 #define ENTER_PM_STATE          1
3177 #define EXIT_PM_STATE           2
3178         struct {
3179                 u8 pm_number;
3180                 u8 pm_state;
3181                 u8 bssid[ETH_ALEN];
3182                 u8 dtim_period;
3183                 u8 wlan_idx_lo;
3184                 __le16 bcn_interval;
3185                 __le32 aid;
3186                 __le32 rx_filter;
3187                 u8 band_idx;
3188                 u8 wlan_idx_hi;
3189                 u8 rsv[2];
3190                 __le32 feature;
3191                 u8 omac_idx;
3192                 u8 wmm_idx;
3193                 u8 bcn_loss_cnt;
3194                 u8 bcn_sp_duration;
3195         } __packed req = {
3196                 .pm_number = 5,
3197                 .pm_state = (enter) ? ENTER_PM_STATE : EXIT_PM_STATE,
3198                 .band_idx = band,
3199         };
3200
3201         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(PM_STATE_CTRL), &req,
3202                                  sizeof(req), true);
3203 }
3204
3205 int mt7915_mcu_rdd_cmd(struct mt7915_dev *dev,
3206                        enum mt7915_rdd_cmd cmd, u8 index,
3207                        u8 rx_sel, u8 val)
3208 {
3209         struct {
3210                 u8 ctrl;
3211                 u8 rdd_idx;
3212                 u8 rdd_rx_sel;
3213                 u8 val;
3214                 u8 rsv[4];
3215         } __packed req = {
3216                 .ctrl = cmd,
3217                 .rdd_idx = index,
3218                 .rdd_rx_sel = rx_sel,
3219                 .val = val,
3220         };
3221
3222         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_CTRL), &req,
3223                                  sizeof(req), true);
3224 }
3225
3226 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
3227 {
3228         struct {
3229                 __le32 tag;
3230                 __le16 min_lpn;
3231                 u8 rsv[2];
3232         } __packed req = {
3233                 .tag = cpu_to_le32(0x1),
3234                 .min_lpn = cpu_to_le16(val),
3235         };
3236
3237         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3238                                  sizeof(req), true);
3239 }
3240
3241 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
3242                             const struct mt7915_dfs_pulse *pulse)
3243 {
3244         struct {
3245                 __le32 tag;
3246
3247                 __le32 max_width;               /* us */
3248                 __le32 max_pwr;                 /* dbm */
3249                 __le32 min_pwr;                 /* dbm */
3250                 __le32 min_stgr_pri;            /* us */
3251                 __le32 max_stgr_pri;            /* us */
3252                 __le32 min_cr_pri;              /* us */
3253                 __le32 max_cr_pri;              /* us */
3254         } __packed req = {
3255                 .tag = cpu_to_le32(0x3),
3256
3257 #define __req_field(field) .field = cpu_to_le32(pulse->field)
3258                 __req_field(max_width),
3259                 __req_field(max_pwr),
3260                 __req_field(min_pwr),
3261                 __req_field(min_stgr_pri),
3262                 __req_field(max_stgr_pri),
3263                 __req_field(min_cr_pri),
3264                 __req_field(max_cr_pri),
3265 #undef __req_field
3266         };
3267
3268         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3269                                  sizeof(req), true);
3270 }
3271
3272 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
3273                             const struct mt7915_dfs_pattern *pattern)
3274 {
3275         struct {
3276                 __le32 tag;
3277                 __le16 radar_type;
3278
3279                 u8 enb;
3280                 u8 stgr;
3281                 u8 min_crpn;
3282                 u8 max_crpn;
3283                 u8 min_crpr;
3284                 u8 min_pw;
3285                 __le32 min_pri;
3286                 __le32 max_pri;
3287                 u8 max_pw;
3288                 u8 min_crbn;
3289                 u8 max_crbn;
3290                 u8 min_stgpn;
3291                 u8 max_stgpn;
3292                 u8 min_stgpr;
3293                 u8 rsv[2];
3294                 __le32 min_stgpr_diff;
3295         } __packed req = {
3296                 .tag = cpu_to_le32(0x2),
3297                 .radar_type = cpu_to_le16(index),
3298
3299 #define __req_field_u8(field) .field = pattern->field
3300 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
3301                 __req_field_u8(enb),
3302                 __req_field_u8(stgr),
3303                 __req_field_u8(min_crpn),
3304                 __req_field_u8(max_crpn),
3305                 __req_field_u8(min_crpr),
3306                 __req_field_u8(min_pw),
3307                 __req_field_u32(min_pri),
3308                 __req_field_u32(max_pri),
3309                 __req_field_u8(max_pw),
3310                 __req_field_u8(min_crbn),
