drivers/net/wireless/mediatek/mt76/mt7915/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2020 MediaTek Inc. */
   3
   4 #include <linux/firmware.h>
   5 #include <linux/fs.h>
   6 #include "mt7915.h"
   7 #include "mcu.h"
   8 #include "mac.h"
   9 #include "eeprom.h"
  10
  11 struct mt7915_patch_hdr {
  12         char build_date[16];
  13         char platform[4];
  14         __be32 hw_sw_ver;
  15         __be32 patch_ver;
  16         __be16 checksum;
  17         u16 reserved;
  18         struct {
  19                 __be32 patch_ver;
  20                 __be32 subsys;
  21                 __be32 feature;
  22                 __be32 n_region;
  23                 __be32 crc;
  24                 u32 reserved[11];
  25         } desc;
  26 } __packed;
  27
  28 struct mt7915_patch_sec {
  29         __be32 type;
  30         __be32 offs;
  31         __be32 size;
  32         union {
  33                 __be32 spec[13];
  34                 struct {
  35                         __be32 addr;
  36                         __be32 len;
  37                         __be32 sec_key_idx;
  38                         __be32 align_len;
  39                         u32 reserved[9];
  40                 } info;
  41         };
  42 } __packed;
  43
  44 struct mt7915_fw_trailer {
  45         u8 chip_id;
  46         u8 eco_code;
  47         u8 n_region;
  48         u8 format_ver;
  49         u8 format_flag;
  50         u8 reserved[2];
  51         char fw_ver[10];
  52         char build_date[15];
  53         u32 crc;
  54 } __packed;
  55
  56 struct mt7915_fw_region {
  57         __le32 decomp_crc;
  58         __le32 decomp_len;
  59         __le32 decomp_blk_sz;
  60         u8 reserved[4];
  61         __le32 addr;
  62         __le32 len;
  63         u8 feature_set;
  64         u8 reserved1[15];
  65 } __packed;
  66
  67 #define MCU_PATCH_ADDRESS               0x200000
  68
  69 #define FW_FEATURE_SET_ENCRYPT          BIT(0)
  70 #define FW_FEATURE_SET_KEY_IDX          GENMASK(2, 1)
  71 #define FW_FEATURE_OVERRIDE_ADDR        BIT(5)
  72
  73 #define DL_MODE_ENCRYPT                 BIT(0)
  74 #define DL_MODE_KEY_IDX                 GENMASK(2, 1)
  75 #define DL_MODE_RESET_SEC_IV            BIT(3)
  76 #define DL_MODE_WORKING_PDA_CR4         BIT(4)
  77 #define DL_MODE_NEED_RSP                BIT(31)
  78
  79 #define FW_START_OVERRIDE               BIT(0)
  80 #define FW_START_WORKING_PDA_CR4        BIT(2)
  81
  82 #define PATCH_SEC_TYPE_MASK             GENMASK(15, 0)
  83 #define PATCH_SEC_TYPE_INFO             0x2
  84
  85 #define to_wcid_lo(id)                  FIELD_GET(GENMASK(7, 0), (u16)id)
  86 #define to_wcid_hi(id)                  FIELD_GET(GENMASK(9, 8), (u16)id)
  87
  88 #define HE_PHY(p, c)                    u8_get_bits(c, IEEE80211_HE_PHY_##p)
  89 #define HE_MAC(m, c)                    u8_get_bits(c, IEEE80211_HE_MAC_##m)
  90
  91 static enum mt7915_cipher_type
  92 mt7915_mcu_get_cipher(int cipher)
  93 {
  94         switch (cipher) {
  95         case WLAN_CIPHER_SUITE_WEP40:
  96                 return MT_CIPHER_WEP40;
  97         case WLAN_CIPHER_SUITE_WEP104:
  98                 return MT_CIPHER_WEP104;
  99         case WLAN_CIPHER_SUITE_TKIP:
 100                 return MT_CIPHER_TKIP;
 101         case WLAN_CIPHER_SUITE_AES_CMAC:
 102                 return MT_CIPHER_BIP_CMAC_128;
 103         case WLAN_CIPHER_SUITE_CCMP:
 104                 return MT_CIPHER_AES_CCMP;
 105         case WLAN_CIPHER_SUITE_CCMP_256:
 106                 return MT_CIPHER_CCMP_256;
 107         case WLAN_CIPHER_SUITE_GCMP:
 108                 return MT_CIPHER_GCMP;
 109         case WLAN_CIPHER_SUITE_GCMP_256:
 110                 return MT_CIPHER_GCMP_256;
 111         case WLAN_CIPHER_SUITE_SMS4:
 112                 return MT_CIPHER_WAPI;
 113         default:
 114                 return MT_CIPHER_NONE;
 115         }
 116 }
 117
 118 static u8 mt7915_mcu_chan_bw(struct cfg80211_chan_def *chandef)
 119 {
 120         static const u8 width_to_bw[] = {
 121                 [NL80211_CHAN_WIDTH_40] = CMD_CBW_40MHZ,
 122                 [NL80211_CHAN_WIDTH_80] = CMD_CBW_80MHZ,
 123                 [NL80211_CHAN_WIDTH_80P80] = CMD_CBW_8080MHZ,
 124                 [NL80211_CHAN_WIDTH_160] = CMD_CBW_160MHZ,
 125                 [NL80211_CHAN_WIDTH_5] = CMD_CBW_5MHZ,
 126                 [NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
 127                 [NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
 128                 [NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
 129         };
 130
 131         if (chandef->width >= ARRAY_SIZE(width_to_bw))
 132                 return 0;
 133
 134         return width_to_bw[chandef->width];
 135 }
 136
 137 static const struct ieee80211_sta_he_cap *
 138 mt7915_get_he_phy_cap(struct mt7915_phy *phy, struct ieee80211_vif *vif)
 139 {
 140         struct ieee80211_supported_band *sband;
 141         enum nl80211_band band;
 142
 143         band = phy->mt76->chandef.chan->band;
 144         sband = phy->mt76->hw->wiphy->bands[band];
 145
 146         return ieee80211_get_he_iftype_cap(sband, vif->type);
 147 }
 148
 149 static u8
 150 mt7915_get_phy_mode(struct ieee80211_vif *vif, struct ieee80211_sta *sta)
 151 {
 152         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 153         enum nl80211_band band = mvif->phy->mt76->chandef.chan->band;
 154         struct ieee80211_sta_ht_cap *ht_cap;
 155         struct ieee80211_sta_vht_cap *vht_cap;
 156         const struct ieee80211_sta_he_cap *he_cap;
 157         u8 mode = 0;
 158
 159         if (sta) {
 160                 ht_cap = &sta->ht_cap;
 161                 vht_cap = &sta->vht_cap;
 162                 he_cap = &sta->he_cap;
 163         } else {
 164                 struct ieee80211_supported_band *sband;
 165
 166                 sband = mvif->phy->mt76->hw->wiphy->bands[band];
 167
 168                 ht_cap = &sband->ht_cap;
 169                 vht_cap = &sband->vht_cap;
 170                 he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
 171         }
 172
 173         if (band == NL80211_BAND_2GHZ) {
 174                 mode |= PHY_MODE_B | PHY_MODE_G;
 175
 176                 if (ht_cap->ht_supported)
 177                         mode |= PHY_MODE_GN;
 178
 179                 if (he_cap->has_he)
 180                         mode |= PHY_MODE_AX_24G;
 181         } else if (band == NL80211_BAND_5GHZ) {
 182                 mode |= PHY_MODE_A;
 183
 184                 if (ht_cap->ht_supported)
 185                         mode |= PHY_MODE_AN;
 186
 187                 if (vht_cap->vht_supported)
 188                         mode |= PHY_MODE_AC;
 189
 190                 if (he_cap->has_he)
 191                         mode |= PHY_MODE_AX_5G;
 192         }
 193
 194         return mode;
 195 }
 196
 197 static u8
 198 mt7915_mcu_get_sta_nss(u16 mcs_map)
 199 {
 200         u8 nss;
 201
 202         for (nss = 8; nss > 0; nss--) {
 203                 u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
 204
 205                 if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
 206                         break;
 207         }
 208
 209         return nss - 1;
 210 }
 211
 212 static void
 213 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
 214                           const u16 *mask)
 215 {
 216         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
 217         struct cfg80211_chan_def *chandef = &msta->vif->phy->mt76->chandef;
 218         int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
 219         u16 mcs_map;
 220
 221         switch (chandef->width) {
 222         case NL80211_CHAN_WIDTH_80P80:
 223                 mcs_map = le16_to_cpu(sta->he_cap.he_mcs_nss_supp.rx_mcs_80p80);
 224                 break;
 225         case NL80211_CHAN_WIDTH_160:
 226                 mcs_map = le16_to_cpu(sta->he_cap.he_mcs_nss_supp.rx_mcs_160);
 227                 break;
 228         default:
 229                 mcs_map = le16_to_cpu(sta->he_cap.he_mcs_nss_supp.rx_mcs_80);
 230                 break;
 231         }
 232
 233         for (nss = 0; nss < max_nss; nss++) {
 234                 int mcs;
 235
 236                 switch ((mcs_map >> (2 * nss)) & 0x3) {
 237                 case IEEE80211_HE_MCS_SUPPORT_0_11:
 238                         mcs = GENMASK(11, 0);
 239                         break;
 240                 case IEEE80211_HE_MCS_SUPPORT_0_9:
 241                         mcs = GENMASK(9, 0);
 242                         break;
 243                 case IEEE80211_HE_MCS_SUPPORT_0_7:
 244                         mcs = GENMASK(7, 0);
 245                         break;
 246                 default:
 247                         mcs = 0;
 248                 }
 249
 250                 mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
 251
 252                 switch (mcs) {
 253                 case 0 ... 7:
 254                         mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
 255                         break;
 256                 case 8 ... 9:
 257                         mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
 258                         break;
 259                 case 10 ... 11:
 260                         mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
 261                         break;
 262                 default:
 263                         mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
 264                         break;
 265                 }
 266                 mcs_map &= ~(0x3 << (nss * 2));
 267                 mcs_map |= mcs << (nss * 2);
 268
 269                 /* only support 2ss on 160MHz */
 270                 if (nss > 1 && (sta->bandwidth == IEEE80211_STA_RX_BW_160))
 271                         break;
 272         }
 273
 274         *he_mcs = cpu_to_le16(mcs_map);
 275 }
 276
 277 static void
 278 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
 279                            const u16 *mask)
 280 {
 281         u16 mcs_map = le16_to_cpu(sta->vht_cap.vht_mcs.rx_mcs_map);
 282         int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
 283         u16 mcs;
 284
 285         for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
 286                 switch (mcs_map & 0x3) {
 287                 case IEEE80211_VHT_MCS_SUPPORT_0_9:
 288                         mcs = GENMASK(9, 0);
 289                         break;
 290                 case IEEE80211_VHT_MCS_SUPPORT_0_8:
 291                         mcs = GENMASK(8, 0);
 292                         break;
 293                 case IEEE80211_VHT_MCS_SUPPORT_0_7:
 294                         mcs = GENMASK(7, 0);
 295                         break;
 296                 default:
 297                         mcs = 0;
 298                 }
 299
 300                 vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
 301
 302                 /* only support 2ss on 160MHz */
 303                 if (nss > 1 && (sta->bandwidth == IEEE80211_STA_RX_BW_160))
 304                         break;
 305         }
 306 }
 307
 308 static void
 309 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
 310                           const u8 *mask)
 311 {
 312         int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
 313
 314         for (nss = 0; nss < max_nss; nss++)
 315                 ht_mcs[nss] = sta->ht_cap.mcs.rx_mask[nss] & mask[nss];
 316 }
 317
 318 static int
 319 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 320                           struct sk_buff *skb, int seq)
 321 {
 322         struct mt7915_mcu_rxd *rxd;
 323         int ret = 0;
 324
 325         if (!skb) {
 326                 dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
 327                         cmd, seq);
 328                 return -ETIMEDOUT;
 329         }
 330
 331         rxd = (struct mt7915_mcu_rxd *)skb->data;
 332         if (seq != rxd->seq)
 333                 return -EAGAIN;
 334
 335         if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
 336                 skb_pull(skb, sizeof(*rxd) - 4);
 337                 ret = *skb->data;
 338         } else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
 339                 skb_pull(skb, sizeof(*rxd) + 4);
 340                 ret = le32_to_cpu(*(__le32 *)skb->data);
 341         } else {
 342                 skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
 343         }
 344
 345         return ret;
 346 }
 347
 348 static int
 349 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 350                         int cmd, int *wait_seq)
 351 {
 352         struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
 353         struct mt7915_mcu_txd *mcu_txd;
 354         enum mt76_mcuq_id qid;
 355         __le32 *txd;
 356         u32 val;
 357         u8 seq;
 358
 359         /* TODO: make dynamic based on msg type */
 360         mdev->mcu.timeout = 20 * HZ;
 361
 362         seq = ++dev->mt76.mcu.msg_seq & 0xf;
 363         if (!seq)
 364                 seq = ++dev->mt76.mcu.msg_seq & 0xf;
 365
 366         if (cmd == MCU_CMD(FW_SCATTER)) {
 367                 qid = MT_MCUQ_FWDL;
 368                 goto exit;
 369         }
 370
 371         mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
 372         if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 373                 qid = MT_MCUQ_WA;
 374         else
 375                 qid = MT_MCUQ_WM;
 376
 377         txd = mcu_txd->txd;
 378
 379         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
 380               FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
 381               FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
 382         txd[0] = cpu_to_le32(val);
 383
 384         val = MT_TXD1_LONG_FORMAT |
 385               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
 386         txd[1] = cpu_to_le32(val);
 387
 388         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 389         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
 390                                                MT_TX_MCU_PORT_RX_Q0));
 391         mcu_txd->pkt_type = MCU_PKT_ID;
 392         mcu_txd->seq = seq;
 393
 394         mcu_txd->cid = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
 395         mcu_txd->set_query = MCU_Q_NA;
 396         mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
 397         if (mcu_txd->ext_cid) {
 398                 mcu_txd->ext_cid_ack = 1;
 399
 400                 /* do not use Q_SET for efuse */
 401                 if (cmd & __MCU_CMD_FIELD_QUERY)
 402                         mcu_txd->set_query = MCU_Q_QUERY;
 403                 else
 404                         mcu_txd->set_query = MCU_Q_SET;
 405         }
 406
 407         if (cmd & __MCU_CMD_FIELD_WA)
 408                 mcu_txd->s2d_index = MCU_S2D_H2C;
 409         else
 410                 mcu_txd->s2d_index = MCU_S2D_H2N;
 411
 412 exit:
 413         if (wait_seq)
 414                 *wait_seq = seq;
 415
 416         return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
 417 }
 418
 419 static void
 420 mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
 421 {
 422         struct {
 423                 __le32 args[3];
 424         } req = {
 425                 .args = {
 426                         cpu_to_le32(a1),
 427                         cpu_to_le32(a2),
 428                         cpu_to_le32(a3),
 429                 },
 430         };
 431
 432         mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
 433 }
 434
 435 static void
 436 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 437 {
 438         if (vif->csa_active)
 439                 ieee80211_csa_finish(vif);
 440 }
 441
 442 static void
 443 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
 444 {
 445         struct mt76_phy *mphy = &dev->mt76.phy;
 446         struct mt7915_mcu_csa_notify *c;
 447
 448         c = (struct mt7915_mcu_csa_notify *)skb->data;
 449
 450         if (c->band_idx && dev->mt76.phy2)
 451                 mphy = dev->mt76.phy2;
 452
 453         ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 454                         IEEE80211_IFACE_ITER_RESUME_ALL,
 455                         mt7915_mcu_csa_finish, mphy->hw);
 456 }
 457
 458 static void
 459 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
 460 {
 461         struct mt76_phy *mphy = &dev->mt76.phy;
 462         struct mt7915_mcu_rdd_report *r;
 463
 464         r = (struct mt7915_mcu_rdd_report *)skb->data;
 465
 466         if (r->band_idx && dev->mt76.phy2)
 467                 mphy = dev->mt76.phy2;
 468
 469         ieee80211_radar_detected(mphy->hw);
 470         dev->hw_pattern++;
 471 }
 472
 473 static int
 474 mt7915_mcu_tx_rate_parse(struct mt76_phy *mphy, struct mt7915_mcu_ra_info *ra,
 475                          struct rate_info *rate, u16 r)
 476 {
 477         struct ieee80211_supported_band *sband;
 478         u16 ru_idx = le16_to_cpu(ra->ru_idx);
 479         bool cck = false;
 480
 481         rate->mcs = FIELD_GET(MT_RA_RATE_MCS, r);
 482         rate->nss = FIELD_GET(MT_RA_RATE_NSS, r) + 1;
 483
 484         switch (FIELD_GET(MT_RA_RATE_TX_MODE, r)) {
 485         case MT_PHY_TYPE_CCK:
 486                 cck = true;
 487                 fallthrough;
 488         case MT_PHY_TYPE_OFDM:
 489                 if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
 490                         sband = &mphy->sband_5g.sband;
 491                 else
 492                         sband = &mphy->sband_2g.sband;
 493
 494                 rate->mcs = mt76_get_rate(mphy->dev, sband, rate->mcs, cck);
 495                 rate->legacy = sband->bitrates[rate->mcs].bitrate;
