1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include "mt7915.h"
6 #include "mcu.h"
7 #include "mac.h"
8 #include "eeprom.h"
9 
10 #define fw_name(_dev, name, ...)	({			\
11 	char *_fw;						\
12 	switch (mt76_chip(&(_dev)->mt76)) {			\
13 	case 0x7915:						\
14 		_fw = MT7915_##name;				\
15 		break;						\
16 	case 0x7981:						\
17 		_fw = MT7981_##name;				\
18 		break;						\
19 	case 0x7986:						\
20 		_fw = MT7986_##name##__VA_ARGS__;		\
21 		break;						\
22 	default:						\
23 		_fw = MT7916_##name;				\
24 		break;						\
25 	}							\
26 	_fw;							\
27 })
28 
29 #define fw_name_var(_dev, name)		(mt7915_check_adie(dev, false) ?	\
30 					 fw_name(_dev, name) :			\
31 					 fw_name(_dev, name, _MT7975))
32 
33 #define MCU_PATCH_ADDRESS		0x200000
34 
35 #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
36 #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
37 
38 static bool sr_scene_detect = true;
39 module_param(sr_scene_detect, bool, 0644);
40 MODULE_PARM_DESC(sr_scene_detect, "Enable firmware scene detection algorithm");
41 
42 static u8
43 mt7915_mcu_get_sta_nss(u16 mcs_map)
44 {
45 	u8 nss;
46 
47 	for (nss = 8; nss > 0; nss--) {
48 		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
49 
50 		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
51 			break;
52 	}
53 
54 	return nss - 1;
55 }
56 
57 static void
58 mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
59 			  u16 mcs_map)
60 {
61 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
62 	struct mt7915_dev *dev = msta->vif->phy->dev;
63 	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
64 	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
65 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
66 
67 	for (nss = 0; nss < max_nss; nss++) {
68 		int mcs;
69 
70 		switch ((mcs_map >> (2 * nss)) & 0x3) {
71 		case IEEE80211_HE_MCS_SUPPORT_0_11:
72 			mcs = GENMASK(11, 0);
73 			break;
74 		case IEEE80211_HE_MCS_SUPPORT_0_9:
75 			mcs = GENMASK(9, 0);
76 			break;
77 		case IEEE80211_HE_MCS_SUPPORT_0_7:
78 			mcs = GENMASK(7, 0);
79 			break;
80 		default:
81 			mcs = 0;
82 		}
83 
84 		mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
85 
86 		switch (mcs) {
87 		case 0 ... 7:
88 			mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
89 			break;
90 		case 8 ... 9:
91 			mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
92 			break;
93 		case 10 ... 11:
94 			mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
95 			break;
96 		default:
97 			mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
98 			break;
99 		}
100 		mcs_map &= ~(0x3 << (nss * 2));
101 		mcs_map |= mcs << (nss * 2);
102 
103 		/* only support 2ss on 160MHz for mt7915 */
104 		if (is_mt7915(&dev->mt76) && nss > 1 &&
105 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
106 			break;
107 	}
108 
109 	*he_mcs = cpu_to_le16(mcs_map);
110 }
111 
112 static void
113 mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
114 			   const u16 *mask)
115 {
116 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
117 	struct mt7915_dev *dev = msta->vif->phy->dev;
118 	u16 mcs_map = le16_to_cpu(sta->deflink.vht_cap.vht_mcs.rx_mcs_map);
119 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
120 	u16 mcs;
121 
122 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
123 		switch (mcs_map & 0x3) {
124 		case IEEE80211_VHT_MCS_SUPPORT_0_9:
125 			mcs = GENMASK(9, 0);
126 			break;
127 		case IEEE80211_VHT_MCS_SUPPORT_0_8:
128 			mcs = GENMASK(8, 0);
129 			break;
130 		case IEEE80211_VHT_MCS_SUPPORT_0_7:
131 			mcs = GENMASK(7, 0);
132 			break;
133 		default:
134 			mcs = 0;
135 		}
136 
137 		vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
138 
139 		/* only support 2ss on 160MHz for mt7915 */
140 		if (is_mt7915(&dev->mt76) && nss > 1 &&
141 		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
142 			break;
143 	}
144 }
145 
146 static void
147 mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
148 			  const u8 *mask)
149 {
150 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
151 
152 	for (nss = 0; nss < max_nss; nss++)
153 		ht_mcs[nss] = sta->deflink.ht_cap.mcs.rx_mask[nss] & mask[nss];
154 }
155 
156 static int
157 mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
158 			  struct sk_buff *skb, int seq)
159 {
160 	struct mt76_connac2_mcu_rxd *rxd;
161 	int ret = 0;
162 
163 	if (!skb) {
164 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
165 			cmd, seq);
166 		return -ETIMEDOUT;
167 	}
168 
169 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
170 	if (seq != rxd->seq &&
171 	    !(rxd->eid == MCU_CMD_EXT_CID &&
172 	      rxd->ext_eid == MCU_EXT_EVENT_WA_TX_STAT))
173 		return -EAGAIN;
174 
175 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
176 		skb_pull(skb, sizeof(*rxd) - 4);
177 		ret = *skb->data;
178 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
179 		skb_pull(skb, sizeof(*rxd) + 4);
180 		ret = le32_to_cpu(*(__le32 *)skb->data);
181 	} else {
182 		skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
183 	}
184 
185 	return ret;
186 }
187 
188 static int
189 mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
190 			int cmd, int *wait_seq)
191 {
192 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
193 	enum mt76_mcuq_id qid;
194 	int ret;
195 
196 	ret = mt76_connac2_mcu_fill_message(mdev, skb, cmd, wait_seq);
197 	if (ret)
198 		return ret;
199 
200 	if (cmd == MCU_CMD(FW_SCATTER))
201 		qid = MT_MCUQ_FWDL;
202 	else if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
203 		qid = MT_MCUQ_WA;
204 	else
205 		qid = MT_MCUQ_WM;
206 
207 	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
208 }
209 
210 int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
211 {
212 	struct {
213 		__le32 args[3];
214 	} req = {
215 		.args = {
216 			cpu_to_le32(a1),
217 			cpu_to_le32(a2),
218 			cpu_to_le32(a3),
219 		},
220 	};
221 
222 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), false);
223 }
224 
225 static void
226 mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
227 {
228 	if (vif->bss_conf.csa_active)
229 		ieee80211_csa_finish(vif);
230 }
231 
232 static void
233 mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb)
234 {
235 	struct mt76_phy *mphy = &dev->mt76.phy;
236 	struct mt7915_mcu_csa_notify *c;
237 
238 	c = (struct mt7915_mcu_csa_notify *)skb->data;
239 
240 	if (c->band_idx > MT_BAND1)
241 		return;
242 
243 	if ((c->band_idx && !dev->phy.mt76->band_idx) &&
244 	    dev->mt76.phys[MT_BAND1])
245 		mphy = dev->mt76.phys[MT_BAND1];
246 
247 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
248 			IEEE80211_IFACE_ITER_RESUME_ALL,
249 			mt7915_mcu_csa_finish, mphy->hw);
250 }
251 
252 static void
253 mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb)
254 {
255 	struct mt76_phy *mphy = &dev->mt76.phy;
256 	struct mt7915_mcu_thermal_notify *t;
257 	struct mt7915_phy *phy;
258 
259 	t = (struct mt7915_mcu_thermal_notify *)skb->data;
260 	if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)
261 		return;
262 
263 	if (t->ctrl.band_idx > MT_BAND1)
264 		return;
265 
266 	if ((t->ctrl.band_idx && !dev->phy.mt76->band_idx) &&
267 	    dev->mt76.phys[MT_BAND1])
268 		mphy = dev->mt76.phys[MT_BAND1];
269 
270 	phy = (struct mt7915_phy *)mphy->priv;
271 	phy->throttle_state = t->ctrl.duty.duty_cycle;
272 }
273 
274 static void
275 mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
276 {
277 	struct mt76_phy *mphy = &dev->mt76.phy;
278 	struct mt7915_mcu_rdd_report *r;
279 
280 	r = (struct mt7915_mcu_rdd_report *)skb->data;
281 
282 	if (r->band_idx > MT_RX_SEL2)
283 		return;
284 
285 	if ((r->band_idx && !dev->phy.mt76->band_idx) &&
286 	    dev->mt76.phys[MT_BAND1])
287 		mphy = dev->mt76.phys[MT_BAND1];
288 
289 	if (r->band_idx == MT_RX_SEL2)
290 		cfg80211_background_radar_event(mphy->hw->wiphy,
291 						&dev->rdd2_chandef,
292 						GFP_ATOMIC);
293 	else
294 		ieee80211_radar_detected(mphy->hw);
295 	dev->hw_pattern++;
296 }
297 
298 static void
299 mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
300 {
301 	struct mt76_connac2_mcu_rxd *rxd;
302 	int len = skb->len - sizeof(*rxd);
303 	const char *data, *type;
304 
305 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
306 	data = (char *)&rxd[1];
307 
308 	switch (rxd->s2d_index) {
309 	case 0:
310 		if (mt7915_debugfs_rx_log(dev, data, len))
311 			return;
312 
313 		type = "WM";
314 		break;
315 	case 2:
316 		type = "WA";
317 		break;
318 	default:
319 		type = "unknown";
320 		break;
321 	}
322 
323 	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type, len, data);
324 }
325 
326 static void
327 mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
328 {
329 	if (!vif->bss_conf.color_change_active)
330 		return;
331 
332 	ieee80211_color_change_finish(vif);
333 }
334 
335 static void
336 mt7915_mcu_rx_bcc_notify(struct mt7915_dev *dev, struct sk_buff *skb)
337 {
338 	struct mt76_phy *mphy = &dev->mt76.phy;
339 	struct mt7915_mcu_bcc_notify *b;
340 
341 	b = (struct mt7915_mcu_bcc_notify *)skb->data;
342 
343 	if (b->band_idx > MT_BAND1)
344 		return;
345 
346 	if ((b->band_idx && !dev->phy.mt76->band_idx) &&
347 	    dev->mt76.phys[MT_BAND1])
348 		mphy = dev->mt76.phys[MT_BAND1];
349 
350 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
351 			IEEE80211_IFACE_ITER_RESUME_ALL,
352 			mt7915_mcu_cca_finish, mphy->hw);
353 }
354 
355 static void
356 mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
357 {
358 	struct mt76_connac2_mcu_rxd *rxd;
359 
360 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
361 	switch (rxd->ext_eid) {
362 	case MCU_EXT_EVENT_THERMAL_PROTECT:
363 		mt7915_mcu_rx_thermal_notify(dev, skb);
364 		break;
365 	case MCU_EXT_EVENT_RDD_REPORT:
366 		mt7915_mcu_rx_radar_detected(dev, skb);
367 		break;
368 	case MCU_EXT_EVENT_CSA_NOTIFY:
369 		mt7915_mcu_rx_csa_notify(dev, skb);
370 		break;
371 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
372 		mt7915_mcu_rx_log_message(dev, skb);
373 		break;
374 	case MCU_EXT_EVENT_BCC_NOTIFY:
375 		mt7915_mcu_rx_bcc_notify(dev, skb);
376 		break;
377 	default:
378 		break;
379 	}
380 }
381 
382 static void
383 mt7915_mcu_rx_unsolicited_event(struct mt7915_dev *dev, struct sk_buff *skb)
384 {
385 	struct mt76_connac2_mcu_rxd *rxd;
386 
387 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
388 	switch (rxd->eid) {
389 	case MCU_EVENT_EXT:
390 		mt7915_mcu_rx_ext_event(dev, skb);
391 		break;
392 	default:
393 		break;
394 	}
395 	dev_kfree_skb(skb);
396 }
397 
398 void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
399 {
400 	struct mt76_connac2_mcu_rxd *rxd;
401 
402 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
403 	if ((rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
404 	     rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
405 	     rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
406 	     rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
407 	     rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
408 	     !rxd->seq) &&
409 	     !(rxd->eid == MCU_CMD_EXT_CID &&
410 	       rxd->ext_eid == MCU_EXT_EVENT_WA_TX_STAT))
411 		mt7915_mcu_rx_unsolicited_event(dev, skb);
412 	else
413 		mt76_mcu_rx_event(&dev->mt76, skb);
414 }
415 
416 static struct tlv *
417 mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
418 			     __le16 *sub_ntlv, __le16 *len)
419 {
420 	struct tlv *ptlv, tlv = {
421 		.tag = cpu_to_le16(sub_tag),
422 		.len = cpu_to_le16(sub_len),
423 	};
424 
425 	ptlv = skb_put(skb, sub_len);
426 	memcpy(ptlv, &tlv, sizeof(tlv));
427 
428 	le16_add_cpu(sub_ntlv, 1);
429 	le16_add_cpu(len, sub_len);
430 
431 	return ptlv;
432 }
433 
434 /** bss info **/
435 struct mt7915_he_obss_narrow_bw_ru_data {
436 	bool tolerated;
437 };
438 
439 static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
440 						   struct cfg80211_bss *bss,
441 						   void *_data)
442 {
443 	struct mt7915_he_obss_narrow_bw_ru_data *data = _data;
444 	const struct element *elem;
445 
446 	rcu_read_lock();
447 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
448 
449 	if (!elem || elem->datalen <= 10 ||
450 	    !(elem->data[10] &
451 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
452 		data->tolerated = false;
453 
454 	rcu_read_unlock();
455 }
456 
457 static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
458 					      struct ieee80211_vif *vif)
459 {
460 	struct mt7915_he_obss_narrow_bw_ru_data iter_data = {
461 		.tolerated = true,
462 	};
463 
464 	if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR))
465 		return false;
466 
467 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
468 			  mt7915_check_he_obss_narrow_bw_ru_iter,
469 			  &iter_data);
470 
471 	/*
472 	 * If there is at least one AP on radar channel that cannot
473 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
474 	 */
475 	return !iter_data.tolerated;
476 }
477 
478 static void
479 mt7915_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
480 			struct mt7915_phy *phy)
481 {
482 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
483 	struct bss_info_rf_ch *ch;
484 	struct tlv *tlv;
485 	int freq1 = chandef->center_freq1;
486 
487 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RF_CH, sizeof(*ch));
488 
489 	ch = (struct bss_info_rf_ch *)tlv;
490 	ch->pri_ch = chandef->chan->hw_value;
491 	ch->center_ch0 = ieee80211_frequency_to_channel(freq1);
492 	ch->bw = mt76_connac_chan_bw(chandef);
493 
494 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
495 		int freq2 = chandef->center_freq2;
496 
497 		ch->center_ch1 = ieee80211_frequency_to_channel(freq2);
498 	}
499 
500 	if (vif->bss_conf.he_support && vif->type == NL80211_IFTYPE_STATION) {
501 		struct mt76_phy *mphy = phy->mt76;
502 
503 		ch->he_ru26_block =
504 			mt7915_check_he_obss_narrow_bw_ru(mphy->hw, vif);
505 		ch->he_all_disable = false;
506 	} else {
507 		ch->he_all_disable = true;
508 	}
509 }
510 
511 static void
512 mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
513 		      struct mt7915_phy *phy)
514 {
515 	int max_nss = hweight8(phy->mt76->antenna_mask);
516 	struct bss_info_ra *ra;
517 	struct tlv *tlv;
518 
519 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_RA, sizeof(*ra));
520 
521 	ra = (struct bss_info_ra *)tlv;
522 	ra->op_mode = vif->type == NL80211_IFTYPE_AP;
523 	ra->adhoc_en = vif->type == NL80211_IFTYPE_ADHOC;
524 	ra->short_preamble = true;
525 	ra->tx_streams = max_nss;
526 	ra->rx_streams = max_nss;
527 	ra->algo = 4;
528 	ra->train_up_rule = 2;
529 	ra->train_up_high_thres = 110;
530 	ra->train_up_rule_rssi = -70;
531 	ra->low_traffic_thres = 2;
532 	ra->phy_cap = cpu_to_le32(0xfdf);
533 	ra->interval = cpu_to_le32(500);
534 	ra->fast_interval = cpu_to_le32(100);
535 }
536 
537 static void
538 mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
539 		      struct mt7915_phy *phy)
540 {
541 #define DEFAULT_HE_PE_DURATION		4
542 #define DEFAULT_HE_DURATION_RTS_THRES	1023
543 	const struct ieee80211_sta_he_cap *cap;
544 	struct bss_info_he *he;
545 	struct tlv *tlv;
546 
547 	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
548 
549 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
550 
551 	he = (struct bss_info_he *)tlv;
552 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
553 	if (!he->he_pe_duration)
554 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
555 
556 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
557 	if (!he->he_rts_thres)
558 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
559 
560 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
561 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
562 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
563 }
564 
565 static void
566 mt7915_mcu_bss_hw_amsdu_tlv(struct sk_buff *skb)
567 {
568 #define TXD_CMP_MAP1		GENMASK(15, 0)
569 #define TXD_CMP_MAP2		(GENMASK(31, 0) & ~BIT(23))
570 	struct bss_info_hw_amsdu *amsdu;
571 	struct tlv *tlv;
572 
573 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HW_AMSDU, sizeof(*amsdu));
574 
575 	amsdu = (struct bss_info_hw_amsdu *)tlv;
576 	amsdu->cmp_bitmap_0 = cpu_to_le32(TXD_CMP_MAP1);
577 	amsdu->cmp_bitmap_1 = cpu_to_le32(TXD_CMP_MAP2);
578 	amsdu->trig_thres = cpu_to_le16(2);
579 	amsdu->enable = true;
580 }
581 
582 static void
583 mt7915_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7915_phy *phy)
584 {
585 	struct bss_info_bmc_rate *bmc;
586 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
587 	enum nl80211_band band = chandef->chan->band;
588 	struct tlv *tlv;
589 
590 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BMC_RATE, sizeof(*bmc));
591 
592 	bmc = (struct bss_info_bmc_rate *)tlv;
