drivers/net/wireless/mediatek/mt76/mt7915/mcu.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2020 MediaTek Inc. */
   3
   4 #include <linux/firmware.h>
   5 #include <linux/fs.h>
   6 #include "mt7915.h"
   7 #include "mcu.h"
   8 #include "mac.h"
   9 #include "eeprom.h"
  10
  11 struct mt7915_patch_hdr {
  12         char build_date[16];
  13         char platform[4];
  14         __be32 hw_sw_ver;
  15         __be32 patch_ver;
  16         __be16 checksum;
  17         u16 reserved;
  18         struct {
  19                 __be32 patch_ver;
  20                 __be32 subsys;
  21                 __be32 feature;
  22                 __be32 n_region;
  23                 __be32 crc;
  24                 u32 reserved[11];
  25         } desc;
  26 } __packed;
  27
  28 struct mt7915_patch_sec {
  29         __be32 type;
  30         __be32 offs;
  31         __be32 size;
  32         union {
  33                 __be32 spec[13];
  34                 struct {
  35                         __be32 addr;
  36                         __be32 len;
  37                         __be32 sec_key_idx;
  38                         __be32 align_len;
  39                         u32 reserved[9];
  40                 } info;
  41         };
  42 } __packed;
  43
  44 struct mt7915_fw_trailer {
  45         u8 chip_id;
  46         u8 eco_code;
  47         u8 n_region;
  48         u8 format_ver;
  49         u8 format_flag;
  50         u8 reserved[2];
  51         char fw_ver[10];
  52         char build_date[15];
  53         u32 crc;
  54 } __packed;
  55
  56 struct mt7915_fw_region {
  57         __le32 decomp_crc;
  58         __le32 decomp_len;
  59         __le32 decomp_blk_sz;
  60         u8 reserved[4];
  61         __le32 addr;
  62         __le32 len;
  63         u8 feature_set;
  64         u8 reserved1[15];
  65 } __packed;
  66
  67 #define fw_name(_dev, name, ...)        ({                      \
  68         char *_fw;                                              \
  69         switch (mt76_chip(&(_dev)->mt76)) {                     \
  70         case 0x7915:                                            \
  71                 _fw = MT7915_##name;                            \
  72                 break;                                          \
  73         case 0x7986:                                            \
  74                 _fw = MT7986_##name##__VA_ARGS__;               \
  75                 break;                                          \
  76         default:                                                \
  77                 _fw = MT7916_##name;                            \
  78                 break;                                          \
  79         }                                                       \
  80         _fw;                                                    \
  81 })
  82
  83 #define fw_name_var(_dev, name)         (mt7915_check_adie(dev, false) ?        \
  84                                          fw_name(_dev, name) :                  \
  85                                          fw_name(_dev, name, _MT7975))
  86
  87 #define MCU_PATCH_ADDRESS               0x200000
  88
  89 #define HE_PHY(p, c)                    u8_get_bits(c, IEEE80211_HE_PHY_##p)
  90 #define HE_MAC(m, c)                    u8_get_bits(c, IEEE80211_HE_MAC_##m)
  91
  92 static u8
  93 mt7915_mcu_get_sta_nss(u16 mcs_map)
  94 {
  95         u8 nss;
  96
  97         for (nss = 8; nss > 0; nss--) {
  98                 u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
  99
 100                 if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
 101                         break;
 102         }
 103
 104         return nss - 1;
 105 }
 106
 107 static void
 108 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
 109                           u16 mcs_map)
 110 {
 111         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
 112         struct mt7915_dev *dev = msta->vif->phy->dev;
 113         enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
 114         const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
 115         int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
 116
 117         for (nss = 0; nss < max_nss; nss++) {
 118                 int mcs;
 119
 120                 switch ((mcs_map >> (2 * nss)) & 0x3) {
 121                 case IEEE80211_HE_MCS_SUPPORT_0_11:
 122                         mcs = GENMASK(11, 0);
 123                         break;
 124                 case IEEE80211_HE_MCS_SUPPORT_0_9:
 125                         mcs = GENMASK(9, 0);
 126                         break;
 127                 case IEEE80211_HE_MCS_SUPPORT_0_7:
 128                         mcs = GENMASK(7, 0);
 129                         break;
 130                 default:
 131                         mcs = 0;
 132                 }
 133
 134                 mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
 135
 136                 switch (mcs) {
 137                 case 0 ... 7:
 138                         mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
 139                         break;
 140                 case 8 ... 9:
 141                         mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
 142                         break;
 143                 case 10 ... 11:
 144                         mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
 145                         break;
 146                 default:
 147                         mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
 148                         break;
 149                 }
 150                 mcs_map &= ~(0x3 << (nss * 2));
 151                 mcs_map |= mcs << (nss * 2);
 152
 153                 /* only support 2ss on 160MHz for mt7915 */
 154                 if (is_mt7915(&dev->mt76) && nss > 1 &&
 155                     sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
 156                         break;
 157         }
 158
 159         *he_mcs = cpu_to_le16(mcs_map);
 160 }
 161
 162 static void
 163 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
 164                            const u16 *mask)
 165 {
 166         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
 167         struct mt7915_dev *dev = msta->vif->phy->dev;
 168         u16 mcs_map = le16_to_cpu(sta->deflink.vht_cap.vht_mcs.rx_mcs_map);
 169         int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
 170         u16 mcs;
 171
 172         for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
 173                 switch (mcs_map & 0x3) {
 174                 case IEEE80211_VHT_MCS_SUPPORT_0_9:
 175                         mcs = GENMASK(9, 0);
 176                         break;
 177                 case IEEE80211_VHT_MCS_SUPPORT_0_8:
 178                         mcs = GENMASK(8, 0);
 179                         break;
 180                 case IEEE80211_VHT_MCS_SUPPORT_0_7:
 181                         mcs = GENMASK(7, 0);
 182                         break;
 183                 default:
 184                         mcs = 0;
 185                 }
 186
 187                 vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
 188
 189                 /* only support 2ss on 160MHz for mt7915 */
 190                 if (is_mt7915(&dev->mt76) && nss > 1 &&
 191                     sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
 192                         break;
 193         }
 194 }
 195
 196 static void
 197 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
 198                           const u8 *mask)
 199 {
 200         int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
 201
 202         for (nss = 0; nss < max_nss; nss++)
 203                 ht_mcs[nss] = sta->deflink.ht_cap.mcs.rx_mask[nss] & mask[nss];
 204 }
 205
 206 static int
 207 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 208                           struct sk_buff *skb, int seq)
 209 {
 210         struct mt7915_mcu_rxd *rxd;
 211         int ret = 0;
 212
 213         if (!skb) {
 214                 dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
 215                         cmd, seq);
 216                 return -ETIMEDOUT;
 217         }
 218
 219         rxd = (struct mt7915_mcu_rxd *)skb->data;
 220         if (seq != rxd->seq)
 221                 return -EAGAIN;
 222
 223         if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
 224                 skb_pull(skb, sizeof(*rxd) - 4);
 225                 ret = *skb->data;
 226         } else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
 227                 skb_pull(skb, sizeof(*rxd) + 4);
 228                 ret = le32_to_cpu(*(__le32 *)skb->data);
 229         } else {
 230                 skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
 231         }
 232
 233         return ret;
 234 }
 235
 236 static int
 237 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 238                         int cmd, int *wait_seq)
 239 {
 240         struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
 241         struct mt7915_mcu_txd *mcu_txd;
 242         enum mt76_mcuq_id qid;
 243         __le32 *txd;
 244         u32 val;
 245         u8 seq;
 246
 247         /* TODO: make dynamic based on msg type */
 248         mdev->mcu.timeout = 20 * HZ;
 249
 250         seq = ++dev->mt76.mcu.msg_seq & 0xf;
 251         if (!seq)
 252                 seq = ++dev->mt76.mcu.msg_seq & 0xf;
 253
 254         if (cmd == MCU_CMD(FW_SCATTER)) {
 255                 qid = MT_MCUQ_FWDL;
 256                 goto exit;
 257         }
 258
 259         mcu_txd = (struct mt7915_mcu_txd *)skb_push(skb, sizeof(*mcu_txd));
 260         if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 261                 qid = MT_MCUQ_WA;
 262         else
 263                 qid = MT_MCUQ_WM;
 264
 265         txd = mcu_txd->txd;
 266
 267         val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
 268               FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
 269               FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
 270         txd[0] = cpu_to_le32(val);
 271
 272         val = MT_TXD1_LONG_FORMAT |
 273               FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
 274         txd[1] = cpu_to_le32(val);
 275
 276         mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 277         mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
 278                                                MT_TX_MCU_PORT_RX_Q0));
 279         mcu_txd->pkt_type = MCU_PKT_ID;
 280         mcu_txd->seq = seq;
 281
 282         mcu_txd->cid = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
 283         mcu_txd->set_query = MCU_Q_NA;
 284         mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
 285         if (mcu_txd->ext_cid) {
 286                 mcu_txd->ext_cid_ack = 1;
 287
 288                 /* do not use Q_SET for efuse */
 289                 if (cmd & __MCU_CMD_FIELD_QUERY)
 290                         mcu_txd->set_query = MCU_Q_QUERY;
 291                 else
 292                         mcu_txd->set_query = MCU_Q_SET;
 293         }
 294
 295         if (cmd & __MCU_CMD_FIELD_WA)
 296                 mcu_txd->s2d_index = MCU_S2D_H2C;
 297         else
 298                 mcu_txd->s2d_index = MCU_S2D_H2N;
 299
 300 exit:
 301         if (wait_seq)
 302                 *wait_seq = seq;
 303
 304         return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
 305 }
 306
 307 int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
 308 {
 309         struct {
 310                 __le32 args[3];
 311         } req = {
 312                 .args = {
 313                         cpu_to_le32(a1),
 314                         cpu_to_le32(a2),
 315                         cpu_to_le32(a3),
 316                 },
 317         };
 318
 319         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), false);
 320 }
 321
 322 static void
 323 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 324 {
 325         if (vif->csa_active)
 326                 ieee80211_csa_finish(vif);
 327 }
 328
 329 static void
 330 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
 331 {
 332         struct mt76_phy *mphy = &dev->mt76.phy;
 333         struct mt7915_mcu_csa_notify *c;
 334
 335         c = (struct mt7915_mcu_csa_notify *)skb->data;
 336
 337         if ((c->band_idx && !dev->phy.band_idx) && dev->mt76.phy2)
 338                 mphy = dev->mt76.phy2;
 339
 340         ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 341                         IEEE80211_IFACE_ITER_RESUME_ALL,
 342                         mt7915_mcu_csa_finish, mphy->hw);
 343 }
 344
 345 static void
 346 mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb)
 347 {
 348         struct mt76_phy *mphy = &dev->mt76.phy;
 349         struct mt7915_mcu_thermal_notify *t;
 350         struct mt7915_phy *phy;
 351
 352         t = (struct mt7915_mcu_thermal_notify *)skb->data;
 353         if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)
 354                 return;
 355
 356         if ((t->ctrl.band_idx && !dev->phy.band_idx) && dev->mt76.phy2)
 357                 mphy = dev->mt76.phy2;
 358
 359         phy = (struct mt7915_phy *)mphy->priv;
 360         phy->throttle_state = t->ctrl.duty.duty_cycle;
 361 }
 362
 363 static void
 364 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
 365 {
 366         struct mt76_phy *mphy = &dev->mt76.phy;
 367         struct mt7915_mcu_rdd_report *r;
 368
 369         r = (struct mt7915_mcu_rdd_report *)skb->data;
 370
 371         if ((r->band_idx && !dev->phy.band_idx) && dev->mt76.phy2)
 372                 mphy = dev->mt76.phy2;
 373
 374         if (r->band_idx == MT_RX_SEL2)
 375                 cfg80211_background_radar_event(mphy->hw->wiphy,
 376                                                 &dev->rdd2_chandef,
 377                                                 GFP_ATOMIC);
 378         else
 379                 ieee80211_radar_detected(mphy->hw);
 380         dev->hw_pattern++;
 381 }
 382
 383 static void
 384 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
 385 {
 386         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 387         const char *data = (char *)&rxd[1];
 388         const char *type;
 389         int len = skb->len - sizeof(*rxd);
 390
 391         switch (rxd->s2d_index) {
 392         case 0:
 393                 if (mt7915_debugfs_rx_log(dev, data, len))
 394                         return;
 395
 396                 type = "WM";
 397                 break;
 398         case 2:
 399                 type = "WA";
 400                 break;
 401         default:
 402                 type = "unknown";
 403                 break;
 404         }
 405
 406         wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type, len, data);
 407 }
 408
 409 static void
 410 mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 411 {
 412         if (!vif->color_change_active)
 413                 return;
 414
 415         ieee80211_color_change_finish(vif);
 416 }
 417
 418 static void
 419 mt7915_mcu_rx_bcc_notify(struct mt7915_dev *dev, struct sk_buff *skb)
 420 {
 421         struct mt76_phy *mphy = &dev->mt76.phy;
 422         struct mt7915_mcu_bcc_notify *b;
 423
 424         b = (struct mt7915_mcu_bcc_notify *)skb->data;
 425
 426         if ((b->band_idx && !dev->phy.band_idx) && dev->mt76.phy2)
 427                 mphy = dev->mt76.phy2;
 428
 429         ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 430                         IEEE80211_IFACE_ITER_RESUME_ALL,
 431                         mt7915_mcu_cca_finish, mphy->hw);
 432 }
 433
 434 static void
 435 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
 436 {
 437         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 438
 439         switch (rxd->ext_eid) {
 440         case MCU_EXT_EVENT_THERMAL_PROTECT:
 441                 mt7915_mcu_rx_thermal_notify(dev, skb);
 442                 break;
 443         case MCU_EXT_EVENT_RDD_REPORT:
 444                 mt7915_mcu_rx_radar_detected(dev, skb);
 445                 break;
 446         case MCU_EXT_EVENT_CSA_NOTIFY:
 447                 mt7915_mcu_rx_csa_notify(dev, skb);
 448                 break;
 449         case MCU_EXT_EVENT_FW_LOG_2_HOST:
 450                 mt7915_mcu_rx_log_message(dev, skb);
 451                 break;
 452         case MCU_EXT_EVENT_BCC_NOTIFY:
 453                 mt7915_mcu_rx_bcc_notify(dev, skb);
 454                 break;
 455         default:
 456                 break;
 457         }
 458 }
 459
 460 static void
 461 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
 462 {
 463         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 464
 465         switch (rxd->eid) {
 466         case MCU_EVENT_EXT:
 467                 mt7915_mcu_rx_ext_event(dev, skb);
 468                 break;
 469         default:
 470                 break;
 471         }
 472         dev_kfree_skb(skb);
 473 }
 474
 475 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
 476 {
 477         struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
 478
 479         if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
 480             rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 481             rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
 482             rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
 483             rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
 484             !rxd->seq)
 485                 mt7915_mcu_rx_unsolicited_event(dev, skb);
 486         else
 487                 mt76_mcu_rx_event(&dev->mt76, skb);
 488 }
 489
 490 static struct tlv *
 491 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
 492                              __le16 *sub_ntlv, __le16 *len)
 493 {
 494         struct tlv *ptlv, tlv = {
 495                 .tag = cpu_to_le16(sub_tag),
 496                 .len = cpu_to_le16(sub_len),
 497         };
 498
 499         ptlv = skb_put(skb, sub_len);
 500         memcpy(ptlv, &tlv, sizeof(tlv));
 501
 502         le16_add_cpu(sub_ntlv, 1);
 503         le16_add_cpu(len, sub_len);
 504
 505         return ptlv;
 506 }
 507
 508 /** bss info **/
 509 struct mt7915_he_obss_narrow_bw_ru_data {
 510         bool tolerated;
 511 };
 512
 513 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
 514                                                    struct cfg80211_bss *bss,
 515                                                    void *_data)
 516 {
 517         struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
 518         const struct element *elem;
 519
 520         rcu_read_lock();
 521         elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
 522
 523         if (!elem || elem->datalen <= 10 ||
 524             !(elem->data[10] &
 525               WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
 526                 data->tolerated = false;
 527
 528         rcu_read_unlock();
 529 }
 530
 531 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
 532                                               struct ieee80211_vif *vif)
 533 {
 534         struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
 535                 .tolerated = true,
 536         };
 537
 538         if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
 539                 return false;
 540
 541         cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
 542                           mt7915_check_he_obss_narrow_bw_ru_iter,
 543                           &iter_data);
 544
 545         /*
 546          * If there is at least one AP on radar channel that cannot
 547          * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
 548          */
 549         return !iter_data.tolerated;
 550 }
 551
 552 static void
 553 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 554                         struct mt7915_phy *phy)
 555 {
