1	// SPDX-License-Identifier: BSD-3-Clause-Clear
2	/*
3	* Copyright (C) 2022 MediaTek Inc.
4	*/
5
6	#include <linux/firmware.h>
7	#include <linux/fs.h>
8	#include "mt7996.h"
9	#include "mcu.h"
10	#include "mac.h"
11	#include "eeprom.h"
12
13	#define fw_name(_dev, name, ...) ({ \
14	char *_fw; \
15	switch (mt76_chip(&(_dev)->mt76)) { \
16	case MT7992_DEVICE_ID: \
17	switch ((_dev)->var.type) { \
18	case MT7992_VAR_TYPE_23: \
19	_fw = MT7992_##name##_23; \
20	break; \
21	default: \
22	_fw = MT7992_##name; \
23	} \
24	break; \
25	case MT7990_DEVICE_ID: \
26	_fw = MT7990_##name; \
27	break; \
28	case MT7996_DEVICE_ID: \
29	default: \
30	switch ((_dev)->var.type) { \
31	case MT7996_VAR_TYPE_233: \
32	_fw = MT7996_##name##_233; \
33	break; \
34	default: \
35	_fw = MT7996_##name; \
36	} \
37	break; \
38	} \
39	_fw; \
40	})
41
42	struct mt7996_patch_hdr {
43	char build_date[16];
44	char platform[4];
45	__be32 hw_sw_ver;
46	__be32 patch_ver;
47	__be16 checksum;
48	u16 reserved;
49	struct {
50	__be32 patch_ver;
51	__be32 subsys;
52	__be32 feature;
53	__be32 n_region;
54	__be32 crc;
55	u32 reserved[11];
56	} desc;
57	} __packed;
58
59	struct mt7996_patch_sec {
60	__be32 type;
61	__be32 offs;
62	__be32 size;
63	union {
64	__be32 spec[13];
65	struct {
66	__be32 addr;
67	__be32 len;
68	__be32 sec_key_idx;
69	__be32 align_len;
70	u32 reserved[9];
71	} info;
72	};
73	} __packed;
74
75	struct mt7996_fw_trailer {
76	u8 chip_id;
77	u8 eco_code;
78	u8 n_region;
79	u8 format_ver;
80	u8 format_flag;
81	u8 reserved[2];
82	char fw_ver[10];
83	char build_date[15];
84	u32 crc;
85	} __packed;
86
87	struct mt7996_fw_region {
88	__le32 decomp_crc;
89	__le32 decomp_len;
90	__le32 decomp_blk_sz;
91	u8 reserved[4];
92	__le32 addr;
93	__le32 len;
94	u8 feature_set;
95	u8 reserved1[15];
96	} __packed;
97
98	#define MCU_PATCH_ADDRESS 0x200000
99
100	#define HE_PHY(p, c) u8_get_bits(c, IEEE80211_HE_PHY_##p)
101	#define HE_MAC(m, c) u8_get_bits(c, IEEE80211_HE_MAC_##m)
102	#define EHT_PHY(p, c) u8_get_bits(c, IEEE80211_EHT_PHY_##p)
103
104	static bool sr_scene_detect = true;
105	module_param(sr_scene_detect, bool, 0644);
106	MODULE_PARM_DESC(sr_scene_detect, "Enable firmware scene detection algorithm");
107
108	static u8
109	mt7996_mcu_get_sta_nss(u16 mcs_map)
110	{
111	u8 nss;
112
113	for (nss = 8; nss > 0; nss--) {
114	u8 nss_mcs = (mcs_map >> (2 * (nss - 1))) & 3;
115
116	if (nss_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED)
117	break;
118	}
119
120	return nss - 1;
121	}
122
123	static void
124	mt7996_mcu_set_sta_he_mcs(struct ieee80211_link_sta *link_sta,
125	struct mt7996_vif_link *link,
126	__le16 *he_mcs, u16 mcs_map)
127	{
128	int nss, max_nss = link_sta->rx_nss > 3 ? 4 : link_sta->rx_nss;
129	enum nl80211_band band = link->phy->mt76->chandef.chan->band;
130	const u16 *mask = link->bitrate_mask.control[band].he_mcs;
131
132	for (nss = 0; nss < max_nss; nss++) {
133	int mcs;
134
135	switch ((mcs_map >> (2 * nss)) & 0x3) {
136	case IEEE80211_HE_MCS_SUPPORT_0_11:
137	mcs = GENMASK(11, 0);
138	break;
139	case IEEE80211_HE_MCS_SUPPORT_0_9:
140	mcs = GENMASK(9, 0);
141	break;
142	case IEEE80211_HE_MCS_SUPPORT_0_7:
143	mcs = GENMASK(7, 0);
144	break;
145	default:
146	mcs = 0;
147	}
148
149	mcs = mcs ? fls(x: mcs & mask[nss]) - 1 : -1;
150
151	switch (mcs) {
152	case 0 ... 7:
153	mcs = IEEE80211_HE_MCS_SUPPORT_0_7;
154	break;
155	case 8 ... 9:
156	mcs = IEEE80211_HE_MCS_SUPPORT_0_9;
157	break;
158	case 10 ... 11:
159	mcs = IEEE80211_HE_MCS_SUPPORT_0_11;
160	break;
161	default:
162	mcs = IEEE80211_HE_MCS_NOT_SUPPORTED;
163	break;
164	}
165	mcs_map &= ~(0x3 << (nss * 2));
166	mcs_map |= mcs << (nss * 2);
167	}
168
169	*he_mcs = cpu_to_le16(mcs_map);
170	}
171
172	static void
173	mt7996_mcu_set_sta_vht_mcs(struct ieee80211_link_sta *link_sta,
174	__le16 *vht_mcs, const u16 *mask)
175	{
176	u16 mcs, mcs_map = le16_to_cpu(link_sta->vht_cap.vht_mcs.rx_mcs_map);
177	int nss, max_nss = link_sta->rx_nss > 3 ? 4 : link_sta->rx_nss;
178
179	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
180	switch (mcs_map & 0x3) {
181	case IEEE80211_VHT_MCS_SUPPORT_0_9:
182	mcs = GENMASK(9, 0);
183	break;
184	case IEEE80211_VHT_MCS_SUPPORT_0_8:
185	mcs = GENMASK(8, 0);
186	break;
187	case IEEE80211_VHT_MCS_SUPPORT_0_7:
188	mcs = GENMASK(7, 0);
189	break;
190	default:
191	mcs = 0;
192	}
193
194	vht_mcs[nss] = cpu_to_le16(mcs & mask[nss]);
195	}
196	}
197
198	static void
199	mt7996_mcu_set_sta_ht_mcs(struct ieee80211_link_sta *link_sta,
200	u8 *ht_mcs, const u8 *mask)
201	{
202	int nss, max_nss = link_sta->rx_nss > 3 ? 4 : link_sta->rx_nss;
203
204	for (nss = 0; nss < max_nss; nss++)
205	ht_mcs[nss] = link_sta->ht_cap.mcs.rx_mask[nss] & mask[nss];
