drivers/net/wireless/mediatek/mt76-6e-usb/mt7915/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2020 MediaTek Inc. */
   3
   4 #include <linux/firmware.h>
   5 #include <linux/fs.h>
   6 #include "mt7915.h"
   7 #include "mcu.h"
   8 #include "mac.h"
   9 #include "eeprom.h"
  10
  11 struct mt7915_patch_hdr {
  12         char build_date[16];
  13         char platform[4];
  14         __be32 hw_sw_ver;
  15         __be32 patch_ver;
  16         __be16 checksum;
  17         u16 reserved;
  18         struct {
  19                 __be32 patch_ver;
  20                 __be32 subsys;
  21                 __be32 feature;
  22                 __be32 n_region;
  23                 __be32 crc;
  24                 u32 reserved[11];
  25         } desc;
  26 } __packed;
  27
  28 struct mt7915_patch_sec {
  29         __be32 type;
  30         __be32 offs;
  31         __be32 size;
  32         union {
  33                 __be32 spec[13];
  34                 struct {
  35                         __be32 addr;
  36                         __be32 len;
  37                         __be32 sec_key_idx;
  38                         __be32 align_len;
  39                         u32 reserved[9];
  40                 } info;
  41         };
  42 } __packed;
  43
  44 struct mt7915_fw_trailer {
  45         u8 chip_id;
  46         u8 eco_code;
  47         u8 n_region;
  48         u8 format_ver;
  49         u8 format_flag;
  50         u8 reserved[2];
  51         char fw_ver[10];
  52         char build_date[15];
  53         u32 crc;
  54 } __packed;
  55
  56 struct mt7915_fw_region {
  57         __le32 decomp_crc;
  58         __le32 decomp_len;
  59         __le32 decomp_blk_sz;
  60         u8 reserved[4];
  61         __le32 addr;
  62         __le32 len;
  63         u8 feature_set;
  64         u8 reserved1[15];
  65 } __packed;
  66
  67 #define fw_name(_dev, name, ...)        ({                      \
  68         char *_fw;                                              \
  69         switch (mt76_chip(&(_dev)->mt76)) {                     \
  70         case 0x7915:                                            \
  71                 _fw = MT7915_##name;                            \
  72                 break;                                          \
  73         case 0x7986:                                            \
  74                 _fw = MT7986_##name##__VA_ARGS__;               \
  75                 break;                                          \
  76         default:                                                \
  77                 _fw = MT7916_##name;                            \
  78                 break;                                          \
  79         }                                                       \
  80         _fw;                                                    \
  81 })
  82
  83 #define fw_name_var(_dev, name)         (mt7915_check_adie(dev, false) ?        \
  84                                          fw_name(_dev, name) :                  \
  85                                          fw_name(_dev, name, _MT7975))
  86
  87 #define MCU_PATCH_ADDRESS               0x200000
  88
  89 #define HE_PHY(p, c)                    u8_get_bits(c, IEEE80211_HE_PHY_##p)
  90 #define HE_MAC(m, c)                    u8_get_bits(c, IEEE80211_HE_MAC_##m)
  91
  92 static u8
  93 mt7915_mcu_get_sta_nss(u16 mcs_map)
  94 {
  95         u8 nss;
  96
  97         for (nss = 8; nss > 0; nss--) {
  98                 u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
  99
 100                 if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
 101                         break;
 102         }
 103
 104         return nss - 1;
 105 }
 106
 107 static void
 108 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
 109                           u16 mcs_map)
 110 {
 111         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
 112         struct mt7915_dev *dev = msta->vif->phy->dev;
 113         enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
 114         const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
 115         int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
 116
 117         for (nss = 0; nss < max_nss; nss++) {
 118                 int mcs;
 119
 120                 switch ((mcs_map >> (2 * nss)) & 0x3) {
 121                 case IEEE80211_HE_MCS_SUPPORT_0_11:
 122                         mcs = GENMASK(11, 0);
 123                         break;
 124                 case IEEE80211_HE_MCS_SUPPORT_0_9:
 125                         mcs = GENMASK(9, 0);
 126                         break;
 127                 case IEEE80211_HE_MCS_SUPPORT_0_7:
 128                         mcs = GENMASK(7, 0);
 129                         break;
 130                 default:
 131                         mcs = 0;
 132                 }
 133
 134                 mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
 135
 136                 switch (mcs) {
 137                 case 0 ... 7:
 138                         mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
 139                         break;
 140                 case 8 ... 9:
 141                         mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
 142                         break;
 143                 case 10 ... 11:
 144                         mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
 145                         break;
 146                 default:
 147                         mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
 148                         break;
 149                 }
 150                 mcs_map &= ~(0x3 << (nss * 2));
 151                 mcs_map |= mcs << (nss * 2);
 152
 153                 /* only support 2ss on 160MHz for mt7915 */
 154                 if (is_mt7915(&dev->mt76) && nss > 1 &&
 155                     sta->bandwidth == IEEE80211_STA_RX_BW_160)
 156                         break;
 157         }
 158
 159         *he_mcs = cpu_to_le16(mcs_map);
 160 }
 161
 162 static void
 163 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
 164                            const u16 *mask)
 165 {
 166         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
 167         struct mt7915_dev *dev = msta->vif->phy->dev;
 168         u16 mcs_map = le16_to_cpu(sta->vht_cap.vht_mcs.rx_mcs_map);
 169         int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
 170         u16 mcs;
 171
 172         for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
 173                 switch (mcs_map & 0x3) {
 174                 case IEEE80211_VHT_MCS_SUPPORT_0_9:
 175                         mcs = GENMASK(9, 0);
 176                         break;
 177                 case IEEE80211_VHT_MCS_SUPPORT_0_8:
 178                         mcs = GENMASK(8, 0);
 179                         break;
 180                 case IEEE80211_VHT_MCS_SUPPORT_0_7:
 181                         mcs = GENMASK(7, 0);
 182                         break;
 183                 default:
 184                         mcs = 0;
 185                 }
 186
 187                 vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
 188
 189                 /* only support 2ss on 160MHz for mt7915 */
 190                 if (is_mt7915(&dev->mt76) && nss > 1 &&
 191                     sta->bandwidth == IEEE80211_STA_RX_BW_160)
 192                         break;
 193         }
 194 }
 195
 196 static void
 197 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
 198                           const u8 *mask)
 199 {
 200         int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
 201
 202         for (nss = 0; nss < max_nss; nss++)
 203                 ht_mcs[nss] = sta->ht_cap.mcs.rx_mask[nss] & mask[nss];
 204 }
 205
 206 static int
 207 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 208                           struct sk_buff *skb, int seq)
 209 {
 210         struct mt7915_mcu_rxd *rxd;
 211         int ret = 0;
 212
 213         if (!skb) {
 214                 dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
 215                         cmd, seq);
 216                 return -ETIMEDOUT;
 217         }
 218
 219         rxd = (struct mt7915_mcu_rxd *)skb->data;
 220         if (seq != rxd->seq)
 221                 return -EAGAIN;
 222
 223         if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
 224                 skb_pull(skb, sizeof(*rxd) - 4);
 225                 ret = *skb->data;
 226         } else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
 227                 skb_pull(skb, sizeof(*rxd) + 4);
 228                 ret = le32_to_cpu(*(__le32 *)skb->data);
 229         } else {
 230                 skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
 231         }
 232
 233         return ret;
 234 }
 235
 236 static int
 237 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 238                         int cmd, int *wait_seq)
 239 {
 240         struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
 241         struct mt7915_mcu_txd *mcu_txd;
 242         enum mt76_mcuq_id qid;
 243         __le32 *txd;
 244         u32 val;
 245         u8 seq;
 246
 247         /* TODO: make dynamic based on msg type */
 248         mdev->mcu.timeout = 20 * HZ;
 249
 250         seq = ++dev->mt76.mcu.msg_seq & 0xf;
 251         if (!seq)
 252                 seq = ++dev->mt76.mcu.msg_seq & 0xf;
 253
 254         if (cmd == MCU_CMD(FW_SCATTER)) {
 255                 qid = MT_MCUQ_FWDL;
 256                 goto exit;
 257         }
 258
 259         mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
 260         if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 261                 qid = MT_MCUQ_WA;
 262         else
 263                 qid = MT_MCUQ_WM;
 264
 265         txd = mcu_txd->txd;
 266
 267         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
 268               FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
 269               FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
 270         txd[0] = cpu_to_le32(val);
 271
 272         val = MT_TXD1_LONG_FORMAT |
 273               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
 274         txd[1] = cpu_to_le32(val);
 275
 276         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 277         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
 278                                                MT_TX_MCU_PORT_RX_Q0));
 279         mcu_txd->pkt_type = MCU_PKT_ID;
 280         mcu_txd->seq = seq;
 281
 282         mcu_txd->cid = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
 283         mcu_txd->set_query = MCU_Q_NA;
 284         mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
 285         if (mcu_txd->ext_cid) {
 286                 mcu_txd->ext_cid_ack = 1;
 287
 288                 /* do not use Q_SET for efuse */
 289                 if (cmd & __MCU_CMD_FIELD_QUERY)
 290                         mcu_txd->set_query = MCU_Q_QUERY;
 291                 else
 292                         mcu_txd->set_query = MCU_Q_SET;
 293         }
 294
 295         if (cmd & __MCU_CMD_FIELD_WA)
 296                 mcu_txd->s2d_index = MCU_S2D_H2C;
 297         else
 298                 mcu_txd->s2d_index = MCU_S2D_H2N;
 299
 300 exit:
 301         if (wait_seq)
 302                 *wait_seq = seq;
 303
 304         return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
 305 }
 306
 307 int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
 308 {
 309         struct {
 310                 __le32 args[3];
 311         } req = {
 312                 .args = {
 313                         cpu_to_le32(a1),
 314                         cpu_to_le32(a2),
 315                         cpu_to_le32(a3),
 316                 },
 317         };
 318
 319         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), false);
 320 }
 321
 322 static void
 323 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 324 {
 325         if (vif->csa_active)
 326                 ieee80211_csa_finish(vif);
 327 }
 328
 329 static void
 330 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
 331 {
 332         struct mt76_phy *mphy = &dev->mt76.phy;
 333         struct mt7915_mcu_csa_notify *c;
 334
 335         c = (struct mt7915_mcu_csa_notify *)skb->data;
 336
 337         if ((c->band_idx && !dev->phy.band_idx) && dev->mt76.phy2)
 338                 mphy = dev->mt76.phy2;
 339
 340         ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 341                         IEEE80211_IFACE_ITER_RESUME_ALL,
 342                         mt7915_mcu_csa_finish, mphy->hw);
 343 }
 344
 345 static void
 346 mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb)
 347 {
 348         struct mt76_phy *mphy = &dev->mt76.phy;
 349         struct mt7915_mcu_thermal_notify *t;
 350         struct mt7915_phy *phy;
 351
 352         t = (struct mt7915_mcu_thermal_notify *)skb->data;
 353         if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)
 354                 return;
 355
 356         if ((t->ctrl.band_idx && !dev->phy.band_idx) && dev->mt76.phy2)
 357                 mphy = dev->mt76.phy2;
 358
 359         phy = (struct mt7915_phy *)mphy->priv;
 360         phy->throttle_state = t->ctrl.duty.duty_cycle;
 361 }
 362
 363 static void
 364 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
 365 {
 366         struct mt76_phy *mphy = &dev->mt76.phy;
 367         struct mt7915_mcu_rdd_report *r;
 368
 369         r = (struct mt7915_mcu_rdd_report *)skb->data;
 370
 371         if ((r->band_idx && !dev->phy.band_idx) && dev->mt76.phy2)
 372                 mphy = dev->mt76.phy2;
 373
 374         if (r->band_idx == MT_RX_SEL2)
 375                 cfg80211_background_radar_event(mphy->hw->wiphy,
 376                                                 &dev->rdd2_chandef,
 377                                                 GFP_ATOMIC);
 378         else
 379                 ieee80211_radar_detected(mphy->hw);
 380         dev->hw_pattern++;
 381 }
 382
 383 static void
 384 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
 385 {
 386         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 387         const char *data = (char *)&rxd[1];
 388         const char *type;
 389         int len = skb->len - sizeof(*rxd);
 390
 391         switch (rxd->s2d_index) {
 392         case 0:
 393                 if (mt7915_debugfs_rx_log(dev, data, len))
 394                         return;
 395
 396                 type = "WM";
 397                 break;
 398         case 2:
 399                 type = "WA";
 400                 break;
 401         default:
 402                 type = "unknown";
 403                 break;
 404         }
 405
 406         wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type, len, data);
 407 }
 408
 409 static void
 410 mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 411 {
 412         if (!vif->color_change_active)
 413                 return;
 414
 415         ieee80211_color_change_finish(vif);
 416 }
 417
 418 static void
 419 mt7915_mcu_rx_bcc_notify(struct mt7915_dev *dev, struct sk_buff *skb)
 420 {
 421         struct mt76_phy *mphy = &dev->mt76.phy;
 422         struct mt7915_mcu_bcc_notify *b;
 423
 424         b = (struct mt7915_mcu_bcc_notify *)skb->data;
 425
 426         if ((b->band_idx && !dev->phy.band_idx) && dev->mt76.phy2)
 427                 mphy = dev->mt76.phy2;
 428
 429         ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 430                         IEEE80211_IFACE_ITER_RESUME_ALL,
 431                         mt7915_mcu_cca_finish, mphy->hw);
 432 }
 433
 434 static void
 435 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
 436 {
 437         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 438
 439         switch (rxd->ext_eid) {
 440         case MCU_EXT_EVENT_THERMAL_PROTECT:
 441                 mt7915_mcu_rx_thermal_notify(dev, skb);
 442                 break;
 443         case MCU_EXT_EVENT_RDD_REPORT:
 444                 mt7915_mcu_rx_radar_detected(dev, skb);
 445                 break;
 446         case MCU_EXT_EVENT_CSA_NOTIFY:
 447                 mt7915_mcu_rx_csa_notify(dev, skb);
 448                 break;
 449         case MCU_EXT_EVENT_FW_LOG_2_HOST:
 450                 mt7915_mcu_rx_log_message(dev, skb);
 451                 break;
 452         case MCU_EXT_EVENT_BCC_NOTIFY:
 453                 mt7915_mcu_rx_bcc_notify(dev, skb);
 454                 break;
 455         default:
 456                 break;
 457         }
 458 }
 459
 460 static void
 461 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
 462 {
 463         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 464
 465         switch (rxd->eid) {
 466         case MCU_EVENT_EXT:
 467                 mt7915_mcu_rx_ext_event(dev, skb);
 468                 break;
 469         default:
 470                 break;
 471         }
 472         dev_kfree_skb(skb);
 473 }
 474
 475 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
 476 {
 477         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 478
 479         if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
 480             rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 481             rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
 482             rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
 483             rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
 484             !rxd->seq)
 485                 mt7915_mcu_rx_unsolicited_event(dev, skb);
 486         else
 487                 mt76_mcu_rx_event(&dev->mt76, skb);
 488 }
 489
 490 static struct tlv *
 491 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
 492                              __le16 *sub_ntlv, __le16 *len)
 493 {
 494         struct tlv *ptlv, tlv = {
 495                 .tag = cpu_to_le16(sub_tag),
 496                 .len = cpu_to_le16(sub_len),
 497         };
 498
 499         ptlv = skb_put(skb, sub_len);
 500         memcpy(ptlv, &tlv, sizeof(tlv));
 501
 502         le16_add_cpu(sub_ntlv, 1);
 503         le16_add_cpu(len, sub_len);
 504
 505         return ptlv;
 506 }
 507
 508 /** bss info **/
 509 struct mt7915_he_obss_narrow_bw_ru_data {
 510         bool tolerated;
 511 };
 512
 513 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
 514                                                    struct cfg80211_bss *bss,
 515                                                    void *_data)
 516 {
 517         struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
 518         const struct element *elem;
 519
 520         rcu_read_lock();
 521         elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
 522
 523         if (!elem || elem->datalen <= 10 ||
 524             !(elem->data[10] &
 525               WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
 526                 data->tolerated = false;
 527
 528         rcu_read_unlock();
 529 }
 530
 531 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
 532                                               struct ieee80211_vif *vif)
 533 {
 534         struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
 535                 .tolerated = true,
 536         };
 537
 538         if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
 539                 return false;
 540
 541         cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
 542                           mt7915_check_he_obss_narrow_bw_ru_iter,
 543                           &iter_data);
 544
 545         /*
 546          * If there is at least one AP on radar channel that cannot
 547          * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
 548          */
 549         return !iter_data.tolerated;
 550 }
 551
 552 static void
 553 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 554                         struct mt7915_phy *phy)