 556         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 557         struct bss_info_rf_ch *ch;
 558         struct tlv *tlv;
 559         int freq1 = chandef->center_freq1;
 560
 561         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
 562
 563         ch = (struct bss_info_rf_ch *)tlv;
 564         ch->pri_ch = chandef->chan->hw_value;
 565         ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
 566         ch->bw = mt76_connac_chan_bw(chandef);
 567
 568         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
 569                 int freq2 = chandef->center_freq2;
 570
 571                 ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
 572         }
 573
 574         if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
 575                 struct mt76_phy *mphy = phy->mt76;
 576
 577                 ch->he_ru26_block =
 578                         mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
 579                 ch->he_all_disable = false;
 580         } else {
 581                 ch->he_all_disable = true;
 582         }
 583 }
 584
 585 static void
 586 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 587                       struct mt7915_phy *phy)
 588 {
 589         int max_nss = hweight8(phy->mt76->chainmask);
 590         struct bss_info_ra *ra;
 591         struct tlv *tlv;
 592
 593         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
 594
 595         ra = (struct bss_info_ra *)tlv;
 596         ra->op_mode = vif->type == NL80211_IFTYPE_AP;
 597         ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
 598         ra->short_preamble = true;
 599         ra->tx_streams = max_nss;
 600         ra->rx_streams = max_nss;
 601         ra->algo = 4;
 602         ra->train_up_rule = 2;
 603         ra->train_up_high_thres = 110;
 604         ra->train_up_rule_rssi = -70;
 605         ra->low_traffic_thres = 2;
 606         ra->phy_cap = cpu_to_le32(0xfdf);
 607         ra->interval = cpu_to_le32(500);
 608         ra->fast_interval = cpu_to_le32(100);
 609 }
 610
 611 static void
 612 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 613                       struct mt7915_phy *phy)
 614 {
 615 #define DEFAULT_HE_PE_DURATION          4
 616 #define DEFAULT_HE_DURATION_RTS_THRES   1023
 617         const struct ieee80211_sta_he_cap *cap;
 618         struct bss_info_he *he;
 619         struct tlv *tlv;
 620
 621         cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
 622
 623         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
 624
 625         he = (struct bss_info_he *)tlv;
 626         he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
 627         if (!he->he_pe_duration)
 628                 he->he_pe_duration = DEFAULT_HE_PE_DURATION;
 629
 630         he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
 631         if (!he->he_rts_thres)
 632                 he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
 633
 634         he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
 635         he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
 636         he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
 637 }
 638
 639 static void
 640 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
 641 {
 642 #define TXD_CMP_MAP1            GENMASK(15, 0)
 643 #define TXD_CMP_MAP2            (GENMASK(31, 0) & ~BIT(23))
 644         struct bss_info_hw_amsdu *amsdu;
 645         struct tlv *tlv;
 646
 647         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
 648
 649         amsdu = (struct bss_info_hw_amsdu *)tlv;
 650         amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
 651         amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
 652         amsdu->trig_thres = cpu_to_le16(2);
 653         amsdu->enable = true;
 654 }
 655
 656 static void
 657 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
 658 {
 659         struct bss_info_bmc_rate *bmc;
 660         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 661         enum nl80211_band band = chandef->chan->band;
 662         struct tlv *tlv;
 663
 664         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
 665
 666         bmc = (struct bss_info_bmc_rate *)tlv;
 667         if (band == NL80211_BAND_2GHZ) {
 668                 bmc->short_preamble = true;
 669         } else {
 670                 bmc->bc_trans = cpu_to_le16(0x2000);
 671                 bmc->mc_trans = cpu_to_le16(0x2080);
 672         }
 673 }
 674
 675 static int
 676 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
 677                        bool bssid, bool enable)
 678 {
 679         struct mt7915_dev *dev = phy->dev;
 680         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 681         u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
 682         u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
 683         const u8 *addr = vif->addr;
 684         struct {
 685                 u8 mode;
 686                 u8 force_clear;
 687                 u8 clear_bitmap[8];
 688                 u8 entry_count;
 689                 u8 write;
 690                 u8 band;
 691
 692                 u8 index;
 693                 u8 bssid;
 694                 u8 addr[ETH_ALEN];
 695         } __packed req = {
 696                 .mode = !!mask || enable,
 697                 .entry_count = 1,
 698                 .write = 1,
 699                 .band = phy != &dev->phy,
 700                 .index = idx * 2 + bssid,
 701         };
 702
 703         if (bssid)
 704                 addr = vif->bss_conf.bssid;
 705
 706         if (enable)
 707                 ether_addr_copy(req.addr, addr);
 708
 709         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
 710                                  sizeof(req), true);
 711 }
 712
 713 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
 714                             struct ieee80211_vif *vif, int enable)
 715 {
 716         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 717         struct mt7915_dev *dev = phy->dev;
 718         struct sk_buff *skb;
 719
 720         if (mvif->mt76.omac_idx >= REPEATER_BSSID_START) {
 721                 mt7915_mcu_muar_config(phy, vif, false, enable);
 722                 mt7915_mcu_muar_config(phy, vif, true, enable);
 723         }
 724
 725         skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
 726                                               MT7915_BSS_UPDATE_MAX_SIZE);
 727         if (IS_ERR(skb))
 728                 return PTR_ERR(skb);
 729
 730         /* bss_omac must be first */
 731         if (enable)
 732                 mt76_connac_mcu_bss_omac_tlv(skb, vif);
 733
 734         mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
 735                                       mvif->sta.wcid.idx, enable);
 736
 737         if (vif->type == NL80211_IFTYPE_MONITOR)
 738                 goto out;
 739
 740         if (enable) {
 741                 mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
 742                 mt7915_mcu_bss_bmc_tlv(skb, phy);
 743                 mt7915_mcu_bss_ra_tlv(skb, vif, phy);
 744                 mt7915_mcu_bss_hw_amsdu_tlv(skb);
 745
 746                 if (vif->bss_conf.he_support)
 747                         mt7915_mcu_bss_he_tlv(skb, vif, phy);
 748
 749                 if (mvif->mt76.omac_idx >= EXT_BSSID_START &&
 750                     mvif->mt76.omac_idx < REPEATER_BSSID_START)
 751                         mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
 752         }
 753 out:
 754         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
 755                                      MCU_EXT_CMD(BSS_INFO_UPDATE), true);
 756 }
 757
 758 /** starec & wtbl **/
 759 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
 760                          struct ieee80211_ampdu_params *params,
 761                          bool enable)
 762 {
 763         struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
 764         struct mt7915_vif *mvif = msta->vif;
 765
 766         if (enable && !params->amsdu)
 767                 msta->wcid.amsdu = false;
 768
 769         return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
 770                                       MCU_EXT_CMD(STA_REC_UPDATE),
 771                                       enable, true);
 772 }
 773
 774 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
 775                          struct ieee80211_ampdu_params *params,
 776                          bool enable)
 777 {
 778         struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
 779         struct mt7915_vif *mvif = msta->vif;
 780
 781         return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
 782                                       MCU_EXT_CMD(STA_REC_UPDATE),
 783                                       enable, false);
 784 }
 785
 786 static void
 787 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
 788                       struct ieee80211_vif *vif)
 789 {
 790         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 791         struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
 792         struct ieee80211_he_mcs_nss_supp mcs_map;
 793         struct sta_rec_he *he;
 794         struct tlv *tlv;
 795         u32 cap = 0;
 796
 797         if (!sta->deflink.he_cap.has_he)
 798                 return;
 799
 800         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
 801
 802         he = (struct sta_rec_he *)tlv;
 803
 804         if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
 805                 cap |= STA_REC_HE_CAP_HTC;
 806
 807         if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
 808                 cap |= STA_REC_HE_CAP_BSR;
 809
 810         if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
 811                 cap |= STA_REC_HE_CAP_OM;
 812
 813         if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
 814                 cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
 815
 816         if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
 817                 cap |= STA_REC_HE_CAP_BQR;
 818
 819         if (elem->phy_cap_info[0] &
 820             (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
 821              IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
 822                 cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
 823
 824         if (mvif->cap.he_ldpc &&
 825             (elem->phy_cap_info[1] &
 826              IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
 827                 cap |= STA_REC_HE_CAP_LDPC;
 828
 829         if (elem->phy_cap_info[1] &
 830             IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
 831                 cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
 832
 833         if (elem->phy_cap_info[2] &
 834             IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
 835                 cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
 836
 837         if (elem->phy_cap_info[2] &
 838             IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
 839                 cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
 840
 841         if (elem->phy_cap_info[2] &
 842             IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
 843                 cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
 844
 845         if (elem->phy_cap_info[6] &
 846             IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB)
 847                 cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
 848
 849         if (elem->phy_cap_info[6] &
 850             IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
 851                 cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
 852
 853         if (elem->phy_cap_info[7] &
 854             IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
 855                 cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
 856
 857         if (elem->phy_cap_info[7] &
 858             IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
 859                 cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
 860
 861         if (elem->phy_cap_info[7] &
 862             IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
 863                 cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
 864
 865         if (elem->phy_cap_info[8] &
 866             IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
 867                 cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
 868
 869         if (elem->phy_cap_info[8] &
 870             IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
 871                 cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
 872
 873         if (elem->phy_cap_info[9] &
 874             IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
 875                 cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
 876
 877         if (elem->phy_cap_info[9] &
 878             IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
 879                 cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
 880
 881         he->he_cap = cpu_to_le32(cap);
 882
 883         mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
 884         switch (sta->deflink.bandwidth) {
 885         case IEEE80211_STA_RX_BW_160:
 886                 if (elem->phy_cap_info[0] &
 887                     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
 888                         mt7915_mcu_set_sta_he_mcs(sta,
 889                                                   &he->max_nss_mcs[CMD_HE_MCS_BW8080],
 890                                                   le16_to_cpu(mcs_map.rx_mcs_80p80));
 891
 892                 mt7915_mcu_set_sta_he_mcs(sta,
 893                                           &he->max_nss_mcs[CMD_HE_MCS_BW160],
 894                                           le16_to_cpu(mcs_map.rx_mcs_160));
 895                 fallthrough;
 896         default:
 897                 mt7915_mcu_set_sta_he_mcs(sta,
 898                                           &he->max_nss_mcs[CMD_HE_MCS_BW80],
 899                                           le16_to_cpu(mcs_map.rx_mcs_80));
 900                 break;
 901         }
 902
 903         he->t_frame_dur =
 904                 HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
 905         he->max_ampdu_exp =
 906                 HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
 907
 908         he->bw_set =
 909                 HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
 910         he->device_class =
 911                 HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
 912         he->punc_pream_rx =
 913                 HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
 914
 915         he->dcm_tx_mode =
 916                 HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
 917         he->dcm_tx_max_nss =
 918                 HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
 919         he->dcm_rx_mode =
 920                 HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
 921         he->dcm_rx_max_nss =
 922                 HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
 923         he->dcm_rx_max_nss =
 924                 HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
 925
 926         he->pkt_ext = 2;
 927 }
 928
 929 static void
 930 mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
 931                         struct ieee80211_vif *vif)
 932 {
 933         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 934         struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
 935         struct sta_rec_muru *muru;
 936         struct tlv *tlv;
 937
 938         if (vif->type != NL80211_IFTYPE_STATION &&
 939             vif->type != NL80211_IFTYPE_AP)
 940                 return;
 941
 942         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
 943
 944         muru = (struct sta_rec_muru *)tlv;
 945
 946         muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
 947                                mvif->cap.vht_mu_ebfer ||
 948                                mvif->cap.vht_mu_ebfee;
 949         muru->cfg.mimo_ul_en = true;
 950         muru->cfg.ofdma_dl_en = true;
 951
 952         if (sta->deflink.vht_cap.vht_supported)
 953                 muru->mimo_dl.vht_mu_bfee =
 954                         !!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 955
 956         if (!sta->deflink.he_cap.has_he)
 957                 return;
 958
 959         muru->mimo_dl.partial_bw_dl_mimo =
 960                 HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
 961
 962         muru->mimo_ul.full_ul_mimo =
 963                 HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
 964         muru->mimo_ul.partial_ul_mimo =
 965                 HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
 966
 967         muru->ofdma_dl.punc_pream_rx =
 968                 HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
 969         muru->ofdma_dl.he_20m_in_40m_2g =
 970                 HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
 971         muru->ofdma_dl.he_20m_in_160m =
 972                 HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
 973         muru->ofdma_dl.he_80m_in_160m =
 974                 HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
 975
 976         muru->ofdma_ul.t_frame_dur =
 977                 HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
 978         muru->ofdma_ul.mu_cascading =
 979                 HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
 980         muru->ofdma_ul.uo_ra =
 981                 HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
 982 }
 983
 984 static void
 985 mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
 986 {
 987         struct sta_rec_ht *ht;
 988         struct tlv *tlv;
 989
 990         if (!sta->deflink.ht_cap.ht_supported)
 991                 return;
 992
 993         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
 994
 995         ht = (struct sta_rec_ht *)tlv;
 996         ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
 997 }
 998
 999 static void
1000 mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
1001 {
1002         struct sta_rec_vht *vht;
1003         struct tlv *tlv;
1004
1005         if (!sta->deflink.vht_cap.vht_supported)
1006                 return;
1007
1008         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1009
1010         vht = (struct sta_rec_vht *)tlv;
1011         vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
1012         vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
1013         vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
1014 }
1015
1016 static void
1017 mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1018                          struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1019 {
1020         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1021         struct sta_rec_amsdu *amsdu;
1022         struct tlv *tlv;
1023
1024         if (vif->type != NL80211_IFTYPE_STATION &&
1025             vif->type != NL80211_IFTYPE_AP)
1026                 return;
1027
1028         if (!sta->max_amsdu_len)
1029             return;
1030
1031         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1032         amsdu = (struct sta_rec_amsdu *)tlv;
1033         amsdu->max_amsdu_num = 8;
1034         amsdu->amsdu_en = true;
1035         msta->wcid.amsdu = true;
1036
1037         switch (sta->max_amsdu_len) {
1038         case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1039                 if (!is_mt7915(&dev->mt76)) {
1040                         amsdu->max_mpdu_size =
1041                                 IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1042                         return;
1043                 }
1044                 fallthrough;
1045         case IEEE80211_MAX_MPDU_LEN_HT_7935:
1046         case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1047                 amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1048                 return;
1049         default:
1050                 amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1051                 return;
1052         }
1053 }
1054
1055 static int
1056 mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1057                         struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1058 {
1059         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1060         struct mt7915_sta *msta;
1061         struct wtbl_req_hdr *wtbl_hdr;
1062         struct mt76_wcid *wcid;
1063         struct tlv *tlv;
1064
1065         msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1066         wcid = sta ? &msta->wcid : NULL;
1067
1068         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
1069         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1070                                                   WTBL_RESET_AND_SET, tlv,
1071                                                   &skb);
1072         if (IS_ERR(wtbl_hdr))
1073                 return PTR_ERR(wtbl_hdr);
1074
1075         mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, skb, vif, sta, tlv,
1076                                          wtbl_hdr);
1077         mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, tlv, wtbl_hdr);
1078         if (sta)
1079                 mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, skb, sta, tlv,
1080                                             wtbl_hdr, mvif->cap.ht_ldpc,
1081                                             mvif->cap.vht_ldpc);
1082
1083         return 0;
1084 }
1085
1086 static inline bool
1087 mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1088                         struct ieee80211_sta *sta, bool bfee)
1089 {
1090         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1091         int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1092
1093         if (vif->type != NL80211_IFTYPE_STATION &&
1094             vif->type != NL80211_IFTYPE_AP)
1095                 return false;
1096
1097         if (!bfee && tx_ant < 2)
1098                 return false;
1099
1100         if (sta->deflink.he_cap.has_he) {
1101                 struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1102
1103                 if (bfee)
1104                         return mvif->cap.he_su_ebfee &&
1105                                HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1106                 else
1107                         return mvif->cap.he_su_ebfer &&
1108                                HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1109         }
1110
1111         if (sta->deflink.vht_cap.vht_supported) {
1112                 u32 cap = sta->deflink.vht_cap.cap;
1113
1114                 if (bfee)
1115                         return mvif->cap.vht_su_ebfee &&
1116                                (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1117                 else
1118                         return mvif->cap.vht_su_ebfer &&
1119                                (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1120         }
1121
1122         return false;
1123 }
1124
1125 static void
1126 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1127 {
1128         bf->sounding_phy = MT_PHY_TYPE_OFDM;
1129         bf->ndp_rate = 0;                               /* mcs0 */
1130         bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;      /* ofdm 24m */
1131         bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT; /* ofdm 24m */
1132 }
1133
1134 static void
1135 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1136                        struct sta_rec_bf *bf)
1137 {
1138         struct ieee80211_mcs_info *mcs = &sta->deflink.ht_cap.mcs;
1139         u8 n = 0;
1140
1141         bf->tx_mode = MT_PHY_TYPE_HT;
1142
1143         if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1144             (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1145                 n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1146                               mcs->tx_params);
1147         else if (mcs->rx_mask[3])
1148                 n = 3;
1149         else if (mcs->rx_mask[2])
1150                 n = 2;
1151         else if (mcs->rx_mask[1])
1152                 n = 1;
1153
1154         bf->nrow = hweight8(phy->mt76->chainmask) - 1;
1155         bf->ncol = min_t(u8, bf->nrow, n);
1156         bf->ibf_ncol = n;
1157 }
1158
1159 static void
1160 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1161                         struct sta_rec_bf *bf, bool explicit)
1162 {
1163         struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1164         struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1165         u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1166         u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1167         u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1168
1169         bf->tx_mode = MT_PHY_TYPE_VHT;
1170
1171         if (explicit) {
1172                 u8 sts, snd_dim;
1173
1174                 mt7915_mcu_sta_sounding_rate(bf);
1175
1176                 sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1177                                 pc->cap);
1178                 snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1179                                     vc->cap);
1180                 bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1181                 bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1182                 bf->ibf_ncol = bf->ncol;
1183
1184                 if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1185                         bf->nrow = 1;
1186         } else {
1187                 bf->nrow = tx_ant;
1188                 bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1189                 bf->ibf_ncol = nss_mcs;
1190
1191                 if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1192                         bf->ibf_nrow = 1;
1193         }
1194 }
1195
1196 static void
1197 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1198                        struct mt7915_phy *phy, struct sta_rec_bf *bf)
1199 {
1200         struct ieee80211_sta_he_cap *pc = &sta->deflink.he_cap;
1201         struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1202         const struct ieee80211_sta_he_cap *vc =
1203                 mt76_connac_get_he_phy_cap(phy->mt76, vif);
1204         const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1205         u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1206         u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1207         u8 snd_dim, sts;
1208
1209         bf->tx_mode = MT_PHY_TYPE_HE_SU;
1210
1211         mt7915_mcu_sta_sounding_rate(bf);
1212
1213         bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1214                                 pe->phy_cap_info[6]);
1215         bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1216                                 pe->phy_cap_info[6]);
1217         snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1218                          ve->phy_cap_info[5]);
1219         sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1220                      pe->phy_cap_info[4]);
1221         bf->nrow = min_t(u8, snd_dim, sts);
1222         bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1223         bf->ibf_ncol = bf->ncol;
1224
1225         if (sta->deflink.bandwidth != IEEE80211_STA_RX_BW_160)
1226                 return;
1227
1228         /* go over for 160MHz and 80p80 */
1229         if (pe->phy_cap_info[0] &
1230             IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1231                 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1232                 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1233
1234                 bf->ncol_bw160 = nss_mcs;
1235         }
1236
1237         if (pe->phy_cap_info[0] &
1238             IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1239                 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1240                 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1241
1242                 if (bf->ncol_bw160)
1243                         bf->ncol_bw160 = min_t(u8, bf->ncol_bw160, nss_mcs);
1244                 else
1245                         bf->ncol_bw160 = nss_mcs;
1246         }
1247
1248         snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1249                          ve->phy_cap_info[5]);
1250         sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1251                      pe->phy_cap_info[4]);
1252
1253         bf->nrow_bw160 = min_t(int, snd_dim, sts);
1254 }
1255
1256 static void
1257 mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1258                         struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1259 {
1260         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1261         struct mt7915_phy *phy = mvif->phy;
1262         int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1263         struct sta_rec_bf *bf;
1264         struct tlv *tlv;
1265         const u8 matrix[4][4] = {
1266                 {0, 0, 0, 0},
1267                 {1, 1, 0, 0},   /* 2x1, 2x2, 2x3, 2x4 */
1268                 {2, 4, 4, 0},   /* 3x1, 3x2, 3x3, 3x4 */
1269                 {3, 5, 6, 0}    /* 4x1, 4x2, 4x3, 4x4 */
1270         };
1271         bool ebf;
1272
1273         if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
1274                 return;
1275
1276         ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
1277         if (!ebf && !dev->ibf)
1278                 return;
1279
1280         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1281         bf = (struct sta_rec_bf *)tlv;
1282
1283         /* he: eBF only, in accordance with spec
1284          * vht: support eBF and iBF
1285          * ht: iBF only, since mac80211 lacks of eBF support
1286          */
1287         if (sta->deflink.he_cap.has_he && ebf)
1288                 mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1289         else if (sta->deflink.vht_cap.vht_supported)
1290                 mt7915_mcu_sta_bfer_vht(sta, phy, bf, ebf);
1291         else if (sta->deflink.ht_cap.ht_supported)
1292                 mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1293         else
1294                 return;
1295
1296         bf->bf_cap = ebf ? ebf : dev->ibf << 1;
1297         bf->bw = sta->deflink.bandwidth;
1298         bf->ibf_dbw = sta->deflink.bandwidth;
1299         bf->ibf_nrow = tx_ant;
1300
1301         if (!ebf && sta->deflink.bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1302                 bf->ibf_timeout = 0x48;
1303         else
1304                 bf->ibf_timeout = 0x18;
1305
1306         if (ebf && bf->nrow != tx_ant)
1307                 bf->mem_20m = matrix[tx_ant][bf->ncol];
1308         else
1309                 bf->mem_20m = matrix[bf->nrow][bf->ncol];
1310
1311         switch (sta->deflink.bandwidth) {
1312         case IEEE80211_STA_RX_BW_160:
1313         case IEEE80211_STA_RX_BW_80:
1314                 bf->mem_total = bf->mem_20m * 2;
1315                 break;
1316         case IEEE80211_STA_RX_BW_40:
1317                 bf->mem_total = bf->mem_20m;
1318                 break;
1319         case IEEE80211_STA_RX_BW_20:
1320         default:
1321                 break;
1322         }
1323 }
1324
1325 static void
1326 mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1327                         struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1328 {
1329         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1330         struct mt7915_phy *phy = mvif->phy;
1331         int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1332         struct sta_rec_bfee *bfee;
1333         struct tlv *tlv;
1334         u8 nrow = 0;
1335
1336         if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
1337                 return;
1338
1339         if (!mt7915_is_ebf_supported(phy, vif, sta, true))
1340                 return;
1341
1342         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1343         bfee = (struct sta_rec_bfee *)tlv;
1344
1345         if (sta->deflink.he_cap.has_he) {
1346                 struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1347
1348                 nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1349                               pe->phy_cap_info[5]);
1350         } else if (sta->deflink.vht_cap.vht_supported) {
1351                 struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1352
1353                 nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1354                                  pc->cap);
1355         }
1356
1357         /* reply with identity matrix to avoid 2x2 BF negative gain */
1358         bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
1359 }
1360
1361 static enum mcu_mmps_mode
1362 mt7915_mcu_get_mmps_mode(enum ieee80211_smps_mode smps)
1363 {
1364         switch (smps) {
1365         case IEEE80211_SMPS_OFF:
1366                 return MCU_MMPS_DISABLE;
1367         case IEEE80211_SMPS_STATIC:
1368                 return MCU_MMPS_STATIC;
1369         case IEEE80211_SMPS_DYNAMIC:
1370                 return MCU_MMPS_DYNAMIC;
1371         default:
1372                 return MCU_MMPS_DISABLE;
1373         }
1374 }
1375
1376 int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
1377                                    struct ieee80211_vif *vif,
1378                                    struct ieee80211_sta *sta,
1379                                    void *data, u32 field)
1380 {
1381         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1382         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1383         struct sta_phy *phy = data;
1384         struct sta_rec_ra_fixed *ra;
1385         struct sk_buff *skb;
1386         struct tlv *tlv;
1387
1388         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1389                                             &msta->wcid);
1390         if (IS_ERR(skb))
1391                 return PTR_ERR(skb);
1392
1393         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
1394         ra = (struct sta_rec_ra_fixed *)tlv;
1395
1396         switch (field) {
1397         case RATE_PARAM_AUTO:
1398                 break;
1399         case RATE_PARAM_FIXED:
1400         case RATE_PARAM_FIXED_MCS:
1401         case RATE_PARAM_FIXED_GI:
1402         case RATE_PARAM_FIXED_HE_LTF:
1403                 if (phy)
1404                         ra->phy = *phy;
1405                 break;
1406         case RATE_PARAM_MMPS_UPDATE:
1407                 ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->smps_mode);
1408                 break;
1409         default:
1410                 break;
1411         }
1412         ra->field = cpu_to_le32(field);
1413
1414         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1415                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1416 }
1417
1418 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1419                         struct ieee80211_sta *sta)
1420 {
1421         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1422         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1423         struct wtbl_req_hdr *wtbl_hdr;
1424         struct tlv *sta_wtbl;
1425         struct sk_buff *skb;
1426         int ret;
1427
1428         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1429                                             &msta->wcid);
1430         if (IS_ERR(skb))
1431                 return PTR_ERR(skb);
1432
1433         sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1434                                            sizeof(struct tlv));
1435         wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1436                                                   WTBL_SET, sta_wtbl, &skb);
1437         if (IS_ERR(wtbl_hdr))
1438                 return PTR_ERR(wtbl_hdr);
1439
1440         mt76_connac_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1441
1442         ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1443                                     MCU_EXT_CMD(STA_REC_UPDATE), true);
1444         if (ret)
1445                 return ret;
1446
1447         return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, NULL,
1448                                               RATE_PARAM_MMPS_UPDATE);
1449 }
1450
1451 static int
1452 mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
1453                                struct ieee80211_vif *vif,
1454                                struct ieee80211_sta *sta)
1455 {
1456         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1457         struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1458         struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1459         enum nl80211_band band = chandef->chan->band;
1460         struct sta_phy phy = {};
1461         int ret, nrates = 0;
1462
1463 #define __sta_phy_bitrate_mask_check(_mcs, _gi, _he)                            \
1464         do {                                                                    \
1465                 u8 i, gi = mask->control[band]._gi;                             \
1466                 gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;               \
1467                 for (i = 0; i <= sta->deflink.bandwidth; i++) {                 \
1468                         phy.sgi |= gi << (i << (_he));                          \
1469                         phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
1470                 }                                                               \
1471                 for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {    \
1472                         if (!mask->control[band]._mcs[i])                       \
1473                                 continue;                                       \
1474                         nrates += hweight16(mask->control[band]._mcs[i]);       \
1475                         phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;         \
1476                 }                                                               \
1477         } while (0)
1478
1479         if (sta->deflink.he_cap.has_he) {
1480                 __sta_phy_bitrate_mask_check(he_mcs, he_gi, 1);
1481         } else if (sta->deflink.vht_cap.vht_supported) {
1482                 __sta_phy_bitrate_mask_check(vht_mcs, gi, 0);
1483         } else if (sta->deflink.ht_cap.ht_supported) {
1484                 __sta_phy_bitrate_mask_check(ht_mcs, gi, 0);
1485         } else {
1486                 nrates = hweight32(mask->control[band].legacy);
1487                 phy.mcs = ffs(mask->control[band].legacy) - 1;
1488         }
1489 #undef __sta_phy_bitrate_mask_check
1490
1491         /* fall back to auto rate control */
1492         if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
1493             mask->control[band].he_gi == GENMASK(7, 0) &&
1494             mask->control[band].he_ltf == GENMASK(7, 0) &&
1495             nrates != 1)
1496                 return 0;
1497
1498         /* fixed single rate */
1499         if (nrates == 1) {
1500                 ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1501                                                      RATE_PARAM_FIXED_MCS);
1502                 if (ret)
1503                         return ret;
1504         }
1505
1506         /* fixed GI */
1507         if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
1508             mask->control[band].he_gi != GENMASK(7, 0)) {
1509                 struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1510                 u32 addr;
1511
1512                 /* firmware updates only TXCMD but doesn't take WTBL into
1513                  * account, so driver should update here to reflect the
1514                  * actual txrate hardware sends out.