206	}
207
208	static int
209	mt7996_mcu_parse_response(struct mt76_dev *mdev, int cmd,
210	struct sk_buff *skb, int seq)
211	{
212	struct mt7996_mcu_rxd *rxd;
213	struct mt7996_mcu_uni_event *event;
214	int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
215	int ret = 0;
216
217	if (!skb) {
218	dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
219	cmd, seq);
220	return -ETIMEDOUT;
221	}
222
223	rxd = (struct mt7996_mcu_rxd *)skb->data;
224	if (seq != rxd->seq)
225	return -EAGAIN;
226
227	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
228	skb_pull(skb, len: sizeof(*rxd) - 4);
229	ret = *skb->data;
230	} else if ((rxd->option & MCU_UNI_CMD_EVENT) &&
231	rxd->eid == MCU_UNI_EVENT_RESULT) {
232	skb_pull(skb, len: sizeof(*rxd));
233	event = (struct mt7996_mcu_uni_event *)skb->data;
234	ret = le32_to_cpu(event->status);
235	/* skip invalid event */
236	if (mcu_cmd != event->cid)
237	ret = -EAGAIN;
238	} else {
239	skb_pull(skb, len: sizeof(struct mt7996_mcu_rxd));
240	}
241
242	return ret;
243	}
244
245	static void
246	mt7996_mcu_set_timeout(struct mt76_dev *mdev, int cmd)
247	{
248	mdev->mcu.timeout = 5 * HZ;
249
250	if (!(cmd & __MCU_CMD_FIELD_UNI))
251	return;
252
253	switch (FIELD_GET(__MCU_CMD_FIELD_ID, cmd)) {
254	case MCU_UNI_CMD_THERMAL:
255	case MCU_UNI_CMD_TWT:
256	case MCU_UNI_CMD_GET_MIB_INFO:
257	case MCU_UNI_CMD_STA_REC_UPDATE:
258	case MCU_UNI_CMD_BSS_INFO_UPDATE:
259	mdev->mcu.timeout = 2 * HZ;
260	return;
261	case MCU_UNI_CMD_EFUSE_CTRL:
262	mdev->mcu.timeout = 20 * HZ;
263	return;
264	default:
265	break;
266	}
267	}
268
269	static int
270	mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
271	int cmd, int *wait_seq)
272	{
273	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
274	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
275	struct mt76_connac2_mcu_uni_txd *uni_txd;
276	struct mt76_connac2_mcu_txd *mcu_txd;
277	enum mt76_mcuq_id qid;
278	__le32 *txd;
279	u32 val;
280	u8 seq;
281
282	mt7996_mcu_set_timeout(mdev, cmd);
283
284	seq = ++dev->mt76.mcu.msg_seq & 0xf;
285	if (!seq)
286	seq = ++dev->mt76.mcu.msg_seq & 0xf;
287
288	if (cmd == MCU_CMD(FW_SCATTER)) {
289	qid = MT_MCUQ_FWDL;
290	goto exit;
291	}
292
293	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
294	txd = (__le32 *)skb_push(skb, len: txd_len);
295	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state) && mt7996_has_wa(dev))
296	qid = MT_MCUQ_WA;
297	else
298	qid = MT_MCUQ_WM;
299
300	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
301	FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
302	FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
303	txd[0] = cpu_to_le32(val);
304
305	val = FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
306	txd[1] = cpu_to_le32(val);
307
308	if (cmd & __MCU_CMD_FIELD_UNI) {
309	uni_txd = (struct mt76_connac2_mcu_uni_txd *)txd;
310	uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
311	uni_txd->cid = cpu_to_le16(mcu_cmd);
312	uni_txd->s2d_index = MCU_S2D_H2CN;
313	uni_txd->pkt_type = MCU_PKT_ID;
314	uni_txd->seq = seq;
315
316	if (cmd & __MCU_CMD_FIELD_QUERY)
317	uni_txd->option = MCU_CMD_UNI_QUERY_ACK;
318	else
319	uni_txd->option = MCU_CMD_UNI_EXT_ACK;
320
321	if (mcu_cmd == MCU_UNI_CMD_SDO)
322	uni_txd->option &= ~MCU_CMD_ACK;
323
324	if ((cmd & __MCU_CMD_FIELD_WA) && (cmd & __MCU_CMD_FIELD_WM))
325	uni_txd->s2d_index = MCU_S2D_H2CN;
326	else if (cmd & __MCU_CMD_FIELD_WA)
327	uni_txd->s2d_index = MCU_S2D_H2C;
328	else if (cmd & __MCU_CMD_FIELD_WM)
329	uni_txd->s2d_index = MCU_S2D_H2N;
330
331	goto exit;
332	}
333
334	mcu_txd = (struct mt76_connac2_mcu_txd *)txd;
335	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
336	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
337	MT_TX_MCU_PORT_RX_Q0));
338	mcu_txd->pkt_type = MCU_PKT_ID;
339	mcu_txd->seq = seq;
340
341	mcu_txd->cid = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
342	mcu_txd->set_query = MCU_Q_NA;
343	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
344	if (mcu_txd->ext_cid) {
345	mcu_txd->ext_cid_ack = 1;
346
347	if (cmd & __MCU_CMD_FIELD_QUERY)
348	mcu_txd->set_query = MCU_Q_QUERY;
349	else
350	mcu_txd->set_query = MCU_Q_SET;
351	}
352
353	if (cmd & __MCU_CMD_FIELD_WA)
354	mcu_txd->s2d_index = MCU_S2D_H2C;
355	else
356	mcu_txd->s2d_index = MCU_S2D_H2N;
357
358	exit:
359	if (wait_seq)
360	*wait_seq = seq;
361
362	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
363	}
364
365	int mt7996_mcu_wa_cmd(struct mt7996_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
366	{
367	struct {
368	u8 _rsv[4];
369
370	__le16 tag;
371	__le16 len;
372	__le32 args[3];
373	} __packed req = {
374	.args = {
375	cpu_to_le32(a1),
376	cpu_to_le32(a2),
377	cpu_to_le32(a3),