 555 {
 556         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 557         struct bss_info_rf_ch *ch;
 558         struct tlv *tlv;
 559         int freq1 = chandef->center_freq1;
 560
 561         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
 562
 563         ch = (struct bss_info_rf_ch *)tlv;
 564         ch->pri_ch = chandef->chan->hw_value;
 565         ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
 566         ch->bw = mt76_connac_chan_bw(chandef);
 567
 568         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
 569                 int freq2 = chandef->center_freq2;
 570
 571                 ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
 572         }
 573
 574         if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
 575                 struct mt76_phy *mphy = phy->mt76;
 576
 577                 ch->he_ru26_block =
 578                         mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
 579                 ch->he_all_disable = false;
 580         } else {
 581                 ch->he_all_disable = true;
 582         }
 583 }
 584
 585 static void
 586 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 587                       struct mt7915_phy *phy)
 588 {
 589         int max_nss = hweight8(phy->mt76->chainmask);
 590         struct bss_info_ra *ra;
 591         struct tlv *tlv;
 592
 593         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
 594
 595         ra = (struct bss_info_ra *)tlv;
 596         ra->op_mode = vif->type == NL80211_IFTYPE_AP;
 597         ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
 598         ra->short_preamble = true;
 599         ra->tx_streams = max_nss;
 600         ra->rx_streams = max_nss;
 601         ra->algo = 4;
 602         ra->train_up_rule = 2;
 603         ra->train_up_high_thres = 110;
 604         ra->train_up_rule_rssi = -70;
 605         ra->low_traffic_thres = 2;
 606         ra->phy_cap = cpu_to_le32(0xfdf);
 607         ra->interval = cpu_to_le32(500);
 608         ra->fast_interval = cpu_to_le32(100);
 609 }
 610
 611 static void
 612 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 613                       struct mt7915_phy *phy)
 614 {
 615 #define DEFAULT_HE_PE_DURATION          4
 616 #define DEFAULT_HE_DURATION_RTS_THRES   1023
 617         const struct ieee80211_sta_he_cap *cap;
 618         struct bss_info_he *he;
 619         struct tlv *tlv;
 620
 621         cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
 622
 623         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
 624
 625         he = (struct bss_info_he *)tlv;
 626         he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
 627         if (!he->he_pe_duration)
 628                 he->he_pe_duration = DEFAULT_HE_PE_DURATION;
 629
 630         he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
 631         if (!he->he_rts_thres)
 632                 he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
 633
 634         he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
 635         he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
 636         he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
 637 }
 638
 639 static void
 640 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
 641 {
 642 #define TXD_CMP_MAP1            GENMASK(15, 0)
 643 #define TXD_CMP_MAP2            (GENMASK(31, 0) & ~BIT(23))
 644         struct bss_info_hw_amsdu *amsdu;
 645         struct tlv *tlv;
 646
 647         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
 648
 649         amsdu = (struct bss_info_hw_amsdu *)tlv;
 650         amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
 651         amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
 652         amsdu->trig_thres = cpu_to_le16(2);
 653         amsdu->enable = true;
 654 }
 655
 656 static void
 657 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
 658 {
 659         struct bss_info_bmc_rate *bmc;
 660         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 661         enum nl80211_band band = chandef->chan->band;
 662         struct tlv *tlv;
 663
 664         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
 665
 666         bmc = (struct bss_info_bmc_rate *)tlv;
 667         if (band == NL80211_BAND_2GHZ) {
 668                 bmc->short_preamble = true;
 669         } else {
 670                 bmc->bc_trans = cpu_to_le16(0x2000);
 671                 bmc->mc_trans = cpu_to_le16(0x2080);
 672         }
 673 }
 674
 675 static int
 676 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
 677                        bool bssid, bool enable)
 678 {
 679         struct mt7915_dev *dev = phy->dev;
 680         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 681         u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
 682         u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
 683         const u8 *addr = vif->addr;
 684         struct {
 685                 u8 mode;
 686                 u8 force_clear;
 687                 u8 clear_bitmap[8];
 688                 u8 entry_count;
 689                 u8 write;
 690                 u8 band;
 691
 692                 u8 index;
 693                 u8 bssid;
 694                 u8 addr[ETH_ALEN];
 695         } __packed req = {
 696                 .mode = !!mask || enable,
 697                 .entry_count = 1,
 698                 .write = 1,
 699                 .band = phy != &dev->phy,
 700                 .index = idx * 2 + bssid,
 701         };
 702
 703         if (bssid)
 704                 addr = vif->bss_conf.bssid;
 705
 706         if (enable)
 707                 ether_addr_copy(req.addr, addr);
 708
 709         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
 710                                  sizeof(req), true);
 711 }
 712
 713 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
 714                             struct ieee80211_vif *vif, int enable)
 715 {
 716         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 717         struct mt7915_dev *dev = phy->dev;
 718         struct sk_buff *skb;
 719
 720         if (mvif->mt76.omac_idx >= REPEATER_BSSID_START) {
 721                 mt7915_mcu_muar_config(phy, vif, false, enable);
 722                 mt7915_mcu_muar_config(phy, vif, true, enable);
 723         }
 724
 725         skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
 726                                               MT7915_BSS_UPDATE_MAX_SIZE);
 727         if (IS_ERR(skb))
 728                 return PTR_ERR(skb);
 729
 730         /* bss_omac must be first */
 731         if (enable)
 732                 mt76_connac_mcu_bss_omac_tlv(skb, vif);
 733
 734         mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
 735                                       mvif->sta.wcid.idx, enable);
 736
 737         if (vif->type == NL80211_IFTYPE_MONITOR)
 738                 goto out;
 739
 740         if (enable) {
 741                 mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
 742                 mt7915_mcu_bss_bmc_tlv(skb, phy);
 743                 mt7915_mcu_bss_ra_tlv(skb, vif, phy);
 744                 mt7915_mcu_bss_hw_amsdu_tlv(skb);
 745
 746                 if (vif->bss_conf.he_support)
 747                         mt7915_mcu_bss_he_tlv(skb, vif, phy);
 748
 749                 if (mvif->mt76.omac_idx >= EXT_BSSID_START &&
 750                     mvif->mt76.omac_idx < REPEATER_BSSID_START)
 751                         mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
 752         }
 753 out:
 754         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
 755                                      MCU_EXT_CMD(BSS_INFO_UPDATE), true);
 756 }
 757
 758 /** starec & wtbl **/
 759 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
 760                          struct ieee80211_ampdu_params *params,
 761                          bool enable)
 762 {
 763         struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
 764         struct mt7915_vif *mvif = msta->vif;
 765
 766         if (enable && !params->amsdu)
 767                 msta->wcid.amsdu = false;
 768
 769         return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
 770                                       MCU_EXT_CMD(STA_REC_UPDATE),
 771                                       enable, true);
 772 }
 773
 774 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
 775                          struct ieee80211_ampdu_params *params,
 776                          bool enable)
 777 {
 778         struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
 779         struct mt7915_vif *mvif = msta->vif;
 780
 781         return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
 782                                       MCU_EXT_CMD(STA_REC_UPDATE),
 783                                       enable, false);
 784 }
 785
 786 static void
 787 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
 788                       struct ieee80211_vif *vif)
 789 {
 790         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 791         struct ieee80211_he_cap_elem *elem = &sta->he_cap.he_cap_elem;
 792         struct ieee80211_he_mcs_nss_supp mcs_map;
 793         struct sta_rec_he *he;
 794         struct tlv *tlv;
 795         u32 cap = 0;
 796
 797         if (!sta->he_cap.has_he)
 798                 return;
 799
 800         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
 801
 802         he = (struct sta_rec_he *)tlv;
 803
 804         if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
 805                 cap |= STA_REC_HE_CAP_HTC;
 806
 807         if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
 808                 cap |= STA_REC_HE_CAP_BSR;
 809
 810         if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
 811                 cap |= STA_REC_HE_CAP_OM;
 812
 813         if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
 814                 cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
 815
 816         if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
 817                 cap |= STA_REC_HE_CAP_BQR;
 818
 819         if (elem->phy_cap_info[0] &
 820             (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
 821              IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
 822                 cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
 823
 824         if (mvif->cap.he_ldpc &&
 825             (elem->phy_cap_info[1] &
 826              IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
 827                 cap |= STA_REC_HE_CAP_LDPC;
 828
 829         if (elem->phy_cap_info[1] &
 830             IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
 831                 cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
 832
 833         if (elem->phy_cap_info[2] &
 834             IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
 835                 cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
 836
 837         if (elem->phy_cap_info[2] &
 838             IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
 839                 cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
 840
 841         if (elem->phy_cap_info[2] &
 842             IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
 843                 cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
 844
 845         if (elem->phy_cap_info[6] &
 846             IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB)
 847                 cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
 848
 849         if (elem->phy_cap_info[6] &
 850             IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
 851                 cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
 852
 853         if (elem->phy_cap_info[7] &
 854             IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
 855                 cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
 856
 857         if (elem->phy_cap_info[7] &
 858             IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
 859                 cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
 860
 861         if (elem->phy_cap_info[7] &
 862             IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
 863                 cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
 864
 865         if (elem->phy_cap_info[8] &
 866             IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
 867                 cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
 868
 869         if (elem->phy_cap_info[8] &
 870             IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
 871                 cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
 872
 873         if (elem->phy_cap_info[9] &
 874             IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
 875                 cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
 876
 877         if (elem->phy_cap_info[9] &
 878             IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
 879                 cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
 880
 881         he->he_cap = cpu_to_le32(cap);
 882
 883         mcs_map = sta->he_cap.he_mcs_nss_supp;
 884         switch (sta->bandwidth) {
 885         case IEEE80211_STA_RX_BW_160:
 886                 if (elem->phy_cap_info[0] &
 887                     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
 888                         mt7915_mcu_set_sta_he_mcs(sta,
 889                                                   &he->max_nss_mcs[CMD_HE_MCS_BW8080],
 890                                                   le16_to_cpu(mcs_map.rx_mcs_80p80));
 891
 892                 mt7915_mcu_set_sta_he_mcs(sta,
 893                                           &he->max_nss_mcs[CMD_HE_MCS_BW160],
 894                                           le16_to_cpu(mcs_map.rx_mcs_160));
 895                 fallthrough;
 896         default:
 897                 mt7915_mcu_set_sta_he_mcs(sta,
 898                                           &he->max_nss_mcs[CMD_HE_MCS_BW80],
 899                                           le16_to_cpu(mcs_map.rx_mcs_80));
 900                 break;
 901         }
 902
 903         he->t_frame_dur =
 904                 HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
 905         he->max_ampdu_exp =
 906                 HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
 907
 908         he->bw_set =
 909                 HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
 910         he->device_class =
 911                 HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
 912         he->punc_pream_rx =
 913                 HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
 914
 915         he->dcm_tx_mode =
 916                 HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
 917         he->dcm_tx_max_nss =
 918                 HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
 919         he->dcm_rx_mode =
 920                 HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
 921         he->dcm_rx_max_nss =
 922                 HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
 923         he->dcm_rx_max_nss =
 924                 HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
 925
 926         he->pkt_ext = 2;
 927 }
 928
 929 static void
 930 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
 931                         struct ieee80211_vif *vif)
 932 {
 933         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 934         struct ieee80211_he_cap_elem *elem = &sta->he_cap.he_cap_elem;
 935         struct sta_rec_muru *muru;
 936         struct tlv *tlv;
 937
 938         if (vif->type != NL80211_IFTYPE_STATION &&
 939             vif->type != NL80211_IFTYPE_AP)
 940                 return;
 941
 942         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
 943
 944         muru = (struct sta_rec_muru *)tlv;
 945
 946         muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
 947                                mvif->cap.vht_mu_ebfer ||
 948                                mvif->cap.vht_mu_ebfee;
 949         muru->cfg.mimo_ul_en = true;
 950         muru->cfg.ofdma_dl_en = true;
 951
 952         if (sta->vht_cap.vht_supported)
 953                 muru->mimo_dl.vht_mu_bfee =
 954                         !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 955
 956         if (!sta->he_cap.has_he)
 957                 return;
 958
 959         muru->mimo_dl.partial_bw_dl_mimo =
 960                 HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
 961
 962         muru->mimo_ul.full_ul_mimo =
 963                 HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
 964         muru->mimo_ul.partial_ul_mimo =
 965                 HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
 966
 967         muru->ofdma_dl.punc_pream_rx =
 968                 HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
 969         muru->ofdma_dl.he_20m_in_40m_2g =
 970                 HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
 971         muru->ofdma_dl.he_20m_in_160m =
 972                 HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
 973         muru->ofdma_dl.he_80m_in_160m =
 974                 HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
 975
 976         muru->ofdma_ul.t_frame_dur =
 977                 HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
 978         muru->ofdma_ul.mu_cascading =
 979                 HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
 980         muru->ofdma_ul.uo_ra =
 981                 HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
 982 }
 983
 984 static void
 985 mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
 986 {
 987         struct sta_rec_ht *ht;
 988         struct tlv *tlv;
 989
 990         if (!sta->ht_cap.ht_supported)
 991                 return;
 992
 993         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
 994
 995         ht = (struct sta_rec_ht *)tlv;
 996         ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
 997 }
 998
 999 static void
1000 mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1001 {
1002         struct sta_rec_vht *vht;
1003         struct tlv *tlv;
1004
1005         if (!sta->vht_cap.vht_supported)
1006                 return;
1007
1008         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1009
1010         vht = (struct sta_rec_vht *)tlv;
1011         vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1012         vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1013         vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1014 }
1015
1016 static void
1017 mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1018                          struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1019 {
1020         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1021         struct sta_rec_amsdu *amsdu;
1022         struct tlv *tlv;
1023
1024         if (vif->type != NL80211_IFTYPE_STATION &&
1025             vif->type != NL80211_IFTYPE_AP)
1026                 return;
1027
1028         if (!sta->max_amsdu_len)
1029             return;
1030
1031         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1032         amsdu = (struct sta_rec_amsdu *)tlv;
1033         amsdu->max_amsdu_num = 8;
1034         amsdu->amsdu_en = true;
1035         msta->wcid.amsdu = true;
1036
1037         switch (sta->max_amsdu_len) {
1038         case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1039                 if (!is_mt7915(&dev->mt76)) {
1040                         amsdu->max_mpdu_size =
1041                                 IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1042                         return;
1043                 }
1044                 fallthrough;
1045         case IEEE80211_MAX_MPDU_LEN_HT_7935:
1046         case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1047                 amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1048                 return;
1049         default:
1050                 amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1051                 return;
1052         }
1053 }
1054
1055 static int
1056 mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1057                         struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1058 {
1059         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1060         struct mt7915_sta *msta;
1061         struct wtbl_req_hdr *wtbl_hdr;
1062         struct mt76_wcid *wcid;
1063         struct tlv *tlv;
1064
1065         msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1066         wcid = sta ? &msta->wcid : NULL;
1067
1068         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1069         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1070                                                   WTBL_RESET_AND_SET, tlv,
1071                                                   &skb);
1072         if (IS_ERR(wtbl_hdr))
1073                 return PTR_ERR(wtbl_hdr);
1074
1075         mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, skb, vif, sta, tlv,
1076                                          wtbl_hdr);
1077         mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, tlv, wtbl_hdr);
1078         if (sta)
1079                 mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, skb, sta, tlv,
1080                                             wtbl_hdr, mvif->cap.ht_ldpc,
1081                                             mvif->cap.vht_ldpc);
1082
1083         return 0;
1084 }
1085
1086 static inline bool
1087 mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1088                         struct ieee80211_sta *sta, bool bfee)
1089 {
1090         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1091         int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1092
1093         if (vif->type != NL80211_IFTYPE_STATION &&
1094             vif->type != NL80211_IFTYPE_AP)
1095                 return false;
1096
1097         if (!bfee && tx_ant < 2)
1098                 return false;
1099
1100         if (sta->he_cap.has_he) {
1101                 struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
1102
1103                 if (bfee)
1104                         return mvif->cap.he_su_ebfee &&
1105                                HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1106                 else
1107                         return mvif->cap.he_su_ebfer &&
1108                                HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1109         }
1110
1111         if (sta->vht_cap.vht_supported) {
1112                 u32 cap = sta->vht_cap.cap;
1113
1114                 if (bfee)
1115                         return mvif->cap.vht_su_ebfee &&
1116                                (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1117                 else
1118                         return mvif->cap.vht_su_ebfer &&
1119                                (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1120         }
1121
1122         return false;
1123 }
1124
1125 static void
1126 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1127 {
1128         bf->sounding_phy = MT_PHY_TYPE_OFDM;
1129         bf->ndp_rate = 0;                               /* mcs0 */
1130         bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;      /* ofdm 24m */
1131         bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT; /* ofdm 24m */
1132 }
1133
1134 static void
1135 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1136                        struct sta_rec_bf *bf)
1137 {
1138         struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
1139         u8 n = 0;
1140
1141         bf->tx_mode = MT_PHY_TYPE_HT;
1142
1143         if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1144             (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1145                 n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1146                               mcs->tx_params);
1147         else if (mcs->rx_mask[3])
1148                 n = 3;
1149         else if (mcs->rx_mask[2])
1150                 n = 2;
1151         else if (mcs->rx_mask[1])
1152                 n = 1;
1153
1154         bf->nrow = hweight8(phy->mt76->chainmask) - 1;
1155         bf->ncol = min_t(u8, bf->nrow, n);
1156         bf->ibf_ncol = n;
1157 }
1158
1159 static void
1160 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1161                         struct sta_rec_bf *bf, bool explicit)
1162 {
1163         struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1164         struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1165         u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1166         u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1167         u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1168
1169         bf->tx_mode = MT_PHY_TYPE_VHT;
1170
1171         if (explicit) {
1172                 u8 sts, snd_dim;
1173
1174                 mt7915_mcu_sta_sounding_rate(bf);
1175
1176                 sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1177                                 pc->cap);
1178                 snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1179                                     vc->cap);
1180                 bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1181                 bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1182                 bf->ibf_ncol = bf->ncol;
1183
1184                 if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1185                         bf->nrow = 1;
1186         } else {
1187                 bf->nrow = tx_ant;
1188                 bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1189                 bf->ibf_ncol = nss_mcs;
1190
1191                 if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1192                         bf->ibf_nrow = 1;
1193         }
1194 }
1195
1196 static void
1197 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1198                        struct mt7915_phy *phy, struct sta_rec_bf *bf)
1199 {
1200         struct ieee80211_sta_he_cap *pc = &sta->he_cap;
1201         struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1202         const struct ieee80211_sta_he_cap *vc =
1203                 mt76_connac_get_he_phy_cap(phy->mt76, vif);
1204         const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1205         u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1206         u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1207         u8 snd_dim, sts;
1208
1209         bf->tx_mode = MT_PHY_TYPE_HE_SU;
1210
1211         mt7915_mcu_sta_sounding_rate(bf);
1212
1213         bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1214                                 pe->phy_cap_info[6]);
1215         bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1216                                 pe->phy_cap_info[6]);
1217         snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1218                          ve->phy_cap_info[5]);
1219         sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1220                      pe->phy_cap_info[4]);
1221         bf->nrow = min_t(u8, snd_dim, sts);
1222         bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1223         bf->ibf_ncol = bf->ncol;
1224
1225         if (sta->bandwidth != IEEE80211_STA_RX_BW_160)
1226                 return;
1227
1228         /* go over for 160MHz and 80p80 */
1229         if (pe->phy_cap_info[0] &
1230             IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1231                 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1232                 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1233
1234                 bf->ncol_bw160 = nss_mcs;
1235         }
1236
1237         if (pe->phy_cap_info[0] &
1238             IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1239                 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1240                 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1241
1242                 if (bf->ncol_bw160)
1243                         bf->ncol_bw160 = min_t(u8, bf->ncol_bw160, nss_mcs);
1244                 else
1245                         bf->ncol_bw160 = nss_mcs;
1246         }
1247
1248         snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1249                          ve->phy_cap_info[5]);
1250         sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1251                      pe->phy_cap_info[4]);
1252
1253         bf->nrow_bw160 = min_t(int, snd_dim, sts);
1254 }
1255
1256 static void
1257 mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1258                         struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1259 {
1260         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1261         struct mt7915_phy *phy = mvif->phy;
1262         int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1263         struct sta_rec_bf *bf;
1264         struct tlv *tlv;
1265         const u8 matrix[4][4] = {
1266                 {0, 0, 0, 0},
1267                 {1, 1, 0, 0},   /* 2x1, 2x2, 2x3, 2x4 */
1268                 {2, 4, 4, 0},   /* 3x1, 3x2, 3x3, 3x4 */
1269                 {3, 5, 6, 0}    /* 4x1, 4x2, 4x3, 4x4 */
1270         };
1271         bool ebf;
1272
1273         if (!(sta->ht_cap.ht_supported || sta->he_cap.has_he))
1274                 return;
1275
1276         ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
1277         if (!ebf && !dev->ibf)
1278                 return;
1279
1280         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1281         bf = (struct sta_rec_bf *)tlv;
1282
1283         /* he: eBF only, in accordance with spec
1284          * vht: support eBF and iBF
1285          * ht: iBF only, since mac80211 lacks of eBF support
1286          */
1287         if (sta->he_cap.has_he && ebf)
1288                 mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1289         else if (sta->vht_cap.vht_supported)
1290                 mt7915_mcu_sta_bfer_vht(sta, phy, bf, ebf);
1291         else if (sta->ht_cap.ht_supported)
1292                 mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1293         else
1294                 return;
1295
1296         bf->bf_cap = ebf ? ebf : dev->ibf << 1;
1297         bf->bw = sta->bandwidth;
1298         bf->ibf_dbw = sta->bandwidth;
1299         bf->ibf_nrow = tx_ant;
1300
1301         if (!ebf && sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1302                 bf->ibf_timeout = 0x48;
1303         else
1304                 bf->ibf_timeout = 0x18;
1305
1306         if (ebf && bf->nrow != tx_ant)
1307                 bf->mem_20m = matrix[tx_ant][bf->ncol];
1308         else
1309                 bf->mem_20m = matrix[bf->nrow][bf->ncol];
1310
1311         switch (sta->bandwidth) {
1312         case IEEE80211_STA_RX_BW_160:
1313         case IEEE80211_STA_RX_BW_80:
1314                 bf->mem_total = bf->mem_20m * 2;
1315                 break;
1316         case IEEE80211_STA_RX_BW_40:
1317                 bf->mem_total = bf->mem_20m;
1318                 break;
1319         case IEEE80211_STA_RX_BW_20:
1320         default:
1321                 break;
1322         }
1323 }
1324
1325 static void
1326 mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1327                         struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1328 {
1329         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1330         struct mt7915_phy *phy = mvif->phy;
1331         int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1332         struct sta_rec_bfee *bfee;
1333         struct tlv *tlv;
1334         u8 nrow = 0;
1335
1336         if (!(sta->vht_cap.vht_supported || sta->he_cap.has_he))
1337                 return;
1338
1339         if (!mt7915_is_ebf_supported(phy, vif, sta, true))
1340                 return;
1341
1342         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1343         bfee = (struct sta_rec_bfee *)tlv;
1344
1345         if (sta->he_cap.has_he) {
1346                 struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
1347
1348                 nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1349                               pe->phy_cap_info[5]);
1350         } else if (sta->vht_cap.vht_supported) {
1351                 struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1352
1353                 nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1354                                  pc->cap);
1355         }
1356
1357         /* reply with identity matrix to avoid 2x2 BF negative gain */
1358         bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
1359 }
1360
1361 static enum mcu_mmps_mode
1362 mt7915_mcu_get_mmps_mode(enum ieee80211_smps_mode smps)
1363 {
1364         switch (smps) {
1365         case IEEE80211_SMPS_OFF:
1366                 return MCU_MMPS_DISABLE;
1367         case IEEE80211_SMPS_STATIC:
1368                 return MCU_MMPS_STATIC;
1369         case IEEE80211_SMPS_DYNAMIC:
1370                 return MCU_MMPS_DYNAMIC;
1371         default:
1372                 return MCU_MMPS_DISABLE;
1373         }
1374 }
1375
1376 int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
1377                                    struct ieee80211_vif *vif,
1378                                    struct ieee80211_sta *sta,
1379                                    void *data, u32 field)
1380 {
1381         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1382         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1383         struct sta_phy *phy = data;
1384         struct sta_rec_ra_fixed *ra;
1385         struct sk_buff *skb;
1386         struct tlv *tlv;
1387
1388         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1389                                             &msta->wcid);
1390         if (IS_ERR(skb))
1391                 return PTR_ERR(skb);
1392
1393         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
1394         ra = (struct sta_rec_ra_fixed *)tlv;
1395
1396         switch (field) {
1397         case RATE_PARAM_AUTO:
1398                 break;
1399         case RATE_PARAM_FIXED:
1400         case RATE_PARAM_FIXED_MCS:
1401         case RATE_PARAM_FIXED_GI:
1402         case RATE_PARAM_FIXED_HE_LTF:
1403                 if (phy)
1404                         ra->phy = *phy;
1405                 break;
1406         case RATE_PARAM_MMPS_UPDATE:
1407                 ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->smps_mode);
1408                 break;
1409         default:
1410                 break;
1411         }
1412         ra->field = cpu_to_le32(field);
1413
1414         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1415                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1416 }
1417
1418 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1419                         struct ieee80211_sta *sta)
1420 {
1421         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1422         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1423         struct wtbl_req_hdr *wtbl_hdr;
1424         struct tlv *sta_wtbl;
1425         struct sk_buff *skb;
1426         int ret;
1427
1428         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1429                                             &msta->wcid);
1430         if (IS_ERR(skb))
1431                 return PTR_ERR(skb);
1432
1433         sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1434                                            sizeof(struct tlv));
1435         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1436                                                   WTBL_SET, sta_wtbl, &skb);
1437         if (IS_ERR(wtbl_hdr))
1438                 return PTR_ERR(wtbl_hdr);
1439
1440         mt76_connac_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1441
1442         ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1443                                     MCU_EXT_CMD(STA_REC_UPDATE), true);
1444         if (ret)
1445                 return ret;
1446
1447         return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, NULL,
1448                                               RATE_PARAM_MMPS_UPDATE);
1449 }
1450
1451 static int
1452 mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
1453                                struct ieee80211_vif *vif,
1454                                struct ieee80211_sta *sta)
1455 {
1456         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1457         struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1458         struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1459         enum nl80211_band band = chandef->chan->band;
1460         struct sta_phy phy = {};
1461         int ret, nrates = 0;
1462
1463 #define __sta_phy_bitrate_mask_check(_mcs, _gi, _he)                            \
1464         do {                                                                    \
1465                 u8 i, gi = mask->control[band]._gi;                             \
1466                 gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;               \
1467                 for (i = 0; i <= sta->bandwidth; i++) {                         \
1468                         phy.sgi |= gi << (i << (_he));                          \
1469                         phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
1470                 }                                                               \
1471                 for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {    \
1472                         if (!mask->control[band]._mcs[i])                       \
1473                                 continue;                                       \
1474                         nrates += hweight16(mask->control[band]._mcs[i]);       \
1475                         phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;         \
1476                 }                                                               \
1477         } while (0)
1478
1479         if (sta->he_cap.has_he) {
1480                 __sta_phy_bitrate_mask_check(he_mcs, he_gi, 1);
1481         } else if (sta->vht_cap.vht_supported) {
1482                 __sta_phy_bitrate_mask_check(vht_mcs, gi, 0);
1483         } else if (sta->ht_cap.ht_supported) {
1484                 __sta_phy_bitrate_mask_check(ht_mcs, gi, 0);
1485         } else {
1486                 nrates = hweight32(mask->control[band].legacy);
1487                 phy.mcs = ffs(mask->control[band].legacy) - 1;
1488         }
1489 #undef __sta_phy_bitrate_mask_check
1490
1491         /* fall back to auto rate control */
1492         if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
1493             mask->control[band].he_gi == GENMASK(7, 0) &&
1494             mask->control[band].he_ltf == GENMASK(7, 0) &&
1495             nrates != 1)
1496                 return 0;
1497
1498         /* fixed single rate */
1499         if (nrates == 1) {
1500                 ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1501                                                      RATE_PARAM_FIXED_MCS);
1502                 if (ret)
1503                         return ret;
1504         }
1505
1506         /* fixed GI */
1507         if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
1508             mask->control[band].he_gi != GENMASK(7, 0)) {
1509                 struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1510                 u32 addr;
1511
1512                 /* firmware updates only TXCMD but doesn't take WTBL into
1513                  * account, so driver should update here to reflect the
1514                  * actual txrate hardware sends out.