 496                 break;
 497         case MT_PHY_TYPE_HT:
 498         case MT_PHY_TYPE_HT_GF:
 499                 rate->mcs += (rate->nss - 1) * 8;
 500                 if (rate->mcs > 31)
 501                         return -EINVAL;
 502
 503                 rate->flags = RATE_INFO_FLAGS_MCS;
 504                 if (ra->gi)
 505                         rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
 506                 break;
 507         case MT_PHY_TYPE_VHT:
 508                 if (rate->mcs > 9)
 509                         return -EINVAL;
 510
 511                 rate->flags = RATE_INFO_FLAGS_VHT_MCS;
 512                 if (ra->gi)
 513                         rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
 514                 break;
 515         case MT_PHY_TYPE_HE_SU:
 516         case MT_PHY_TYPE_HE_EXT_SU:
 517         case MT_PHY_TYPE_HE_TB:
 518         case MT_PHY_TYPE_HE_MU:
 519                 if (ra->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11)
 520                         return -EINVAL;
 521
 522                 rate->he_gi = ra->gi;
 523                 rate->he_dcm = FIELD_GET(MT_RA_RATE_DCM_EN, r);
 524                 rate->flags = RATE_INFO_FLAGS_HE_MCS;
 525                 break;
 526         default:
 527                 return -EINVAL;
 528         }
 529
 530         if (ru_idx) {
 531                 switch (ru_idx) {
 532                 case 1 ... 2:
 533                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_996;
 534                         break;
 535                 case 3 ... 6:
 536                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_484;
 537                         break;
 538                 case 7 ... 14:
 539                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_242;
 540                         break;
 541                 default:
 542                         rate->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_106;
 543                         break;
 544                 }
 545                 rate->bw = RATE_INFO_BW_HE_RU;
 546         } else {
 547                 u8 bw = mt7915_mcu_chan_bw(&mphy->chandef) -
 548                         FIELD_GET(MT_RA_RATE_BW, r);
 549
 550                 switch (bw) {
 551                 case IEEE80211_STA_RX_BW_160:
 552                         rate->bw = RATE_INFO_BW_160;
 553                         break;
 554                 case IEEE80211_STA_RX_BW_80:
 555                         rate->bw = RATE_INFO_BW_80;
 556                         break;
 557                 case IEEE80211_STA_RX_BW_40:
 558                         rate->bw = RATE_INFO_BW_40;
 559                         break;
 560                 default:
 561                         rate->bw = RATE_INFO_BW_20;
 562                         break;
 563                 }
 564         }
 565
 566         return 0;
 567 }
 568
 569 static void
 570 mt7915_mcu_tx_rate_report(struct mt7915_dev *dev, struct sk_buff *skb)
 571 {
 572         struct mt7915_mcu_ra_info *ra = (struct mt7915_mcu_ra_info *)skb->data;
 573         struct rate_info rate = {}, prob_rate = {};
 574         u16 probe = le16_to_cpu(ra->prob_up_rate);
 575         u16 attempts = le16_to_cpu(ra->attempts);
 576         u16 curr = le16_to_cpu(ra->curr_rate);
 577         u16 wcidx = le16_to_cpu(ra->wlan_idx);
 578         struct ieee80211_tx_status status = {};
 579         struct mt76_phy *mphy = &dev->mphy;
 580         struct mt7915_sta_stats *stats;
 581         struct mt7915_sta *msta;
 582         struct mt76_wcid *wcid;
 583
 584         if (wcidx >= MT76_N_WCIDS)
 585                 return;
 586
 587         wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
 588         if (!wcid)
 589                 return;
 590
 591         msta = container_of(wcid, struct mt7915_sta, wcid);
 592         stats = &msta->stats;
 593
 594         if (msta->wcid.ext_phy && dev->mt76.phy2)
 595                 mphy = dev->mt76.phy2;
 596
 597         /* current rate */
 598         if (!mt7915_mcu_tx_rate_parse(mphy, ra, &rate, curr))
 599                 stats->tx_rate = rate;
 600
 601         /* probing rate */
 602         if (!mt7915_mcu_tx_rate_parse(mphy, ra, &prob_rate, probe))
 603                 stats->prob_rate = prob_rate;
 604
 605         if (attempts) {
 606                 u16 success = le16_to_cpu(ra->success);
 607
 608                 stats->per = 1000 * (attempts - success) / attempts;
 609         }
 610
 611         status.sta = wcid_to_sta(wcid);
 612         if (!status.sta)
 613                 return;
 614
 615         status.rate = &stats->tx_rate;
 616         ieee80211_tx_status_ext(mphy->hw, &status);
 617 }
 618
 619 static void
 620 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
 621 {
 622         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 623         const char *data = (char *)&rxd[1];
 624         const char *type;
 625
 626         switch (rxd->s2d_index) {
 627         case 0:
 628                 type = "WM";
 629                 break;
 630         case 2:
 631                 type = "WA";
 632                 break;
 633         default:
 634                 type = "unknown";
 635                 break;
 636         }
 637
 638         wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type,
 639                    (int)(skb->len - sizeof(*rxd)), data);
 640 }
 641
 642 static void
 643 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
 644 {
 645         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 646
 647         switch (rxd->ext_eid) {
 648         case MCU_EXT_EVENT_RDD_REPORT:
 649                 mt7915_mcu_rx_radar_detected(dev, skb);
 650                 break;
 651         case MCU_EXT_EVENT_CSA_NOTIFY:
 652                 mt7915_mcu_rx_csa_notify(dev, skb);
 653                 break;
 654         case MCU_EXT_EVENT_RATE_REPORT:
 655                 mt7915_mcu_tx_rate_report(dev, skb);
 656                 break;
 657         case MCU_EXT_EVENT_FW_LOG_2_HOST:
 658                 mt7915_mcu_rx_log_message(dev, skb);
 659                 break;
 660         default:
 661                 break;
 662         }
 663 }
 664
 665 static void
 666 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
 667 {
 668         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 669
 670         switch (rxd->eid) {
 671         case MCU_EVENT_EXT:
 672                 mt7915_mcu_rx_ext_event(dev, skb);
 673                 break;
 674         default:
 675                 break;
 676         }
 677         dev_kfree_skb(skb);
 678 }
 679
 680 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
 681 {
 682         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 683
 684         if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
 685             rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 686             rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
 687             rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
 688             rxd->ext_eid == MCU_EXT_EVENT_RATE_REPORT ||
 689             !rxd->seq)
 690                 mt7915_mcu_rx_unsolicited_event(dev, skb);
 691         else
 692                 mt76_mcu_rx_event(&dev->mt76, skb);
 693 }
 694
 695 static struct sk_buff *
 696 mt7915_mcu_alloc_sta_req(struct mt7915_dev *dev, struct mt7915_vif *mvif,
 697                          struct mt7915_sta *msta, int len)
 698 {
 699         struct sta_req_hdr hdr = {
 700                 .bss_idx = mvif->idx,
 701                 .wlan_idx_lo = msta ? to_wcid_lo(msta->wcid.idx) : 0,
 702                 .wlan_idx_hi = msta ? to_wcid_hi(msta->wcid.idx) : 0,
 703                 .muar_idx = msta ? mvif->omac_idx : 0,
 704                 .is_tlv_append = 1,
 705         };
 706         struct sk_buff *skb;
 707
 708         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
 709         if (!skb)
 710                 return ERR_PTR(-ENOMEM);
 711
 712         skb_put_data(skb, &hdr, sizeof(hdr));
 713
 714         return skb;
 715 }
 716
 717 static struct wtbl_req_hdr *
 718 mt7915_mcu_alloc_wtbl_req(struct mt7915_dev *dev, struct mt7915_sta *msta,
 719                           int cmd, void *sta_wtbl, struct sk_buff **skb)
 720 {
 721         struct tlv *sta_hdr = sta_wtbl;
 722         struct wtbl_req_hdr hdr = {
 723                 .wlan_idx_lo = to_wcid_lo(msta->wcid.idx),
 724                 .wlan_idx_hi = to_wcid_hi(msta->wcid.idx),
 725                 .operation = cmd,
 726         };
 727         struct sk_buff *nskb = *skb;
 728
 729         if (!nskb) {
 730                 nskb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
 731                                           MT7915_WTBL_UPDATE_MAX_SIZE);
 732                 if (!nskb)
 733                         return ERR_PTR(-ENOMEM);
 734
 735                 *skb = nskb;
 736         }
 737
 738         if (sta_hdr)
 739                 sta_hdr->len = cpu_to_le16(sizeof(hdr));
 740
 741         return skb_put_data(nskb, &hdr, sizeof(hdr));
 742 }
 743
 744 static struct tlv *
 745 mt7915_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
 746                           void *sta_ntlv, void *sta_wtbl)
 747 {
 748         struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
 749         struct tlv *sta_hdr = sta_wtbl;
 750         struct tlv *ptlv, tlv = {
 751                 .tag = cpu_to_le16(tag),
 752                 .len = cpu_to_le16(len),
 753         };
 754         u16 ntlv;
 755
 756         ptlv = skb_put(skb, len);
 757         memcpy(ptlv, &tlv, sizeof(tlv));
 758
 759         ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
 760         ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
 761
 762         if (sta_hdr) {
 763                 u16 size = le16_to_cpu(sta_hdr->len);
 764
 765                 sta_hdr->len = cpu_to_le16(size + len);
 766         }
 767
 768         return ptlv;
 769 }
 770
 771 static struct tlv *
 772 mt7915_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
 773 {
 774         return mt7915_mcu_add_nested_tlv(skb, tag, len, skb->data, NULL);
 775 }
 776
 777 static struct tlv *
 778 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
 779                              __le16 *sub_ntlv, __le16 *len)
 780 {
 781         struct tlv *ptlv, tlv = {
 782                 .tag = cpu_to_le16(sub_tag),
 783                 .len = cpu_to_le16(sub_len),
 784         };
 785
 786         ptlv = skb_put(skb, sub_len);
 787         memcpy(ptlv, &tlv, sizeof(tlv));
 788
 789         le16_add_cpu(sub_ntlv, 1);
 790         le16_add_cpu(len, sub_len);
 791
 792         return ptlv;
 793 }
 794
 795 /** bss info **/
 796 static int
 797 mt7915_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 798                          struct mt7915_phy *phy, bool enable)
 799 {
 800         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 801         struct bss_info_basic *bss;
 802         u16 wlan_idx = mvif->sta.wcid.idx;
 803         u32 type = NETWORK_INFRA;
 804         struct tlv *tlv;
 805
 806         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
 807
 808         switch (vif->type) {
 809         case NL80211_IFTYPE_MESH_POINT:
 810         case NL80211_IFTYPE_AP:
 811         case NL80211_IFTYPE_MONITOR:
 812                 break;
 813         case NL80211_IFTYPE_STATION:
 814                 /* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
 815                 if (enable) {
 816                         struct ieee80211_sta *sta;
 817                         struct mt7915_sta *msta;
 818
 819                         rcu_read_lock();
 820                         sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
 821                         if (!sta) {
 822                                 rcu_read_unlock();
 823                                 return -EINVAL;
 824                         }
 825
 826                         msta = (struct mt7915_sta *)sta->drv_priv;
 827                         wlan_idx = msta->wcid.idx;
 828                         rcu_read_unlock();
 829                 }
 830                 break;
 831         case NL80211_IFTYPE_ADHOC:
 832                 type = NETWORK_IBSS;
 833                 break;
 834         default:
 835                 WARN_ON(1);
 836                 break;
 837         }
 838
 839         bss = (struct bss_info_basic *)tlv;
 840         bss->network_type = cpu_to_le32(type);
 841         bss->bmc_wcid_lo = to_wcid_lo(wlan_idx);
 842         bss->bmc_wcid_hi = to_wcid_hi(wlan_idx);
 843         bss->wmm_idx = mvif->wmm_idx;
 844         bss->active = enable;
 845
 846         if (vif->type != NL80211_IFTYPE_MONITOR) {
 847                 memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
 848                 bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
 849                 bss->dtim_period = vif->bss_conf.dtim_period;
 850                 bss->phy_mode = mt7915_get_phy_mode(vif, NULL);
 851         } else {
 852                 memcpy(bss->bssid, phy->mt76->macaddr, ETH_ALEN);
 853         }
 854
 855         return 0;
 856 }
 857
 858 static void
 859 mt7915_mcu_bss_omac_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
 860 {
 861         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 862         struct bss_info_omac *omac;
 863         struct tlv *tlv;
 864         u32 type = 0;
 865         u8 idx;
 866
 867         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
 868
 869         switch (vif->type) {
 870         case NL80211_IFTYPE_MONITOR:
 871         case NL80211_IFTYPE_MESH_POINT:
 872         case NL80211_IFTYPE_AP:
 873                 type = CONNECTION_INFRA_AP;
 874                 break;
 875         case NL80211_IFTYPE_STATION:
 876                 type = CONNECTION_INFRA_STA;
 877                 break;
 878         case NL80211_IFTYPE_ADHOC:
 879                 type = CONNECTION_IBSS_ADHOC;
 880                 break;
 881         default:
 882                 WARN_ON(1);
 883                 break;
 884         }
 885
 886         omac = (struct bss_info_omac *)tlv;
 887         idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
 888         omac->conn_type = cpu_to_le32(type);
 889         omac->omac_idx = mvif->omac_idx;
 890         omac->band_idx = mvif->band_idx;
 891         omac->hw_bss_idx = idx;
 892 }
 893
 894 struct mt7915_he_obss_narrow_bw_ru_data {
 895         bool tolerated;
 896 };
 897
 898 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
 899                                                    struct cfg80211_bss *bss,
 900                                                    void *_data)
 901 {
 902         struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
 903         const struct element *elem;
 904
 905         elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
 906
 907         if (!elem || elem->datalen < 10 ||
 908             !(elem->data[10] &
 909               WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
 910                 data->tolerated = false;
 911 }
 912
 913 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
 914                                               struct ieee80211_vif *vif)
 915 {
 916         struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
 917                 .tolerated = true,
 918         };
 919
 920         if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
 921                 return false;
 922
 923         cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
 924                           mt7915_check_he_obss_narrow_bw_ru_iter,
 925                           &iter_data);
 926
 927         /*
 928          * If there is at least one AP on radar channel that cannot
 929          * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
 930          */
 931         return !iter_data.tolerated;
 932 }
 933
 934 static void
 935 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 936                         struct mt7915_phy *phy)
 937 {
 938         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 939         struct bss_info_rf_ch *ch;
 940         struct tlv *tlv;
 941         int freq1 = chandef->center_freq1;
 942
 943         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
 944
 945         ch = (struct bss_info_rf_ch *)tlv;
 946         ch->pri_ch = chandef->chan->hw_value;
 947         ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
 948         ch->bw = mt7915_mcu_chan_bw(chandef);
 949
 950         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
 951                 int freq2 = chandef->center_freq2;
 952
 953                 ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
 954         }
 955
 956         if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
 957                 struct mt7915_dev *dev = phy->dev;
 958                 struct mt76_phy *mphy = &dev->mt76.phy;
 959                 bool ext_phy = phy != &dev->phy;
 960
 961                 if (ext_phy && dev->mt76.phy2)
 962                         mphy = dev->mt76.phy2;
 963
 964                 ch->he_ru26_block =
 965                         mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
 966                 ch->he_all_disable = false;
 967         } else {
 968                 ch->he_all_disable = true;
 969         }
 970 }
 971
 972 static void
 973 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 974                       struct mt7915_phy *phy)
 975 {
 976         int max_nss = hweight8(phy->mt76->chainmask);
 977         struct bss_info_ra *ra;
 978         struct tlv *tlv;
 979
 980         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
 981
 982         ra = (struct bss_info_ra *)tlv;
