mcu.c

   1// SPDX-License-Identifier: BSD-3-Clause-Clear
   2/*
   3 * Copyright (C) 2022 MediaTek Inc.
   4 */
   5
   6#include <linux/firmware.h>
   7#include <linux/fs.h>
   8#include "mt7996.h"
   9#include "mcu.h"
  10#include "mac.h"
  11#include "eeprom.h"
  12
  13#define fw_name(_dev, name, ...)	({			\
  14	char *_fw;						\
  15	switch (mt76_chip(&(_dev)->mt76)) {			\
  16	case MT7992_DEVICE_ID:						\
  17		switch ((_dev)->var.type) {			\
  18		case MT7992_VAR_TYPE_23:			\
  19			_fw = MT7992_##name##_23;		\
  20			break;					\
  21		default:					\
  22			_fw = MT7992_##name;			\
  23		}						\
  24		break;						\
  25	case MT7990_DEVICE_ID:					\
  26		_fw = MT7990_##name;				\
  27		break;						\
  28	case MT7996_DEVICE_ID:						\
  29	default:						\
  30		switch ((_dev)->var.type) {			\
  31		case MT7996_VAR_TYPE_233:			\
  32			_fw = MT7996_##name##_233;		\
  33			break;					\
  34		default:					\
  35			_fw = MT7996_##name;			\
  36		}						\
  37		break;						\
  38	}							\
  39	_fw;							\
  40})
  41
  42struct mt7996_patch_hdr {
  43	char build_date[16];
  44	char platform[4];
  45	__be32 hw_sw_ver;
  46	__be32 patch_ver;
  47	__be16 checksum;
  48	u16 reserved;
  49	struct {
  50		__be32 patch_ver;
  51		__be32 subsys;
  52		__be32 feature;
  53		__be32 n_region;
  54		__be32 crc;
  55		u32 reserved[11];
  56	} desc;
  57} __packed;
  58
  59struct mt7996_patch_sec {
  60	__be32 type;
  61	__be32 offs;
  62	__be32 size;
  63	union {
  64		__be32 spec[13];
  65		struct {
  66			__be32 addr;
  67			__be32 len;
  68			__be32 sec_key_idx;
  69			__be32 align_len;
  70			u32 reserved[9];
  71		} info;
  72	};
  73} __packed;
  74
  75struct mt7996_fw_trailer {
  76	u8 chip_id;
  77	u8 eco_code;
  78	u8 n_region;
  79	u8 format_ver;
  80	u8 format_flag;
  81	u8 reserved[2];
  82	char fw_ver[10];
  83	char build_date[15];
  84	u32 crc;
  85} __packed;
  86
  87struct mt7996_fw_region {
  88	__le32 decomp_crc;
  89	__le32 decomp_len;
  90	__le32 decomp_blk_sz;
  91	u8 reserved[4];
  92	__le32 addr;
  93	__le32 len;
  94	u8 feature_set;
  95	u8 reserved1[15];
  96} __packed;
  97
  98#define MCU_PATCH_ADDRESS		0x200000
  99
 100#define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
 101#define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
 102#define EHT_PHY(p, c)			u8_get_bits(c, IEEE80211_EHT_PHY_##p)
 103
 104static bool sr_scene_detect = true;
 105module_param(sr_scene_detect, bool, 0644);
 106MODULE_PARM_DESC(sr_scene_detect, "Enable firmware scene detection algorithm");
 107
 108static u8
 109mt7996_mcu_get_sta_nss(u16 mcs_map)
 110{
 111	u8 nss;
 112
 113	for (nss = 8; nss > 0; nss--) {
 114		u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
 115
 116		if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
 117			break;
 118	}
 119
 120	return nss - 1;
 121}
 122
 123static void
 124mt7996_mcu_set_sta_he_mcs(struct ieee80211_link_sta *link_sta,
 125			  struct mt7996_vif_link *link,
 126			  __le16 *he_mcs, u16 mcs_map)
 127{
 128	int nss, max_nss = link_sta->rx_nss > 3 ? 4 : link_sta->rx_nss;
 129	enum nl80211_band band = link->phy->mt76->chandef.chan->band;
 130	const u16 *mask = link->bitrate_mask.control[band].he_mcs;
 131
 132	for (nss = 0; nss < max_nss; nss++) {
 133		int mcs;
 134
 135		switch ((mcs_map >> (2 * nss)) & 0x3) {
 136		case IEEE80211_HE_MCS_SUPPORT_0_11:
 137			mcs = GENMASK(11, 0);
 138			break;
 139		case IEEE80211_HE_MCS_SUPPORT_0_9:
 140			mcs = GENMASK(9, 0);
 141			break;
 142		case IEEE80211_HE_MCS_SUPPORT_0_7:
 143			mcs = GENMASK(7, 0);
 144			break;
 145		default:
 146			mcs = 0;
 147		}
 148
 149		mcs = mcs ? fls(mcs & mask[nss]) - 1 : -1;
 150
 151		switch (mcs) {
 152		case 0 ... 7:
 153			mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
 154			break;
 155		case 8 ... 9:
 156			mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
 157			break;
 158		case 10 ... 11:
 159			mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
 160			break;
 161		default:
 162			mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
 163			break;
 164		}
 165		mcs_map &= ~(0x3 << (nss * 2));
 166		mcs_map |= mcs << (nss * 2);
 167	}
 168
 169	*he_mcs = cpu_to_le16(mcs_map);
 170}
 171
 172static void
 173mt7996_mcu_set_sta_vht_mcs(struct ieee80211_link_sta *link_sta,
 174			   __le16 *vht_mcs, const u16 *mask)
 175{
 176	u16 mcs, mcs_map = le16_to_cpu(link_sta->vht_cap.vht_mcs.rx_mcs_map);
 177	int nss, max_nss = link_sta->rx_nss > 3 ? 4 : link_sta->rx_nss;
 178
 179	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
 180		switch (mcs_map & 0x3) {
 181		case IEEE80211_VHT_MCS_SUPPORT_0_9:
 182			mcs = GENMASK(9, 0);
 183			break;
 184		case IEEE80211_VHT_MCS_SUPPORT_0_8:
 185			mcs = GENMASK(8, 0);
 186			break;
 187		case IEEE80211_VHT_MCS_SUPPORT_0_7:
 188			mcs = GENMASK(7, 0);
 189			break;
 190		default:
 191			mcs = 0;
 192		}
 193
 194		vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
 195	}
 196}
 197
 198static void
 199mt7996_mcu_set_sta_ht_mcs(struct ieee80211_link_sta *link_sta,
 200			  u8 *ht_mcs, const u8 *mask)
 201{
 202	int nss, max_nss = link_sta->rx_nss > 3 ? 4 : link_sta->rx_nss;
 203
 204	for (nss = 0; nss < max_nss; nss++)
 205		ht_mcs[nss] = link_sta->ht_cap.mcs.rx_mask[nss] & mask[nss];
 206}
 207
 208static int
 209mt7996_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 210			  struct sk_buff *skb, int seq)
 211{
 212	struct mt7996_mcu_rxd *rxd;
 213	struct mt7996_mcu_uni_event *event;
 214	int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
 215	int ret = 0;
 216
 217	if (!skb) {
 218		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
 219			cmd, seq);
 220		return -ETIMEDOUT;
 221	}
 222
 223	rxd = (struct mt7996_mcu_rxd *)skb->data;
 224	if (seq != rxd->seq)
 225		return -EAGAIN;
 226
 227	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
 228		skb_pull(skb, sizeof(*rxd) - 4);
 229		ret = *skb->data;
 230	} else if ((rxd->option & MCU_UNI_CMD_EVENT) &&
 231		    rxd->eid == MCU_UNI_EVENT_RESULT) {
 232		skb_pull(skb, sizeof(*rxd));
 233		event = (struct mt7996_mcu_uni_event *)skb->data;
 234		ret = le32_to_cpu(event->status);
 235		/* skip invalid event */
 236		if (mcu_cmd != event->cid)
 237			ret = -EAGAIN;
 238	} else {
 239		skb_pull(skb, sizeof(struct mt7996_mcu_rxd));
 240	}
 241
 242	return ret;
 243}
 244
 245static void
 246mt7996_mcu_set_timeout(struct mt76_dev *mdev, int cmd)
 247{
 248	mdev->mcu.timeout = 5 * HZ;
 249
 250	if (!(cmd & __MCU_CMD_FIELD_UNI))
 251		return;
 252
 253	switch (FIELD_GET(__MCU_CMD_FIELD_ID, cmd)) {
 254	case MCU_UNI_CMD_THERMAL:
 255	case MCU_UNI_CMD_TWT:
 256	case MCU_UNI_CMD_GET_MIB_INFO:
 257	case MCU_UNI_CMD_STA_REC_UPDATE:
 258	case MCU_UNI_CMD_BSS_INFO_UPDATE:
 259		mdev->mcu.timeout = 2 * HZ;
 260		return;
 261	case MCU_UNI_CMD_EFUSE_CTRL:
 262		mdev->mcu.timeout = 20 * HZ;
 263		return;
 264	default:
 265		break;
 266	}
 267}
 268
 269static int
 270mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 271			int cmd, int *wait_seq)
 272{
 273	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
 274	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
 275	struct mt76_connac2_mcu_uni_txd *uni_txd;
 276	struct mt76_connac2_mcu_txd *mcu_txd;
 277	enum mt76_mcuq_id qid;
 278	__le32 *txd;
 279	u32 val;
 280	u8 seq;
 281
 282	mt7996_mcu_set_timeout(mdev, cmd);
 283
 284	seq = ++dev->mt76.mcu.msg_seq & 0xf;
 285	if (!seq)
 286		seq = ++dev->mt76.mcu.msg_seq & 0xf;
 287
 288	if (cmd == MCU_CMD(FW_SCATTER)) {
 289		qid = MT_MCUQ_FWDL;
 290		goto exit;
 291	}
 292
 293	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
 294	txd = (__le32 *)skb_push(skb, txd_len);
 295	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state) && mt7996_has_wa(dev))
 296		qid = MT_MCUQ_WA;
 297	else
 298		qid = MT_MCUQ_WM;
 299
 300	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
 301	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
 302	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
 303	txd[0] = cpu_to_le32(val);
 304
 305	val = FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
 306	txd[1] = cpu_to_le32(val);
 307
 308	if (cmd & __MCU_CMD_FIELD_UNI) {
 309		uni_txd = (struct mt76_connac2_mcu_uni_txd *)txd;
 310		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
 311		uni_txd->cid = cpu_to_le16(mcu_cmd);
 312		uni_txd->s2d_index = MCU_S2D_H2CN;
 313		uni_txd->pkt_type = MCU_PKT_ID;
 314		uni_txd->seq = seq;
 315
 316		if (cmd & __MCU_CMD_FIELD_QUERY)
 317			uni_txd->option = MCU_CMD_UNI_QUERY_ACK;
 318		else
 319			uni_txd->option = MCU_CMD_UNI_EXT_ACK;
 320
 321		if (mcu_cmd == MCU_UNI_CMD_SDO)
 322			uni_txd->option &= ~MCU_CMD_ACK;
 323
 324		if ((cmd & __MCU_CMD_FIELD_WA) && (cmd & __MCU_CMD_FIELD_WM))
 325			uni_txd->s2d_index = MCU_S2D_H2CN;
 326		else if (cmd & __MCU_CMD_FIELD_WA)
 327			uni_txd->s2d_index = MCU_S2D_H2C;
 328		else if (cmd & __MCU_CMD_FIELD_WM)
 329			uni_txd->s2d_index = MCU_S2D_H2N;
 330
 331		goto exit;
 332	}
 333
 334	mcu_txd = (struct mt76_connac2_mcu_txd *)txd;
 335	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
 336	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
 337					       MT_TX_MCU_PORT_RX_Q0));
 338	mcu_txd->pkt_type = MCU_PKT_ID;
 339	mcu_txd->seq = seq;
 340
 341	mcu_txd->cid = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
 342	mcu_txd->set_query = MCU_Q_NA;
 343	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
 344	if (mcu_txd->ext_cid) {
 345		mcu_txd->ext_cid_ack = 1;
 346
 347		if (cmd & __MCU_CMD_FIELD_QUERY)
 348			mcu_txd->set_query = MCU_Q_QUERY;
 349		else
 350			mcu_txd->set_query = MCU_Q_SET;
 351	}
 352
 353	if (cmd & __MCU_CMD_FIELD_WA)
 354		mcu_txd->s2d_index = MCU_S2D_H2C;
 355	else
 356		mcu_txd->s2d_index = MCU_S2D_H2N;
 357
 358exit:
 359	if (wait_seq)
 360		*wait_seq = seq;
 361
 362	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
 363}
 364
 365int mt7996_mcu_wa_cmd(struct mt7996_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
 366{
 367	struct {
 368		u8 _rsv[4];
 369
 370		__le16 tag;
 371		__le16 len;
 372		__le32 args[3];
 373	} __packed req = {
 374		.args = {
 375			cpu_to_le32(a1),
 376			cpu_to_le32(a2),
 377			cpu_to_le32(a3),
 378		},
 379	};
 380
 381	if (mt7996_has_wa(dev))
 382		return mt76_mcu_send_msg(&dev->mt76, cmd, &req.args,
 383					 sizeof(req.args), false);
 384
 385	req.tag = cpu_to_le16(cmd == MCU_WA_PARAM_CMD(QUERY) ? UNI_CMD_SDO_QUERY :
 386							       UNI_CMD_SDO_SET);
 387	req.len = cpu_to_le16(sizeof(req) - 4);
 388
 389	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_UNI_CMD(SDO), &req,
 390				 sizeof(req), false);
 391}
 392
 393static void
 394mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 395{
 396	if (!vif->bss_conf.csa_active || vif->type == NL80211_IFTYPE_STATION)
 397		return;
 398
 399	ieee80211_csa_finish(vif, 0);
 400}
 401
 402static void
 403mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
 404{
 405	struct mt76_phy *mphy = &dev->mt76.phy;
 406	struct mt7996_mcu_rdd_report *r;
 407
 408	r = (struct mt7996_mcu_rdd_report *)skb->data;
 409
 410	switch (r->rdd_idx) {
 411	case MT_RDD_IDX_BAND2:
 412		mphy = dev->mt76.phys[MT_BAND2];
 413		break;
 414	case MT_RDD_IDX_BAND1:
 415		mphy = dev->mt76.phys[MT_BAND1];
 416		break;
 417	case MT_RDD_IDX_BACKGROUND:
 418		if (!dev->rdd2_phy)
 419			return;
 420		mphy = dev->rdd2_phy->mt76;
 421		break;
 422	default:
 423		dev_err(dev->mt76.dev, "Unknown RDD idx %d\n", r->rdd_idx);
 424		return;
 425	}
 426
 427	if (!mphy)
 428		return;
 429
 430	if (r->rdd_idx == MT_RDD_IDX_BACKGROUND)
 431		cfg80211_background_radar_event(mphy->hw->wiphy,
 432						&dev->rdd2_chandef,
 433						GFP_ATOMIC);
 434	else
 435		ieee80211_radar_detected(mphy->hw, NULL);
 436	dev->hw_pattern++;
 437}
 438
 439static void
 440mt7996_mcu_rx_log_message(struct mt7996_dev *dev, struct sk_buff *skb)
 441{
 442#define UNI_EVENT_FW_LOG_FORMAT 0
 443	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
 444	const char *data = (char *)&rxd[1] + 4, *type;
 445	struct tlv *tlv = (struct tlv *)data;
 446	int len;
 447
 448	if (!(rxd->option & MCU_UNI_CMD_EVENT)) {
 449		len = skb->len - sizeof(*rxd);
 450		data = (char *)&rxd[1];
 451		goto out;
 452	}
 453
 454	if (le16_to_cpu(tlv->tag) != UNI_EVENT_FW_LOG_FORMAT)
 455		return;
 456
 457	data += sizeof(*tlv) + 4;
 458	len = le16_to_cpu(tlv->len) - sizeof(*tlv) - 4;
 459
 460out:
 461	switch (rxd->s2d_index) {
 462	case 0:
 463		if (mt7996_debugfs_rx_log(dev, data, len))
 464			return;
 465
 466		type = "WM";
 467		break;
 468	case 2:
 469		type = "WA";
 470		break;
 471	default:
 472		type = "unknown";
 473		break;
 474	}
 475
 476	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type, len, data);
 477}
 478
 479static void
 480mt7996_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
 481{
 482	if (!vif->bss_conf.color_change_active || vif->type == NL80211_IFTYPE_STATION)
 483		return;
 484
 485	ieee80211_color_change_finish(vif, 0);
 486}
 487
 488static void
 489mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
 490{
 491#define UNI_EVENT_IE_COUNTDOWN_CSA 0
 492#define UNI_EVENT_IE_COUNTDOWN_BCC 1
 493	struct header {
 494		u8 band;
 495		u8 rsv[3];
 496	};
 497	struct mt76_phy *mphy = &dev->mt76.phy;
 498	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
 499	const char *data = (char *)&rxd[1], *tail;
 500	struct header *hdr = (struct header *)data;
 501	struct tlv *tlv = (struct tlv *)(data + 4);
 502
 503	if (hdr->band >= ARRAY_SIZE(dev->mt76.phys))
 504		return;
 505
 506	if (hdr->band && dev->mt76.phys[hdr->band])
 507		mphy = dev->mt76.phys[hdr->band];
 508
 509	tail = skb->data + skb->len;
 510	data += sizeof(struct header);
 511	while (data + sizeof(struct tlv) < tail && le16_to_cpu(tlv->len)) {
 512		switch (le16_to_cpu(tlv->tag)) {
 513		case UNI_EVENT_IE_COUNTDOWN_CSA:
 514			ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 515					IEEE80211_IFACE_ITER_RESUME_ALL,
 516					mt7996_mcu_csa_finish, mphy->hw);
 517			break;
 518		case UNI_EVENT_IE_COUNTDOWN_BCC:
 519			ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 520					IEEE80211_IFACE_ITER_RESUME_ALL,
 521					mt7996_mcu_cca_finish, mphy->hw);
 522			break;
 523		}
 524
 525		data += le16_to_cpu(tlv->len);
 526		tlv = (struct tlv *)data;
 527	}
 528}
 529
 530static int
 531mt7996_mcu_update_tx_gi(struct rate_info *rate, struct all_sta_trx_rate *mcu_rate)
 532{
 533	switch (mcu_rate->tx_mode) {
 534	case MT_PHY_TYPE_CCK:
 535	case MT_PHY_TYPE_OFDM:
 536		break;
 537	case MT_PHY_TYPE_HT:
 538	case MT_PHY_TYPE_HT_GF:
 539	case MT_PHY_TYPE_VHT:
 540		if (mcu_rate->tx_gi)
 541			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
 542		else
 543			rate->flags &= ~RATE_INFO_FLAGS_SHORT_GI;
 544		break;
 545	case MT_PHY_TYPE_HE_SU:
 546	case MT_PHY_TYPE_HE_EXT_SU:
 547	case MT_PHY_TYPE_HE_TB:
 548	case MT_PHY_TYPE_HE_MU:
 549		if (mcu_rate->tx_gi > NL80211_RATE_INFO_HE_GI_3_2)
 550			return -EINVAL;
 551		rate->he_gi = mcu_rate->tx_gi;
 552		break;
 553	case MT_PHY_TYPE_EHT_SU:
 554	case MT_PHY_TYPE_EHT_TRIG:
 555	case MT_PHY_TYPE_EHT_MU:
 556		if (mcu_rate->tx_gi > NL80211_RATE_INFO_EHT_GI_3_2)
 557			return -EINVAL;
 558		rate->eht_gi = mcu_rate->tx_gi;
 559		break;
 560	default:
 561		return -EINVAL;
 562	}
 563
 564	return 0;
 565}
 566
 567static void
 568mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
 569{
 570	struct mt7996_mcu_all_sta_info_event *res;
 571	u16 i;
 572
 573	skb_pull(skb, sizeof(struct mt7996_mcu_rxd));
 574
 575	res = (struct mt7996_mcu_all_sta_info_event *)skb->data;
 576
 577	for (i = 0; i < le16_to_cpu(res->sta_num); i++) {
 578		u8 ac;
 579		u16 wlan_idx;
 580		struct mt76_wcid *wcid;
 581
 582		switch (le16_to_cpu(res->tag)) {
 583		case UNI_ALL_STA_TXRX_RATE:
 584			wlan_idx = le16_to_cpu(res->rate[i].wlan_idx);
 585			wcid = mt76_wcid_ptr(dev, wlan_idx);
 586
 587			if (!wcid)
 588				break;
 589
 590			if (mt7996_mcu_update_tx_gi(&wcid->rate, &res->rate[i]))
 591				dev_err(dev->mt76.dev, "Failed to update TX GI\n");
 592			break;
 593		case UNI_ALL_STA_TXRX_ADM_STAT:
 594			wlan_idx = le16_to_cpu(res->adm_stat[i].wlan_idx);
 595			wcid = mt76_wcid_ptr(dev, wlan_idx);
 596
 597			if (!wcid)
 598				break;
 599
 600			for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
 601				wcid->stats.tx_bytes +=
 602					le32_to_cpu(res->adm_stat[i].tx_bytes[ac]);
 603				wcid->stats.rx_bytes +=
 604					le32_to_cpu(res->adm_stat[i].rx_bytes[ac]);
 605			}
 606			break;
 607		case UNI_ALL_STA_TXRX_MSDU_COUNT:
 608			wlan_idx = le16_to_cpu(res->msdu_cnt[i].wlan_idx);
 609			wcid = mt76_wcid_ptr(dev, wlan_idx);
 610
 611			if (!wcid)
 612				break;
 613
 614			wcid->stats.tx_packets +=
 615				le32_to_cpu(res->msdu_cnt[i].tx_msdu_cnt);
 616			wcid->stats.rx_packets +=
 617				le32_to_cpu(res->msdu_cnt[i].rx_msdu_cnt);
 618			break;
 619		default:
 620			break;
 621		}
 622	}
 623}
 624
 625static void
 626mt7996_mcu_rx_thermal_notify(struct mt7996_dev *dev, struct sk_buff *skb)
 627{
 628#define THERMAL_NOTIFY_TAG 0x4
 629#define THERMAL_NOTIFY 0x2
 630	struct mt76_phy *mphy = &dev->mt76.phy;
 631	struct mt7996_mcu_thermal_notify *n;
 632	struct mt7996_phy *phy;
 633
 634	n = (struct mt7996_mcu_thermal_notify *)skb->data;
 635
 636	if (le16_to_cpu(n->tag) != THERMAL_NOTIFY_TAG)
 637		return;
 638
 639	if (n->event_id != THERMAL_NOTIFY)
 640		return;
 641
 642	if (n->band_idx > MT_BAND2)
 643		return;
 644
 645	mphy = dev->mt76.phys[n->band_idx];
 646	if (!mphy)
 647		return;
 648
 649	phy = (struct mt7996_phy *)mphy->priv;
 650	phy->throttle_state = n->duty_percent;
 651}
 652
 653static void
 654mt7996_mcu_rx_ext_event(struct mt7996_dev *dev, struct sk_buff *skb)
 655{
 656	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
 657
 658	switch (rxd->ext_eid) {
 659	case MCU_EXT_EVENT_FW_LOG_2_HOST:
 660		mt7996_mcu_rx_log_message(dev, skb);
 661		break;
 662	default:
 663		break;
 664	}
 665}
 666
 667static void
 668mt7996_mcu_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
 669{
 670	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
 671
 672	switch (rxd->eid) {
 673	case MCU_EVENT_EXT:
 674		mt7996_mcu_rx_ext_event(dev, skb);
 675		break;
 676	case MCU_UNI_EVENT_THERMAL:
 677		mt7996_mcu_rx_thermal_notify(dev, skb);
 678		break;
 679	default:
 680		break;
 681	}
 682	dev_kfree_skb(skb);
 683}
 684
 685static void
 686mt7996_mcu_wed_rro_event(struct mt7996_dev *dev, struct sk_buff *skb)
 687{