1515                  */
1516                 addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
1517                 if (sta->he_cap.has_he)
1518                         mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
1519                 else
1520                         mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
1521
1522                 ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1523                                                      RATE_PARAM_FIXED_GI);
1524                 if (ret)
1525                         return ret;
1526         }
1527
1528         /* fixed HE_LTF */
1529         if (mask->control[band].he_ltf != GENMASK(7, 0)) {
1530                 ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1531                                                      RATE_PARAM_FIXED_HE_LTF);
1532                 if (ret)
1533                         return ret;
1534         }
1535
1536         return 0;
1537 }
1538
1539 static void
1540 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
1541                              struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1542 {
1543         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1544         struct mt76_phy *mphy = mvif->phy->mt76;
1545         struct cfg80211_chan_def *chandef = &mphy->chandef;
1546         struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1547         enum nl80211_band band = chandef->chan->band;
1548         struct sta_rec_ra *ra;
1549         struct tlv *tlv;
1550         u32 supp_rate = sta->supp_rates[band];
1551         u32 cap = sta->wme ? STA_CAP_WMM : 0;
1552
1553         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
1554         ra = (struct sta_rec_ra *)tlv;
1555
1556         ra->valid = true;
1557         ra->auto_rate = true;
1558         ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
1559         ra->channel = chandef->chan->hw_value;
1560         ra->bw = sta->bandwidth;
1561         ra->phy.bw = sta->bandwidth;
1562         ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->smps_mode);
1563
1564         if (supp_rate) {
1565                 supp_rate &= mask->control[band].legacy;
1566                 ra->rate_len = hweight32(supp_rate);
1567
1568                 if (band == NL80211_BAND_2GHZ) {
1569                         ra->supp_mode = MODE_CCK;
1570                         ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
1571
1572                         if (ra->rate_len > 4) {
1573                                 ra->supp_mode |= MODE_OFDM;
1574                                 ra->supp_ofdm_rate = supp_rate >> 4;
1575                         }
1576                 } else {
1577                         ra->supp_mode = MODE_OFDM;
1578                         ra->supp_ofdm_rate = supp_rate;
1579                 }
1580         }
1581
1582         if (sta->ht_cap.ht_supported) {
1583                 ra->supp_mode |= MODE_HT;
1584                 ra->af = sta->ht_cap.ampdu_factor;
1585                 ra->ht_gf = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
1586
1587                 cap |= STA_CAP_HT;
1588                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1589                         cap |= STA_CAP_SGI_20;
1590                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1591                         cap |= STA_CAP_SGI_40;
1592                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
1593                         cap |= STA_CAP_TX_STBC;
1594                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
1595                         cap |= STA_CAP_RX_STBC;
1596                 if (mvif->cap.ht_ldpc &&
1597                     (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
1598                         cap |= STA_CAP_LDPC;
1599
1600                 mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
1601                                           mask->control[band].ht_mcs);
1602                 ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
1603         }
1604
1605         if (sta->vht_cap.vht_supported) {
1606                 u8 af;
1607
1608                 ra->supp_mode |= MODE_VHT;
1609                 af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1610                                sta->vht_cap.cap);
1611                 ra->af = max_t(u8, ra->af, af);
1612
1613                 cap |= STA_CAP_VHT;
1614                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1615                         cap |= STA_CAP_VHT_SGI_80;
1616                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1617                         cap |= STA_CAP_VHT_SGI_160;
1618                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
1619                         cap |= STA_CAP_VHT_TX_STBC;
1620                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
1621                         cap |= STA_CAP_VHT_RX_STBC;
1622                 if (mvif->cap.vht_ldpc &&
1623                     (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
1624                         cap |= STA_CAP_VHT_LDPC;
1625
1626                 mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
1627                                            mask->control[band].vht_mcs);
1628         }
1629
1630         if (sta->he_cap.has_he) {
1631                 ra->supp_mode |= MODE_HE;
1632                 cap |= STA_CAP_HE;
1633
1634                 if (sta->he_6ghz_capa.capa)
1635                         ra->af = le16_get_bits(sta->he_6ghz_capa.capa,
1636                                                IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1637         }
1638
1639         ra->sta_cap = cpu_to_le32(cap);
1640 }
1641
1642 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1643                              struct ieee80211_sta *sta, bool changed)
1644 {
1645         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1646         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1647         struct sk_buff *skb;
1648         int ret;
1649
1650         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1651                                             &msta->wcid);
1652         if (IS_ERR(skb))
1653                 return PTR_ERR(skb);
1654
1655         /* firmware rc algorithm refers to sta_rec_he for HE control.
1656          * once dev->rc_work changes the settings driver should also
1657          * update sta_rec_he here.
1658          */
1659         if (changed)
1660                 mt7915_mcu_sta_he_tlv(skb, sta, vif);
1661
1662         /* sta_rec_ra accommodates BW, NSS and only MCS range format
1663          * i.e 0-{7,8,9} for VHT.
1664          */
1665         mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
1666
1667         ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1668                                     MCU_EXT_CMD(STA_REC_UPDATE), true);
1669         if (ret)
1670                 return ret;
1671
1672         /* sta_rec_ra_fixed accommodates single rate, (HE)GI and HE_LTE,
1673          * and updates as peer fixed rate parameters, which overrides
1674          * sta_rec_ra and firmware rate control algorithm.
1675          */
1676         return mt7915_mcu_add_rate_ctrl_fixed(dev, vif, sta);
1677 }
1678
1679 static int
1680 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1681                      struct ieee80211_sta *sta)
1682 {
1683 #define MT_STA_BSS_GROUP                1
1684         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1685         struct mt7915_sta *msta;
1686         struct {
1687                 __le32 action;
1688                 u8 wlan_idx_lo;
1689                 u8 status;
1690                 u8 wlan_idx_hi;
1691                 u8 rsv0[5];
1692                 __le32 val;
1693                 u8 rsv1[8];
1694         } __packed req = {
1695                 .action = cpu_to_le32(MT_STA_BSS_GROUP),
1696                 .val = cpu_to_le32(mvif->mt76.idx % 16),
1697         };
1698
1699         msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1700         req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
1701         req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
1702
1703         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL), &req,
1704                                  sizeof(req), true);
1705 }
1706
1707 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1708                        struct ieee80211_sta *sta, bool enable)
1709 {
1710         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1711         struct mt7915_sta *msta;
1712         struct sk_buff *skb;
1713         int ret;
1714
1715         msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1716
1717         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1718                                             &msta->wcid);
1719         if (IS_ERR(skb))
1720                 return PTR_ERR(skb);
1721
1722         /* starec basic */
1723         mt76_connac_mcu_sta_basic_tlv(skb, vif, sta, enable, true);
1724         if (!enable)
1725                 goto out;
1726
1727         /* tag order is in accordance with firmware dependency. */
1728         if (sta) {
1729                 /* starec bfer */
1730                 mt7915_mcu_sta_bfer_tlv(dev, skb, vif, sta);
1731                 /* starec ht */
1732                 mt7915_mcu_sta_ht_tlv(skb, sta);
1733                 /* starec vht */
1734                 mt7915_mcu_sta_vht_tlv(skb, sta);
1735                 /* starec uapsd */
1736                 mt76_connac_mcu_sta_uapsd(skb, vif, sta);
1737         }
1738
1739         ret = mt7915_mcu_sta_wtbl_tlv(dev, skb, vif, sta);
1740         if (ret) {
1741                 dev_kfree_skb(skb);
1742                 return ret;
1743         }
1744
1745         if (sta) {
1746                 /* starec amsdu */
1747                 mt7915_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
1748                 /* starec he */
1749                 mt7915_mcu_sta_he_tlv(skb, sta, vif);
1750                 /* starec muru */
1751                 mt7915_mcu_sta_muru_tlv(skb, sta, vif);
1752                 /* starec bfee */
1753                 mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
1754         }
1755
1756         ret = mt7915_mcu_add_group(dev, vif, sta);
1757         if (ret) {
1758                 dev_kfree_skb(skb);
1759                 return ret;
1760         }
1761 out:
1762         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1763                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1764 }
1765
1766 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
1767                             struct ieee80211_vif *vif, bool enable)
1768 {
1769         struct mt7915_dev *dev = phy->dev;
1770         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1771         struct {
1772                 struct req_hdr {
1773                         u8 omac_idx;
1774                         u8 dbdc_idx;
1775                         __le16 tlv_num;
1776                         u8 is_tlv_append;
1777                         u8 rsv[3];
1778                 } __packed hdr;
1779                 struct req_tlv {
1780                         __le16 tag;
1781                         __le16 len;
1782                         u8 active;
1783                         u8 dbdc_idx;
1784                         u8 omac_addr[ETH_ALEN];
1785                 } __packed tlv;
1786         } data = {
1787                 .hdr = {
1788                         .omac_idx = mvif->mt76.omac_idx,
1789                         .dbdc_idx = mvif->mt76.band_idx,
1790                         .tlv_num = cpu_to_le16(1),
1791                         .is_tlv_append = 1,
1792                 },
1793                 .tlv = {
1794                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
1795                         .len = cpu_to_le16(sizeof(struct req_tlv)),
1796                         .active = enable,
1797                         .dbdc_idx = mvif->mt76.band_idx,
1798                 },
1799         };
1800
1801         if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
1802                 return mt7915_mcu_muar_config(phy, vif, false, enable);
1803
1804         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
1805         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
1806                                  &data, sizeof(data), true);
1807 }
1808
1809 static void
1810 mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
1811                          struct sk_buff *skb, struct bss_info_bcn *bcn,
1812                          struct ieee80211_mutable_offsets *offs)
1813 {
1814         struct bss_info_bcn_cntdwn *info;
1815         struct tlv *tlv;
1816         int sub_tag;
1817
1818         if (!offs->cntdwn_counter_offs[0])
1819                 return;
1820
1821         sub_tag = vif->csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
1822         tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
1823                                            &bcn->sub_ntlv, &bcn->len);
1824         info = (struct bss_info_bcn_cntdwn *)tlv;
1825         info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
1826 }
1827
1828 static void
1829 mt7915_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
1830                        struct ieee80211_vif *vif, struct bss_info_bcn *bcn,
1831                        struct ieee80211_mutable_offsets *offs)
1832 {
1833         struct bss_info_bcn_mbss *mbss;
1834         const struct element *elem;
1835         struct tlv *tlv;
1836
1837         if (!vif->bss_conf.bssid_indicator)
1838                 return;
1839
1840         tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_MBSSID,
1841                                            sizeof(*mbss), &bcn->sub_ntlv,
1842                                            &bcn->len);
1843
1844         mbss = (struct bss_info_bcn_mbss *)tlv;
1845         mbss->offset[0] = cpu_to_le16(offs->tim_offset);
1846         mbss->bitmap = cpu_to_le32(1);
1847
1848         for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
1849                             &skb->data[offs->mbssid_off],
1850                             skb->len - offs->mbssid_off) {
1851                 const struct element *sub_elem;
1852
1853                 if (elem->datalen < 2)
1854                         continue;
1855
1856                 for_each_element(sub_elem, elem->data + 1, elem->datalen - 1) {
1857                         const struct ieee80211_bssid_index *idx;
1858                         const u8 *idx_ie;
1859
1860                         if (sub_elem->id || sub_elem->datalen < 4)
1861                                 continue; /* not a valid BSS profile */
1862
1863                         /* Find WLAN_EID_MULTI_BSSID_IDX
1864                          * in the merged nontransmitted profile
1865                          */
1866                         idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
1867                                                   sub_elem->data,
1868                                                   sub_elem->datalen);
1869                         if (!idx_ie || idx_ie[1] < sizeof(*idx))
1870                                 continue;
1871
1872                         idx = (void *)(idx_ie + 2);
1873                         if (!idx->bssid_index || idx->bssid_index > 31)
1874                                 continue;
1875
1876                         mbss->offset[idx->bssid_index] =
1877                                 cpu_to_le16(idx_ie - skb->data);
1878                         mbss->bitmap |= cpu_to_le32(BIT(idx->bssid_index));
1879                 }
1880         }
1881 }
1882
1883 static void
1884 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1885                        struct sk_buff *rskb, struct sk_buff *skb,
1886                        struct bss_info_bcn *bcn,
1887                        struct ieee80211_mutable_offsets *offs)
1888 {
1889         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1890         struct bss_info_bcn_cont *cont;
1891         struct tlv *tlv;
1892         u8 *buf;
1893         int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
1894
1895         tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
1896                                            len, &bcn->sub_ntlv, &bcn->len);
1897
1898         cont = (struct bss_info_bcn_cont *)tlv;
1899         cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1900         cont->tim_ofs = cpu_to_le16(offs->tim_offset);
1901
1902         if (offs->cntdwn_counter_offs[0]) {
1903                 u16 offset = offs->cntdwn_counter_offs[0];
1904
1905                 if (vif->csa_active)
1906                         cont->csa_ofs = cpu_to_le16(offset - 4);
1907                 if (vif->color_change_active)
1908                         cont->bcc_ofs = cpu_to_le16(offset - 3);
1909         }
1910
1911         buf = (u8 *)tlv + sizeof(*cont);
1912         mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
1913                               true);
1914         memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1915 }
1916
1917 static void
1918 mt7915_mcu_beacon_check_caps(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1919                              struct sk_buff *skb)
1920 {
1921         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1922         struct mt7915_vif_cap *vc = &mvif->cap;
1923         const struct ieee80211_he_cap_elem *he;
1924         const struct ieee80211_vht_cap *vht;
1925         const struct ieee80211_ht_cap *ht;
1926         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
1927         const u8 *ie;
1928         u32 len, bc;
1929
1930         /* Check missing configuration options to allow AP mode in mac80211
1931          * to remain in sync with hostapd settings, and get a subset of
1932          * beacon and hardware capabilities.