3311                 __req_field_u8(max_crbn),
3312                 __req_field_u8(min_stgpn),
3313                 __req_field_u8(max_stgpn),
3314                 __req_field_u8(min_stgpr),
3315                 __req_field_u32(min_stgpr_diff),
3316 #undef __req_field_u8
3317 #undef __req_field_u32
3318         };
3319
3320         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3321                                  sizeof(req), true);
3322 }
3323
3324 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
3325 {
3326         struct mt7915_dev *dev = phy->dev;
3327         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3328         int freq1 = chandef->center_freq1;
3329         bool ext_phy = phy != &dev->phy;
3330         struct {
3331                 u8 control_ch;
3332                 u8 center_ch;
3333                 u8 bw;
3334                 u8 tx_streams_num;
3335                 u8 rx_streams;  /* mask or num */
3336                 u8 switch_reason;
3337                 u8 band_idx;
3338                 u8 center_ch2;  /* for 80+80 only */
3339                 __le16 cac_case;
3340                 u8 channel_band;
3341                 u8 rsv0;
3342                 __le32 outband_freq;
3343                 u8 txpower_drop;
3344                 u8 ap_bw;
3345                 u8 ap_center_ch;
3346                 u8 rsv1[57];
3347         } __packed req = {
3348                 .control_ch = chandef->chan->hw_value,
3349                 .center_ch = ieee80211_frequency_to_channel(freq1),
3350                 .bw = mt7915_mcu_chan_bw(chandef),
3351                 .tx_streams_num = hweight8(phy->mt76->antenna_mask),
3352                 .rx_streams = phy->mt76->antenna_mask,
3353                 .band_idx = ext_phy,
3354                 .channel_band = chandef->chan->band,
3355         };
3356
3357 #ifdef CONFIG_NL80211_TESTMODE
3358         if (phy->mt76->test.tx_antenna_mask &&
3359             (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
3360              phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES ||
3361              phy->mt76->test.state == MT76_TM_STATE_TX_CONT)) {
3362                 req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
3363                 req.rx_streams = phy->mt76->test.tx_antenna_mask;
3364
3365                 if (ext_phy) {
3366                         req.tx_streams_num = 2;
3367                         req.rx_streams >>= 2;
3368                 }
3369         }
3370 #endif
3371
3372         if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
3373                 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
3374         else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
3375                  chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
3376                 req.switch_reason = CH_SWITCH_DFS;
3377         else
3378                 req.switch_reason = CH_SWITCH_NORMAL;
3379
3380         if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
3381                 req.rx_streams = hweight8(req.rx_streams);
3382
3383         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
3384                 int freq2 = chandef->center_freq2;
3385
3386                 req.center_ch2 = ieee80211_frequency_to_channel(freq2);
3387         }
3388
3389         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
3390 }
3391
3392 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
3393 {
3394 #define TOTAL_PAGE_MASK         GENMASK(7, 5)
3395 #define PAGE_IDX_MASK           GENMASK(4, 2)
3396 #define PER_PAGE_SIZE           0x400
3397         struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
3398         u8 total = MT7915_EEPROM_SIZE / PER_PAGE_SIZE;
3399         u8 *eep = (u8 *)dev->mt76.eeprom.data;
3400         int eep_len;
3401         int i;
3402
3403         for (i = 0; i <= total; i++, eep += eep_len) {
3404                 struct sk_buff *skb;
3405                 int ret;
3406
3407                 if (i == total)
3408                         eep_len = MT7915_EEPROM_SIZE % PER_PAGE_SIZE;
3409                 else
3410                         eep_len = PER_PAGE_SIZE;
3411
3412                 skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3413                                          sizeof(req) + eep_len);
3414                 if (!skb)
3415                         return -ENOMEM;
3416
3417                 req.format = FIELD_PREP(TOTAL_PAGE_MASK, total) |
3418                              FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
3419                 req.len = cpu_to_le16(eep_len);
3420
3421                 skb_put_data(skb, &req, sizeof(req));
3422                 skb_put_data(skb, eep, eep_len);
3423
3424                 ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3425                                             MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
3426                 if (ret)
3427                         return ret;
3428         }
3429
3430         return 0;