593 	if (band == NL80211_BAND_2GHZ) {
594 		bmc->short_preamble = true;
595 	} else {
596 		bmc->bc_trans = cpu_to_le16(0x2000);
597 		bmc->mc_trans = cpu_to_le16(0x2080);
598 	}
599 }
600 
601 static int
602 mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
603 		       bool bssid, bool enable)
604 {
605 	struct mt7915_dev *dev = phy->dev;
606 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
607 	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
608 	u32 mask = phy->omac_mask >> 32 & ~BIT(idx);
609 	const u8 *addr = vif->addr;
610 	struct {
611 		u8 mode;
612 		u8 force_clear;
613 		u8 clear_bitmap[8];
614 		u8 entry_count;
615 		u8 write;
616 		u8 band;
617 
618 		u8 index;
619 		u8 bssid;
620 		u8 addr[ETH_ALEN];
621 	} __packed req = {
622 		.mode = !!mask || enable,
623 		.entry_count = 1,
624 		.write = 1,
625 		.band = phy->mt76->band_idx,
626 		.index = idx * 2 + bssid,
627 	};
628 
629 	if (bssid)
630 		addr = vif->bss_conf.bssid;
631 
632 	if (enable)
633 		ether_addr_copy(req.addr, addr);
634 
635 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
636 				 sizeof(req), true);
637 }
638 
639 int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
640 			    struct ieee80211_vif *vif, int enable)
641 {
642 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
643 	struct mt7915_dev *dev = phy->dev;
644 	struct sk_buff *skb;
645 
646 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START) {
647 		mt7915_mcu_muar_config(phy, vif, false, enable);
648 		mt7915_mcu_muar_config(phy, vif, true, enable);
649 	}
650 
651 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
652 					      MT7915_BSS_UPDATE_MAX_SIZE);
653 	if (IS_ERR(skb))
654 		return PTR_ERR(skb);
655 
656 	/* bss_omac must be first */
657 	if (enable)
658 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
659 
660 	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
661 				      mvif->sta.wcid.idx, enable);
662 
663 	if (vif->type == NL80211_IFTYPE_MONITOR)
664 		goto out;
665 
666 	if (enable) {
667 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
668 		mt7915_mcu_bss_bmc_tlv(skb, phy);
669 		mt7915_mcu_bss_ra_tlv(skb, vif, phy);
670 		mt7915_mcu_bss_hw_amsdu_tlv(skb);
671 
672 		if (vif->bss_conf.he_support)
673 			mt7915_mcu_bss_he_tlv(skb, vif, phy);
674 
675 		if (mvif->mt76.omac_idx >= EXT_BSSID_START &&
676 		    mvif->mt76.omac_idx < REPEATER_BSSID_START)
677 			mt76_connac_mcu_bss_ext_tlv(skb, &mvif->mt76);
678 	}
679 out:
680 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
681 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
682 }
683 
684 /** starec & wtbl **/
685 int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev,
686 			 struct ieee80211_ampdu_params *params,
687 			 bool enable)
688 {
689 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
690 	struct mt7915_vif *mvif = msta->vif;
691 
692 	if (enable && !params->amsdu)
693 		msta->wcid.amsdu = false;
694 
695 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
696 				      MCU_EXT_CMD(STA_REC_UPDATE),
697 				      enable, true);
698 }
699 
700 int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
701 			 struct ieee80211_ampdu_params *params,
702 			 bool enable)
703 {
704 	struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;
705 	struct mt7915_vif *mvif = msta->vif;
706 
707 	return mt76_connac_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
708 				      MCU_EXT_CMD(STA_REC_UPDATE),
709 				      enable, false);
710 }
711 
712 static void
713 mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
714 		      struct ieee80211_vif *vif)
715 {
716 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
717 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
718 	struct ieee80211_he_mcs_nss_supp mcs_map;
719 	struct sta_rec_he *he;
720 	struct tlv *tlv;
721 	u32 cap = 0;
722 
723 	if (!sta->deflink.he_cap.has_he)
724 		return;
725 
726 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
727 
728 	he = (struct sta_rec_he *)tlv;
729 
730 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
731 		cap |= STA_REC_HE_CAP_HTC;
732 
733 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
734 		cap |= STA_REC_HE_CAP_BSR;
735 
736 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
737 		cap |= STA_REC_HE_CAP_OM;
738 
739 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
740 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
741 
742 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
743 		cap |= STA_REC_HE_CAP_BQR;
744 
745 	if (elem->phy_cap_info[0] &
746 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
747 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
748 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
749 
750 	if (mvif->cap.he_ldpc &&
751 	    (elem->phy_cap_info[1] &
752 	     IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
753 		cap |= STA_REC_HE_CAP_LDPC;
754 
755 	if (elem->phy_cap_info[1] &
756 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
757 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
758 
759 	if (elem->phy_cap_info[2] &
760 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
761 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
762 
763 	if (elem->phy_cap_info[2] &
764 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
765 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
766 
767 	if (elem->phy_cap_info[2] &
768 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
769 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
770 
771 	if (elem->phy_cap_info[6] &
772 	    IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB)
773 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
774 
775 	if (elem->phy_cap_info[6] &
776 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
777 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
778 
779 	if (elem->phy_cap_info[7] &
780 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
781 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
782 
783 	if (elem->phy_cap_info[7] &
784 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
785 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
786 
787 	if (elem->phy_cap_info[7] &
788 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
789 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
790 
791 	if (elem->phy_cap_info[8] &
792 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
793 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
794 
795 	if (elem->phy_cap_info[8] &
796 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
797 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
798 
799 	if (elem->phy_cap_info[9] &
800 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
801 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
802 
803 	if (elem->phy_cap_info[9] &
804 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
805 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
806 
807 	he->he_cap = cpu_to_le32(cap);
808 
809 	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
810 	switch (sta->deflink.bandwidth) {
811 	case IEEE80211_STA_RX_BW_160:
812 		if (elem->phy_cap_info[0] &
813 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
814 			mt7915_mcu_set_sta_he_mcs(sta,
815 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
816 						  le16_to_cpu(mcs_map.rx_mcs_80p80));
817 
818 		mt7915_mcu_set_sta_he_mcs(sta,
819 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
820 					  le16_to_cpu(mcs_map.rx_mcs_160));
821 		fallthrough;
822 	default:
823 		mt7915_mcu_set_sta_he_mcs(sta,
824 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
825 					  le16_to_cpu(mcs_map.rx_mcs_80));
826 		break;
827 	}
828 
829 	he->t_frame_dur =
830 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
831 	he->max_ampdu_exp =
832 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
833 
834 	he->bw_set =
835 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
836 	he->device_class =
837 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
838 	he->punc_pream_rx =
839 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
840 
841 	he->dcm_tx_mode =
842 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
843 	he->dcm_tx_max_nss =
844 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
845 	he->dcm_rx_mode =
846 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
847 	he->dcm_rx_max_nss =
848 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
849 	he->dcm_rx_max_nss =
850 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
851 
852 	he->pkt_ext = 2;
853 }
854 
855 static void
856 mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
857 			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
858 {
859 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
860 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
861 	struct sta_rec_muru *muru;
862 	struct tlv *tlv;
863 
864 	if (vif->type != NL80211_IFTYPE_STATION &&
865 	    vif->type != NL80211_IFTYPE_AP)
866 		return;
867 
868 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
869 
870 	muru = (struct sta_rec_muru *)tlv;
871 
872 	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
873 			       mvif->cap.vht_mu_ebfer ||
874 			       mvif->cap.vht_mu_ebfee;
875 	if (!is_mt7915(&dev->mt76))
876 		muru->cfg.mimo_ul_en = true;
877 	muru->cfg.ofdma_dl_en = true;
878 
879 	if (sta->deflink.vht_cap.vht_supported)
880 		muru->mimo_dl.vht_mu_bfee =
881 			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
882 
883 	if (!sta->deflink.he_cap.has_he)
884 		return;
885 
886 	muru->mimo_dl.partial_bw_dl_mimo =
887 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
888 
889 	muru->mimo_ul.full_ul_mimo =
890 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
891 	muru->mimo_ul.partial_ul_mimo =
892 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
893 
894 	muru->ofdma_dl.punc_pream_rx =
895 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
896 	muru->ofdma_dl.he_20m_in_40m_2g =
897 		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
898 	muru->ofdma_dl.he_20m_in_160m =
899 		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
900 	muru->ofdma_dl.he_80m_in_160m =
901 		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
902 
903 	muru->ofdma_ul.t_frame_dur =
904 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
905 	muru->ofdma_ul.mu_cascading =
906 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
907 	muru->ofdma_ul.uo_ra =
908 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
909 }
910 
911 static void
912 mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
913 {
914 	struct sta_rec_ht *ht;
915 	struct tlv *tlv;
916 
917 	if (!sta->deflink.ht_cap.ht_supported)
918 		return;
919 
920 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
921 
922 	ht = (struct sta_rec_ht *)tlv;
923 	ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
924 }
925 
926 static void
927 mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
928 {
929 	struct sta_rec_vht *vht;
930 	struct tlv *tlv;
931 
932 	if (!sta->deflink.vht_cap.vht_supported)
933 		return;
934 
935 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
936 
937 	vht = (struct sta_rec_vht *)tlv;
938 	vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
939 	vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
940 	vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
941 }
942 
943 static void
944 mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
945 			 struct ieee80211_vif *vif, struct ieee80211_sta *sta)
946 {
947 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
948 	struct sta_rec_amsdu *amsdu;
949 	struct tlv *tlv;
950 
951 	if (vif->type != NL80211_IFTYPE_STATION &&
952 	    vif->type != NL80211_IFTYPE_AP)
953 		return;
954 
955 	if (!sta->deflink.agg.max_amsdu_len)
956 	    return;
957 
958 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
959 	amsdu = (struct sta_rec_amsdu *)tlv;
960 	amsdu->max_amsdu_num = 8;
961 	amsdu->amsdu_en = true;
962 	msta->wcid.amsdu = true;
963 
964 	switch (sta->deflink.agg.max_amsdu_len) {
965 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
966 		if (!is_mt7915(&dev->mt76)) {
967 			amsdu->max_mpdu_size =
968 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
969 			return;
970 		}
971 		fallthrough;
972 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
973 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
974 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
975 		return;
976 	default:
977 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
978 		return;
979 	}
980 }
981 
982 static int
983 mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
984 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
985 {
986 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
987 	struct mt7915_sta *msta;
988 	struct wtbl_req_hdr *wtbl_hdr;
989 	struct mt76_wcid *wcid;
990 	struct tlv *tlv;
991 
992 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
993 	wcid = sta ? &msta->wcid : NULL;
994 
995 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL, sizeof(struct tlv));
996 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
997 						  WTBL_RESET_AND_SET, tlv,
998 						  &skb);
999 	if (IS_ERR(wtbl_hdr))
1000 		return PTR_ERR(wtbl_hdr);
1001 
1002 	mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, skb, vif, sta, tlv,
1003 					 wtbl_hdr);
1004 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, tlv, wtbl_hdr);
1005 	if (sta)
1006 		mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, skb, sta, tlv,
1007 					    wtbl_hdr, mvif->cap.ht_ldpc,
1008 					    mvif->cap.vht_ldpc);
1009 
1010 	return 0;
1011 }
1012 
1013 static inline bool
1014 mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
1015 			struct ieee80211_sta *sta, bool bfee)
1016 {
1017 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1018 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1019 
1020 	if (vif->type != NL80211_IFTYPE_STATION &&
1021 	    vif->type != NL80211_IFTYPE_AP)
1022 		return false;
1023 
1024 	if (!bfee && tx_ant < 2)
1025 		return false;
1026 
1027 	if (sta->deflink.he_cap.has_he) {
1028 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1029 
1030 		if (bfee)
1031 			return mvif->cap.he_su_ebfee &&
1032 			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1033 		else
1034 			return mvif->cap.he_su_ebfer &&
1035 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1036 	}
1037 
1038 	if (sta->deflink.vht_cap.vht_supported) {
1039 		u32 cap = sta->deflink.vht_cap.cap;
1040 
1041 		if (bfee)
1042 			return mvif->cap.vht_su_ebfee &&
1043 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1044 		else
1045 			return mvif->cap.vht_su_ebfer &&
1046 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1047 	}
1048 
1049 	return false;
1050 }
1051 
1052 static void
1053 mt7915_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
1054 {
1055 	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1056 	bf->ndp_rate = 0;				/* mcs0 */
1057 	bf->ndpa_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1058 	bf->rept_poll_rate = MT7915_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1059 }
1060 
1061 static void
1062 mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1063 		       struct sta_rec_bf *bf)
1064 {
1065 	struct ieee80211_mcs_info *mcs = &sta->deflink.ht_cap.mcs;
1066 	u8 n = 0;
1067 
1068 	bf->tx_mode = MT_PHY_TYPE_HT;
1069 
1070 	if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1071 	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1072 		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1073 			      mcs->tx_params);
1074 	else if (mcs->rx_mask[3])
1075 		n = 3;
1076 	else if (mcs->rx_mask[2])
1077 		n = 2;
1078 	else if (mcs->rx_mask[1])
1079 		n = 1;
1080 
1081 	bf->nrow = hweight8(phy->mt76->chainmask) - 1;
1082 	bf->ncol = min_t(u8, bf->nrow, n);
1083 	bf->ibf_ncol = n;
1084 }
1085 
1086 static void
1087 mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
1088 			struct sta_rec_bf *bf, bool explicit)
1089 {
1090 	struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1091 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1092 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1093 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1094 	u8 tx_ant = hweight8(phy->mt76->chainmask) - 1;
1095 
1096 	bf->tx_mode = MT_PHY_TYPE_VHT;
1097 
1098 	if (explicit) {
1099 		u8 sts, snd_dim;
1100 
1101 		mt7915_mcu_sta_sounding_rate(bf);
1102 
1103 		sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1104 				pc->cap);
1105 		snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1106 				    vc->cap);
1107 		bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1108 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1109 		bf->ibf_ncol = bf->ncol;