378	},
379	};
380
381	if (mt7996_has_wa(dev))
382	return mt76_mcu_send_msg(dev: &dev->mt76, cmd, data: &req.args,
383	len: sizeof(req.args), wait_resp: false);
384
385	req.tag = cpu_to_le16(cmd == MCU_WA_PARAM_CMD(QUERY) ? UNI_CMD_SDO_QUERY :
386	UNI_CMD_SDO_SET);
387	req.len = cpu_to_le16(sizeof(req) - 4);
388
389	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WA_UNI_CMD(SDO), data: &req,
390	len: sizeof(req), wait_resp: false);
391	}
392
393	static void
394	mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
395	{
396	if (!vif->bss_conf.csa_active || vif->type == NL80211_IFTYPE_STATION)
397	return;
398
399	ieee80211_csa_finish(vif, link_id: 0);
400	}
401
402	static void
403	mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
404	{
405	struct mt76_phy *mphy = &dev->mt76.phy;
406	struct mt7996_mcu_rdd_report *r;
407
408	r = (struct mt7996_mcu_rdd_report *)skb->data;
409
410	switch (r->rdd_idx) {
411	case MT_RDD_IDX_BAND2:
412	mphy = dev->mt76.phys[MT_BAND2];
413	break;
414	case MT_RDD_IDX_BAND1:
415	mphy = dev->mt76.phys[MT_BAND1];
416	break;
417	case MT_RDD_IDX_BACKGROUND:
418	if (!dev->rdd2_phy)
419	return;
420	mphy = dev->rdd2_phy->mt76;
421	break;
422	default:
423	dev_err(dev->mt76.dev, "Unknown RDD idx %d\n", r->rdd_idx);
424	return;
425	}
426
427	if (!mphy)
428	return;
429
430	if (r->rdd_idx == MT_RDD_IDX_BACKGROUND)
431	cfg80211_background_radar_event(wiphy: mphy->hw->wiphy,
432	chandef: &dev->rdd2_chandef,
433	GFP_ATOMIC);
434	else
435	ieee80211_radar_detected(hw: mphy->hw, NULL);
436	dev->hw_pattern++;
437	}
438
439	static void
440	mt7996_mcu_rx_log_message(struct mt7996_dev *dev, struct sk_buff *skb)
441	{
442	#define UNI_EVENT_FW_LOG_FORMAT 0
443	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
444	const char *data = (char *)&rxd[1] + 4, *type;
445	struct tlv *tlv = (struct tlv *)data;
446	int len;
447
448	if (!(rxd->option & MCU_UNI_CMD_EVENT)) {
449	len = skb->len - sizeof(*rxd);
450	data = (char *)&rxd[1];
451	goto out;
452	}
453
454	if (le16_to_cpu(tlv->tag) != UNI_EVENT_FW_LOG_FORMAT)
455	return;
456
457	data += sizeof(*tlv) + 4;
458	len = le16_to_cpu(tlv->len) - sizeof(*tlv) - 4;
459
460	out:
461	switch (rxd->s2d_index) {
462	case 0:
463	if (mt7996_debugfs_rx_log(dev, data, len))
464	return;
465
466	type = "WM";
467	break;
468	case 2:
469	type = "WA";
470	break;
471	default:
472	type = "unknown";
473	break;
474	}
475
476	wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type, len, data);
477	}
478
479	static void
480	mt7996_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
481	{
482	if (!vif->bss_conf.color_change_active || vif->type == NL80211_IFTYPE_STATION)
483	return;
484
485	ieee80211_color_change_finish(vif, link_id: 0);
486	}
487
488	static void
489	mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
490	{
491	#define UNI_EVENT_IE_COUNTDOWN_CSA 0
492	#define UNI_EVENT_IE_COUNTDOWN_BCC 1
493	struct header {
494	u8 band;
495	u8 rsv[3];
496	};
497	struct mt76_phy *mphy = &dev->mt76.phy;
498	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
499	const char *data = (char *)&rxd[1], *tail;
500	struct header *hdr = (struct header *)data;
501	struct tlv *tlv = (struct tlv *)(data + 4);
502
503	if (hdr->band >= ARRAY_SIZE(dev->mt76.phys))
504	return;
505
506	if (hdr->band && dev->mt76.phys[hdr->band])
507	mphy = dev->mt76.phys[hdr->band];
508
509	tail = skb->data + skb->len;
510	data += sizeof(struct header);
511	while (data + sizeof(struct tlv) < tail && le16_to_cpu(tlv->len)) {
512	switch (le16_to_cpu(tlv->tag)) {
513	case UNI_EVENT_IE_COUNTDOWN_CSA:
514	ieee80211_iterate_active_interfaces_atomic(hw: mphy->hw,
515	iter_flags: IEEE80211_IFACE_ITER_RESUME_ALL,
516	iterator: mt7996_mcu_csa_finish, data: mphy->hw);
517	break;
518	case UNI_EVENT_IE_COUNTDOWN_BCC:
519	ieee80211_iterate_active_interfaces_atomic(hw: mphy->hw,
520	iter_flags: IEEE80211_IFACE_ITER_RESUME_ALL,
521	iterator: mt7996_mcu_cca_finish, data: mphy->hw);
522	break;
523	}
524
525	data += le16_to_cpu(tlv->len);
526	tlv = (struct tlv *)data;
527	}
528	}
529
530	static int
531	mt7996_mcu_update_tx_gi(struct rate_info *rate, struct all_sta_trx_rate *mcu_rate)
532	{
533	switch (mcu_rate->tx_mode) {
534	case MT_PHY_TYPE_CCK:
535	case MT_PHY_TYPE_OFDM:
536	break;
537	case MT_PHY_TYPE_HT:
538	case MT_PHY_TYPE_HT_GF:
539	case MT_PHY_TYPE_VHT:
540	if (mcu_rate->tx_gi)
541	rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
542	else
543	rate->flags &= ~RATE_INFO_FLAGS_SHORT_GI;
544	break;
545	case MT_PHY_TYPE_HE_SU:
546	case MT_PHY_TYPE_HE_EXT_SU:
547	case MT_PHY_TYPE_HE_TB:
548	case MT_PHY_TYPE_HE_MU:
549	if (mcu_rate->tx_gi > NL80211_RATE_INFO_HE_GI_3_2)
550	return -EINVAL;