3431 }
3432
3433 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
3434 {
3435         struct mt7915_mcu_eeprom req = {
3436                 .buffer_mode = EE_MODE_EFUSE,
3437                 .format = EE_FORMAT_WHOLE,
3438         };
3439
3440         if (dev->flash_mode)
3441                 return mt7915_mcu_set_eeprom_flash(dev);
3442
3443         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
3444                                  &req, sizeof(req), true);
3445 }
3446
3447 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
3448 {
3449         struct mt7915_mcu_eeprom_info req = {
3450                 .addr = cpu_to_le32(round_down(offset,
3451                                     MT7915_EEPROM_BLOCK_SIZE)),
3452         };
3453         struct mt7915_mcu_eeprom_info *res;
3454         struct sk_buff *skb;
3455         int ret;
3456         u8 *buf;
3457
3458         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_ACCESS), &req,
3459                                 sizeof(req), true, &skb);
3460         if (ret)
3461                 return ret;
3462
3463         res = (struct mt7915_mcu_eeprom_info *)skb->data;
3464         buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
3465         memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
3466         dev_kfree_skb(skb);
3467
3468         return 0;
3469 }
3470
3471 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
3472                                   u8 *data, u32 len, int cmd)
3473 {
3474         struct {
3475                 u8 dir;
3476                 u8 valid;
3477                 __le16 bitmap;
3478                 s8 precal;
3479                 u8 action;
3480                 u8 band;
3481                 u8 idx;
3482                 u8 rsv[4];
3483                 __le32 len;
3484         } req;
3485         struct sk_buff *skb;
3486
3487         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
3488         if (!skb)
3489                 return -ENOMEM;
3490
3491         req.idx = idx;
3492         req.len = cpu_to_le32(len);
3493         skb_put_data(skb, &req, sizeof(req));
3494         skb_put_data(skb, data, len);
3495
3496         return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
3497 }
3498
3499 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
3500 {
3501         u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3502         u32 total = MT_EE_CAL_GROUP_SIZE;
3503
3504         if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
3505                 return 0;
3506
3507         /*
3508          * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
3509          * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
3510          */
3511         while (total > 0) {
3512                 int ret, len;
3513
3514                 len = min_t(u32, total, MT_EE_CAL_UNIT);
3515
3516                 ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
3517                                              MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
3518                 if (ret)
3519                         return ret;
3520
3521                 total -= len;
3522                 cal += len;
3523                 idx++;
3524         }
3525
3526         return 0;
3527 }
3528
3529 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
3530 {
3531         int i;
3532
3533         for (i = 0; i < n_freqs; i++)
3534                 if (cur == freqs[i])
3535                         return i;
3536
3537         return -1;
3538 }
3539
3540 static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
3541 {
3542         static const u16 freq_list[] = {
3543                 5180, 5200, 5220, 5240,
3544                 5260, 5280, 5300, 5320,
3545                 5500, 5520, 5540, 5560,
3546                 5580, 5600, 5620, 5640,
3547                 5660, 5680, 5700, 5745,
3548                 5765, 5785, 5805, 5825
3549         };
3550         int offset_2g = ARRAY_SIZE(freq_list);
3551         int idx;
3552
3553         if (freq < 4000) {
3554                 if (freq < 2432)
3555                         return offset_2g;
3556                 if (freq < 2457)
3557                         return offset_2g + 1;
3558
3559                 return offset_2g + 2;
3560         }
3561
3562         if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
3563                 return -1;
3564
3565         if (bw != NL80211_CHAN_WIDTH_20) {
3566                 idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3567                                            freq + 10);
3568                 if (idx >= 0)
3569                         return idx;
3570
3571                 idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3572                                            freq - 10);
3573                 if (idx >= 0)
3574                         return idx;
3575         }
3576
3577         return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3578 }
3579
3580 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