 983         ra->op_mode = vif->type == NL80211_IFTYPE_AP;
 984         ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
 985         ra->short_preamble = true;
 986         ra->tx_streams = max_nss;
 987         ra->rx_streams = max_nss;
 988         ra->algo = 4;
 989         ra->train_up_rule = 2;
 990         ra->train_up_high_thres = 110;
 991         ra->train_up_rule_rssi = -70;
 992         ra->low_traffic_thres = 2;
 993         ra->phy_cap = cpu_to_le32(0xfdf);
 994         ra->interval = cpu_to_le32(500);
 995         ra->fast_interval = cpu_to_le32(100);
 996 }
 997
 998 static void
 999 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1000                       struct mt7915_phy *phy)
1001 {
1002 #define DEFAULT_HE_PE_DURATION          4
1003 #define DEFAULT_HE_DURATION_RTS_THRES   1023
1004         const struct ieee80211_sta_he_cap *cap;
1005         struct bss_info_he *he;
1006         struct tlv *tlv;
1007
1008         cap = mt7915_get_he_phy_cap(phy, vif);
1009
1010         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
1011
1012         he = (struct bss_info_he *)tlv;
1013         he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
1014         if (!he->he_pe_duration)
1015                 he->he_pe_duration = DEFAULT_HE_PE_DURATION;
1016
1017         he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
1018         if (!he->he_rts_thres)
1019                 he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
1020
1021         he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
1022         he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
1023         he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
1024 }
1025
1026 static void
1027 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
1028 {
1029 #define TXD_CMP_MAP1            GENMASK(15, 0)
1030 #define TXD_CMP_MAP2            (GENMASK(31, 0) & ~BIT(23))
1031         struct bss_info_hw_amsdu *amsdu;
1032         struct tlv *tlv;
1033
1034         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
1035
1036         amsdu = (struct bss_info_hw_amsdu *)tlv;
1037         amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
1038         amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
1039         amsdu->trig_thres = cpu_to_le16(2);
1040         amsdu->enable = true;
1041 }
1042
1043 static void
1044 mt7915_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt7915_vif *mvif)
1045 {
1046 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
1047 #define BCN_TX_ESTIMATE_TIME    (4096 + 20)
1048         struct bss_info_ext_bss *ext;
1049         int ext_bss_idx, tsf_offset;
1050         struct tlv *tlv;
1051
1052         ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
1053         if (ext_bss_idx < 0)
1054                 return;
1055
1056         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
1057
1058         ext = (struct bss_info_ext_bss *)tlv;
1059         tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
1060         ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
1061 }
1062
1063 static void
1064 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
1065 {
1066         struct bss_info_bmc_rate *bmc;
1067         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
1068         enum nl80211_band band = chandef->chan->band;
1069         struct tlv *tlv;
1070
1071         tlv = mt7915_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
1072
1073         bmc = (struct bss_info_bmc_rate *)tlv;
1074         if (band == NL80211_BAND_2GHZ) {
1075                 bmc->short_preamble = true;
1076         } else {
1077                 bmc->bc_trans = cpu_to_le16(0x2000);
1078                 bmc->mc_trans = cpu_to_le16(0x2080);
1079         }
1080 }
1081
1082 static int
1083 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1084                        bool bssid, bool enable)
1085 {
1086         struct mt7915_dev *dev = phy->dev;
1087         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1088         u32 idx = mvif->omac_idx - REPEATER_BSSID_START;
1089         u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
1090         const u8 *addr = vif->addr;
1091         struct {
1092                 u8 mode;
1093                 u8 force_clear;
1094                 u8 clear_bitmap[8];
1095                 u8 entry_count;
1096                 u8 write;
1097                 u8 band;
1098
1099                 u8 index;
1100                 u8 bssid;
1101                 u8 addr[ETH_ALEN];
1102         } __packed req = {
1103                 .mode = !!mask || enable,
1104                 .entry_count = 1,
1105                 .write = 1,
1106                 .band = phy != &dev->phy,
1107                 .index = idx * 2 + bssid,
1108         };
1109
1110         if (bssid)
1111                 addr = vif->bss_conf.bssid;
1112
1113         if (enable)
1114                 ether_addr_copy(req.addr, addr);
1115
1116         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
1117                                  sizeof(req), true);
1118 }
1119
1120 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
1121                             struct ieee80211_vif *vif, int enable)
1122 {
1123         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1124         struct sk_buff *skb;
1125
1126         if (mvif->omac_idx >= REPEATER_BSSID_START) {
1127                 mt7915_mcu_muar_config(phy, vif, false, enable);
1128                 mt7915_mcu_muar_config(phy, vif, true, enable);
1129         }
1130
1131         skb = mt7915_mcu_alloc_sta_req(phy->dev, mvif, NULL,
1132                                        MT7915_BSS_UPDATE_MAX_SIZE);
1133         if (IS_ERR(skb))
1134                 return PTR_ERR(skb);
1135
1136         /* bss_omac must be first */
1137         if (enable)
1138                 mt7915_mcu_bss_omac_tlv(skb, vif);
1139
1140         mt7915_mcu_bss_basic_tlv(skb, vif, phy, enable);
1141
1142         if (vif->type == NL80211_IFTYPE_MONITOR)
1143                 goto out;
1144
1145         if (enable) {
1146                 mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
1147                 mt7915_mcu_bss_bmc_tlv(skb, phy);
1148                 mt7915_mcu_bss_ra_tlv(skb, vif, phy);
1149                 mt7915_mcu_bss_hw_amsdu_tlv(skb);
1150
1151                 if (vif->bss_conf.he_support)
1152                         mt7915_mcu_bss_he_tlv(skb, vif, phy);
1153
1154                 if (mvif->omac_idx >= EXT_BSSID_START &&
1155                     mvif->omac_idx < REPEATER_BSSID_START)
1156                         mt7915_mcu_bss_ext_tlv(skb, mvif);
1157         }
1158 out:
1159         return mt76_mcu_skb_send_msg(&phy->dev->mt76, skb,
1160                                      MCU_EXT_CMD(BSS_INFO_UPDATE), true);
1161 }
1162
1163 /** starec & wtbl **/
1164 static int
1165 mt7915_mcu_sta_key_tlv(struct mt7915_sta *msta, struct sk_buff *skb,
1166                        struct ieee80211_key_conf *key, enum set_key_cmd cmd)
1167 {
1168         struct mt7915_sta_key_conf *bip = &msta->bip;
1169         struct sta_rec_sec *sec;
1170         struct tlv *tlv;
1171         u32 len = sizeof(*sec);
1172
1173         tlv = mt7915_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
1174
1175         sec = (struct sta_rec_sec *)tlv;
1176         sec->add = cmd;
1177
1178         if (cmd == SET_KEY) {
1179                 struct sec_key *sec_key;
1180                 u8 cipher;
1181
1182                 cipher = mt7915_mcu_get_cipher(key->cipher);
1183                 if (cipher == MT_CIPHER_NONE)
1184                         return -EOPNOTSUPP;
1185
1186                 sec_key = &sec->key[0];
1187                 sec_key->cipher_len = sizeof(*sec_key);
1188
1189                 if (cipher == MT_CIPHER_BIP_CMAC_128) {
1190                         sec_key->cipher_id = MT_CIPHER_AES_CCMP;
1191                         sec_key->key_id = bip->keyidx;
1192                         sec_key->key_len = 16;
1193                         memcpy(sec_key->key, bip->key, 16);
1194
1195                         sec_key = &sec->key[1];
1196                         sec_key->cipher_id = MT_CIPHER_BIP_CMAC_128;
1197                         sec_key->cipher_len = sizeof(*sec_key);
1198                         sec_key->key_len = 16;
1199                         memcpy(sec_key->key, key->key, 16);
1200
1201                         sec->n_cipher = 2;
1202                 } else {
1203                         sec_key->cipher_id = cipher;
1204                         sec_key->key_id = key->keyidx;
1205                         sec_key->key_len = key->keylen;
1206                         memcpy(sec_key->key, key->key, key->keylen);
1207
1208                         if (cipher == MT_CIPHER_TKIP) {
1209                                 /* Rx/Tx MIC keys are swapped */
1210                                 memcpy(sec_key->key + 16, key->key + 24, 8);
1211                                 memcpy(sec_key->key + 24, key->key + 16, 8);
1212                         }
1213
1214                         /* store key_conf for BIP batch update */
1215                         if (cipher == MT_CIPHER_AES_CCMP) {
1216                                 memcpy(bip->key, key->key, key->keylen);
1217                                 bip->keyidx = key->keyidx;
1218                         }
1219
1220                         len -= sizeof(*sec_key);
1221                         sec->n_cipher = 1;
1222                 }
1223         } else {
1224                 len -= sizeof(sec->key);
1225                 sec->n_cipher = 0;
1226         }
1227         sec->len = cpu_to_le16(len);
1228
1229         return 0;
1230 }
1231
1232 int mt7915_mcu_add_key(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1233                        struct mt7915_sta *msta, struct ieee80211_key_conf *key,
1234                        enum set_key_cmd cmd)
1235 {
1236         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1237         struct sk_buff *skb;
1238         int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_sec);
1239         int ret;
1240
1241         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1242         if (IS_ERR(skb))
1243                 return PTR_ERR(skb);
1244
1245         ret = mt7915_mcu_sta_key_tlv(msta, skb, key, cmd);
1246         if (ret)
1247                 return ret;
1248
1249         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1250                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1251 }
1252
1253 static void
1254 mt7915_mcu_sta_ba_tlv(struct sk_buff *skb,
1255                       struct ieee80211_ampdu_params *params,
1256                       bool enable, bool tx)
1257 {
1258         struct sta_rec_ba *ba;
1259         struct tlv *tlv;
1260
1261         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
1262
1263         ba = (struct sta_rec_ba *)tlv;
1264         ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
1265         ba->winsize = cpu_to_le16(params->buf_size);
1266         ba->ssn = cpu_to_le16(params->ssn);
1267         ba->ba_en = enable << params->tid;
1268         ba->amsdu = params->amsdu;
1269         ba->tid = params->tid;
1270 }
1271
1272 static void
1273 mt7915_mcu_wtbl_ba_tlv(struct sk_buff *skb,
1274                        struct ieee80211_ampdu_params *params,
1275                        bool enable, bool tx, void *sta_wtbl,
1276                        void *wtbl_tlv)
1277 {
1278         struct wtbl_ba *ba;
1279         struct tlv *tlv;
1280
1281         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1282                                         wtbl_tlv, sta_wtbl);
1283
1284         ba = (struct wtbl_ba *)tlv;
1285         ba->tid = params->tid;
1286
1287         if (tx) {
1288                 ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1289                 ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1290                 ba->ba_en = enable;
1291         } else {
1292                 memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1293                 ba->ba_type = MT_BA_TYPE_RECIPIENT;
1294                 ba->rst_ba_tid = params->tid;
1295                 ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1296                 ba->rst_ba_sb = 1;
1297         }
1298
1299         if (enable && tx)
1300                 ba->ba_winsize = cpu_to_le16(params->buf_size);
1301 }
1302
1303 static int
1304 mt7915_mcu_sta_ba(struct mt7915_dev *dev,
1305                   struct ieee80211_ampdu_params *params,
1306                   bool enable, bool tx)
1307 {
1308         struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
1309         struct mt7915_vif *mvif = msta->vif;
1310         struct wtbl_req_hdr *wtbl_hdr;
1311         struct tlv *sta_wtbl;
1312         struct sk_buff *skb;
1313         int ret;
1314
1315         if (enable && tx && !params->amsdu)
1316                 msta->wcid.amsdu = false;
1317
1318         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1319                                        MT7915_STA_UPDATE_MAX_SIZE);
1320         if (IS_ERR(skb))
1321                 return PTR_ERR(skb);
1322
1323         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1324
1325         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1326                                              &skb);
1327         if (IS_ERR(wtbl_hdr))
1328                 return PTR_ERR(wtbl_hdr);
1329
1330         mt7915_mcu_wtbl_ba_tlv(skb, params, enable, tx, sta_wtbl, wtbl_hdr);
1331
1332         ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1333                                     MCU_EXT_CMD(STA_REC_UPDATE), true);
1334         if (ret)
1335                 return ret;
1336
1337         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1338                                        MT7915_STA_UPDATE_MAX_SIZE);
1339         if (IS_ERR(skb))
1340                 return PTR_ERR(skb);
1341
1342         mt7915_mcu_sta_ba_tlv(skb, params, enable, tx);
1343
1344         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1345                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1346 }
1347
1348 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
1349                          struct ieee80211_ampdu_params *params,
1350                          bool enable)
1351 {
1352         return mt7915_mcu_sta_ba(dev, params, enable, true);
1353 }
1354
1355 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
1356                          struct ieee80211_ampdu_params *params,
1357                          bool enable)
1358 {
1359         return mt7915_mcu_sta_ba(dev, params, enable, false);
1360 }
1361
1362 static void
1363 mt7915_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1364                             struct ieee80211_sta *sta, void *sta_wtbl,
1365                             void *wtbl_tlv)
1366 {
1367         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1368         struct wtbl_generic *generic;
1369         struct wtbl_rx *rx;
1370         struct tlv *tlv;
1371
1372         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_GENERIC, sizeof(*generic),
1373                                         wtbl_tlv, sta_wtbl);
1374
1375         generic = (struct wtbl_generic *)tlv;
1376
1377         if (sta) {
1378                 memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
1379                 generic->partial_aid = cpu_to_le16(sta->aid);
1380                 generic->muar_idx = mvif->omac_idx;
1381                 generic->qos = sta->wme;
1382         } else {
1383                 /* use BSSID in station mode */
1384                 if (vif->type == NL80211_IFTYPE_STATION)
1385                         memcpy(generic->peer_addr, vif->bss_conf.bssid,
1386                                ETH_ALEN);
1387                 else
1388                         eth_broadcast_addr(generic->peer_addr);
1389
1390                 generic->muar_idx = 0xe;
1391         }
1392
1393         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
1394                                         wtbl_tlv, sta_wtbl);
1395
1396         rx = (struct wtbl_rx *)tlv;
1397         rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
1398         rx->rca2 = 1;
1399         rx->rv = 1;
1400 }
1401
1402 static void
1403 mt7915_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1404                          struct ieee80211_sta *sta, bool enable)
1405 {
1406 #define EXTRA_INFO_VER          BIT(0)
1407 #define EXTRA_INFO_NEW          BIT(1)
1408         struct sta_rec_basic *basic;
1409         struct tlv *tlv;
1410
1411         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
1412
1413         basic = (struct sta_rec_basic *)tlv;
1414         basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
1415
1416         if (enable) {
1417                 basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
1418                 basic->conn_state = CONN_STATE_PORT_SECURE;
1419         } else {
1420                 basic->conn_state = CONN_STATE_DISCONNECT;
1421         }
1422
1423         if (!sta) {
1424                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
1425                 eth_broadcast_addr(basic->peer_addr);
1426                 return;
1427         }
1428
1429         switch (vif->type) {
1430         case NL80211_IFTYPE_MESH_POINT:
1431         case NL80211_IFTYPE_AP:
1432                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1433                 break;
1434         case NL80211_IFTYPE_STATION:
1435                 basic->conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1436                 break;
1437         case NL80211_IFTYPE_ADHOC:
1438                 basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1439                 break;