551	rate->he_gi = mcu_rate->tx_gi;
552	break;
553	case MT_PHY_TYPE_EHT_SU:
554	case MT_PHY_TYPE_EHT_TRIG:
555	case MT_PHY_TYPE_EHT_MU:
556	if (mcu_rate->tx_gi > NL80211_RATE_INFO_EHT_GI_3_2)
557	return -EINVAL;
558	rate->eht_gi = mcu_rate->tx_gi;
559	break;
560	default:
561	return -EINVAL;
562	}
563
564	return 0;
565	}
566
567	static void
568	mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
569	{
570	struct mt7996_mcu_all_sta_info_event *res;
571	u16 i;
572
573	skb_pull(skb, len: sizeof(struct mt7996_mcu_rxd));
574
575	res = (struct mt7996_mcu_all_sta_info_event *)skb->data;
576
577	for (i = 0; i < le16_to_cpu(res->sta_num); i++) {
578	u8 ac;
579	u16 wlan_idx;
580	struct mt76_wcid *wcid;
581
582	switch (le16_to_cpu(res->tag)) {
583	case UNI_ALL_STA_TXRX_RATE:
584	wlan_idx = le16_to_cpu(res->rate[i].wlan_idx);
585	wcid = mt76_wcid_ptr(dev, wlan_idx);
586
587	if (!wcid)
588	break;
589
590	if (mt7996_mcu_update_tx_gi(rate: &wcid->rate, mcu_rate: &res->rate[i]))
591	dev_err(dev->mt76.dev, "Failed to update TX GI\n");
592	break;
593	case UNI_ALL_STA_TXRX_ADM_STAT:
594	wlan_idx = le16_to_cpu(res->adm_stat[i].wlan_idx);
595	wcid = mt76_wcid_ptr(dev, wlan_idx);
596
597	if (!wcid)
598	break;
599
600	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
601	wcid->stats.tx_bytes +=
602	le32_to_cpu(res->adm_stat[i].tx_bytes[ac]);
603	wcid->stats.rx_bytes +=
604	le32_to_cpu(res->adm_stat[i].rx_bytes[ac]);
605	}
606	break;
607	case UNI_ALL_STA_TXRX_MSDU_COUNT:
608	wlan_idx = le16_to_cpu(res->msdu_cnt[i].wlan_idx);
609	wcid = mt76_wcid_ptr(dev, wlan_idx);
610
611	if (!wcid)
612	break;
613
614	wcid->stats.tx_packets +=
615	le32_to_cpu(res->msdu_cnt[i].tx_msdu_cnt);
616	wcid->stats.rx_packets +=
617	le32_to_cpu(res->msdu_cnt[i].rx_msdu_cnt);
618	break;
619	default:
620	break;
621	}
622	}
623	}
624
625	static void
626	mt7996_mcu_rx_thermal_notify(struct mt7996_dev *dev, struct sk_buff *skb)
627	{
628	#define THERMAL_NOTIFY_TAG 0x4
629	#define THERMAL_NOTIFY 0x2
630	struct mt76_phy *mphy = &dev->mt76.phy;
631	struct mt7996_mcu_thermal_notify *n;
632	struct mt7996_phy *phy;
633
634	n = (struct mt7996_mcu_thermal_notify *)skb->data;
635
636	if (le16_to_cpu(n->tag) != THERMAL_NOTIFY_TAG)
637	return;
638
639	if (n->event_id != THERMAL_NOTIFY)
640	return;
641
642	if (n->band_idx > MT_BAND2)
643	return;
644
645	mphy = dev->mt76.phys[n->band_idx];
646	if (!mphy)
647	return;
648
649	phy = (struct mt7996_phy *)mphy->priv;
650	phy->throttle_state = n->duty_percent;
651	}
652
653	static void
654	mt7996_mcu_rx_ext_event(struct mt7996_dev *dev, struct sk_buff *skb)
655	{
656	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
657
658	switch (rxd->ext_eid) {
659	case MCU_EXT_EVENT_FW_LOG_2_HOST:
660	mt7996_mcu_rx_log_message(dev, skb);
661	break;
662	default:
663	break;
664	}
665	}
666
667	static void
668	mt7996_mcu_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
669	{
670	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
671
672	switch (rxd->eid) {
673	case MCU_EVENT_EXT:
674	mt7996_mcu_rx_ext_event(dev, skb);
675	break;
676	case MCU_UNI_EVENT_THERMAL:
677	mt7996_mcu_rx_thermal_notify(dev, skb);
678	break;
679	default:
680	break;
681	}
682	dev_kfree_skb(skb);
683	}
684
685	static void
686	mt7996_mcu_wed_rro_event(struct mt7996_dev *dev, struct sk_buff *skb)
687	{
688	struct mt7996_mcu_wed_rro_event *event = (void *)skb->data;
689
690	if (!mt7996_has_hwrro(dev))
691	return;
692
693	skb_pull(skb, len: sizeof(struct mt7996_mcu_rxd) + 4);
694
695	switch (le16_to_cpu(event->tag)) {
696	case UNI_WED_RRO_BA_SESSION_STATUS: {
697	struct mt7996_mcu_wed_rro_ba_event *e;
698
699	while (skb->len >= sizeof(*e)) {
700	struct mt76_rx_tid *tid;
701	struct mt76_wcid *wcid;
702	u16 idx;
703
704	e = (void *)skb->data;
705	idx = le16_to_cpu(e->wlan_id);
706	wcid = mt76_wcid_ptr(dev, idx);
707	if (!wcid || !wcid->sta)
708	break;
709
710	if (e->tid >= ARRAY_SIZE(wcid->aggr))
711	break;
712
713	tid = rcu_dereference(wcid->aggr[e->tid]);
714	if (!tid)
715	break;
716
717	tid->id = le16_to_cpu(e->id);
718	skb_pull(skb, len: sizeof(*e));
719	}
720	break;
721	}
722	case UNI_WED_RRO_BA_SESSION_DELETE: {
723	struct mt7996_mcu_wed_rro_ba_delete_event *e;
724
725	while (skb->len >= sizeof(*e)) {
726	struct mt7996_wed_rro_session_id *session;
727
728	e = (void *)skb->data;
729	session = kzalloc(sizeof(*session), GFP_ATOMIC);
730	if (!session)
731	break;
732
733	session->id = le16_to_cpu(e->session_id);
734
735	spin_lock_bh(lock: &dev->wed_rro.lock);
736	list_add_tail(new: &session->list, head: &dev->wed_rro.poll_list);
737	spin_unlock_bh(lock: &dev->wed_rro.lock);
738
739	ieee80211_queue_work(mt76_hw(dev), work: &dev->wed_rro.work);
740	skb_pull(skb, len: sizeof(*e));