1933          */
1934         if (WARN_ON_ONCE(skb->len <= (mgmt->u.beacon.variable - skb->data)))
1935                 return;
1936
1937         memset(vc, 0, sizeof(*vc));
1938
1939         len = skb->len - (mgmt->u.beacon.variable - skb->data);
1940
1941         ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, mgmt->u.beacon.variable,
1942                               len);
1943         if (ie && ie[1] >= sizeof(*ht)) {
1944                 ht = (void *)(ie + 2);
1945                 vc->ht_ldpc = !!(le16_to_cpu(ht->cap_info) &
1946                                  IEEE80211_HT_CAP_LDPC_CODING);
1947         }
1948
1949         ie = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, mgmt->u.beacon.variable,
1950                               len);
1951         if (ie && ie[1] >= sizeof(*vht)) {
1952                 u32 pc = phy->mt76->sband_5g.sband.vht_cap.cap;
1953
1954                 vht = (void *)(ie + 2);
1955                 bc = le32_to_cpu(vht->vht_cap_info);
1956
1957                 vc->vht_ldpc = !!(bc & IEEE80211_VHT_CAP_RXLDPC);
1958                 vc->vht_su_ebfer =
1959                         (bc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE) &&
1960                         (pc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1961                 vc->vht_su_ebfee =
1962                         (bc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE) &&
1963                         (pc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1964                 vc->vht_mu_ebfer =
1965                         (bc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE) &&
1966                         (pc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE);
1967                 vc->vht_mu_ebfee =
1968                         (bc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) &&
1969                         (pc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1970         }
1971
1972         ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY,
1973                                   mgmt->u.beacon.variable, len);
1974         if (ie && ie[1] >= sizeof(*he) + 1) {
1975                 const struct ieee80211_sta_he_cap *pc =
1976                         mt76_connac_get_he_phy_cap(phy->mt76, vif);
1977                 const struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1978
1979                 he = (void *)(ie + 3);
1980
1981                 vc->he_ldpc =
1982                         HE_PHY(CAP1_LDPC_CODING_IN_PAYLOAD, pe->phy_cap_info[1]);
1983                 vc->he_su_ebfer =
1984                         HE_PHY(CAP3_SU_BEAMFORMER, he->phy_cap_info[3]) &&
1985                         HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1986                 vc->he_su_ebfee =
1987                         HE_PHY(CAP4_SU_BEAMFORMEE, he->phy_cap_info[4]) &&
1988                         HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1989                 vc->he_mu_ebfer =
1990                         HE_PHY(CAP4_MU_BEAMFORMER, he->phy_cap_info[4]) &&
1991                         HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4]);
1992         }
1993 }
1994
1995 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
1996                           struct ieee80211_vif *vif, int en)
1997 {
1998 #define MAX_BEACON_SIZE 512
1999         struct mt7915_dev *dev = mt7915_hw_dev(hw);
2000         struct mt7915_phy *phy = mt7915_hw_phy(hw);
2001         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2002         struct ieee80211_mutable_offsets offs;
2003         struct ieee80211_tx_info *info;
2004         struct sk_buff *skb, *rskb;
2005         struct tlv *tlv;
2006         struct bss_info_bcn *bcn;
2007         int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
2008         bool ext_phy = phy != &dev->phy;
2009
2010         if (vif->bss_conf.nontransmitted)
2011                 return 0;
2012
2013         rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
2014                                                NULL, len);
2015         if (IS_ERR(rskb))
2016                 return PTR_ERR(rskb);
2017
2018         tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2019         bcn = (struct bss_info_bcn *)tlv;
2020         bcn->enable = en;
2021
2022         if (!en)
2023                 goto out;
2024
2025         skb = ieee80211_beacon_get_template(hw, vif, &offs);
2026         if (!skb)
2027                 return -EINVAL;
2028
2029         if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
2030                 dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2031                 dev_kfree_skb(skb);
2032                 return -EINVAL;
2033         }
2034
2035         if (ext_phy) {
2036                 info = IEEE80211_SKB_CB(skb);
2037                 info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2038         }
2039
2040         mt7915_mcu_beacon_check_caps(phy, vif, skb);
2041
2042         mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
2043         mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
2044         mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
2045         dev_kfree_skb(skb);
2046
2047 out:
2048         return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2049                                      MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2050 }
2051
2052 static int mt7915_driver_own(struct mt7915_dev *dev, u8 band)
2053 {
2054         mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(band), MT_TOP_LPCR_HOST_DRV_OWN);
2055         if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND(band),
2056                             MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) {
2057                 dev_err(dev->mt76.dev, "Timeout for driver own\n");
2058                 return -EIO;
2059         }
2060
2061         /* clear irq when the driver own success */
2062         mt76_wr(dev, MT_TOP_LPCR_HOST_BAND_IRQ_STAT(band),
2063                 MT_TOP_LPCR_HOST_BAND_STAT);
2064
2065         return 0;
2066 }
2067
2068 static int mt7915_load_patch(struct mt7915_dev *dev)
2069 {
2070         const struct mt7915_patch_hdr *hdr;
2071         const struct firmware *fw = NULL;
2072         int i, ret, sem;
2073
2074         sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, 1);
2075         switch (sem) {
2076         case PATCH_IS_DL:
2077                 return 0;
2078         case PATCH_NOT_DL_SEM_SUCCESS:
2079                 break;
2080         default:
2081                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2082                 return -EAGAIN;
2083         }
2084
2085         ret = request_firmware(&fw, fw_name_var(dev, ROM_PATCH),
2086                                dev->mt76.dev);
2087         if (ret)
2088                 goto out;
2089
2090         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2091                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2092                 ret = -EINVAL;
2093                 goto out;
2094         }
2095
2096         hdr = (const struct mt7915_patch_hdr *)(fw->data);
2097
2098         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2099                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2100
2101         for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2102                 struct mt7915_patch_sec *sec;
2103                 const u8 *dl;
2104                 u32 len, addr;
2105
2106                 sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2107                                                   i * sizeof(*sec));
2108                 if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2109                     PATCH_SEC_TYPE_INFO) {
2110                         ret = -EINVAL;
2111                         goto out;
2112                 }
2113
2114                 addr = be32_to_cpu(sec->info.addr);
2115                 len = be32_to_cpu(sec->info.len);
2116                 dl = fw->data + be32_to_cpu(sec->offs);
2117
2118                 ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
2119                                                     DL_MODE_NEED_RSP);
2120                 if (ret) {
2121                         dev_err(dev->mt76.dev, "Download request failed\n");
2122                         goto out;
2123                 }
2124
2125                 ret = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2126                                                dl, len, 4096);
2127                 if (ret) {
2128                         dev_err(dev->mt76.dev, "Failed to send patch\n");
2129                         goto out;
2130                 }
2131         }
2132
2133         ret = mt76_connac_mcu_start_patch(&dev->mt76);
2134         if (ret)
2135                 dev_err(dev->mt76.dev, "Failed to start patch\n");
2136
2137 out:
2138         sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, 0);
2139         switch (sem) {
2140         case PATCH_REL_SEM_SUCCESS:
2141                 break;
2142         default:
2143                 ret = -EAGAIN;
2144                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2145                 break;
2146         }
2147         release_firmware(fw);
2148
2149         return ret;
2150 }
2151
2152 static int
2153 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2154                              const struct mt7915_fw_trailer *hdr,
2155                              const u8 *data, bool is_wa)
2156 {
2157         int i, offset = 0;
2158         u32 override = 0, option = 0;
2159
2160         for (i = 0; i < hdr->n_region; i++) {
2161                 const struct mt7915_fw_region *region;
2162                 int err;
2163                 u32 len, addr, mode;
2164
2165                 region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2166                          (hdr->n_region - i) * sizeof(*region));
2167                 mode = mt76_connac_mcu_gen_dl_mode(&dev->mt76,
2168                                                    region->feature_set, is_wa);
2169                 len = le32_to_cpu(region->len);
2170                 addr = le32_to_cpu(region->addr);
2171
2172                 if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2173                         override = addr;
2174
2175                 err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
2176                                                     mode);
2177                 if (err) {
2178                         dev_err(dev->mt76.dev, "Download request failed\n");
2179                         return err;
2180                 }
2181
2182                 err = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2183                                                data + offset, len, 4096);
2184                 if (err) {
2185                         dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2186                         return err;
2187                 }
2188
2189                 offset += len;
2190         }
2191
2192         if (override)
2193                 option |= FW_START_OVERRIDE;
2194
2195         if (is_wa)
2196                 option |= FW_START_WORKING_PDA_CR4;
2197
2198         return mt76_connac_mcu_start_firmware(&dev->mt76, override, option);
2199 }
2200
2201 static int mt7915_load_ram(struct mt7915_dev *dev)
2202 {
2203         const struct mt7915_fw_trailer *hdr;
2204         const struct firmware *fw;
2205         int ret;
2206
2207         ret = request_firmware(&fw, fw_name_var(dev, FIRMWARE_WM),
2208                                dev->mt76.dev);
2209         if (ret)
2210                 return ret;
2211
2212         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2213                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2214                 ret = -EINVAL;
2215                 goto out;
2216         }
2217
2218         hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2219                                         sizeof(*hdr));
2220
2221         dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2222                  hdr->fw_ver, hdr->build_date);
2223
2224         ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2225         if (ret) {
2226                 dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2227                 goto out;
2228         }
2229
2230         release_firmware(fw);
2231
2232         ret = request_firmware(&fw, fw_name(dev, FIRMWARE_WA),
2233                                dev->mt76.dev);
2234         if (ret)
2235                 return ret;
2236
2237         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2238                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2239                 ret = -EINVAL;
2240                 goto out;
2241         }
2242
2243         hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2244                                         sizeof(*hdr));
2245
2246         dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2247                  hdr->fw_ver, hdr->build_date);
2248
2249         ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2250         if (ret) {
2251                 dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2252                 goto out;
2253         }
2254
2255         snprintf(dev->mt76.hw->wiphy->fw_version,
2256                  sizeof(dev->mt76.hw->wiphy->fw_version),
2257                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2258
2259 out:
2260         release_firmware(fw);
2261
2262         return ret;
2263 }
2264
2265 static int
2266 mt7915_firmware_state(struct mt7915_dev *dev, bool wa)
2267 {
2268         u32 state = FIELD_PREP(MT_TOP_MISC_FW_STATE,
2269                                wa ? FW_STATE_RDY : FW_STATE_FW_DOWNLOAD);
2270
2271         if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2272                             state, 1000)) {
2273                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2274                 return -EIO;
2275         }
2276         return 0;
2277 }
2278
2279 static int mt7915_load_firmware(struct mt7915_dev *dev)
2280 {
2281         int ret;
2282
2283         /* make sure fw is download state */
2284         if (mt7915_firmware_state(dev, false)) {
2285                 /* restart firmware once */
2286                 __mt76_mcu_restart(&dev->mt76);
2287                 ret = mt7915_firmware_state(dev, false);
2288                 if (ret) {
2289                         dev_err(dev->mt76.dev,
2290                                 "Firmware is not ready for download\n");
2291                         return ret;
2292                 }
2293         }
2294
2295         ret = mt7915_load_patch(dev);
2296         if (ret)
2297                 return ret;
2298
2299         ret = mt7915_load_ram(dev);
2300         if (ret)
2301                 return ret;
2302
2303         ret = mt7915_firmware_state(dev, true);
2304         if (ret)
2305                 return ret;
2306
2307         mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2308
2309         dev_dbg(dev->mt76.dev, "Firmware init done\n");
2310
2311         return 0;
2312 }
2313
2314 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl)
2315 {
2316         struct {
2317                 u8 ctrl_val;
2318                 u8 pad[3];
2319         } data = {
2320                 .ctrl_val = ctrl
2321         };
2322
2323         if (type == MCU_FW_LOG_WA)
2324                 return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(FW_LOG_2_HOST),
2325                                          &data, sizeof(data), true);
2326
2327         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2328                                  sizeof(data), true);
2329 }
2330
2331 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2332 {
2333         struct {
2334                 u8 ver;
2335                 u8 pad;
2336                 __le16 len;
2337                 u8 level;
2338                 u8 rsv[3];
2339                 __le32 module_idx;
2340         } data = {
2341                 .module_idx = cpu_to_le32(module),
2342                 .level = level,
2343         };
2344
2345         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2346                                  sizeof(data), false);
2347 }
2348
2349 int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enabled)
2350 {