 688	struct mt7996_mcu_wed_rro_event *event = (void *)skb->data;
 689
 690	if (!mt7996_has_hwrro(dev))
 691		return;
 692
 693	skb_pull(skb, sizeof(struct mt7996_mcu_rxd) + 4);
 694
 695	switch (le16_to_cpu(event->tag)) {
 696	case UNI_WED_RRO_BA_SESSION_STATUS: {
 697		struct mt7996_mcu_wed_rro_ba_event *e;
 698
 699		while (skb->len >= sizeof(*e)) {
 700			struct mt76_rx_tid *tid;
 701			struct mt76_wcid *wcid;
 702			u16 idx;
 703
 704			e = (void *)skb->data;
 705			idx = le16_to_cpu(e->wlan_id);
 706			wcid = mt76_wcid_ptr(dev, idx);
 707			if (!wcid || !wcid->sta)
 708				break;
 709
 710			if (e->tid >= ARRAY_SIZE(wcid->aggr))
 711				break;
 712
 713			tid = rcu_dereference(wcid->aggr[e->tid]);
 714			if (!tid)
 715				break;
 716
 717			tid->id = le16_to_cpu(e->id);
 718			skb_pull(skb, sizeof(*e));
 719		}
 720		break;
 721	}
 722	case UNI_WED_RRO_BA_SESSION_DELETE: {
 723		struct mt7996_mcu_wed_rro_ba_delete_event *e;
 724
 725		while (skb->len >= sizeof(*e)) {
 726			struct mt7996_wed_rro_session_id *session;
 727
 728			e = (void *)skb->data;
 729			session = kzalloc(sizeof(*session), GFP_ATOMIC);
 730			if (!session)
 731				break;
 732
 733			session->id = le16_to_cpu(e->session_id);
 734
 735			spin_lock_bh(&dev->wed_rro.lock);
 736			list_add_tail(&session->list, &dev->wed_rro.poll_list);
 737			spin_unlock_bh(&dev->wed_rro.lock);
 738
 739			ieee80211_queue_work(mt76_hw(dev), &dev->wed_rro.work);
 740			skb_pull(skb, sizeof(*e));
 741		}
 742		break;
 743	}
 744	default:
 745		break;
 746	}
 747}
 748
 749static void
 750mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
 751{
 752	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
 753
 754	switch (rxd->eid) {
 755	case MCU_UNI_EVENT_FW_LOG_2_HOST:
 756		mt7996_mcu_rx_log_message(dev, skb);
 757		break;
 758	case MCU_UNI_EVENT_IE_COUNTDOWN:
 759		mt7996_mcu_ie_countdown(dev, skb);
 760		break;
 761	case MCU_UNI_EVENT_RDD_REPORT:
 762		mt7996_mcu_rx_radar_detected(dev, skb);
 763		break;
 764	case MCU_UNI_EVENT_ALL_STA_INFO:
 765		mt7996_mcu_rx_all_sta_info_event(dev, skb);
 766		break;
 767	case MCU_UNI_EVENT_WED_RRO:
 768		mt7996_mcu_wed_rro_event(dev, skb);
 769		break;
 770	default:
 771		break;
 772	}
 773	dev_kfree_skb(skb);
 774}
 775
 776void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb)
 777{
 778	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
 779
 780	if (rxd->option & MCU_UNI_CMD_UNSOLICITED_EVENT) {
 781		mt7996_mcu_uni_rx_unsolicited_event(dev, skb);
 782		return;
 783	}
 784
 785	/* WA still uses legacy event*/
 786	if (rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
 787	    !rxd->seq)
 788		mt7996_mcu_rx_unsolicited_event(dev, skb);
 789	else
 790		mt76_mcu_rx_event(&dev->mt76, skb);
 791}
 792
 793static struct tlv *
 794mt7996_mcu_add_uni_tlv(struct sk_buff *skb, u16 tag, u16 len)
 795{
 796	struct tlv *ptlv = skb_put_zero(skb, len);
 797
 798	ptlv->tag = cpu_to_le16(tag);
 799	ptlv->len = cpu_to_le16(len);
 800
 801	return ptlv;
 802}
 803
 804static void
 805mt7996_mcu_bss_rfch_tlv(struct sk_buff *skb, struct mt7996_phy *phy)
 806{
 807	static const u8 rlm_ch_band[] = {
 808		[NL80211_BAND_2GHZ] = 1,
 809		[NL80211_BAND_5GHZ] = 2,
 810		[NL80211_BAND_6GHZ] = 3,
 811	};
 812	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 813	struct bss_rlm_tlv *ch;
 814	struct tlv *tlv;
 815	int freq1 = chandef->center_freq1;
 816
 817	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_RLM, sizeof(*ch));
 818
 819	ch = (struct bss_rlm_tlv *)tlv;
 820	ch->control_channel = chandef->chan->hw_value;
 821	ch->center_chan = ieee80211_frequency_to_channel(freq1);
 822	ch->bw = mt76_connac_chan_bw(chandef);
 823	ch->tx_streams = hweight8(phy->mt76->antenna_mask);
 824	ch->rx_streams = hweight8(phy->mt76->antenna_mask);
 825	ch->band = rlm_ch_band[chandef->chan->band];
 826
 827	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
 828		int freq2 = chandef->center_freq2;
 829
 830		ch->center_chan2 = ieee80211_frequency_to_channel(freq2);
 831	}
 832}
 833
 834static void
 835mt7996_mcu_bss_ra_tlv(struct sk_buff *skb, struct mt7996_phy *phy)
 836{
 837	struct bss_ra_tlv *ra;
 838	struct tlv *tlv;
 839
 840	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_RA, sizeof(*ra));
 841
 842	ra = (struct bss_ra_tlv *)tlv;
 843	ra->short_preamble = true;
 844}
 845
 846static void
 847mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 848		      struct ieee80211_bss_conf *link_conf,
 849		      struct mt7996_phy *phy)
 850{
 851#define DEFAULT_HE_PE_DURATION		4
 852#define DEFAULT_HE_DURATION_RTS_THRES	1023
 853	const struct ieee80211_sta_he_cap *cap;
 854	struct bss_info_uni_he *he;
 855	struct tlv *tlv;
 856
 857	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
 858
 859	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
 860
 861	he = (struct bss_info_uni_he *)tlv;
 862	he->he_pe_duration = link_conf->htc_trig_based_pkt_ext;
 863	if (!he->he_pe_duration)
 864		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
 865
 866	he->he_rts_thres = cpu_to_le16(link_conf->frame_time_rts_th);
 867	if (!he->he_rts_thres)
 868		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
 869
 870	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
 871	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
 872	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
 873}
 874
 875static void
 876mt7996_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
 877			  bool enable)
 878{
 879	struct bss_info_uni_mbssid *mbssid;
 880	struct tlv *tlv;
 881
 882	if (!link_conf->bssid_indicator && enable)
 883		return;
 884
 885	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_11V_MBSSID, sizeof(*mbssid));
 886
 887	mbssid = (struct bss_info_uni_mbssid *)tlv;
 888
 889	if (enable) {
 890		mbssid->max_indicator = link_conf->bssid_indicator;
 891		mbssid->mbss_idx = link_conf->bssid_index;
 892		mbssid->tx_bss_omac_idx = 0;
 893	}
 894}
 895
 896static void
 897mt7996_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt76_vif_link *mlink,
 898		       struct mt7996_phy *phy)
 899{
 900	struct bss_rate_tlv *bmc;
 901	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
 902	enum nl80211_band band = chandef->chan->band;
 903	struct tlv *tlv;
 904	u8 idx = mlink->mcast_rates_idx ?
 905		 mlink->mcast_rates_idx : mlink->basic_rates_idx;
 906
 907	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_RATE, sizeof(*bmc));
 908
 909	bmc = (struct bss_rate_tlv *)tlv;
 910
 911	bmc->short_preamble = (band == NL80211_BAND_2GHZ);
 912	bmc->bc_fixed_rate = idx;
 913	bmc->mc_fixed_rate = idx;
 914}
 915
 916static void
 917mt7996_mcu_bss_txcmd_tlv(struct sk_buff *skb, bool en)
 918{
 919	struct bss_txcmd_tlv *txcmd;
 920	struct tlv *tlv;
 921
 922	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_TXCMD, sizeof(*txcmd));
 923
 924	txcmd = (struct bss_txcmd_tlv *)tlv;
 925	txcmd->txcmd_mode = en;
 926}
 927
 928static void
 929mt7996_mcu_bss_mld_tlv(struct sk_buff *skb,
 930		       struct ieee80211_bss_conf *link_conf,
 931		       struct mt7996_vif_link *link)
 932{
 933	struct ieee80211_vif *vif = link_conf->vif;
 934	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
 935	struct bss_mld_tlv *mld;
 936	struct tlv *tlv;
 937
 938	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_MLD, sizeof(*mld));
 939	mld = (struct bss_mld_tlv *)tlv;
 940	mld->own_mld_id = link->mld_idx;
 941	mld->link_id = link_conf->link_id;
 942
 943	if (ieee80211_vif_is_mld(vif)) {
 944		mld->group_mld_id = mvif->mld_group_idx;
 945		mld->remap_idx = mvif->mld_remap_idx;
 946		memcpy(mld->mac_addr, vif->addr, ETH_ALEN);
 947	} else {
 948		mld->group_mld_id = 0xff;
 949		mld->remap_idx = 0xff;
 950	}
 951}
 952
 953static void
 954mt7996_mcu_bss_sec_tlv(struct sk_buff *skb, struct mt76_vif_link *mlink)
 955{
 956	struct bss_sec_tlv *sec;
 957	struct tlv *tlv;
 958
 959	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_SEC, sizeof(*sec));
 960
 961	sec = (struct bss_sec_tlv *)tlv;
 962	sec->cipher = mlink->cipher;
 963}
 964
 965static int
 966mt7996_mcu_muar_config(struct mt7996_dev *dev, struct mt76_vif_link *mlink,
 967		       const u8 *addr, bool bssid, bool enable)
 968{
 969#define UNI_MUAR_ENTRY 2
 970	u32 idx = mlink->omac_idx - REPEATER_BSSID_START;
 971	struct {
 972		struct {
 973			u8 band;
 974			u8 __rsv[3];
 975		} hdr;
 976
 977		__le16 tag;
 978		__le16 len;
 979
 980		bool smesh;
 981		u8 bssid;
 982		u8 index;
 983		u8 entry_add;
 984		u8 addr[ETH_ALEN];
 985		u8 __rsv[2];
 986	} __packed req = {
 987		.hdr.band = mlink->band_idx,
 988		.tag = cpu_to_le16(UNI_MUAR_ENTRY),
 989		.len = cpu_to_le16(sizeof(req) - sizeof(req.hdr)),
 990		.smesh = false,
 991		.index = idx * 2 + bssid,
 992		.entry_add = true,
 993	};
 994
 995	if (enable)
 996		memcpy(req.addr, addr, ETH_ALEN);
 997
 998	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(REPT_MUAR), &req,
 999				 sizeof(req), true);
1000}
1001
1002static void
1003mt7996_mcu_bss_ifs_timing_tlv(struct sk_buff *skb, struct mt7996_phy *phy)
1004{
1005	struct bss_ifs_time_tlv *ifs_time;
1006	struct tlv *tlv;
1007	bool is_2ghz = phy->mt76->chandef.chan->band == NL80211_BAND_2GHZ;
1008
1009	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_IFS_TIME, sizeof(*ifs_time));
1010
1011	ifs_time = (struct bss_ifs_time_tlv *)tlv;
1012	ifs_time->slot_valid = true;
1013	ifs_time->sifs_valid = true;
1014	ifs_time->rifs_valid = true;
1015	ifs_time->eifs_valid = true;
1016
1017	ifs_time->slot_time = cpu_to_le16(phy->slottime);
1018	ifs_time->sifs_time = cpu_to_le16(10);
1019	ifs_time->rifs_time = cpu_to_le16(2);
1020	ifs_time->eifs_time = cpu_to_le16(is_2ghz ? 78 : 84);
1021
1022	if (is_2ghz) {
1023		ifs_time->eifs_cck_valid = true;
1024		ifs_time->eifs_cck_time = cpu_to_le16(314);
1025	}
1026}
1027
1028static int
1029mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
1030			 struct ieee80211_vif *vif,
1031			 struct ieee80211_bss_conf *link_conf,
1032			 struct mt76_vif_link *mvif,
1033			 struct mt76_phy *phy, u16 wlan_idx,
1034			 bool enable)
1035{
1036	struct cfg80211_chan_def *chandef = &phy->chandef;
1037	struct mt76_connac_bss_basic_tlv *bss;
1038	u32 type = CONNECTION_INFRA_AP;
1039	u16 sta_wlan_idx = wlan_idx;
1040	struct tlv *tlv;
1041	int idx;
1042
1043	switch (vif->type) {
1044	case NL80211_IFTYPE_MESH_POINT:
1045	case NL80211_IFTYPE_AP:
1046	case NL80211_IFTYPE_MONITOR:
1047		break;
1048	case NL80211_IFTYPE_STATION:
1049		if (enable) {
1050			struct ieee80211_sta *sta;
1051
1052			rcu_read_lock();
1053			sta = ieee80211_find_sta(vif, link_conf->bssid);
1054			if (sta) {
1055				struct mt7996_sta *msta = (void *)sta->drv_priv;
1056				struct mt7996_sta_link *msta_link;
1057				int link_id = link_conf->link_id;
1058
1059				msta_link = rcu_dereference(msta->link[link_id]);
1060				if (msta_link)
1061					sta_wlan_idx = msta_link->wcid.idx;
1062			}
1063			rcu_read_unlock();
1064		}
1065		type = CONNECTION_INFRA_STA;
1066		break;
1067	case NL80211_IFTYPE_ADHOC:
1068		type = CONNECTION_IBSS_ADHOC;
1069		break;
1070	default:
1071		WARN_ON(1);
1072		break;
1073	}
1074
1075	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*bss));
1076
1077	bss = (struct mt76_connac_bss_basic_tlv *)tlv;
1078	bss->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
1079	bss->sta_idx = cpu_to_le16(sta_wlan_idx);
1080	bss->conn_type = cpu_to_le32(type);
1081	bss->omac_idx = mvif->omac_idx;
1082	bss->band_idx = mvif->band_idx;
1083	bss->wmm_idx = mvif->wmm_idx;
1084	bss->conn_state = !enable;
1085	bss->active = enable;
1086
1087	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1088	bss->hw_bss_idx = idx;
1089
1090	if (vif->type == NL80211_IFTYPE_MONITOR) {
1091		memcpy(bss->bssid, phy->macaddr, ETH_ALEN);
1092		return 0;
1093	}
1094
1095	memcpy(bss->bssid, link_conf->bssid, ETH_ALEN);
1096	bss->bcn_interval = cpu_to_le16(link_conf->beacon_int);
1097	bss->dtim_period = link_conf->dtim_period;
1098	bss->phymode = mt76_connac_get_phy_mode(phy, vif,
1099						chandef->chan->band, NULL);
1100	bss->phymode_ext = mt76_connac_get_phy_mode_ext(phy, link_conf,
1101							chandef->chan->band);
1102
1103	return 0;
1104}
1105
1106static struct sk_buff *
1107__mt7996_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif_link *mvif, int len)
1108{
1109	struct bss_req_hdr hdr = {
1110		.bss_idx = mvif->idx,
1111	};
1112	struct sk_buff *skb;
1113
1114	skb = mt76_mcu_msg_alloc(dev, NULL, len);
1115	if (!skb)
1116		return ERR_PTR(-ENOMEM);
1117
1118	skb_put_data(skb, &hdr, sizeof(hdr));
1119
1120	return skb;
1121}
1122
1123int mt7996_mcu_add_bss_info(struct mt7996_phy *phy, struct ieee80211_vif *vif,
1124			    struct ieee80211_bss_conf *link_conf,
1125			    struct mt76_vif_link *mlink,
1126			    struct mt7996_sta_link *msta_link, int enable)
1127{
1128	struct mt7996_dev *dev = phy->dev;
1129	struct sk_buff *skb;
1130
1131	if (mlink->omac_idx >= REPEATER_BSSID_START) {
1132		mt7996_mcu_muar_config(dev, mlink, link_conf->addr, false, enable);
1133		mt7996_mcu_muar_config(dev, mlink, link_conf->bssid, true, enable);
1134	}
1135
1136	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, mlink,
1137					 MT7996_BSS_UPDATE_MAX_SIZE);
1138	if (IS_ERR(skb))
1139		return PTR_ERR(skb);
1140
1141	/* bss_basic must be first */
1142	mt7996_mcu_bss_basic_tlv(skb, vif, link_conf, mlink, phy->mt76,
1143				 msta_link->wcid.idx, enable);
1144	mt7996_mcu_bss_sec_tlv(skb, mlink);
1145
1146	if (vif->type == NL80211_IFTYPE_MONITOR)
1147		goto out;
1148
1149	if (enable) {
1150		struct mt7996_vif_link *link;
1151
1152		mt7996_mcu_bss_rfch_tlv(skb, phy);
1153		mt7996_mcu_bss_bmc_tlv(skb, mlink, phy);
1154		mt7996_mcu_bss_ra_tlv(skb, phy);
1155		mt7996_mcu_bss_txcmd_tlv(skb, true);
1156		mt7996_mcu_bss_ifs_timing_tlv(skb, phy);
1157
1158		if (vif->bss_conf.he_support)
1159			mt7996_mcu_bss_he_tlv(skb, vif, link_conf, phy);
1160
1161		/* this tag is necessary no matter if the vif is MLD */
1162		link = container_of(mlink, struct mt7996_vif_link, mt76);
1163		mt7996_mcu_bss_mld_tlv(skb, link_conf, link);
1164	}
1165
1166	mt7996_mcu_bss_mbssid_tlv(skb, link_conf, enable);
1167
1168out:
1169	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1170				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
1171}
1172
1173int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif,
1174			  struct ieee80211_bss_conf *link_conf)
1175{
1176	struct mt7996_dev *dev = phy->dev;
1177	struct mt76_vif_link *mlink = mt76_vif_conf_link(&dev->mt76, vif, link_conf);
1178	struct sk_buff *skb;
1179
1180	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, mlink,
1181					 MT7996_BSS_UPDATE_MAX_SIZE);
1182	if (IS_ERR(skb))
1183		return PTR_ERR(skb);
1184
1185	mt7996_mcu_bss_ifs_timing_tlv(skb, phy);
1186
1187	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1188				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
1189}
1190
1191static int
1192mt7996_mcu_sta_ba(struct mt7996_dev *dev, struct mt76_vif_link *mvif,
1193		  struct ieee80211_ampdu_params *params,
1194		  struct mt76_wcid *wcid, bool enable, bool tx)
1195{
1196	struct sta_rec_ba_uni *ba;
1197	struct sk_buff *skb;
1198	struct tlv *tlv;
1199
1200	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, mvif, wcid,
1201					      MT7996_STA_UPDATE_MAX_SIZE);
1202	if (IS_ERR(skb))
1203		return PTR_ERR(skb);
1204
1205	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
1206
1207	ba = (struct sta_rec_ba_uni *)tlv;
1208	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
1209	ba->winsize = cpu_to_le16(params->buf_size);
1210	ba->ssn = cpu_to_le16(params->ssn);
1211	ba->ba_en = enable << params->tid;
1212	ba->amsdu = params->amsdu;
1213	ba->tid = params->tid;
1214	ba->ba_rdd_rro = !tx && enable && mt7996_has_hwrro(dev);
1215
1216	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1217				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
1218}
1219
1220/** starec & wtbl **/
1221int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
1222			 struct ieee80211_ampdu_params *params,
1223			 struct ieee80211_vif *vif, bool enable)
1224{
1225	struct ieee80211_sta *sta = params->sta;
1226	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
1227	struct ieee80211_link_sta *link_sta;
1228	unsigned int link_id;
1229	int ret = 0;
1230
1231	for_each_sta_active_link(vif, sta, link_sta, link_id) {
1232		struct mt7996_sta_link *msta_link;
1233		struct mt7996_vif_link *link;
1234
1235		msta_link = mt76_dereference(msta->link[link_id], &dev->mt76);
1236		if (!msta_link)
1237			continue;
1238
1239		link = mt7996_vif_link(dev, vif, link_id);
1240		if (!link)
1241			continue;
1242
1243		if (enable && !params->amsdu)
1244			msta_link->wcid.amsdu = false;
1245
1246		ret = mt7996_mcu_sta_ba(dev, &link->mt76, params,
1247					&msta_link->wcid, enable, true);
1248		if (ret)
1249			break;
1250	}
1251
1252	return ret;
1253}
1254
1255int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
1256			 struct ieee80211_ampdu_params *params,
1257			 struct ieee80211_vif *vif, bool enable)
1258{
1259	struct ieee80211_sta *sta = params->sta;
1260	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
1261	struct ieee80211_link_sta *link_sta;
1262	unsigned int link_id;
1263	int ret = 0;
1264
1265	for_each_sta_active_link(vif, sta, link_sta, link_id) {
1266		struct mt7996_sta_link *msta_link;
1267		struct mt7996_vif_link *link;
1268
1269		msta_link = mt76_dereference(msta->link[link_id], &dev->mt76);
1270		if (!msta_link)
1271			continue;
1272
1273		link = mt7996_vif_link(dev, vif, link_id);
1274		if (!link)
1275			continue;
1276
1277		ret = mt7996_mcu_sta_ba(dev, &link->mt76, params,
1278					&msta_link->wcid, enable, false);
1279		if (ret)
1280			break;
1281	}
1282
1283	return ret;
1284}
1285
1286static void
1287mt7996_mcu_sta_he_tlv(struct sk_buff *skb,
1288		      struct ieee80211_link_sta *link_sta,
1289		      struct mt7996_vif_link *link)
1290{
1291	struct ieee80211_he_cap_elem *elem = &link_sta->he_cap.he_cap_elem;
1292	struct ieee80211_he_mcs_nss_supp mcs_map;
1293	struct sta_rec_he_v2 *he;
1294	struct tlv *tlv;
1295	int i = 0;
1296
1297	if (!link_sta->he_cap.has_he)
1298		return;
1299
1300	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_V2, sizeof(*he));
1301
1302	he = (struct sta_rec_he_v2 *)tlv;
1303	for (i = 0; i < 11; i++) {
1304		if (i < 6)
1305			he->he_mac_cap[i] = elem->mac_cap_info[i];
1306		he->he_phy_cap[i] = elem->phy_cap_info[i];
1307	}
1308
1309	mcs_map = link_sta->he_cap.he_mcs_nss_supp;
1310	switch (link_sta->bandwidth) {
1311	case IEEE80211_STA_RX_BW_160:
1312		if (elem->phy_cap_info[0] &
1313		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
1314			mt7996_mcu_set_sta_he_mcs(link_sta, link,
1315						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
1316						  le16_to_cpu(mcs_map.rx_mcs_80p80));
1317
1318		mt7996_mcu_set_sta_he_mcs(link_sta, link,
1319					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
1320					  le16_to_cpu(mcs_map.rx_mcs_160));
1321		fallthrough;
1322	default:
1323		mt7996_mcu_set_sta_he_mcs(link_sta, link,
1324					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
1325					  le16_to_cpu(mcs_map.rx_mcs_80));
1326		break;
1327	}
1328
1329	he->pkt_ext = 2;
1330}
1331
1332static void
1333mt7996_mcu_sta_he_6g_tlv(struct sk_buff *skb,
1334			 struct ieee80211_link_sta *link_sta)
1335{
1336	struct sta_rec_he_6g_capa *he_6g;
1337	struct tlv *tlv;
1338
1339	if (!link_sta->he_6ghz_capa.capa)
1340		return;
1341
1342	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G, sizeof(*he_6g));
1343
1344	he_6g = (struct sta_rec_he_6g_capa *)tlv;
1345	he_6g->capa = link_sta->he_6ghz_capa.capa;
1346}
1347
1348static void
1349mt7996_mcu_sta_eht_tlv(struct sk_buff *skb,
1350		       struct ieee80211_link_sta *link_sta)
1351{
1352	struct mt7996_sta *msta = (struct mt7996_sta *)link_sta->sta->drv_priv;
1353	struct ieee80211_vif *vif = container_of((void *)msta->vif,
1354						 struct ieee80211_vif, drv_priv);
1355	struct ieee80211_eht_mcs_nss_supp *mcs_map;
1356	struct ieee80211_eht_cap_elem_fixed *elem;
1357	struct sta_rec_eht *eht;
1358	struct tlv *tlv;
1359
1360	if (!link_sta->eht_cap.has_eht)
1361		return;
1362
1363	mcs_map = &link_sta->eht_cap.eht_mcs_nss_supp;
1364	elem = &link_sta->eht_cap.eht_cap_elem;
1365
1366	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT, sizeof(*eht));
1367
1368	eht = (struct sta_rec_eht *)tlv;
1369	eht->tid_bitmap = 0xff;
1370	eht->mac_cap = cpu_to_le16(*(u16 *)elem->mac_cap_info);
1371	eht->phy_cap = cpu_to_le64(*(u64 *)elem->phy_cap_info);
1372	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
1373
1374	if (vif->type != NL80211_IFTYPE_STATION &&
1375	    (link_sta->he_cap.he_cap_elem.phy_cap_info[0] &
1376	     (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G |
1377	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
1378	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
1379	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)) == 0) {
1380		memcpy(eht->mcs_map_bw20, &mcs_map->only_20mhz,
1381		       sizeof(eht->mcs_map_bw20));
1382		return;
1383	}
1384
1385	memcpy(eht->mcs_map_bw80, &mcs_map->bw._80, sizeof(eht->mcs_map_bw80));
1386	memcpy(eht->mcs_map_bw160, &mcs_map->bw._160, sizeof(eht->mcs_map_bw160));
1387	memcpy(eht->mcs_map_bw320, &mcs_map->bw._320, sizeof(eht->mcs_map_bw320));
1388}
1389
1390static void
1391mt7996_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1392{
1393	struct sta_rec_ht_uni *ht;
1394	struct tlv *tlv;
1395
1396	if (!link_sta->ht_cap.ht_supported)
1397		return;
1398
1399	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1400
1401	ht = (struct sta_rec_ht_uni *)tlv;
1402	ht->ht_cap = cpu_to_le16(link_sta->ht_cap.cap);
1403	ht->ampdu_param = u8_encode_bits(link_sta->ht_cap.ampdu_factor,
1404					 IEEE80211_HT_AMPDU_PARM_FACTOR) |
1405			  u8_encode_bits(link_sta->ht_cap.ampdu_density,
1406					 IEEE80211_HT_AMPDU_PARM_DENSITY);
1407}
1408
1409static void
1410mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1411{
1412	struct sta_rec_vht *vht;
1413	struct tlv *tlv;
1414
1415	/* For 6G band, this tlv is necessary to let hw work normally */
1416	if (!link_sta->he_6ghz_capa.capa && !link_sta->vht_cap.vht_supported)
1417		return;
1418
1419	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1420
1421	vht = (struct sta_rec_vht *)tlv;
1422	vht->vht_cap = cpu_to_le32(link_sta->vht_cap.cap);
1423	vht->vht_rx_mcs_map = link_sta->vht_cap.vht_mcs.rx_mcs_map;
1424	vht->vht_tx_mcs_map = link_sta->vht_cap.vht_mcs.tx_mcs_map;
1425}
1426
1427static void
1428mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
1429			 struct ieee80211_vif *vif,
1430			 struct ieee80211_link_sta *link_sta,
1431			 struct mt7996_sta_link *msta_link)
1432{
1433	struct sta_rec_amsdu *amsdu;
1434	struct tlv *tlv;
1435
1436	if (vif->type != NL80211_IFTYPE_STATION &&
1437	    vif->type != NL80211_IFTYPE_MESH_POINT &&
1438	    vif->type != NL80211_IFTYPE_AP)
1439		return;
1440
1441	if (!link_sta->agg.max_amsdu_len)
1442		return;
1443
1444	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1445	amsdu = (struct sta_rec_amsdu *)tlv;
1446	amsdu->max_amsdu_num = 8;
1447	amsdu->amsdu_en = true;
1448	msta_link->wcid.amsdu = true;
1449
1450	switch (link_sta->agg.max_amsdu_len) {
1451	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1452		amsdu->max_mpdu_size =
1453			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1454		return;
1455	case IEEE80211_MAX_MPDU_LEN_HT_7935:
1456	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1457		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1458		return;
1459	default:
1460		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1461		return;
1462	}
1463}
1464
1465static void
1466mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
1467			struct ieee80211_bss_conf *link_conf,
1468			struct ieee80211_link_sta *link_sta)
1469{
1470	struct ieee80211_he_cap_elem *elem = &link_sta->he_cap.he_cap_elem;
1471	struct sta_rec_muru *muru;
1472	struct tlv *tlv;
1473
1474	if (link_conf->vif->type != NL80211_IFTYPE_STATION &&
1475	    link_conf->vif->type != NL80211_IFTYPE_AP)
1476		return;
1477
1478	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
1479
1480	muru = (struct sta_rec_muru *)tlv;
1481	muru->cfg.mimo_dl_en = link_conf->eht_mu_beamformer ||
1482			       link_conf->he_mu_beamformer ||
1483			       link_conf->vht_mu_beamformer ||
1484			       link_conf->vht_mu_beamformee;
1485	muru->cfg.ofdma_dl_en = true;
1486
1487	if (link_sta->vht_cap.vht_supported)
1488		muru->mimo_dl.vht_mu_bfee =
1489			!!(link_sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1490
1491	if (!link_sta->he_cap.has_he)
1492		return;
1493
1494	muru->mimo_dl.partial_bw_dl_mimo =
1495		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
1496
1497	muru->mimo_ul.full_ul_mimo =
1498		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
1499	muru->mimo_ul.partial_ul_mimo =
1500		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
1501
1502	muru->ofdma_dl.punc_pream_rx =
1503		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1504	muru->ofdma_dl.he_20m_in_40m_2g =
1505		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
1506	muru->ofdma_dl.he_20m_in_160m =
1507		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1508	muru->ofdma_dl.he_80m_in_160m =
1509		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1510
1511	muru->ofdma_ul.t_frame_dur =
1512		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1513	muru->ofdma_ul.mu_cascading =
1514		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
1515	muru->ofdma_ul.uo_ra =
1516		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
1517	muru->ofdma_ul.rx_ctrl_frame_to_mbss =
1518		HE_MAC(CAP3_RX_CTRL_FRAME_TO_MULTIBSS, elem->mac_cap_info[3]);
1519}
1520
1521static inline bool
1522mt7996_is_ebf_supported(struct mt7996_phy *phy,
1523			struct ieee80211_bss_conf *link_conf,
1524			struct ieee80211_link_sta *link_sta, bool bfee)
1525{
1526	int sts = hweight16(phy->mt76->chainmask);
1527
1528	if (link_conf->vif->type != NL80211_IFTYPE_STATION &&
1529	    link_conf->vif->type != NL80211_IFTYPE_AP)
1530		return false;
1531
1532	if (!bfee && sts < 2)
1533		return false;
1534
1535	if (link_sta->eht_cap.has_eht) {
1536		struct ieee80211_sta_eht_cap *pc = &link_sta->eht_cap;
1537		struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
1538
1539		if (bfee)
1540			return link_conf->eht_su_beamformee &&
1541			       EHT_PHY(CAP0_SU_BEAMFORMER, pe->phy_cap_info[0]);
1542		else
1543			return link_conf->eht_su_beamformer &&
1544			       EHT_PHY(CAP0_SU_BEAMFORMEE, pe->phy_cap_info[0]);
1545	}
1546
1547	if (link_sta->he_cap.has_he) {
1548		struct ieee80211_he_cap_elem *pe = &link_sta->he_cap.he_cap_elem;
1549
1550		if (bfee)
1551			return link_conf->he_su_beamformee &&
1552			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1553		else
1554			return link_conf->he_su_beamformer &&
1555			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1556	}
1557
1558	if (link_sta->vht_cap.vht_supported) {
1559		u32 cap = link_sta->vht_cap.cap;
1560
1561		if (bfee)
1562			return link_conf->vht_su_beamformee &&
1563			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1564		else
1565			return link_conf->vht_su_beamformer &&
1566			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1567	}
1568
1569	return false;
1570}
1571
1572static void
1573mt7996_mcu_sta_sounding_rate(struct sta_rec_bf *bf, struct mt7996_phy *phy)
1574{
1575	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1576	bf->ndp_rate = 0;				/* mcs0 */
1577	if (is_mt7996(phy->mt76->dev))
1578		bf->ndpa_rate = MT7996_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1579	else
1580		bf->ndpa_rate = MT7992_CFEND_RATE_DEFAULT;	/* ofdm 6m */
1581
1582	bf->rept_poll_rate = MT7996_CFEND_RATE_DEFAULT;	/* ofdm 24m */
1583}
1584
1585static void
1586mt7996_mcu_sta_bfer_ht(struct ieee80211_link_sta *link_sta,
1587		       struct mt7996_phy *phy, struct sta_rec_bf *bf,
1588		       bool explicit)
1589{
1590	struct ieee80211_mcs_info *mcs = &link_sta->ht_cap.mcs;
1591	u8 n = 0;
1592
1593	bf->tx_mode = MT_PHY_TYPE_HT;
1594
1595	if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1596	    (mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1597		n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1598			      mcs->tx_params);
1599	else if (mcs->rx_mask[3])
1600		n = 3;
1601	else if (mcs->rx_mask[2])
1602		n = 2;
1603	else if (mcs->rx_mask[1])
1604		n = 1;
1605
1606	bf->nrow = hweight8(phy->mt76->antenna_mask) - 1;
1607	bf->ncol = min_t(u8, bf->nrow, n);
1608	bf->ibf_ncol = explicit ? min_t(u8, MT7996_IBF_MAX_NC, bf->ncol) :
1609				  min_t(u8, MT7996_IBF_MAX_NC, n);
1610}
1611
1612static void
1613mt7996_mcu_sta_bfer_vht(struct ieee80211_link_sta *link_sta,
1614			struct mt7996_phy *phy, struct sta_rec_bf *bf,
1615			bool explicit)
1616{
1617	struct ieee80211_sta_vht_cap *pc = &link_sta->vht_cap;
1618	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1619	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1620	u8 nss_mcs = mt7996_mcu_get_sta_nss(mcs_map);
1621	u8 tx_ant = hweight8(phy->mt76->antenna_mask) - 1;
1622
1623	bf->tx_mode = MT_PHY_TYPE_VHT;
1624
1625	if (explicit) {
1626		u8 sts, snd_dim;
1627
1628		mt7996_mcu_sta_sounding_rate(bf, phy);
1629
1630		sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1631				pc->cap);
1632		snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1633				    vc->cap);
1634		bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1635		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1636		bf->ibf_ncol = min_t(u8, MT7996_IBF_MAX_NC, bf->ncol);
1637
1638		if (link_sta->bandwidth == IEEE80211_STA_RX_BW_160)
1639			bf->nrow = 1;
1640	} else {
1641		bf->nrow = tx_ant;
1642		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1643		bf->ibf_ncol = min_t(u8, MT7996_IBF_MAX_NC, nss_mcs);
1644
1645		if (link_sta->bandwidth == IEEE80211_STA_RX_BW_160)
1646			bf->ibf_nrow = 1;
1647	}
1648}
1649
1650static void
1651mt7996_mcu_sta_bfer_he(struct ieee80211_link_sta *link_sta,
1652		       struct ieee80211_vif *vif, struct mt7996_phy *phy,
1653		       struct sta_rec_bf *bf, bool explicit)
1654{
1655	struct ieee80211_sta_he_cap *pc = &link_sta->he_cap;
1656	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1657	const struct ieee80211_sta_he_cap *vc =
1658		mt76_connac_get_he_phy_cap(phy->mt76, vif);
1659	const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1660	u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1661	u8 nss_mcs = mt7996_mcu_get_sta_nss(mcs_map);
1662	u8 snd_dim, sts;
1663
1664	if (!vc)
1665		return;
1666
1667	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1668
1669	mt7996_mcu_sta_sounding_rate(bf, phy);
1670
1671	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1672				pe->phy_cap_info[6]);
1673	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1674				pe->phy_cap_info[6]);
1675	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1676			 ve->phy_cap_info[5]);
1677	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1678		     pe->phy_cap_info[4]);
1679	bf->nrow = min_t(u8, snd_dim, sts);
1680	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1681	bf->ibf_ncol = explicit ? min_t(u8, MT7996_IBF_MAX_NC, bf->ncol) :
1682				  min_t(u8, MT7996_IBF_MAX_NC, nss_mcs);
1683
1684	if (link_sta->bandwidth != IEEE80211_STA_RX_BW_160)
1685		return;
1686
1687	/* go over for 160MHz and 80p80 */
1688	if (pe->phy_cap_info[0] &
1689	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1690		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1691		nss_mcs = mt7996_mcu_get_sta_nss(mcs_map);
1692
1693		bf->ncol_gt_bw80 = nss_mcs;
1694	}
1695
1696	if (pe->phy_cap_info[0] &
1697	    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1698		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1699		nss_mcs = mt7996_mcu_get_sta_nss(mcs_map);
1700
1701		if (bf->ncol_gt_bw80)
1702			bf->ncol_gt_bw80 = min_t(u8, bf->ncol_gt_bw80, nss_mcs);
1703		else
1704			bf->ncol_gt_bw80 = nss_mcs;
1705	}
1706
1707	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1708			 ve->phy_cap_info[5]);
1709	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1710		     pe->phy_cap_info[4]);
1711
1712	bf->nrow_gt_bw80 = min_t(int, snd_dim, sts);
1713}
1714
1715static void
1716mt7996_mcu_sta_bfer_eht(struct ieee80211_link_sta *link_sta,
1717			struct ieee80211_vif *vif, struct mt7996_phy *phy,
1718			struct sta_rec_bf *bf, bool explicit)
1719{
1720	struct ieee80211_sta_eht_cap *pc = &link_sta->eht_cap;
1721	struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
1722	struct ieee80211_eht_mcs_nss_supp *eht_nss = &pc->eht_mcs_nss_supp;
1723	const struct ieee80211_sta_eht_cap *vc =
1724		mt76_connac_get_eht_phy_cap(phy->mt76, vif);
1725	const struct ieee80211_eht_cap_elem_fixed *ve = &vc->eht_cap_elem;
1726	u8 nss_mcs = u8_get_bits(eht_nss->bw._80.rx_tx_mcs9_max_nss,
1727				 IEEE80211_EHT_MCS_NSS_RX) - 1;
1728	u8 snd_dim, sts;
1729
1730	bf->tx_mode = MT_PHY_TYPE_EHT_MU;
1731
1732	mt7996_mcu_sta_sounding_rate(bf, phy);
1733
1734	bf->trigger_su = EHT_PHY(CAP3_TRIG_SU_BF_FDBK, pe->phy_cap_info[3]);
1735	bf->trigger_mu = EHT_PHY(CAP3_TRIG_MU_BF_PART_BW_FDBK, pe->phy_cap_info[3]);
1736	snd_dim = EHT_PHY(CAP2_SOUNDING_DIM_80MHZ_MASK, ve->phy_cap_info[2]);
1737	sts = EHT_PHY(CAP0_BEAMFORMEE_SS_80MHZ_MASK, pe->phy_cap_info[0]) +
1738	      (EHT_PHY(CAP1_BEAMFORMEE_SS_80MHZ_MASK, pe->phy_cap_info[1]) << 1);
1739	bf->nrow = min_t(u8, snd_dim, sts);
1740	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1741	bf->ibf_ncol = explicit ? min_t(u8, MT7996_IBF_MAX_NC, bf->ncol) :
1742				  min_t(u8, MT7996_IBF_MAX_NC, nss_mcs);
1743
1744	if (link_sta->bandwidth < IEEE80211_STA_RX_BW_160)
1745		return;
1746
1747	switch (link_sta->bandwidth) {
1748	case IEEE80211_STA_RX_BW_160:
1749		snd_dim = EHT_PHY(CAP2_SOUNDING_DIM_160MHZ_MASK, ve->phy_cap_info[2]);
1750		sts = EHT_PHY(CAP1_BEAMFORMEE_SS_160MHZ_MASK, pe->phy_cap_info[1]);
1751		nss_mcs = u8_get_bits(eht_nss->bw._160.rx_tx_mcs9_max_nss,
1752				      IEEE80211_EHT_MCS_NSS_RX) - 1;
1753
1754		bf->nrow_gt_bw80 = min_t(u8, snd_dim, sts);
1755		bf->ncol_gt_bw80 = nss_mcs;
1756		break;
1757	case IEEE80211_STA_RX_BW_320:
1758		snd_dim = EHT_PHY(CAP2_SOUNDING_DIM_320MHZ_MASK, ve->phy_cap_info[2]) +
1759			  (EHT_PHY(CAP3_SOUNDING_DIM_320MHZ_MASK,
1760				   ve->phy_cap_info[3]) << 1);
1761		sts = EHT_PHY(CAP1_BEAMFORMEE_SS_320MHZ_MASK, pe->phy_cap_info[1]);
1762		nss_mcs = u8_get_bits(eht_nss->bw._320.rx_tx_mcs9_max_nss,
1763				      IEEE80211_EHT_MCS_NSS_RX) - 1;
1764
1765		bf->nrow_gt_bw80 = min_t(u8, snd_dim, sts) << 4;
1766		bf->ncol_gt_bw80 = nss_mcs << 4;
1767		break;
1768	default:
1769		break;
1770	}
1771}
1772
1773static void
1774mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
1775			struct ieee80211_bss_conf *link_conf,
1776			struct ieee80211_link_sta *link_sta,
1777			struct mt7996_vif_link *link)
1778{
1779#define EBF_MODE	BIT(0)
1780#define IBF_MODE	BIT(1)
1781#define BF_MAT_ORDER	4
1782	struct ieee80211_vif *vif = link_conf->vif;
1783	struct mt7996_phy *phy = link->phy;
1784	int tx_ant = hweight16(phy->mt76->chainmask) - 1;
1785	struct sta_rec_bf *bf;
1786	struct tlv *tlv;
1787	static const u8 matrix[BF_MAT_ORDER][BF_MAT_ORDER] = {
1788		{0, 0, 0, 0},
1789		{1, 1, 0, 0},	/* 2x1, 2x2, 2x3, 2x4 */
1790		{2, 4, 4, 0},	/* 3x1, 3x2, 3x3, 3x4 */
1791		{3, 5, 6, 0}	/* 4x1, 4x2, 4x3, 4x4 */
1792	};
1793	bool ebf;
1794
1795	if (!(link_sta->ht_cap.ht_supported || link_sta->he_cap.has_he))
1796		return;
1797
1798	ebf = mt7996_is_ebf_supported(phy, link_conf, link_sta, false);
1799	if (!ebf && !dev->ibf)
1800		return;
1801
1802	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
1803	bf = (struct sta_rec_bf *)tlv;
1804
1805	/* he/eht: eBF only, except mt7992 that has 5T on 5GHz also supports iBF
1806	 * vht: support eBF and iBF
1807	 * ht: iBF only, since mac80211 lacks of eBF support
1808	 */
1809	if (link_sta->eht_cap.has_eht)
1810		mt7996_mcu_sta_bfer_eht(link_sta, vif, link->phy, bf, ebf);
1811	else if (link_sta->he_cap.has_he)
1812		mt7996_mcu_sta_bfer_he(link_sta, vif, link->phy, bf, ebf);
1813	else if (link_sta->vht_cap.vht_supported)
1814		mt7996_mcu_sta_bfer_vht(link_sta, link->phy, bf, ebf);
1815	else if (link_sta->ht_cap.ht_supported)
1816		mt7996_mcu_sta_bfer_ht(link_sta, link->phy, bf, ebf);
1817	else
1818		return;
1819
1820	bf->bf_cap = ebf ? EBF_MODE : (dev->ibf ? IBF_MODE : 0);
1821	if (is_mt7992(&dev->mt76) && tx_ant == 4)
1822		bf->bf_cap |= IBF_MODE;
1823
1824	bf->bw = link_sta->bandwidth;
1825	bf->ibf_dbw = link_sta->bandwidth;
1826	bf->ibf_nrow = tx_ant;
1827
1828	if (link_sta->eht_cap.has_eht || link_sta->he_cap.has_he)
1829		bf->ibf_timeout = is_mt7992(&dev->mt76) ? MT7992_IBF_TIMEOUT :
1830							  MT7996_IBF_TIMEOUT;
1831	else if (!ebf && link_sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1832		bf->ibf_timeout = MT7996_IBF_TIMEOUT_LEGACY;
1833	else
1834		bf->ibf_timeout = MT7996_IBF_TIMEOUT;
1835
1836	if (bf->ncol < BF_MAT_ORDER) {
1837		if (ebf)
1838			bf->mem_20m = tx_ant < BF_MAT_ORDER ?