741	}
742	break;
743	}
744	default:
745	break;
746	}
747	}
748
749	static void
750	mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
751	{
752	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
753
754	switch (rxd->eid) {
755	case MCU_UNI_EVENT_FW_LOG_2_HOST:
756	mt7996_mcu_rx_log_message(dev, skb);
757	break;
758	case MCU_UNI_EVENT_IE_COUNTDOWN:
759	mt7996_mcu_ie_countdown(dev, skb);
760	break;
761	case MCU_UNI_EVENT_RDD_REPORT:
762	mt7996_mcu_rx_radar_detected(dev, skb);
763	break;
764	case MCU_UNI_EVENT_ALL_STA_INFO:
765	mt7996_mcu_rx_all_sta_info_event(dev, skb);
766	break;
767	case MCU_UNI_EVENT_WED_RRO:
768	mt7996_mcu_wed_rro_event(dev, skb);
769	break;
770	default:
771	break;
772	}
773	dev_kfree_skb(skb);
774	}
775
776	void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb)
777	{
778	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
779
780	if (rxd->option & MCU_UNI_CMD_UNSOLICITED_EVENT) {
781	mt7996_mcu_uni_rx_unsolicited_event(dev, skb);
782	return;
783	}
784
785	/* WA still uses legacy event*/
786	if (rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
787	!rxd->seq)
788	mt7996_mcu_rx_unsolicited_event(dev, skb);
789	else
790	mt76_mcu_rx_event(dev: &dev->mt76, skb);
791	}
792
793	static struct tlv *
794	mt7996_mcu_add_uni_tlv(struct sk_buff *skb, u16 tag, u16 len)
795	{
796	struct tlv *ptlv = skb_put_zero(skb, len);
797
798	ptlv->tag = cpu_to_le16(tag);
799	ptlv->len = cpu_to_le16(len);
800
801	return ptlv;
802	}
803
804	static void
805	mt7996_mcu_bss_rfch_tlv(struct sk_buff *skb, struct mt7996_phy *phy)
806	{
807	static const u8 rlm_ch_band[] = {
808	[NL80211_BAND_2GHZ] = 1,
809	[NL80211_BAND_5GHZ] = 2,
810	[NL80211_BAND_6GHZ] = 3,
811	};
812	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
813	struct bss_rlm_tlv *ch;
814	struct tlv *tlv;
815	int freq1 = chandef->center_freq1;
816
817	tlv = mt7996_mcu_add_uni_tlv(skb, tag: UNI_BSS_INFO_RLM, len: sizeof(*ch));
818
819	ch = (struct bss_rlm_tlv *)tlv;
820	ch->control_channel = chandef->chan->hw_value;
821	ch->center_chan = ieee80211_frequency_to_channel(freq: freq1);
822	ch->bw = mt76_connac_chan_bw(chandef);
823	ch->tx_streams = hweight8(phy->mt76->antenna_mask);
824	ch->rx_streams = hweight8(phy->mt76->antenna_mask);
825	ch->band = rlm_ch_band[chandef->chan->band];
826
827	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
828	int freq2 = chandef->center_freq2;
829
830	ch->center_chan2 = ieee80211_frequency_to_channel(freq: freq2);
831	}
832	}
833
834	static void
835	mt7996_mcu_bss_ra_tlv(struct sk_buff *skb, struct mt7996_phy *phy)
836	{
837	struct bss_ra_tlv *ra;
838	struct tlv *tlv;
839
840	tlv = mt7996_mcu_add_uni_tlv(skb, tag: UNI_BSS_INFO_RA, len: sizeof(*ra));
841
842	ra = (struct bss_ra_tlv *)tlv;
843	ra->short_preamble = true;
844	}
845
846	static void
847	mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
848	struct ieee80211_bss_conf *link_conf,
849	struct mt7996_phy *phy)
850	{
851	#define DEFAULT_HE_PE_DURATION 4
852	#define DEFAULT_HE_DURATION_RTS_THRES 1023
853	const struct ieee80211_sta_he_cap *cap;
854	struct bss_info_uni_he *he;
855	struct tlv *tlv;
856
857	cap = mt76_connac_get_he_phy_cap(phy: phy->mt76, vif);
858
859	tlv = mt7996_mcu_add_uni_tlv(skb, tag: UNI_BSS_INFO_HE_BASIC, len: sizeof(*he));
860
861	he = (struct bss_info_uni_he *)tlv;
862	he->he_pe_duration = link_conf->htc_trig_based_pkt_ext;
863	if (!he->he_pe_duration)
864	he->he_pe_duration = DEFAULT_HE_PE_DURATION;
865
866	he->he_rts_thres = cpu_to_le16(link_conf->frame_time_rts_th);
867	if (!he->he_rts_thres)
868	he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
869
870	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
871	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
872	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
873	}
874
875	static void
876	mt7996_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
877	bool enable)
878	{
879	struct bss_info_uni_mbssid *mbssid;
880	struct tlv *tlv;
881
882	if (!link_conf->bssid_indicator && enable)
883	return;
884
885	tlv = mt7996_mcu_add_uni_tlv(skb, tag: UNI_BSS_INFO_11V_MBSSID, len: sizeof(*mbssid));
886
887	mbssid = (struct bss_info_uni_mbssid *)tlv;
888
889	if (enable) {
890	mbssid->max_indicator = link_conf->bssid_indicator;
891	mbssid->mbss_idx = link_conf->bssid_index;
892	mbssid->tx_bss_omac_idx = 0;
893	}
894	}
895
896	static void
897	mt7996_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt76_vif_link *mlink,
898	struct mt7996_phy *phy)
899	{
900	struct bss_rate_tlv *bmc;
901	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
902	enum nl80211_band band = chandef->chan->band;
903	struct tlv *tlv;
904	u8 idx = mlink->mcast_rates_idx ?