3581 {
3582         struct mt7915_dev *dev = phy->dev;
3583         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3584         u16 total = 2, center_freq = chandef->center_freq1;
3585         u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3586         int idx;
3587
3588         if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
3589                 return 0;
3590
3591         idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
3592         if (idx < 0)
3593                 return -EINVAL;
3594
3595         /* Items: Tx DPD, Tx Flatness */
3596         idx = idx * 2;
3597         cal += MT_EE_CAL_GROUP_SIZE;
3598
3599         while (total--) {
3600                 int ret;
3601
3602                 cal += (idx * MT_EE_CAL_UNIT);
3603                 ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
3604                                              MCU_EXT_CMD(DPD_PRE_CAL_INFO));
3605                 if (ret)
3606                         return ret;
3607
3608                 idx++;
3609         }
3610
3611         return 0;
3612 }
3613
3614 int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
3615 {
3616         /* strict order */
3617         static const enum mt7915_chan_mib_offs offs[] = {
3618                 MIB_BUSY_TIME, MIB_TX_TIME, MIB_RX_TIME, MIB_OBSS_AIRTIME
3619         };
3620         struct mt76_channel_state *state = phy->mt76->chan_state;
3621         struct mt76_channel_state *state_ts = &phy->state_ts;
3622         struct mt7915_dev *dev = phy->dev;
3623         struct mt7915_mcu_mib *res, req[4];
3624         struct sk_buff *skb;
3625         int i, ret;
3626
3627         for (i = 0; i < 4; i++) {
3628                 req[i].band = cpu_to_le32(phy != &dev->phy);
3629                 req[i].offs = cpu_to_le32(offs[i]);
3630         }
3631
3632         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(GET_MIB_INFO),
3633                                         req, sizeof(req), true, &skb);
3634         if (ret)
3635                 return ret;
3636
3637         res = (struct mt7915_mcu_mib *)(skb->data + 20);
3638
3639         if (chan_switch)
3640                 goto out;
3641
3642 #define __res_u64(s) le64_to_cpu(res[s].data)
3643         state->cc_busy += __res_u64(0) - state_ts->cc_busy;
3644         state->cc_tx += __res_u64(1) - state_ts->cc_tx;
3645         state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx;
3646         state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx;
3647
3648 out:
3649         state_ts->cc_busy = __res_u64(0);
3650         state_ts->cc_tx = __res_u64(1);
3651         state_ts->cc_bss_rx = __res_u64(2);
3652         state_ts->cc_rx = __res_u64(2) + __res_u64(3);
3653 #undef __res_u64
3654
3655         dev_kfree_skb(skb);
3656
3657         return 0;
3658 }
3659
3660 int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
3661 {
3662         struct mt7915_dev *dev = phy->dev;
3663         struct {
3664                 u8 ctrl_id;
3665                 u8 action;
3666                 u8 dbdc_idx;
3667                 u8 rsv[5];
3668         } req = {
3669                 .ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3670                 .dbdc_idx = phy != &dev->phy,
3671         };
3672
3673         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3674                                  sizeof(req), true);
3675 }
3676
3677 int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
3678 {
3679         struct mt7915_dev *dev = phy->dev;
3680         struct {
3681                 struct mt7915_mcu_thermal_ctrl ctrl;
3682
3683                 __le32 trigger_temp;
3684                 __le32 restore_temp;
3685                 __le16 sustain_time;
3686                 u8 rsv[2];
3687         } __packed req = {
3688                 .ctrl = {
3689                         .band_idx = phy != &dev->phy,
3690                 },
3691         };
3692         int level;
3693
3694 #define TRIGGER_TEMPERATURE     122
3695 #define RESTORE_TEMPERATURE     116
3696 #define SUSTAIN_PERIOD          10
3697
3698         if (!state) {
3699                 req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
3700                 goto out;
3701         }
3702
3703         /* set duty cycle and level */
3704         for (level = 0; level < 4; level++) {
3705                 int ret;
3706
3707                 req.ctrl.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG;
3708                 req.ctrl.duty.duty_level = level;
3709                 req.ctrl.duty.duty_cycle = state;
3710                 state = state * 4 / 5;
3711
3712                 ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3713                                         &req, sizeof(req.ctrl), false);
3714                 if (ret)
3715                         return ret;
3716         }
3717
3718         /* currently use fixed values for throttling, and would be better
3719          * to implement thermal zone for dynamic trip in the long run.