2351         struct {
2352                 __le32 cmd;
2353                 u8 enable;
2354         } data = {
2355                 .cmd = cpu_to_le32(MURU_SET_TXC_TX_STATS_EN),
2356                 .enable = enabled,
2357         };
2358
2359         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &data,
2360                                 sizeof(data), false);
2361 }
2362
2363 int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy, void *ms)
2364 {
2365         struct mt7915_dev *dev = phy->dev;
2366         struct sk_buff *skb;
2367         struct mt7915_mcu_muru_stats *mu_stats =
2368                                 (struct mt7915_mcu_muru_stats *)ms;
2369         int ret;
2370
2371         struct {
2372                 __le32 cmd;
2373                 u8 band_idx;
2374         } req = {
2375                 .cmd = cpu_to_le32(MURU_GET_TXC_TX_STATS),
2376                 .band_idx = phy->band_idx,
2377         };
2378
2379         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
2380                                         &req, sizeof(req), true, &skb);
2381         if (ret)
2382                 return ret;
2383
2384         memcpy(mu_stats, skb->data, sizeof(struct mt7915_mcu_muru_stats));
2385         dev_kfree_skb(skb);
2386
2387         return 0;
2388 }
2389
2390 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2391 {
2392         struct {
2393                 u8 enable;
2394                 u8 _rsv[3];
2395         } __packed req = {
2396                 .enable = enabled
2397         };
2398
2399         return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2400                                  sizeof(req), false);
2401 }
2402
2403 int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val)
2404 {
2405         struct {
2406                 __le32 cmd;
2407                 u8 val[4];
2408         } __packed req = {
2409                 .cmd = cpu_to_le32(cmd),
2410         };
2411
2412         put_unaligned_le32(val, req.val);
2413
2414         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
2415                                  sizeof(req), false);
2416 }
2417
2418 static int
2419 mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
2420 {
2421 #define RX_AIRTIME_FEATURE_CTRL         1
2422 #define RX_AIRTIME_BITWISE_CTRL         2
2423 #define RX_AIRTIME_CLEAR_EN     1
2424         struct {
2425                 __le16 field;
2426                 __le16 sub_field;
2427                 __le32 set_status;
2428                 __le32 get_status;
2429                 u8 _rsv[12];
2430
2431                 bool airtime_en;
2432                 bool mibtime_en;
2433                 bool earlyend_en;
2434                 u8 _rsv1[9];
2435
2436                 bool airtime_clear;
2437                 bool mibtime_clear;
2438                 u8 _rsv2[98];
2439         } __packed req = {
2440                 .field = cpu_to_le16(RX_AIRTIME_BITWISE_CTRL),
2441                 .sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN),
2442                 .airtime_clear = true,
2443         };
2444         int ret;
2445
2446         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2447                                 sizeof(req), true);
2448         if (ret)
2449                 return ret;
2450
2451         req.field = cpu_to_le16(RX_AIRTIME_FEATURE_CTRL);
2452         req.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN);
2453         req.airtime_en = true;
2454
2455         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2456                                  sizeof(req), true);
2457 }
2458
2459 int mt7915_mcu_init(struct mt7915_dev *dev)
2460 {
2461         static const struct mt76_mcu_ops mt7915_mcu_ops = {
2462                 .headroom = sizeof(struct mt7915_mcu_txd),
2463                 .mcu_skb_send_msg = mt7915_mcu_send_message,
2464                 .mcu_parse_response = mt7915_mcu_parse_response,
2465                 .mcu_restart = mt76_connac_mcu_restart,
2466         };
2467         int ret;
2468
2469         dev->mt76.mcu_ops = &mt7915_mcu_ops;
2470
2471         /* force firmware operation mode into normal state,
2472          * which should be set before firmware download stage.
2473          */
2474         if (is_mt7915(&dev->mt76))
2475                 mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
2476         else
2477                 mt76_wr(dev, MT_SWDEF_MODE_MT7916, MT_SWDEF_NORMAL_MODE);
2478
2479         ret = mt7915_driver_own(dev, 0);
2480         if (ret)
2481                 return ret;
2482         /* set driver own for band1 when two hif exist */
2483         if (dev->hif2) {
2484                 ret = mt7915_driver_own(dev, 1);
2485                 if (ret)
2486                         return ret;
2487         }
2488
2489         ret = mt7915_load_firmware(dev);
2490         if (ret)
2491                 return ret;
2492
2493         set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2494         ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
2495         if (ret)
2496                 return ret;
2497
2498         ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, 0);
2499         if (ret)
2500                 return ret;
2501
2502         ret = mt7915_mcu_set_mwds(dev, 1);
2503         if (ret)
2504                 return ret;
2505
2506         ret = mt7915_mcu_set_muru_ctrl(dev, MURU_SET_PLATFORM_TYPE,
2507                                        MURU_PLATFORM_TYPE_PERF_LEVEL_2);
2508         if (ret)
2509                 return ret;
2510
2511         ret = mt7915_mcu_init_rx_airtime(dev);
2512         if (ret)
2513                 return ret;
2514
2515         return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
2516                                  MCU_WA_PARAM_RED, 0, 0);
2517 }
2518
2519 void mt7915_mcu_exit(struct mt7915_dev *dev)
2520 {
2521         __mt76_mcu_restart(&dev->mt76);
2522         if (mt7915_firmware_state(dev, false)) {
2523                 dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2524                 return;
2525         }
2526
2527         mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
2528         if (dev->hif2)
2529                 mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
2530                         MT_TOP_LPCR_HOST_FW_OWN);
2531         skb_queue_purge(&dev->mt76.mcu.res_q);
2532 }
2533
2534 static int
2535 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
2536 {
2537         struct {
2538                 u8 operation;
2539                 u8 count;
2540                 u8 _rsv[2];
2541                 u8 index;
2542                 u8 enable;
2543                 __le16 etype;
2544         } req = {
2545                 .operation = 1,
2546                 .count = 1,
2547                 .enable = 1,
2548                 .etype = cpu_to_le16(ETH_P_PAE),
2549         };
2550
2551         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2552                                  &req, sizeof(req), false);
2553 }
2554
2555 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2556                        bool enable, bool hdr_trans)
2557 {
2558         struct {
2559                 u8 operation;
2560                 u8 enable;
2561                 u8 check_bssid;
2562                 u8 insert_vlan;
2563                 u8 remove_vlan;
2564                 u8 tid;
2565                 u8 mode;
2566                 u8 rsv;
2567         } __packed req_trans = {
2568                 .enable = hdr_trans,
2569         };
2570         struct {
2571                 u8 enable;
2572                 u8 band;
2573                 u8 rsv[2];
2574         } __packed req_mac = {
2575                 .enable = enable,
2576                 .band = band,
2577         };
2578         int ret;
2579
2580         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2581                                 &req_trans, sizeof(req_trans), false);
2582         if (ret)
2583                 return ret;
2584
2585         if (hdr_trans)
2586                 mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
2587
2588         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
2589                                  &req_mac, sizeof(req_mac), true);
2590 }
2591
2592 int mt7915_mcu_set_scs(struct mt7915_dev *dev, u8 band, bool enable)
2593 {
2594         struct {
2595                 __le32 cmd;
2596                 u8 band;
2597                 u8 enable;
2598         } __packed req = {
2599                 .cmd = cpu_to_le32(SCS_ENABLE),
2600                 .band = band,
2601                 .enable = enable + 1,
2602         };
2603
2604         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SCS_CTRL), &req,
2605                                  sizeof(req), false);
2606 }
2607
2608 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
2609 {
2610         struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
2611         u8 num = req->total;
2612         size_t len = sizeof(*req) -
2613                      (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
2614
2615         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
2616                                  len, true);
2617 }
2618
2619 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2620 {
2621 #define TX_CMD_MODE             1
2622         struct mt7915_mcu_tx req = {
2623                 .valid = true,
2624                 .mode = TX_CMD_MODE,
2625                 .total = IEEE80211_NUM_ACS,
2626         };
2627         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2628         int ac;
2629
2630         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2631                 struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2632                 struct edca *e = &req.edca[ac];
2633
2634                 e->set = WMM_PARAM_SET;
2635                 e->queue = ac + mvif->mt76.wmm_idx * MT7915_MAX_WMM_SETS;
2636                 e->aifs = q->aifs;
2637                 e->txop = cpu_to_le16(q->txop);
2638
2639                 if (q->cw_min)
2640                         e->cw_min = fls(q->cw_min);
2641                 else
2642                         e->cw_min = 5;
2643
2644                 if (q->cw_max)
2645                         e->cw_max = cpu_to_le16(fls(q->cw_max));
2646                 else
2647                         e->cw_max = cpu_to_le16(10);
2648         }
2649
2650         return mt7915_mcu_update_edca(dev, &req);
2651 }
2652
2653 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
2654 {
2655         struct {
2656                 __le32 tag;
2657                 __le16 min_lpn;
2658                 u8 rsv[2];
2659         } __packed req = {
2660                 .tag = cpu_to_le32(0x1),
2661                 .min_lpn = cpu_to_le16(val),
2662         };
2663
2664         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2665                                  sizeof(req), true);
2666 }
2667
2668 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
2669                             const struct mt7915_dfs_pulse *pulse)
2670 {
2671         struct {
2672                 __le32 tag;
2673
2674                 __le32 max_width;               /* us */
2675                 __le32 max_pwr;                 /* dbm */
2676                 __le32 min_pwr;                 /* dbm */
2677                 __le32 min_stgr_pri;            /* us */
2678                 __le32 max_stgr_pri;            /* us */
2679                 __le32 min_cr_pri;              /* us */
2680                 __le32 max_cr_pri;              /* us */
2681         } __packed req = {
2682                 .tag = cpu_to_le32(0x3),
2683
2684 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2685                 __req_field(max_width),
2686                 __req_field(max_pwr),
2687                 __req_field(min_pwr),
2688                 __req_field(min_stgr_pri),
2689                 __req_field(max_stgr_pri),
2690                 __req_field(min_cr_pri),
2691                 __req_field(max_cr_pri),
2692 #undef __req_field
2693         };
2694
2695         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2696                                  sizeof(req), true);
2697 }
2698
2699 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
2700                             const struct mt7915_dfs_pattern *pattern)
2701 {
2702         struct {
2703                 __le32 tag;
2704                 __le16 radar_type;
2705
2706                 u8 enb;
2707                 u8 stgr;
2708                 u8 min_crpn;
2709                 u8 max_crpn;
2710                 u8 min_crpr;
2711                 u8 min_pw;
2712                 __le32 min_pri;
2713                 __le32 max_pri;
2714                 u8 max_pw;
2715                 u8 min_crbn;
2716                 u8 max_crbn;
2717                 u8 min_stgpn;
2718                 u8 max_stgpn;
2719                 u8 min_stgpr;
2720                 u8 rsv[2];
2721                 __le32 min_stgpr_diff;
2722         } __packed req = {
2723                 .tag = cpu_to_le32(0x2),
2724                 .radar_type = cpu_to_le16(index),
2725
2726 #define __req_field_u8(field) .field = pattern->field
2727 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2728                 __req_field_u8(enb),
2729                 __req_field_u8(stgr),
2730                 __req_field_u8(min_crpn),
2731                 __req_field_u8(max_crpn),
2732                 __req_field_u8(min_crpr),
2733                 __req_field_u8(min_pw),
2734                 __req_field_u32(min_pri),
2735                 __req_field_u32(max_pri),
2736                 __req_field_u8(max_pw),
2737                 __req_field_u8(min_crbn),
2738                 __req_field_u8(max_crbn),
2739                 __req_field_u8(min_stgpn),
2740                 __req_field_u8(max_stgpn),
2741                 __req_field_u8(min_stgpr),
2742                 __req_field_u32(min_stgpr_diff),
2743 #undef __req_field_u8
2744 #undef __req_field_u32
2745         };
2746
2747         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2748                                  sizeof(req), true);
2749 }
2750
2751 static int
2752 mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
2753                                  struct cfg80211_chan_def *chandef,
2754                                  int cmd)
2755 {
2756         struct mt7915_dev *dev = phy->dev;
2757         struct mt76_phy *mphy = phy->mt76;
2758         struct ieee80211_channel *chan = mphy->chandef.chan;
2759         int freq = mphy->chandef.center_freq1;
2760         struct mt7915_mcu_background_chain_ctrl req = {
2761                 .monitor_scan_type = 2, /* simple rx */
2762         };
2763
2764         if (!chandef && cmd != CH_SWITCH_BACKGROUND_SCAN_STOP)
2765                 return -EINVAL;
2766
2767         if (!cfg80211_chandef_valid(&mphy->chandef))
2768                 return -EINVAL;
2769
2770         switch (cmd) {
2771         case CH_SWITCH_BACKGROUND_SCAN_START: {
2772                 req.chan = chan->hw_value;
2773                 req.central_chan = ieee80211_frequency_to_channel(freq);
2774                 req.bw = mt76_connac_chan_bw(&mphy->chandef);
2775                 req.monitor_chan = chandef->chan->hw_value;
2776                 req.monitor_central_chan =
2777                         ieee80211_frequency_to_channel(chandef->center_freq1);
2778                 req.monitor_bw = mt76_connac_chan_bw(chandef);
2779                 req.band_idx = phy != &dev->phy;
2780                 req.scan_mode = 1;
2781                 break;
2782         }
2783         case CH_SWITCH_BACKGROUND_SCAN_RUNNING:
2784                 req.monitor_chan = chandef->chan->hw_value;
2785                 req.monitor_central_chan =
2786                         ieee80211_frequency_to_channel(chandef->center_freq1);
2787                 req.band_idx = phy != &dev->phy;
2788                 req.scan_mode = 2;
2789                 break;
2790         case CH_SWITCH_BACKGROUND_SCAN_STOP:
2791                 req.chan = chan->hw_value;
2792                 req.central_chan = ieee80211_frequency_to_channel(freq);
2793                 req.bw = mt76_connac_chan_bw(&mphy->chandef);
2794                 req.tx_stream = hweight8(mphy->antenna_mask);
2795                 req.rx_stream = mphy->antenna_mask;
2796                 break;
2797         default:
2798                 return -EINVAL;
2799         }
2800         req.band = chandef ? chandef->chan->band == NL80211_BAND_5GHZ : 1;
2801
2802         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(OFFCH_SCAN_CTRL),
2803                                  &req, sizeof(req), false);
2804 }
2805
2806 int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
2807                                      struct cfg80211_chan_def *chandef)
2808 {
2809         struct mt7915_dev *dev = phy->dev;
2810         int err, region;
2811
2812         if (!chandef) { /* disable offchain */
2813                 err = mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_STOP, MT_RX_SEL2,
2814                                               0, 0);
2815                 if (err)
2816                         return err;
2817
2818                 return mt7915_mcu_background_chain_ctrl(phy, NULL,
2819                                 CH_SWITCH_BACKGROUND_SCAN_STOP);
2820         }
2821
2822         err = mt7915_mcu_background_chain_ctrl(phy, chandef,
2823                                                CH_SWITCH_BACKGROUND_SCAN_START);
2824         if (err)
2825                 return err;
2826
2827         switch (dev->mt76.region) {
2828         case NL80211_DFS_ETSI:
2829                 region = 0;
2830                 break;
2831         case NL80211_DFS_JP:
2832                 region = 2;
2833                 break;
2834         case NL80211_DFS_FCC:
2835         default:
2836                 region = 1;
2837                 break;
2838         }
2839
2840         return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_START, MT_RX_SEL2,
2841                                        0, region);
2842 }
2843
2844 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
2845 {
2846         static const u8 ch_band[] = {
2847                 [NL80211_BAND_2GHZ] = 0,
2848                 [NL80211_BAND_5GHZ] = 1,
2849                 [NL80211_BAND_6GHZ] = 2,
2850         };
2851         struct mt7915_dev *dev = phy->dev;
2852         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2853         int freq1 = chandef->center_freq1;
2854         struct {
2855                 u8 control_ch;
2856                 u8 center_ch;
2857                 u8 bw;
2858                 u8 tx_streams_num;
2859                 u8 rx_streams;  /* mask or num */
2860                 u8 switch_reason;
2861                 u8 band_idx;
2862                 u8 center_ch2;  /* for 80+80 only */
2863                 __le16 cac_case;
2864                 u8 channel_band;
2865                 u8 rsv0;
2866                 __le32 outband_freq;
2867                 u8 txpower_drop;
2868                 u8 ap_bw;
2869                 u8 ap_center_ch;
2870                 u8 rsv1[57];
2871         } __packed req = {
2872                 .control_ch = chandef->chan->hw_value,
2873                 .center_ch = ieee80211_frequency_to_channel(freq1),
2874                 .bw = mt76_connac_chan_bw(chandef),
2875                 .tx_streams_num = hweight8(phy->mt76->antenna_mask),
2876                 .rx_streams = phy->mt76->antenna_mask,
2877                 .band_idx = phy->band_idx,
2878                 .channel_band = ch_band[chandef->chan->band],
2879         };
2880
2881 #ifdef CONFIG_NL80211_TESTMODE
2882         if (phy->mt76->test.tx_antenna_mask &&
2883             (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
2884              phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES ||
2885              phy->mt76->test.state == MT76_TM_STATE_TX_CONT)) {
2886                 req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
2887                 req.rx_streams = phy->mt76->test.tx_antenna_mask;
2888
2889                 if (phy != &dev->phy)
2890                         req.rx_streams >>= dev->chainshift;
2891         }
2892 #endif
2893
2894         if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
2895             dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
2896                 req.switch_reason = CH_SWITCH_NORMAL;
2897         else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2898                 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2899         else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
2900                                           NL80211_IFTYPE_AP))
2901                 req.switch_reason = CH_SWITCH_DFS;
2902         else
2903                 req.switch_reason = CH_SWITCH_NORMAL;
2904
2905         if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
2906                 req.rx_streams = hweight8(req.rx_streams);
2907
2908         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
2909                 int freq2 = chandef->center_freq2;
2910
2911                 req.center_ch2 = ieee80211_frequency_to_channel(freq2);
2912         }
2913
2914         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2915 }
2916
2917 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
2918 {
2919 #define MAX_PAGE_IDX_MASK       GENMASK(7, 5)
2920 #define PAGE_IDX_MASK           GENMASK(4, 2)
2921 #define PER_PAGE_SIZE           0x400
2922         struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
2923         u16 eeprom_size = mt7915_eeprom_size(dev);
2924         u8 total = DIV_ROUND_UP(eeprom_size, PER_PAGE_SIZE);
2925         u8 *eep = (u8 *)dev->mt76.eeprom.data;
2926         int eep_len;
2927         int i;
2928
2929         for (i = 0; i < total; i++, eep += eep_len) {
2930                 struct sk_buff *skb;
2931                 int ret;
2932
2933                 if (i == total - 1 && !!(eeprom_size % PER_PAGE_SIZE))
2934                         eep_len = eeprom_size % PER_PAGE_SIZE;
2935                 else
2936                         eep_len = PER_PAGE_SIZE;
2937
2938                 skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2939                                          sizeof(req) + eep_len);
2940                 if (!skb)
2941                         return -ENOMEM;
2942
2943                 req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
2944                              FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
2945                 req.len = cpu_to_le16(eep_len);
2946
2947                 skb_put_data(skb, &req, sizeof(req));
2948                 skb_put_data(skb, eep, eep_len);
2949
2950                 ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2951                                             MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
2952                 if (ret)
2953                         return ret;
2954         }
2955
2956         return 0;
2957 }
2958
2959 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
2960 {
2961         struct mt7915_mcu_eeprom req = {
2962                 .buffer_mode = EE_MODE_EFUSE,
2963                 .format = EE_FORMAT_WHOLE,
2964         };
2965
2966         if (dev->flash_mode)
2967                 return mt7915_mcu_set_eeprom_flash(dev);
2968
2969         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
2970                                  &req, sizeof(req), true);
2971 }
2972
2973 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
2974 {
2975         struct mt7915_mcu_eeprom_info req = {
2976                 .addr = cpu_to_le32(round_down(offset,
2977                                     MT7915_EEPROM_BLOCK_SIZE)),
2978         };
2979         struct mt7915_mcu_eeprom_info *res;
2980         struct sk_buff *skb;
2981         int ret;
2982         u8 *buf;
2983
2984         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_ACCESS), &req,
2985                                 sizeof(req), true, &skb);
2986         if (ret)
2987                 return ret;
2988
2989         res = (struct mt7915_mcu_eeprom_info *)skb->data;
2990         buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
2991         memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
2992         dev_kfree_skb(skb);
2993
2994         return 0;
2995 }
2996
2997 int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num)
2998 {
2999         struct {
3000                 u8 _rsv;
3001                 u8 version;
3002                 u8 die_idx;
3003                 u8 _rsv2;
3004         } __packed req = {
3005                 .version = 1,
3006         };
3007         struct sk_buff *skb;
3008         int ret;
3009
3010         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_FREE_BLOCK), &req,
3011                                         sizeof(req), true, &skb);
3012         if (ret)
3013                 return ret;
3014
3015         *block_num = *(u8 *)skb->data;
3016         dev_kfree_skb(skb);
3017
3018         return 0;
3019 }
3020
3021 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
3022                                   u8 *data, u32 len, int cmd)
3023 {
3024         struct {
3025                 u8 dir;
3026                 u8 valid;
3027                 __le16 bitmap;
3028                 s8 precal;
3029                 u8 action;
3030                 u8 band;
3031                 u8 idx;
3032                 u8 rsv[4];
3033                 __le32 len;
3034         } req = {};
3035         struct sk_buff *skb;
3036
3037         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
3038         if (!skb)
3039                 return -ENOMEM;
3040
3041         req.idx = idx;
3042         req.len = cpu_to_le32(len);
3043         skb_put_data(skb, &req, sizeof(req));
3044         skb_put_data(skb, data, len);
3045
3046         return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
3047 }
3048
3049 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
3050 {
3051         u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3052         u32 total = MT_EE_CAL_GROUP_SIZE;
3053
3054         if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
3055                 return 0;
3056
3057         /*
3058          * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
3059          * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
3060          */
3061         while (total > 0) {
3062                 int ret, len;
3063
3064                 len = min_t(u32, total, MT_EE_CAL_UNIT);
3065
3066                 ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
3067                                              MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
3068                 if (ret)
3069                         return ret;
3070
3071                 total -= len;
3072                 cal += len;
3073                 idx++;
3074         }
3075
3076         return 0;
3077 }
3078
3079 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
3080 {
3081         int i;
3082
3083         for (i = 0; i < n_freqs; i++)
3084                 if (cur == freqs[i])
3085                         return i;
3086
3087         return -1;
3088 }
3089
3090 static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
3091 {
3092         static const u16 freq_list[] = {
3093                 5180, 5200, 5220, 5240,
3094                 5260, 5280, 5300, 5320,
3095                 5500, 5520, 5540, 5560,
3096                 5580, 5600, 5620, 5640,
3097                 5660, 5680, 5700, 5745,
3098                 5765, 5785, 5805, 5825
3099         };
3100         int offset_2g = ARRAY_SIZE(freq_list);
3101         int idx;
3102
3103         if (freq < 4000) {
3104                 if (freq < 2432)
3105                         return offset_2g;
3106                 if (freq < 2457)
3107                         return offset_2g + 1;
3108
3109                 return offset_2g + 2;
3110         }
3111
3112         if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
3113                 return -1;
3114
3115         if (bw != NL80211_CHAN_WIDTH_20) {
3116                 idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3117                                            freq + 10);
3118                 if (idx >= 0)
3119                         return idx;
3120
3121                 idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3122                                            freq - 10);
3123                 if (idx >= 0)
3124                         return idx;
3125         }
3126
3127         return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3128 }
3129
3130 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
3131 {
3132         struct mt7915_dev *dev = phy->dev;
3133         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3134         u16 total = 2, center_freq = chandef->center_freq1;
3135         u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3136         int idx;
3137
3138         if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
3139                 return 0;
3140
3141         idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
3142         if (idx < 0)
3143                 return -EINVAL;
3144
3145         /* Items: Tx DPD, Tx Flatness */
3146         idx = idx * 2;
3147         cal += MT_EE_CAL_GROUP_SIZE;
3148
3149         while (total--) {
3150                 int ret;
3151
3152                 cal += (idx * MT_EE_CAL_UNIT);
3153                 ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
3154                                              MCU_EXT_CMD(DPD_PRE_CAL_INFO));
3155                 if (ret)
3156                         return ret;
3157
3158                 idx++;
3159         }
3160
3161         return 0;
3162 }
3163
3164 int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
3165 {
3166         /* strict order */
3167         static const u32 offs[] = {
3168                 MIB_BUSY_TIME, MIB_TX_TIME, MIB_RX_TIME, MIB_OBSS_AIRTIME,
3169                 MIB_BUSY_TIME_V2, MIB_TX_TIME_V2, MIB_RX_TIME_V2,
3170                 MIB_OBSS_AIRTIME_V2
3171         };
3172         struct mt76_channel_state *state = phy->mt76->chan_state;
3173         struct mt76_channel_state *state_ts = &phy->state_ts;
3174         struct mt7915_dev *dev = phy->dev;
3175         struct mt7915_mcu_mib *res, req[4];
3176         struct sk_buff *skb;
3177         int i, ret, start = 0, ofs = 20;
3178
3179         if (!is_mt7915(&dev->mt76)) {
3180                 start = 4;
3181                 ofs = 0;
3182         }
3183
3184         for (i = 0; i < 4; i++) {
3185                 req[i].band = cpu_to_le32(phy != &dev->phy);
3186                 req[i].offs = cpu_to_le32(offs[i + start]);
3187         }
3188
3189         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(GET_MIB_INFO),
3190                                         req, sizeof(req), true, &skb);
3191         if (ret)
3192                 return ret;
3193
3194         res = (struct mt7915_mcu_mib *)(skb->data + ofs);
3195
3196         if (chan_switch)
3197                 goto out;
3198
3199 #define __res_u64(s) le64_to_cpu(res[s].data)
3200         state->cc_busy += __res_u64(0) - state_ts->cc_busy;
3201         state->cc_tx += __res_u64(1) - state_ts->cc_tx;
3202         state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx;
3203         state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx;
3204
3205 out:
3206         state_ts->cc_busy = __res_u64(0);
3207         state_ts->cc_tx = __res_u64(1);
3208         state_ts->cc_bss_rx = __res_u64(2);
3209         state_ts->cc_rx = __res_u64(2) + __res_u64(3);
3210 #undef __res_u64
3211
3212         dev_kfree_skb(skb);
3213
3214         return 0;
3215 }
3216
3217 int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
3218 {
3219         struct mt7915_dev *dev = phy->dev;
3220         struct {
3221                 u8 ctrl_id;
3222                 u8 action;
3223                 u8 dbdc_idx;
3224                 u8 rsv[5];
3225         } req = {
3226                 .ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3227                 .dbdc_idx = phy != &dev->phy,
3228         };
3229
3230         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3231                                  sizeof(req), true);
3232 }
3233
3234 int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
3235 {
3236         struct mt7915_dev *dev = phy->dev;
3237         struct {
3238                 struct mt7915_mcu_thermal_ctrl ctrl;
3239
3240                 __le32 trigger_temp;
3241                 __le32 restore_temp;
3242                 __le16 sustain_time;
3243                 u8 rsv[2];
3244         } __packed req = {
3245                 .ctrl = {