1110 
1111 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1112 			bf->nrow = 1;
1113 	} else {
1114 		bf->nrow = tx_ant;
1115 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1116 		bf->ibf_ncol = nss_mcs;
1117 
1118 		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
1119 			bf->ibf_nrow = 1;
1120 	}
1121 }
1122 
1123 static void
1124 mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1125 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
1126 {
1127 	struct ieee80211_sta_he_cap *pc = &sta->deflink.he_cap;
1128 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1129 	const struct ieee80211_sta_he_cap *vc =
1130 		mt76_connac_get_he_phy_cap(phy->mt76, vif);
1131 	const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1132 	u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1133 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1134 	u8 snd_dim, sts;
1135 
1136 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1137 
1138 	mt7915_mcu_sta_sounding_rate(bf);
1139 
1140 	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1141 				pe->phy_cap_info[6]);
1142 	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1143 				pe->phy_cap_info[6]);
1144 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1145 			 ve->phy_cap_info[5]);
1146 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1147 		     pe->phy_cap_info[4]);
1148 	bf->nrow = min_t(u8, snd_dim, sts);
1149 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1150 	bf->ibf_ncol = bf->ncol;
1151 
1152 	if (sta->deflink.bandwidth != IEEE80211_STA_RX_BW_160)
1153 		return;
1154 
1155 	/* go over for 160MHz and 80p80 */
1156 	if (pe->phy_cap_info[0] &
1157 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1158 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1159 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1160 
1161 		bf->ncol_gt_bw80 = nss_mcs;
1162 	}
1163 
1164 	if (pe->phy_cap_info[0] &
1165 	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1166 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1167 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
1168 
1169 		if (bf->ncol_gt_bw80)
1170 			bf->ncol_gt_bw80 = min_t(u8, bf->ncol_gt_bw80, nss_mcs);
1171 		else
1172 			bf->ncol_gt_bw80 = nss_mcs;
1173 	}
1174 
1175 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1176 			 ve->phy_cap_info[5]);
1177 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1178 		     pe->phy_cap_info[4]);
1179 
1180 	bf->nrow_gt_bw80 = min_t(int, snd_dim, sts);
1181 }
1182 
1183 static void
1184 mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1185 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1186 {
1187 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1188 	struct mt7915_phy *phy = mvif->phy;
1189 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1190 	struct sta_rec_bf *bf;
1191 	struct tlv *tlv;
1192 	const u8 matrix[4][4] = {
1193 		{0, 0, 0, 0},
1194 		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1195 		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1196 		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1197 	};
1198 	bool ebf;
1199 
1200 	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
1201 		return;
1202 
1203 	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
1204 	if (!ebf && !dev->ibf)
1205 		return;
1206 
1207 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1208 	bf = (struct sta_rec_bf *)tlv;
1209 
1210 	/* he: eBF only, in accordance with spec
1211 	 * vht: support eBF and iBF
1212 	 * ht: iBF only, since mac80211 lacks of eBF support
1213 	 */
1214 	if (sta->deflink.he_cap.has_he && ebf)
1215 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
1216 	else if (sta->deflink.vht_cap.vht_supported)
1217 		mt7915_mcu_sta_bfer_vht(sta, phy, bf, ebf);
1218 	else if (sta->deflink.ht_cap.ht_supported)
1219 		mt7915_mcu_sta_bfer_ht(sta, phy, bf);
1220 	else
1221 		return;
1222 
1223 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
1224 	bf->bw = sta->deflink.bandwidth;
1225 	bf->ibf_dbw = sta->deflink.bandwidth;
1226 	bf->ibf_nrow = tx_ant;
1227 
1228 	if (!ebf && sta->deflink.bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1229 		bf->ibf_timeout = 0x48;
1230 	else
1231 		bf->ibf_timeout = 0x18;
1232 
1233 	if (ebf && bf->nrow != tx_ant)
1234 		bf->mem_20m = matrix[tx_ant][bf->ncol];
1235 	else
1236 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
1237 
1238 	switch (sta->deflink.bandwidth) {
1239 	case IEEE80211_STA_RX_BW_160:
1240 	case IEEE80211_STA_RX_BW_80:
1241 		bf->mem_total = bf->mem_20m * 2;
1242 		break;
1243 	case IEEE80211_STA_RX_BW_40:
1244 		bf->mem_total = bf->mem_20m;
1245 		break;
1246 	case IEEE80211_STA_RX_BW_20:
1247 	default:
1248 		break;
1249 	}
1250 }
1251 
1252 static void
1253 mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
1254 			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1255 {
1256 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1257 	struct mt7915_phy *phy = mvif->phy;
1258 	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
1259 	struct sta_rec_bfee *bfee;
1260 	struct tlv *tlv;
1261 	u8 nrow = 0;
1262 
1263 	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
1264 		return;
1265 
1266 	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
1267 		return;
1268 
1269 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1270 	bfee = (struct sta_rec_bfee *)tlv;
1271 
1272 	if (sta->deflink.he_cap.has_he) {
1273 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
1274 
1275 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1276 			      pe->phy_cap_info[5]);
1277 	} else if (sta->deflink.vht_cap.vht_supported) {
1278 		struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
1279 
1280 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1281 				 pc->cap);
1282 	}
1283 
1284 	/* reply with identity matrix to avoid 2x2 BF negative gain */
1285 	bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
1286 }
1287 
1288 static enum mcu_mmps_mode
1289 mt7915_mcu_get_mmps_mode(enum ieee80211_smps_mode smps)
1290 {
1291 	switch (smps) {
1292 	case IEEE80211_SMPS_OFF:
1293 		return MCU_MMPS_DISABLE;
1294 	case IEEE80211_SMPS_STATIC:
1295 		return MCU_MMPS_STATIC;
1296 	case IEEE80211_SMPS_DYNAMIC:
1297 		return MCU_MMPS_DYNAMIC;
1298 	default:
1299 		return MCU_MMPS_DISABLE;
1300 	}
1301 }
1302 
1303 int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
1304 				   struct ieee80211_vif *vif,
1305 				   struct ieee80211_sta *sta,
1306 				   void *data, u32 field)
1307 {
1308 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1309 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1310 	struct sta_phy *phy = data;
1311 	struct sta_rec_ra_fixed *ra;
1312 	struct sk_buff *skb;
1313 	struct tlv *tlv;
1314 
1315 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1316 					    &msta->wcid);
1317 	if (IS_ERR(skb))
1318 		return PTR_ERR(skb);
1319 
1320 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
1321 	ra = (struct sta_rec_ra_fixed *)tlv;
1322 
1323 	switch (field) {
1324 	case RATE_PARAM_AUTO:
1325 		break;
1326 	case RATE_PARAM_FIXED:
1327 	case RATE_PARAM_FIXED_MCS:
1328 	case RATE_PARAM_FIXED_GI:
1329 	case RATE_PARAM_FIXED_HE_LTF:
1330 		if (phy)
1331 			ra->phy = *phy;
1332 		break;
1333 	case RATE_PARAM_MMPS_UPDATE:
1334 		ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
1335 		break;
1336 	case RATE_PARAM_SPE_UPDATE:
1337 		ra->spe_idx = *(u8 *)data;
1338 		break;
1339 	default:
1340 		break;
1341 	}
1342 	ra->field = cpu_to_le32(field);
1343 
1344 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1345 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1346 }
1347 
1348 int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1349 			struct ieee80211_sta *sta)
1350 {
1351 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1352 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1353 	struct wtbl_req_hdr *wtbl_hdr;
1354 	struct tlv *sta_wtbl;
1355 	struct sk_buff *skb;
1356 	int ret;
1357 
1358 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1359 					    &msta->wcid);
1360 	if (IS_ERR(skb))
1361 		return PTR_ERR(skb);
1362 
1363 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1364 					   sizeof(struct tlv));
1365 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
1366 						  WTBL_SET, sta_wtbl, &skb);
1367 	if (IS_ERR(wtbl_hdr))
1368 		return PTR_ERR(wtbl_hdr);
1369 
1370 	mt76_connac_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_hdr);
1371 
1372 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1373 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1374 	if (ret)
1375 		return ret;
1376 
1377 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, NULL,
1378 					      RATE_PARAM_MMPS_UPDATE);
1379 }
1380 
1381 static int
1382 mt7915_mcu_set_spe_idx(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1383 		       struct ieee80211_sta *sta)
1384 {
1385 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1386 	struct mt76_phy *mphy = mvif->phy->mt76;
1387 	u8 spe_idx = mt76_connac_spe_idx(mphy->antenna_mask);
1388 
1389 	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &spe_idx,
1390 					      RATE_PARAM_SPE_UPDATE);
1391 }
1392 
1393 static int
1394 mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
1395 			       struct ieee80211_vif *vif,
1396 			       struct ieee80211_sta *sta)
1397 {
1398 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1399 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1400 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1401 	enum nl80211_band band = chandef->chan->band;
1402 	struct sta_phy phy = {};
1403 	int ret, nrates = 0;
1404 
1405 #define __sta_phy_bitrate_mask_check(_mcs, _gi, _ht, _he)			\
1406 	do {									\
1407 		u8 i, gi = mask->control[band]._gi;				\
1408 		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
1409 		for (i = 0; i <= sta->deflink.bandwidth; i++) {			\
1410 			phy.sgi |= gi << (i << (_he));				\
1411 			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
1412 		}								\
1413 		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {	\
1414 			if (!mask->control[band]._mcs[i])			\
1415 				continue;					\
1416 			nrates += hweight16(mask->control[band]._mcs[i]);	\
1417 			phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;		\
1418 			if (_ht)						\
1419 				phy.mcs += 8 * i;				\
1420 		}								\
1421 	} while (0)
1422 
1423 	if (sta->deflink.he_cap.has_he) {
1424 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
1425 	} else if (sta->deflink.vht_cap.vht_supported) {
1426 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
1427 	} else if (sta->deflink.ht_cap.ht_supported) {
1428 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
1429 	} else {
1430 		nrates = hweight32(mask->control[band].legacy);
1431 		phy.mcs = ffs(mask->control[band].legacy) - 1;
1432 	}
1433 #undef __sta_phy_bitrate_mask_check
1434 
1435 	/* fall back to auto rate control */
1436 	if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
1437 	    mask->control[band].he_gi == GENMASK(7, 0) &&
1438 	    mask->control[band].he_ltf == GENMASK(7, 0) &&
1439 	    nrates != 1)
1440 		return 0;
1441 
1442 	/* fixed single rate */
1443 	if (nrates == 1) {
1444 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1445 						     RATE_PARAM_FIXED_MCS);
1446 		if (ret)
1447 			return ret;
1448 	}
1449 
1450 	/* fixed GI */
1451 	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
1452 	    mask->control[band].he_gi != GENMASK(7, 0)) {
1453 		struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1454 		u32 addr;
1455 
1456 		/* firmware updates only TXCMD but doesn't take WTBL into
1457 		 * account, so driver should update here to reflect the
1458 		 * actual txrate hardware sends out.
1459 		 */
1460 		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
1461 		if (sta->deflink.he_cap.has_he)
1462 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
1463 		else
1464 			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
1465 
1466 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1467 						     RATE_PARAM_FIXED_GI);
1468 		if (ret)
1469 			return ret;
1470 	}
1471 
1472 	/* fixed HE_LTF */
1473 	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
1474 		ret = mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &phy,
1475 						     RATE_PARAM_FIXED_HE_LTF);
1476 		if (ret)
1477 			return ret;
1478 	}
1479 
1480 	return mt7915_mcu_set_spe_idx(dev, vif, sta);
1481 }
1482 
1483 static void
1484 mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
1485 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1486 {
1487 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1488 	struct mt76_phy *mphy = mvif->phy->mt76;
1489 	struct cfg80211_chan_def *chandef = &mphy->chandef;
1490 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
1491 	enum nl80211_band band = chandef->chan->band;
1492 	struct sta_rec_ra *ra;
1493 	struct tlv *tlv;
1494 	u32 supp_rate = sta->deflink.supp_rates[band];
1495 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
1496 
1497 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
1498 	ra = (struct sta_rec_ra *)tlv;
1499 
1500 	ra->valid = true;
1501 	ra->auto_rate = true;
1502 	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
1503 	ra->channel = chandef->chan->hw_value;
1504 	ra->bw = sta->deflink.bandwidth;
1505 	ra->phy.bw = sta->deflink.bandwidth;
1506 	ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
1507 
1508 	if (supp_rate) {
1509 		supp_rate &= mask->control[band].legacy;
1510 		ra->rate_len = hweight32(supp_rate);
1511 
1512 		if (band == NL80211_BAND_2GHZ) {
1513 			ra->supp_mode = MODE_CCK;
1514 			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
1515 
1516 			if (ra->rate_len > 4) {
1517 				ra->supp_mode |= MODE_OFDM;
1518 				ra->supp_ofdm_rate = supp_rate >> 4;
1519 			}
1520 		} else {
1521 			ra->supp_mode = MODE_OFDM;
1522 			ra->supp_ofdm_rate = supp_rate;
1523 		}
1524 	}
1525 
1526 	if (sta->deflink.ht_cap.ht_supported) {
1527 		ra->supp_mode |= MODE_HT;
1528 		ra->af = sta->deflink.ht_cap.ampdu_factor;
1529 		ra->ht_gf = !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
1530 
1531 		cap |= STA_CAP_HT;
1532 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
1533 			cap |= STA_CAP_SGI_20;
1534 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
1535 			cap |= STA_CAP_SGI_40;
1536 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
1537 			cap |= STA_CAP_TX_STBC;
1538 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
1539 			cap |= STA_CAP_RX_STBC;
1540 		if (mvif->cap.ht_ldpc &&
1541 		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
1542 			cap |= STA_CAP_LDPC;
1543 
1544 		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
1545 					  mask->control[band].ht_mcs);
1546 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
1547 	}
1548 
1549 	if (sta->deflink.vht_cap.vht_supported) {
1550 		u8 af;
1551 
1552 		ra->supp_mode |= MODE_VHT;
1553 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1554 			       sta->deflink.vht_cap.cap);
1555 		ra->af = max_t(u8, ra->af, af);
1556 
1557 		cap |= STA_CAP_VHT;
1558 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
1559 			cap |= STA_CAP_VHT_SGI_80;
1560 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
1561 			cap |= STA_CAP_VHT_SGI_160;
1562 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
1563 			cap |= STA_CAP_VHT_TX_STBC;
1564 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
1565 			cap |= STA_CAP_VHT_RX_STBC;
1566 		if (mvif->cap.vht_ldpc &&
1567 		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
1568 			cap |= STA_CAP_VHT_LDPC;
1569 
1570 		mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
1571 					   mask->control[band].vht_mcs);
1572 	}
1573 
1574 	if (sta->deflink.he_cap.has_he) {
1575 		ra->supp_mode |= MODE_HE;
1576 		cap |= STA_CAP_HE;
1577 
1578 		if (sta->deflink.he_6ghz_capa.capa)
1579 			ra->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
1580 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1581 	}
1582 
1583 	ra->sta_cap = cpu_to_le32(cap);
1584 }
1585 
1586 int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1587 			     struct ieee80211_sta *sta, bool changed)
1588 {
1589 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1590 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
1591 	struct sk_buff *skb;
1592 	int ret;
1593 
1594 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1595 					    &msta->wcid);
1596 	if (IS_ERR(skb))
1597 		return PTR_ERR(skb);
1598 
1599 	/* firmware rc algorithm refers to sta_rec_he for HE control.