3720          */
3721
3722         /* set high-temperature trigger threshold */
3723         req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
3724         req.trigger_temp = cpu_to_le32(TRIGGER_TEMPERATURE);
3725         req.restore_temp = cpu_to_le32(RESTORE_TEMPERATURE);
3726         req.sustain_time = cpu_to_le16(SUSTAIN_PERIOD);
3727
3728 out:
3729         req.ctrl.type.protect_type = 1;
3730         req.ctrl.type.trigger_type = 1;
3731
3732         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3733                                  &req, sizeof(req), false);
3734 }
3735
3736 int mt7915_mcu_get_tx_rate(struct mt7915_dev *dev, u32 cmd, u16 wlan_idx)
3737 {
3738         struct {
3739                 __le32 cmd;
3740                 __le16 wlan_idx;
3741                 __le16 ru_idx;
3742                 __le16 direction;
3743                 __le16 dump_group;
3744         } req = {
3745                 .cmd = cpu_to_le32(cmd),
3746                 .wlan_idx = cpu_to_le16(wlan_idx),
3747                 .dump_group = cpu_to_le16(1),
3748         };
3749
3750         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RATE_CTRL), &req,
3751                                  sizeof(req), false);
3752 }
3753
3754 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3755 {
3756         struct mt7915_dev *dev = phy->dev;
3757         struct mt76_phy *mphy = phy->mt76;
3758         struct ieee80211_hw *hw = mphy->hw;
3759         struct mt7915_sku_val {
3760                 u8 format_id;
3761                 u8 limit_type;
3762                 u8 dbdc_idx;
3763                 s8 val[MT7915_SKU_RATE_NUM];
3764         } __packed req = {
3765                 .format_id = 4,
3766                 .dbdc_idx = phy != &dev->phy,
3767         };
3768         struct mt76_power_limits limits_array;
3769         s8 *la = (s8 *)&limits_array;
3770         int i, idx, n_chains = hweight8(mphy->antenna_mask);
3771         int tx_power;
3772
3773         tx_power = hw->conf.power_level * 2 -
3774                    mt76_tx_power_nss_delta(n_chains);
3775
3776         tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3777                                               &limits_array, tx_power);
3778         mphy->txpower_cur = tx_power;
3779
3780         for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3781                 u8 mcs_num, len = mt7915_sku_group_len[i];
3782                 int j;
3783
3784                 if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3785                         mcs_num = 10;
3786
3787                         if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3788                                 la = (s8 *)&limits_array + 12;
3789                 } else {
3790                         mcs_num = len;
3791                 }
3792
3793                 for (j = 0; j < min_t(u8, mcs_num, len); j++)
3794                         req.val[idx + j] = la[j];
3795
3796                 la += mcs_num;
3797                 idx += len;
3798         }
3799
3800         return mt76_mcu_send_msg(&dev->mt76,
3801                                  MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3802                                  sizeof(req), true);
3803 }
3804
3805 int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
3806 {
3807 #define RATE_POWER_INFO 2
3808         struct mt7915_dev *dev = phy->dev;
3809         struct {
3810                 u8 format_id;
3811                 u8 category;
3812                 u8 band;
3813                 u8 _rsv;
3814         } __packed req = {
3815                 .format_id = 7,
3816                 .category = RATE_POWER_INFO,
3817                 .band = phy != &dev->phy,
3818         };
3819         s8 res[MT7915_SKU_RATE_NUM][2];
3820         struct sk_buff *skb;
3821         int ret, i;
3822
3823         ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3824                                         MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
3825                                         &req, sizeof(req), true, &skb);
3826         if (ret)
3827                 return ret;
3828
3829         memcpy(res, skb->data + 4, sizeof(res));
3830         for (i = 0; i < len; i++)