3246                         .band_idx = phy->band_idx,
3247                 },
3248         };
3249         int level;
3250
3251         if (!state) {
3252                 req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
3253                 goto out;
3254         }
3255
3256         /* set duty cycle and level */
3257         for (level = 0; level < 4; level++) {
3258                 int ret;
3259
3260                 req.ctrl.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG;
3261                 req.ctrl.duty.duty_level = level;
3262                 req.ctrl.duty.duty_cycle = state;
3263                 state /= 2;
3264
3265                 ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3266                                         &req, sizeof(req.ctrl), false);
3267                 if (ret)
3268                         return ret;
3269         }
3270
3271         /* set high-temperature trigger threshold */
3272         req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
3273         /* add a safety margin ~10 */
3274         req.restore_temp = cpu_to_le32(phy->throttle_temp[0] - 10);
3275         req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
3276         req.sustain_time = cpu_to_le16(10);
3277
3278 out:
3279         req.ctrl.type.protect_type = 1;
3280         req.ctrl.type.trigger_type = 1;
3281
3282         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3283                                  &req, sizeof(req), false);
3284 }
3285
3286 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3287 {
3288         struct mt7915_dev *dev = phy->dev;
3289         struct mt76_phy *mphy = phy->mt76;
3290         struct ieee80211_hw *hw = mphy->hw;
3291         struct mt7915_sku_val {
3292                 u8 format_id;
3293                 u8 limit_type;
3294                 u8 dbdc_idx;
3295                 s8 val[MT7915_SKU_RATE_NUM];
3296         } __packed req = {
3297                 .format_id = 4,
3298                 .dbdc_idx = phy != &dev->phy,
3299         };
3300         struct mt76_power_limits limits_array;
3301         s8 *la = (s8 *)&limits_array;
3302         int i, idx, n_chains = hweight8(mphy->antenna_mask);
3303         int tx_power = hw->conf.power_level * 2;
3304
3305         tx_power = mt76_get_sar_power(mphy, mphy->chandef.chan,
3306                                       tx_power);
3307         tx_power -= mt76_tx_power_nss_delta(n_chains);
3308         tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3309                                               &limits_array, tx_power);
3310         mphy->txpower_cur = tx_power;
3311
3312         for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3313                 u8 mcs_num, len = mt7915_sku_group_len[i];
3314                 int j;
3315
3316                 if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3317                         mcs_num = 10;
3318
3319                         if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3320                                 la = (s8 *)&limits_array + 12;
3321                 } else {
3322                         mcs_num = len;
3323                 }
3324
3325                 for (j = 0; j < min_t(u8, mcs_num, len); j++)
3326                         req.val[idx + j] = la[j];
3327
3328                 la += mcs_num;
3329                 idx += len;
3330         }
3331
3332         return mt76_mcu_send_msg(&dev->mt76,
3333                                  MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3334                                  sizeof(req), true);
3335 }
3336
3337 int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
3338 {
3339 #define RATE_POWER_INFO 2
3340         struct mt7915_dev *dev = phy->dev;
3341         struct {
3342                 u8 format_id;
3343                 u8 category;
3344                 u8 band;
3345                 u8 _rsv;
3346         } __packed req = {
3347                 .format_id = 7,
3348                 .category = RATE_POWER_INFO,
3349                 .band = phy != &dev->phy,
3350         };
3351         s8 res[MT7915_SKU_RATE_NUM][2];
3352         struct sk_buff *skb;
3353         int ret, i;
3354
3355         ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3356                                         MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
3357                                         &req, sizeof(req), true, &skb);
3358         if (ret)
3359                 return ret;
3360
3361         memcpy(res, skb->data + 4, sizeof(res));
3362         for (i = 0; i < len; i++)
3363                 txpower[i] = res[i][req.band];
3364
3365         dev_kfree_skb(skb);
3366
3367         return 0;
3368 }
3369
3370 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3371                               u8 en)
3372 {
3373         struct {
3374                 u8 test_mode_en;
3375                 u8 param_idx;
3376                 u8 _rsv[2];
3377
3378                 u8 enable;
3379                 u8 _rsv2[3];
3380
3381                 u8 pad[8];
3382         } __packed req = {
3383                 .test_mode_en = test_mode,
3384                 .param_idx = param,
3385                 .enable = en,
3386         };
3387
3388         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3389                                  sizeof(req), false);
3390 }
3391
3392 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3393 {
3394         struct mt7915_dev *dev = phy->dev;
3395         struct mt7915_sku {
3396                 u8 format_id;
3397                 u8 sku_enable;
3398                 u8 dbdc_idx;
3399                 u8 rsv;
3400         } __packed req = {
3401                 .format_id = 0,
3402                 .dbdc_idx = phy != &dev->phy,
3403                 .sku_enable = enable,
3404         };
3405
3406         return mt76_mcu_send_msg(&dev->mt76,
3407                                  MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3408                                  sizeof(req), true);
3409 }
3410
3411 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3412 {
3413         struct {
3414                 u8 action;
3415                 u8 set;
3416                 u8 band;
3417                 u8 rsv;
3418         } req = {
3419                 .action = action,
3420                 .set = set,
3421                 .band = band,
3422         };
3423
3424         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3425                                  &req, sizeof(req), false);
3426 }
3427
3428 int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
3429 {
3430         struct {
3431                 u8 action;
3432                 union {
3433                         struct {
3434                                 u8 snd_mode;
3435                                 u8 sta_num;
3436                                 u8 rsv;
3437                                 u8 wlan_idx[4];
3438                                 __le32 snd_period;      /* ms */
3439                         } __packed snd;
3440                         struct {
3441                                 bool ebf;
3442                                 bool ibf;
3443                                 u8 rsv;
3444                         } __packed type;
3445                         struct {
3446                                 u8 bf_num;
3447                                 u8 bf_bitmap;
3448                                 u8 bf_sel[8];
3449                                 u8 rsv[5];
3450                         } __packed mod;
3451                 };
3452         } __packed req = {
3453                 .action = action,
3454         };
3455
3456 #define MT_BF_PROCESSING        4
3457         switch (action) {
3458         case MT_BF_SOUNDING_ON:
3459                 req.snd.snd_mode = MT_BF_PROCESSING;
3460                 break;
3461         case MT_BF_TYPE_UPDATE:
3462                 req.type.ebf = true;
3463                 req.type.ibf = dev->ibf;
3464                 break;
3465         case MT_BF_MODULE_UPDATE:
3466                 req.mod.bf_num = 2;
3467                 req.mod.bf_bitmap = GENMASK(1, 0);
3468                 break;
3469         default:
3470                 return -EINVAL;
3471         }
3472
3473         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3474                                  sizeof(req), true);
3475 }
3476
3477 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3478                             bool enable)
3479 {
3480 #define MT_SPR_ENABLE           1
3481         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3482         struct {
3483                 u8 action;
3484                 u8 arg_num;
3485                 u8 band_idx;
3486                 u8 status;
3487                 u8 drop_tx_idx;
3488                 u8 sta_idx;     /* 256 sta */
3489                 u8 rsv[2];
3490                 __le32 val;
3491         } __packed req = {
3492                 .action = MT_SPR_ENABLE,
3493                 .arg_num = 1,
3494                 .band_idx = mvif->mt76.band_idx,
3495                 .val = cpu_to_le32(enable),
3496         };
3497
3498         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3499                                  sizeof(req), true);
3500 }
3501
3502 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3503                            struct ieee80211_sta *sta, struct rate_info *rate)
3504 {
3505         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3506         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3507         struct mt7915_dev *dev = phy->dev;
3508         struct mt76_phy *mphy = phy->mt76;
3509         struct {
3510                 u8 category;
3511                 u8 band;
3512                 __le16 wcid;
3513         } __packed req = {
3514                 .category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3515                 .band = mvif->mt76.band_idx,
3516                 .wcid = cpu_to_le16(msta->wcid.idx),
3517         };
3518         struct ieee80211_supported_band *sband;
3519         struct mt7915_mcu_phy_rx_info *res;
3520         struct sk_buff *skb;
3521         int ret;
3522         bool cck = false;
3523
3524         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3525                                         &req, sizeof(req), true, &skb);
3526         if (ret)
3527                 return ret;
3528
3529         res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3530
3531         rate->mcs = res->rate;
3532         rate->nss = res->nsts + 1;
3533
3534         switch (res->mode) {
3535         case MT_PHY_TYPE_CCK:
3536                 cck = true;
3537                 fallthrough;
3538         case MT_PHY_TYPE_OFDM:
3539                 if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3540                         sband = &mphy->sband_5g.sband;
3541                 else if (mphy->chandef.chan->band == NL80211_BAND_6GHZ)
3542                         sband = &mphy->sband_6g.sband;
3543                 else
3544                         sband = &mphy->sband_2g.sband;
3545
3546                 rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
3547                 rate->legacy = sband->bitrates[rate->mcs].bitrate;
3548                 break;
3549         case MT_PHY_TYPE_HT:
3550         case MT_PHY_TYPE_HT_GF:
3551                 if (rate->mcs > 31) {
3552                         ret = -EINVAL;
3553                         goto out;
3554                 }
3555
3556                 rate->flags = RATE_INFO_FLAGS_MCS;
3557                 if (res->gi)
3558                         rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3559                 break;
3560         case MT_PHY_TYPE_VHT:
3561                 if (rate->mcs > 9) {
3562                         ret = -EINVAL;
3563                         goto out;
3564                 }
3565
3566                 rate->flags = RATE_INFO_FLAGS_VHT_MCS;
3567                 if (res->gi)
3568                         rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3569                 break;
3570         case MT_PHY_TYPE_HE_SU:
3571         case MT_PHY_TYPE_HE_EXT_SU:
3572         case MT_PHY_TYPE_HE_TB:
3573         case MT_PHY_TYPE_HE_MU:
3574                 if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
3575                         ret = -EINVAL;
3576                         goto out;
3577                 }
3578                 rate->he_gi = res->gi;
3579                 rate->flags = RATE_INFO_FLAGS_HE_MCS;
3580                 break;
3581         default:
3582                 ret = -EINVAL;
3583                 goto out;
3584         }
3585
3586         switch (res->bw) {
3587         case IEEE80211_STA_RX_BW_160:
3588                 rate->bw = RATE_INFO_BW_160;
3589                 break;
3590         case IEEE80211_STA_RX_BW_80:
3591                 rate->bw = RATE_INFO_BW_80;
3592                 break;
3593         case IEEE80211_STA_RX_BW_40:
3594                 rate->bw = RATE_INFO_BW_40;
3595                 break;
3596         default:
3597                 rate->bw = RATE_INFO_BW_20;
3598                 break;
3599         }
3600
3601 out:
3602         dev_kfree_skb(skb);
3603
3604         return ret;
3605 }
3606
3607 int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3608                                 struct cfg80211_he_bss_color *he_bss_color)
3609 {
3610         int len = sizeof(struct sta_req_hdr) + sizeof(struct bss_info_color);
3611         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3612         struct bss_info_color *bss_color;
3613         struct sk_buff *skb;
3614         struct tlv *tlv;
3615
3616         skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
3617                                               NULL, len);
3618         if (IS_ERR(skb))
3619                 return PTR_ERR(skb);
3620
3621         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BSS_COLOR,
3622                                       sizeof(*bss_color));
3623         bss_color = (struct bss_info_color *)tlv;
3624         bss_color->disable = !he_bss_color->enabled;
3625         bss_color->color = he_bss_color->color;
3626
3627         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
3628                                      MCU_EXT_CMD(BSS_INFO_UPDATE), true);
3629 }
3630
3631 #define TWT_AGRT_TRIGGER        BIT(0)
3632 #define TWT_AGRT_ANNOUNCE       BIT(1)
3633 #define TWT_AGRT_PROTECT        BIT(2)
3634
3635 int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
3636                                struct mt7915_vif *mvif,
3637                                struct mt7915_twt_flow *flow,
3638                                int cmd)
3639 {
3640         struct {
3641                 u8 tbl_idx;
3642                 u8 cmd;
3643                 u8 own_mac_idx;
3644                 u8 flowid; /* 0xff for group id */
3645                 __le16 peer_id; /* specify the peer_id (msb=0)
3646                                  * or group_id (msb=1)
3647                                  */
3648                 u8 duration; /* 256 us */
3649                 u8 bss_idx;
3650                 __le64 start_tsf;
3651                 __le16 mantissa;
3652                 u8 exponent;
3653                 u8 is_ap;
3654                 u8 agrt_params;
3655                 u8 rsv[23];
3656         } __packed req = {
3657                 .tbl_idx = flow->table_id,
3658                 .cmd = cmd,
3659                 .own_mac_idx = mvif->mt76.omac_idx,
3660                 .flowid = flow->id,
3661                 .peer_id = cpu_to_le16(flow->wcid),
3662                 .duration = flow->duration,
3663                 .bss_idx = mvif->mt76.idx,
3664                 .start_tsf = cpu_to_le64(flow->tsf),
3665                 .mantissa = flow->mantissa,
3666                 .exponent = flow->exp,
3667                 .is_ap = true,
3668         };
3669
3670         if (flow->protection)
3671                 req.agrt_params |= TWT_AGRT_PROTECT;
3672         if (!flow->flowtype)
3673                 req.agrt_params |= TWT_AGRT_ANNOUNCE;
3674         if (flow->trigger)
3675                 req.agrt_params |= TWT_AGRT_TRIGGER;
3676
3677         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TWT_AGRT_UPDATE),
3678                                  &req, sizeof(req), true);
3679 }