1515                  */
1516                 addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
1517                 if (sta->deflink.he_cap.has_he)
1518                         mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
1519                 else
1520                         mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
1521
1522                 ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1523                                                      RATE_PARAM_FIXED_GI);
1524                 if (ret)
1525                         return ret;
1526         }
1527
1528         /* fixed HE_LTF */
1529         if (mask->control[band].he_ltf != GENMASK(7, 0)) {
1530                 ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1531                                                      RATE_PARAM_FIXED_HE_LTF);
1532                 if (ret)
1533                         return ret;
1534         }
1535
1536         return 0;
1537 }
1538
1539 static void
1540 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
1541                              struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1542 {
1543         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1544         struct mt76_phy *mphy = mvif->phy->mt76;
1545         struct cfg80211_chan_def *chandef = &mphy->chandef;
1546         struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1547         enum nl80211_band band = chandef->chan->band;
1548         struct sta_rec_ra *ra;
1549         struct tlv *tlv;
1550         u32 supp_rate = sta->deflink.supp_rates[band];
1551         u32 cap = sta->wme ? STA_CAP_WMM : 0;
1552
1553         tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
1554         ra = (struct sta_rec_ra *)tlv;
1555
1556         ra->valid = true;
1557         ra->auto_rate = true;
1558         ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
1559         ra->channel = chandef->chan->hw_value;
1560         ra->bw = sta->deflink.bandwidth;
1561         ra->phy.bw = sta->deflink.bandwidth;
1562         ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->smps_mode);
1563
1564         if (supp_rate) {
1565                 supp_rate &= mask->control[band].legacy;
1566                 ra->rate_len = hweight32(supp_rate);
1567
1568                 if (band == NL80211_BAND_2GHZ) {
1569                         ra->supp_mode = MODE_CCK;
1570                         ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
1571
1572                         if (ra->rate_len > 4) {
1573                                 ra->supp_mode |= MODE_OFDM;
1574                                 ra->supp_ofdm_rate = supp_rate >> 4;
1575                         }
1576                 } else {
1577                         ra->supp_mode = MODE_OFDM;
1578                         ra->supp_ofdm_rate = supp_rate;
1579                 }
1580         }
1581
1582         if (sta->deflink.ht_cap.ht_supported) {
1583                 ra->supp_mode |= MODE_HT;
1584                 ra->af = sta->deflink.ht_cap.ampdu_factor;
1585                 ra->ht_gf = !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
1586
1587                 cap |= STA_CAP_HT;
1588                 if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1589                         cap |= STA_CAP_SGI_20;
1590                 if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1591                         cap |= STA_CAP_SGI_40;
1592                 if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
1593                         cap |= STA_CAP_TX_STBC;
1594                 if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
1595                         cap |= STA_CAP_RX_STBC;
1596                 if (mvif->cap.ht_ldpc &&
1597                     (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
1598                         cap |= STA_CAP_LDPC;
1599
1600                 mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
1601                                           mask->control[band].ht_mcs);
1602                 ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
1603         }
1604
1605         if (sta->deflink.vht_cap.vht_supported) {
1606                 u8 af;
1607
1608                 ra->supp_mode |= MODE_VHT;
1609                 af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1610                                sta->deflink.vht_cap.cap);
1611                 ra->af = max_t(u8, ra->af, af);
1612
1613                 cap |= STA_CAP_VHT;
1614                 if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1615                         cap |= STA_CAP_VHT_SGI_80;
1616                 if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1617                         cap |= STA_CAP_VHT_SGI_160;
1618                 if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
1619                         cap |= STA_CAP_VHT_TX_STBC;
1620                 if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
1621                         cap |= STA_CAP_VHT_RX_STBC;
1622                 if (mvif->cap.vht_ldpc &&
1623                     (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
1624                         cap |= STA_CAP_VHT_LDPC;
1625
1626                 mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
1627                                            mask->control[band].vht_mcs);
1628         }
1629
1630         if (sta->deflink.he_cap.has_he) {
1631                 ra->supp_mode |= MODE_HE;
1632                 cap |= STA_CAP_HE;
1633
1634                 if (sta->deflink.he_6ghz_capa.capa)
1635                         ra->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
1636                                                IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1637         }
1638
1639         ra->sta_cap = cpu_to_le32(cap);
1640 }
1641
1642 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1643                              struct ieee80211_sta *sta, bool changed)
1644 {
1645         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1646         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1647         struct sk_buff *skb;
1648         int ret;
1649
1650         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1651                                             &msta->wcid);
1652         if (IS_ERR(skb))
1653                 return PTR_ERR(skb);
1654
1655         /* firmware rc algorithm refers to sta_rec_he for HE control.
1656          * once dev->rc_work changes the settings driver should also
1657          * update sta_rec_he here.
1658          */
1659         if (changed)
1660                 mt7915_mcu_sta_he_tlv(skb, sta, vif);
1661
1662         /* sta_rec_ra accommodates BW, NSS and only MCS range format
1663          * i.e 0-{7,8,9} for VHT.
1664          */
1665         mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
1666
1667         ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1668                                     MCU_EXT_CMD(STA_REC_UPDATE), true);
1669         if (ret)
1670                 return ret;
1671
1672         /* sta_rec_ra_fixed accommodates single rate, (HE)GI and HE_LTE,
1673          * and updates as peer fixed rate parameters, which overrides
1674          * sta_rec_ra and firmware rate control algorithm.
1675          */
1676         return mt7915_mcu_add_rate_ctrl_fixed(dev, vif, sta);
1677 }
1678
1679 static int
1680 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1681                      struct ieee80211_sta *sta)
1682 {
1683 #define MT_STA_BSS_GROUP                1
1684         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1685         struct mt7915_sta *msta;
1686         struct {
1687                 __le32 action;
1688                 u8 wlan_idx_lo;
1689                 u8 status;
1690                 u8 wlan_idx_hi;
1691                 u8 rsv0[5];
1692                 __le32 val;
1693                 u8 rsv1[8];
1694         } __packed req = {
1695                 .action = cpu_to_le32(MT_STA_BSS_GROUP),
1696                 .val = cpu_to_le32(mvif->mt76.idx % 16),
1697         };
1698
1699         msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1700         req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
1701         req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
1702
1703         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL), &req,
1704                                  sizeof(req), true);
1705 }
1706
1707 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1708                        struct ieee80211_sta *sta, bool enable)
1709 {
1710         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1711         struct mt7915_sta *msta;
1712         struct sk_buff *skb;
1713         int ret;
1714
1715         msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1716
1717         skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1718                                             &msta->wcid);
1719         if (IS_ERR(skb))
1720                 return PTR_ERR(skb);
1721
1722         /* starec basic */
1723         mt76_connac_mcu_sta_basic_tlv(skb, vif, sta, enable, true);
1724         if (!enable)
1725                 goto out;
1726
1727         /* tag order is in accordance with firmware dependency. */
1728         if (sta) {
1729                 /* starec bfer */
1730                 mt7915_mcu_sta_bfer_tlv(dev, skb, vif, sta);
1731                 /* starec ht */
1732                 mt7915_mcu_sta_ht_tlv(skb, sta);
1733                 /* starec vht */
1734                 mt7915_mcu_sta_vht_tlv(skb, sta);
1735                 /* starec uapsd */
1736                 mt76_connac_mcu_sta_uapsd(skb, vif, sta);
1737         }
1738
1739         ret = mt7915_mcu_sta_wtbl_tlv(dev, skb, vif, sta);
1740         if (ret) {
1741                 dev_kfree_skb(skb);
1742                 return ret;
1743         }
1744
1745         if (sta) {
1746                 /* starec amsdu */
1747                 mt7915_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
1748                 /* starec he */
1749                 mt7915_mcu_sta_he_tlv(skb, sta, vif);
1750                 /* starec muru */
1751                 mt7915_mcu_sta_muru_tlv(skb, sta, vif);
1752                 /* starec bfee */
1753                 mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
1754         }
1755
1756         ret = mt7915_mcu_add_group(dev, vif, sta);
1757         if (ret) {
1758                 dev_kfree_skb(skb);
1759                 return ret;
1760         }
1761 out:
1762         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1763                                      MCU_EXT_CMD(STA_REC_UPDATE), true);
1764 }
1765
1766 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
1767                             struct ieee80211_vif *vif, bool enable)
1768 {
1769         struct mt7915_dev *dev = phy->dev;
1770         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1771         struct {
1772                 struct req_hdr {
1773                         u8 omac_idx;
1774                         u8 dbdc_idx;
1775                         __le16 tlv_num;
1776                         u8 is_tlv_append;
1777                         u8 rsv[3];
1778                 } __packed hdr;
1779                 struct req_tlv {
1780                         __le16 tag;
1781                         __le16 len;
1782                         u8 active;
1783                         u8 dbdc_idx;
1784                         u8 omac_addr[ETH_ALEN];
1785                 } __packed tlv;
1786         } data = {
1787                 .hdr = {
1788                         .omac_idx = mvif->mt76.omac_idx,
1789                         .dbdc_idx = mvif->mt76.band_idx,
1790                         .tlv_num = cpu_to_le16(1),
1791                         .is_tlv_append = 1,
1792                 },
1793                 .tlv = {
1794                         .tag = cpu_to_le16(DEV_INFO_ACTIVE),
1795                         .len = cpu_to_le16(sizeof(struct req_tlv)),
1796                         .active = enable,
1797                         .dbdc_idx = mvif->mt76.band_idx,
1798                 },
1799         };
1800
1801         if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
1802                 return mt7915_mcu_muar_config(phy, vif, false, enable);
1803
1804         memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
1805         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
1806                                  &data, sizeof(data), true);
1807 }
1808
1809 static void
1810 mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
1811                          struct sk_buff *skb, struct bss_info_bcn *bcn,
1812                          struct ieee80211_mutable_offsets *offs)
1813 {
1814         struct bss_info_bcn_cntdwn *info;
1815         struct tlv *tlv;
1816         int sub_tag;
1817
1818         if (!offs->cntdwn_counter_offs[0])
1819                 return;
1820
1821         sub_tag = vif->csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
1822         tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
1823                                            &bcn->sub_ntlv, &bcn->len);
1824         info = (struct bss_info_bcn_cntdwn *)tlv;
1825         info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
1826 }
1827
1828 static void
1829 mt7915_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
1830                        struct ieee80211_vif *vif, struct bss_info_bcn *bcn,
1831                        struct ieee80211_mutable_offsets *offs)
1832 {
1833         struct bss_info_bcn_mbss *mbss;
1834         const struct element *elem;
1835         struct tlv *tlv;
1836
1837         if (!vif->bss_conf.bssid_indicator)
1838                 return;
1839
1840         tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_MBSSID,
1841                                            sizeof(*mbss), &bcn->sub_ntlv,
1842                                            &bcn->len);
1843
1844         mbss = (struct bss_info_bcn_mbss *)tlv;
1845         mbss->offset[0] = cpu_to_le16(offs->tim_offset);
1846         mbss->bitmap = cpu_to_le32(1);
1847
1848         for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
1849                             &skb->data[offs->mbssid_off],
1850                             skb->len - offs->mbssid_off) {
1851                 const struct element *sub_elem;
1852
1853                 if (elem->datalen < 2)
1854                         continue;
1855
1856                 for_each_element(sub_elem, elem->data + 1, elem->datalen - 1) {
1857                         const struct ieee80211_bssid_index *idx;
1858                         const u8 *idx_ie;
1859
1860                         if (sub_elem->id || sub_elem->datalen < 4)
1861                                 continue; /* not a valid BSS profile */
1862
1863                         /* Find WLAN_EID_MULTI_BSSID_IDX
1864                          * in the merged nontransmitted profile
1865                          */
1866                         idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
1867                                                   sub_elem->data,
1868                                                   sub_elem->datalen);
1869                         if (!idx_ie || idx_ie[1] < sizeof(*idx))
1870                                 continue;
1871
1872                         idx = (void *)(idx_ie + 2);
1873                         if (!idx->bssid_index || idx->bssid_index > 31)
1874                                 continue;
1875
1876                         mbss->offset[idx->bssid_index] =
1877                                 cpu_to_le16(idx_ie - skb->data);
1878                         mbss->bitmap |= cpu_to_le32(BIT(idx->bssid_index));
1879                 }
1880         }
1881 }
1882
1883 static void
1884 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1885                        struct sk_buff *rskb, struct sk_buff *skb,
1886                        struct bss_info_bcn *bcn,
1887                        struct ieee80211_mutable_offsets *offs)
1888 {
1889         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1890         struct bss_info_bcn_cont *cont;
1891         struct tlv *tlv;
1892         u8 *buf;
1893         int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
1894
1895         len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1896         tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
1897                                            len, &bcn->sub_ntlv, &bcn->len);
1898
1899         cont = (struct bss_info_bcn_cont *)tlv;
1900         cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1901         cont->tim_ofs = cpu_to_le16(offs->tim_offset);
1902
1903         if (offs->cntdwn_counter_offs[0]) {
1904                 u16 offset = offs->cntdwn_counter_offs[0];
1905
1906                 if (vif->csa_active)
1907                         cont->csa_ofs = cpu_to_le16(offset - 4);
1908                 if (vif->color_change_active)
1909                         cont->bcc_ofs = cpu_to_le16(offset - 3);
1910         }
1911
1912         buf = (u8 *)tlv + sizeof(*cont);
1913         mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
1914                               BSS_CHANGED_BEACON);
1915         memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1916 }
1917
1918 static void
1919 mt7915_mcu_beacon_check_caps(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1920                              struct sk_buff *skb)
1921 {
1922         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1923         struct mt7915_vif_cap *vc = &mvif->cap;
1924         const struct ieee80211_he_cap_elem *he;
1925         const struct ieee80211_vht_cap *vht;
1926         const struct ieee80211_ht_cap *ht;
1927         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
1928         const u8 *ie;
1929         u32 len, bc;
1930
1931         /* Check missing configuration options to allow AP mode in mac80211
1932          * to remain in sync with hostapd settings, and get a subset of
1933          * beacon and hardware capabilities.