1440         default:
1441                 WARN_ON(1);
1442                 break;
1443         }
1444
1445         memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
1446         basic->aid = cpu_to_le16(sta->aid);
1447         basic->qos = sta->wme;
1448 }
1449
1450 static void
1451 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1452 {
1453         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1454         struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1455         struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1456         enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
1457         const u16 *mcs_mask = msta->vif->bitrate_mask.control[band].he_mcs;
1458         struct sta_rec_he *he;
1459         struct tlv *tlv;
1460         u32 cap = 0;
1461
1462         tlv = mt7915_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
1463
1464         he = (struct sta_rec_he *)tlv;
1465
1466         if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
1467                 cap |= STA_REC_HE_CAP_HTC;
1468
1469         if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
1470                 cap |= STA_REC_HE_CAP_BSR;
1471
1472         if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
1473                 cap |= STA_REC_HE_CAP_OM;
1474
1475         if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
1476                 cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
1477
1478         if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
1479                 cap |= STA_REC_HE_CAP_BQR;
1480
1481         if (elem->phy_cap_info[0] &
1482             (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
1483              IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
1484                 cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
1485
1486         if (elem->phy_cap_info[1] &
1487             IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD)
1488                 cap |= STA_REC_HE_CAP_LDPC;
1489
1490         if (elem->phy_cap_info[1] &
1491             IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
1492                 cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
1493
1494         if (elem->phy_cap_info[2] &
1495             IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
1496                 cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
1497
1498         if (elem->phy_cap_info[2] &
1499             IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
1500                 cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
1501
1502         if (elem->phy_cap_info[2] &
1503             IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
1504                 cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
1505
1506         if (elem->phy_cap_info[6] &
1507             IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
1508                 cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
1509
1510         if (elem->phy_cap_info[7] &
1511             IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
1512                 cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
1513
1514         if (elem->phy_cap_info[7] &
1515             IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
1516                 cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
1517
1518         if (elem->phy_cap_info[7] &
1519             IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
1520                 cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
1521
1522         if (elem->phy_cap_info[8] &
1523             IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
1524                 cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
1525
1526         if (elem->phy_cap_info[8] &
1527             IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
1528                 cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
1529
1530         if (elem->phy_cap_info[9] &
1531             IEEE80211_HE_PHY_CAP9_NON_TRIGGERED_CQI_FEEDBACK)
1532                 cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
1533
1534         if (elem->phy_cap_info[9] &
1535             IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
1536                 cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
1537
1538         if (elem->phy_cap_info[9] &
1539             IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
1540                 cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
1541
1542         he->he_cap = cpu_to_le32(cap);
1543
1544         switch (sta->bandwidth) {
1545         case IEEE80211_STA_RX_BW_160:
1546                 if (elem->phy_cap_info[0] &
1547                     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
1548                         mt7915_mcu_set_sta_he_mcs(sta,
1549                                                   &he->max_nss_mcs[CMD_HE_MCS_BW8080],
1550                                                   mcs_mask);
1551
1552                 mt7915_mcu_set_sta_he_mcs(sta,
1553                                           &he->max_nss_mcs[CMD_HE_MCS_BW160],
1554                                           mcs_mask);
1555                 fallthrough;
1556         default:
1557                 mt7915_mcu_set_sta_he_mcs(sta,
1558                                           &he->max_nss_mcs[CMD_HE_MCS_BW80],
1559                                           mcs_mask);
1560                 break;
1561         }
1562
1563         he->t_frame_dur =
1564                 HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1565         he->max_ampdu_exp =
1566                 HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
1567
1568         he->bw_set =
1569                 HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
1570         he->device_class =
1571                 HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
1572         he->punc_pream_rx =
1573                 HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1574
1575         he->dcm_tx_mode =
1576                 HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
1577         he->dcm_tx_max_nss =
1578                 HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
1579         he->dcm_rx_mode =
1580                 HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
1581         he->dcm_rx_max_nss =
1582                 HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
1583         he->dcm_rx_max_nss =
1584                 HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
1585
1586         he->pkt_ext = 2;
1587 }
1588
1589 static void
1590 mt7915_mcu_sta_uapsd_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1591                      struct ieee80211_vif *vif)
1592 {
1593         struct sta_rec_uapsd *uapsd;
1594         struct tlv *tlv;
1595
1596         if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
1597                 return;
1598
1599         tlv = mt7915_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
1600         uapsd = (struct sta_rec_uapsd *)tlv;
1601
1602         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
1603                 uapsd->dac_map |= BIT(3);
1604                 uapsd->tac_map |= BIT(3);
1605         }
1606         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
1607                 uapsd->dac_map |= BIT(2);
1608                 uapsd->tac_map |= BIT(2);
1609         }
1610         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
1611                 uapsd->dac_map |= BIT(1);
1612                 uapsd->tac_map |= BIT(1);
1613         }
1614         if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
1615                 uapsd->dac_map |= BIT(0);
1616                 uapsd->tac_map |= BIT(0);
1617         }
1618         uapsd->max_sp = sta->max_sp;
1619 }
1620
1621 static void
1622 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1623 {
1624         struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
1625         struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
1626         struct sta_rec_muru *muru;
1627         struct tlv *tlv;
1628
1629         tlv = mt7915_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
1630
1631         muru = (struct sta_rec_muru *)tlv;
1632         muru->cfg.ofdma_dl_en = true;
1633         muru->cfg.mimo_dl_en = true;
1634
1635         muru->ofdma_dl.punc_pream_rx =
1636                 HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1637         muru->ofdma_dl.he_20m_in_40m_2g =
1638                 HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
1639         muru->ofdma_dl.he_20m_in_160m =
1640                 HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1641         muru->ofdma_dl.he_80m_in_160m =
1642                 HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1643         muru->ofdma_dl.lt16_sigb = 0;
1644         muru->ofdma_dl.rx_su_comp_sigb = 0;
1645         muru->ofdma_dl.rx_su_non_comp_sigb = 0;
1646
1647         muru->ofdma_ul.t_frame_dur =
1648                 HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1649         muru->ofdma_ul.mu_cascading =
1650                 HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
1651         muru->ofdma_ul.uo_ra =
1652                 HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
1653         muru->ofdma_ul.he_2x996_tone = 0;
1654         muru->ofdma_ul.rx_t_frame_11ac = 0;
1655
1656         muru->mimo_dl.vht_mu_bfee =
1657                 !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1658         muru->mimo_dl.partial_bw_dl_mimo =
1659                 HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
1660
1661         muru->mimo_ul.full_ul_mimo =
1662                 HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
1663         muru->mimo_ul.partial_ul_mimo =
1664                 HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
1665 }
1666
1667 static int
1668 mt7915_mcu_add_mu(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1669                   struct ieee80211_sta *sta)
1670 {
1671         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1672         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1673         struct sk_buff *skb;
1674         int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_muru);
1675
1676         if (!sta->vht_cap.vht_supported && !sta->he_cap.has_he)
1677                 return 0;
1678
1679         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
1680         if (IS_ERR(skb))
1681                 return PTR_ERR(skb);
1682
1683         /* starec muru */
1684         mt7915_mcu_sta_muru_tlv(skb, sta);
1685
1686         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1687                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1688 }
1689
1690 static void
1691 mt7915_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1692 {
1693         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1694         struct sta_rec_amsdu *amsdu;
1695         struct tlv *tlv;
1696
1697         if (!sta->max_amsdu_len)
1698             return;
1699
1700         tlv = mt7915_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1701         amsdu = (struct sta_rec_amsdu *)tlv;
1702         amsdu->max_amsdu_num = 8;
1703         amsdu->amsdu_en = true;
1704         amsdu->max_mpdu_size = sta->max_amsdu_len >=
1705                                IEEE80211_MAX_MPDU_LEN_VHT_7991;
1706         msta->wcid.amsdu = true;
1707 }
1708
1709 static bool
1710 mt7915_hw_amsdu_supported(struct ieee80211_vif *vif)
1711 {
1712         switch (vif->type) {
1713         case NL80211_IFTYPE_AP:
1714         case NL80211_IFTYPE_STATION:
1715                 return true;
1716         default:
1717                 return false;
1718         }
1719 }
1720
1721 static void
1722 mt7915_mcu_sta_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1723                    struct ieee80211_sta *sta, struct ieee80211_vif *vif)
1724 {
1725         struct tlv *tlv;
1726
1727         /* starec ht */
1728         if (sta->ht_cap.ht_supported) {
1729                 struct sta_rec_ht *ht;
1730
1731                 tlv = mt7915_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1732                 ht = (struct sta_rec_ht *)tlv;
1733                 ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
1734
1735                 if (mt7915_hw_amsdu_supported(vif))
1736                         mt7915_mcu_sta_amsdu_tlv(skb, sta);
1737         }
1738
1739         /* starec vht */
1740         if (sta->vht_cap.vht_supported) {
1741                 struct sta_rec_vht *vht;
1742
1743                 tlv = mt7915_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1744                 vht = (struct sta_rec_vht *)tlv;
1745                 vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
1746                 vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
1747                 vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
1748         }
1749
1750         /* starec he */
1751         if (sta->he_cap.has_he)
1752                 mt7915_mcu_sta_he_tlv(skb, sta);
1753
1754         /* starec uapsd */
1755         mt7915_mcu_sta_uapsd_tlv(skb, sta, vif);
1756 }
1757
1758 static void
1759 mt7915_mcu_wtbl_smps_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1760                          void *sta_wtbl, void *wtbl_tlv)
1761 {
1762         struct wtbl_smps *smps;
1763         struct tlv *tlv;
1764
1765         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
1766                                         wtbl_tlv, sta_wtbl);
1767         smps = (struct wtbl_smps *)tlv;
1768
1769         if (sta->smps_mode == IEEE80211_SMPS_DYNAMIC)
1770                 smps->smps = true;
1771 }
1772
1773 static void
1774 mt7915_mcu_wtbl_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
1775                        void *sta_wtbl, void *wtbl_tlv)
1776 {
1777         struct wtbl_ht *ht = NULL;
1778         struct tlv *tlv;
1779
1780         /* wtbl ht */
1781         if (sta->ht_cap.ht_supported) {
1782                 tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
1783                                                 wtbl_tlv, sta_wtbl);
1784                 ht = (struct wtbl_ht *)tlv;
1785                 ht->ldpc = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
1786                 ht->af = sta->ht_cap.ampdu_factor;
1787                 ht->mm = sta->ht_cap.ampdu_density;
1788                 ht->ht = true;
1789         }
1790
1791         /* wtbl vht */
1792         if (sta->vht_cap.vht_supported) {
1793                 struct wtbl_vht *vht;
1794                 u8 af;
1795
1796                 tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_VHT, sizeof(*vht),
1797                                                 wtbl_tlv, sta_wtbl);
1798                 vht = (struct wtbl_vht *)tlv;
1799                 vht->ldpc = !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
1800                 vht->vht = true;
1801
1802                 af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1803                                sta->vht_cap.cap);
1804                 if (ht)
1805                         ht->af = max_t(u8, ht->af, af);
1806         }
1807
1808         mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_tlv);
1809 }
1810
1811 static void
1812 mt7915_mcu_wtbl_hdr_trans_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
1813                               struct ieee80211_sta *sta,
1814                               void *sta_wtbl, void *wtbl_tlv)
1815 {
1816         struct mt7915_sta *msta;
1817         struct wtbl_hdr_trans *htr = NULL;
1818         struct tlv *tlv;
1819
1820         tlv = mt7915_mcu_add_nested_tlv(skb, WTBL_HDR_TRANS, sizeof(*htr),
1821                                         wtbl_tlv, sta_wtbl);
1822         htr = (struct wtbl_hdr_trans *)tlv;
1823         htr->no_rx_trans = true;
1824         if (vif->type == NL80211_IFTYPE_STATION)
1825                 htr->to_ds = true;
1826         else
1827                 htr->from_ds = true;
1828
1829         if (!sta)
1830                 return;
1831
1832         msta = (struct mt7915_sta *)sta->drv_priv;
1833         htr->no_rx_trans = !test_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
1834         if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags)) {
1835                 htr->to_ds = true;
1836                 htr->from_ds = true;
1837         }
1838 }
1839
1840 int mt7915_mcu_sta_update_hdr_trans(struct mt7915_dev *dev,
1841                                     struct ieee80211_vif *vif,
1842                                     struct ieee80211_sta *sta)
1843 {
1844         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1845         struct wtbl_req_hdr *wtbl_hdr;
1846         struct sk_buff *skb;
1847
1848         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, MT7915_WTBL_UPDATE_MAX_SIZE);
1849         if (!skb)
1850                 return -ENOMEM;
1851
1852         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, NULL, &skb);
1853         if (IS_ERR(wtbl_hdr))
1854                 return PTR_ERR(wtbl_hdr);
1855
1856         mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, NULL, wtbl_hdr);
1857
1858         return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD(WTBL_UPDATE),
1859                                      true);
1860 }
1861
1862 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1863                         struct ieee80211_sta *sta)
1864 {
1865         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1866         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1867         struct wtbl_req_hdr *wtbl_hdr;
1868         struct tlv *sta_wtbl;
1869         struct sk_buff *skb;
1870