1839				      matrix[tx_ant][bf->ncol] : 0;
1840		else
1841			bf->mem_20m = bf->nrow < BF_MAT_ORDER ?
1842				      matrix[bf->nrow][bf->ncol] : 0;
1843	}
1844}
1845
1846static void
1847mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
1848			struct ieee80211_bss_conf *link_conf,
1849			struct ieee80211_link_sta *link_sta,
1850			struct mt7996_vif_link *link)
1851{
1852	struct mt7996_phy *phy = link->phy;
1853	int tx_ant = hweight8(phy->mt76->antenna_mask) - 1;
1854	struct sta_rec_bfee *bfee;
1855	struct tlv *tlv;
1856	u8 nrow = 0;
1857
1858	if (!(link_sta->vht_cap.vht_supported || link_sta->he_cap.has_he))
1859		return;
1860
1861	if (!mt7996_is_ebf_supported(phy, link_conf, link_sta, true))
1862		return;
1863
1864	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
1865	bfee = (struct sta_rec_bfee *)tlv;
1866
1867	if (link_sta->he_cap.has_he) {
1868		struct ieee80211_he_cap_elem *pe = &link_sta->he_cap.he_cap_elem;
1869
1870		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1871			      pe->phy_cap_info[5]);
1872	} else if (link_sta->vht_cap.vht_supported) {
1873		struct ieee80211_sta_vht_cap *pc = &link_sta->vht_cap;
1874
1875		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1876				 pc->cap);
1877	}
1878
1879	/* reply with identity matrix to avoid 2x2 BF negative gain */
1880	bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
1881}
1882
1883static void
1884mt7996_mcu_sta_tx_proc_tlv(struct sk_buff *skb)
1885{
1886	struct sta_rec_tx_proc *tx_proc;
1887	struct tlv *tlv;
1888
1889	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_TX_PROC, sizeof(*tx_proc));
1890
1891	tx_proc = (struct sta_rec_tx_proc *)tlv;
1892	tx_proc->flag = cpu_to_le32(0);
1893}
1894
1895static void
1896mt7996_mcu_sta_hdrt_tlv(struct mt7996_dev *dev, struct sk_buff *skb)
1897{
1898	struct sta_rec_hdrt *hdrt;
1899	struct tlv *tlv;
1900
1901	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HDRT, sizeof(*hdrt));
1902
1903	hdrt = (struct sta_rec_hdrt *)tlv;
1904	hdrt->hdrt_mode = 1;
1905}
1906
1907static void
1908mt7996_mcu_sta_hdr_trans_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
1909			     struct ieee80211_vif *vif, struct mt76_wcid *wcid)
1910{
1911	struct sta_rec_hdr_trans *hdr_trans;
1912	struct tlv *tlv;
1913
1914	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HDR_TRANS, sizeof(*hdr_trans));
1915	hdr_trans = (struct sta_rec_hdr_trans *)tlv;
1916	hdr_trans->dis_rx_hdr_tran = true;
1917
1918	if (vif->type == NL80211_IFTYPE_STATION)
1919		hdr_trans->to_ds = true;
1920	else
1921		hdr_trans->from_ds = true;
1922
1923	if (!wcid)
1924		return;
1925
1926	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
1927	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
1928		hdr_trans->to_ds = true;
1929		hdr_trans->from_ds = true;
1930	}
1931
1932	if (vif->type == NL80211_IFTYPE_MESH_POINT) {
1933		hdr_trans->to_ds = true;
1934		hdr_trans->from_ds = true;
1935		hdr_trans->mesh = true;
1936	}
1937}
1938
1939static enum mcu_mmps_mode
1940mt7996_mcu_get_mmps_mode(enum ieee80211_smps_mode smps)
1941{
1942	switch (smps) {
1943	case IEEE80211_SMPS_OFF:
1944		return MCU_MMPS_DISABLE;
1945	case IEEE80211_SMPS_STATIC:
1946		return MCU_MMPS_STATIC;
1947	case IEEE80211_SMPS_DYNAMIC:
1948		return MCU_MMPS_DYNAMIC;
1949	default:
1950		return MCU_MMPS_DISABLE;
1951	}
1952}
1953
1954int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
1955				   void *data, u16 version)
1956{
1957	struct uni_header hdr = {};
1958	struct ra_fixed_rate *req;
1959	struct sk_buff *skb;
1960	struct tlv *tlv;
1961	int len;
1962
1963	len = sizeof(hdr) + sizeof(*req);
1964
1965	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
1966	if (!skb)
1967		return -ENOMEM;
1968
1969	skb_put_data(skb, &hdr, sizeof(hdr));
1970
1971	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_RA_FIXED_RATE, sizeof(*req));
1972	req = (struct ra_fixed_rate *)tlv;
1973	req->version = cpu_to_le16(version);
1974	memcpy(&req->rate, data, sizeof(req->rate));
1975
1976	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1977				     MCU_WM_UNI_CMD(RA), true);
1978}
1979
1980int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct mt7996_sta *msta,
1981			       void *data, u8 link_id, u32 field)
1982{
1983	struct mt7996_vif *mvif = msta->vif;
1984	struct mt7996_sta_link *msta_link;
1985	struct sta_rec_ra_fixed_uni *ra;
1986	struct sta_phy_uni *phy = data;
1987	struct mt76_vif_link *mlink;
1988	struct sk_buff *skb;
1989	int err = -ENODEV;
1990	struct tlv *tlv;
1991
1992	rcu_read_lock();
1993
1994	mlink = rcu_dereference(mvif->mt76.link[link_id]);
1995	if (!mlink)
1996		goto error_unlock;
1997
1998	msta_link = rcu_dereference(msta->link[link_id]);
1999	if (!msta_link)
2000		goto error_unlock;
2001
2002	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, mlink,
2003					      &msta_link->wcid,
2004					      MT7996_STA_UPDATE_MAX_SIZE);
2005	if (IS_ERR(skb)) {
2006		err = PTR_ERR(skb);
2007		goto error_unlock;
2008	}
2009
2010	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
2011	ra = (struct sta_rec_ra_fixed_uni *)tlv;
2012
2013	switch (field) {
2014	case RATE_PARAM_AUTO:
2015		break;
2016	case RATE_PARAM_FIXED:
2017	case RATE_PARAM_FIXED_MCS:
2018	case RATE_PARAM_FIXED_GI:
2019	case RATE_PARAM_FIXED_HE_LTF:
2020		if (phy)
2021			ra->phy = *phy;
2022		break;
2023	case RATE_PARAM_MMPS_UPDATE: {
2024		struct ieee80211_sta *sta = wcid_to_sta(&msta_link->wcid);
2025		struct ieee80211_link_sta *link_sta;
2026
2027		link_sta = rcu_dereference(sta->link[link_id]);
2028		if (!link_sta) {
2029			dev_kfree_skb(skb);
2030			goto error_unlock;
2031		}
2032
2033		ra->mmps_mode = mt7996_mcu_get_mmps_mode(link_sta->smps_mode);
2034		break;
2035	}
2036	default:
2037		break;
2038	}
2039	ra->field = cpu_to_le32(field);
2040
2041	rcu_read_unlock();
2042
2043	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2044				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
2045error_unlock:
2046	rcu_read_unlock();
2047
2048	return err;
2049}
2050
2051static int
2052mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct mt7996_sta *msta,
2053			       struct ieee80211_vif *vif, u8 link_id)
2054{
2055	struct ieee80211_link_sta *link_sta;
2056	struct cfg80211_bitrate_mask mask;
2057	struct mt7996_sta_link *msta_link;
2058	struct mt7996_vif_link *link;
2059	struct sta_phy_uni phy = {};
2060	struct ieee80211_sta *sta;
2061	int ret, nrates = 0, idx;
2062	enum nl80211_band band;
2063	bool has_he;
2064
2065#define __sta_phy_bitrate_mask_check(_mcs, _gi, _ht, _he)			\
2066	do {									\
2067		u8 i, gi = mask.control[band]._gi;				\
2068		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
2069		phy.sgi = gi;							\
2070		phy.he_ltf = mask.control[band].he_ltf;				\
2071		for (i = 0; i < ARRAY_SIZE(mask.control[band]._mcs); i++) {	\
2072			if (!mask.control[band]._mcs[i])			\
2073				continue;					\
2074			nrates += hweight16(mask.control[band]._mcs[i]);	\
2075			phy.mcs = ffs(mask.control[band]._mcs[i]) - 1;		\
2076			if (_ht)						\
2077				phy.mcs += 8 * i;				\
2078		}								\
2079	} while (0)
2080
2081	rcu_read_lock();
2082
2083	link = mt7996_vif_link(dev, vif, link_id);
2084	if (!link)
2085		goto error_unlock;
2086
2087	msta_link = rcu_dereference(msta->link[link_id]);
2088	if (!msta_link)
2089		goto error_unlock;
2090
2091	sta = wcid_to_sta(&msta_link->wcid);
2092	link_sta = rcu_dereference(sta->link[link_id]);
2093	if (!link_sta)
2094		goto error_unlock;
2095
2096	band = link->phy->mt76->chandef.chan->band;
2097	has_he = link_sta->he_cap.has_he;
2098	mask = link->bitrate_mask;
2099	idx = msta_link->wcid.idx;
2100
2101	if (has_he) {
2102		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
2103	} else if (link_sta->vht_cap.vht_supported) {
2104		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
2105	} else if (link_sta->ht_cap.ht_supported) {
2106		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
2107	} else {
2108		nrates = hweight32(mask.control[band].legacy);
2109		phy.mcs = ffs(mask.control[band].legacy) - 1;
2110	}
2111
2112	rcu_read_unlock();
2113
2114#undef __sta_phy_bitrate_mask_check
2115
2116	/* fall back to auto rate control */
2117	if (mask.control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
2118	    mask.control[band].he_gi == GENMASK(7, 0) &&
2119	    mask.control[band].he_ltf == GENMASK(7, 0) &&
2120	    nrates != 1)
2121		return 0;
2122
2123	/* fixed single rate */
2124	if (nrates == 1) {
2125		ret = mt7996_mcu_set_fixed_field(dev, msta, &phy, link_id,
2126						 RATE_PARAM_FIXED_MCS);
2127		if (ret)
2128			return ret;
2129	}
2130
2131	/* fixed GI */
2132	if (mask.control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
2133	    mask.control[band].he_gi != GENMASK(7, 0)) {
2134		u32 addr;
2135
2136		/* firmware updates only TXCMD but doesn't take WTBL into
2137		 * account, so driver should update here to reflect the
2138		 * actual txrate hardware sends out.
2139		 */
2140		addr = mt7996_mac_wtbl_lmac_addr(dev, idx, 7);
2141		if (has_he)
2142			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
2143		else
2144			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
2145
2146		ret = mt7996_mcu_set_fixed_field(dev, msta, &phy, link_id,
2147						 RATE_PARAM_FIXED_GI);
2148		if (ret)
2149			return ret;
2150	}
2151
2152	/* fixed HE_LTF */
2153	if (mask.control[band].he_ltf != GENMASK(7, 0)) {
2154		ret = mt7996_mcu_set_fixed_field(dev, msta, &phy, link_id,
2155						 RATE_PARAM_FIXED_HE_LTF);
2156		if (ret)
2157			return ret;
2158	}
2159
2160	return 0;
2161
2162error_unlock:
2163	rcu_read_unlock();
2164
2165	return -ENODEV;
2166}
2167
2168static void
2169mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
2170			     struct ieee80211_vif *vif,
2171			     struct ieee80211_bss_conf *link_conf,
2172			     struct ieee80211_link_sta *link_sta,
2173			     struct mt7996_vif_link *link)
2174{
2175#define INIT_RCPI 180
2176	struct mt76_phy *mphy = link->phy->mt76;
2177	struct cfg80211_chan_def *chandef = &mphy->chandef;
2178	struct cfg80211_bitrate_mask *mask = &link->bitrate_mask;
2179	u32 cap = link_sta->sta->wme ? STA_CAP_WMM : 0;
2180	enum nl80211_band band = chandef->chan->band;
2181	struct sta_rec_ra_uni *ra;
2182	struct tlv *tlv;
2183	u32 supp_rate = link_sta->supp_rates[band];
2184
2185	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
2186	ra = (struct sta_rec_ra_uni *)tlv;
2187
2188	ra->valid = true;
2189	ra->auto_rate = true;
2190	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, link_sta);
2191	ra->channel = chandef->chan->hw_value;
2192	ra->bw = (link_sta->bandwidth == IEEE80211_STA_RX_BW_320) ?
2193		 CMD_CBW_320MHZ : link_sta->bandwidth;
2194	ra->phy.bw = ra->bw;
2195	ra->mmps_mode = mt7996_mcu_get_mmps_mode(link_sta->smps_mode);
2196
2197	if (supp_rate) {
2198		supp_rate &= mask->control[band].legacy;
2199		ra->rate_len = hweight32(supp_rate);
2200
2201		if (band == NL80211_BAND_2GHZ) {
2202			ra->supp_mode = MODE_CCK;
2203			ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
2204
2205			if (ra->rate_len > 4) {
2206				ra->supp_mode |= MODE_OFDM;
2207				ra->supp_ofdm_rate = supp_rate >> 4;
2208			}
2209		} else {
2210			ra->supp_mode = MODE_OFDM;
2211			ra->supp_ofdm_rate = supp_rate;
2212		}
2213	}
2214
2215	if (link_sta->ht_cap.ht_supported) {
2216		ra->supp_mode |= MODE_HT;
2217		ra->af = link_sta->ht_cap.ampdu_factor;
2218		ra->ht_gf = !!(link_sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
2219
2220		cap |= STA_CAP_HT;
2221		if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
2222			cap |= STA_CAP_SGI_20;
2223		if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
2224			cap |= STA_CAP_SGI_40;
2225		if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
2226			cap |= STA_CAP_TX_STBC;
2227		if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
2228			cap |= STA_CAP_RX_STBC;
2229		if (link_conf->ht_ldpc &&
2230		    (link_sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
2231			cap |= STA_CAP_LDPC;
2232
2233		mt7996_mcu_set_sta_ht_mcs(link_sta, ra->ht_mcs,
2234					  mask->control[band].ht_mcs);
2235		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
2236	}
2237
2238	if (link_sta->vht_cap.vht_supported) {
2239		u8 af;
2240
2241		ra->supp_mode |= MODE_VHT;
2242		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
2243			       link_sta->vht_cap.cap);
2244		ra->af = max_t(u8, ra->af, af);
2245
2246		cap |= STA_CAP_VHT;
2247		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
2248			cap |= STA_CAP_VHT_SGI_80;
2249		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
2250			cap |= STA_CAP_VHT_SGI_160;
2251		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
2252			cap |= STA_CAP_VHT_TX_STBC;
2253		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
2254			cap |= STA_CAP_VHT_RX_STBC;
2255		if ((vif->type != NL80211_IFTYPE_AP || link_conf->vht_ldpc) &&
2256		    (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
2257			cap |= STA_CAP_VHT_LDPC;
2258
2259		mt7996_mcu_set_sta_vht_mcs(link_sta, ra->supp_vht_mcs,
2260					   mask->control[band].vht_mcs);
2261	}
2262
2263	if (link_sta->he_cap.has_he) {
2264		ra->supp_mode |= MODE_HE;
2265		cap |= STA_CAP_HE;
2266
2267		if (link_sta->he_6ghz_capa.capa)
2268			ra->af = le16_get_bits(link_sta->he_6ghz_capa.capa,
2269					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
2270	}
2271	ra->sta_cap = cpu_to_le32(cap);
2272
2273	memset(ra->rx_rcpi, INIT_RCPI, sizeof(ra->rx_rcpi));
2274}
2275
2276int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct mt7996_sta *msta,
2277			     struct ieee80211_vif *vif, u8 link_id,
2278			     bool changed)
2279{
2280	struct ieee80211_bss_conf *link_conf;
2281	struct ieee80211_link_sta *link_sta;
2282	struct mt7996_sta_link *msta_link;
2283	struct mt7996_vif_link *link;
2284	struct ieee80211_sta *sta;
2285	struct sk_buff *skb;
2286	int ret = -ENODEV;
2287
2288	rcu_read_lock();
2289
2290	link = mt7996_vif_link(dev, vif, link_id);
2291	if (!link)
2292		goto error_unlock;
2293
2294	msta_link = rcu_dereference(msta->link[link_id]);
2295	if (!msta_link)
2296		goto error_unlock;
2297
2298	sta = wcid_to_sta(&msta_link->wcid);
2299	link_sta = rcu_dereference(sta->link[link_id]);
2300	if (!link_sta)
2301		goto error_unlock;
2302
2303	link_conf = rcu_dereference(vif->link_conf[link_id]);
2304	if (!link_conf)
2305		goto error_unlock;
2306
2307	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &link->mt76,
2308					      &msta_link->wcid,
2309					      MT7996_STA_UPDATE_MAX_SIZE);
2310	if (IS_ERR(skb)) {
2311		ret = PTR_ERR(skb);
2312		goto error_unlock;
2313	}
2314
2315	/* firmware rc algorithm refers to sta_rec_he for HE control.
2316	 * once dev->rc_work changes the settings driver should also
2317	 * update sta_rec_he here.
2318	 */
2319	if (changed)
2320		mt7996_mcu_sta_he_tlv(skb, link_sta, link);
2321
2322	/* sta_rec_ra accommodates BW, NSS and only MCS range format
2323	 * i.e 0-{7,8,9} for VHT.