1934          */
1935         if (WARN_ON_ONCE(skb->len <= (mgmt->u.beacon.variable - skb->data)))
1936                 return;
1937
1938         memset(vc, 0, sizeof(*vc));
1939
1940         len = skb->len - (mgmt->u.beacon.variable - skb->data);
1941
1942         ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, mgmt->u.beacon.variable,
1943                               len);
1944         if (ie && ie[1] >= sizeof(*ht)) {
1945                 ht = (void *)(ie + 2);
1946                 vc->ht_ldpc = !!(le16_to_cpu(ht->cap_info) &
1947                                  IEEE80211_HT_CAP_LDPC_CODING);
1948         }
1949
1950         ie = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, mgmt->u.beacon.variable,
1951                               len);
1952         if (ie && ie[1] >= sizeof(*vht)) {
1953                 u32 pc = phy->mt76->sband_5g.sband.vht_cap.cap;
1954
1955                 vht = (void *)(ie + 2);
1956                 bc = le32_to_cpu(vht->vht_cap_info);
1957
1958                 vc->vht_ldpc = !!(bc & IEEE80211_VHT_CAP_RXLDPC);
1959                 vc->vht_su_ebfer =
1960                         (bc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE) &&
1961                         (pc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1962                 vc->vht_su_ebfee =
1963                         (bc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE) &&
1964                         (pc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1965                 vc->vht_mu_ebfer =
1966                         (bc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE) &&
1967                         (pc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE);
1968                 vc->vht_mu_ebfee =
1969                         (bc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) &&
1970                         (pc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1971         }
1972
1973         ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY,
1974                                   mgmt->u.beacon.variable, len);
1975         if (ie && ie[1] >= sizeof(*he) + 1) {
1976                 const struct ieee80211_sta_he_cap *pc =
1977                         mt76_connac_get_he_phy_cap(phy->mt76, vif);
1978                 const struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1979
1980                 he = (void *)(ie + 3);
1981
1982                 vc->he_ldpc =
1983                         HE_PHY(CAP1_LDPC_CODING_IN_PAYLOAD, pe->phy_cap_info[1]);
1984                 vc->he_su_ebfer =
1985                         HE_PHY(CAP3_SU_BEAMFORMER, he->phy_cap_info[3]) &&
1986                         HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1987                 vc->he_su_ebfee =
1988                         HE_PHY(CAP4_SU_BEAMFORMEE, he->phy_cap_info[4]) &&
1989                         HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1990                 vc->he_mu_ebfer =
1991                         HE_PHY(CAP4_MU_BEAMFORMER, he->phy_cap_info[4]) &&
1992                         HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4]);
1993         }
1994 }
1995
1996 static void
1997 mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1998                                 struct sk_buff *rskb, struct bss_info_bcn *bcn,
1999                                 u32 changed)
2000 {
2001 #define OFFLOAD_TX_MODE_SU      BIT(0)
2002 #define OFFLOAD_TX_MODE_MU      BIT(1)
2003         struct ieee80211_hw *hw = mt76_hw(dev);
2004         struct mt7915_phy *phy = mt7915_hw_phy(hw);
2005         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2006         struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
2007         enum nl80211_band band = chandef->chan->band;
2008         struct mt76_wcid *wcid = &dev->mt76.global_wcid;
2009         struct bss_info_inband_discovery *discov;
2010         struct ieee80211_tx_info *info;
2011         struct sk_buff *skb = NULL;
2012         struct tlv *tlv;
2013         bool ext_phy = phy != &dev->phy;
2014         u8 *buf, interval;
2015         int len;
2016
2017         if (changed & BSS_CHANGED_FILS_DISCOVERY &&
2018             vif->bss_conf.fils_discovery.max_interval) {
2019                 interval = vif->bss_conf.fils_discovery.max_interval;
2020                 skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
2021         } else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
2022                    vif->bss_conf.unsol_bcast_probe_resp_interval) {
2023                 interval = vif->bss_conf.unsol_bcast_probe_resp_interval;
2024                 skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
2025         }
2026
2027         if (!skb)
2028                 return;
2029
2030         info = IEEE80211_SKB_CB(skb);
2031         info->control.vif = vif;
2032         info->band = band;
2033
2034         if (ext_phy)
2035                 info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2036
2037         len = sizeof(*discov) + MT_TXD_SIZE + skb->len;
2038         len = (len & 0x3) ? ((len | 0x3) + 1) : len;
2039
2040         tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_DISCOV,
2041                                            len, &bcn->sub_ntlv, &bcn->len);
2042         discov = (struct bss_info_inband_discovery *)tlv;
2043         discov->tx_mode = OFFLOAD_TX_MODE_SU;
2044         /* 0: UNSOL PROBE RESP, 1: FILS DISCOV */
2045         discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
2046         discov->tx_interval = interval;
2047         discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2048         discov->enable = true;
2049
2050         buf = (u8 *)tlv + sizeof(*discov);
2051
2052         mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
2053                               changed);
2054         memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2055
2056         dev_kfree_skb(skb);
2057 }
2058
2059 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2060                           int en, u32 changed)
2061 {
2062 #define MAX_BEACON_SIZE 512
2063         struct mt7915_dev *dev = mt7915_hw_dev(hw);
2064         struct mt7915_phy *phy = mt7915_hw_phy(hw);
2065         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2066         struct ieee80211_mutable_offsets offs;
2067         struct ieee80211_tx_info *info;
2068         struct sk_buff *skb, *rskb;
2069         struct tlv *tlv;
2070         struct bss_info_bcn *bcn;
2071         int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
2072         bool ext_phy = phy != &dev->phy;
2073
2074         if (vif->bss_conf.nontransmitted)
2075                 return 0;
2076
2077         rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
2078                                                NULL, len);
2079         if (IS_ERR(rskb))
2080                 return PTR_ERR(rskb);
2081
2082         tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
2083         bcn = (struct bss_info_bcn *)tlv;
2084         bcn->enable = en;
2085
2086         if (!en)
2087                 goto out;
2088
2089         skb = ieee80211_beacon_get_template(hw, vif, &offs);
2090         if (!skb)
2091                 return -EINVAL;
2092
2093         if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
2094                 dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2095                 dev_kfree_skb(skb);
2096                 return -EINVAL;
2097         }
2098
2099         if (ext_phy) {
2100                 info = IEEE80211_SKB_CB(skb);
2101                 info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
2102         }
2103
2104         mt7915_mcu_beacon_check_caps(phy, vif, skb);
2105
2106         mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
2107         mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
2108         mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
2109         dev_kfree_skb(skb);
2110
2111         if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP ||
2112             changed & BSS_CHANGED_FILS_DISCOVERY)
2113                 mt7915_mcu_beacon_inband_discov(dev, vif, rskb,
2114                                                 bcn, changed);
2115
2116 out:
2117         return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2118                                      MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2119 }
2120
2121 static int mt7915_driver_own(struct mt7915_dev *dev, u8 band)
2122 {
2123         mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(band), MT_TOP_LPCR_HOST_DRV_OWN);
2124         if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND(band),
2125                             MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) {
2126                 dev_err(dev->mt76.dev, "Timeout for driver own\n");
2127                 return -EIO;
2128         }
2129
2130         /* clear irq when the driver own success */
2131         mt76_wr(dev, MT_TOP_LPCR_HOST_BAND_IRQ_STAT(band),
2132                 MT_TOP_LPCR_HOST_BAND_STAT);
2133
2134         return 0;
2135 }
2136
2137 static int mt7915_load_patch(struct mt7915_dev *dev)
2138 {
2139         const struct mt7915_patch_hdr *hdr;
2140         const struct firmware *fw = NULL;
2141         int i, ret, sem;
2142
2143         sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, 1);
2144         switch (sem) {
2145         case PATCH_IS_DL:
2146                 return 0;
2147         case PATCH_NOT_DL_SEM_SUCCESS:
2148                 break;
2149         default:
2150                 dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2151                 return -EAGAIN;
2152         }
2153
2154         ret = reject_firmware(&fw, fw_name_var(dev, ROM_PATCH),
2155                                dev->mt76.dev);
2156         if (ret)
2157                 goto out;
2158
2159         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2160                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2161                 ret = -EINVAL;
2162                 goto out;
2163         }
2164
2165         hdr = (const struct mt7915_patch_hdr *)(fw->data);
2166
2167         dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2168                  be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2169
2170         for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2171                 struct mt7915_patch_sec *sec;
2172                 const u8 *dl;
2173                 u32 len, addr;
2174
2175                 sec = (struct mt7915_patch_sec *)(fw->data + sizeof(*hdr) +
2176                                                   i * sizeof(*sec));
2177                 if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2178                     PATCH_SEC_TYPE_INFO) {
2179                         ret = -EINVAL;
2180                         goto out;
2181                 }
2182
2183                 addr = be32_to_cpu(sec->info.addr);
2184                 len = be32_to_cpu(sec->info.len);
2185                 dl = fw->data + be32_to_cpu(sec->offs);
2186
2187                 ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
2188                                                     DL_MODE_NEED_RSP);
2189                 if (ret) {
2190                         dev_err(dev->mt76.dev, "Download request failed\n");
2191                         goto out;
2192                 }
2193
2194                 ret = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2195                                                dl, len, 4096);
2196                 if (ret) {
2197                         dev_err(dev->mt76.dev, "Failed to send patch\n");
2198                         goto out;
2199                 }
2200         }
2201
2202         ret = mt76_connac_mcu_start_patch(&dev->mt76);
2203         if (ret)
2204                 dev_err(dev->mt76.dev, "Failed to start patch\n");
2205
2206 out:
2207         sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, 0);
2208         switch (sem) {
2209         case PATCH_REL_SEM_SUCCESS:
2210                 break;
2211         default:
2212                 ret = -EAGAIN;
2213                 dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
2214                 break;
2215         }
2216         release_firmware(fw);
2217
2218         return ret;
2219 }
2220
2221 static int
2222 mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
2223                              const struct mt7915_fw_trailer *hdr,
2224                              const u8 *data, bool is_wa)
2225 {
2226         int i, offset = 0;
2227         u32 override = 0, option = 0;
2228
2229         for (i = 0; i < hdr->n_region; i++) {
2230                 const struct mt7915_fw_region *region;
2231                 int err;
2232                 u32 len, addr, mode;
2233
2234                 region = (const struct mt7915_fw_region *)((const u8 *)hdr -
2235                          (hdr->n_region - i) * sizeof(*region));
2236                 mode = mt76_connac_mcu_gen_dl_mode(&dev->mt76,
2237                                                    region->feature_set, is_wa);
2238                 len = le32_to_cpu(region->len);
2239                 addr = le32_to_cpu(region->addr);
2240
2241                 if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2242                         override = addr;
2243
2244                 err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
2245                                                     mode);
2246                 if (err) {
2247                         dev_err(dev->mt76.dev, "Download request failed\n");
2248                         return err;
2249                 }
2250
2251                 err = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
2252                                                data + offset, len, 4096);
2253                 if (err) {
2254                         dev_err(dev->mt76.dev, "Failed to send firmware.\n");
2255                         return err;
2256                 }
2257
2258                 offset += len;
2259         }
2260
2261         if (override)
2262                 option |= FW_START_OVERRIDE;
2263
2264         if (is_wa)
2265                 option |= FW_START_WORKING_PDA_CR4;
2266
2267         return mt76_connac_mcu_start_firmware(&dev->mt76, override, option);
2268 }
2269
2270 static int mt7915_load_ram(struct mt7915_dev *dev)
2271 {
2272         const struct mt7915_fw_trailer *hdr;
2273         const struct firmware *fw;
2274         int ret;
2275
2276         ret = reject_firmware(&fw, fw_name_var(dev, FIRMWARE_WM),
2277                                dev->mt76.dev);
2278         if (ret)
2279                 return ret;
2280
2281         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2282                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2283                 ret = -EINVAL;
2284                 goto out;
2285         }
2286
2287         hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2288                                         sizeof(*hdr));
2289
2290         dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2291                  hdr->fw_ver, hdr->build_date);
2292
2293         ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2294         if (ret) {
2295                 dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
2296                 goto out;
2297         }
2298
2299         release_firmware(fw);
2300
2301         ret = reject_firmware(&fw, fw_name(dev, FIRMWARE_WA),
2302                                dev->mt76.dev);
2303         if (ret)
2304                 return ret;
2305
2306         if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2307                 dev_err(dev->mt76.dev, "Invalid firmware\n");
2308                 ret = -EINVAL;
2309                 goto out;
2310         }
2311
2312         hdr = (const struct mt7915_fw_trailer *)(fw->data + fw->size -
2313                                         sizeof(*hdr));
2314
2315         dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2316                  hdr->fw_ver, hdr->build_date);
2317
2318         ret = mt7915_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2319         if (ret) {
2320                 dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
2321                 goto out;
2322         }
2323
2324         snprintf(dev->mt76.hw->wiphy->fw_version,
2325                  sizeof(dev->mt76.hw->wiphy->fw_version),
2326                  "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2327
2328 out:
2329         release_firmware(fw);
2330
2331         return ret;
2332 }
2333
2334 static int
2335 mt7915_firmware_state(struct mt7915_dev *dev, bool wa)
2336 {
2337         u32 state = FIELD_PREP(MT_TOP_MISC_FW_STATE,
2338                                wa ? FW_STATE_RDY : FW_STATE_FW_DOWNLOAD);
2339
2340         if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2341                             state, 1000)) {
2342                 dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2343                 return -EIO;
2344         }
2345         return 0;
2346 }
2347
2348 static int mt7915_load_firmware(struct mt7915_dev *dev)
2349 {
2350         int ret;
2351
2352         /* make sure fw is download state */