1600 	 * once dev->rc_work changes the settings driver should also
1601 	 * update sta_rec_he here.
1602 	 */
1603 	if (changed)
1604 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1605 
1606 	/* sta_rec_ra accommodates BW, NSS and only MCS range format
1607 	 * i.e 0-{7,8,9} for VHT.
1608 	 */
1609 	mt7915_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
1610 
1611 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1612 				    MCU_EXT_CMD(STA_REC_UPDATE), true);
1613 	if (ret)
1614 		return ret;
1615 
1616 	/* sta_rec_ra_fixed accommodates single rate, (HE)GI and HE_LTE,
1617 	 * and updates as peer fixed rate parameters, which overrides
1618 	 * sta_rec_ra and firmware rate control algorithm.
1619 	 */
1620 	return mt7915_mcu_add_rate_ctrl_fixed(dev, vif, sta);
1621 }
1622 
1623 static int
1624 mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1625 		     struct ieee80211_sta *sta)
1626 {
1627 #define MT_STA_BSS_GROUP		1
1628 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1629 	struct mt7915_sta *msta;
1630 	struct {
1631 		__le32 action;
1632 		u8 wlan_idx_lo;
1633 		u8 status;
1634 		u8 wlan_idx_hi;
1635 		u8 rsv0[5];
1636 		__le32 val;
1637 		u8 rsv1[8];
1638 	} __packed req = {
1639 		.action = cpu_to_le32(MT_STA_BSS_GROUP),
1640 		.val = cpu_to_le32(mvif->mt76.idx % 16),
1641 	};
1642 
1643 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1644 	req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
1645 	req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
1646 
1647 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL), &req,
1648 				 sizeof(req), true);
1649 }
1650 
1651 int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1652 		       struct ieee80211_sta *sta, bool enable)
1653 {
1654 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1655 	struct mt7915_sta *msta;
1656 	struct sk_buff *skb;
1657 	int ret;
1658 
1659 	msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;
1660 
1661 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1662 					    &msta->wcid);
1663 	if (IS_ERR(skb))
1664 		return PTR_ERR(skb);
1665 
1666 	/* starec basic */
1667 	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, sta, enable,
1668 				      !rcu_access_pointer(dev->mt76.wcid[msta->wcid.idx]));
1669 	if (!enable)
1670 		goto out;
1671 
1672 	/* tag order is in accordance with firmware dependency. */
1673 	if (sta) {
1674 		/* starec bfer */
1675 		mt7915_mcu_sta_bfer_tlv(dev, skb, vif, sta);
1676 		/* starec ht */
1677 		mt7915_mcu_sta_ht_tlv(skb, sta);
1678 		/* starec vht */
1679 		mt7915_mcu_sta_vht_tlv(skb, sta);
1680 		/* starec uapsd */
1681 		mt76_connac_mcu_sta_uapsd(skb, vif, sta);
1682 	}
1683 
1684 	ret = mt7915_mcu_sta_wtbl_tlv(dev, skb, vif, sta);
1685 	if (ret) {
1686 		dev_kfree_skb(skb);
1687 		return ret;
1688 	}
1689 
1690 	if (sta) {
1691 		/* starec amsdu */
1692 		mt7915_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
1693 		/* starec he */
1694 		mt7915_mcu_sta_he_tlv(skb, sta, vif);
1695 		/* starec muru */
1696 		mt7915_mcu_sta_muru_tlv(dev, skb, sta, vif);
1697 		/* starec bfee */
1698 		mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
1699 	}
1700 
1701 	ret = mt7915_mcu_add_group(dev, vif, sta);
1702 	if (ret) {
1703 		dev_kfree_skb(skb);
1704 		return ret;
1705 	}
1706 out:
1707 	ret = mt76_connac_mcu_sta_wed_update(&dev->mt76, skb);
1708 	if (ret)
1709 		return ret;
1710 
1711 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1712 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
1713 }
1714 
1715 int mt7915_mcu_wed_enable_rx_stats(struct mt7915_dev *dev)
1716 {
1717 #ifdef CONFIG_NET_MEDIATEK_SOC_WED
1718 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
1719 	struct {
1720 		__le32 args[2];
1721 	} req = {
1722 		.args[0] = cpu_to_le32(1),
1723 		.args[1] = cpu_to_le32(6),
1724 	};
1725 
1726 	return mtk_wed_device_update_msg(wed, MTK_WED_WO_CMD_RXCNT_CTRL,
1727 					 &req, sizeof(req));
1728 #else
1729 	return 0;
1730 #endif
1731 }
1732 
1733 int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
1734 			    struct ieee80211_vif *vif, bool enable)
1735 {
1736 	struct mt7915_dev *dev = phy->dev;
1737 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1738 	struct {
1739 		struct req_hdr {
1740 			u8 omac_idx;
1741 			u8 band_idx;
1742 			__le16 tlv_num;
1743 			u8 is_tlv_append;
1744 			u8 rsv[3];
1745 		} __packed hdr;
1746 		struct req_tlv {
1747 			__le16 tag;
1748 			__le16 len;
1749 			u8 active;
1750 			u8 band_idx;
1751 			u8 omac_addr[ETH_ALEN];
1752 		} __packed tlv;
1753 	} data = {
1754 		.hdr = {
1755 			.omac_idx = mvif->mt76.omac_idx,
1756 			.band_idx = mvif->mt76.band_idx,
1757 			.tlv_num = cpu_to_le16(1),
1758 			.is_tlv_append = 1,
1759 		},
1760 		.tlv = {
1761 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
1762 			.len = cpu_to_le16(sizeof(struct req_tlv)),
1763 			.active = enable,
1764 			.band_idx = mvif->mt76.band_idx,
1765 		},
1766 	};
1767 
1768 	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
1769 		return mt7915_mcu_muar_config(phy, vif, false, enable);
1770 
1771 	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
1772 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(DEV_INFO_UPDATE),
1773 				 &data, sizeof(data), true);
1774 }
1775 
1776 static void
1777 mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
1778 			 struct sk_buff *skb, struct bss_info_bcn *bcn,
1779 			 struct ieee80211_mutable_offsets *offs)
1780 {
1781 	struct bss_info_bcn_cntdwn *info;
1782 	struct tlv *tlv;
1783 	int sub_tag;
1784 
1785 	if (!offs->cntdwn_counter_offs[0])
1786 		return;
1787 
1788 	sub_tag = vif->bss_conf.csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
1789 	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
1790 					   &bcn->sub_ntlv, &bcn->len);
1791 	info = (struct bss_info_bcn_cntdwn *)tlv;
1792 	info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
1793 }
1794 
1795 static void
1796 mt7915_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
1797 		       struct ieee80211_vif *vif, struct bss_info_bcn *bcn,
1798 		       struct ieee80211_mutable_offsets *offs)
1799 {
1800 	struct bss_info_bcn_mbss *mbss;
1801 	const struct element *elem;
1802 	struct tlv *tlv;
1803 
1804 	if (!vif->bss_conf.bssid_indicator)
1805 		return;
1806 
1807 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_MBSSID,
1808 					   sizeof(*mbss), &bcn->sub_ntlv,
1809 					   &bcn->len);
1810 
1811 	mbss = (struct bss_info_bcn_mbss *)tlv;
1812 	mbss->offset[0] = cpu_to_le16(offs->tim_offset);
1813 	mbss->bitmap = cpu_to_le32(1);
1814 
1815 	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
1816 			    &skb->data[offs->mbssid_off],
1817 			    skb->len - offs->mbssid_off) {
1818 		const struct element *sub_elem;
1819 
1820 		if (elem->datalen < 2)
1821 			continue;
1822 
1823 		for_each_element(sub_elem, elem->data + 1, elem->datalen - 1) {
1824 			const struct ieee80211_bssid_index *idx;
1825 			const u8 *idx_ie;
1826 
1827 			if (sub_elem->id || sub_elem->datalen < 4)
1828 				continue; /* not a valid BSS profile */
1829 
1830 			/* Find WLAN_EID_MULTI_BSSID_IDX
1831 			 * in the merged nontransmitted profile
1832 			 */
1833 			idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
1834 						  sub_elem->data,
1835 						  sub_elem->datalen);
1836 			if (!idx_ie || idx_ie[1] < sizeof(*idx))
1837 				continue;
1838 
1839 			idx = (void *)(idx_ie + 2);
1840 			if (!idx->bssid_index || idx->bssid_index > 31)
1841 				continue;
1842 
1843 			mbss->offset[idx->bssid_index] =
1844 				cpu_to_le16(idx_ie - skb->data);
1845 			mbss->bitmap |= cpu_to_le32(BIT(idx->bssid_index));
1846 		}
1847 	}
1848 }
1849 
1850 static void
1851 mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1852 		       struct sk_buff *rskb, struct sk_buff *skb,
1853 		       struct bss_info_bcn *bcn,
1854 		       struct ieee80211_mutable_offsets *offs)
1855 {
1856 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1857 	struct bss_info_bcn_cont *cont;
1858 	struct tlv *tlv;
1859 	u8 *buf;
1860 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
1861 
1862 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1863 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
1864 					   len, &bcn->sub_ntlv, &bcn->len);
1865 
1866 	cont = (struct bss_info_bcn_cont *)tlv;
1867 	cont->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1868 	cont->tim_ofs = cpu_to_le16(offs->tim_offset);
1869 
1870 	if (offs->cntdwn_counter_offs[0]) {
1871 		u16 offset = offs->cntdwn_counter_offs[0];
1872 
1873 		if (vif->bss_conf.csa_active)
1874 			cont->csa_ofs = cpu_to_le16(offset - 4);
1875 		if (vif->bss_conf.color_change_active)
1876 			cont->bcc_ofs = cpu_to_le16(offset - 3);
1877 	}
1878 
1879 	buf = (u8 *)tlv + sizeof(*cont);
1880 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
1881 			      0, BSS_CHANGED_BEACON);
1882 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1883 }
1884 
1885 static void
1886 mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
1887 				struct sk_buff *rskb, struct bss_info_bcn *bcn,
1888 				u32 changed)
1889 {
1890 #define OFFLOAD_TX_MODE_SU	BIT(0)
1891 #define OFFLOAD_TX_MODE_MU	BIT(1)
1892 	struct ieee80211_hw *hw = mt76_hw(dev);
1893 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
1894 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1895 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
1896 	enum nl80211_band band = chandef->chan->band;
1897 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1898 	struct bss_info_inband_discovery *discov;
1899 	struct ieee80211_tx_info *info;
1900 	struct sk_buff *skb = NULL;
1901 	struct tlv *tlv;
1902 	bool ext_phy = phy != &dev->phy;
1903 	u8 *buf, interval;
1904 	int len;
1905 
1906 	if (changed & BSS_CHANGED_FILS_DISCOVERY &&
1907 	    vif->bss_conf.fils_discovery.max_interval) {
1908 		interval = vif->bss_conf.fils_discovery.max_interval;
1909 		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
1910 	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
1911 		   vif->bss_conf.unsol_bcast_probe_resp_interval) {
1912 		interval = vif->bss_conf.unsol_bcast_probe_resp_interval;
1913 		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
1914 	}
1915 
1916 	if (!skb)
1917 		return;
1918 
1919 	info = IEEE80211_SKB_CB(skb);
1920 	info->control.vif = vif;
1921 	info->band = band;
1922 
1923 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
1924 
1925 	len = sizeof(*discov) + MT_TXD_SIZE + skb->len;
1926 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
1927 
1928 	if (len > (MT7915_MAX_BSS_OFFLOAD_SIZE - rskb->len)) {
1929 		dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
1930 		dev_kfree_skb(skb);
1931 		return;
1932 	}
1933 
1934 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_DISCOV,
1935 					   len, &bcn->sub_ntlv, &bcn->len);
1936 	discov = (struct bss_info_inband_discovery *)tlv;
1937 	discov->tx_mode = OFFLOAD_TX_MODE_SU;
1938 	/* 0: UNSOL PROBE RESP, 1: FILS DISCOV */
1939 	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
1940 	discov->tx_interval = interval;
1941 	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
1942 	discov->enable = true;
1943 
1944 	buf = (u8 *)tlv + sizeof(*discov);
1945 
1946 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
1947 			      0, changed);
1948 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
1949 
1950 	dev_kfree_skb(skb);
1951 }
1952 
1953 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1954 			  int en, u32 changed)
1955 {
1956 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
1957 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
1958 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
1959 	struct ieee80211_mutable_offsets offs;
1960 	struct ieee80211_tx_info *info;
1961 	struct sk_buff *skb, *rskb;
1962 	struct tlv *tlv;
1963 	struct bss_info_bcn *bcn;
1964 	int len = MT7915_MAX_BSS_OFFLOAD_SIZE;
1965 	bool ext_phy = phy != &dev->phy;
1966 
1967 	if (vif->bss_conf.nontransmitted)
1968 		return 0;
1969 
1970 	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
1971 					       NULL, len);
1972 	if (IS_ERR(rskb))
1973 		return PTR_ERR(rskb);
1974 
1975 	tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
1976 	bcn = (struct bss_info_bcn *)tlv;
1977 	bcn->enable = en;
1978 
1979 	if (!en)
1980 		goto out;
1981 
1982 	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
1983 	if (!skb)
1984 		return -EINVAL;
1985 
1986 	if (skb->len > MT7915_MAX_BEACON_SIZE - MT_TXD_SIZE) {
1987 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
1988 		dev_kfree_skb(skb);
1989 		return -EINVAL;
1990 	}
1991 
1992 	info = IEEE80211_SKB_CB(skb);
1993 	info->hw_queue = FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
1994 
1995 	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
1996 	mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
1997 	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
1998 	dev_kfree_skb(skb);
1999 
2000 	if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP ||
2001 	    changed & BSS_CHANGED_FILS_DISCOVERY)
2002 		mt7915_mcu_beacon_inband_discov(dev, vif, rskb,