1871         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
1872                                        MT7915_STA_UPDATE_MAX_SIZE);
1873         if (IS_ERR(skb))
1874                 return PTR_ERR(skb);
1875
1876         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1877
1878         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_SET, sta_wtbl,
1879                                              &skb);
1880         if (IS_ERR(wtbl_hdr))
1881                 return PTR_ERR(wtbl_hdr);
1882
1883         mt7915_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1884
1885         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1886                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1887 }
1888
1889 static void
1890 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1891 {
1892         bf->bf_cap = MT_EBF;
1893         bf->sounding_phy = MT_PHY_TYPE_OFDM;
1894         bf->ndp_rate = 0;                               /* mcs0 */
1895         bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;      /* ofdm 24m */
1896         bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT; /* ofdm 24m */
1897 }
1898
1899 static void
1900 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1901                        struct sta_rec_bf *bf)
1902 {
1903         struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
1904         u8 n = 0;
1905
1906         bf->tx_mode = MT_PHY_TYPE_HT;
1907         bf->bf_cap = MT_IBF;
1908
1909         if (mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF &&
1910             (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1911                 n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1912                               mcs->tx_params);
1913         else if (mcs->rx_mask[3])
1914                 n = 3;
1915         else if (mcs->rx_mask[2])
1916                 n = 2;
1917         else if (mcs->rx_mask[1])
1918                 n = 1;
1919
1920         bf->nr = hweight8(phy->mt76->chainmask) - 1;
1921         bf->nc = min_t(u8, bf->nr, n);
1922         bf->ibf_ncol = n;
1923 }
1924
1925 static void
1926 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1927                         struct sta_rec_bf *bf, bool explicit)
1928 {
1929         struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
1930         struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1931         u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1932         u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1933         u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1934
1935         bf->tx_mode = MT_PHY_TYPE_VHT;
1936
1937         if (explicit) {
1938                 u8 bfee_nr, bfer_nr;
1939
1940                 mt7915_mcu_sta_sounding_rate(bf);
1941                 bfee_nr = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1942                                     pc->cap);
1943                 bfer_nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1944                                     vc->cap);
1945                 bf->nr = min_t(u8, min_t(u8, bfer_nr, bfee_nr), tx_ant);
1946                 bf->nc = min_t(u8, nss_mcs, bf->nr);
1947                 bf->ibf_ncol = bf->nc;
1948
1949                 if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1950                         bf->nr = 1;
1951         } else {
1952                 bf->bf_cap = MT_IBF;
1953                 bf->nr = tx_ant;
1954                 bf->nc = min_t(u8, nss_mcs, bf->nr);
1955                 bf->ibf_ncol = nss_mcs;
1956
1957                 if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
1958                         bf->ibf_nrow = 1;
1959         }
1960 }
1961
1962 static void
1963 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1964                        struct mt7915_phy *phy, struct sta_rec_bf *bf)
1965 {
1966         struct ieee80211_sta_he_cap *pc = &sta->he_cap;
1967         struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1968         const struct ieee80211_sta_he_cap *vc = mt7915_get_he_phy_cap(phy, vif);
1969         const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1970         u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1971         u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1972         u8 bfee_nr, bfer_nr;
1973
1974         bf->tx_mode = MT_PHY_TYPE_HE_SU;
1975         mt7915_mcu_sta_sounding_rate(bf);
1976         bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1977                                 pe->phy_cap_info[6]);
1978         bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1979                                 pe->phy_cap_info[6]);
1980         bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1981                          ve->phy_cap_info[5]);
1982         bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1983                          pe->phy_cap_info[4]);
1984         bf->nr = min_t(u8, bfer_nr, bfee_nr);
1985         bf->nc = min_t(u8, nss_mcs, bf->nr);
1986         bf->ibf_ncol = bf->nc;
1987
1988         if (sta->bandwidth != IEEE80211_STA_RX_BW_160)
1989                 return;
1990
1991         /* go over for 160MHz and 80p80 */
1992         if (pe->phy_cap_info[0] &
1993             IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1994                 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1995                 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1996
1997                 bf->nc_bw160 = nss_mcs;
1998         }
1999
2000         if (pe->phy_cap_info[0] &
2001             IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
2002                 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
2003                 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
2004
2005                 if (bf->nc_bw160)
2006                         bf->nc_bw160 = min_t(u8, bf->nc_bw160, nss_mcs);
2007                 else
2008                         bf->nc_bw160 = nss_mcs;
2009         }
2010
2011         bfer_nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
2012                          ve->phy_cap_info[5]);
2013         bfee_nr = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
2014                          pe->phy_cap_info[4]);
2015
2016         bf->nr_bw160 = min_t(int, bfer_nr, bfee_nr);
2017 }
2018
2019 static void
2020 mt7915_mcu_sta_bfer_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
2021                         struct ieee80211_vif *vif, struct mt7915_phy *phy,
2022                         bool enable, bool explicit)
2023 {
2024         int tx_ant = hweight8(phy->mt76->chainmask) - 1;
2025         struct sta_rec_bf *bf;
2026         struct tlv *tlv;
2027         const u8 matrix[4][4] = {
2028                 {0, 0, 0, 0},
2029                 {1, 1, 0, 0},   /* 2x1, 2x2, 2x3, 2x4 */
2030                 {2, 4, 4, 0},   /* 3x1, 3x2, 3x3, 3x4 */
2031                 {3, 5, 6, 0}    /* 4x1, 4x2, 4x3, 4x4 */
2032         };
2033
2034 #define MT_BFER_FREE            cpu_to_le16(GENMASK(15, 0))
2035
2036         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
2037         bf = (struct sta_rec_bf *)tlv;
2038
2039         if (!enable) {
2040                 bf->pfmu = MT_BFER_FREE;
2041                 return;
2042         }
2043
2044         /* he: eBF only, in accordance with spec
2045          * vht: support eBF and iBF
2046          * ht: iBF only, since mac80211 lacks of eBF support
2047          */
2048         if (sta->he_cap.has_he && explicit)
2049                 mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
2050         else if (sta->vht_cap.vht_supported)
2051                 mt7915_mcu_sta_bfer_vht(sta, phy, bf, explicit);
2052         else if (sta->ht_cap.ht_supported)
2053                 mt7915_mcu_sta_bfer_ht(sta, phy, bf);
2054         else
2055                 return;
2056
2057         bf->bw = sta->bandwidth;
2058         bf->ibf_dbw = sta->bandwidth;
2059         bf->ibf_nrow = tx_ant;
2060
2061         if (!explicit && sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->nc)
2062                 bf->ibf_timeout = 0x48;
2063         else
2064                 bf->ibf_timeout = 0x18;
2065
2066         if (explicit && bf->nr != tx_ant)
2067                 bf->mem_20m = matrix[tx_ant][bf->nc];
2068         else
2069                 bf->mem_20m = matrix[bf->nr][bf->nc];
2070
2071         switch (sta->bandwidth) {
2072         case IEEE80211_STA_RX_BW_160:
2073         case IEEE80211_STA_RX_BW_80:
2074                 bf->mem_total = bf->mem_20m * 2;
2075                 break;
2076         case IEEE80211_STA_RX_BW_40:
2077                 bf->mem_total = bf->mem_20m;
2078                 break;
2079         case IEEE80211_STA_RX_BW_20:
2080         default:
2081                 break;
2082         }
2083 }
2084
2085 static void
2086 mt7915_mcu_sta_bfee_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
2087                         struct mt7915_phy *phy)
2088 {
2089         int tx_ant = hweight8(phy->mt76->chainmask) - 1;
2090         struct sta_rec_bfee *bfee;
2091         struct tlv *tlv;
2092         u8 nr = 0;
2093
2094         tlv = mt7915_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
2095         bfee = (struct sta_rec_bfee *)tlv;
2096
2097         if (sta->he_cap.has_he) {
2098                 struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
2099
2100                 nr = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
2101                             pe->phy_cap_info[5]);
2102         } else if (sta->vht_cap.vht_supported) {
2103                 struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
2104
2105                 nr = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
2106                                pc->cap);
2107         }
2108
2109         /* reply with identity matrix to avoid 2x2 BF negative gain */
2110         bfee->fb_identity_matrix = !!(nr == 1 && tx_ant == 2);
2111 }
2112
2113 static int
2114 mt7915_mcu_add_txbf(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2115                     struct ieee80211_sta *sta, bool enable)
2116 {
2117         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2118         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2119         struct mt7915_phy *phy;
2120         struct sk_buff *skb;
2121         int r, len;
2122         bool ebfee = 0, ebf = 0;
2123
2124         if (vif->type != NL80211_IFTYPE_STATION &&
2125             vif->type != NL80211_IFTYPE_AP)
2126                 return 0;
2127
2128         phy = mvif->band_idx ? mt7915_ext_phy(dev) : &dev->phy;
2129
2130         if (sta->he_cap.has_he) {
2131                 struct ieee80211_he_cap_elem *pe;
2132                 const struct ieee80211_he_cap_elem *ve;
2133                 const struct ieee80211_sta_he_cap *vc;
2134
2135                 pe = &sta->he_cap.he_cap_elem;
2136                 vc = mt7915_get_he_phy_cap(phy, vif);
2137                 ve = &vc->he_cap_elem;
2138
2139                 ebfee = !!((HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]) ||
2140                             HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4])) &&
2141                            HE_PHY(CAP4_SU_BEAMFORMEE, ve->phy_cap_info[4]));
2142                 ebf = !!((HE_PHY(CAP3_SU_BEAMFORMER, ve->phy_cap_info[3]) ||
2143                           HE_PHY(CAP4_MU_BEAMFORMER, ve->phy_cap_info[4])) &&
2144                          HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]));
2145         } else if (sta->vht_cap.vht_supported) {
2146                 struct ieee80211_sta_vht_cap *pc;
2147                 struct ieee80211_sta_vht_cap *vc;
2148                 u32 cr, ce;
2149
2150                 pc = &sta->vht_cap;
2151                 vc = &phy->mt76->sband_5g.sband.vht_cap;
2152                 cr = IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
2153                      IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
2154                 ce = IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
2155                      IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
2156
2157                 ebfee = !!((pc->cap & cr) && (vc->cap & ce));
2158                 ebf = !!((vc->cap & cr) && (pc->cap & ce));
2159         }
2160
2161         /* must keep each tag independent */
2162
2163         /* starec bf */
2164         if (ebf || dev->ibf) {
2165                 len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bf);
2166
2167                 skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2168                 if (IS_ERR(skb))
2169                         return PTR_ERR(skb);
2170
2171                 mt7915_mcu_sta_bfer_tlv(skb, sta, vif, phy, enable, ebf);
2172
2173                 r = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2174                                           MCU_EXT_CMD(STA_REC_UPDATE), true);
2175                 if (r)
2176                         return r;
2177         }
2178
2179         /* starec bfee */
2180         if (ebfee) {
2181                 len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_bfee);
2182
2183                 skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2184                 if (IS_ERR(skb))
2185                         return PTR_ERR(skb);
2186
2187                 mt7915_mcu_sta_bfee_tlv(skb, sta, phy);
2188
2189                 r = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2190                                           MCU_EXT_CMD(STA_REC_UPDATE), true);
2191                 if (r)
2192                         return r;
2193         }
2194
2195         return 0;
2196 }
2197
2198 static void
2199 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
2200                              struct ieee80211_vif *vif, struct ieee80211_sta *sta)
2201 {
2202         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2203         struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
2204         struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
2205         enum nl80211_band band = chandef->chan->band;
2206         struct sta_rec_ra *ra;
2207         struct tlv *tlv;
2208         u32 supp_rate = sta->supp_rates[band];
2209         u32 cap = sta->wme ? STA_CAP_WMM : 0;
2210
2211         tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
2212         ra = (struct sta_rec_ra *)tlv;
2213
2214         ra->valid = true;
2215         ra->auto_rate = true;
2216         ra->phy_mode = mt7915_get_phy_mode(vif, sta);
2217         ra->channel = chandef->chan->hw_value;
2218         ra->bw = sta->bandwidth;
2219         ra->phy.bw = sta->bandwidth;
2220
2221         if (supp_rate) {
2222                 supp_rate &= mask->control[band].legacy;
2223                 ra->rate_len = hweight32(supp_rate);
2224
2225                 if (band == NL80211_BAND_2GHZ) {
2226                         ra->supp_mode = MODE_CCK;
2227                         ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
2228
2229                         if (ra->rate_len > 4) {
2230                                 ra->supp_mode |= MODE_OFDM;
2231                                 ra->supp_ofdm_rate = supp_rate >> 4;
2232                         }
2233                 } else {
2234                         ra->supp_mode = MODE_OFDM;
2235                         ra->supp_ofdm_rate = supp_rate;
2236                 }
2237         }
2238
2239         if (sta->ht_cap.ht_supported) {
2240                 const u8 *mcs_mask = mask->control[band].ht_mcs;
2241
2242                 ra->supp_mode |= MODE_HT;
2243                 ra->af = sta->ht_cap.ampdu_factor;
2244                 ra->ht_gf = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
2245
2246                 cap |= STA_CAP_HT;
2247                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
2248                         cap |= STA_CAP_SGI_20;
2249                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
2250                         cap |= STA_CAP_SGI_40;
2251                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
2252                         cap |= STA_CAP_TX_STBC;
2253                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
2254                         cap |= STA_CAP_RX_STBC;
2255                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING)
2256                         cap |= STA_CAP_LDPC;
2257
2258                 mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs, mcs_mask);
2259                 ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
2260         }
2261
2262         if (sta->vht_cap.vht_supported) {
2263                 const u16 *mcs_mask = mask->control[band].vht_mcs;
2264                 u8 af;
2265
2266                 ra->supp_mode |= MODE_VHT;
2267                 af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
2268                                sta->vht_cap.cap);
2269                 ra->af = max_t(u8, ra->af, af);
2270
2271                 cap |= STA_CAP_VHT;
2272                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
2273                         cap |= STA_CAP_VHT_SGI_80;
2274                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
2275                         cap |= STA_CAP_VHT_SGI_160;
2276                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
2277                         cap |= STA_CAP_VHT_TX_STBC;
2278                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
2279                         cap |= STA_CAP_VHT_RX_STBC;
2280                 if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC)
2281                         cap |= STA_CAP_VHT_LDPC;
2282
2283                 mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs, mcs_mask);
2284         }
2285