2324	 */
2325	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, vif, link_conf, link_sta, link);
2326
2327	rcu_read_unlock();
2328
2329	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
2330				    MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
2331	if (ret)
2332		return ret;
2333
2334	return mt7996_mcu_add_rate_ctrl_fixed(dev, msta, vif, link_id);
2335
2336error_unlock:
2337	rcu_read_unlock();
2338
2339	return ret;
2340}
2341
2342static int
2343mt7996_mcu_add_group(struct mt7996_dev *dev, struct mt7996_vif_link *link,
2344		     struct mt76_wcid *wcid)
2345{
2346#define MT_STA_BSS_GROUP		1
2347	struct {
2348		u8 __rsv1[4];
2349
2350		__le16 tag;
2351		__le16 len;
2352		__le16 wlan_idx;
2353		u8 __rsv2[2];
2354		__le32 action;
2355		__le32 val;
2356		u8 __rsv3[8];
2357	} __packed req = {
2358		.tag = cpu_to_le16(UNI_VOW_DRR_CTRL),
2359		.len = cpu_to_le16(sizeof(req) - 4),
2360		.action = cpu_to_le32(MT_STA_BSS_GROUP),
2361		.val = cpu_to_le32(link->mt76.idx % 16),
2362		.wlan_idx = cpu_to_le16(wcid->idx),
2363	};
2364
2365	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(VOW), &req,
2366				 sizeof(req), true);
2367}
2368
2369static void
2370mt7996_mcu_sta_mld_setup_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
2371			     struct ieee80211_vif *vif,
2372			     struct ieee80211_sta *sta)
2373{
2374	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
2375	unsigned int nlinks = hweight16(sta->valid_links);
2376	struct mld_setup_link *mld_setup_link;
2377	struct ieee80211_link_sta *link_sta;
2378	struct sta_rec_mld_setup *mld_setup;
2379	struct mt7996_sta_link *msta_link;
2380	unsigned int link_id;
2381	struct tlv *tlv;
2382
2383	msta_link = mt76_dereference(msta->link[msta->deflink_id], &dev->mt76);
2384	if (!msta_link)
2385		return;
2386
2387	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MLD,
2388				      sizeof(struct sta_rec_mld_setup) +
2389				      sizeof(struct mld_setup_link) * nlinks);
2390
2391	mld_setup = (struct sta_rec_mld_setup *)tlv;
2392	memcpy(mld_setup->mld_addr, sta->addr, ETH_ALEN);
2393	mld_setup->setup_wcid = cpu_to_le16(msta_link->wcid.idx);
2394	mld_setup->primary_id = cpu_to_le16(msta_link->wcid.idx);
2395
2396	if (nlinks > 1) {
2397		msta_link = mt76_dereference(msta->link[msta->seclink_id],
2398					     &dev->mt76);
2399		if (!msta_link)
2400			return;
2401	}
2402	mld_setup->seconed_id = cpu_to_le16(msta_link->wcid.idx);
2403	mld_setup->link_num = nlinks;
2404
2405	mld_setup_link = (struct mld_setup_link *)mld_setup->link_info;
2406	for_each_sta_active_link(vif, sta, link_sta, link_id) {
2407		struct mt7996_vif_link *link;
2408
2409		msta_link = mt76_dereference(msta->link[link_id], &dev->mt76);
2410		if (!msta_link)
2411			continue;
2412
2413		link = mt7996_vif_link(dev, vif, link_id);
2414		if (!link)
2415			continue;
2416
2417		mld_setup_link->wcid = cpu_to_le16(msta_link->wcid.idx);
2418		mld_setup_link->bss_idx = link->mt76.idx;
2419		mld_setup_link++;
2420	}
2421}
2422
2423static void
2424mt7996_mcu_sta_eht_mld_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
2425			   struct ieee80211_sta *sta)
2426{
2427	struct sta_rec_eht_mld *eht_mld;
2428	struct tlv *tlv;
2429	int i;
2430
2431	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT_MLD, sizeof(*eht_mld));
2432	eht_mld = (struct sta_rec_eht_mld *)tlv;
2433
2434	for (i = 0; i < ARRAY_SIZE(eht_mld->str_cap); i++)
2435		eht_mld->str_cap[i] = 0x7;
2436}
2437
2438int mt7996_mcu_add_sta(struct mt7996_dev *dev,
2439		       struct ieee80211_bss_conf *link_conf,
2440		       struct ieee80211_link_sta *link_sta,
2441		       struct mt7996_vif_link *link,
2442		       struct mt7996_sta_link *msta_link,
2443		       int conn_state, bool newly)
2444{
2445	struct mt76_wcid *wcid = msta_link ? &msta_link->wcid : link->mt76.wcid;
2446	struct ieee80211_sta *sta = link_sta ? link_sta->sta : NULL;
2447	struct sk_buff *skb;
2448	int ret;
2449
2450	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &link->mt76, wcid,
2451					      MT7996_STA_UPDATE_MAX_SIZE);
2452	if (IS_ERR(skb))
2453		return PTR_ERR(skb);
2454
2455	/* starec basic */
2456	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, link_conf, link_sta,
2457				      conn_state, newly);
2458
2459	if (conn_state == CONN_STATE_DISCONNECT)
2460		goto out;
2461
2462	/* starec hdr trans */
2463	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, link_conf->vif, wcid);
2464	/* starec tx proc */
2465	mt7996_mcu_sta_tx_proc_tlv(skb);
2466
2467	/* tag order is in accordance with firmware dependency. */
2468	if (link_sta) {
2469		/* starec hdrt mode */
2470		mt7996_mcu_sta_hdrt_tlv(dev, skb);
2471		if (conn_state == CONN_STATE_CONNECT) {
2472			/* starec bfer */
2473			mt7996_mcu_sta_bfer_tlv(dev, skb, link_conf, link_sta,
2474						link);
2475			/* starec bfee */
2476			mt7996_mcu_sta_bfee_tlv(dev, skb, link_conf, link_sta,
2477						link);
2478		}
2479		/* starec ht */
2480		mt7996_mcu_sta_ht_tlv(skb, link_sta);
2481		/* starec vht */
2482		mt7996_mcu_sta_vht_tlv(skb, link_sta);
2483		/* starec uapsd */
2484		mt76_connac_mcu_sta_uapsd(skb, link_conf->vif, sta);
2485		/* starec amsdu */
2486		mt7996_mcu_sta_amsdu_tlv(dev, skb, link_conf->vif, link_sta,
2487					 msta_link);
2488		/* starec he */
2489		mt7996_mcu_sta_he_tlv(skb, link_sta, link);
2490		/* starec he 6g*/
2491		mt7996_mcu_sta_he_6g_tlv(skb, link_sta);
2492		/* starec eht */
2493		mt7996_mcu_sta_eht_tlv(skb, link_sta);
2494		/* starec muru */
2495		mt7996_mcu_sta_muru_tlv(dev, skb, link_conf, link_sta);
2496
2497		if (sta->mlo) {
2498			mt7996_mcu_sta_mld_setup_tlv(dev, skb, link_conf->vif,
2499						     sta);
2500			mt7996_mcu_sta_eht_mld_tlv(dev, skb, sta);
2501		}
2502	}
2503
2504	ret = mt7996_mcu_add_group(dev, link, wcid);
2505	if (ret) {
2506		dev_kfree_skb(skb);
2507		return ret;
2508	}
2509out:
2510	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2511				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
2512}
2513
2514int mt7996_mcu_teardown_mld_sta(struct mt7996_dev *dev,
2515				struct mt7996_vif_link *link,
2516				struct mt7996_sta_link *msta_link)
2517{
2518	struct sk_buff *skb;
2519
2520	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &link->mt76,
2521					      &msta_link->wcid,
2522					      MT7996_STA_UPDATE_MAX_SIZE);
2523	if (IS_ERR(skb))
2524		return PTR_ERR(skb);
2525
2526	mt76_connac_mcu_add_tlv(skb, STA_REC_MLD_OFF, sizeof(struct tlv));
2527
2528	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2529				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
2530}
2531
2532static int
2533mt7996_mcu_sta_key_tlv(struct mt76_dev *dev, struct mt76_wcid *wcid,
2534		       struct sk_buff *skb,
2535		       struct ieee80211_key_conf *key,
2536		       enum set_key_cmd cmd)
2537{
2538	struct sta_rec_sec_uni *sec;
2539	struct sec_key_uni *sec_key;
2540	struct tlv *tlv;
2541	u8 cipher;
2542
2543	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
2544	sec = (struct sta_rec_sec_uni *)tlv;
2545	/* due to connac3 FW design, we only do remove key for BIGTK; even for
2546	 * removal, the field should be filled with SET_KEY
2547	 */
2548	sec->add = SET_KEY;
2549	sec->n_cipher = 1;
2550	sec_key = &sec->key[0];
2551	sec_key->wlan_idx = cpu_to_le16(wcid->idx);
2552	sec_key->key_id = key->keyidx;
2553
2554	if (cmd != SET_KEY)
2555		return 0;
2556
2557	cipher = mt76_connac_mcu_get_cipher(key->cipher);
2558	if (cipher == MCU_CIPHER_NONE)
2559		return -EOPNOTSUPP;
2560
2561	sec_key->mgmt_prot = 0;
2562	sec_key->cipher_id = cipher;
2563	sec_key->cipher_len = sizeof(*sec_key);
2564	sec_key->key_len = key->keylen;
2565	sec_key->need_resp = 0;
2566	memcpy(sec_key->key, key->key, key->keylen);
2567
2568	if (cipher == MCU_CIPHER_TKIP) {
2569		/* Rx/Tx MIC keys are swapped */
2570		memcpy(sec_key->key + 16, key->key + 24, 8);
2571		memcpy(sec_key->key + 24, key->key + 16, 8);
2572		return 0;
2573	}
2574
2575	if (sec_key->key_id != 6 && sec_key->key_id != 7)
2576		return 0;
2577
2578	switch (key->cipher) {
2579	case WLAN_CIPHER_SUITE_AES_CMAC:
2580		sec_key->cipher_id = MCU_CIPHER_BCN_PROT_CMAC_128;
2581		break;
2582	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
2583		sec_key->cipher_id = MCU_CIPHER_BCN_PROT_GMAC_128;
2584		break;
2585	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
2586		sec_key->cipher_id = MCU_CIPHER_BCN_PROT_GMAC_256;
2587		break;
2588	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
2589		if (!is_mt7990(dev))
2590			return -EOPNOTSUPP;
2591		sec_key->cipher_id = MCU_CIPHER_BCN_PROT_CMAC_256;
2592		break;
2593	default:
2594		return -EOPNOTSUPP;
2595	}
2596
2597	sec_key->bcn_mode = is_mt7990(dev) ? BP_HW_MODE : BP_SW_MODE;
2598
2599	return 0;
2600}
2601
2602int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_vif_link *link,
2603		       struct ieee80211_key_conf *key, int mcu_cmd,
2604		       struct mt76_wcid *wcid, enum set_key_cmd cmd)
2605{
2606	struct sk_buff *skb;
2607	int ret;
2608
2609	skb = __mt76_connac_mcu_alloc_sta_req(dev, (struct mt76_vif_link *)link,
2610					      wcid, MT7996_STA_UPDATE_MAX_SIZE);
2611	if (IS_ERR(skb))
2612		return PTR_ERR(skb);
2613
2614	ret = mt7996_mcu_sta_key_tlv(dev, wcid, skb, key, cmd);
2615	if (ret) {
2616		dev_kfree_skb(skb);
2617		return ret;
2618	}
2619
2620	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
2621}
2622
2623int mt7996_mcu_add_dev_info(struct mt7996_phy *phy, struct ieee80211_vif *vif,
2624			    struct ieee80211_bss_conf *link_conf,
2625			    struct mt76_vif_link *mlink, bool enable)
2626{
2627	struct mt7996_dev *dev = phy->dev;
2628	struct {
2629		struct req_hdr {
2630			u8 omac_idx;
2631			u8 band_idx;
2632			u8 __rsv[2];
2633		} __packed hdr;
2634		struct req_tlv {
2635			__le16 tag;
2636			__le16 len;
2637			u8 active;
2638			u8 __rsv;
2639			u8 omac_addr[ETH_ALEN];
2640		} __packed tlv;
2641	} data = {
2642		.hdr = {
2643			.omac_idx = mlink->omac_idx,
2644			.band_idx = mlink->band_idx,
2645		},
2646		.tlv = {
2647			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
2648			.len = cpu_to_le16(sizeof(struct req_tlv)),
2649			.active = enable,
2650		},
2651	};
2652
2653	if (mlink->omac_idx >= REPEATER_BSSID_START)
2654		return mt7996_mcu_muar_config(dev, mlink, link_conf->addr, false, enable);
2655
2656	memcpy(data.tlv.omac_addr, link_conf->addr, ETH_ALEN);
2657	return mt76_mcu_send_msg(&dev->mt76, MCU_WMWA_UNI_CMD(DEV_INFO_UPDATE),
2658				 &data, sizeof(data), true);
2659}
2660
2661static void
2662mt7996_mcu_beacon_cntdwn(struct sk_buff *rskb, struct sk_buff *skb,
2663			 struct ieee80211_mutable_offsets *offs,
2664			 bool csa)
2665{
2666	struct bss_bcn_cntdwn_tlv *info;
2667	struct tlv *tlv;
2668	u16 tag;
2669
2670	if (!offs->cntdwn_counter_offs[0])
2671		return;
2672
2673	tag = csa ? UNI_BSS_INFO_BCN_CSA : UNI_BSS_INFO_BCN_BCC;
2674
2675	tlv = mt7996_mcu_add_uni_tlv(rskb, tag, sizeof(*info));
2676
2677	info = (struct bss_bcn_cntdwn_tlv *)tlv;
2678	info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
2679}
2680
2681static void
2682mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
2683		       struct bss_bcn_content_tlv *bcn,
2684		       struct ieee80211_mutable_offsets *offs)
2685{
2686	struct bss_bcn_mbss_tlv *mbss;
2687	const struct element *elem;
2688	struct tlv *tlv;
2689
2690	tlv = mt7996_mcu_add_uni_tlv(rskb, UNI_BSS_INFO_BCN_MBSSID, sizeof(*mbss));
2691
2692	mbss = (struct bss_bcn_mbss_tlv *)tlv;
2693	mbss->offset[0] = cpu_to_le16(offs->tim_offset);
2694	mbss->bitmap = cpu_to_le32(1);
2695
2696	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
2697			    &skb->data[offs->mbssid_off],
2698			    skb->len - offs->mbssid_off) {
2699		const struct element *sub_elem;
2700
2701		if (elem->datalen < 2)
2702			continue;
2703
2704		for_each_element(sub_elem, elem->data + 1, elem->datalen - 1) {
2705			const struct ieee80211_bssid_index *idx;
2706			const u8 *idx_ie;
2707
2708			/* not a valid BSS profile */
2709			if (sub_elem->id || sub_elem->datalen < 4)
2710				continue;
2711
2712			/* Find WLAN_EID_MULTI_BSSID_IDX
2713			 * in the merged nontransmitted profile
2714			 */
2715			idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
2716						  sub_elem->data, sub_elem->datalen);
2717			if (!idx_ie || idx_ie[1] < sizeof(*idx))
2718				continue;
2719
2720			idx = (void *)(idx_ie + 2);
2721			if (!idx->bssid_index || idx->bssid_index > 31)
2722				continue;
2723
2724			mbss->offset[idx->bssid_index] = cpu_to_le16(idx_ie -
2725								     skb->data);
2726			mbss->bitmap |= cpu_to_le32(BIT(idx->bssid_index));
2727		}
2728	}
2729}
2730
2731static void
2732mt7996_mcu_beacon_cont(struct mt7996_dev *dev,
2733		       struct ieee80211_bss_conf *link_conf,
2734		       struct mt7996_vif_link *link,
2735		       struct sk_buff *rskb, struct sk_buff *skb,
2736		       struct bss_bcn_content_tlv *bcn,
2737		       struct ieee80211_mutable_offsets *offs)
2738{
2739	u8 *buf, keyidx = link->msta_link.wcid.hw_key_idx2;
2740	struct mt76_wcid *wcid;
2741
2742	if (is_mt7990(&dev->mt76) && (keyidx == 6 || keyidx == 7))
2743		wcid = &link->msta_link.wcid;
2744	else
2745		wcid = &dev->mt76.global_wcid;
2746
2747	bcn->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2748	bcn->tim_ie_pos = cpu_to_le16(offs->tim_offset);
2749
2750	if (offs->cntdwn_counter_offs[0]) {
2751		u16 offset = offs->cntdwn_counter_offs[0];
2752
2753		if (link_conf->csa_active)
2754			bcn->csa_ie_pos = cpu_to_le16(offset - 4);
2755		if (link_conf->color_change_active)
2756			bcn->bcc_ie_pos = cpu_to_le16(offset - 3);
2757	}
2758
2759	buf = (u8 *)bcn + sizeof(*bcn);
2760	mt7996_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, NULL, 0, 0,
2761			      BSS_CHANGED_BEACON);
2762
2763	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2764}
2765
2766int mt7996_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2767			  struct ieee80211_bss_conf *link_conf, bool enabled)
2768{
2769	struct mt7996_dev *dev = mt7996_hw_dev(hw);
2770	struct mt7996_vif_link *link = mt7996_vif_conf_link(dev, vif, link_conf);
2771	struct mt76_vif_link *mlink = link ? &link->mt76 : NULL;
2772	struct ieee80211_mutable_offsets offs;
2773	struct ieee80211_tx_info *info;
2774	struct sk_buff *skb, *rskb;
2775	struct tlv *tlv;
2776	struct bss_bcn_content_tlv *bcn;
2777	int len, extra_len = 0;
2778
2779	if (link_conf->nontransmitted)
2780		return 0;
2781
2782	if (!mlink)
2783		return -EINVAL;
2784
2785	if (link->phy && link->phy->mt76->offchannel)
2786		enabled = false;
2787
2788	rskb = __mt7996_mcu_alloc_bss_req(&dev->mt76, mlink,
2789					  MT7996_MAX_BSS_OFFLOAD_SIZE);
2790	if (IS_ERR(rskb))
2791		return PTR_ERR(rskb);
2792
2793	skb = ieee80211_beacon_get_template(hw, vif, &offs, link_conf->link_id);
2794	if (enabled && !skb) {
2795		dev_kfree_skb(rskb);
2796		return -EINVAL;
2797	}
2798
2799	if (skb) {
2800		if (skb->len > MT7996_MAX_BEACON_SIZE) {
2801			dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2802			dev_kfree_skb(rskb);
2803			dev_kfree_skb(skb);
2804			return -EINVAL;
2805		}
2806
2807		extra_len = skb->len;
2808	}
2809
2810	len = ALIGN(sizeof(*bcn) + MT_TXD_SIZE + extra_len, 4);
2811	tlv = mt7996_mcu_add_uni_tlv(rskb, UNI_BSS_INFO_BCN_CONTENT, len);
2812	bcn = (struct bss_bcn_content_tlv *)tlv;
2813	bcn->enable = enabled;
2814	if (!bcn->enable)
2815		goto out;
2816
2817	info = IEEE80211_SKB_CB(skb);
2818	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, mlink->band_idx);
2819
2820	mt7996_mcu_beacon_cont(dev, link_conf, link, rskb, skb, bcn, &offs);
2821	if (link_conf->bssid_indicator)
2822		mt7996_mcu_beacon_mbss(rskb, skb, bcn, &offs);
2823	mt7996_mcu_beacon_cntdwn(rskb, skb, &offs, link_conf->csa_active);
2824out:
2825	dev_kfree_skb(skb);
2826	return mt76_mcu_skb_send_msg(&dev->mt76, rskb,
2827				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
2828}
2829
2830int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
2831				    struct ieee80211_bss_conf *link_conf,
2832				    struct mt7996_vif_link *link, u32 changed)
2833{
2834#define OFFLOAD_TX_MODE_SU	BIT(0)
2835#define OFFLOAD_TX_MODE_MU	BIT(1)
2836	struct ieee80211_vif *vif = link_conf->vif;
2837	struct ieee80211_hw *hw = mt76_hw(dev);
2838	struct mt7996_phy *phy = link->phy;
2839	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
2840	struct bss_inband_discovery_tlv *discov;
2841	struct ieee80211_tx_info *info;
2842	struct sk_buff *rskb, *skb = NULL;
2843	struct cfg80211_chan_def *chandef;
2844	enum nl80211_band band;
2845	struct tlv *tlv;
2846	u8 *buf, interval;
2847	int len;
2848
2849	if (!phy)
2850		return -EINVAL;
2851
2852	chandef = &phy->mt76->chandef;
2853	band = chandef->chan->band;
2854
2855	if (link_conf->nontransmitted)
2856		return 0;
2857
2858	rskb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &link->mt76,
2859					  MT7996_MAX_BSS_OFFLOAD_SIZE);
2860	if (IS_ERR(rskb))
2861		return PTR_ERR(rskb);
2862
2863	if (changed & BSS_CHANGED_FILS_DISCOVERY &&
2864	    link_conf->fils_discovery.max_interval) {
2865		interval = link_conf->fils_discovery.max_interval;
2866		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
2867	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
2868		   link_conf->unsol_bcast_probe_resp_interval) {
2869		interval = link_conf->unsol_bcast_probe_resp_interval;
2870		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
2871	}
2872
2873	if (!skb) {
2874		dev_kfree_skb(rskb);
2875		return -EINVAL;
2876	}
2877
2878	if (skb->len > MT7996_MAX_BEACON_SIZE) {
2879		dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
2880		dev_kfree_skb(rskb);
2881		dev_kfree_skb(skb);
2882		return -EINVAL;
2883	}
2884
2885	info = IEEE80211_SKB_CB(skb);
2886	info->control.vif = vif;
2887	info->band = band;
2888	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, phy->mt76->band_idx);
2889
2890	len = ALIGN(sizeof(*discov) + MT_TXD_SIZE + skb->len, 4);
2891	tlv = mt7996_mcu_add_uni_tlv(rskb, UNI_BSS_INFO_OFFLOAD, len);
2892
2893	discov = (struct bss_inband_discovery_tlv *)tlv;
2894	discov->tx_mode = OFFLOAD_TX_MODE_SU;
2895	/* 0: UNSOL PROBE RESP, 1: FILS DISCOV */
2896	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
2897	discov->tx_interval = interval;
2898	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2899	discov->enable = true;
2900	discov->wcid = cpu_to_le16(MT7996_WTBL_RESERVED);
2901
2902	buf = (u8 *)tlv + sizeof(*discov);
2903
2904	mt7996_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, NULL, 0, 0, changed);