3831                 txpower[i] = res[i][req.band];
3832
3833         dev_kfree_skb(skb);
3834
3835         return 0;
3836 }
3837
3838 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3839                               u8 en)
3840 {
3841         struct {
3842                 u8 test_mode_en;
3843                 u8 param_idx;
3844                 u8 _rsv[2];
3845
3846                 u8 enable;
3847                 u8 _rsv2[3];
3848
3849                 u8 pad[8];
3850         } __packed req = {
3851                 .test_mode_en = test_mode,
3852                 .param_idx = param,
3853                 .enable = en,
3854         };
3855
3856         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3857                                  sizeof(req), false);
3858 }
3859
3860 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3861 {
3862         struct mt7915_dev *dev = phy->dev;
3863         struct mt7915_sku {
3864                 u8 format_id;
3865                 u8 sku_enable;
3866                 u8 dbdc_idx;
3867                 u8 rsv;
3868         } __packed req = {
3869                 .format_id = 0,
3870                 .dbdc_idx = phy != &dev->phy,
3871                 .sku_enable = enable,
3872         };
3873
3874         return mt76_mcu_send_msg(&dev->mt76,
3875                                  MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3876                                  sizeof(req), true);
3877 }
3878
3879 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3880 {
3881         struct {
3882                 u8 action;
3883                 u8 set;
3884                 u8 band;
3885                 u8 rsv;
3886         } req = {
3887                 .action = action,
3888                 .set = set,
3889                 .band = band,
3890         };
3891
3892         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3893                                  &req, sizeof(req), false);
3894 }
3895
3896 int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
3897 {
3898         struct {
3899                 u8 action;
3900                 union {
3901                         struct {
3902                                 u8 snd_mode;
3903                                 u8 sta_num;
3904                                 u8 rsv;
3905                                 u8 wlan_idx[4];
3906                                 __le32 snd_period;      /* ms */
3907                         } __packed snd;
3908                         struct {
3909                                 bool ebf;
3910                                 bool ibf;
3911                                 u8 rsv;
3912                         } __packed type;
3913                         struct {
3914                                 u8 bf_num;
3915                                 u8 bf_bitmap;
3916                                 u8 bf_sel[8];
3917                                 u8 rsv[5];
3918                         } __packed mod;
3919                 };
3920         } __packed req = {
3921                 .action = action,
3922         };
3923
3924 #define MT_BF_PROCESSING        4
3925         switch (action) {
3926         case MT_BF_SOUNDING_ON:
3927                 req.snd.snd_mode = MT_BF_PROCESSING;
3928                 break;
3929         case MT_BF_TYPE_UPDATE:
3930                 req.type.ebf = true;
3931                 req.type.ibf = dev->ibf;
3932                 break;
3933         case MT_BF_MODULE_UPDATE:
3934                 req.mod.bf_num = 2;
3935                 req.mod.bf_bitmap = GENMASK(1, 0);
3936                 break;
3937         default:
3938                 return -EINVAL;
3939         }
3940
3941         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3942                                  sizeof(req), true);
3943 }
3944
3945 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3946                             bool enable)
3947 {
3948 #define MT_SPR_ENABLE           1
3949         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3950         struct {
3951                 u8 action;
3952                 u8 arg_num;
3953                 u8 band_idx;
3954                 u8 status;
3955                 u8 drop_tx_idx;
3956                 u8 sta_idx;     /* 256 sta */