2286         if (sta->he_cap.has_he) {
2287                 ra->supp_mode |= MODE_HE;
2288                 cap |= STA_CAP_HE;
2289         }
2290
2291         ra->sta_cap = cpu_to_le32(cap);
2292 }
2293
2294 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2295                              struct ieee80211_sta *sta)
2296 {
2297         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2298         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2299         struct sk_buff *skb;
2300         int len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_ra);
2301
2302         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2303         if (IS_ERR(skb))
2304                 return PTR_ERR(skb);
2305
2306         mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
2307
2308         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2309                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
2310 }
2311
2312 int mt7915_mcu_add_he(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2313                       struct ieee80211_sta *sta)
2314 {
2315         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2316         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2317         struct sk_buff *skb;
2318         int len;
2319
2320         if (!sta->he_cap.has_he)
2321                 return 0;
2322
2323         len = sizeof(struct sta_req_hdr) + sizeof(struct sta_rec_he);
2324
2325         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2326         if (IS_ERR(skb))
2327                 return PTR_ERR(skb);
2328
2329         mt7915_mcu_sta_he_tlv(skb, sta);
2330
2331         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2332                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
2333 }
2334
2335 int mt7915_mcu_add_sta_adv(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2336                            struct ieee80211_sta *sta, bool enable)
2337 {
2338         int ret;
2339
2340         if (!sta)
2341                 return 0;
2342
2343         /* must keep the order */
2344         ret = mt7915_mcu_add_txbf(dev, vif, sta, enable);
2345         if (ret)
2346                 return ret;
2347
2348         ret = mt7915_mcu_add_mu(dev, vif, sta);
2349         if (ret)
2350                 return ret;
2351
2352         if (enable)
2353                 return mt7915_mcu_add_rate_ctrl(dev, vif, sta);
2354
2355         return 0;
2356 }
2357
2358 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
2359                        struct ieee80211_sta *sta, bool enable)
2360 {
2361         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2362         struct wtbl_req_hdr *wtbl_hdr;
2363         struct mt7915_sta *msta;
2364         struct tlv *sta_wtbl;
2365         struct sk_buff *skb;
2366
2367         msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
2368
2369         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta,
2370                                        MT7915_STA_UPDATE_MAX_SIZE);
2371         if (IS_ERR(skb))
2372                 return PTR_ERR(skb);
2373
2374         mt7915_mcu_sta_basic_tlv(skb, vif, sta, enable);
2375         if (enable && sta)
2376                 mt7915_mcu_sta_tlv(dev, skb, sta, vif);
2377
2378         sta_wtbl = mt7915_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
2379
2380         wtbl_hdr = mt7915_mcu_alloc_wtbl_req(dev, msta, WTBL_RESET_AND_SET,
2381                                              sta_wtbl, &skb);
2382         if (IS_ERR(wtbl_hdr))
2383                 return PTR_ERR(wtbl_hdr);
2384
2385         if (enable) {
2386                 mt7915_mcu_wtbl_generic_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2387                 mt7915_mcu_wtbl_hdr_trans_tlv(skb, vif, sta, sta_wtbl, wtbl_hdr);
2388                 if (sta)
2389                         mt7915_mcu_wtbl_ht_tlv(skb, sta, sta_wtbl, wtbl_hdr);
2390         }
2391
2392         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2393                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
2394 }
2395
2396 int mt7915_mcu_set_fixed_rate(struct mt7915_dev *dev,
2397                               struct ieee80211_sta *sta, u32 rate)
2398 {
2399         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
2400         struct mt7915_vif *mvif = msta->vif;
2401         struct sta_rec_ra_fixed *ra;
2402         struct sk_buff *skb;
2403         struct tlv *tlv;
2404         int len = sizeof(struct sta_req_hdr) + sizeof(*ra);
2405
2406         skb = mt7915_mcu_alloc_sta_req(dev, mvif, msta, len);
2407         if (IS_ERR(skb))
2408                 return PTR_ERR(skb);
2409
2410         tlv = mt7915_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
2411         ra = (struct sta_rec_ra_fixed *)tlv;
2412
2413         if (!rate) {
2414                 ra->field = cpu_to_le32(RATE_PARAM_AUTO);
2415                 goto out;
2416         } else {
2417                 ra->field = cpu_to_le32(RATE_PARAM_FIXED);
2418         }
2419
2420         ra->phy.type = FIELD_GET(RATE_CFG_PHY_TYPE, rate);
2421         ra->phy.bw = FIELD_GET(RATE_CFG_BW, rate);
2422         ra->phy.nss = FIELD_GET(RATE_CFG_NSS, rate);
2423         ra->phy.mcs = FIELD_GET(RATE_CFG_MCS, rate);
2424         ra->phy.stbc = FIELD_GET(RATE_CFG_STBC, rate);
2425
2426         if (ra->phy.bw)
2427                 ra->phy.ldpc = 7;
2428         else
2429                 ra->phy.ldpc = FIELD_GET(RATE_CFG_LDPC, rate) * 7;
2430
2431         /* HT/VHT - SGI: 1, LGI: 0; HE - SGI: 0, MGI: 1, LGI: 2 */
2432         if (ra->phy.type > MT_PHY_TYPE_VHT)
2433                 ra->phy.sgi = ra->phy.mcs * 85;
2434         else
2435                 ra->phy.sgi = ra->phy.mcs * 15;
2436
2437 out:
2438         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2439                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
2440 }
2441
2442 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
2443                             struct ieee80211_vif *vif, bool enable)
2444 {
2445         struct mt7915_dev *dev = phy->dev;
2446         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2447         struct {
2448                 struct req_hdr {
2449                         u8 omac_idx;
2450                         u8 dbdc_idx;
2451                         __le16 tlv_num;
2452                         u8 is_tlv_append;
2453                         u8 rsv[3];
2454                 } __packed hdr;
2455                 struct req_tlv {
2456                         __le16 tag;
2457                         __le16 len;
2458                         u8 active;
2459                         u8 dbdc_idx;
2460                         u8 omac_addr[ETH_ALEN];
2461                 } __packed tlv;
2462         } data = {
2463                 .hdr = {
2464                         .omac_idx = mvif->omac_idx,
2465                         .dbdc_idx = mvif->band_idx,
2466                         .tlv_num = cpu_to_le16(1),
2467                         .is_tlv_append = 1,
2468                 },
2469                 .tlv = {
2470                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
2471                         .len = cpu_to_le16(sizeof(struct req_tlv)),
2472                         .active = enable,
2473                         .dbdc_idx = mvif->band_idx,
2474                 },
2475         };
2476
2477         if (mvif->omac_idx >= REPEATER_BSSID_START)
2478                 return mt7915_mcu_muar_config(phy, vif, false, enable);
2479
2480         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
2481         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
2482                                  &data, sizeof(data), true);
2483 }
2484
2485 static void
2486 mt7915_mcu_beacon_csa(struct sk_buff *rskb, struct sk_buff *skb,
2487                       struct bss_info_bcn *bcn,
2488                       struct ieee80211_mutable_offsets *offs)
2489 {
2490         if (offs->cntdwn_counter_offs[0]) {
2491                 struct tlv *tlv;
2492                 struct bss_info_bcn_csa *csa;
2493
2494                 tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CSA,
2495                                                    sizeof(*csa), &bcn->sub_ntlv,
2496                                                    &bcn->len);
2497                 csa = (struct bss_info_bcn_csa *)tlv;
2498                 csa->cnt = skb->data[offs->cntdwn_counter_offs[0]];
2499         }
2500 }
2501
2502 static void
2503 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct sk_buff *rskb,
2504                        struct sk_buff *skb, struct bss_info_bcn *bcn,
2505                        struct ieee80211_mutable_offsets *offs)
2506 {
2507         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
2508         struct bss_info_bcn_cont *cont;
2509         struct tlv *tlv;
2510         u8 *buf;
2511         int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
2512
2513         tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
2514                                            len, &bcn->sub_ntlv, &bcn->len);
2515
2516         cont = (struct bss_info_bcn_cont *)tlv;
2517         cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2518         cont->tim_ofs = cpu_to_le16(offs->tim_offset);
2519
2520         if (offs->cntdwn_counter_offs[0])
2521                 cont->csa_ofs = cpu_to_le16(offs->cntdwn_counter_offs[0] - 4);
2522
2523         buf = (u8 *)tlv + sizeof(*cont);
2524         mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
2525                               true);
2526         memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2527 }
2528
2529 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
2530                           struct ieee80211_vif *vif, int en)
2531 {
2532 #define MAX_BEACON_SIZE 512
2533         struct mt7915_dev *dev = mt7915_hw_dev(hw);
2534         struct mt7915_phy *phy = mt7915_hw_phy(hw);
2535         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2536         struct ieee80211_mutable_offsets offs;
2537         struct ieee80211_tx_info *info;
2538         struct sk_buff *skb, *rskb;
2539         struct tlv *tlv;
2540         struct bss_info_bcn *bcn;
2541         int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
2542
2543         rskb = mt7915_mcu_alloc_sta_req(dev, mvif, NULL, len);
2544         if (IS_ERR(rskb))
2545                 return PTR_ERR(rskb);
2546
2547         tlv = mt7915_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2548         bcn = (struct bss_info_bcn *)tlv;
2549         bcn->enable = en;
2550
2551         if (!en)
2552                 goto out;
2553
2554         skb = ieee80211_beacon_get_template(hw, vif, &offs);
2555         if (!skb)
2556                 return -EINVAL;
2557
2558         if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
2559                 dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2560                 dev_kfree_skb(skb);
2561                 return -EINVAL;
2562         }
2563
2564         if (mvif->band_idx) {
2565                 info = IEEE80211_SKB_CB(skb);
2566                 info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2567         }
2568
2569         /* TODO: subtag - bss color count & 11v MBSSID */
2570         mt7915_mcu_beacon_csa(rskb, skb, bcn, &offs);
2571         mt7915_mcu_beacon_cont(dev, rskb, skb, bcn, &offs);
2572         dev_kfree_skb(skb);
2573
2574 out:
2575         return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2576                                      MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2577 }
2578
2579 static int mt7915_mcu_start_firmware(struct mt7915_dev *dev, u32 addr,
2580                                      u32 option)
2581 {
2582         struct {
2583                 __le32 option;
2584                 __le32 addr;
2585         } req = {
2586                 .option = cpu_to_le32(option),
2587                 .addr = cpu_to_le32(addr),
2588         };
2589
2590         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(FW_START_REQ), &req,
2591                                  sizeof(req), true);
2592 }
2593
2594 static int mt7915_mcu_restart(struct mt76_dev *dev)
2595 {
2596         struct {
2597                 u8 power_mode;
2598                 u8 rsv[3];
2599         } req = {
2600                 .power_mode = 1,
2601         };
2602
2603         return mt76_mcu_send_msg(dev, MCU_CMD(NIC_POWER_CTRL), &req,
2604                                  sizeof(req), false);
2605 }
2606
2607 static int mt7915_mcu_patch_sem_ctrl(struct mt7915_dev *dev, bool get)
2608 {
2609         struct {
2610                 __le32 op;
2611         } req = {
2612                 .op = cpu_to_le32(get ? PATCH_SEM_GET : PATCH_SEM_RELEASE),
2613         };
2614
2615         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(PATCH_SEM_CONTROL), &req,
2616                                  sizeof(req), true);
2617 }
2618
2619 static int mt7915_mcu_start_patch(struct mt7915_dev *dev)
2620 {
2621         struct {
2622                 u8 check_crc;
2623                 u8 reserved[3];
2624         } req = {
2625                 .check_crc = 0,
2626         };
2627
2628         return mt76_mcu_send_msg(&dev->mt76, MCU_CMD(PATCH_FINISH_REQ), &req,
2629                                  sizeof(req), true);
2630 }
2631
2632 static int mt7915_driver_own(struct mt7915_dev *dev)
2633 {
2634         mt76_wr(dev, MT_TOP_LPCR_HOST_BAND0, MT_TOP_LPCR_HOST_DRV_OWN);
2635         if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND0,
2636                             MT_TOP_LPCR_HOST_FW_OWN, 0, 500)) {
2637                 dev_err(dev->mt76.dev, "Timeout for driver own\n");
2638                 return -EIO;
2639         }
2640
2641         return 0;
2642 }
2643
2644 static int mt7915_mcu_init_download(struct mt7915_dev *dev, u32 addr,
2645                                     u32 len, u32 mode)
2646 {
2647         struct {
2648                 __le32 addr;
2649                 __le32 len;
2650                 __le32 mode;
2651         } req = {
2652                 .addr = cpu_to_le32(addr),
2653                 .len = cpu_to_le32(len),
2654                 .mode = cpu_to_le32(mode),
2655         };
2656         int attr;
2657
2658         if (req.addr == cpu_to_le32(MCU_PATCH_ADDRESS))
2659                 attr = MCU_CMD(PATCH_START_REQ);
2660         else
2661                 attr = MCU_CMD(TARGET_ADDRESS_LEN_REQ);
2662
2663         return mt76_mcu_send_msg(&dev->mt76, attr, &req, sizeof(req), true);
2664 }
2665
2666 static int mt7915_load_patch(struct mt7915_dev *dev)
2667 {
2668         const struct mt7915_patch_hdr *hdr;
2669         const struct firmware *fw = NULL;
2670         int i, ret, sem;
2671
2672         sem = mt7915_mcu_patch_sem_ctrl(dev, 1);
2673         switch (sem) {
2674         case PATCH_IS_DL:
2675                 return 0;
2676         case PATCH_NOT_DL_SEM_SUCCESS:
2677                 break;
2678         default:
2679                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2680                 return -EAGAIN;
2681         }
2682
2683         ret = request_firmware(&fw, MT7915_ROM_PATCH, dev->mt76.dev);
2684         if (ret)
2685                 goto out;
2686
2687         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2688                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2689                 ret = -EINVAL;
2690                 goto out;
2691         }
2692
2693         hdr = (const struct mt7915_patch_hdr *)(fw->data);
2694
2695         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2696                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2697
2698         for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2699                 struct mt7915_patch_sec *sec;
2700                 const u8 *dl;
2701                 u32 len, addr;
2702
2703                 sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2704                                                   i * sizeof(*sec));
2705                 if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2706                     PATCH_SEC_TYPE_INFO) {
2707                         ret = -EINVAL;
2708                         goto out;
2709                 }
2710
2711                 addr = be32_to_cpu(sec->info.addr);
2712                 len = be32_to_cpu(sec->info.len);
2713                 dl = fw->data + be32_to_cpu(sec->offs);
2714
2715                 ret = mt7915_mcu_init_download(dev, addr, len,
2716                                                DL_MODE_NEED_RSP);
2717                 if (ret) {
2718                         dev_err(dev->mt76.dev, "Download request failed\n");
2719                         goto out;
2720                 }
2721
2722                 ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2723                                              dl, len);
2724                 if (ret) {
2725                         dev_err(dev->mt76.dev, "Failed to send patch\n");
2726                         goto out;
2727                 }
2728         }
2729
2730         ret = mt7915_mcu_start_patch(dev);
2731         if (ret)
2732                 dev_err(dev->mt76.dev, "Failed to start patch\n");
2733
2734 out:
2735         sem = mt7915_mcu_patch_sem_ctrl(dev, 0);
2736         switch (sem) {
2737         case PATCH_REL_SEM_SUCCESS:
2738                 break;
2739         default:
2740                 ret = -EAGAIN;
2741                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2742                 goto out;
2743         }
2744         release_firmware(fw);
2745
2746         return ret;
2747 }
2748
2749 static u32 mt7915_mcu_gen_dl_mode(u8 feature_set, bool is_wa)
2750 {
2751         u32 ret = 0;
2752
2753         ret |= (feature_set & FW_FEATURE_SET_ENCRYPT) ?