2905
2906	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2907
2908	dev_kfree_skb(skb);
2909
2910	return mt76_mcu_skb_send_msg(&dev->mt76, rskb,
2911				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
2912}
2913
2914static int mt7996_driver_own(struct mt7996_dev *dev, u8 band)
2915{
2916	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(band), MT_TOP_LPCR_HOST_DRV_OWN);
2917	if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND(band),
2918			    MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) {
2919		dev_err(dev->mt76.dev, "Timeout for driver own\n");
2920		return -EIO;
2921	}
2922
2923	/* clear irq when the driver own success */
2924	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND_IRQ_STAT(band),
2925		MT_TOP_LPCR_HOST_BAND_STAT);
2926
2927	return 0;
2928}
2929
2930static u32 mt7996_patch_sec_mode(u32 key_info)
2931{
2932	u32 sec = u32_get_bits(key_info, MT7996_PATCH_SEC), key = 0;
2933
2934	if (key_info == GENMASK(31, 0) || sec == MT7996_SEC_MODE_PLAIN)
2935		return 0;
2936
2937	if (sec == MT7996_SEC_MODE_AES)
2938		key = u32_get_bits(key_info, MT7996_PATCH_AES_KEY);
2939	else
2940		key = u32_get_bits(key_info, MT7996_PATCH_SCRAMBLE_KEY);
2941
2942	return MT7996_SEC_ENCRYPT | MT7996_SEC_IV |
2943	       u32_encode_bits(key, MT7996_SEC_KEY_IDX);
2944}
2945
2946static int mt7996_load_patch(struct mt7996_dev *dev)
2947{
2948	const struct mt7996_patch_hdr *hdr;
2949	const struct firmware *fw = NULL;
2950	int i, ret, sem;
2951
2952	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, 1);
2953	switch (sem) {
2954	case PATCH_IS_DL:
2955		return 0;
2956	case PATCH_NOT_DL_SEM_SUCCESS:
2957		break;
2958	default:
2959		dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2960		return -EAGAIN;
2961	}
2962
2963	ret = request_firmware(&fw, fw_name(dev, ROM_PATCH), dev->mt76.dev);
2964	if (ret)
2965		goto out;
2966
2967	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2968		dev_err(dev->mt76.dev, "Invalid firmware\n");
2969		ret = -EINVAL;
2970		goto out;
2971	}
2972
2973	hdr = (const struct mt7996_patch_hdr *)(fw->data);
2974
2975	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2976		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2977
2978	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2979		struct mt7996_patch_sec *sec;
2980		const u8 *dl;
2981		u32 len, addr, sec_key_idx, mode = DL_MODE_NEED_RSP;
2982
2983		sec = (struct mt7996_patch_sec *)(fw->data + sizeof(*hdr) +
2984						  i * sizeof(*sec));
2985		if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2986		    PATCH_SEC_TYPE_INFO) {
2987			ret = -EINVAL;
2988			goto out;
2989		}
2990
2991		addr = be32_to_cpu(sec->info.addr);
2992		len = be32_to_cpu(sec->info.len);
2993		sec_key_idx = be32_to_cpu(sec->info.sec_key_idx);
2994		dl = fw->data + be32_to_cpu(sec->offs);
2995
2996		mode |= mt7996_patch_sec_mode(sec_key_idx);
2997
2998		ret = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
2999						    mode);
3000		if (ret) {
3001			dev_err(dev->mt76.dev, "Download request failed\n");
3002			goto out;
3003		}
3004
3005		ret = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
3006					       dl, len, 4096);
3007		if (ret) {
3008			dev_err(dev->mt76.dev, "Failed to send patch\n");
3009			goto out;
3010		}
3011	}
3012
3013	ret = mt76_connac_mcu_start_patch(&dev->mt76);
3014	if (ret)
3015		dev_err(dev->mt76.dev, "Failed to start patch\n");
3016
3017out:
3018	sem = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, 0);
3019	switch (sem) {
3020	case PATCH_REL_SEM_SUCCESS:
3021		break;
3022	default:
3023		ret = -EAGAIN;
3024		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
3025		break;
3026	}
3027	release_firmware(fw);
3028
3029	return ret;
3030}
3031
3032static int
3033mt7996_mcu_send_ram_firmware(struct mt7996_dev *dev,
3034			     const struct mt7996_fw_trailer *hdr,
3035			     const u8 *data, enum mt7996_ram_type type)
3036{
3037	int i, offset = 0;
3038	u32 override = 0, option = 0;
3039
3040	for (i = 0; i < hdr->n_region; i++) {
3041		const struct mt7996_fw_region *region;
3042		int err;
3043		u32 len, addr, mode;
3044
3045		region = (const struct mt7996_fw_region *)((const u8 *)hdr -
3046			 (hdr->n_region - i) * sizeof(*region));
3047		/* DSP and WA use same mode */
3048		mode = mt76_connac_mcu_gen_dl_mode(&dev->mt76,
3049						   region->feature_set,
3050						   type != MT7996_RAM_TYPE_WM);
3051		len = le32_to_cpu(region->len);
3052		addr = le32_to_cpu(region->addr);
3053
3054		if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
3055			override = addr;
3056
3057		err = mt76_connac_mcu_init_download(&dev->mt76, addr, len,
3058						    mode);
3059		if (err) {
3060			dev_err(dev->mt76.dev, "Download request failed\n");
3061			return err;
3062		}
3063
3064		err = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
3065					       data + offset, len, 4096);
3066		if (err) {
3067			dev_err(dev->mt76.dev, "Failed to send firmware.\n");
3068			return err;
3069		}
3070
3071		offset += len;
3072	}
3073
3074	if (override)
3075		option |= FW_START_OVERRIDE;
3076
3077	if (type == MT7996_RAM_TYPE_WA)
3078		option |= FW_START_WORKING_PDA_CR4;
3079	else if (type == MT7996_RAM_TYPE_DSP)
3080		option |= FW_START_WORKING_PDA_DSP;
3081
3082	return mt76_connac_mcu_start_firmware(&dev->mt76, override, option);
3083}
3084
3085static int __mt7996_load_ram(struct mt7996_dev *dev, const char *fw_type,
3086			     const char *fw_file, enum mt7996_ram_type ram_type)
3087{
3088	const struct mt7996_fw_trailer *hdr;
3089	const struct firmware *fw;
3090	int ret;
3091
3092	ret = request_firmware(&fw, fw_file, dev->mt76.dev);
3093	if (ret)
3094		return ret;
3095
3096	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
3097		dev_err(dev->mt76.dev, "Invalid firmware\n");
3098		ret = -EINVAL;
3099		goto out;
3100	}
3101
3102	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
3103	dev_info(dev->mt76.dev, "%s Firmware Version: %.10s, Build Time: %.15s\n",
3104		 fw_type, hdr->fw_ver, hdr->build_date);
3105
3106	ret = mt7996_mcu_send_ram_firmware(dev, hdr, fw->data, ram_type);
3107	if (ret) {
3108		dev_err(dev->mt76.dev, "Failed to start %s firmware\n", fw_type);
3109		goto out;
3110	}
3111
3112	snprintf(dev->mt76.hw->wiphy->fw_version,
3113		 sizeof(dev->mt76.hw->wiphy->fw_version),
3114		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
3115
3116out:
3117	release_firmware(fw);
3118
3119	return ret;
3120}
3121
3122static int mt7996_load_ram(struct mt7996_dev *dev)
3123{
3124	int ret;
3125
3126	ret = __mt7996_load_ram(dev, "WM", fw_name(dev, FIRMWARE_WM),
3127				MT7996_RAM_TYPE_WM);
3128	if (ret)
3129		return ret;
3130
3131	if (!mt7996_has_wa(dev))
3132		return 0;
3133
3134	ret = __mt7996_load_ram(dev, "DSP", fw_name(dev, FIRMWARE_DSP),
3135				MT7996_RAM_TYPE_DSP);
3136	if (ret)
3137		return ret;
3138
3139	return __mt7996_load_ram(dev, "WA", fw_name(dev, FIRMWARE_WA),
3140				 MT7996_RAM_TYPE_WA);
3141}
3142
3143static int
3144mt7996_firmware_state(struct mt7996_dev *dev, u8 fw_state)
3145{
3146	u32 state = FIELD_PREP(MT_TOP_MISC_FW_STATE, fw_state);
3147
3148	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
3149			    state, 1000)) {
3150		dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
3151		return -EIO;
3152	}
3153	return 0;
3154}
3155
3156static int
3157mt7996_mcu_restart(struct mt76_dev *dev)
3158{
3159	struct {
3160		u8 __rsv1[4];
3161
3162		__le16 tag;
3163		__le16 len;
3164		u8 power_mode;
3165		u8 __rsv2[3];
3166	} __packed req = {
3167		.tag = cpu_to_le16(UNI_POWER_OFF),
3168		.len = cpu_to_le16(sizeof(req) - 4),
3169		.power_mode = 1,
3170	};
3171
3172	return mt76_mcu_send_msg(dev, MCU_WM_UNI_CMD(POWER_CTRL), &req,
3173				 sizeof(req), false);
3174}
3175
3176static int mt7996_load_firmware(struct mt7996_dev *dev)
3177{
3178	u8 fw_state;
3179	int ret;
3180
3181	/* make sure fw is download state */
3182	if (mt7996_firmware_state(dev, FW_STATE_FW_DOWNLOAD)) {
3183		/* restart firmware once */
3184		mt7996_mcu_restart(&dev->mt76);
3185		ret = mt7996_firmware_state(dev, FW_STATE_FW_DOWNLOAD);
3186		if (ret) {
3187			dev_err(dev->mt76.dev,
3188				"Firmware is not ready for download\n");
3189			return ret;
3190		}
3191	}
3192
3193	ret = mt7996_load_patch(dev);
3194	if (ret)
3195		return ret;
3196
3197	ret = mt7996_load_ram(dev);
3198	if (ret)
3199		return ret;
3200
3201	fw_state = mt7996_has_wa(dev) ? FW_STATE_RDY : FW_STATE_NORMAL_TRX;
3202	ret = mt7996_firmware_state(dev, fw_state);
3203	if (ret)
3204		return ret;
3205
3206	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
3207
3208	dev_dbg(dev->mt76.dev, "Firmware init done\n");
3209
3210	return 0;
3211}
3212
3213int mt7996_mcu_fw_log_2_host(struct mt7996_dev *dev, u8 type, u8 ctrl)
3214{
3215	struct {
3216		u8 _rsv[4];
3217
3218		__le16 tag;
3219		__le16 len;
3220		u8 ctrl;
3221		u8 interval;
3222		u8 _rsv2[2];
3223	} __packed data = {
3224		.tag = cpu_to_le16(UNI_WSYS_CONFIG_FW_LOG_CTRL),
3225		.len = cpu_to_le16(sizeof(data) - 4),
3226		.ctrl = ctrl,
3227	};
3228
3229	if (type == MCU_FW_LOG_WA)
3230		return mt76_mcu_send_msg(&dev->mt76, MCU_WA_UNI_CMD(WSYS_CONFIG),
3231					 &data, sizeof(data), true);
3232
3233	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(WSYS_CONFIG), &data,
3234				 sizeof(data), true);
3235}
3236
3237int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level)
3238{
3239	struct {
3240		u8 _rsv[4];
3241
3242		__le16 tag;
3243		__le16 len;
3244		__le32 module_idx;
3245		u8 level;
3246		u8 _rsv2[3];
3247	} data = {
3248		.tag = cpu_to_le16(UNI_WSYS_CONFIG_FW_DBG_CTRL),
3249		.len = cpu_to_le16(sizeof(data) - 4),
3250		.module_idx = cpu_to_le32(module),
3251		.level = level,
3252	};
3253
3254	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(WSYS_CONFIG), &data,
3255				 sizeof(data), false);
3256}
3257
3258static int mt7996_mcu_set_mwds(struct mt7996_dev *dev, bool enabled)
3259{
3260	struct {
3261		u8 enable;
3262		u8 _rsv[3];
3263	} __packed req = {
3264		.enable = enabled
3265	};
3266
3267	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), &req,
3268				 sizeof(req), false);
3269}
3270
3271static void mt7996_add_rx_airtime_tlv(struct sk_buff *skb, u8 band_idx)
3272{
3273	struct vow_rx_airtime *req;
3274	struct tlv *tlv;
3275
3276	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_VOW_RX_AT_AIRTIME_CLR_EN, sizeof(*req));
3277	req = (struct vow_rx_airtime *)tlv;
3278	req->enable = true;
3279	req->band = band_idx;
3280
3281	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_VOW_RX_AT_AIRTIME_EN, sizeof(*req));
3282	req = (struct vow_rx_airtime *)tlv;
3283	req->enable = true;
3284	req->band = band_idx;
3285}
3286
3287static int
3288mt7996_mcu_init_rx_airtime(struct mt7996_dev *dev)
3289{
3290	struct uni_header hdr = {};
3291	struct sk_buff *skb;
3292	int len, num, i;
3293
3294	num = 2 + 2 * (mt7996_band_valid(dev, MT_BAND1) +
3295		       mt7996_band_valid(dev, MT_BAND2));
3296	len = sizeof(hdr) + num * sizeof(struct vow_rx_airtime);
3297	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
3298	if (!skb)
3299		return -ENOMEM;
3300
3301	skb_put_data(skb, &hdr, sizeof(hdr));
3302
3303	for (i = 0; i < __MT_MAX_BAND; i++) {
3304		if (mt7996_band_valid(dev, i))
3305			mt7996_add_rx_airtime_tlv(skb, i);
3306	}
3307
3308	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
3309				     MCU_WM_UNI_CMD(VOW), true);
3310}
3311
3312int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
3313{
3314	int ret;
3315
3316	/* force firmware operation mode into normal state,
3317	 * which should be set before firmware download stage.
3318	 */
3319	mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
3320
3321	ret = mt7996_driver_own(dev, 0);
3322	if (ret)
3323		return ret;
3324	/* set driver own for band1 when two hif exist */
3325	if (dev->hif2) {
3326		ret = mt7996_driver_own(dev, 1);
3327		if (ret)
3328			return ret;
3329	}
3330
3331	ret = mt7996_load_firmware(dev);
3332	if (ret)
3333		return ret;
3334
3335	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
3336	ret = mt7996_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
3337	if (ret)
3338		return ret;
3339
3340	if (mt7996_has_wa(dev)) {
3341		ret = mt7996_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, 0);
3342		if (ret)
3343			return ret;
3344
3345		ret = mt7996_mcu_set_mwds(dev, 1);
3346		if (ret)
3347			return ret;
3348	}
3349
3350	ret = mt7996_mcu_init_rx_airtime(dev);
3351	if (ret)
3352		return ret;
3353
3354	return mt7996_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
3355				 MCU_WA_PARAM_RED, 0, 0);
3356}
3357
3358int mt7996_mcu_init(struct mt7996_dev *dev)
3359{
3360	static const struct mt76_mcu_ops mt7996_mcu_ops = {
3361		.headroom = sizeof(struct mt76_connac2_mcu_txd), /* reuse */
3362		.mcu_skb_send_msg = mt7996_mcu_send_message,
3363		.mcu_parse_response = mt7996_mcu_parse_response,
3364	};
3365
3366	dev->mt76.mcu_ops = &mt7996_mcu_ops;
3367
3368	return mt7996_mcu_init_firmware(dev);
3369}
3370
3371void mt7996_mcu_exit(struct mt7996_dev *dev)
3372{
3373	mt7996_mcu_restart(&dev->mt76);
3374	if (mt7996_firmware_state(dev, FW_STATE_FW_DOWNLOAD)) {
3375		dev_err(dev->mt76.dev, "Failed to exit mcu\n");
3376		goto out;
3377	}
3378
3379	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
3380	if (dev->hif2)
3381		mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
3382			MT_TOP_LPCR_HOST_FW_OWN);
3383out:
3384	skb_queue_purge(&dev->mt76.mcu.res_q);
3385}
3386
3387int mt7996_mcu_set_hdr_trans(struct mt7996_dev *dev, bool hdr_trans)
3388{
3389	struct {
3390		u8 __rsv[4];
3391	} __packed hdr = {};
3392	struct hdr_trans_blacklist *req_blacklist;
3393	struct hdr_trans_en *req_en;
3394	struct sk_buff *skb;
3395	struct tlv *tlv;
3396	int len = MT7996_HDR_TRANS_MAX_SIZE + sizeof(hdr);
3397
3398	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
3399	if (!skb)
3400		return -ENOMEM;
3401
3402	skb_put_data(skb, &hdr, sizeof(hdr));
3403
3404	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_HDR_TRANS_EN, sizeof(*req_en));
3405	req_en = (struct hdr_trans_en *)tlv;
3406	req_en->enable = hdr_trans;
3407
3408	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_HDR_TRANS_VLAN,
3409				     sizeof(struct hdr_trans_vlan));
3410
3411	if (hdr_trans) {
3412		tlv = mt7996_mcu_add_uni_tlv(skb, UNI_HDR_TRANS_BLACKLIST,
3413					     sizeof(*req_blacklist));
3414		req_blacklist = (struct hdr_trans_blacklist *)tlv;
3415		req_blacklist->enable = 1;
3416		req_blacklist->type = cpu_to_le16(ETH_P_PAE);
3417	}
3418
3419	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
3420				     MCU_WM_UNI_CMD(RX_HDR_TRANS), true);
3421}
3422
3423int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif,
3424		      struct ieee80211_bss_conf *link_conf)
3425{
3426#define MCU_EDCA_AC_PARAM	0
3427#define WMM_AIFS_SET		BIT(0)
3428#define WMM_CW_MIN_SET		BIT(1)
3429#define WMM_CW_MAX_SET		BIT(2)
3430#define WMM_TXOP_SET		BIT(3)
3431#define WMM_PARAM_SET		(WMM_AIFS_SET | WMM_CW_MIN_SET | \
3432				 WMM_CW_MAX_SET | WMM_TXOP_SET)
3433	struct mt7996_vif_link *link = mt7996_vif_conf_link(dev, vif, link_conf);
3434	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
3435	unsigned int link_id = link_conf->link_id;
3436	struct mt7996_vif_link_info *link_info = &mvif->link_info[link_id];
3437	struct {
3438		u8 bss_idx;
3439		u8 __rsv[3];
3440	} __packed hdr = {
3441		.bss_idx = link->mt76.idx,
3442	};
3443	struct sk_buff *skb;
3444	int len = sizeof(hdr) + IEEE80211_NUM_ACS * sizeof(struct edca);
3445	int ac;
3446
3447	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
3448	if (!skb)
3449		return -ENOMEM;
3450
3451	skb_put_data(skb, &hdr, sizeof(hdr));
3452
3453	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
3454		struct ieee80211_tx_queue_params *q = &link_info->queue_params[ac];
3455		struct edca *e;
3456		struct tlv *tlv;
3457
3458		tlv = mt7996_mcu_add_uni_tlv(skb, MCU_EDCA_AC_PARAM, sizeof(*e));
3459
3460		e = (struct edca *)tlv;
3461		e->set = WMM_PARAM_SET;
3462		e->queue = ac;
3463		e->aifs = q->aifs;
3464		e->txop = cpu_to_le16(q->txop);
3465
3466		if (q->cw_min)
3467			e->cw_min = fls(q->cw_min);
3468		else
3469			e->cw_min = 5;
3470
3471		if (q->cw_max)
3472			e->cw_max = fls(q->cw_max);
3473		else
3474			e->cw_max = 10;
3475	}
3476
3477	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
3478				     MCU_WM_UNI_CMD(EDCA_UPDATE), true);
3479}
3480
3481int mt7996_mcu_set_fcc5_lpn(struct mt7996_dev *dev, int val)
3482{
3483	struct {
3484		u8 _rsv[4];
3485
3486		__le16 tag;
3487		__le16 len;
3488
3489		__le32 ctrl;
3490		__le16 min_lpn;
3491		u8 rsv[2];
3492	} __packed req = {
3493		.tag = cpu_to_le16(UNI_RDD_CTRL_SET_TH),
3494		.len = cpu_to_le16(sizeof(req) - 4),
3495
3496		.ctrl = cpu_to_le32(0x1),
3497		.min_lpn = cpu_to_le16(val),
3498	};
3499
3500	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(RDD_CTRL),
3501				 &req, sizeof(req), true);
3502}
3503
3504int mt7996_mcu_set_pulse_th(struct mt7996_dev *dev,
3505			    const struct mt7996_dfs_pulse *pulse)
3506{
3507	struct {
3508		u8 _rsv[4];
3509
3510		__le16 tag;
3511		__le16 len;
3512
3513		__le32 ctrl;
3514
3515		__le32 max_width;		/* us */
3516		__le32 max_pwr;			/* dbm */
3517		__le32 min_pwr;			/* dbm */
3518		__le32 min_stgr_pri;		/* us */
3519		__le32 max_stgr_pri;		/* us */
3520		__le32 min_cr_pri;		/* us */
3521		__le32 max_cr_pri;		/* us */
3522	} __packed req = {
3523		.tag = cpu_to_le16(UNI_RDD_CTRL_SET_TH),
3524		.len = cpu_to_le16(sizeof(req) - 4),
3525
3526		.ctrl = cpu_to_le32(0x3),
3527
3528#define __req_field(field) .field = cpu_to_le32(pulse->field)
3529		__req_field(max_width),
3530		__req_field(max_pwr),
3531		__req_field(min_pwr),
3532		__req_field(min_stgr_pri),
3533		__req_field(max_stgr_pri),
3534		__req_field(min_cr_pri),
3535		__req_field(max_cr_pri),
3536#undef __req_field
3537	};
3538
3539	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(RDD_CTRL),
3540				 &req, sizeof(req), true);
3541}
3542
3543int mt7996_mcu_set_radar_th(struct mt7996_dev *dev, int index,
3544			    const struct mt7996_dfs_pattern *pattern)
3545{
3546	struct {
3547		u8 _rsv[4];
3548
3549		__le16 tag;
3550		__le16 len;
3551
3552		__le32 ctrl;
3553		__le16 radar_type;
3554
3555		u8 enb;
3556		u8 stgr;
3557		u8 min_crpn;
3558		u8 max_crpn;
3559		u8 min_crpr;
3560		u8 min_pw;
3561		__le32 min_pri;
3562		__le32 max_pri;
3563		u8 max_pw;
3564		u8 min_crbn;
3565		u8 max_crbn;
3566		u8 min_stgpn;
3567		u8 max_stgpn;