2003 						bcn, changed);
2004 
2005 out:
2006 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
2007 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
2008 }
2009 
2010 static int mt7915_driver_own(struct mt7915_dev *dev, u8 band)
2011 {
2012 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(band), MT_TOP_LPCR_HOST_DRV_OWN);
2013 	if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND(band),
2014 			    MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) {
2015 		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2016 		return -EIO;
2017 	}
2018 
2019 	/* clear irq when the driver own success */
2020 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND_IRQ_STAT(band),
2021 		MT_TOP_LPCR_HOST_BAND_STAT);
2022 
2023 	return 0;
2024 }
2025 
2026 static int
2027 mt7915_firmware_state(struct mt7915_dev *dev, bool wa)
2028 {
2029 	u32 state = FIELD_PREP(MT_TOP_MISC_FW_STATE,
2030 			       wa ? FW_STATE_RDY : FW_STATE_FW_DOWNLOAD);
2031 
2032 	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
2033 			    state, 1000)) {
2034 		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
2035 		return -EIO;
2036 	}
2037 	return 0;
2038 }
2039 
2040 static int mt7915_load_firmware(struct mt7915_dev *dev)
2041 {
2042 	int ret;
2043 
2044 	/* make sure fw is download state */
2045 	if (mt7915_firmware_state(dev, false)) {
2046 		/* restart firmware once */
2047 		mt76_connac_mcu_restart(&dev->mt76);
2048 		ret = mt7915_firmware_state(dev, false);
2049 		if (ret) {
2050 			dev_err(dev->mt76.dev,
2051 				"Firmware is not ready for download\n");
2052 			return ret;
2053 		}
2054 	}
2055 
2056 	ret = mt76_connac2_load_patch(&dev->mt76, fw_name_var(dev, ROM_PATCH));
2057 	if (ret)
2058 		return ret;
2059 
2060 	ret = mt76_connac2_load_ram(&dev->mt76, fw_name_var(dev, FIRMWARE_WM),
2061 				    fw_name(dev, FIRMWARE_WA));
2062 	if (ret)
2063 		return ret;
2064 
2065 	ret = mt7915_firmware_state(dev, true);
2066 	if (ret)
2067 		return ret;
2068 
2069 	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
2070 
2071 	dev_dbg(dev->mt76.dev, "Firmware init done\n");
2072 
2073 	return 0;
2074 }
2075 
2076 int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl)
2077 {
2078 	struct {
2079 		u8 ctrl_val;
2080 		u8 pad[3];
2081 	} data = {
2082 		.ctrl_val = ctrl
2083 	};
2084 
2085 	if (type == MCU_FW_LOG_WA)
2086 		return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(FW_LOG_2_HOST),
2087 					 &data, sizeof(data), true);
2088 
2089 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_LOG_2_HOST), &data,
2090 				 sizeof(data), true);
2091 }
2092 
2093 int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level)
2094 {
2095 	struct {
2096 		u8 ver;
2097 		u8 pad;
2098 		__le16 len;
2099 		u8 level;
2100 		u8 rsv[3];
2101 		__le32 module_idx;
2102 	} data = {
2103 		.module_idx = cpu_to_le32(module),
2104 		.level = level,
2105 	};
2106 
2107 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(FW_DBG_CTRL), &data,
2108 				 sizeof(data), false);
2109 }
2110 
2111 int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enabled)
2112 {
2113 	struct {
2114 		__le32 cmd;
2115 		u8 enable;
2116 	} data = {
2117 		.cmd = cpu_to_le32(MURU_SET_TXC_TX_STATS_EN),
2118 		.enable = enabled,
2119 	};
2120 
2121 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &data,
2122 				sizeof(data), false);
2123 }
2124 
2125 int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy)
2126 {
2127 	struct mt7915_dev *dev = phy->dev;
2128 	struct sk_buff *skb;
2129 	struct mt7915_mcu_muru_stats *mu_stats;
2130 	int ret;
2131 
2132 	struct {
2133 		__le32 cmd;
2134 		u8 band_idx;
2135 	} req = {
2136 		.cmd = cpu_to_le32(MURU_GET_TXC_TX_STATS),
2137 		.band_idx = phy->mt76->band_idx,
2138 	};
2139 
2140 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
2141 					&req, sizeof(req), true, &skb);
2142 	if (ret)
2143 		return ret;
2144 
2145 	mu_stats = (struct mt7915_mcu_muru_stats *)(skb->data);
2146 
2147 	/* accumulate stats, these are clear-on-read */
2148 #define __dl_u32(s)	 phy->mib.dl_##s += le32_to_cpu(mu_stats->dl.s)
2149 #define __ul_u32(s)	 phy->mib.ul_##s += le32_to_cpu(mu_stats->ul.s)
2150 	__dl_u32(cck_cnt);
2151 	__dl_u32(ofdm_cnt);
2152 	__dl_u32(htmix_cnt);
2153 	__dl_u32(htgf_cnt);
2154 	__dl_u32(vht_su_cnt);
2155 	__dl_u32(vht_2mu_cnt);
2156 	__dl_u32(vht_3mu_cnt);
2157 	__dl_u32(vht_4mu_cnt);
2158 	__dl_u32(he_su_cnt);
2159 	__dl_u32(he_2ru_cnt);
2160 	__dl_u32(he_2mu_cnt);
2161 	__dl_u32(he_3ru_cnt);
2162 	__dl_u32(he_3mu_cnt);
2163 	__dl_u32(he_4ru_cnt);
2164 	__dl_u32(he_4mu_cnt);
2165 	__dl_u32(he_5to8ru_cnt);
2166 	__dl_u32(he_9to16ru_cnt);
2167 	__dl_u32(he_gtr16ru_cnt);
2168 
2169 	__ul_u32(hetrig_su_cnt);
2170 	__ul_u32(hetrig_2ru_cnt);
2171 	__ul_u32(hetrig_3ru_cnt);
2172 	__ul_u32(hetrig_4ru_cnt);
2173 	__ul_u32(hetrig_5to8ru_cnt);
2174 	__ul_u32(hetrig_9to16ru_cnt);
2175 	__ul_u32(hetrig_gtr16ru_cnt);
2176 	__ul_u32(hetrig_2mu_cnt);
2177 	__ul_u32(hetrig_3mu_cnt);
2178 	__ul_u32(hetrig_4mu_cnt);
2179 #undef __dl_u32
2180 #undef __ul_u32
2181 
2182 	dev_kfree_skb(skb);
2183 
2184 	return 0;
2185 }
2186 
2187 static int mt7915_mcu_set_mwds(struct mt7915_dev *dev, bool enabled)
2188 {
2189 	struct {
2190 		u8 enable;
2191 		u8 _rsv[3];
2192 	} __packed req = {
2193 		.enable = enabled
2194 	};
2195 
2196 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
2197 				 sizeof(req), false);
2198 }
2199 
2200 int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val)
2201 {
2202 	struct {
2203 		__le32 cmd;
2204 		u8 val[4];
2205 	} __packed req = {
2206 		.cmd = cpu_to_le32(cmd),
2207 	};
2208 
2209 	put_unaligned_le32(val, req.val);
2210 
2211 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
2212 				 sizeof(req), false);
2213 }
2214 
2215 static int
2216 mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
2217 {
2218 #define RX_AIRTIME_FEATURE_CTRL		1
2219 #define RX_AIRTIME_BITWISE_CTRL		2
2220 #define RX_AIRTIME_CLEAR_EN	1
2221 	struct {
2222 		__le16 field;
2223 		__le16 sub_field;
2224 		__le32 set_status;
2225 		__le32 get_status;
2226 		u8 _rsv[12];
2227 
2228 		bool airtime_en;
2229 		bool mibtime_en;
2230 		bool earlyend_en;
2231 		u8 _rsv1[9];
2232 
2233 		bool airtime_clear;
2234 		bool mibtime_clear;
2235 		u8 _rsv2[98];
2236 	} __packed req = {
2237 		.field = cpu_to_le16(RX_AIRTIME_BITWISE_CTRL),
2238 		.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN),
2239 		.airtime_clear = true,
2240 	};
2241 	int ret;
2242 
2243 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2244 				sizeof(req), true);
2245 	if (ret)
2246 		return ret;
2247 
2248 	req.field = cpu_to_le16(RX_AIRTIME_FEATURE_CTRL);
2249 	req.sub_field = cpu_to_le16(RX_AIRTIME_CLEAR_EN);
2250 	req.airtime_en = true;
2251 
2252 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_AIRTIME_CTRL), &req,
2253 				 sizeof(req), true);
2254 }
2255 
2256 static int mt7915_red_set_watermark(struct mt7915_dev *dev)
2257 {
2258 #define RED_GLOBAL_TOKEN_WATERMARK 2
2259 	struct {
2260 		__le32 args[3];
2261 		u8 cmd;
2262 		u8 version;
2263 		u8 __rsv1[4];
2264 		__le16 len;
2265 		__le16 high_mark;
2266 		__le16 low_mark;
2267 		u8 __rsv2[12];
2268 	} __packed req = {
2269 		.args[0] = cpu_to_le32(MCU_WA_PARAM_RED_SETTING),
2270 		.cmd = RED_GLOBAL_TOKEN_WATERMARK,
2271 		.len = cpu_to_le16(sizeof(req) - sizeof(req.args)),
2272 		.high_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256),
2273 		.low_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256 - 1536),
2274 	};
2275 
2276 	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET), &req,
2277 				 sizeof(req), false);
2278 }
2279 
2280 static int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
2281 {
2282 #define RED_DISABLE		0
2283 #define RED_BY_WA_ENABLE	2
2284 	int ret;
2285 	u32 red_type = enabled ? RED_BY_WA_ENABLE : RED_DISABLE;
2286 	__le32 req = cpu_to_le32(red_type);
2287 
2288 	if (enabled) {
2289 		ret = mt7915_red_set_watermark(dev);
2290 		if (ret < 0)
2291 			return ret;
2292 	}
2293 
2294 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RED_ENABLE), &req,
2295 				sizeof(req), false);
2296 	if (ret < 0)
2297 		return ret;
2298 
2299 	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
2300 				 MCU_WA_PARAM_RED, enabled, 0);
2301 }
2302 
2303 int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
2304 {
2305 	int ret;
2306 
2307 	/* force firmware operation mode into normal state,
2308 	 * which should be set before firmware download stage.
2309 	 */
2310 	mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
2311 
2312 	ret = mt7915_driver_own(dev, 0);
2313 	if (ret)
2314 		return ret;
2315 	/* set driver own for band1 when two hif exist */
2316 	if (dev->hif2) {
2317 		ret = mt7915_driver_own(dev, 1);
2318 		if (ret)
2319 			return ret;
2320 	}
2321 
2322 	ret = mt7915_load_firmware(dev);
2323 	if (ret)
2324 		return ret;
2325 
2326 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
2327 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
2328 	if (ret)
2329 		return ret;
2330 
2331 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, 0);
2332 	if (ret)
2333 		return ret;
2334 
2335 	if ((mtk_wed_device_active(&dev->mt76.mmio.wed) &&
2336 	     is_mt7915(&dev->mt76)) ||
2337 	    !mtk_wed_get_rx_capa(&dev->mt76.mmio.wed))
2338 		mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY), 0, 0, 0);
2339 
2340 	ret = mt7915_mcu_set_mwds(dev, 1);
2341 	if (ret)
2342 		return ret;
2343 
2344 	ret = mt7915_mcu_set_muru_ctrl(dev, MURU_SET_PLATFORM_TYPE,
2345 				       MURU_PLATFORM_TYPE_PERF_LEVEL_2);
2346 	if (ret)
2347 		return ret;
2348 
2349 	ret = mt7915_mcu_init_rx_airtime(dev);
2350 	if (ret)
2351 		return ret;
2352 
2353 	return mt7915_mcu_set_red(dev, mtk_wed_device_active(&dev->mt76.mmio.wed));
2354 }
2355 
2356 int mt7915_mcu_init(struct mt7915_dev *dev)
2357 {
2358 	static const struct mt76_mcu_ops mt7915_mcu_ops = {
2359 		.headroom = sizeof(struct mt76_connac2_mcu_txd),
2360 		.mcu_skb_send_msg = mt7915_mcu_send_message,
2361 		.mcu_parse_response = mt7915_mcu_parse_response,
2362 	};
2363 
2364 	dev->mt76.mcu_ops = &mt7915_mcu_ops;
2365 
2366 	return mt7915_mcu_init_firmware(dev);
2367 }
2368 
2369 void mt7915_mcu_exit(struct mt7915_dev *dev)
2370 {
2371 	mt76_connac_mcu_restart(&dev->mt76);
2372 	if (mt7915_firmware_state(dev, false)) {
2373 		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
2374 		goto out;
2375 	}
2376 
2377 	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
2378 	if (dev->hif2)
2379 		mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
2380 			MT_TOP_LPCR_HOST_FW_OWN);
2381 out:
2382 	skb_queue_purge(&dev->mt76.mcu.res_q);
2383 }
2384 
2385 static int
2386 mt7915_mcu_set_rx_hdr_trans_blacklist(struct mt7915_dev *dev, int band)
2387 {
2388 	struct {
2389 		u8 operation;
2390 		u8 count;
2391 		u8 _rsv[2];
2392 		u8 index;
2393 		u8 enable;
2394 		__le16 etype;
2395 	} req = {
2396 		.operation = 1,
2397 		.count = 1,
2398 		.enable = 1,
2399 		.etype = cpu_to_le16(ETH_P_PAE),
2400 	};
2401 
2402 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2403 				 &req, sizeof(req), false);
2404 }
2405 
2406 int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band,
2407 		       bool enable, bool hdr_trans)
2408 {
2409 	struct {
2410 		u8 operation;
2411 		u8 enable;
2412 		u8 check_bssid;
2413 		u8 insert_vlan;
2414 		u8 remove_vlan;
2415 		u8 tid;
2416 		u8 mode;
2417 		u8 rsv;
2418 	} __packed req_trans = {
2419 		.enable = hdr_trans,
2420 	};
2421 	struct {
2422 		u8 enable;
2423 		u8 band;
2424 		u8 rsv[2];
2425 	} __packed req_mac = {
2426 		.enable = enable,
2427 		.band = band,
2428 	};
2429 	int ret;
2430 
2431 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_HDR_TRANS),
2432 				&req_trans, sizeof(req_trans), false);
2433 	if (ret)
2434 		return ret;
2435 
2436 	if (hdr_trans)
2437 		mt7915_mcu_set_rx_hdr_trans_blacklist(dev, band);
2438 
2439 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MAC_INIT_CTRL),
2440 				 &req_mac, sizeof(req_mac), true);
2441 }
2442 
2443 int mt7915_mcu_update_edca(struct mt7915_dev *dev, void *param)
2444 {
2445 	struct mt7915_mcu_tx *req = (struct mt7915_mcu_tx *)param;
2446 	u8 num = req->total;
2447 	size_t len = sizeof(*req) -
2448 		     (IEEE80211_NUM_ACS - num) * sizeof(struct edca);
2449 
2450 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE), req,
2451 				 len, true);
2452 }
2453 
2454 int mt7915_mcu_set_tx(struct mt7915_dev *dev, struct ieee80211_vif *vif)
2455 {
2456 #define TX_CMD_MODE		1
2457 	struct mt7915_mcu_tx req = {
2458 		.valid = true,
2459 		.mode = TX_CMD_MODE,
2460 		.total = IEEE80211_NUM_ACS,
2461 	};
2462 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
2463 	int ac;
2464 
2465 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2466 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
2467 		struct edca *e = &req.edca[ac];
2468 
2469 		e->set = WMM_PARAM_SET;
2470 		e->queue = ac + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
2471 		e->aifs = q->aifs;
2472 		e->txop = cpu_to_le16(q->txop);
2473 
2474 		if (q->cw_min)
2475 			e->cw_min = fls(q->cw_min);
2476 		else