2754                (DL_MODE_ENCRYPT | DL_MODE_RESET_SEC_IV) : 0;
2755         ret |= FIELD_PREP(DL_MODE_KEY_IDX,
2756                           FIELD_GET(FW_FEATURE_SET_KEY_IDX, feature_set));
2757         ret |= DL_MODE_NEED_RSP;
2758         ret |= is_wa ? DL_MODE_WORKING_PDA_CR4 : 0;
2759
2760         return ret;
2761 }
2762
2763 static int
2764 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2765                              const struct mt7915_fw_trailer *hdr,
2766                              const u8 *data, bool is_wa)
2767 {
2768         int i, offset = 0;
2769         u32 override = 0, option = 0;
2770
2771         for (i = 0; i < hdr->n_region; i++) {
2772                 const struct mt7915_fw_region *region;
2773                 int err;
2774                 u32 len, addr, mode;
2775
2776                 region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2777                          (hdr->n_region - i) * sizeof(*region));
2778                 mode = mt7915_mcu_gen_dl_mode(region->feature_set, is_wa);
2779                 len = le32_to_cpu(region->len);
2780                 addr = le32_to_cpu(region->addr);
2781
2782                 if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2783                         override = addr;
2784
2785                 err = mt7915_mcu_init_download(dev, addr, len, mode);
2786                 if (err) {
2787                         dev_err(dev->mt76.dev, "Download request failed\n");
2788                         return err;
2789                 }
2790
2791                 err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2792                                              data + offset, len);
2793                 if (err) {
2794                         dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2795                         return err;
2796                 }
2797
2798                 offset += len;
2799         }
2800
2801         if (override)
2802                 option |= FW_START_OVERRIDE;
2803
2804         if (is_wa)
2805                 option |= FW_START_WORKING_PDA_CR4;
2806
2807         return mt7915_mcu_start_firmware(dev, override, option);
2808 }
2809
2810 static int mt7915_load_ram(struct mt7915_dev *dev)
2811 {
2812         const struct mt7915_fw_trailer *hdr;
2813         const struct firmware *fw;
2814         int ret;
2815
2816         ret = request_firmware(&fw, MT7915_FIRMWARE_WM, dev->mt76.dev);
2817         if (ret)
2818                 return ret;
2819
2820         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2821                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2822                 ret = -EINVAL;
2823                 goto out;
2824         }
2825
2826         hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2827                                         sizeof(*hdr));
2828
2829         dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2830                  hdr->fw_ver, hdr->build_date);
2831
2832         ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2833         if (ret) {
2834                 dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2835                 goto out;
2836         }
2837
2838         release_firmware(fw);
2839
2840         ret = request_firmware(&fw, MT7915_FIRMWARE_WA, dev->mt76.dev);
2841         if (ret)
2842                 return ret;
2843
2844         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2845                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2846                 ret = -EINVAL;
2847                 goto out;
2848         }
2849
2850         hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2851                                         sizeof(*hdr));
2852
2853         dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2854                  hdr->fw_ver, hdr->build_date);
2855
2856         ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2857         if (ret) {
2858                 dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2859                 goto out;
2860         }
2861
2862         snprintf(dev->mt76.hw->wiphy->fw_version,
2863                  sizeof(dev->mt76.hw->wiphy->fw_version),
2864                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2865
2866 out:
2867         release_firmware(fw);
2868
2869         return ret;
2870 }
2871
2872 static int mt7915_load_firmware(struct mt7915_dev *dev)
2873 {
2874         int ret;
2875
2876         ret = mt7915_load_patch(dev);
2877         if (ret)
2878                 return ret;
2879
2880         ret = mt7915_load_ram(dev);
2881         if (ret)
2882                 return ret;
2883
2884         if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2885                             FIELD_PREP(MT_TOP_MISC_FW_STATE,
2886                                        FW_STATE_WACPU_RDY), 1000)) {
2887                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2888                 return -EIO;
2889         }
2890
2891         mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2892
2893         dev_dbg(dev->mt76.dev, "Firmware init done\n");
2894
2895         return 0;
2896 }
2897
2898 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 ctrl)
2899 {
2900         struct {
2901                 u8 ctrl_val;
2902                 u8 pad[3];
2903         } data = {
2904                 .ctrl_val = ctrl
2905         };
2906
2907         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2908                                  sizeof(data), true);
2909 }
2910
2911 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2912 {
2913         struct {
2914                 u8 ver;
2915                 u8 pad;
2916                 __le16 len;
2917                 u8 level;
2918                 u8 rsv[3];
2919                 __le32 module_idx;
2920         } data = {
2921                 .module_idx = cpu_to_le32(module),
2922                 .level = level,
2923         };
2924
2925         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2926                                  sizeof(data), false);
2927 }
2928
2929 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2930 {
2931         struct {
2932                 u8 enable;
2933                 u8 _rsv[3];
2934         } __packed req = {
2935                 .enable = enabled
2936         };
2937
2938         return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2939                                  sizeof(req), false);
2940 }
2941
2942 int mt7915_mcu_init(struct mt7915_dev *dev)
2943 {
2944         static const struct mt76_mcu_ops mt7915_mcu_ops = {
2945                 .headroom = sizeof(struct mt7915_mcu_txd),
2946                 .mcu_skb_send_msg = mt7915_mcu_send_message,
2947                 .mcu_parse_response = mt7915_mcu_parse_response,
2948                 .mcu_restart = mt7915_mcu_restart,
2949         };
2950         int ret;
2951
2952         dev->mt76.mcu_ops = &mt7915_mcu_ops;
2953
2954         ret = mt7915_driver_own(dev);
2955         if (ret)
2956                 return ret;
2957
2958         ret = mt7915_load_firmware(dev);
2959         if (ret)
2960                 return ret;
2961
2962         set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2963         mt7915_mcu_fw_log_2_host(dev, 0);
2964         mt7915_mcu_set_mwds(dev, 1);
2965         mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET), MCU_WA_PARAM_RED, 0, 0);
2966
2967         return 0;
2968 }
2969
2970 void mt7915_mcu_exit(struct mt7915_dev *dev)
2971 {
2972         __mt76_mcu_restart(&dev->mt76);
2973         if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2974                             FIELD_PREP(MT_TOP_MISC_FW_STATE,
2975                                        FW_STATE_FW_DOWNLOAD), 1000)) {
2976                 dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2977                 return;
2978         }
2979
2980         mt76_wr(dev, MT_TOP_LPCR_HOST_BAND0, MT_TOP_LPCR_HOST_FW_OWN);
2981         skb_queue_purge(&dev->mt76.mcu.res_q);
2982 }
2983
2984 static int
2985 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
2986 {
2987         struct {
2988                 u8 operation;
2989                 u8 count;
2990                 u8 _rsv[2];
2991                 u8 index;
2992                 u8 enable;
2993                 __le16 etype;
2994         } req = {
2995                 .operation = 1,
2996                 .count = 1,
2997                 .enable = 1,
2998                 .etype = cpu_to_le16(ETH_P_PAE),
2999         };
3000
3001         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
3002                                  &req, sizeof(req), false);
3003 }
3004
3005 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
3006                        bool enable, bool hdr_trans)
3007 {
3008         struct {
3009                 u8 operation;
3010                 u8 enable;
3011                 u8 check_bssid;
3012                 u8 insert_vlan;
3013                 u8 remove_vlan;
3014                 u8 tid;
3015                 u8 mode;
3016                 u8 rsv;
3017         } __packed req_trans = {
3018                 .enable = hdr_trans,
3019         };
3020         struct {
3021                 u8 enable;
3022                 u8 band;
3023                 u8 rsv[2];
3024         } __packed req_mac = {
3025                 .enable = enable,
3026                 .band = band,
3027         };
3028         int ret;
3029
3030         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
3031                                 &req_trans, sizeof(req_trans), false);
3032         if (ret)
3033                 return ret;
3034
3035         if (hdr_trans)
3036                 mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
3037
3038         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
3039                                  &req_mac, sizeof(req_mac), true);
3040 }
3041
3042 int mt7915_mcu_set_scs(struct mt7915_dev *dev, u8 band, bool enable)
3043 {
3044         struct {
3045                 __le32 cmd;
3046                 u8 band;
3047                 u8 enable;
3048         } __packed req = {
3049                 .cmd = cpu_to_le32(SCS_ENABLE),
3050                 .band = band,
3051                 .enable = enable + 1,
3052         };
3053
3054         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SCS_CTRL), &req,
3055                                  sizeof(req), false);
3056 }
3057
3058 int mt7915_mcu_set_rts_thresh(struct mt7915_phy *phy, u32 val)
3059 {
3060         struct mt7915_dev *dev = phy->dev;
3061         struct {
3062                 u8 prot_idx;
3063                 u8 band;
3064                 u8 rsv[2];
3065                 __le32 len_thresh;
3066                 __le32 pkt_thresh;
3067         } __packed req = {
3068                 .prot_idx = 1,
3069                 .band = phy != &dev->phy,
3070                 .len_thresh = cpu_to_le32(val),
3071                 .pkt_thresh = cpu_to_le32(0x2),
3072         };
3073
3074         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(PROTECT_CTRL), &req,
3075                                  sizeof(req), true);
3076 }
3077
3078 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
3079 {
3080         struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
3081         u8 num = req->total;
3082         size_t len = sizeof(*req) -
3083                      (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
3084
3085         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
3086                                  len, true);
3087 }
3088
3089 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
3090 {
3091 #define TX_CMD_MODE             1
3092         struct mt7915_mcu_tx req = {
3093                 .valid = true,
3094                 .mode = TX_CMD_MODE,
3095                 .total = IEEE80211_NUM_ACS,
3096         };
3097         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3098         int ac;
3099
3100         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
3101                 struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
3102                 struct edca *e = &req.edca[ac];
3103
3104                 e->set = WMM_PARAM_SET;
3105                 e->queue = ac + mvif->wmm_idx * MT7915_MAX_WMM_SETS;
3106                 e->aifs = q->aifs;
3107                 e->txop = cpu_to_le16(q->txop);
3108
3109                 if (q->cw_min)
3110                         e->cw_min = fls(q->cw_min);
3111                 else
3112                         e->cw_min = 5;
3113
3114                 if (q->cw_max)
3115                         e->cw_max = cpu_to_le16(fls(q->cw_max));
3116                 else
3117                         e->cw_max = cpu_to_le16(10);
3118         }
3119
3120         return mt7915_mcu_update_edca(dev, &req);
3121 }
3122
3123 int mt7915_mcu_set_pm(struct mt7915_dev *dev, int band, int enter)
3124 {
3125 #define ENTER_PM_STATE          1
3126 #define EXIT_PM_STATE           2
3127         struct {
3128                 u8 pm_number;
3129                 u8 pm_state;
3130                 u8 bssid[ETH_ALEN];
3131                 u8 dtim_period;
3132                 u8 wlan_idx_lo;
3133                 __le16 bcn_interval;
3134                 __le32 aid;
3135                 __le32 rx_filter;
3136                 u8 band_idx;
3137                 u8 wlan_idx_hi;
3138                 u8 rsv[2];
3139                 __le32 feature;
3140                 u8 omac_idx;
3141                 u8 wmm_idx;
3142                 u8 bcn_loss_cnt;
3143                 u8 bcn_sp_duration;
3144         } __packed req = {
3145                 .pm_number = 5,
3146                 .pm_state = (enter) ? ENTER_PM_STATE : EXIT_PM_STATE,
3147                 .band_idx = band,
3148         };
3149
3150         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(PM_STATE_CTRL), &req,
3151                                  sizeof(req), true);
3152 }
3153
3154 int mt7915_mcu_rdd_cmd(struct mt7915_dev *dev,
3155                        enum mt7915_rdd_cmd cmd, u8 index,
3156                        u8 rx_sel, u8 val)
3157 {
3158         struct {
3159                 u8 ctrl;
3160                 u8 rdd_idx;
3161                 u8 rdd_rx_sel;
3162                 u8 val;
3163                 u8 rsv[4];
3164         } __packed req = {
3165                 .ctrl = cmd,
3166                 .rdd_idx = index,
3167                 .rdd_rx_sel = rx_sel,
3168                 .val = val,
3169         };
3170
3171         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_CTRL), &req,
3172                                  sizeof(req), true);
3173 }
3174
3175 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
3176 {
3177         struct {
3178                 __le32 tag;
3179                 __le16 min_lpn;
3180                 u8 rsv[2];
3181         } __packed req = {
3182                 .tag = cpu_to_le32(0x1),
3183                 .min_lpn = cpu_to_le16(val),
3184         };
3185
3186         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3187                                  sizeof(req), true);
3188 }
3189
3190 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
3191                             const struct mt7915_dfs_pulse *pulse)
3192 {
3193         struct {
3194                 __le32 tag;
3195
3196                 __le32 max_width;               /* us */
3197                 __le32 max_pwr;                 /* dbm */
3198                 __le32 min_pwr;                 /* dbm */
3199                 __le32 min_stgr_pri;            /* us */
3200                 __le32 max_stgr_pri;            /* us */
3201                 __le32 min_cr_pri;              /* us */
3202                 __le32 max_cr_pri;              /* us */
3203         } __packed req = {
3204                 .tag = cpu_to_le32(0x3),
3205
3206 #define __req_field(field) .field = cpu_to_le32(pulse->field)
3207                 __req_field(max_width),
3208                 __req_field(max_pwr),
3209                 __req_field(min_pwr),
3210                 __req_field(min_stgr_pri),
3211                 __req_field(max_stgr_pri),
3212                 __req_field(min_cr_pri),
3213                 __req_field(max_cr_pri),
3214 #undef __req_field
3215         };
3216
3217         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3218                                  sizeof(req), true);
3219 }
3220
3221 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
3222                             const struct mt7915_dfs_pattern *pattern)
3223 {
3224         struct {
3225                 __le32 tag;
3226                 __le16 radar_type;
3227
3228                 u8 enb;
3229                 u8 stgr;
3230                 u8 min_crpn;
3231                 u8 max_crpn;
3232                 u8 min_crpr;
3233                 u8 min_pw;
3234                 __le32 min_pri;
3235                 __le32 max_pri;
3236                 u8 max_pw;
3237                 u8 min_crbn;
3238                 u8 max_crbn;
3239                 u8 min_stgpn;
3240                 u8 max_stgpn;
3241                 u8 min_stgpr;
3242                 u8 rsv[2];
3243                 __le32 min_stgpr_diff;
3244         } __packed req = {
3245                 .tag = cpu_to_le32(0x2),
3246                 .radar_type = cpu_to_le16(index),
3247
3248 #define __req_field_u8(field) .field = pattern->field
3249 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
3250                 __req_field_u8(enb),
3251                 __req_field_u8(stgr),
3252                 __req_field_u8(min_crpn),
3253                 __req_field_u8(max_crpn),
3254                 __req_field_u8(min_crpr),
3255                 __req_field_u8(min_pw),
3256                 __req_field_u32(min_pri),
3257                 __req_field_u32(max_pri),
3258                 __req_field_u8(max_pw),
3259                 __req_field_u8(min_crbn),
3260                 __req_field_u8(max_crbn),
3261                 __req_field_u8(min_stgpn),
3262                 __req_field_u8(max_stgpn),
3263                 __req_field_u8(min_stgpr),
3264                 __req_field_u32(min_stgpr_diff),
3265 #undef __req_field_u8
3266 #undef __req_field_u32
3267         };
3268
3269         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
3270                                  sizeof(req), true);
3271 }
3272
3273 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
3274 {
3275         struct mt7915_dev *dev = phy->dev;
3276         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3277         int freq1 = chandef->center_freq1;
3278         bool ext_phy = phy != &dev->phy;
3279         struct {
3280                 u8 control_ch;
3281                 u8 center_ch;
3282                 u8 bw;
3283                 u8 tx_streams_num;
3284                 u8 rx_streams;  /* mask or num */
3285                 u8 switch_reason;
3286                 u8 band_idx;
3287                 u8 center_ch2;  /* for 80+80 only */
3288                 __le16 cac_case;
3289                 u8 channel_band;
3290                 u8 rsv0;
3291                 __le32 outband_freq;
3292                 u8 txpower_drop;
3293                 u8 ap_bw;
3294                 u8 ap_center_ch;
3295                 u8 rsv1[57];
3296         } __packed req = {
3297                 .control_ch = chandef->chan->hw_value,
3298                 .center_ch = ieee80211_frequency_to_channel(freq1),
3299                 .bw = mt7915_mcu_chan_bw(chandef),
3300                 .tx_streams_num = hweight8(phy->mt76->antenna_mask),
3301                 .rx_streams = phy->mt76->antenna_mask,
3302                 .band_idx = ext_phy,
3303                 .channel_band = chandef->chan->band,
3304         };
3305
3306 #ifdef CONFIG_NL80211_TESTMODE
3307         if (phy->mt76->test.tx_antenna_mask &&
3308             (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
3309              phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES ||
3310              phy->mt76->test.state == MT76_TM_STATE_TX_CONT)) {
3311                 req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
3312                 req.rx_streams = phy->mt76->test.tx_antenna_mask;
3313
3314                 if (ext_phy) {