905	mlink->mcast_rates_idx : mlink->basic_rates_idx;
906
907	tlv = mt7996_mcu_add_uni_tlv(skb, tag: UNI_BSS_INFO_RATE, len: sizeof(*bmc));
908
909	bmc = (struct bss_rate_tlv *)tlv;
910
911	bmc->short_preamble = (band == NL80211_BAND_2GHZ);
912	bmc->bc_fixed_rate = idx;
913	bmc->mc_fixed_rate = idx;
914	}
915
916	static void
917	mt7996_mcu_bss_txcmd_tlv(struct sk_buff *skb, bool en)
918	{
919	struct bss_txcmd_tlv *txcmd;
920	struct tlv *tlv;
921
922	tlv = mt7996_mcu_add_uni_tlv(skb, tag: UNI_BSS_INFO_TXCMD, len: sizeof(*txcmd));
923
924	txcmd = (struct bss_txcmd_tlv *)tlv;
925	txcmd->txcmd_mode = en;
926	}
927
928	static void
929	mt7996_mcu_bss_mld_tlv(struct sk_buff *skb,
930	struct ieee80211_bss_conf *link_conf,
931	struct mt7996_vif_link *link)
932	{
933	struct ieee80211_vif *vif = link_conf->vif;
934	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
935	struct bss_mld_tlv *mld;
936	struct tlv *tlv;
937
938	tlv = mt7996_mcu_add_uni_tlv(skb, tag: UNI_BSS_INFO_MLD, len: sizeof(*mld));
939	mld = (struct bss_mld_tlv *)tlv;
940	mld->own_mld_id = link->mld_idx;
941	mld->link_id = link_conf->link_id;
942
943	if (ieee80211_vif_is_mld(vif)) {
944	mld->group_mld_id = mvif->mld_group_idx;
945	mld->remap_idx = mvif->mld_remap_idx;
946	memcpy(mld->mac_addr, vif->addr, ETH_ALEN);
947	} else {
948	mld->group_mld_id = 0xff;
949	mld->remap_idx = 0xff;
950	}
951	}
952
953	static void
954	mt7996_mcu_bss_sec_tlv(struct sk_buff *skb, struct mt76_vif_link *mlink)
955	{
956	struct bss_sec_tlv *sec;
957	struct tlv *tlv;
958
959	tlv = mt7996_mcu_add_uni_tlv(skb, tag: UNI_BSS_INFO_SEC, len: sizeof(*sec));
960
961	sec = (struct bss_sec_tlv *)tlv;
962	sec->cipher = mlink->cipher;
963	}
964
965	static int
966	mt7996_mcu_muar_config(struct mt7996_dev *dev, struct mt76_vif_link *mlink,
967	const u8 *addr, bool bssid, bool enable)
968	{
969	#define UNI_MUAR_ENTRY 2
970	u32 idx = mlink->omac_idx - REPEATER_BSSID_START;
971	struct {
972	struct {
973	u8 band;
974	u8 __rsv[3];
975	} hdr;
976
977	__le16 tag;
978	__le16 len;
979
980	bool smesh;
981	u8 bssid;
982	u8 index;
983	u8 entry_add;
984	u8 addr[ETH_ALEN];
985	u8 __rsv[2];
986	} __packed req = {
987	.hdr.band = mlink->band_idx,
988	.tag = cpu_to_le16(UNI_MUAR_ENTRY),
989	.len = cpu_to_le16(sizeof(req) - sizeof(req.hdr)),
990	.smesh = false,
991	.index = idx * 2 + bssid,
992	.entry_add = true,
993	};
994
995	if (enable)
996	memcpy(req.addr, addr, ETH_ALEN);
997
998	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(REPT_MUAR), data: &req,
999	len: sizeof(req), wait_resp: true);
1000	}
1001
1002	static void
1003	mt7996_mcu_bss_ifs_timing_tlv(struct sk_buff *skb, struct mt7996_phy *phy)
1004	{
1005	struct bss_ifs_time_tlv *ifs_time;
1006	struct tlv *tlv;
1007	bool is_2ghz = phy->mt76->chandef.chan->band == NL80211_BAND_2GHZ;
1008
1009	tlv = mt7996_mcu_add_uni_tlv(skb, tag: UNI_BSS_INFO_IFS_TIME, len: sizeof(*ifs_time));
1010
1011	ifs_time = (struct bss_ifs_time_tlv *)tlv;
1012	ifs_time->slot_valid = true;
1013	ifs_time->sifs_valid = true;
1014	ifs_time->rifs_valid = true;
1015	ifs_time->eifs_valid = true;
1016
1017	ifs_time->slot_time = cpu_to_le16(phy->slottime);
1018	ifs_time->sifs_time = cpu_to_le16(10);
1019	ifs_time->rifs_time = cpu_to_le16(2);
1020	ifs_time->eifs_time = cpu_to_le16(is_2ghz ? 78 : 84);
1021
1022	if (is_2ghz) {
1023	ifs_time->eifs_cck_valid = true;
1024	ifs_time->eifs_cck_time = cpu_to_le16(314);
1025	}
1026	}
1027
1028	static int
1029	mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
1030	struct ieee80211_vif *vif,
1031	struct ieee80211_bss_conf *link_conf,
1032	struct mt76_vif_link *mvif,
1033	struct mt76_phy *phy, u16 wlan_idx,
1034	bool enable)
1035	{
1036	struct cfg80211_chan_def *chandef = &phy->chandef;
1037	struct mt76_connac_bss_basic_tlv *bss;
1038	u32 type = CONNECTION_INFRA_AP;
1039	u16 sta_wlan_idx = wlan_idx;
1040	struct tlv *tlv;
1041	int idx;
1042
1043	switch (vif->type) {
1044	case NL80211_IFTYPE_MESH_POINT:
1045	case NL80211_IFTYPE_AP:
1046	case NL80211_IFTYPE_MONITOR:
1047	break;
1048	case NL80211_IFTYPE_STATION:
1049	if (enable) {
1050	struct ieee80211_sta *sta;
1051
1052	rcu_read_lock();
1053	sta = ieee80211_find_sta(vif, addr: link_conf->bssid);
1054	if (sta) {
1055	struct mt7996_sta *msta = (void *)sta->drv_priv;
1056	struct mt7996_sta_link *msta_link;
1057	int link_id = link_conf->link_id;
1058
1059	msta_link = rcu_dereference(msta->link[link_id]);
1060	if (msta_link)
1061	sta_wlan_idx = msta_link->wcid.idx;
1062	}
1063	rcu_read_unlock();
1064	}
1065	type = CONNECTION_INFRA_STA;
1066	break;
1067	case NL80211_IFTYPE_ADHOC:
1068	type = CONNECTION_IBSS_ADHOC;
1069	break;
1070	default:
1071	WARN_ON(1);
1072	break;
1073	}
1074
1075	tlv = mt7996_mcu_add_uni_tlv(skb, tag: UNI_BSS_INFO_BASIC, len: sizeof(*bss));
1076
1077	bss = (struct mt76_connac_bss_basic_tlv *)tlv;
1078	bss->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
1079	bss->sta_idx = cpu_to_le16(sta_wlan_idx);
1080	bss->conn_type = cpu_to_le32(type);
1081	bss->omac_idx = mvif->omac_idx;
1082	bss->band_idx = mvif->band_idx;
1083	bss->wmm_idx = mvif->wmm_idx;
1084	bss->conn_state = !enable;
1085	bss->active = enable;
1086