2477 			e->cw_min = 5;
2478 
2479 		if (q->cw_max)
2480 			e->cw_max = cpu_to_le16(fls(q->cw_max));
2481 		else
2482 			e->cw_max = cpu_to_le16(10);
2483 	}
2484 
2485 	return mt7915_mcu_update_edca(dev, &req);
2486 }
2487 
2488 int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val)
2489 {
2490 	struct {
2491 		__le32 tag;
2492 		__le16 min_lpn;
2493 		u8 rsv[2];
2494 	} __packed req = {
2495 		.tag = cpu_to_le32(0x1),
2496 		.min_lpn = cpu_to_le16(val),
2497 	};
2498 
2499 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2500 				 sizeof(req), true);
2501 }
2502 
2503 int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
2504 			    const struct mt7915_dfs_pulse *pulse)
2505 {
2506 	struct {
2507 		__le32 tag;
2508 
2509 		__le32 max_width;		/* us */
2510 		__le32 max_pwr;			/* dbm */
2511 		__le32 min_pwr;			/* dbm */
2512 		__le32 min_stgr_pri;		/* us */
2513 		__le32 max_stgr_pri;		/* us */
2514 		__le32 min_cr_pri;		/* us */
2515 		__le32 max_cr_pri;		/* us */
2516 	} __packed req = {
2517 		.tag = cpu_to_le32(0x3),
2518 
2519 #define __req_field(field) .field = cpu_to_le32(pulse->field)
2520 		__req_field(max_width),
2521 		__req_field(max_pwr),
2522 		__req_field(min_pwr),
2523 		__req_field(min_stgr_pri),
2524 		__req_field(max_stgr_pri),
2525 		__req_field(min_cr_pri),
2526 		__req_field(max_cr_pri),
2527 #undef __req_field
2528 	};
2529 
2530 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2531 				 sizeof(req), true);
2532 }
2533 
2534 int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
2535 			    const struct mt7915_dfs_pattern *pattern)
2536 {
2537 	struct {
2538 		__le32 tag;
2539 		__le16 radar_type;
2540 
2541 		u8 enb;
2542 		u8 stgr;
2543 		u8 min_crpn;
2544 		u8 max_crpn;
2545 		u8 min_crpr;
2546 		u8 min_pw;
2547 		__le32 min_pri;
2548 		__le32 max_pri;
2549 		u8 max_pw;
2550 		u8 min_crbn;
2551 		u8 max_crbn;
2552 		u8 min_stgpn;
2553 		u8 max_stgpn;
2554 		u8 min_stgpr;
2555 		u8 rsv[2];
2556 		__le32 min_stgpr_diff;
2557 	} __packed req = {
2558 		.tag = cpu_to_le32(0x2),
2559 		.radar_type = cpu_to_le16(index),
2560 
2561 #define __req_field_u8(field) .field = pattern->field
2562 #define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
2563 		__req_field_u8(enb),
2564 		__req_field_u8(stgr),
2565 		__req_field_u8(min_crpn),
2566 		__req_field_u8(max_crpn),
2567 		__req_field_u8(min_crpr),
2568 		__req_field_u8(min_pw),
2569 		__req_field_u32(min_pri),
2570 		__req_field_u32(max_pri),
2571 		__req_field_u8(max_pw),
2572 		__req_field_u8(min_crbn),
2573 		__req_field_u8(max_crbn),
2574 		__req_field_u8(min_stgpn),
2575 		__req_field_u8(max_stgpn),
2576 		__req_field_u8(min_stgpr),
2577 		__req_field_u32(min_stgpr_diff),
2578 #undef __req_field_u8
2579 #undef __req_field_u32
2580 	};
2581 
2582 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_RDD_TH), &req,
2583 				 sizeof(req), true);
2584 }
2585 
2586 static int
2587 mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
2588 				 struct cfg80211_chan_def *chandef,
2589 				 int cmd)
2590 {
2591 	struct mt7915_dev *dev = phy->dev;
2592 	struct mt76_phy *mphy = phy->mt76;
2593 	struct ieee80211_channel *chan = mphy->chandef.chan;
2594 	int freq = mphy->chandef.center_freq1;
2595 	struct mt7915_mcu_background_chain_ctrl req = {
2596 		.monitor_scan_type = 2, /* simple rx */
2597 	};
2598 
2599 	if (!chandef && cmd != CH_SWITCH_BACKGROUND_SCAN_STOP)
2600 		return -EINVAL;
2601 
2602 	if (!cfg80211_chandef_valid(&mphy->chandef))
2603 		return -EINVAL;
2604 
2605 	switch (cmd) {
2606 	case CH_SWITCH_BACKGROUND_SCAN_START: {
2607 		req.chan = chan->hw_value;
2608 		req.central_chan = ieee80211_frequency_to_channel(freq);
2609 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2610 		req.monitor_chan = chandef->chan->hw_value;
2611 		req.monitor_central_chan =
2612 			ieee80211_frequency_to_channel(chandef->center_freq1);
2613 		req.monitor_bw = mt76_connac_chan_bw(chandef);
2614 		req.band_idx = phy->mt76->band_idx;
2615 		req.scan_mode = 1;
2616 		break;
2617 	}
2618 	case CH_SWITCH_BACKGROUND_SCAN_RUNNING:
2619 		req.monitor_chan = chandef->chan->hw_value;
2620 		req.monitor_central_chan =
2621 			ieee80211_frequency_to_channel(chandef->center_freq1);
2622 		req.band_idx = phy->mt76->band_idx;
2623 		req.scan_mode = 2;
2624 		break;
2625 	case CH_SWITCH_BACKGROUND_SCAN_STOP:
2626 		req.chan = chan->hw_value;
2627 		req.central_chan = ieee80211_frequency_to_channel(freq);
2628 		req.bw = mt76_connac_chan_bw(&mphy->chandef);
2629 		req.tx_stream = hweight8(mphy->antenna_mask);
2630 		req.rx_stream = mphy->antenna_mask;
2631 		break;
2632 	default:
2633 		return -EINVAL;
2634 	}
2635 	req.band = chandef ? chandef->chan->band == NL80211_BAND_5GHZ : 1;
2636 
2637 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(OFFCH_SCAN_CTRL),
2638 				 &req, sizeof(req), false);
2639 }
2640 
2641 int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
2642 				     struct cfg80211_chan_def *chandef)
2643 {
2644 	struct mt7915_dev *dev = phy->dev;
2645 	int err, region;
2646 
2647 	if (!chandef) { /* disable offchain */
2648 		err = mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_STOP, MT_RX_SEL2,
2649 					      0, 0);
2650 		if (err)
2651 			return err;
2652 
2653 		return mt7915_mcu_background_chain_ctrl(phy, NULL,
2654 				CH_SWITCH_BACKGROUND_SCAN_STOP);
2655 	}
2656 
2657 	err = mt7915_mcu_background_chain_ctrl(phy, chandef,
2658 					       CH_SWITCH_BACKGROUND_SCAN_START);
2659 	if (err)
2660 		return err;
2661 
2662 	switch (dev->mt76.region) {
2663 	case NL80211_DFS_ETSI:
2664 		region = 0;
2665 		break;
2666 	case NL80211_DFS_JP:
2667 		region = 2;
2668 		break;
2669 	case NL80211_DFS_FCC:
2670 	default:
2671 		region = 1;
2672 		break;
2673 	}
2674 
2675 	return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_START, MT_RX_SEL2,
2676 				       0, region);
2677 }
2678 
2679 int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
2680 {
2681 	static const u8 ch_band[] = {
2682 		[NL80211_BAND_2GHZ] = 0,
2683 		[NL80211_BAND_5GHZ] = 1,
2684 		[NL80211_BAND_6GHZ] = 2,
2685 	};
2686 	struct mt7915_dev *dev = phy->dev;
2687 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2688 	int freq1 = chandef->center_freq1;
2689 	u8 band = phy->mt76->band_idx;
2690 	struct {
2691 		u8 control_ch;
2692 		u8 center_ch;
2693 		u8 bw;
2694 		u8 tx_path_num;
2695 		u8 rx_path;	/* mask or num */
2696 		u8 switch_reason;
2697 		u8 band_idx;
2698 		u8 center_ch2;	/* for 80+80 only */
2699 		__le16 cac_case;
2700 		u8 channel_band;
2701 		u8 rsv0;
2702 		__le32 outband_freq;
2703 		u8 txpower_drop;
2704 		u8 ap_bw;
2705 		u8 ap_center_ch;
2706 		u8 rsv1[57];
2707 	} __packed req = {
2708 		.control_ch = chandef->chan->hw_value,
2709 		.center_ch = ieee80211_frequency_to_channel(freq1),
2710 		.bw = mt76_connac_chan_bw(chandef),
2711 		.tx_path_num = hweight16(phy->mt76->chainmask),
2712 		.rx_path = phy->mt76->chainmask >> (dev->chainshift * band),
2713 		.band_idx = band,
2714 		.channel_band = ch_band[chandef->chan->band],
2715 	};
2716 
2717 #ifdef CONFIG_NL80211_TESTMODE
2718 	if (phy->mt76->test.tx_antenna_mask &&
2719 	    mt76_testmode_enabled(phy->mt76)) {
2720 		req.tx_path_num = fls(phy->mt76->test.tx_antenna_mask);
2721 		req.rx_path = phy->mt76->test.tx_antenna_mask;
2722 	}
2723 #endif
2724 
2725 	if (mt76_connac_spe_idx(phy->mt76->antenna_mask))
2726 		req.tx_path_num = fls(phy->mt76->antenna_mask);
2727 
2728 	if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
2729 	    dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
2730 		req.switch_reason = CH_SWITCH_NORMAL;
2731 	else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
2732 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
2733 	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
2734 					  NL80211_IFTYPE_AP))
2735 		req.switch_reason = CH_SWITCH_DFS;
2736 	else
2737 		req.switch_reason = CH_SWITCH_NORMAL;
2738 
2739 	if (cmd == MCU_EXT_CMD(CHANNEL_SWITCH))
2740 		req.rx_path = hweight8(req.rx_path);
2741 
2742 	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
2743 		int freq2 = chandef->center_freq2;
2744 
2745 		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
2746 	}
2747 
2748 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), true);
2749 }
2750 
2751 static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
2752 {
2753 #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
2754 #define PAGE_IDX_MASK		GENMASK(4, 2)
2755 #define PER_PAGE_SIZE		0x400
2756 	struct mt7915_mcu_eeprom req = { .buffer_mode = EE_MODE_BUFFER };
2757 	u16 eeprom_size = mt7915_eeprom_size(dev);
2758 	u8 total = DIV_ROUND_UP(eeprom_size, PER_PAGE_SIZE);
2759 	u8 *eep = (u8 *)dev->mt76.eeprom.data;
2760 	int eep_len;
2761 	int i;
2762 
2763 	for (i = 0; i < total; i++, eep += eep_len) {
2764 		struct sk_buff *skb;
2765 		int ret;
2766 
2767 		if (i == total - 1 && !!(eeprom_size % PER_PAGE_SIZE))
2768 			eep_len = eeprom_size % PER_PAGE_SIZE;
2769 		else
2770 			eep_len = PER_PAGE_SIZE;
2771 
2772 		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
2773 					 sizeof(req) + eep_len);
2774 		if (!skb)
2775 			return -ENOMEM;
2776 
2777 		req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
2778 			     FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
2779 		req.len = cpu_to_le16(eep_len);
2780 
2781 		skb_put_data(skb, &req, sizeof(req));
2782 		skb_put_data(skb, eep, eep_len);
2783 
2784 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2785 					    MCU_EXT_CMD(EFUSE_BUFFER_MODE), true);
2786 		if (ret)
2787 			return ret;
2788 	}
2789 
2790 	return 0;
2791 }
2792 
2793 int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
2794 {
2795 	struct mt7915_mcu_eeprom req = {
2796 		.buffer_mode = EE_MODE_EFUSE,
2797 		.format = EE_FORMAT_WHOLE,
2798 	};
2799 
2800 	if (dev->flash_mode)
2801 		return mt7915_mcu_set_eeprom_flash(dev);
2802 
2803 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
2804 				 &req, sizeof(req), true);
2805 }
2806 
2807 int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
2808 {
2809 	struct mt7915_mcu_eeprom_info req = {
2810 		.addr = cpu_to_le32(round_down(offset,
2811 				    MT7915_EEPROM_BLOCK_SIZE)),
2812 	};
2813 	struct mt7915_mcu_eeprom_info *res;
2814 	struct sk_buff *skb;
2815 	int ret;
2816 	u8 *buf;
2817 
2818 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
2819 					MCU_EXT_QUERY(EFUSE_ACCESS),
2820 					&req, sizeof(req), true, &skb);
2821 	if (ret)
2822 		return ret;
2823 
2824 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
2825 	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
2826 	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
2827 	dev_kfree_skb(skb);
2828 
2829 	return 0;
2830 }
2831 
2832 int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num)
2833 {
2834 	struct {
2835 		u8 _rsv;
2836 		u8 version;
2837 		u8 die_idx;
2838 		u8 _rsv2;
2839 	} __packed req = {
2840 		.version = 1,
2841 	};
2842 	struct sk_buff *skb;
2843 	int ret;
2844 
2845 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
2846 					MCU_EXT_QUERY(EFUSE_FREE_BLOCK),
2847 					&req, sizeof(req), true, &skb);
2848 	if (ret)
2849 		return ret;
2850 
2851 	*block_num = *(u8 *)skb->data;
2852 	dev_kfree_skb(skb);
2853 
2854 	return 0;
2855 }
2856 
2857 static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
2858 				  u8 *data, u32 len, int cmd)
2859 {
2860 	struct {
2861 		u8 dir;
2862 		u8 valid;
2863 		__le16 bitmap;
2864 		s8 precal;
2865 		u8 action;
2866 		u8 band;
2867 		u8 idx;
2868 		u8 rsv[4];
2869 		__le32 len;
2870 	} req = {};
2871 	struct sk_buff *skb;
2872 
2873 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(req) + len);
2874 	if (!skb)
2875 		return -ENOMEM;
2876 
2877 	req.idx = idx;
2878 	req.len = cpu_to_le32(len);
2879 	skb_put_data(skb, &req, sizeof(req));
2880 	skb_put_data(skb, data, len);
2881 
2882 	return mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, false);
2883 }
2884 
2885 int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
2886 {
2887 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
2888 	u32 total = MT_EE_CAL_GROUP_SIZE;
2889 
2890 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
2891 		return 0;
2892 
2893 	/*
2894 	 * Items: Rx DCOC, RSSI DCOC, Tx TSSI DCOC, Tx LPFG
2895 	 * Tx FDIQ, Tx DCIQ, Rx FDIQ, Rx FIIQ, ADCDCOC
2896 	 */
2897 	while (total > 0) {
2898 		int ret, len;
2899 
2900 		len = min_t(u32, total, MT_EE_CAL_UNIT);
2901 
2902 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, len,
2903 					     MCU_EXT_CMD(GROUP_PRE_CAL_INFO));
2904 		if (ret)
2905 			return ret;
2906 
2907 		total -= len;
2908 		cal += len;
2909 		idx++;
2910 	}
2911 
2912 	return 0;
2913 }
2914 
2915 static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
2916 {
2917 	int i;
2918 
2919 	for (i = 0; i < n_freqs; i++)
2920 		if (cur == freqs[i])
2921 			return i;
2922 
2923 	return -1;
2924 }
2925 
2926 static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
2927 {
2928 	static const u16 freq_list[] = {
2929 		5180, 5200, 5220, 5240,
2930 		5260, 5280, 5300, 5320,
2931 		5500, 5520, 5540, 5560,