3315                         req.tx_streams_num = 2;
3316                         req.rx_streams >>= 2;
3317                 }
3318         }
3319 #endif
3320
3321         if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
3322                 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
3323         else if ((chandef->chan->flags & IEEE80211_CHAN_RADAR) &&
3324                  chandef->chan->dfs_state != NL80211_DFS_AVAILABLE)
3325                 req.switch_reason = CH_SWITCH_DFS;
3326         else
3327                 req.switch_reason = CH_SWITCH_NORMAL;
3328
3329         if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
3330                 req.rx_streams = hweight8(req.rx_streams);
3331
3332         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
3333                 int freq2 = chandef->center_freq2;
3334
3335                 req.center_ch2 = ieee80211_frequency_to_channel(freq2);
3336         }
3337
3338         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
3339 }
3340
3341 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
3342 {
3343 #define TOTAL_PAGE_MASK         GENMASK(7, 5)
3344 #define PAGE_IDX_MASK           GENMASK(4, 2)
3345 #define PER_PAGE_SIZE           0x400
3346         struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
3347         u8 total = MT7915_EEPROM_SIZE / PER_PAGE_SIZE;
3348         u8 *eep = (u8 *)dev->mt76.eeprom.data;
3349         int eep_len;
3350         int i;
3351
3352         for (i = 0; i <= total; i++, eep += eep_len) {
3353                 struct sk_buff *skb;
3354                 int ret;
3355
3356                 if (i == total)
3357                         eep_len = MT7915_EEPROM_SIZE % PER_PAGE_SIZE;
3358                 else
3359                         eep_len = PER_PAGE_SIZE;
3360
3361                 skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
3362                                          sizeof(req) + eep_len);
3363                 if (!skb)
3364                         return -ENOMEM;
3365
3366                 req.format = FIELD_PREP(TOTAL_PAGE_MASK, total) |
3367                              FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
3368                 req.len = cpu_to_le16(eep_len);
3369
3370                 skb_put_data(skb, &req, sizeof(req));
3371                 skb_put_data(skb, eep, eep_len);
3372
3373                 ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3374                                             MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
3375                 if (ret)
3376                         return ret;
3377         }
3378
3379         return 0;
3380 }
3381
3382 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
3383 {
3384         struct mt7915_mcu_eeprom req = {
3385                 .buffer_mode = EE_MODE_EFUSE,
3386                 .format = EE_FORMAT_WHOLE,
3387         };
3388
3389         if (dev->flash_mode)
3390                 return mt7915_mcu_set_eeprom_flash(dev);
3391
3392         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
3393                                  &req, sizeof(req), true);
3394 }
3395
3396 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
3397 {
3398         struct mt7915_mcu_eeprom_info req = {
3399                 .addr = cpu_to_le32(round_down(offset, 16)),
3400         };
3401         struct mt7915_mcu_eeprom_info *res;
3402         struct sk_buff *skb;
3403         int ret;
3404         u8 *buf;
3405
3406         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_ACCESS), &req,
3407                                 sizeof(req), true, &skb);
3408         if (ret)
3409                 return ret;
3410
3411         res = (struct mt7915_mcu_eeprom_info *)skb->data;
3412         buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
3413         memcpy(buf, res->data, 16);
3414         dev_kfree_skb(skb);
3415
3416         return 0;
3417 }
3418
3419 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
3420                                   u8 *data, u32 len, int cmd)
3421 {
3422         struct {
3423                 u8 dir;
3424                 u8 valid;
3425                 __le16 bitmap;
3426                 s8 precal;
3427                 u8 action;
3428                 u8 band;
3429                 u8 idx;
3430                 u8 rsv[4];
3431                 __le32 len;
3432         } req;
3433         struct sk_buff *skb;
3434
3435         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
3436         if (!skb)
3437                 return -ENOMEM;
3438
3439         req.idx = idx;
3440         req.len = cpu_to_le32(len);
3441         skb_put_data(skb, &req, sizeof(req));
3442         skb_put_data(skb, data, len);
3443
3444         return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
3445 }
3446
3447 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
3448 {
3449         u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3450         u32 total = MT_EE_CAL_GROUP_SIZE;
3451
3452         if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
3453                 return 0;
3454
3455         /*
3456          * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
3457          * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
3458          */
3459         while (total > 0) {
3460                 int ret, len;
3461
3462                 len = min_t(u32, total, MT_EE_CAL_UNIT);
3463
3464                 ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
3465                                              MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
3466                 if (ret)
3467                         return ret;
3468
3469                 total -= len;
3470                 cal += len;
3471                 idx++;
3472         }
3473
3474         return 0;
3475 }
3476
3477 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
3478 {
3479         int i;
3480
3481         for (i = 0; i < n_freqs; i++)
3482                 if (cur == freqs[i])
3483                         return i;
3484
3485         return -1;
3486 }
3487
3488 static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
3489 {
3490         static const u16 freq_list[] = {
3491                 5180, 5200, 5220, 5240,
3492                 5260, 5280, 5300, 5320,
3493                 5500, 5520, 5540, 5560,
3494                 5580, 5600, 5620, 5640,
3495                 5660, 5680, 5700, 5745,
3496                 5765, 5785, 5805, 5825
3497         };
3498         int offset_2g = ARRAY_SIZE(freq_list);
3499         int idx;
3500
3501         if (freq < 4000) {
3502                 if (freq < 2432)
3503                         return offset_2g;
3504                 if (freq < 2457)
3505                         return offset_2g + 1;
3506
3507                 return offset_2g + 2;
3508         }
3509
3510         if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
3511                 return -1;
3512
3513         if (bw != NL80211_CHAN_WIDTH_20) {
3514                 idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3515                                            freq + 10);
3516                 if (idx >= 0)
3517                         return idx;
3518
3519                 idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3520                                            freq - 10);
3521                 if (idx >= 0)
3522                         return idx;
3523         }
3524
3525         return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3526 }
3527
3528 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
3529 {
3530         struct mt7915_dev *dev = phy->dev;
3531         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3532         u16 total = 2, center_freq = chandef->center_freq1;
3533         u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3534         int idx;
3535
3536         if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
3537                 return 0;
3538
3539         idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
3540         if (idx < 0)
3541                 return -EINVAL;
3542
3543         /* Items: Tx DPD, Tx Flatness */
3544         idx = idx * 2;
3545         cal += MT_EE_CAL_GROUP_SIZE;
3546
3547         while (total--) {
3548                 int ret;
3549
3550                 cal += (idx * MT_EE_CAL_UNIT);
3551                 ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
3552                                              MCU_EXT_CMD(DPD_PRE_CAL_INFO));
3553                 if (ret)
3554                         return ret;
3555
3556                 idx++;
3557         }
3558
3559         return 0;
3560 }
3561
3562 int mt7915_mcu_get_temperature(struct mt7915_dev *dev, int index)
3563 {
3564         struct {
3565                 u8 ctrl_id;
3566                 u8 action;
3567                 u8 band;
3568                 u8 rsv[5];
3569         } req = {
3570                 .ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3571                 .action = index,
3572         };
3573
3574         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3575                                  sizeof(req), true);
3576 }
3577
3578 int mt7915_mcu_get_tx_rate(struct mt7915_dev *dev, u32 cmd, u16 wlan_idx)
3579 {
3580         struct {
3581                 __le32 cmd;
3582                 __le16 wlan_idx;
3583                 __le16 ru_idx;
3584                 __le16 direction;
3585                 __le16 dump_group;
3586         } req = {
3587                 .cmd = cpu_to_le32(cmd),
3588                 .wlan_idx = cpu_to_le16(wlan_idx),
3589                 .dump_group = cpu_to_le16(1),
3590         };
3591
3592         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RATE_CTRL), &req,
3593                                  sizeof(req), false);
3594 }
3595
3596 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3597 {
3598 #define MT7915_SKU_RATE_NUM             161
3599         struct mt7915_dev *dev = phy->dev;
3600         struct mt76_phy *mphy = phy->mt76;
3601         struct ieee80211_hw *hw = mphy->hw;
3602         struct mt7915_sku_val {
3603                 u8 format_id;
3604                 u8 limit_type;
3605                 u8 dbdc_idx;
3606                 s8 val[MT7915_SKU_RATE_NUM];
3607         } __packed req = {
3608                 .format_id = 4,
3609                 .dbdc_idx = phy != &dev->phy,
3610         };
3611         struct mt76_power_limits limits_array;
3612         s8 *la = (s8 *)&limits_array;
3613         int i, idx, n_chains = hweight8(mphy->antenna_mask);
3614         int tx_power;
3615
3616         tx_power = hw->conf.power_level * 2 -
3617                    mt76_tx_power_nss_delta(n_chains);
3618
3619         tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3620                                               &limits_array, tx_power);
3621         mphy->txpower_cur = tx_power;
3622
3623         for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3624                 u8 mcs_num, len = mt7915_sku_group_len[i];
3625                 int j;
3626
3627                 if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3628                         mcs_num = 10;
3629
3630                         if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3631                                 la = (s8 *)&limits_array + 12;
3632                 } else {
3633                         mcs_num = len;
3634                 }
3635
3636                 for (j = 0; j < min_t(u8, mcs_num, len); j++)
3637                         req.val[idx + j] = la[j];
3638
3639                 la += mcs_num;
3640                 idx += len;
3641         }
3642
3643         return mt76_mcu_send_msg(&dev->mt76,
3644                                  MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3645                                  sizeof(req), true);
3646 }
3647
3648 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3649                               u8 en)
3650 {
3651         struct {
3652                 u8 test_mode_en;
3653                 u8 param_idx;
3654                 u8 _rsv[2];
3655
3656                 u8 enable;
3657                 u8 _rsv2[3];
3658
3659                 u8 pad[8];
3660         } __packed req = {
3661                 .test_mode_en = test_mode,
3662                 .param_idx = param,
3663                 .enable = en,
3664         };
3665
3666         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3667                                  sizeof(req), false);
3668 }
3669
3670 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3671 {
3672         struct mt7915_dev *dev = phy->dev;
3673         struct mt7915_sku {
3674                 u8 format_id;
3675                 u8 sku_enable;
3676                 u8 dbdc_idx;
3677                 u8 rsv;
3678         } __packed req = {
3679                 .format_id = 0,
3680                 .dbdc_idx = phy != &dev->phy,
3681                 .sku_enable = enable,
3682         };
3683
3684         return mt76_mcu_send_msg(&dev->mt76,
3685                                  MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3686                                  sizeof(req), true);
3687 }
3688
3689 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3690 {
3691         struct {
3692                 u8 action;
3693                 u8 set;
3694                 u8 band;
3695                 u8 rsv;
3696         } req = {
3697                 .action = action,
3698                 .set = set,
3699                 .band = band,
3700         };
3701
3702         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3703                                  &req, sizeof(req), false);
3704 }
3705
3706 int mt7915_mcu_set_txbf_module(struct mt7915_dev *dev)
3707 {
3708 #define MT_BF_MODULE_UPDATE               25
3709         struct {
3710                 u8 action;
3711                 u8 bf_num;
3712                 u8 bf_bitmap;
3713                 u8 bf_sel[8];
3714                 u8 rsv[8];
3715         } __packed req = {
3716                 .action = MT_BF_MODULE_UPDATE,
3717                 .bf_num = 2,
3718                 .bf_bitmap = GENMASK(1, 0),
3719         };
3720
3721         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3722                                  sizeof(req), true);
3723 }
3724
3725 int mt7915_mcu_set_txbf_type(struct mt7915_dev *dev)
3726 {
3727 #define MT_BF_TYPE_UPDATE               20
3728         struct {
3729                 u8 action;
3730                 bool ebf;
3731                 bool ibf;
3732                 u8 rsv;
3733         } __packed req = {
3734                 .action = MT_BF_TYPE_UPDATE,
3735                 .ebf = true,
3736                 .ibf = dev->ibf,
3737         };
3738
3739         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3740                                  sizeof(req), true);
3741 }
3742
3743 int mt7915_mcu_set_txbf_sounding(struct mt7915_dev *dev)
3744 {
3745 #define MT_BF_PROCESSING                4
3746         struct {
3747                 u8 action;
3748                 u8 snd_mode;
3749                 u8 sta_num;
3750                 u8 rsv;
3751                 u8 wlan_idx[4];
3752                 __le32 snd_period;      /* ms */
3753         } __packed req = {
3754                 .action = true,
3755                 .snd_mode = MT_BF_PROCESSING,
3756         };
3757
3758         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3759                                  sizeof(req), true);
3760 }
3761
3762 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3763                             bool enable)
3764 {
3765 #define MT_SPR_ENABLE           1
3766         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3767         struct {
3768                 u8 action;
3769                 u8 arg_num;
3770                 u8 band_idx;
3771                 u8 status;
3772                 u8 drop_tx_idx;
3773                 u8 sta_idx;     /* 256 sta */
3774                 u8 rsv[2];
3775                 __le32 val;
3776         } __packed req = {
3777                 .action = MT_SPR_ENABLE,
3778                 .arg_num = 1,
3779                 .band_idx = mvif->band_idx,
3780                 .val = cpu_to_le32(enable),
3781         };
3782
3783         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3784                                  sizeof(req), true);
3785 }
3786
3787 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3788                            struct ieee80211_sta *sta, struct rate_info *rate)
3789 {
3790         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3791         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3792         struct mt7915_dev *dev = phy->dev;
3793         struct mt76_phy *mphy = phy->mt76;
3794         struct {
3795                 u8 category;
3796                 u8 band;
3797                 __le16 wcid;
3798         } __packed req = {
3799                 .category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3800                 .band = mvif->band_idx,
3801                 .wcid = cpu_to_le16(msta->wcid.idx),
3802         };
3803         struct ieee80211_supported_band *sband;
3804         struct mt7915_mcu_phy_rx_info *res;
3805         struct sk_buff *skb;
3806         int ret;
3807         bool cck = false;
3808
3809         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3810                                         &req, sizeof(req), true, &skb);
3811         if (ret)
3812                 return ret;
3813
3814         res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3815
3816         rate->mcs = res->rate;
3817         rate->nss = res->nsts + 1;
3818
3819         switch (res->mode) {
3820         case MT_PHY_TYPE_CCK:
3821                 cck = true;
3822                 fallthrough;
3823         case MT_PHY_TYPE_OFDM:
3824                 if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3825                         sband = &mphy->sband_5g.sband;
3826                 else
3827                         sband = &mphy->sband_2g.sband;
3828
3829                 rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
3830                 rate->legacy = sband->bitrates[rate->mcs].bitrate;
3831                 break;
3832         case MT_PHY_TYPE_HT:
3833         case MT_PHY_TYPE_HT_GF:
3834                 if (rate->mcs > 31) {
3835                         ret = -EINVAL;
3836                         goto out;
3837                 }
3838
3839                 rate->flags = RATE_INFO_FLAGS_MCS;
3840                 if (res->gi)
3841                         rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3842                 break;
3843         case MT_PHY_TYPE_VHT:
3844                 if (rate->mcs > 9) {
3845                         ret = -EINVAL;
3846                         goto out;
3847                 }
3848
3849                 rate->flags = RATE_INFO_FLAGS_VHT_MCS;
3850                 if (res->gi)
3851                         rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3852                 break;
3853         case MT_PHY_TYPE_HE_SU:
3854         case MT_PHY_TYPE_HE_EXT_SU:
3855         case MT_PHY_TYPE_HE_TB:
3856         case MT_PHY_TYPE_HE_MU:
3857                 if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
3858                         ret = -EINVAL;
3859                         goto out;
3860                 }
3861                 rate->he_gi = res->gi;
3862                 rate->flags = RATE_INFO_FLAGS_HE_MCS;
3863                 break;
3864         default:
3865                 ret = -EINVAL;
3866                 goto out;
3867         }
3868
3869         switch (res->bw) {
3870         case IEEE80211_STA_RX_BW_160:
3871                 rate->bw = RATE_INFO_BW_160;
3872                 break;
3873         case IEEE80211_STA_RX_BW_80:
3874                 rate->bw = RATE_INFO_BW_80;
3875                 break;
3876         case IEEE80211_STA_RX_BW_40:
3877                 rate->bw = RATE_INFO_BW_40;
3878                 break;
3879         default:
3880                 rate->bw = RATE_INFO_BW_20;
3881                 break;
3882         }
3883
3884 out:
3885         dev_kfree_skb(skb);
3886
3887         return ret;
3888 }