1087	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1088	bss->hw_bss_idx = idx;
1089
1090	if (vif->type == NL80211_IFTYPE_MONITOR) {
1091	memcpy(bss->bssid, phy->macaddr, ETH_ALEN);
1092	return 0;
1093	}
1094
1095	memcpy(bss->bssid, link_conf->bssid, ETH_ALEN);
1096	bss->bcn_interval = cpu_to_le16(link_conf->beacon_int);
1097	bss->dtim_period = link_conf->dtim_period;
1098	bss->phymode = mt76_connac_get_phy_mode(phy, vif,
1099	band: chandef->chan->band, NULL);
1100	bss->phymode_ext = mt76_connac_get_phy_mode_ext(phy, conf: link_conf,
1101	band: chandef->chan->band);
1102
1103	return 0;
1104	}
1105
1106	static struct sk_buff *
1107	__mt7996_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif_link *mvif, int len)
1108	{
1109	struct bss_req_hdr hdr = {
1110	.bss_idx = mvif->idx,
1111	};
1112	struct sk_buff *skb;
1113
1114	skb = mt76_mcu_msg_alloc(dev, NULL, data_len: len);
1115	if (!skb)
1116	return ERR_PTR(error: -ENOMEM);
1117
1118	skb_put_data(skb, data: &hdr, len: sizeof(hdr));
1119
1120	return skb;
1121	}
1122
1123	int mt7996_mcu_add_bss_info(struct mt7996_phy *phy, struct ieee80211_vif *vif,
1124	struct ieee80211_bss_conf *link_conf,
1125	struct mt76_vif_link *mlink,
1126	struct mt7996_sta_link *msta_link, int enable)
1127	{
1128	struct mt7996_dev *dev = phy->dev;
1129	struct sk_buff *skb;
1130
1131	if (mlink->omac_idx >= REPEATER_BSSID_START) {
1132	mt7996_mcu_muar_config(dev, mlink, addr: link_conf->addr, bssid: false, enable);
1133	mt7996_mcu_muar_config(dev, mlink, addr: link_conf->bssid, bssid: true, enable);
1134	}
1135
1136	skb = __mt7996_mcu_alloc_bss_req(dev: &dev->mt76, mvif: mlink,
1137	MT7996_BSS_UPDATE_MAX_SIZE);
1138	if (IS_ERR(ptr: skb))
1139	return PTR_ERR(ptr: skb);
1140
1141	/* bss_basic must be first */
1142	mt7996_mcu_bss_basic_tlv(skb, vif, link_conf, mvif: mlink, phy: phy->mt76,
1143	wlan_idx: msta_link->wcid.idx, enable);
1144	mt7996_mcu_bss_sec_tlv(skb, mlink);
1145
1146	if (vif->type == NL80211_IFTYPE_MONITOR)
1147	goto out;
1148
1149	if (enable) {
1150	struct mt7996_vif_link *link;
1151
1152	mt7996_mcu_bss_rfch_tlv(skb, phy);
1153	mt7996_mcu_bss_bmc_tlv(skb, mlink, phy);
1154	mt7996_mcu_bss_ra_tlv(skb, phy);
1155	mt7996_mcu_bss_txcmd_tlv(skb, en: true);
1156	mt7996_mcu_bss_ifs_timing_tlv(skb, phy);
1157
1158	if (vif->bss_conf.he_support)
1159	mt7996_mcu_bss_he_tlv(skb, vif, link_conf, phy);
1160
1161	/* this tag is necessary no matter if the vif is MLD */
1162	link = container_of(mlink, struct mt7996_vif_link, mt76);
1163	mt7996_mcu_bss_mld_tlv(skb, link_conf, link);
1164	}
1165
1166	mt7996_mcu_bss_mbssid_tlv(skb, link_conf, enable);
1167
1168	out:
1169	return mt76_mcu_skb_send_msg(dev: &dev->mt76, skb,
1170	MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), wait_resp: true);
1171	}
1172
1173	int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif,
1174	struct ieee80211_bss_conf *link_conf)
1175	{
1176	struct mt7996_dev *dev = phy->dev;
1177	struct mt76_vif_link *mlink = mt76_vif_conf_link(dev: &dev->mt76, vif, link_conf);
1178	struct sk_buff *skb;
1179
1180	skb = __mt7996_mcu_alloc_bss_req(dev: &dev->mt76, mvif: mlink,
1181	MT7996_BSS_UPDATE_MAX_SIZE);
1182	if (IS_ERR(ptr: skb))
1183	return PTR_ERR(ptr: skb);
1184
1185	mt7996_mcu_bss_ifs_timing_tlv(skb, phy);
1186
1187	return mt76_mcu_skb_send_msg(dev: &dev->mt76, skb,
1188	MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), wait_resp: true);
1189	}
1190
1191	static int
1192	mt7996_mcu_sta_ba(struct mt7996_dev *dev, struct mt76_vif_link *mvif,
1193	struct ieee80211_ampdu_params *params,
1194	struct mt76_wcid *wcid, bool enable, bool tx)
1195	{
1196	struct sta_rec_ba_uni *ba;
1197	struct sk_buff *skb;
1198	struct tlv *tlv;
1199
1200	skb = __mt76_connac_mcu_alloc_sta_req(dev: &dev->mt76, mvif, wcid,
1201	MT7996_STA_UPDATE_MAX_SIZE);
1202	if (IS_ERR(ptr: skb))
1203	return PTR_ERR(ptr: skb);
1204
1205	tlv = mt76_connac_mcu_add_tlv(skb, tag: STA_REC_BA, len: sizeof(*ba));
1206
1207	ba = (struct sta_rec_ba_uni *)tlv;
1208	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
1209	ba->winsize = cpu_to_le16(params->buf_size);
1210	ba->ssn = cpu_to_le16(params->ssn);
1211	ba->ba_en = enable << params->tid;
1212	ba->amsdu = params->amsdu;
1213	ba->tid = params->tid;
1214	ba->ba_rdd_rro = !tx && enable && mt7996_has_hwrro(dev);
1215
1216	return mt76_mcu_skb_send_msg(dev: &dev->mt76, skb,
1217	MCU_WMWA_UNI_CMD(STA_REC_UPDATE), wait_resp: true);
1218	}
1219
1220	/** starec & wtbl **/
1221	int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
1222	struct ieee80211_ampdu_params *params,
1223	struct ieee80211_vif *vif, bool enable)
1224	{
1225	struct ieee80211_sta *sta = params->sta;
1226	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
1227	struct ieee80211_link_sta *link_sta;
1228	unsigned int link_id;
1229	int ret = 0;
1230
1231	for_each_sta_active_link(vif, sta, link_sta, link_id) {
1232	struct mt7996_sta_link *msta_link;
1233	struct mt7996_vif_link *link;
1234
1235	msta_link = mt76_dereference(msta->link[link_id], &dev->mt76);
1236	if (!msta_link)
1237	continue;
1238
1239	link = mt7996_vif_link(dev, vif, link_id);
1240	if (!link)
1241	continue;
1242