2932 		5580, 5600, 5620, 5640,
2933 		5660, 5680, 5700, 5745,
2934 		5765, 5785, 5805, 5825
2935 	};
2936 	int offset_2g = ARRAY_SIZE(freq_list);
2937 	int idx;
2938 
2939 	if (freq < 4000) {
2940 		if (freq < 2432)
2941 			return offset_2g;
2942 		if (freq < 2457)
2943 			return offset_2g + 1;
2944 
2945 		return offset_2g + 2;
2946 	}
2947 
2948 	if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
2949 		return -1;
2950 
2951 	if (bw != NL80211_CHAN_WIDTH_20) {
2952 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2953 					   freq + 10);
2954 		if (idx >= 0)
2955 			return idx;
2956 
2957 		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
2958 					   freq - 10);
2959 		if (idx >= 0)
2960 			return idx;
2961 	}
2962 
2963 	return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
2964 }
2965 
2966 int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
2967 {
2968 	struct mt7915_dev *dev = phy->dev;
2969 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
2970 	u16 total = 2, center_freq = chandef->center_freq1;
2971 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
2972 	int idx;
2973 
2974 	if (!(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
2975 		return 0;
2976 
2977 	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
2978 	if (idx < 0)
2979 		return -EINVAL;
2980 
2981 	/* Items: Tx DPD, Tx Flatness */
2982 	idx = idx * 2;
2983 	cal += MT_EE_CAL_GROUP_SIZE;
2984 
2985 	while (total--) {
2986 		int ret;
2987 
2988 		cal += (idx * MT_EE_CAL_UNIT);
2989 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
2990 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
2991 		if (ret)
2992 			return ret;
2993 
2994 		idx++;
2995 	}
2996 
2997 	return 0;
2998 }
2999 
3000 int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
3001 {
3002 	struct mt76_channel_state *state = phy->mt76->chan_state;
3003 	struct mt76_channel_state *state_ts = &phy->state_ts;
3004 	struct mt7915_dev *dev = phy->dev;
3005 	struct mt7915_mcu_mib *res, req[5];
3006 	struct sk_buff *skb;
3007 	static const u32 *offs;
3008 	int i, ret, len, offs_cc;
3009 	u64 cc_tx;
3010 
3011 	/* strict order */
3012 	if (is_mt7915(&dev->mt76)) {
3013 		static const u32 chip_offs[] = {
3014 			MIB_NON_WIFI_TIME,
3015 			MIB_TX_TIME,
3016 			MIB_RX_TIME,
3017 			MIB_OBSS_AIRTIME,
3018 			MIB_TXOP_INIT_COUNT,
3019 		};
3020 		len = ARRAY_SIZE(chip_offs);
3021 		offs = chip_offs;
3022 		offs_cc = 20;
3023 	} else {
3024 		static const u32 chip_offs[] = {
3025 			MIB_NON_WIFI_TIME_V2,
3026 			MIB_TX_TIME_V2,
3027 			MIB_RX_TIME_V2,
3028 			MIB_OBSS_AIRTIME_V2
3029 		};
3030 		len = ARRAY_SIZE(chip_offs);
3031 		offs = chip_offs;
3032 		offs_cc = 0;
3033 	}
3034 
3035 	for (i = 0; i < len; i++) {
3036 		req[i].band = cpu_to_le32(phy->mt76->band_idx);
3037 		req[i].offs = cpu_to_le32(offs[i]);
3038 	}
3039 
3040 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(GET_MIB_INFO),
3041 					req, len * sizeof(req[0]), true, &skb);
3042 	if (ret)
3043 		return ret;
3044 
3045 	res = (struct mt7915_mcu_mib *)(skb->data + offs_cc);
3046 
3047 #define __res_u64(s) le64_to_cpu(res[s].data)
3048 	/* subtract Tx backoff time from Tx duration */
3049 	cc_tx = is_mt7915(&dev->mt76) ? __res_u64(1) - __res_u64(4) : __res_u64(1);
3050 
3051 	if (chan_switch)
3052 		goto out;
3053 
3054 	state->cc_tx += cc_tx - state_ts->cc_tx;
3055 	state->cc_bss_rx += __res_u64(2) - state_ts->cc_bss_rx;
3056 	state->cc_rx += __res_u64(2) + __res_u64(3) - state_ts->cc_rx;
3057 	state->cc_busy += __res_u64(0) + cc_tx + __res_u64(2) + __res_u64(3) -
3058 			  state_ts->cc_busy;
3059 
3060 out:
3061 	state_ts->cc_tx = cc_tx;
3062 	state_ts->cc_bss_rx = __res_u64(2);
3063 	state_ts->cc_rx = __res_u64(2) + __res_u64(3);
3064 	state_ts->cc_busy = __res_u64(0) + cc_tx + __res_u64(2) + __res_u64(3);
3065 #undef __res_u64
3066 
3067 	dev_kfree_skb(skb);
3068 
3069 	return 0;
3070 }
3071 
3072 int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
3073 {
3074 	struct mt7915_dev *dev = phy->dev;
3075 	struct {
3076 		u8 ctrl_id;
3077 		u8 action;
3078 		u8 band_idx;
3079 		u8 rsv[5];
3080 	} req = {
3081 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
3082 		.band_idx = phy->mt76->band_idx,
3083 	};
3084 
3085 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
3086 				 sizeof(req), true);
3087 }
3088 
3089 int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
3090 {
3091 	struct mt7915_dev *dev = phy->dev;
3092 	struct mt7915_mcu_thermal_ctrl req = {
3093 		.band_idx = phy->mt76->band_idx,
3094 		.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG,
3095 	};
3096 	int level, ret;
3097 
3098 	/* set duty cycle and level */
3099 	for (level = 0; level < 4; level++) {
3100 		req.duty.duty_level = level;
3101 		req.duty.duty_cycle = state;
3102 		state /= 2;
3103 
3104 		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3105 					&req, sizeof(req), false);
3106 		if (ret)
3107 			return ret;
3108 	}
3109 	return 0;
3110 }
3111 
3112 int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy)
3113 {
3114 	struct mt7915_dev *dev = phy->dev;
3115 	struct {
3116 		struct mt7915_mcu_thermal_ctrl ctrl;
3117 
3118 		__le32 trigger_temp;
3119 		__le32 restore_temp;
3120 		__le16 sustain_time;
3121 		u8 rsv[2];
3122 	} __packed req = {
3123 		.ctrl = {
3124 			.band_idx = phy->mt76->band_idx,
3125 			.type.protect_type = 1,
3126 			.type.trigger_type = 1,
3127 		},
3128 	};
3129 	int ret;
3130 
3131 	req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
3132 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3133 				&req, sizeof(req.ctrl), false);
3134 
3135 	if (ret)
3136 		return ret;
3137 
3138 	/* set high-temperature trigger threshold */
3139 	req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
3140 	/* add a safety margin ~10 */
3141 	req.restore_temp = cpu_to_le32(phy->throttle_temp[0] - 10);
3142 	req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
3143 	req.sustain_time = cpu_to_le16(10);
3144 
3145 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
3146 				 &req, sizeof(req), false);
3147 }
3148 
3149 int mt7915_mcu_set_txpower_frame_min(struct mt7915_phy *phy, s8 txpower)
3150 {
3151 	struct mt7915_dev *dev = phy->dev;
3152 	struct {
3153 		u8 format_id;
3154 		u8 rsv;
3155 		u8 band_idx;
3156 		s8 txpower_min;
3157 	} __packed req = {
3158 		.format_id = TX_POWER_LIMIT_FRAME_MIN,
3159 		.band_idx = phy->mt76->band_idx,
3160 		.txpower_min = txpower * 2, /* 0.5db */
3161 	};
3162 
3163 	return mt76_mcu_send_msg(&dev->mt76,
3164 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3165 				 sizeof(req), true);
3166 }
3167 
3168 int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
3169 				 struct ieee80211_vif *vif,
3170 				 struct ieee80211_sta *sta, s8 txpower)
3171 {
3172 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3173 	struct mt7915_dev *dev = phy->dev;
3174 	struct mt76_phy *mphy = phy->mt76;
3175 	struct {
3176 		u8 format_id;
3177 		u8 rsv[3];
3178 		u8 band_idx;
3179 		s8 txpower_max;
3180 		__le16 wcid;
3181 		s8 txpower_offs[48];
3182 	} __packed req = {
3183 		.format_id = TX_POWER_LIMIT_FRAME,
3184 		.band_idx = phy->mt76->band_idx,
3185 		.txpower_max = DIV_ROUND_UP(mphy->txpower_cur, 2),
3186 		.wcid = cpu_to_le16(msta->wcid.idx),
3187 	};
3188 	int ret;
3189 	s8 txpower_sku[MT7915_SKU_RATE_NUM];
3190 
3191 	ret = mt7915_mcu_get_txpower_sku(phy, txpower_sku, sizeof(txpower_sku));
3192 	if (ret)
3193 		return ret;
3194 
3195 	txpower = mt7915_get_power_bound(phy, txpower);
3196 	if (txpower > mphy->txpower_cur || txpower < 0)
3197 		return -EINVAL;
3198 
3199 	if (txpower) {
3200 		u32 offs, len, i;
3201 
3202 		if (sta->deflink.ht_cap.ht_supported) {
3203 			const u8 *sku_len = mt7915_sku_group_len;
3204 
3205 			offs = sku_len[SKU_CCK] + sku_len[SKU_OFDM];
3206 			len = sku_len[SKU_HT_BW20] + sku_len[SKU_HT_BW40];
3207 
3208 			if (sta->deflink.vht_cap.vht_supported) {
3209 				offs += len;
3210 				len = sku_len[SKU_VHT_BW20] * 4;
3211 
3212 				if (sta->deflink.he_cap.has_he) {
3213 					offs += len + sku_len[SKU_HE_RU26] * 3;
3214 					len = sku_len[SKU_HE_RU242] * 4;
3215 				}
3216 			}
3217 		} else {
3218 			return -EINVAL;
3219 		}
3220 
3221 		for (i = 0; i < len; i++, offs++)
3222 			req.txpower_offs[i] =
3223 				DIV_ROUND_UP(txpower - txpower_sku[offs], 2);
3224 	}
3225 
3226 	return mt76_mcu_send_msg(&dev->mt76,
3227 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3228 				 sizeof(req), true);
3229 }
3230 
3231 int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
3232 {
3233 	struct mt7915_dev *dev = phy->dev;
3234 	struct mt76_phy *mphy = phy->mt76;
3235 	struct ieee80211_hw *hw = mphy->hw;
3236 	struct mt7915_mcu_txpower_sku req = {
3237 		.format_id = TX_POWER_LIMIT_TABLE,
3238 		.band_idx = phy->mt76->band_idx,
3239 	};
3240 	struct mt76_power_limits limits_array;
3241 	s8 *la = (s8 *)&limits_array;
3242 	int i, idx;
3243 	int tx_power;
3244 
3245 	tx_power = mt7915_get_power_bound(phy, hw->conf.power_level);
3246 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
3247 					      &limits_array, tx_power);
3248 	mphy->txpower_cur = tx_power;
3249 
3250 	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
3251 		u8 mcs_num, len = mt7915_sku_group_len[i];
3252 		int j;
3253 
3254 		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
3255 			mcs_num = 10;
3256 
3257 			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
3258 				la = (s8 *)&limits_array + 12;
3259 		} else {
3260 			mcs_num = len;
3261 		}
3262 
3263 		for (j = 0; j < min_t(u8, mcs_num, len); j++)
3264 			req.txpower_sku[idx + j] = la[j];
3265 
3266 		la += mcs_num;
3267 		idx += len;
3268 	}
3269 
3270 	return mt76_mcu_send_msg(&dev->mt76,
3271 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3272 				 sizeof(req), true);
3273 }
3274 
3275 int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
3276 {
3277 #define RATE_POWER_INFO	2
3278 	struct mt7915_dev *dev = phy->dev;
3279 	struct {
3280 		u8 format_id;
3281 		u8 category;
3282 		u8 band_idx;
3283 		u8 _rsv;
3284 	} __packed req = {
3285 		.format_id = TX_POWER_LIMIT_INFO,
3286 		.category = RATE_POWER_INFO,
3287 		.band_idx = phy->mt76->band_idx,
3288 	};
3289 	s8 txpower_sku[MT7915_SKU_RATE_NUM][2];
3290 	struct sk_buff *skb;
3291 	int ret, i;
3292 
3293 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3294 					MCU_EXT_CMD(TX_POWER_FEATURE_CTRL),
3295 					&req, sizeof(req), true, &skb);
3296 	if (ret)
3297 		return ret;
3298 
3299 	memcpy(txpower_sku, skb->data + 4, sizeof(txpower_sku));
3300 	for (i = 0; i < len; i++)
3301 		txpower[i] = txpower_sku[i][req.band_idx];
3302 
3303 	dev_kfree_skb(skb);
3304 
3305 	return 0;
3306 }
3307 
3308 int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
3309 			      u8 en)
3310 {
3311 	struct {
3312 		u8 test_mode_en;
3313 		u8 param_idx;
3314 		u8 _rsv[2];
3315 
3316 		u8 enable;
3317 		u8 _rsv2[3];
3318 
3319 		u8 pad[8];
3320 	} __packed req = {
3321 		.test_mode_en = test_mode,
3322 		.param_idx = param,
3323 		.enable = en,
3324 	};
3325 
3326 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
3327 				 sizeof(req), false);
3328 }
3329 
3330 int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
3331 {
3332 	struct mt7915_dev *dev = phy->dev;
3333 	struct mt7915_sku {
3334 		u8 format_id;
3335 		u8 sku_enable;
3336 		u8 band_idx;
3337 		u8 rsv;
3338 	} __packed req = {
3339 		.format_id = TX_POWER_LIMIT_ENABLE,
3340 		.band_idx = phy->mt76->band_idx,
3341 		.sku_enable = enable,
3342 	};
3343 
3344 	return mt76_mcu_send_msg(&dev->mt76,
3345 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
3346 				 sizeof(req), true);
3347 }
3348 
3349 int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
3350 {
3351 	struct {
3352 		u8 action;
3353 		u8 set;
3354 		u8 band;
3355 		u8 rsv;
3356 	} req = {
3357 		.action = action,
3358 		.set = set,
3359 		.band = band,
3360 	};
3361 
3362 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SER_TRIGGER),
3363 				 &req, sizeof(req), false);
3364 }
3365 
3366 int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
3367 {
3368 	struct {
3369 		u8 action;
3370 		union {
3371 			struct {
3372 				u8 snd_mode;
3373 				u8 sta_num;
3374 				u8 rsv;
3375 				u8 wlan_idx[4];
3376 				__le32 snd_period;	/* ms */
3377 			} __packed snd;
3378 			struct {
3379 				bool ebf;
3380 				bool ibf;
3381 				u8 rsv;
3382 			} __packed type;
3383 			struct {
3384 				u8 bf_num;
3385 				u8 bf_bitmap;
3386 				u8 bf_sel[8];
3387 				u8 rsv[5];
3388 			} __packed mod;
3389 		};
3390 	} __packed req = {
3391 		.action = action,
3392 	};
3393 
3394 #define MT_BF_PROCESSING	4
3395 	switch (action) {
3396 	case MT_BF_SOUNDING_ON:
3397 		req.snd.snd_mode = MT_BF_PROCESSING;
3398 		break;
3399 	case MT_BF_TYPE_UPDATE:
3400 		req.type.ebf = true;
3401 		req.type.ibf = dev->ibf;
3402 		break;
3403 	case MT_BF_MODULE_UPDATE:
3404 		req.mod.bf_num = 2;
3405 		req.mod.bf_bitmap = GENMASK(1, 0);
3406 		break;
3407 	default:
3408 		return -EINVAL;
3409 	}
3410 
3411 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
3412 				 sizeof(req), true);
3413 }
3414 