2353         if (mt7915_firmware_state(dev, false)) {
2354                 /* restart firmware once */
2355                 __mt76_mcu_restart(&dev->mt76);
2356                 ret = mt7915_firmware_state(dev, false);
2357                 if (ret) {
2358                         dev_err(dev->mt76.dev,
2359                                 "Firmware is not ready for download\n");
2360                         return ret;
2361                 }
2362         }
2363
2364         ret = mt7915_load_patch(dev);
2365         if (ret)
2366                 return ret;
2367
2368         ret = mt7915_load_ram(dev);
2369         if (ret)
2370                 return ret;
2371
2372         ret = mt7915_firmware_state(dev, true);
2373         if (ret)
2374                 return ret;
2375
2376         mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2377
2378         dev_dbg(dev->mt76.dev, "Firmware init done\n");
2379
2380         return 0;
2381 }
2382
2383 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl)
2384 {
2385         struct {
2386                 u8 ctrl_val;
2387                 u8 pad[3];
2388         } data = {
2389                 .ctrl_val = ctrl
2390         };
2391
2392         if (type == MCU_FW_LOG_WA)
2393                 return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(FW_LOG_2_HOST),
2394                                          &data, sizeof(data), true);
2395
2396         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2397                                  sizeof(data), true);
2398 }
2399
2400 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2401 {
2402         struct {
2403                 u8 ver;
2404                 u8 pad;
2405                 __le16 len;
2406                 u8 level;
2407                 u8 rsv[3];
2408                 __le32 module_idx;
2409         } data = {
2410                 .module_idx = cpu_to_le32(module),
2411                 .level = level,
2412         };
2413
2414         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2415                                  sizeof(data), false);
2416 }
2417
2418 int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enabled)
2419 {
2420         struct {
2421                 __le32 cmd;
2422                 u8 enable;
2423         } data = {
2424                 .cmd = cpu_to_le32(MURU_SET_TXC_TX_STATS_EN),
2425                 .enable = enabled,
2426         };
2427
2428         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &data,
2429                                 sizeof(data), false);
2430 }
2431
2432 int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy, void *ms)
2433 {
2434         struct mt7915_dev *dev = phy->dev;
2435         struct sk_buff *skb;
2436         struct mt7915_mcu_muru_stats *mu_stats =
2437                                 (struct mt7915_mcu_muru_stats *)ms;
2438         int ret;
2439
2440         struct {
2441                 __le32 cmd;
2442                 u8 band_idx;
2443         } req = {
2444                 .cmd = cpu_to_le32(MURU_GET_TXC_TX_STATS),
2445                 .band_idx = phy->band_idx,
2446         };
2447
2448         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
2449                                         &req, sizeof(req), true, &skb);
2450         if (ret)
2451                 return ret;
2452
2453         memcpy(mu_stats, skb->data, sizeof(struct mt7915_mcu_muru_stats));
2454         dev_kfree_skb(skb);
2455
2456         return 0;
2457 }
2458
2459 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2460 {
2461         struct {
2462                 u8 enable;
2463                 u8 _rsv[3];
2464         } __packed req = {
2465                 .enable = enabled
2466         };
2467
2468         return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2469                                  sizeof(req), false);
2470 }
2471
2472 int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val)
2473 {
2474         struct {
2475                 __le32 cmd;
2476                 u8 val[4];
2477         } __packed req = {
2478                 .cmd = cpu_to_le32(cmd),
2479         };
2480
2481         put_unaligned_le32(val, req.val);
2482
2483         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
2484                                  sizeof(req), false);
2485 }
2486
2487 static int
2488 mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
2489 {
2490 #define RX_AIRTIME_FEATURE_CTRL         1
2491 #define RX_AIRTIME_BITWISE_CTRL         2
2492 #define RX_AIRTIME_CLEAR_EN     1
2493         struct {
2494                 __le16 field;
2495                 __le16 sub_field;
2496                 __le32 set_status;
2497                 __le32 get_status;
2498                 u8 _rsv[12];
2499
2500                 bool airtime_en;
2501                 bool mibtime_en;
2502                 bool earlyend_en;
2503                 u8 _rsv1[9];
2504
2505                 bool airtime_clear;
2506                 bool mibtime_clear;
2507                 u8 _rsv2[98];
2508         } __packed req = {
2509                 .field = cpu_to_le16(RX_AIRTIME_BITWISE_CTRL),
2510                 .sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN),
2511                 .airtime_clear = true,
2512         };
2513         int ret;
2514
2515         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2516                                 sizeof(req), true);
2517         if (ret)
2518                 return ret;
2519
2520         req.field = cpu_to_le16(RX_AIRTIME_FEATURE_CTRL);
2521         req.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN);
2522         req.airtime_en = true;
2523
2524         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2525                                  sizeof(req), true);
2526 }
2527
2528 int mt7915_mcu_init(struct mt7915_dev *dev)
2529 {
2530         static const struct mt76_mcu_ops mt7915_mcu_ops = {
2531                 .headroom = sizeof(struct mt7915_mcu_txd),
2532                 .mcu_skb_send_msg = mt7915_mcu_send_message,
2533                 .mcu_parse_response = mt7915_mcu_parse_response,
2534                 .mcu_restart = mt76_connac_mcu_restart,
2535         };
2536         int ret;
2537
2538         dev->mt76.mcu_ops = &mt7915_mcu_ops;
2539
2540         /* force firmware operation mode into normal state,
2541          * which should be set before firmware download stage.
2542          */
2543         mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
2544
2545         ret = mt7915_driver_own(dev, 0);
2546         if (ret)
2547                 return ret;
2548         /* set driver own for band1 when two hif exist */
2549         if (dev->hif2) {
2550                 ret = mt7915_driver_own(dev, 1);
2551                 if (ret)
2552                         return ret;
2553         }
2554
2555         ret = mt7915_load_firmware(dev);
2556         if (ret)
2557                 return ret;
2558
2559         set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2560         ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
2561         if (ret)
2562                 return ret;
2563
2564         ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, 0);
2565         if (ret)
2566                 return ret;
2567
2568         if (mtk_wed_device_active(&dev->mt76.mmio.wed))
2569                 mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY), 0, 0, 0);
2570
2571         ret = mt7915_mcu_set_mwds(dev, 1);
2572         if (ret)
2573                 return ret;
2574
2575         ret = mt7915_mcu_set_muru_ctrl(dev, MURU_SET_PLATFORM_TYPE,
2576                                        MURU_PLATFORM_TYPE_PERF_LEVEL_2);
2577         if (ret)
2578                 return ret;
2579
2580         ret = mt7915_mcu_init_rx_airtime(dev);
2581         if (ret)
2582                 return ret;
2583
2584         return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
2585                                  MCU_WA_PARAM_RED, 0, 0);
2586 }
2587
2588 void mt7915_mcu_exit(struct mt7915_dev *dev)
2589 {
2590         __mt76_mcu_restart(&dev->mt76);
2591         if (mt7915_firmware_state(dev, false)) {
2592                 dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2593                 return;
2594         }
2595
2596         mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
2597         if (dev->hif2)
2598                 mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
2599                         MT_TOP_LPCR_HOST_FW_OWN);
2600         skb_queue_purge(&dev->mt76.mcu.res_q);
2601 }
2602
2603 static int
2604 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
2605 {
2606         struct {
2607                 u8 operation;
2608                 u8 count;
2609                 u8 _rsv[2];
2610                 u8 index;
2611                 u8 enable;
2612                 __le16 etype;
2613         } req = {
2614                 .operation = 1,
2615                 .count = 1,
2616                 .enable = 1,
2617                 .etype = cpu_to_le16(ETH_P_PAE),
2618         };
2619
2620         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2621                                  &req, sizeof(req), false);
2622 }
2623
2624 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2625                        bool enable, bool hdr_trans)
2626 {
2627         struct {
2628                 u8 operation;
2629                 u8 enable;
2630                 u8 check_bssid;
2631                 u8 insert_vlan;
2632                 u8 remove_vlan;
2633                 u8 tid;
2634                 u8 mode;
2635                 u8 rsv;
2636         } __packed req_trans = {
2637                 .enable = hdr_trans,
2638         };
2639         struct {
2640                 u8 enable;
2641                 u8 band;
2642                 u8 rsv[2];
2643         } __packed req_mac = {
2644                 .enable = enable,
2645                 .band = band,
2646         };
2647         int ret;
2648
2649         ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2650                                 &req_trans, sizeof(req_trans), false);
2651         if (ret)
2652                 return ret;
2653
2654         if (hdr_trans)
2655                 mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
2656
2657         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
2658                                  &req_mac, sizeof(req_mac), true);
2659 }
2660
2661 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
2662 {
2663         struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
2664         u8 num = req->total;
2665         size_t len = sizeof(*req) -
2666                      (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
2667
2668         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
2669                                  len, true);
2670 }
2671
2672 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2673 {
2674 #define TX_CMD_MODE             1
2675         struct mt7915_mcu_tx req = {
2676                 .valid = true,
2677                 .mode = TX_CMD_MODE,
2678                 .total = IEEE80211_NUM_ACS,
2679         };
2680         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2681         int ac;
2682
2683         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2684                 struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2685                 struct edca *e = &req.edca[ac];
2686
2687                 e->set = WMM_PARAM_SET;
2688                 e->queue = ac + mvif->mt76.wmm_idx * MT7915_MAX_WMM_SETS;
2689                 e->aifs = q->aifs;
2690                 e->txop = cpu_to_le16(q->txop);
2691
2692                 if (q->cw_min)
2693                         e->cw_min = fls(q->cw_min);
2694                 else
2695                         e->cw_min = 5;
2696
2697                 if (q->cw_max)
2698                         e->cw_max = cpu_to_le16(fls(q->cw_max));
2699                 else
2700                         e->cw_max = cpu_to_le16(10);
2701         }
2702
2703         return mt7915_mcu_update_edca(dev, &req);
2704 }
2705
2706 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
2707 {
2708         struct {
2709                 __le32 tag;
2710                 __le16 min_lpn;
2711                 u8 rsv[2];
2712         } __packed req = {
2713                 .tag = cpu_to_le32(0x1),
2714                 .min_lpn = cpu_to_le16(val),
2715         };
2716
2717         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2718                                  sizeof(req), true);
2719 }
2720
2721 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
2722                             const struct mt7915_dfs_pulse *pulse)
2723 {
2724         struct {
2725                 __le32 tag;
2726
2727                 __le32 max_width;               /* us */
2728                 __le32 max_pwr;                 /* dbm */
2729                 __le32 min_pwr;                 /* dbm */
2730                 __le32 min_stgr_pri;            /* us */
2731                 __le32 max_stgr_pri;            /* us */
2732                 __le32 min_cr_pri;              /* us */
2733                 __le32 max_cr_pri;              /* us */
2734         } __packed req = {
2735                 .tag = cpu_to_le32(0x3),
2736
2737 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2738                 __req_field(max_width),
2739                 __req_field(max_pwr),
2740                 __req_field(min_pwr),
2741                 __req_field(min_stgr_pri),
2742                 __req_field(max_stgr_pri),
2743                 __req_field(min_cr_pri),
2744                 __req_field(max_cr_pri),
2745 #undef __req_field
2746         };
2747
2748         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2749                                  sizeof(req), true);
2750 }
2751
2752 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
2753                             const struct mt7915_dfs_pattern *pattern)
2754 {
2755         struct {
2756                 __le32 tag;
2757                 __le16 radar_type;
2758
2759                 u8 enb;
2760                 u8 stgr;
2761                 u8 min_crpn;
2762                 u8 max_crpn;
2763                 u8 min_crpr;
2764                 u8 min_pw;
2765                 __le32 min_pri;
2766                 __le32 max_pri;
2767                 u8 max_pw;
2768                 u8 min_crbn;
2769                 u8 max_crbn;
2770                 u8 min_stgpn;
2771                 u8 max_stgpn;
2772                 u8 min_stgpr;
2773                 u8 rsv[2];
2774                 __le32 min_stgpr_diff;
2775         } __packed req = {
2776                 .tag = cpu_to_le32(0x2),
2777                 .radar_type = cpu_to_le16(index),
2778
2779 #define __req_field_u8(field) .field = pattern->field
2780 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2781                 __req_field_u8(enb),
2782                 __req_field_u8(stgr),
2783                 __req_field_u8(min_crpn),
2784                 __req_field_u8(max_crpn),
2785                 __req_field_u8(min_crpr),
2786                 __req_field_u8(min_pw),
2787                 __req_field_u32(min_pri),
2788                 __req_field_u32(max_pri),
2789                 __req_field_u8(max_pw),
2790                 __req_field_u8(min_crbn),
2791                 __req_field_u8(max_crbn),
2792                 __req_field_u8(min_stgpn),
2793                 __req_field_u8(max_stgpn),
2794                 __req_field_u8(min_stgpr),
2795                 __req_field_u32(min_stgpr_diff),
2796 #undef __req_field_u8
2797 #undef __req_field_u32
2798         };
2799
2800         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2801                                  sizeof(req), true);
2802 }
2803
2804 static int
2805 mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
2806                                  struct cfg80211_chan_def *chandef,
2807                                  int cmd)
2808 {
2809         struct mt7915_dev *dev = phy->dev;
2810         struct mt76_phy *mphy = phy->mt76;
2811         struct ieee80211_channel *chan = mphy->chandef.chan;
2812         int freq = mphy->chandef.center_freq1;
2813         struct mt7915_mcu_background_chain_ctrl req = {
2814                 .monitor_scan_type = 2, /* simple rx */
2815         };
2816
2817         if (!chandef && cmd != CH_SWITCH_BACKGROUND_SCAN_STOP)
2818                 return -EINVAL;
2819
2820         if (!cfg80211_chandef_valid(&mphy->chandef))
2821                 return -EINVAL;
2822
2823         switch (cmd) {
2824         case CH_SWITCH_BACKGROUND_SCAN_START: {
2825                 req.chan = chan->hw_value;
2826                 req.central_chan = ieee80211_frequency_to_channel(freq);
2827                 req.bw = mt76_connac_chan_bw(&mphy->chandef);
2828                 req.monitor_chan = chandef->chan->hw_value;
2829                 req.monitor_central_chan =
2830                         ieee80211_frequency_to_channel(chandef->center_freq1);
2831                 req.monitor_bw = mt76_connac_chan_bw(chandef);
2832                 req.band_idx = phy != &dev->phy;
2833                 req.scan_mode = 1;
2834                 break;
2835         }
2836         case CH_SWITCH_BACKGROUND_SCAN_RUNNING:
2837                 req.monitor_chan = chandef->chan->hw_value;
2838                 req.monitor_central_chan =
2839                         ieee80211_frequency_to_channel(chandef->center_freq1);
2840                 req.band_idx = phy != &dev->phy;
2841                 req.scan_mode = 2;
2842                 break;
2843         case CH_SWITCH_BACKGROUND_SCAN_STOP:
2844                 req.chan = chan->hw_value;
2845                 req.central_chan = ieee80211_frequency_to_channel(freq);
2846                 req.bw = mt76_connac_chan_bw(&mphy->chandef);
2847                 req.tx_stream = hweight8(mphy->antenna_mask);
2848                 req.rx_stream = mphy->antenna_mask;
2849                 break;
2850         default:
2851                 return -EINVAL;
2852         }
2853         req.band = chandef ? chandef->chan->band == NL80211_BAND_5GHZ : 1;
2854
2855         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(OFFCH_SCAN_CTRL),
2856                                  &req, sizeof(req), false);
2857 }
2858
2859 int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
2860                                      struct cfg80211_chan_def *chandef)
2861 {
2862         struct mt7915_dev *dev = phy->dev;
2863         int err, region;
2864
2865         if (!chandef) { /* disable offchain */
2866                 err = mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_STOP, MT_RX_SEL2,
2867                                               0, 0);
2868                 if (err)
2869                         return err;
2870
2871                 return mt7915_mcu_background_chain_ctrl(phy, NULL,
2872                                 CH_SWITCH_BACKGROUND_SCAN_STOP);
2873         }
2874
2875         err = mt7915_mcu_background_chain_ctrl(phy, chandef,
2876                                                CH_SWITCH_BACKGROUND_SCAN_START);
2877         if (err)
2878                 return err;
2879
2880         switch (dev->mt76.region) {
2881         case NL80211_DFS_ETSI:
2882                 region = 0;
2883                 break;
2884         case NL80211_DFS_JP:
2885                 region = 2;
2886                 break;
2887         case NL80211_DFS_FCC:
2888         default:
2889                 region = 1;
2890                 break;
2891         }
2892
2893         return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_START, MT_RX_SEL2,
2894                                        0, region);
2895 }
2896
2897 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
2898 {
2899         static const u8 ch_band[] = {
2900                 [NL80211_BAND_2GHZ] = 0,
2901                 [NL80211_BAND_5GHZ] = 1,
2902                 [NL80211_BAND_6GHZ] = 2,
2903         };
2904         struct mt7915_dev *dev = phy->dev;
2905         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2906         int freq1 = chandef->center_freq1;
2907         struct {
2908                 u8 control_ch;
2909                 u8 center_ch;
2910                 u8 bw;
2911                 u8 tx_streams_num;
2912                 u8 rx_streams;  /* mask or num */
2913                 u8 switch_reason;
2914                 u8 band_idx;
2915                 u8 center_ch2;  /* for 80+80 only */
2916                 __le16 cac_case;
2917                 u8 channel_band;
2918                 u8 rsv0;
2919                 __le32 outband_freq;
2920                 u8 txpower_drop;
2921                 u8 ap_bw;
2922                 u8 ap_center_ch;
2923                 u8 rsv1[57];
2924         } __packed req = {
2925                 .control_ch = chandef->chan->hw_value,
2926                 .center_ch = ieee80211_frequency_to_channel(freq1),
2927                 .bw = mt76_connac_chan_bw(chandef),
2928                 .tx_streams_num = hweight8(phy->mt76->antenna_mask),
2929                 .rx_streams = phy->mt76->antenna_mask,
2930                 .band_idx = phy->band_idx,
2931                 .channel_band = ch_band[chandef->chan->band],
2932         };
2933
2934 #ifdef CONFIG_NL80211_TESTMODE
2935         if (phy->mt76->test.tx_antenna_mask &&
2936             (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
2937              phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES ||
2938              phy->mt76->test.state == MT76_TM_STATE_TX_CONT)) {
2939                 req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
2940                 req.rx_streams = phy->mt76->test.tx_antenna_mask;
2941
2942                 if (phy != &dev->phy)
2943                         req.rx_streams >>= dev->chainshift;
2944         }
2945 #endif
2946
2947         if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
2948             dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
2949                 req.switch_reason = CH_SWITCH_NORMAL;
2950         else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2951                 req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2952         else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
2953                                           NL80211_IFTYPE_AP))
2954                 req.switch_reason = CH_SWITCH_DFS;
2955         else
2956                 req.switch_reason = CH_SWITCH_NORMAL;
2957
2958         if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
2959                 req.rx_streams = hweight8(req.rx_streams);
2960
2961         if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
2962                 int freq2 = chandef->center_freq2;
2963
2964                 req.center_ch2 = ieee80211_frequency_to_channel(freq2);
2965         }
2966
2967         return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2968 }
2969
2970 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
2971 {
2972 #define MAX_PAGE_IDX_MASK       GENMASK(7, 5)
2973 #define PAGE_IDX_MASK           GENMASK(4, 2)
2974 #define PER_PAGE_SIZE           0x400
2975         struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
2976         u16 eeprom_size = mt7915_eeprom_size(dev);
2977         u8 total = DIV_ROUND_UP(eeprom_size, PER_PAGE_SIZE);
2978         u8 *eep = (u8 *)dev->mt76.eeprom.data;
2979         int eep_len;
2980         int i;
2981
2982         for (i = 0; i < total; i++, eep += eep_len) {
2983                 struct sk_buff *skb;
2984                 int ret;
2985
2986                 if (i == total - 1 && !!(eeprom_size % PER_PAGE_SIZE))
2987                         eep_len = eeprom_size % PER_PAGE_SIZE;
2988                 else
2989                         eep_len = PER_PAGE_SIZE;
2990
2991                 skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2992                                          sizeof(req) + eep_len);
2993                 if (!skb)
2994                         return -ENOMEM;
2995
2996                 req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
2997                              FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
2998                 req.len = cpu_to_le16(eep_len);
2999
3000                 skb_put_data(skb, &req, sizeof(req));
3001                 skb_put_data(skb, eep, eep_len);
3002
3003                 ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3004                                             MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
3005                 if (ret)
3006                         return ret;
3007         }
3008
3009         return 0;
3010 }
3011
3012 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
3013 {
3014         struct mt7915_mcu_eeprom req = {
3015                 .buffer_mode = EE_MODE_EFUSE,
3016                 .format = EE_FORMAT_WHOLE,
3017         };
3018
3019         if (dev->flash_mode)
3020                 return mt7915_mcu_set_eeprom_flash(dev);
3021
3022         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
3023                                  &req, sizeof(req), true);
3024 }
3025
3026 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
3027 {
3028         struct mt7915_mcu_eeprom_info req = {
3029                 .addr = cpu_to_le32(round_down(offset,
3030                                     MT7915_EEPROM_BLOCK_SIZE)),
3031         };
3032         struct mt7915_mcu_eeprom_info *res;
3033         struct sk_buff *skb;
3034         int ret;
3035         u8 *buf;
3036
3037         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_ACCESS), &req,
3038                                 sizeof(req), true, &skb);
3039         if (ret)
3040                 return ret;
3041
3042         res = (struct mt7915_mcu_eeprom_info *)skb->data;
3043         buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
3044         memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
3045         dev_kfree_skb(skb);
3046
3047         return 0;
3048 }
3049
3050 int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num)
3051 {
3052         struct {
3053                 u8 _rsv;
3054                 u8 version;
3055                 u8 die_idx;
3056                 u8 _rsv2;
3057         } __packed req = {
3058                 .version = 1,
3059         };
3060         struct sk_buff *skb;
3061         int ret;
3062
3063         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_FREE_BLOCK), &req,
3064                                         sizeof(req), true, &skb);
3065         if (ret)
3066                 return ret;
3067
3068         *block_num = *(u8 *)skb->data;
3069         dev_kfree_skb(skb);
3070
3071         return 0;
3072 }
3073
3074 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
3075                                   u8 *data, u32 len, int cmd)
3076 {
3077         struct {
3078                 u8 dir;
3079                 u8 valid;
3080                 __le16 bitmap;
3081                 s8 precal;
3082                 u8 action;
3083                 u8 band;
3084                 u8 idx;
3085                 u8 rsv[4];
3086                 __le32 len;
3087         } req = {};
3088         struct sk_buff *skb;
3089
3090         skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
3091         if (!skb)
3092                 return -ENOMEM;
3093
3094         req.idx = idx;
3095         req.len = cpu_to_le32(len);
3096         skb_put_data(skb, &req, sizeof(req));
3097         skb_put_data(skb, data, len);
3098
3099         return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
3100 }
3101
3102 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
3103 {
3104         u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3105         u32 total = MT_EE_CAL_GROUP_SIZE;
3106
3107         if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
3108                 return 0;
3109
3110         /*
3111          * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
3112          * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
3113          */
3114         while (total > 0) {
3115                 int ret, len;
3116
3117                 len = min_t(u32, total, MT_EE_CAL_UNIT);
3118
3119                 ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
3120                                              MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
3121                 if (ret)
3122                         return ret;
3123
3124                 total -= len;
3125                 cal += len;
3126                 idx++;
3127         }
3128
3129         return 0;
3130 }
3131
3132 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
3133 {
3134         int i;
3135
3136         for (i = 0; i < n_freqs; i++)
3137                 if (cur == freqs[i])
3138                         return i;
3139
3140         return -1;
3141 }
3142
3143 static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
3144 {
3145         static const u16 freq_list[] = {
3146                 5180, 5200, 5220, 5240,
3147                 5260, 5280, 5300, 5320,
3148                 5500, 5520, 5540, 5560,
3149                 5580, 5600, 5620, 5640,
3150                 5660, 5680, 5700, 5745,
3151                 5765, 5785, 5805, 5825
3152         };
3153         int offset_2g = ARRAY_SIZE(freq_list);
3154         int idx;
3155
3156         if (freq < 4000) {
3157                 if (freq < 2432)
3158                         return offset_2g;
3159                 if (freq < 2457)
3160                         return offset_2g + 1;
3161
3162                 return offset_2g + 2;
3163         }
3164
3165         if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
3166                 return -1;
3167
3168         if (bw != NL80211_CHAN_WIDTH_20) {
3169                 idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3170                                            freq + 10);
3171                 if (idx >= 0)
3172                         return idx;
3173
3174                 idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
3175                                            freq - 10);
3176                 if (idx >= 0)
3177                         return idx;
3178         }
3179
3180         return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
3181 }
3182
3183 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
3184 {
3185         struct mt7915_dev *dev = phy->dev;
3186         struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3187         u16 total = 2, center_freq = chandef->center_freq1;
3188         u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
3189         int idx;
3190
3191         if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
3192                 return 0;
3193
3194         idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
3195         if (idx < 0)
3196                 return -EINVAL;
3197
3198         /* Items: Tx DPD, Tx Flatness */
3199         idx = idx * 2;
3200         cal += MT_EE_CAL_GROUP_SIZE;
3201
3202         while (total--) {
3203                 int ret;
3204
3205                 cal += (idx * MT_EE_CAL_UNIT);
3206                 ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
3207                                              MCU_EXT_CMD(DPD_PRE_CAL_INFO));
3208                 if (ret)
3209                         return ret;
3210
3211                 idx++;
3212         }
3213
3214         return 0;
3215 }
3216
3217 int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
3218 {
3219         /* strict order */
3220         static const u32 offs[] = {
3221                 MIB_BUSY_TIME, MIB_TX_TIME, MIB_RX_TIME, MIB_OBSS_AIRTIME,
3222                 MIB_BUSY_TIME_V2, MIB_TX_TIME_V2, MIB_RX_TIME_V2,
3223                 MIB_OBSS_AIRTIME_V2
3224         };
3225         struct mt76_channel_state *state = phy->mt76->chan_state;
3226         struct mt76_channel_state *state_ts = &phy->state_ts;
3227         struct mt7915_dev *dev = phy->dev;
3228         struct mt7915_mcu_mib *res, req[4];
3229         struct sk_buff *skb;
3230         int i, ret, start = 0, ofs = 20;
3231
3232         if (!is_mt7915(&dev->mt76)) {
3233                 start = 4;
3234                 ofs = 0;
3235         }
3236
3237         for (i = 0; i < 4; i++) {
3238                 req[i].band = cpu_to_le32(phy != &dev->phy);
3239                 req[i].offs = cpu_to_le32(offs[i + start]);
3240         }
3241
3242         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(GET_MIB_INFO),
3243                                         req, sizeof(req), true, &skb);
3244         if (ret)
3245                 return ret;
3246
3247         res = (struct mt7915_mcu_mib *)(skb->data + ofs);
3248
3249         if (chan_switch)
3250                 goto out;
3251
3252 #define __res_u64(s) le64_to_cpu(res[s].data)
3253         state->cc_busy += __res_u64(0) - state_ts->cc_busy;
3254         state->cc_tx += __res_u64(1) - state_ts->cc_tx;
3255         state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx;
3256         state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx;
3257
3258 out:
3259         state_ts->cc_busy = __res_u64(0);
3260         state_ts->cc_tx = __res_u64(1);
3261         state_ts->cc_bss_rx = __res_u64(2);
3262         state_ts->cc_rx = __res_u64(2) + __res_u64(3);
3263 #undef __res_u64
3264
3265         dev_kfree_skb(skb);
3266
3267         return 0;
3268 }
3269
3270 int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
3271 {
3272         struct mt7915_dev *dev = phy->dev;
3273         struct {
3274                 u8 ctrl_id;
3275                 u8 action;
3276                 u8 dbdc_idx;
3277                 u8 rsv[5];
3278         } req = {
3279                 .ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3280                 .dbdc_idx = phy != &dev->phy,
3281         };
3282
3283         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3284                                  sizeof(req), true);
3285 }
3286
3287 int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
3288 {
3289         struct mt7915_dev *dev = phy->dev;
3290         struct {
3291                 struct mt7915_mcu_thermal_ctrl ctrl;
3292
3293                 __le32 trigger_temp;
3294                 __le32 restore_temp;
3295                 __le16 sustain_time;
3296                 u8 rsv[2];
3297         } __packed req = {
3298                 .ctrl = {
3299                         .band_idx = phy->band_idx,
3300                 },
3301         };
3302         int level;
3303
3304         if (!state) {