3568		u8 min_stgpr;
3569		u8 rsv[2];
3570		__le32 min_stgpr_diff;
3571	} __packed req = {
3572		.tag = cpu_to_le16(UNI_RDD_CTRL_SET_TH),
3573		.len = cpu_to_le16(sizeof(req) - 4),
3574
3575		.ctrl = cpu_to_le32(0x2),
3576		.radar_type = cpu_to_le16(index),
3577
3578#define __req_field_u8(field) .field = pattern->field
3579#define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
3580		__req_field_u8(enb),
3581		__req_field_u8(stgr),
3582		__req_field_u8(min_crpn),
3583		__req_field_u8(max_crpn),
3584		__req_field_u8(min_crpr),
3585		__req_field_u8(min_pw),
3586		__req_field_u32(min_pri),
3587		__req_field_u32(max_pri),
3588		__req_field_u8(max_pw),
3589		__req_field_u8(min_crbn),
3590		__req_field_u8(max_crbn),
3591		__req_field_u8(min_stgpn),
3592		__req_field_u8(max_stgpn),
3593		__req_field_u8(min_stgpr),
3594		__req_field_u32(min_stgpr_diff),
3595#undef __req_field_u8
3596#undef __req_field_u32
3597	};
3598
3599	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(RDD_CTRL),
3600				 &req, sizeof(req), true);
3601}
3602
3603static int
3604mt7996_mcu_background_chain_ctrl(struct mt7996_phy *phy,
3605				 struct cfg80211_chan_def *chandef,
3606				 int cmd)
3607{
3608	struct mt7996_dev *dev = phy->dev;
3609	struct mt76_phy *mphy = phy->mt76;
3610	struct ieee80211_channel *chan = mphy->chandef.chan;
3611	int freq = mphy->chandef.center_freq1;
3612	struct mt7996_mcu_background_chain_ctrl req = {
3613		.tag = cpu_to_le16(0),
3614		.len = cpu_to_le16(sizeof(req) - 4),
3615		.monitor_scan_type = 2, /* simple rx */
3616	};
3617
3618	if (!chandef && cmd != CH_SWITCH_BACKGROUND_SCAN_STOP)
3619		return -EINVAL;
3620
3621	if (!cfg80211_chandef_valid(&mphy->chandef))
3622		return -EINVAL;
3623
3624	switch (cmd) {
3625	case CH_SWITCH_BACKGROUND_SCAN_START: {
3626		req.chan = chan->hw_value;
3627		req.central_chan = ieee80211_frequency_to_channel(freq);
3628		req.bw = mt76_connac_chan_bw(&mphy->chandef);
3629		req.monitor_chan = chandef->chan->hw_value;
3630		req.monitor_central_chan =
3631			ieee80211_frequency_to_channel(chandef->center_freq1);
3632		req.monitor_bw = mt76_connac_chan_bw(chandef);
3633		req.band_idx = phy->mt76->band_idx;
3634		req.scan_mode = 1;
3635		break;
3636	}
3637	case CH_SWITCH_BACKGROUND_SCAN_RUNNING:
3638		req.monitor_chan = chandef->chan->hw_value;
3639		req.monitor_central_chan =
3640			ieee80211_frequency_to_channel(chandef->center_freq1);
3641		req.band_idx = phy->mt76->band_idx;
3642		req.scan_mode = 2;
3643		break;
3644	case CH_SWITCH_BACKGROUND_SCAN_STOP:
3645		req.chan = chan->hw_value;
3646		req.central_chan = ieee80211_frequency_to_channel(freq);
3647		req.bw = mt76_connac_chan_bw(&mphy->chandef);
3648		req.tx_stream = hweight8(mphy->antenna_mask);
3649		req.rx_stream = mphy->antenna_mask;
3650		break;
3651	default:
3652		return -EINVAL;
3653	}
3654	req.band = chandef ? chandef->chan->band == NL80211_BAND_5GHZ : 1;
3655
3656	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(OFFCH_SCAN_CTRL),
3657				 &req, sizeof(req), false);
3658}
3659
3660int mt7996_mcu_rdd_background_enable(struct mt7996_phy *phy,
3661				     struct cfg80211_chan_def *chandef)
3662{
3663	struct mt7996_dev *dev = phy->dev;
3664	int err, region, rdd_idx = mt7996_get_rdd_idx(phy, true);
3665
3666	if (!chandef) { /* disable offchain */
3667		err = mt7996_mcu_rdd_cmd(dev, RDD_STOP, rdd_idx, 0);
3668		if (err)
3669			return err;
3670
3671		return mt7996_mcu_background_chain_ctrl(phy, NULL,
3672				CH_SWITCH_BACKGROUND_SCAN_STOP);
3673	}
3674
3675	err = mt7996_mcu_background_chain_ctrl(phy, chandef,
3676					       CH_SWITCH_BACKGROUND_SCAN_START);
3677	if (err)
3678		return err;
3679
3680	switch (dev->mt76.region) {
3681	case NL80211_DFS_ETSI:
3682		region = 0;
3683		break;
3684	case NL80211_DFS_JP:
3685		region = 2;
3686		break;
3687	case NL80211_DFS_FCC:
3688	default:
3689		region = 1;
3690		break;
3691	}
3692
3693	return mt7996_mcu_rdd_cmd(dev, RDD_START, rdd_idx, region);
3694}
3695
3696int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
3697{
3698	static const u8 ch_band[] = {
3699		[NL80211_BAND_2GHZ] = 0,
3700		[NL80211_BAND_5GHZ] = 1,
3701		[NL80211_BAND_6GHZ] = 2,
3702	};
3703	struct mt7996_dev *dev = phy->dev;
3704	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3705	int freq1 = chandef->center_freq1;
3706	u8 band_idx = phy->mt76->band_idx;
3707	struct {
3708		/* fixed field */
3709		u8 __rsv[4];
3710
3711		__le16 tag;
3712		__le16 len;
3713		u8 control_ch;
3714		u8 center_ch;
3715		u8 bw;
3716		u8 tx_path_num;
3717		u8 rx_path;	/* mask or num */
3718		u8 switch_reason;
3719		u8 band_idx;
3720		u8 center_ch2;	/* for 80+80 only */
3721		__le16 cac_case;
3722		u8 channel_band;
3723		u8 rsv0;
3724		__le32 outband_freq;
3725		u8 txpower_drop;
3726		u8 ap_bw;
3727		u8 ap_center_ch;
3728		u8 rsv1[53];
3729	} __packed req = {
3730		.tag = cpu_to_le16(tag),
3731		.len = cpu_to_le16(sizeof(req) - 4),
3732		.control_ch = chandef->chan->hw_value,
3733		.center_ch = ieee80211_frequency_to_channel(freq1),
3734		.bw = mt76_connac_chan_bw(chandef),
3735		.tx_path_num = hweight16(phy->mt76->chainmask),
3736		.rx_path = mt7996_rx_chainmask(phy) >> dev->chainshift[band_idx],
3737		.band_idx = band_idx,
3738		.channel_band = ch_band[chandef->chan->band],
3739	};
3740
3741	if (phy->mt76->hw->conf.flags & IEEE80211_CONF_MONITOR)
3742		req.switch_reason = CH_SWITCH_NORMAL;
3743	else if (phy->mt76->offchannel ||
3744		 phy->mt76->hw->conf.flags & IEEE80211_CONF_IDLE)
3745		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
3746	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
3747					  NL80211_IFTYPE_AP))
3748		req.switch_reason = CH_SWITCH_DFS;
3749	else
3750		req.switch_reason = CH_SWITCH_NORMAL;
3751
3752	if (tag == UNI_CHANNEL_SWITCH)
3753		req.rx_path = hweight8(req.rx_path);
3754
3755	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
3756		int freq2 = chandef->center_freq2;
3757
3758		req.center_ch2 = ieee80211_frequency_to_channel(freq2);
3759	}
3760
3761	return mt76_mcu_send_msg(&dev->mt76, MCU_WMWA_UNI_CMD(CHANNEL_SWITCH),
3762				 &req, sizeof(req), true);
3763}
3764
3765static int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
3766{
3767#define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
3768#define PAGE_IDX_MASK		GENMASK(4, 2)
3769#define PER_PAGE_SIZE		0x400
3770	struct mt7996_mcu_eeprom req = {
3771		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
3772		.buffer_mode = EE_MODE_BUFFER
3773	};
3774	u16 eeprom_size = MT7996_EEPROM_SIZE;
3775	u8 total = DIV_ROUND_UP(eeprom_size, PER_PAGE_SIZE);
3776	u8 *eep = (u8 *)dev->mt76.eeprom.data;
3777	int eep_len, i;
3778
3779	for (i = 0; i < total; i++, eep += eep_len) {
3780		struct sk_buff *skb;
3781		int ret, msg_len;
3782
3783		if (i == total - 1 && !!(eeprom_size % PER_PAGE_SIZE))
3784			eep_len = eeprom_size % PER_PAGE_SIZE;
3785		else
3786			eep_len = PER_PAGE_SIZE;
3787
3788		msg_len = sizeof(req) + eep_len;
3789		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, msg_len);
3790		if (!skb)
3791			return -ENOMEM;
3792
3793		req.len = cpu_to_le16(msg_len - 4);
3794		req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
3795			     FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
3796		req.buf_len = cpu_to_le16(eep_len);
3797
3798		skb_put_data(skb, &req, sizeof(req));
3799		skb_put_data(skb, eep, eep_len);
3800
3801		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3802					    MCU_WM_UNI_CMD(EFUSE_CTRL), true);
3803		if (ret)
3804			return ret;
3805	}
3806
3807	return 0;
3808}
3809
3810int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
3811{
3812	struct mt7996_mcu_eeprom req = {
3813		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
3814		.len = cpu_to_le16(sizeof(req) - 4),
3815		.buffer_mode = EE_MODE_EFUSE,
3816		.format = EE_FORMAT_WHOLE
3817	};
3818
3819	if (dev->flash_mode)
3820		return mt7996_mcu_set_eeprom_flash(dev);
3821
3822	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(EFUSE_CTRL),
3823				 &req, sizeof(req), true);
3824}
3825
3826int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len)
3827{
3828	struct {
3829		u8 _rsv[4];
3830
3831		__le16 tag;
3832		__le16 len;
3833		__le32 addr;
3834		__le32 valid;
3835		u8 data[16];
3836	} __packed req = {
3837		.tag = cpu_to_le16(UNI_EFUSE_ACCESS),
3838		.len = cpu_to_le16(sizeof(req) - 4),
3839		.addr = cpu_to_le32(round_down(offset,
3840				    MT7996_EEPROM_BLOCK_SIZE)),
3841	};
3842	struct sk_buff *skb;
3843	bool valid;
3844	int ret;
3845
3846	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3847					MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL),
3848					&req, sizeof(req), true, &skb);
3849	if (ret)
3850		return ret;
3851
3852	valid = le32_to_cpu(*(__le32 *)(skb->data + 16));
3853	if (valid) {
3854		u32 addr = le32_to_cpu(*(__le32 *)(skb->data + 12));
3855
3856		if (!buf)
3857			buf = (u8 *)dev->mt76.eeprom.data + addr;
3858		if (!buf_len || buf_len > MT7996_EEPROM_BLOCK_SIZE)
3859			buf_len = MT7996_EEPROM_BLOCK_SIZE;
3860
3861		skb_pull(skb, 48);
3862		memcpy(buf, skb->data, buf_len);
3863	} else {
3864		ret = -EINVAL;
3865	}
3866
3867	dev_kfree_skb(skb);
3868
3869	return ret;
3870}
3871
3872int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num)
3873{
3874	struct {
3875		u8 _rsv[4];
3876
3877		__le16 tag;
3878		__le16 len;
3879		u8 num;
3880		u8 version;
3881		u8 die_idx;
3882		u8 _rsv2;
3883	} __packed req = {
3884		.tag = cpu_to_le16(UNI_EFUSE_FREE_BLOCK),
3885		.len = cpu_to_le16(sizeof(req) - 4),
3886		.version = 2,
3887	};
3888	struct sk_buff *skb;
3889	int ret;
3890
3891	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL), &req,
3892					sizeof(req), true, &skb);
3893	if (ret)
3894		return ret;
3895
3896	*block_num = *(u8 *)(skb->data + 8);
3897	dev_kfree_skb(skb);
3898
3899	return 0;
3900}
3901
3902int mt7996_mcu_get_chip_config(struct mt7996_dev *dev, u32 *cap)
3903{
3904#define NIC_CAP	3
3905#define UNI_EVENT_CHIP_CONFIG_EFUSE_VERSION	0x21
3906	struct {
3907		u8 _rsv[4];
3908
3909		__le16 tag;
3910		__le16 len;
3911	} __packed req = {
3912		.tag = cpu_to_le16(NIC_CAP),
3913		.len = cpu_to_le16(sizeof(req) - 4),
3914	};
3915	struct sk_buff *skb;
3916	u8 *buf;
3917	int ret;
3918
3919	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3920					MCU_WM_UNI_CMD_QUERY(CHIP_CONFIG), &req,
3921					sizeof(req), true, &skb);
3922	if (ret)
3923		return ret;
3924
3925	/* fixed field */
3926	skb_pull(skb, 4);
3927
3928	buf = skb->data;
3929	while (buf - skb->data < skb->len) {
3930		struct tlv *tlv = (struct tlv *)buf;
3931
3932		switch (le16_to_cpu(tlv->tag)) {
3933		case UNI_EVENT_CHIP_CONFIG_EFUSE_VERSION:
3934			*cap = le32_to_cpu(*(__le32 *)(buf + sizeof(*tlv)));
3935			break;
3936		default:
3937			break;
3938		}
3939
3940		buf += le16_to_cpu(tlv->len);
3941	}
3942
3943	dev_kfree_skb(skb);
3944
3945	return 0;
3946}
3947
3948int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch)
3949{
3950	enum {
3951		IDX_TX_TIME,
3952		IDX_RX_TIME,
3953		IDX_OBSS_AIRTIME,
3954		IDX_NON_WIFI_TIME,
3955		IDX_NUM
3956	};
3957	struct {
3958		struct {
3959			u8 band;
3960			u8 __rsv[3];
3961		} hdr;
3962		struct {
3963			__le16 tag;
3964			__le16 len;
3965			__le32 offs;
3966		} data[IDX_NUM];
3967	} __packed req = {
3968		.hdr.band = phy->mt76->band_idx,
3969	};
3970	static const u32 offs[] = {
3971		[IDX_TX_TIME] = UNI_MIB_TX_TIME,
3972		[IDX_RX_TIME] = UNI_MIB_RX_TIME,
3973		[IDX_OBSS_AIRTIME] = UNI_MIB_OBSS_AIRTIME,
3974		[IDX_NON_WIFI_TIME] = UNI_MIB_NON_WIFI_TIME,
3975	};
3976	struct mt76_channel_state *state = phy->mt76->chan_state;
3977	struct mt76_channel_state *state_ts = &phy->state_ts;
3978	struct mt7996_dev *dev = phy->dev;
3979	struct mt7996_mcu_mib *res;
3980	struct sk_buff *skb;
3981	int i, ret;
3982
3983	for (i = 0; i < IDX_NUM; i++) {
3984		req.data[i].tag = cpu_to_le16(UNI_CMD_MIB_DATA);
3985		req.data[i].len = cpu_to_le16(sizeof(req.data[i]));
3986		req.data[i].offs = cpu_to_le32(offs[i]);
3987	}
3988
3989	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WM_UNI_CMD_QUERY(GET_MIB_INFO),
3990					&req, sizeof(req), true, &skb);
3991	if (ret)
3992		return ret;
3993
3994	skb_pull(skb, sizeof(req.hdr));
3995
3996	res = (struct mt7996_mcu_mib *)(skb->data);
3997
3998	if (chan_switch)
3999		goto out;
4000
4001#define __res_u64(s) le64_to_cpu(res[s].data)
4002	state->cc_tx += __res_u64(IDX_TX_TIME) - state_ts->cc_tx;
4003	state->cc_bss_rx += __res_u64(IDX_RX_TIME) - state_ts->cc_bss_rx;
4004	state->cc_rx += __res_u64(IDX_RX_TIME) +
4005			__res_u64(IDX_OBSS_AIRTIME) -
4006			state_ts->cc_rx;
4007	state->cc_busy += __res_u64(IDX_TX_TIME) +
4008			  __res_u64(IDX_RX_TIME) +
4009			  __res_u64(IDX_OBSS_AIRTIME) +
4010			  __res_u64(IDX_NON_WIFI_TIME) -
4011			  state_ts->cc_busy;
4012out:
4013	state_ts->cc_tx = __res_u64(IDX_TX_TIME);
4014	state_ts->cc_bss_rx = __res_u64(IDX_RX_TIME);
4015	state_ts->cc_rx = __res_u64(IDX_RX_TIME) + __res_u64(IDX_OBSS_AIRTIME);
4016	state_ts->cc_busy = __res_u64(IDX_TX_TIME) +
4017			    __res_u64(IDX_RX_TIME) +
4018			    __res_u64(IDX_OBSS_AIRTIME) +
4019			    __res_u64(IDX_NON_WIFI_TIME);
4020#undef __res_u64
4021
4022	dev_kfree_skb(skb);
4023
4024	return 0;
4025}
4026
4027int mt7996_mcu_get_temperature(struct mt7996_phy *phy)
4028{
4029#define TEMPERATURE_QUERY 0
4030#define GET_TEMPERATURE 0
4031	struct {
4032		u8 _rsv[4];
4033
4034		__le16 tag;
4035		__le16 len;
4036
4037		u8 rsv1;
4038		u8 action;
4039		u8 band_idx;
4040		u8 rsv2;
4041	} req = {
4042		.tag = cpu_to_le16(TEMPERATURE_QUERY),
4043		.len = cpu_to_le16(sizeof(req) - 4),
4044		.action = GET_TEMPERATURE,
4045		.band_idx = phy->mt76->band_idx,
4046	};
4047	struct mt7996_mcu_thermal {
4048		u8 _rsv[4];
4049
4050		__le16 tag;
4051		__le16 len;
4052
4053		__le32 rsv;
4054		__le32 temperature;
4055	} __packed * res;
4056	struct sk_buff *skb;
4057	int ret;
4058	u32 temp;
4059
4060	ret = mt76_mcu_send_and_get_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(THERMAL),
4061					&req, sizeof(req), true, &skb);
4062	if (ret)
4063		return ret;
4064
4065	res = (void *)skb->data;
4066	temp = le32_to_cpu(res->temperature);
4067	dev_kfree_skb(skb);
4068
4069	return temp;
4070}
4071
4072int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state)
4073{
4074	struct {
4075		u8 _rsv[4];
4076
4077		__le16 tag;
4078		__le16 len;
4079
4080		struct mt7996_mcu_thermal_ctrl ctrl;
4081	} __packed req = {
4082		.tag = cpu_to_le16(UNI_CMD_THERMAL_PROTECT_DUTY_CONFIG),
4083		.len = cpu_to_le16(sizeof(req) - 4),
4084		.ctrl = {
4085			.band_idx = phy->mt76->band_idx,
4086		},
4087	};
4088	int level, ret;
4089
4090	/* set duty cycle and level */
4091	for (level = 0; level < 4; level++) {
4092		req.ctrl.duty.duty_level = level;
4093		req.ctrl.duty.duty_cycle = state;
4094		state /= 2;
4095
4096		ret = mt76_mcu_send_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(THERMAL),
4097					&req, sizeof(req), false);
4098		if (ret)
4099			return ret;
4100	}
4101
4102	return 0;
4103}
4104
4105int mt7996_mcu_set_thermal_protect(struct mt7996_phy *phy, bool enable)
4106{
4107#define SUSTAIN_PERIOD		10
4108	struct {
4109		u8 _rsv[4];
4110
4111		__le16 tag;
4112		__le16 len;
4113
4114		struct mt7996_mcu_thermal_ctrl ctrl;
4115		struct mt7996_mcu_thermal_enable enable;
4116	} __packed req = {
4117		.len = cpu_to_le16(sizeof(req) - 4 - sizeof(req.enable)),
4118		.ctrl = {
4119			.band_idx = phy->mt76->band_idx,
4120			.type.protect_type = 1,
4121			.type.trigger_type = 1,
4122		},
4123	};
4124	int ret;
4125
4126	req.tag = cpu_to_le16(UNI_CMD_THERMAL_PROTECT_DISABLE);
4127
4128	ret = mt76_mcu_send_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(THERMAL),
4129				&req, sizeof(req) - sizeof(req.enable), false);
4130	if (ret || !enable)
4131		return ret;
4132
4133	/* set high-temperature trigger threshold */
4134	req.tag = cpu_to_le16(UNI_CMD_THERMAL_PROTECT_ENABLE);
4135	req.enable.restore_temp = cpu_to_le32(phy->throttle_temp[0]);
4136	req.enable.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
4137	req.enable.sustain_time = cpu_to_le16(SUSTAIN_PERIOD);
4138
4139	req.len = cpu_to_le16(sizeof(req) - 4);
4140
4141	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(THERMAL),
4142				 &req, sizeof(req), false);
4143}
4144
4145int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 val, u8 band)
4146{
4147	struct {
4148		u8 rsv[4];
4149
4150		__le16 tag;
4151		__le16 len;
4152
4153		union {
4154			struct {
4155				__le32 mask;
4156			} __packed set;
4157
4158			struct {
4159				u8 method;
4160				u8 band;
4161				u8 rsv2[2];
4162			} __packed trigger;
4163		};
4164	} __packed req = {
4165		.tag = cpu_to_le16(action),
4166		.len = cpu_to_le16(sizeof(req) - 4),
4167	};
4168
4169	switch (action) {
4170	case UNI_CMD_SER_SET:
4171		req.set.mask = cpu_to_le32(val);
4172		break;
4173	case UNI_CMD_SER_TRIGGER:
4174		req.trigger.method = val;
4175		req.trigger.band = band;
4176		break;
4177	default:
4178		return -EINVAL;
4179	}
4180
4181	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(SER),
4182				 &req, sizeof(req), false);
4183}
4184
4185int mt7996_mcu_set_txbf(struct mt7996_dev *dev, u8 action)
4186{
4187#define MT7996_BF_MAX_SIZE	sizeof(union bf_tag_tlv)
4188#define BF_PROCESSING	4
4189	struct uni_header hdr;
4190	struct sk_buff *skb;
4191	struct tlv *tlv;
4192	int len = sizeof(hdr) + MT7996_BF_MAX_SIZE;
4193
4194	memset(&hdr, 0, sizeof(hdr));
4195
4196	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
4197	if (!skb)
4198		return -ENOMEM;
4199
4200	skb_put_data(skb, &hdr, sizeof(hdr));
4201
4202	switch (action) {
4203	case BF_SOUNDING_ON: {
4204		struct bf_sounding_on *req_snd_on;
4205
4206		tlv = mt7996_mcu_add_uni_tlv(skb, action, sizeof(*req_snd_on));
4207		req_snd_on = (struct bf_sounding_on *)tlv;
4208		req_snd_on->snd_mode = BF_PROCESSING;
4209		break;
4210	}
4211	case BF_HW_EN_UPDATE: {
4212		struct bf_hw_en_status_update *req_hw_en;
4213
4214		tlv = mt7996_mcu_add_uni_tlv(skb, action, sizeof(*req_hw_en));
4215		req_hw_en = (struct bf_hw_en_status_update *)tlv;
4216		req_hw_en->ebf = true;
4217		req_hw_en->ibf = dev->ibf;
4218		break;
4219	}
4220	case BF_MOD_EN_CTRL: {
4221		struct bf_mod_en_ctrl *req_mod_en;
4222
4223		tlv = mt7996_mcu_add_uni_tlv(skb, action, sizeof(*req_mod_en));
4224		req_mod_en = (struct bf_mod_en_ctrl *)tlv;
4225		req_mod_en->bf_num = mt7996_band_valid(dev, MT_BAND2) ? 3 : 2;
4226		req_mod_en->bf_bitmap = mt7996_band_valid(dev, MT_BAND2) ?