3415 static int
3416 mt7915_mcu_enable_obss_spr(struct mt7915_phy *phy, u8 action, u8 val)
3417 {
3418 	struct mt7915_dev *dev = phy->dev;
3419 	struct mt7915_mcu_sr_ctrl req = {
3420 		.action = action,
3421 		.argnum = 1,
3422 		.band_idx = phy->mt76->band_idx,
3423 		.val = cpu_to_le32(val),
3424 	};
3425 
3426 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3427 				 sizeof(req), true);
3428 }
3429 
3430 static int
3431 mt7915_mcu_set_obss_spr_pd(struct mt7915_phy *phy,
3432 			   struct ieee80211_he_obss_pd *he_obss_pd)
3433 {
3434 	struct mt7915_dev *dev = phy->dev;
3435 	struct {
3436 		struct mt7915_mcu_sr_ctrl ctrl;
3437 		struct {
3438 			u8 pd_th_non_srg;
3439 			u8 pd_th_srg;
3440 			u8 period_offs;
3441 			u8 rcpi_src;
3442 			__le16 obss_pd_min;
3443 			__le16 obss_pd_min_srg;
3444 			u8 resp_txpwr_mode;
3445 			u8 txpwr_restrict_mode;
3446 			u8 txpwr_ref;
3447 			u8 rsv[3];
3448 		} __packed param;
3449 	} __packed req = {
3450 		.ctrl = {
3451 			.action = SPR_SET_PARAM,
3452 			.argnum = 9,
3453 			.band_idx = phy->mt76->band_idx,
3454 		},
3455 	};
3456 	int ret;
3457 	u8 max_th = 82, non_srg_max_th = 62;
3458 
3459 	/* disable firmware dynamical PD asjustment */
3460 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_DPD, false);
3461 	if (ret)
3462 		return ret;
3463 
3464 	if (he_obss_pd->sr_ctrl &
3465 	    IEEE80211_HE_SPR_NON_SRG_OBSS_PD_SR_DISALLOWED)
3466 		req.param.pd_th_non_srg = max_th;
3467 	else if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_NON_SRG_OFFSET_PRESENT)
3468 		req.param.pd_th_non_srg  = max_th - he_obss_pd->non_srg_max_offset;
3469 	else
3470 		req.param.pd_th_non_srg  = non_srg_max_th;
3471 
3472 	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_SRG_INFORMATION_PRESENT)
3473 		req.param.pd_th_srg = max_th - he_obss_pd->max_offset;
3474 
3475 	req.param.obss_pd_min = cpu_to_le16(82);
3476 	req.param.obss_pd_min_srg = cpu_to_le16(82);
3477 	req.param.txpwr_restrict_mode = 2;
3478 	req.param.txpwr_ref = 21;
3479 
3480 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3481 				 sizeof(req), true);
3482 }
3483 
3484 static int
3485 mt7915_mcu_set_obss_spr_siga(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3486 			     struct ieee80211_he_obss_pd *he_obss_pd)
3487 {
3488 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3489 	struct mt7915_dev *dev = phy->dev;
3490 	u8 omac = mvif->mt76.omac_idx;
3491 	struct {
3492 		struct mt7915_mcu_sr_ctrl ctrl;
3493 		struct {
3494 			u8 omac;
3495 			u8 rsv[3];
3496 			u8 flag[20];
3497 		} __packed siga;
3498 	} __packed req = {
3499 		.ctrl = {
3500 			.action = SPR_SET_SIGA,
3501 			.argnum = 1,
3502 			.band_idx = phy->mt76->band_idx,
3503 		},
3504 		.siga = {
3505 			.omac = omac > HW_BSSID_MAX ? omac - 12 : omac,
3506 		},
3507 	};
3508 	int ret;
3509 
3510 	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_HESIGA_SR_VAL15_ALLOWED)
3511 		req.siga.flag[req.siga.omac] = 0xf;
3512 	else
3513 		return 0;
3514 
3515 	/* switch to normal AP mode */
3516 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_MODE, 0);
3517 	if (ret)
3518 		return ret;
3519 
3520 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3521 				 sizeof(req), true);
3522 }
3523 
3524 static int
3525 mt7915_mcu_set_obss_spr_bitmap(struct mt7915_phy *phy,
3526 			       struct ieee80211_he_obss_pd *he_obss_pd)
3527 {
3528 	struct mt7915_dev *dev = phy->dev;
3529 	struct {
3530 		struct mt7915_mcu_sr_ctrl ctrl;
3531 		struct {
3532 			__le32 color_l[2];
3533 			__le32 color_h[2];
3534 			__le32 bssid_l[2];
3535 			__le32 bssid_h[2];
3536 		} __packed bitmap;
3537 	} __packed req = {
3538 		.ctrl = {
3539 			.action = SPR_SET_SRG_BITMAP,
3540 			.argnum = 4,
3541 			.band_idx = phy->mt76->band_idx,
3542 		},
3543 	};
3544 	u32 bitmap;
3545 
3546 	memcpy(&bitmap, he_obss_pd->bss_color_bitmap, sizeof(bitmap));
3547 	req.bitmap.color_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3548 
3549 	memcpy(&bitmap, he_obss_pd->bss_color_bitmap + 4, sizeof(bitmap));
3550 	req.bitmap.color_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3551 
3552 	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap, sizeof(bitmap));
3553 	req.bitmap.bssid_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3554 
3555 	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap + 4, sizeof(bitmap));
3556 	req.bitmap.bssid_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
3557 
3558 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
3559 				 sizeof(req), true);
3560 }
3561 
3562 int mt7915_mcu_add_obss_spr(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3563 			    struct ieee80211_he_obss_pd *he_obss_pd)
3564 {
3565 	int ret;
3566 
3567 	/* enable firmware scene detection algorithms */
3568 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_SD, sr_scene_detect);
3569 	if (ret)
3570 		return ret;
3571 
3572 	/* firmware dynamically adjusts PD threshold so skip manual control */
3573 	if (sr_scene_detect && !he_obss_pd->enable)
3574 		return 0;
3575 
3576 	/* enable spatial reuse */
3577 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE, he_obss_pd->enable);
3578 	if (ret)
3579 		return ret;
3580 
3581 	if (sr_scene_detect || !he_obss_pd->enable)
3582 		return 0;
3583 
3584 	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_TX, true);
3585 	if (ret)
3586 		return ret;
3587 
3588 	/* set SRG/non-SRG OBSS PD threshold */
3589 	ret = mt7915_mcu_set_obss_spr_pd(phy, he_obss_pd);
3590 	if (ret)
3591 		return ret;
3592 
3593 	/* Set SR prohibit */
3594 	ret = mt7915_mcu_set_obss_spr_siga(phy, vif, he_obss_pd);
3595 	if (ret)
3596 		return ret;
3597 
3598 	/* set SRG BSS color/BSSID bitmap */
3599 	return mt7915_mcu_set_obss_spr_bitmap(phy, he_obss_pd);
3600 }
3601 
3602 int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
3603 			   struct ieee80211_sta *sta, struct rate_info *rate)
3604 {
3605 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3606 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
3607 	struct mt7915_dev *dev = phy->dev;
3608 	struct mt76_phy *mphy = phy->mt76;
3609 	struct {
3610 		u8 category;
3611 		u8 band;
3612 		__le16 wcid;
3613 	} __packed req = {
3614 		.category = MCU_PHY_STATE_CONTENTION_RX_RATE,
3615 		.band = mvif->mt76.band_idx,
3616 		.wcid = cpu_to_le16(msta->wcid.idx),
3617 	};
3618 	struct ieee80211_supported_band *sband;
3619 	struct mt7915_mcu_phy_rx_info *res;
3620 	struct sk_buff *skb;
3621 	int ret;
3622 	bool cck = false;
3623 
3624 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(PHY_STAT_INFO),
3625 					&req, sizeof(req), true, &skb);
3626 	if (ret)
3627 		return ret;
3628 
3629 	res = (struct mt7915_mcu_phy_rx_info *)skb->data;
3630 
3631 	rate->mcs = res->rate;
3632 	rate->nss = res->nsts + 1;
3633 
3634 	switch (res->mode) {
3635 	case MT_PHY_TYPE_CCK:
3636 		cck = true;
3637 		fallthrough;
3638 	case MT_PHY_TYPE_OFDM:
3639 		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)
3640 			sband = &mphy->sband_5g.sband;
3641 		else if (mphy->chandef.chan->band == NL80211_BAND_6GHZ)
3642 			sband = &mphy->sband_6g.sband;
3643 		else
3644 			sband = &mphy->sband_2g.sband;
3645 
3646 		rate->mcs = mt76_get_rate(&dev->mt76, sband, rate->mcs, cck);
3647 		rate->legacy = sband->bitrates[rate->mcs].bitrate;
3648 		break;
3649 	case MT_PHY_TYPE_HT:
3650 	case MT_PHY_TYPE_HT_GF:
3651 		if (rate->mcs > 31) {
3652 			ret = -EINVAL;
3653 			goto out;
3654 		}
3655 
3656 		rate->flags = RATE_INFO_FLAGS_MCS;
3657 		if (res->gi)
3658 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3659 		break;
3660 	case MT_PHY_TYPE_VHT:
3661 		if (rate->mcs > 9) {
3662 			ret = -EINVAL;
3663 			goto out;
3664 		}
3665 
3666 		rate->flags = RATE_INFO_FLAGS_VHT_MCS;
3667 		if (res->gi)
3668 			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
3669 		break;
3670 	case MT_PHY_TYPE_HE_SU:
3671 	case MT_PHY_TYPE_HE_EXT_SU:
3672 	case MT_PHY_TYPE_HE_TB:
3673 	case MT_PHY_TYPE_HE_MU:
3674 		if (res->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11) {
3675 			ret = -EINVAL;
3676 			goto out;
3677 		}
3678 		rate->he_gi = res->gi;
3679 		rate->flags = RATE_INFO_FLAGS_HE_MCS;
3680 		break;
3681 	default:
3682 		ret = -EINVAL;
3683 		goto out;
3684 	}
3685 
3686 	switch (res->bw) {
3687 	case IEEE80211_STA_RX_BW_160:
3688 		rate->bw = RATE_INFO_BW_160;
3689 		break;
3690 	case IEEE80211_STA_RX_BW_80:
3691 		rate->bw = RATE_INFO_BW_80;
3692 		break;
3693 	case IEEE80211_STA_RX_BW_40:
3694 		rate->bw = RATE_INFO_BW_40;
3695 		break;
3696 	default:
3697 		rate->bw = RATE_INFO_BW_20;
3698 		break;
3699 	}
3700 
3701 out:
3702 	dev_kfree_skb(skb);
3703 
3704 	return ret;
3705 }
3706 
3707 int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
3708 				struct cfg80211_he_bss_color *he_bss_color)
3709 {
3710 	int len = sizeof(struct sta_req_hdr) + sizeof(struct bss_info_color);
3711 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
3712 	struct bss_info_color *bss_color;
3713 	struct sk_buff *skb;
3714 	struct tlv *tlv;
3715 
3716 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
3717 					      NULL, len);
3718 	if (IS_ERR(skb))
3719 		return PTR_ERR(skb);
3720 
3721 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BSS_COLOR,
3722 				      sizeof(*bss_color));
3723 	bss_color = (struct bss_info_color *)tlv;
3724 	bss_color->disable = !he_bss_color->enabled;
3725 	bss_color->color = he_bss_color->color;
3726 
3727 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
3728 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
3729 }
3730 
3731 #define TWT_AGRT_TRIGGER	BIT(0)
3732 #define TWT_AGRT_ANNOUNCE	BIT(1)
3733 #define TWT_AGRT_PROTECT	BIT(2)
3734 
3735 int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
3736 			       struct mt7915_vif *mvif,
3737 			       struct mt7915_twt_flow *flow,
3738 			       int cmd)
3739 {
3740 	struct {
3741 		u8 tbl_idx;
3742 		u8 cmd;
3743 		u8 own_mac_idx;
3744 		u8 flowid; /* 0xff for group id */
3745 		__le16 peer_id; /* specify the peer_id (msb=0)
3746 				 * or group_id (msb=1)
3747 				 */
3748 		u8 duration; /* 256 us */
3749 		u8 bss_idx;
3750 		__le64 start_tsf;
3751 		__le16 mantissa;
3752 		u8 exponent;
3753 		u8 is_ap;
3754 		u8 agrt_params;
3755 		u8 rsv[23];
3756 	} __packed req = {
3757 		.tbl_idx = flow->table_id,
3758 		.cmd = cmd,
3759 		.own_mac_idx = mvif->mt76.omac_idx,
3760 		.flowid = flow->id,
3761 		.peer_id = cpu_to_le16(flow->wcid),
3762 		.duration = flow->duration,
3763 		.bss_idx = mvif->mt76.idx,
3764 		.start_tsf = cpu_to_le64(flow->tsf),
3765 		.mantissa = flow->mantissa,
3766 		.exponent = flow->exp,
3767 		.is_ap = true,
3768 	};
3769 
3770 	if (flow->protection)
3771 		req.agrt_params |= TWT_AGRT_PROTECT;
3772 	if (!flow->flowtype)
3773 		req.agrt_params |= TWT_AGRT_ANNOUNCE;
3774 	if (flow->trigger)
3775 		req.agrt_params |= TWT_AGRT_TRIGGER;
3776 
3777 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TWT_AGRT_UPDATE),
3778 				 &req, sizeof(req), true);
3779 }
3780 
3781 int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx)
3782 {
3783 	struct {
3784 		__le32 cmd;
3785 		__le32 num;
3786 		__le32 __rsv;
3787 		__le16 wlan_idx;
3788 	} req = {
3789 		.cmd = cpu_to_le32(0x15),
3790 		.num = cpu_to_le32(1),
3791 		.wlan_idx = cpu_to_le16(wlan_idx),
3792 	};
3793 	struct mt7915_mcu_wa_tx_stat {
3794 		__le16 wlan_idx;
3795 		u8 __rsv[2];
3796 
3797 		/* tx_bytes is deprecated since WA byte counter uses u32,
3798 		 * which easily leads to overflow.
3799 		 */
3800 		__le32 tx_bytes;
3801 		__le32 tx_packets;
3802 	} *res;
3803 	struct mt76_wcid *wcid;
3804 	struct sk_buff *skb;
3805 	int ret;
3806 
3807 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WA_PARAM_CMD(QUERY),
3808 					&req, sizeof(req), true, &skb);
3809 	if (ret)
3810 		return ret;
3811 
3812 	if (!is_mt7915(&dev->mt76))
3813 		skb_pull(skb, 4);
3814 
3815 	res = (struct mt7915_mcu_wa_tx_stat *)skb->data;
3816 
3817 	if (le16_to_cpu(res->wlan_idx) != wlan_idx) {
3818 		ret = -EINVAL;
3819 		goto out;
3820 	}
3821 
3822 	rcu_read_lock();
3823 
3824 	wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
3825 	if (wcid)
3826 		wcid->stats.tx_packets += le32_to_cpu(res->tx_packets);
3827 	else
3828 		ret = -EINVAL;
3829 
3830 	rcu_read_unlock();
3831 out:
3832 	dev_kfree_skb(skb);
3833 
3834 	return ret;
3835 }
3836 
3837 int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
3838 {
3839 	struct {
3840 		__le32 idx;
3841 		__le32 ofs;
3842 		__le32 data;
3843 	} __packed req = {
3844 		.idx = cpu_to_le32(u32_get_bits(regidx, GENMASK(31, 24))),
3845 		.ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(23, 0))),
3846 		.data = set ? cpu_to_le32(*val) : 0,
3847 	};
3848 	struct sk_buff *skb;
3849 	int ret;
3850 
3851 	if (set)
3852 		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_REG_ACCESS),
3853 					 &req, sizeof(req), false);
3854 
3855 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(RF_REG_ACCESS),
3856 					&req, sizeof(req), true, &skb);
3857 	if (ret)
3858 		return ret;
3859 
3860 	*val = le32_to_cpu(*(__le32 *)(skb->data + 8));
3861 	dev_kfree_skb(skb);
3862 
3863 	return 0;
3864 }
3865