3305                 req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
3306                 goto out;
3307         }
3308
3309         /* set duty cycle and level */
3310         for (level = 0; level < 4; level++) {
3311                 int ret;
3312
3313                 req.ctrl.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG;
3314                 req.ctrl.duty.duty_level = level;
3315                 req.ctrl.duty.duty_cycle = state;
3316                 state /= 2;
3317
3318                 ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3319                                         &req, sizeof(req.ctrl), false);
3320                 if (ret)
3321                         return ret;
3322         }
3323
3324         /* set high-temperature trigger threshold */
3325         req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
3326         /* add a safety margin ~10 */
3327         req.restore_temp = cpu_to_le32(phy->throttle_temp[0] - 10);
3328         req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
3329         req.sustain_time = cpu_to_le16(10);
3330
3331 out:
3332         req.ctrl.type.protect_type = 1;
3333         req.ctrl.type.trigger_type = 1;
3334
3335         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3336                                  &req, sizeof(req), false);
3337 }
3338
3339 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3340 {
3341         struct mt7915_dev *dev = phy->dev;
3342         struct mt76_phy *mphy = phy->mt76;
3343         struct ieee80211_hw *hw = mphy->hw;
3344         struct mt7915_sku_val {
3345                 u8 format_id;
3346                 u8 limit_type;
3347                 u8 dbdc_idx;
3348                 s8 val[MT7915_SKU_RATE_NUM];
3349         } __packed req = {
3350                 .format_id = 4,
3351                 .dbdc_idx = phy != &dev->phy,
3352         };
3353         struct mt76_power_limits limits_array;
3354         s8 *la = (s8 *)&limits_array;
3355         int i, idx, n_chains = hweight8(mphy->antenna_mask);
3356         int tx_power = hw->conf.power_level * 2;
3357
3358         tx_power = mt76_get_sar_power(mphy, mphy->chandef.chan,
3359                                       tx_power);
3360         tx_power -= mt76_tx_power_nss_delta(n_chains);
3361         tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3362                                               &limits_array, tx_power);
3363         mphy->txpower_cur = tx_power;
3364
3365         for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3366                 u8 mcs_num, len = mt7915_sku_group_len[i];
3367                 int j;
3368
3369                 if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3370                         mcs_num = 10;
3371
3372                         if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3373                                 la = (s8 *)&limits_array + 12;
3374                 } else {
3375                         mcs_num = len;
3376                 }
3377
3378                 for (j = 0; j < min_t(u8, mcs_num, len); j++)
3379                         req.val[idx + j] = la[j];
3380
3381                 la += mcs_num;
3382                 idx += len;
3383         }
3384
3385         return mt76_mcu_send_msg(&dev->mt76,
3386                                  MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3387                                  sizeof(req), true);
3388 }
3389
3390 int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
3391 {
3392 #define RATE_POWER_INFO 2
3393         struct mt7915_dev *dev = phy->dev;
3394         struct {
3395                 u8 format_id;
3396                 u8 category;
3397                 u8 band;
3398                 u8 _rsv;
3399         } __packed req = {
3400                 .format_id = 7,
3401                 .category = RATE_POWER_INFO,
3402                 .band = phy != &dev->phy,
3403         };
3404         s8 res[MT7915_SKU_RATE_NUM][2];
3405         struct sk_buff *skb;
3406         int ret, i;
3407
3408         ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3409                                         MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
3410                                         &req, sizeof(req), true, &skb);
3411         if (ret)
3412                 return ret;
3413
3414         memcpy(res, skb->data + 4, sizeof(res));
3415         for (i = 0; i < len; i++)
3416                 txpower[i] = res[i][req.band];
3417
3418         dev_kfree_skb(skb);
3419
3420         return 0;
3421 }
3422
3423 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3424                               u8 en)
3425 {
3426         struct {
3427                 u8 test_mode_en;
3428                 u8 param_idx;
3429                 u8 _rsv[2];
3430
3431                 u8 enable;
3432                 u8 _rsv2[3];
3433
3434                 u8 pad[8];
3435         } __packed req = {
3436                 .test_mode_en = test_mode,
3437                 .param_idx = param,
3438                 .enable = en,
3439         };
3440
3441         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3442                                  sizeof(req), false);
3443 }
3444
3445 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3446 {
3447         struct mt7915_dev *dev = phy->dev;
3448         struct mt7915_sku {
3449                 u8 format_id;
3450                 u8 sku_enable;
3451                 u8 dbdc_idx;
3452                 u8 rsv;
3453         } __packed req = {
3454                 .format_id = 0,
3455                 .dbdc_idx = phy != &dev->phy,
3456                 .sku_enable = enable,
3457         };
3458
3459         return mt76_mcu_send_msg(&dev->mt76,
3460                                  MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3461                                  sizeof(req), true);
3462 }
3463
3464 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3465 {
3466         struct {
3467                 u8 action;
3468                 u8 set;
3469                 u8 band;
3470                 u8 rsv;
3471         } req = {
3472                 .action = action,
3473                 .set = set,
3474                 .band = band,
3475         };
3476
3477         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3478                                  &req, sizeof(req), false);
3479 }
3480
3481 int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
3482 {
3483         struct {
3484                 u8 action;
3485                 union {
3486                         struct {
3487                                 u8 snd_mode;
3488                                 u8 sta_num;
3489                                 u8 rsv;
3490                                 u8 wlan_idx[4];
3491                                 __le32 snd_period;      /* ms */
3492                         } __packed snd;
3493                         struct {
3494                                 bool ebf;
3495                                 bool ibf;
3496                                 u8 rsv;
3497                         } __packed type;
3498                         struct {
3499                                 u8 bf_num;
3500                                 u8 bf_bitmap;
3501                                 u8 bf_sel[8];
3502                                 u8 rsv[5];
3503                         } __packed mod;
3504                 };
3505         } __packed req = {
3506                 .action = action,
3507         };
3508
3509 #define MT_BF_PROCESSING        4
3510         switch (action) {
3511         case MT_BF_SOUNDING_ON:
3512                 req.snd.snd_mode = MT_BF_PROCESSING;
3513                 break;
3514         case MT_BF_TYPE_UPDATE:
3515                 req.type.ebf = true;
3516                 req.type.ibf = dev->ibf;
3517                 break;
3518         case MT_BF_MODULE_UPDATE:
3519                 req.mod.bf_num = 2;
3520                 req.mod.bf_bitmap = GENMASK(1, 0);
3521                 break;
3522         default:
3523                 return -EINVAL;
3524         }
3525
3526         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3527                                  sizeof(req), true);
3528 }
3529
3530 int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3531                             bool enable)
3532 {
3533 #define MT_SPR_ENABLE           1
3534         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3535         struct {
3536                 u8 action;
3537                 u8 arg_num;
3538                 u8 band_idx;
3539                 u8 status;
3540                 u8 drop_tx_idx;
3541                 u8 sta_idx;     /* 256 sta */
3542                 u8 rsv[2];
3543                 __le32 val;
3544         } __packed req = {
3545                 .action = MT_SPR_ENABLE,
3546                 .arg_num = 1,
3547                 .band_idx = mvif->mt76.band_idx,
3548                 .val = cpu_to_le32(enable),
3549         };
3550
3551         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3552                                  sizeof(req), true);
3553 }
3554
3555 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3556                            struct ieee80211_sta *sta, struct rate_info *rate)
3557 {
3558         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3559         struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3560         struct mt7915_dev *dev = phy->dev;
3561         struct mt76_phy *mphy = phy->mt76;
3562         struct {
3563                 u8 category;
3564                 u8 band;
3565                 __le16 wcid;
3566         } __packed req = {
3567                 .category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3568                 .band = mvif->mt76.band_idx,
3569                 .wcid = cpu_to_le16(msta->wcid.idx),
3570         };
3571         struct ieee80211_supported_band *sband;
3572         struct mt7915_mcu_phy_rx_info *res;
3573         struct sk_buff *skb;
3574         int ret;
3575         bool cck = false;
3576
3577         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3578                                         &req, sizeof(req), true, &skb);
3579         if (ret)
3580                 return ret;
3581
3582         res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3583
3584         rate->mcs = res->rate;
3585         rate->nss = res->nsts + 1;
3586
3587         switch (res->mode) {
3588         case MT_PHY_TYPE_CCK:
3589                 cck = true;
3590                 fallthrough;
3591         case MT_PHY_TYPE_OFDM:
3592                 if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3593                         sband = &mphy->sband_5g.sband;
3594                 else if (mphy->chandef.chan->band == NL80211_BAND_6GHZ)
3595                         sband = &mphy->sband_6g.sband;
3596                 else
3597                         sband = &mphy->sband_2g.sband;
3598
3599                 rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
3600                 rate->legacy = sband->bitrates[rate->mcs].bitrate;
3601                 break;
3602         case MT_PHY_TYPE_HT:
3603         case MT_PHY_TYPE_HT_GF:
3604                 if (rate->mcs > 31) {
3605                         ret = -EINVAL;
3606                         goto out;
3607                 }
3608
3609                 rate->flags = RATE_INFO_FLAGS_MCS;
3610                 if (res->gi)
3611                         rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3612                 break;
3613         case MT_PHY_TYPE_VHT:
3614                 if (rate->mcs > 9) {
3615                         ret = -EINVAL;
3616                         goto out;
3617                 }
3618
3619                 rate->flags = RATE_INFO_FLAGS_VHT_MCS;
3620                 if (res->gi)
3621                         rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3622                 break;
3623         case MT_PHY_TYPE_HE_SU:
3624         case MT_PHY_TYPE_HE_EXT_SU:
3625         case MT_PHY_TYPE_HE_TB:
3626         case MT_PHY_TYPE_HE_MU:
3627                 if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
3628                         ret = -EINVAL;
3629                         goto out;
3630                 }
3631                 rate->he_gi = res->gi;
3632                 rate->flags = RATE_INFO_FLAGS_HE_MCS;
3633                 break;
3634         default:
3635                 ret = -EINVAL;
3636                 goto out;
3637         }
3638
3639         switch (res->bw) {
3640         case IEEE80211_STA_RX_BW_160:
3641                 rate->bw = RATE_INFO_BW_160;
3642                 break;
3643         case IEEE80211_STA_RX_BW_80:
3644                 rate->bw = RATE_INFO_BW_80;
3645                 break;
3646         case IEEE80211_STA_RX_BW_40:
3647                 rate->bw = RATE_INFO_BW_40;
3648                 break;
3649         default:
3650                 rate->bw = RATE_INFO_BW_20;
3651                 break;
3652         }
3653
3654 out:
3655         dev_kfree_skb(skb);
3656
3657         return ret;
3658 }
3659
3660 int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3661                                 struct cfg80211_he_bss_color *he_bss_color)
3662 {
3663         int len = sizeof(struct sta_req_hdr) + sizeof(struct bss_info_color);
3664         struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3665         struct bss_info_color *bss_color;
3666         struct sk_buff *skb;
3667         struct tlv *tlv;
3668
3669         skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
3670                                               NULL, len);
3671         if (IS_ERR(skb))
3672                 return PTR_ERR(skb);
3673
3674         tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BSS_COLOR,
3675                                       sizeof(*bss_color));
3676         bss_color = (struct bss_info_color *)tlv;
3677         bss_color->disable = !he_bss_color->enabled;
3678         bss_color->color = he_bss_color->color;
3679
3680         return mt76_mcu_skb_send_msg(&dev->mt76, skb,
3681                                      MCU_EXT_CMD(BSS_INFO_UPDATE), true);
3682 }
3683
3684 #define TWT_AGRT_TRIGGER        BIT(0)
3685 #define TWT_AGRT_ANNOUNCE       BIT(1)
3686 #define TWT_AGRT_PROTECT        BIT(2)
3687
3688 int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
3689                                struct mt7915_vif *mvif,
3690                                struct mt7915_twt_flow *flow,
3691                                int cmd)
3692 {
3693         struct {
3694                 u8 tbl_idx;
3695                 u8 cmd;
3696                 u8 own_mac_idx;
3697                 u8 flowid; /* 0xff for group id */
3698                 __le16 peer_id; /* specify the peer_id (msb=0)
3699                                  * or group_id (msb=1)
3700                                  */
3701                 u8 duration; /* 256 us */
3702                 u8 bss_idx;
3703                 __le64 start_tsf;
3704                 __le16 mantissa;
3705                 u8 exponent;
3706                 u8 is_ap;
3707                 u8 agrt_params;
3708                 u8 rsv[23];
3709         } __packed req = {
3710                 .tbl_idx = flow->table_id,
3711                 .cmd = cmd,
3712                 .own_mac_idx = mvif->mt76.omac_idx,
3713                 .flowid = flow->id,
3714                 .peer_id = cpu_to_le16(flow->wcid),
3715                 .duration = flow->duration,
3716                 .bss_idx = mvif->mt76.idx,
3717                 .start_tsf = cpu_to_le64(flow->tsf),
3718                 .mantissa = flow->mantissa,
3719                 .exponent = flow->exp,
3720                 .is_ap = true,
3721         };
3722
3723         if (flow->protection)
3724                 req.agrt_params |= TWT_AGRT_PROTECT;
3725         if (!flow->flowtype)
3726                 req.agrt_params |= TWT_AGRT_ANNOUNCE;
3727         if (flow->trigger)
3728                 req.agrt_params |= TWT_AGRT_TRIGGER;
3729
3730         return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TWT_AGRT_UPDATE),
3731                                  &req, sizeof(req), true);
3732 }
3733
3734 int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
3735 {
3736         struct {
3737                 __le32 idx;
3738                 __le32 ofs;
3739                 __le32 data;
3740         } __packed req = {
3741                 .idx = cpu_to_le32(u32_get_bits(regidx, GENMASK(31, 28))),
3742                 .ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(27, 0))),
3743                 .data = set ? cpu_to_le32(*val) : 0,
3744         };
3745         struct sk_buff *skb;
3746         int ret;
3747
3748         if (set)
3749                 return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_REG_ACCESS),
3750                                          &req, sizeof(req), false);
3751
3752         ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(RF_REG_ACCESS),
3753                                         &req, sizeof(req), true, &skb);
3754         if (ret)
3755                 return ret;
3756
3757         *val = le32_to_cpu(*(__le32 *)(skb->data + 8));
3758         dev_kfree_skb(skb);
3759
3760         return 0;
3761 }