4227					GENMASK(2, 0) : GENMASK(1, 0);
4228		break;
4229	}
4230	default:
4231		return -EINVAL;
4232	}
4233
4234	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_WM_UNI_CMD(BF), true);
4235}
4236
4237static int
4238mt7996_mcu_enable_obss_spr(struct mt7996_phy *phy, u16 action, u8 val)
4239{
4240	struct mt7996_dev *dev = phy->dev;
4241	struct {
4242		u8 band_idx;
4243		u8 __rsv[3];
4244
4245		__le16 tag;
4246		__le16 len;
4247
4248		__le32 val;
4249	} __packed req = {
4250		.band_idx = phy->mt76->band_idx,
4251		.tag = cpu_to_le16(action),
4252		.len = cpu_to_le16(sizeof(req) - 4),
4253		.val = cpu_to_le32(val),
4254	};
4255
4256	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(SR),
4257				 &req, sizeof(req), true);
4258}
4259
4260static int
4261mt7996_mcu_set_obss_spr_pd(struct mt7996_phy *phy,
4262			   struct ieee80211_he_obss_pd *he_obss_pd)
4263{
4264	struct mt7996_dev *dev = phy->dev;
4265	u8 max_th = 82, non_srg_max_th = 62;
4266	struct {
4267		u8 band_idx;
4268		u8 __rsv[3];
4269
4270		__le16 tag;
4271		__le16 len;
4272
4273		u8 pd_th_non_srg;
4274		u8 pd_th_srg;
4275		u8 period_offs;
4276		u8 rcpi_src;
4277		__le16 obss_pd_min;
4278		__le16 obss_pd_min_srg;
4279		u8 resp_txpwr_mode;
4280		u8 txpwr_restrict_mode;
4281		u8 txpwr_ref;
4282		u8 __rsv2[3];
4283	} __packed req = {
4284		.band_idx = phy->mt76->band_idx,
4285		.tag = cpu_to_le16(UNI_CMD_SR_SET_PARAM),
4286		.len = cpu_to_le16(sizeof(req) - 4),
4287		.obss_pd_min = cpu_to_le16(max_th),
4288		.obss_pd_min_srg = cpu_to_le16(max_th),
4289		.txpwr_restrict_mode = 2,
4290		.txpwr_ref = 21
4291	};
4292	int ret;
4293
4294	/* disable firmware dynamical PD asjustment */
4295	ret = mt7996_mcu_enable_obss_spr(phy, UNI_CMD_SR_ENABLE_DPD, false);
4296	if (ret)
4297		return ret;
4298
4299	if (he_obss_pd->sr_ctrl &
4300	    IEEE80211_HE_SPR_NON_SRG_OBSS_PD_SR_DISALLOWED)
4301		req.pd_th_non_srg = max_th;
4302	else if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_NON_SRG_OFFSET_PRESENT)
4303		req.pd_th_non_srg  = max_th - he_obss_pd->non_srg_max_offset;
4304	else
4305		req.pd_th_non_srg  = non_srg_max_th;
4306
4307	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_SRG_INFORMATION_PRESENT)
4308		req.pd_th_srg = max_th - he_obss_pd->max_offset;
4309
4310	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(SR),
4311				 &req, sizeof(req), true);
4312}
4313
4314static int
4315mt7996_mcu_set_obss_spr_siga(struct mt7996_phy *phy,
4316			     struct mt7996_vif_link *link,
4317			     struct ieee80211_he_obss_pd *he_obss_pd)
4318{
4319	struct mt7996_dev *dev = phy->dev;
4320	u8 omac = link->mt76.omac_idx;
4321	struct {
4322		u8 band_idx;
4323		u8 __rsv[3];
4324
4325		__le16 tag;
4326		__le16 len;
4327
4328		u8 omac;
4329		u8 __rsv2[3];
4330		u8 flag[20];
4331	} __packed req = {
4332		.band_idx = phy->mt76->band_idx,
4333		.tag = cpu_to_le16(UNI_CMD_SR_SET_SIGA),
4334		.len = cpu_to_le16(sizeof(req) - 4),
4335		.omac = omac > HW_BSSID_MAX ? omac - 12 : omac,
4336	};
4337	int ret;
4338
4339	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_HESIGA_SR_VAL15_ALLOWED)
4340		req.flag[req.omac] = 0xf;
4341	else
4342		return 0;
4343
4344	/* switch to normal AP mode */
4345	ret = mt7996_mcu_enable_obss_spr(phy, UNI_CMD_SR_ENABLE_MODE, 0);
4346	if (ret)
4347		return ret;
4348
4349	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(SR),
4350				 &req, sizeof(req), true);
4351}
4352
4353static int
4354mt7996_mcu_set_obss_spr_bitmap(struct mt7996_phy *phy,
4355			       struct ieee80211_he_obss_pd *he_obss_pd)
4356{
4357	struct mt7996_dev *dev = phy->dev;
4358	struct {
4359		u8 band_idx;
4360		u8 __rsv[3];
4361
4362		__le16 tag;
4363		__le16 len;
4364
4365		__le32 color_l[2];
4366		__le32 color_h[2];
4367		__le32 bssid_l[2];
4368		__le32 bssid_h[2];
4369	} __packed req = {
4370		.band_idx = phy->mt76->band_idx,
4371		.tag = cpu_to_le16(UNI_CMD_SR_SET_SRG_BITMAP),
4372		.len = cpu_to_le16(sizeof(req) - 4),
4373	};
4374	u32 bitmap;
4375
4376	memcpy(&bitmap, he_obss_pd->bss_color_bitmap, sizeof(bitmap));
4377	req.color_l[req.band_idx] = cpu_to_le32(bitmap);
4378
4379	memcpy(&bitmap, he_obss_pd->bss_color_bitmap + 4, sizeof(bitmap));
4380	req.color_h[req.band_idx] = cpu_to_le32(bitmap);
4381
4382	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap, sizeof(bitmap));
4383	req.bssid_l[req.band_idx] = cpu_to_le32(bitmap);
4384
4385	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap + 4, sizeof(bitmap));
4386	req.bssid_h[req.band_idx] = cpu_to_le32(bitmap);
4387
4388	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(SR), &req,
4389				 sizeof(req), true);
4390}
4391
4392int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy,
4393			    struct mt7996_vif_link *link,
4394			    struct ieee80211_he_obss_pd *he_obss_pd)
4395{
4396	int ret;
4397
4398	/* enable firmware scene detection algorithms */
4399	ret = mt7996_mcu_enable_obss_spr(phy, UNI_CMD_SR_ENABLE_SD,
4400					 sr_scene_detect);
4401	if (ret)
4402		return ret;
4403
4404	/* firmware dynamically adjusts PD threshold so skip manual control */
4405	if (sr_scene_detect && !he_obss_pd->enable)
4406		return 0;
4407
4408	/* enable spatial reuse */
4409	ret = mt7996_mcu_enable_obss_spr(phy, UNI_CMD_SR_ENABLE,
4410					 he_obss_pd->enable);
4411	if (ret)
4412		return ret;
4413
4414	if (sr_scene_detect || !he_obss_pd->enable)
4415		return 0;
4416
4417	ret = mt7996_mcu_enable_obss_spr(phy, UNI_CMD_SR_ENABLE_TX, true);
4418	if (ret)
4419		return ret;
4420
4421	/* set SRG/non-SRG OBSS PD threshold */
4422	ret = mt7996_mcu_set_obss_spr_pd(phy, he_obss_pd);
4423	if (ret)
4424		return ret;
4425
4426	/* Set SR prohibit */
4427	ret = mt7996_mcu_set_obss_spr_siga(phy, link, he_obss_pd);
4428	if (ret)
4429		return ret;
4430
4431	/* set SRG BSS color/BSSID bitmap */
4432	return mt7996_mcu_set_obss_spr_bitmap(phy, he_obss_pd);
4433}
4434
4435int mt7996_mcu_update_bss_color(struct mt7996_dev *dev,
4436				struct mt76_vif_link *mlink,
4437				struct cfg80211_he_bss_color *he_bss_color)
4438{
4439	int len = sizeof(struct bss_req_hdr) + sizeof(struct bss_color_tlv);
4440	struct bss_color_tlv *bss_color;
4441	struct sk_buff *skb;
4442	struct tlv *tlv;
4443
4444	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, mlink, len);
4445	if (IS_ERR(skb))
4446		return PTR_ERR(skb);
4447
4448	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BSS_COLOR,
4449				      sizeof(*bss_color));
4450	bss_color = (struct bss_color_tlv *)tlv;
4451	bss_color->enable = he_bss_color->enabled;
4452	bss_color->color = he_bss_color->color;
4453
4454	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
4455				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
4456}
4457
4458#define TWT_AGRT_TRIGGER	BIT(0)
4459#define TWT_AGRT_ANNOUNCE	BIT(1)
4460#define TWT_AGRT_PROTECT	BIT(2)
4461
4462int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
4463			       struct mt7996_vif_link *link,
4464			       struct mt7996_twt_flow *flow,
4465			       int cmd)
4466{
4467	struct {
4468		/* fixed field */
4469		u8 bss;
4470		u8 _rsv[3];
4471
4472		__le16 tag;
4473		__le16 len;
4474		u8 tbl_idx;
4475		u8 cmd;
4476		u8 own_mac_idx;
4477		u8 flowid; /* 0xff for group id */
4478		__le16 peer_id; /* specify the peer_id (msb=0)
4479				 * or group_id (msb=1)
4480				 */
4481		u8 duration; /* 256 us */
4482		u8 bss_idx;
4483		__le64 start_tsf;
4484		__le16 mantissa;
4485		u8 exponent;
4486		u8 is_ap;
4487		u8 agrt_params;
4488		u8 __rsv2[23];
4489	} __packed req = {
4490		.tag = cpu_to_le16(UNI_CMD_TWT_ARGT_UPDATE),
4491		.len = cpu_to_le16(sizeof(req) - 4),
4492		.tbl_idx = flow->table_id,
4493		.cmd = cmd,
4494		.own_mac_idx = link->mt76.omac_idx,
4495		.flowid = flow->id,
4496		.peer_id = cpu_to_le16(flow->wcid),
4497		.duration = flow->duration,
4498		.bss = link->mt76.idx,
4499		.bss_idx = link->mt76.idx,
4500		.start_tsf = cpu_to_le64(flow->tsf),
4501		.mantissa = flow->mantissa,
4502		.exponent = flow->exp,
4503		.is_ap = true,
4504	};
4505
4506	if (flow->protection)
4507		req.agrt_params |= TWT_AGRT_PROTECT;
4508	if (!flow->flowtype)
4509		req.agrt_params |= TWT_AGRT_ANNOUNCE;
4510	if (flow->trigger)
4511		req.agrt_params |= TWT_AGRT_TRIGGER;
4512
4513	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(TWT),
4514				 &req, sizeof(req), true);
4515}
4516
4517int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val)
4518{
4519	struct {
4520		u8 band_idx;
4521		u8 _rsv[3];
4522
4523		__le16 tag;
4524		__le16 len;
4525		__le32 len_thresh;
4526		__le32 pkt_thresh;
4527	} __packed req = {
4528		.band_idx = phy->mt76->band_idx,
4529		.tag = cpu_to_le16(UNI_BAND_CONFIG_RTS_THRESHOLD),
4530		.len = cpu_to_le16(sizeof(req) - 4),
4531		.len_thresh = cpu_to_le32(val),
4532		.pkt_thresh = cpu_to_le32(0x2),
4533	};
4534
4535	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(BAND_CONFIG),
4536				 &req, sizeof(req), true);
4537}
4538
4539int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable)
4540{
4541	struct {
4542		u8 band_idx;
4543		u8 _rsv[3];
4544
4545		__le16 tag;
4546		__le16 len;
4547		u8 enable;
4548		u8 _rsv2[3];
4549	} __packed req = {
4550		.band_idx = phy->mt76->band_idx,
4551		.tag = cpu_to_le16(UNI_BAND_CONFIG_RADIO_ENABLE),
4552		.len = cpu_to_le16(sizeof(req) - 4),
4553		.enable = enable,
4554	};
4555
4556	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(BAND_CONFIG),
4557				 &req, sizeof(req), true);
4558}
4559
4560int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 rdd_idx, u8 val)
4561{
4562	struct {
4563		u8 _rsv[4];
4564
4565		__le16 tag;
4566		__le16 len;
4567
4568		u8 ctrl;
4569		u8 rdd_idx;
4570		u8 rdd_rx_sel;
4571		u8 val;
4572		u8 rsv[4];
4573	} __packed req = {
4574		.tag = cpu_to_le16(UNI_RDD_CTRL_PARM),
4575		.len = cpu_to_le16(sizeof(req) - 4),
4576		.ctrl = cmd,
4577		.rdd_idx = rdd_idx,
4578		.val = val,
4579	};
4580
4581	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(RDD_CTRL),
4582				 &req, sizeof(req), true);
4583}
4584
4585int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
4586				     struct ieee80211_vif *vif,
4587				     struct mt7996_vif_link *link,
4588				     struct mt7996_sta_link *msta_link)
4589{
4590	struct sk_buff *skb;
4591
4592	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &link->mt76,
4593					      &msta_link->wcid,
4594					      MT7996_STA_UPDATE_MAX_SIZE);
4595	if (IS_ERR(skb))
4596		return PTR_ERR(skb);
4597
4598	/* starec hdr trans */
4599	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, &msta_link->wcid);
4600	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
4601				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
4602}
4603
4604int mt7996_mcu_set_fixed_rate_table(struct mt7996_phy *phy, u8 table_idx,
4605				    u16 rate_idx, bool beacon)
4606{
4607#define UNI_FIXED_RATE_TABLE_SET	0
4608#define SPE_IXD_SELECT_TXD		0
4609#define SPE_IXD_SELECT_BMC_WTBL		1
4610	struct mt7996_dev *dev = phy->dev;
4611	struct fixed_rate_table_ctrl req = {
4612		.tag = cpu_to_le16(UNI_FIXED_RATE_TABLE_SET),
4613		.len = cpu_to_le16(sizeof(req) - 4),
4614		.table_idx = table_idx,
4615		.rate_idx = cpu_to_le16(rate_idx),
4616		.gi = 1,
4617		.he_ltf = 1,
4618	};
4619	u8 band_idx = phy->mt76->band_idx;
4620
4621	if (beacon) {
4622		req.spe_idx_sel = SPE_IXD_SELECT_TXD;
4623		req.spe_idx = 24 + band_idx;
4624		phy->beacon_rate = rate_idx;
4625	} else {
4626		req.spe_idx_sel = SPE_IXD_SELECT_BMC_WTBL;
4627	}
4628
4629	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(FIXED_RATE_TABLE),
4630				 &req, sizeof(req), false);
4631}
4632
4633int mt7996_mcu_rf_regval(struct mt7996_dev *dev, u32 regidx, u32 *val, bool set)
4634{
4635	struct {
4636		u8 __rsv1[4];
4637
4638		__le16 tag;
4639		__le16 len;
4640		__le16 idx;
4641		u8 __rsv2[2];
4642		__le32 ofs;
4643		__le32 data;
4644	} __packed *res, req = {
4645		.tag = cpu_to_le16(UNI_CMD_ACCESS_RF_REG_BASIC),
4646		.len = cpu_to_le16(sizeof(req) - 4),
4647
4648		.idx = cpu_to_le16(u32_get_bits(regidx, GENMASK(31, 24))),
4649		.ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(23, 0))),
4650		.data = set ? cpu_to_le32(*val) : 0,
4651	};
4652	struct sk_buff *skb;
4653	int ret;
4654
4655	if (set)
4656		return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(REG_ACCESS),
4657					 &req, sizeof(req), true);
4658
4659	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
4660					MCU_WM_UNI_CMD_QUERY(REG_ACCESS),
4661					&req, sizeof(req), true, &skb);
4662	if (ret)
4663		return ret;
4664
4665	res = (void *)skb->data;
4666	*val = le32_to_cpu(res->data);
4667	dev_kfree_skb(skb);
4668
4669	return 0;
4670}
4671
4672int mt7996_mcu_trigger_assert(struct mt7996_dev *dev)
4673{
4674	struct {
4675		__le16 tag;
4676		__le16 len;
4677		u8 enable;
4678		u8 rsv[3];
4679	} __packed req = {
4680		.len = cpu_to_le16(sizeof(req) - 4),
4681		.enable = true,
4682	};
4683
4684	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(ASSERT_DUMP),
4685				 &req, sizeof(req), false);
4686}
4687
4688int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val)
4689{
4690	struct {
4691		u8 __rsv1[4];
4692		__le16 tag;
4693		__le16 len;
4694		union {
4695			struct {
4696				u8 type;
4697				u8 __rsv2[3];
4698			} __packed platform_type;
4699			struct {
4700				u8 type;
4701				u8 dest;
4702				u8 __rsv2[2];
4703			} __packed bypass_mode;
4704			struct {
4705				u8 path;
4706				u8 __rsv2[3];
4707			} __packed txfree_path;
4708			struct {
4709				__le16 flush_one;
4710				__le16 flush_all;
4711				u8 __rsv2[4];
4712			} __packed timeout;
4713		};
4714	} __packed req = {
4715		.tag = cpu_to_le16(tag),
4716		.len = cpu_to_le16(sizeof(req) - 4),
4717	};
4718
4719	switch (tag) {
4720	case UNI_RRO_SET_PLATFORM_TYPE:
4721		req.platform_type.type = val;
4722		break;
4723	case UNI_RRO_SET_BYPASS_MODE:
4724		req.bypass_mode.type = val;
4725		break;
4726	case UNI_RRO_SET_TXFREE_PATH:
4727		req.txfree_path.path = val;
4728		break;
4729	case UNI_RRO_SET_FLUSH_TIMEOUT:
4730		req.timeout.flush_one = cpu_to_le16(val);
4731		req.timeout.flush_all = cpu_to_le16(2 * val);
4732		break;
4733	default:
4734		return -EINVAL;
4735	}
4736
4737	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(RRO), &req,
4738				 sizeof(req), true);
4739}
4740
4741int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag)
4742{
4743	struct mt7996_dev *dev = phy->dev;
4744	struct {
4745		u8 _rsv[4];
4746
4747		__le16 tag;
4748		__le16 len;
4749	} __packed req = {
4750		.tag = cpu_to_le16(tag),
4751		.len = cpu_to_le16(sizeof(req) - 4),
4752	};
4753
4754	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(ALL_STA_INFO),
4755				 &req, sizeof(req), false);
4756}
4757
4758int mt7996_mcu_wed_rro_reset_sessions(struct mt7996_dev *dev, u16 id)
4759{
4760	struct {
4761		u8 __rsv[4];
4762
4763		__le16 tag;
4764		__le16 len;
4765		__le16 session_id;
4766		u8 pad[4];
4767	} __packed req = {
4768		.tag = cpu_to_le16(UNI_RRO_DEL_BA_SESSION),
4769		.len = cpu_to_le16(sizeof(req) - 4),
4770		.session_id = cpu_to_le16(id),
4771	};
4772
4773	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(RRO), &req,
4774				 sizeof(req), true);
4775}
4776
4777int mt7996_mcu_set_sniffer_mode(struct mt7996_phy *phy, bool enabled)
4778{
4779	struct mt7996_dev *dev = phy->dev;
4780	struct {
4781		u8 band_idx;
4782		u8 _rsv[3];
4783		__le16 tag;
4784		__le16 len;
4785		u8 enable;
4786		u8 _pad[3];
4787	} __packed req = {
4788		.band_idx = phy->mt76->band_idx,
4789		.tag = 0,
4790		.len = cpu_to_le16(sizeof(req) - 4),
4791		.enable = enabled,
4792	};
4793
4794	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(SNIFFER), &req,
4795				 sizeof(req), true);
4796}
4797
4798int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
4799{
4800#define TX_POWER_LIMIT_TABLE_RATE	0
4801	struct mt7996_dev *dev = phy->dev;
4802	struct mt76_phy *mphy = phy->mt76;
4803	struct tx_power_limit_table_ctrl {
4804		u8 __rsv1[4];
4805
4806		__le16 tag;
4807		__le16 len;
4808		u8 power_ctrl_id;
4809		u8 power_limit_type;
4810		u8 band_idx;
4811	} __packed req = {
4812		.tag = cpu_to_le16(UNI_TXPOWER_POWER_LIMIT_TABLE_CTRL),
4813		.len = cpu_to_le16(sizeof(req) + MT7996_SKU_PATH_NUM - 4),
4814		.power_ctrl_id = UNI_TXPOWER_POWER_LIMIT_TABLE_CTRL,
4815		.power_limit_type = TX_POWER_LIMIT_TABLE_RATE,
4816		.band_idx = phy->mt76->band_idx,
4817	};
4818	struct mt76_power_limits la = {};
4819	struct sk_buff *skb;
4820	int i, tx_power;
4821
4822	tx_power = mt76_get_power_bound(mphy, phy->txpower);
4823	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
4824					      &la, tx_power);
4825	mphy->txpower_cur = tx_power;
4826
4827	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
4828				 sizeof(req) + MT7996_SKU_PATH_NUM);
4829	if (!skb)
4830		return -ENOMEM;
4831
4832	skb_put_data(skb, &req, sizeof(req));
4833	/* cck and ofdm */
4834	skb_put_data(skb, &la.cck, sizeof(la.cck));
4835	skb_put_data(skb, &la.ofdm, sizeof(la.ofdm));
4836	/* ht20 */
4837	skb_put_data(skb, &la.mcs[0], 8);
4838	/* ht40 */
4839	skb_put_data(skb, &la.mcs[1], 9);
4840
4841	/* vht */
4842	for (i = 0; i < 4; i++) {
4843		skb_put_data(skb, &la.mcs[i], sizeof(la.mcs[i]));
4844		skb_put_zero(skb, 2);  /* padding */
4845	}
4846
4847	/* he */
4848	skb_put_data(skb, &la.ru[0], sizeof(la.ru));
4849	/* eht */
4850	skb_put_data(skb, &la.eht[0], sizeof(la.eht));
4851
4852	/* padding */
4853	skb_put_zero(skb, MT7996_SKU_PATH_NUM - MT7996_SKU_RATE_NUM);
4854
4855	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
4856				     MCU_WM_UNI_CMD(TXPOWER), true);
4857}
4858
4859int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode)
4860{
4861	__le32 cp_mode;
4862
4863	if (mode < mt76_connac_lmac_mapping(IEEE80211_AC_BE) ||
4864	    mode > mt76_connac_lmac_mapping(IEEE80211_AC_VO))
4865		return -EINVAL;
4866
4867	if (!mt7996_has_wa(dev)) {
4868		struct {
4869			u8 _rsv[4];
4870
4871			__le16 tag;
4872			__le16 len;
4873			u8 cp_mode;
4874			u8 rsv[3];
4875		} __packed req = {
4876			.tag = cpu_to_le16(UNI_CMD_SDO_CP_MODE),
4877			.len = cpu_to_le16(sizeof(req) - 4),
4878			.cp_mode = mode,
4879		};
4880
4881		return mt76_mcu_send_msg(&dev->mt76, MCU_WA_UNI_CMD(SDO),
4882					 &req, sizeof(req), false);
4883	}
4884
4885	cp_mode = cpu_to_le32(mode);
4886
4887	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(CP_SUPPORT),
4888				 &cp_mode, sizeof(cp_mode), true);
4889}