3957                 u8 rsv[2];
3958                 __le32 val;
3959         } __packed req = {
3960                 .action = MT_SPR_ENABLE,
3961                 .arg_num = 1,
3962                 .band_idx = mvif->band_idx,
3963                 .val = cpu_to_le32(enable),
3964         };
3965
3966         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3967                                  sizeof(req), true);
3968 }
3969
3970 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3971                            struct ieee80211_sta *sta, struct rate_info *rate)
3972 {
3973         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3974         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3975         struct mt7915_dev *dev = phy->dev;
3976         struct mt76_phy *mphy = phy->mt76;
3977         struct {
3978                 u8 category;
3979                 u8 band;
3980                 __le16 wcid;
3981         } __packed req = {
3982                 .category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3983                 .band = mvif->band_idx,
3984                 .wcid = cpu_to_le16(msta->wcid.idx),
3985         };
3986         struct ieee80211_supported_band *sband;
3987         struct mt7915_mcu_phy_rx_info *res;
3988         struct sk_buff *skb;
3989         int ret;
3990         bool cck = false;
3991
3992         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3993                                         &req, sizeof(req), true, &skb);
3994         if (ret)
3995                 return ret;
3996
3997         res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3998
3999         rate->mcs = res->rate;
4000         rate->nss = res->nsts + 1;
4001
4002         switch (res->mode) {
4003         case MT_PHY_TYPE_CCK:
4004                 cck = true;
4005                 fallthrough;
4006         case MT_PHY_TYPE_OFDM:
4007                 if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
4008                         sband = &mphy->sband_5g.sband;
4009                 else
4010                         sband = &mphy->sband_2g.sband;
4011
4012                 rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
4013                 rate->legacy = sband->bitrates[rate->mcs].bitrate;
4014                 break;
4015         case MT_PHY_TYPE_HT:
4016         case MT_PHY_TYPE_HT_GF:
4017                 if (rate->mcs > 31) {
4018                         ret = -EINVAL;
4019                         goto out;
4020                 }
4021
4022                 rate->flags = RATE_INFO_FLAGS_MCS;
4023                 if (res->gi)
4024                         rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
4025                 break;
4026         case MT_PHY_TYPE_VHT:
4027                 if (rate->mcs > 9) {
4028                         ret = -EINVAL;
4029                         goto out;
4030                 }
4031
4032                 rate->flags = RATE_INFO_FLAGS_VHT_MCS;
4033                 if (res->gi)
4034                         rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
4035                 break;
4036         case MT_PHY_TYPE_HE_SU:
4037         case MT_PHY_TYPE_HE_EXT_SU:
4038         case MT_PHY_TYPE_HE_TB:
4039         case MT_PHY_TYPE_HE_MU:
4040                 if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
4041                         ret = -EINVAL;
4042                         goto out;
4043                 }
4044                 rate->he_gi = res->gi;
4045                 rate->flags = RATE_INFO_FLAGS_HE_MCS;
4046                 break;
4047         default:
4048                 ret = -EINVAL;
4049                 goto out;
4050         }
4051
4052         switch (res->bw) {
4053         case IEEE80211_STA_RX_BW_160:
4054                 rate->bw = RATE_INFO_BW_160;
4055                 break;
4056         case IEEE80211_STA_RX_BW_80:
4057                 rate->bw = RATE_INFO_BW_80;
4058                 break;
4059         case IEEE80211_STA_RX_BW_40:
4060                 rate->bw = RATE_INFO_BW_40;
4061                 break;
4062         default:
4063                 rate->bw = RATE_INFO_BW_20;
4064                 break;
4065         }
4066
4067 out:
4068         dev_kfree_skb(skb);
4069
4070         return ret;
4071 }