1243	if (enable && !params->amsdu)
1244	msta_link->wcid.amsdu = false;
1245
1246	ret = mt7996_mcu_sta_ba(dev, mvif: &link->mt76, params,
1247	wcid: &msta_link->wcid, enable, tx: true);
1248	if (ret)
1249	break;
1250	}
1251
1252	return ret;
1253	}
1254
1255	int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
1256	struct ieee80211_ampdu_params *params,
1257	struct ieee80211_vif *vif, bool enable)
1258	{
1259	struct ieee80211_sta *sta = params->sta;
1260	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
1261	struct ieee80211_link_sta *link_sta;
1262	unsigned int link_id;
1263	int ret = 0;
1264
1265	for_each_sta_active_link(vif, sta, link_sta, link_id) {
1266	struct mt7996_sta_link *msta_link;
1267	struct mt7996_vif_link *link;
1268
1269	msta_link = mt76_dereference(msta->link[link_id], &dev->mt76);
1270	if (!msta_link)
1271	continue;
1272
1273	link = mt7996_vif_link(dev, vif, link_id);
1274	if (!link)
1275	continue;
1276
1277	ret = mt7996_mcu_sta_ba(dev, mvif: &link->mt76, params,
1278	wcid: &msta_link->wcid, enable, tx: false);
1279	if (ret)
1280	break;
1281	}
1282
1283	return ret;
1284	}
1285
1286	static void
1287	mt7996_mcu_sta_he_tlv(struct sk_buff *skb,
1288	struct ieee80211_link_sta *link_sta,
1289	struct mt7996_vif_link *link)
1290	{
1291	struct ieee80211_he_cap_elem *elem = &link_sta->he_cap.he_cap_elem;
1292	struct ieee80211_he_mcs_nss_supp mcs_map;
1293	struct sta_rec_he_v2 *he;
1294	struct tlv *tlv;
1295	int i = 0;
1296
1297	if (!link_sta->he_cap.has_he)
1298	return;
1299
1300	tlv = mt76_connac_mcu_add_tlv(skb, tag: STA_REC_HE_V2, len: sizeof(*he));
1301
1302	he = (struct sta_rec_he_v2 *)tlv;
1303	for (i = 0; i < 11; i++) {
1304	if (i < 6)
1305	he->he_mac_cap[i] = elem->mac_cap_info[i];
1306	he->he_phy_cap[i] = elem->phy_cap_info[i];
1307	}
1308
1309	mcs_map = link_sta->he_cap.he_mcs_nss_supp;
1310	switch (link_sta->bandwidth) {
1311	case IEEE80211_STA_RX_BW_160:
1312	if (elem->phy_cap_info[0] &
1313	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
1314	mt7996_mcu_set_sta_he_mcs(link_sta, link,
1315	he_mcs: &he->max_nss_mcs[CMD_HE_MCS_BW8080],
1316	le16_to_cpu(mcs_map.rx_mcs_80p80));
1317
1318	mt7996_mcu_set_sta_he_mcs(link_sta, link,
1319	he_mcs: &he->max_nss_mcs[CMD_HE_MCS_BW160],
1320	le16_to_cpu(mcs_map.rx_mcs_160));
1321	fallthrough;
1322	default:
1323	mt7996_mcu_set_sta_he_mcs(link_sta, link,
1324	he_mcs: &he->max_nss_mcs[CMD_HE_MCS_BW80],
1325	le16_to_cpu(mcs_map.rx_mcs_80));
1326	break;
1327	}
1328
1329	he->pkt_ext = 2;
1330	}
1331
1332	static void
1333	mt7996_mcu_sta_he_6g_tlv(struct sk_buff *skb,
1334	struct ieee80211_link_sta *link_sta)
1335	{
1336	struct sta_rec_he_6g_capa *he_6g;
1337	struct tlv *tlv;
1338
1339	if (!link_sta->he_6ghz_capa.capa)
1340	return;
1341
1342	tlv = mt76_connac_mcu_add_tlv(skb, tag: STA_REC_HE_6G, len: sizeof(*he_6g));
1343
1344	he_6g = (struct sta_rec_he_6g_capa *)tlv;
1345	he_6g->capa = link_sta->he_6ghz_capa.capa;
1346	}
1347
1348	static void
1349	mt7996_mcu_sta_eht_tlv(struct sk_buff *skb,
1350	struct ieee80211_link_sta *link_sta)
1351	{
1352	struct mt7996_sta *msta = (struct mt7996_sta *)link_sta->sta->drv_priv;
1353	struct ieee80211_vif *vif = container_of((void *)msta->vif,
1354	struct ieee80211_vif, drv_priv);
1355	struct ieee80211_eht_mcs_nss_supp *mcs_map;
1356	struct ieee80211_eht_cap_elem_fixed *elem;
1357	struct sta_rec_eht *eht;
1358	struct tlv *tlv;
1359
1360	if (!link_sta->eht_cap.has_eht)
1361	return;
1362
1363	mcs_map = &link_sta->eht_cap.eht_mcs_nss_supp;
1364	elem = &link_sta->eht_cap.eht_cap_elem;
1365
1366	tlv = mt76_connac_mcu_add_tlv(skb, tag: STA_REC_EHT, len: sizeof(*eht));
1367
1368	eht = (struct sta_rec_eht *)tlv;
1369	eht->tid_bitmap = 0xff;
1370	eht->mac_cap = cpu_to_le16(*(u16 *)elem->mac_cap_info);
1371	eht->phy_cap = cpu_to_le64(*(u64 *)elem->phy_cap_info);
1372	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
1373
1374	if (vif->type != NL80211_IFTYPE_STATION &&
1375	(link_sta->he_cap.he_cap_elem.phy_cap_info[0] &
1376	(IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G |
1377	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
1378	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
1379	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)) == 0) {
1380	memcpy(eht->mcs_map_bw20, &mcs_map->only_20mhz,
1381	sizeof(eht->mcs_map_bw20));
1382	return;
1383	}
1384
1385	memcpy(eht->mcs_map_bw80, &mcs_map->bw._80, sizeof(eht->mcs_map_bw80));
1386	memcpy(eht->mcs_map_bw160, &mcs_map->bw._160, sizeof(eht->mcs_map_bw160));
1387	memcpy(eht->mcs_map_bw320, &mcs_map->bw._320, sizeof(eht->mcs_map_bw320));
1388	}
1389
1390	static void
1391	mt7996_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1392	{
1393	struct sta_rec_ht_uni *ht;
1394	struct tlv *tlv;
1395
1396	if (!link_sta->ht_cap.ht_supported)
1397	return;
1398
1399	tlv = mt76_connac_mcu_add_tlv(skb, tag: STA_REC_HT, len: sizeof(*ht));
1400
1401	ht = (struct sta_rec_ht_uni *)tlv;
1402	ht->ht_cap = cpu_to_le16(link_sta->ht_cap.cap);
1403	ht->ampdu_param = u8_encode_bits(v: link_sta->ht_cap.ampdu_factor,
1404	IEEE80211_HT_AMPDU_PARM_FACTOR) |
1405	u8_encode_bits(v: link_sta->ht_cap.ampdu_density,
1406	IEEE80211_HT_AMPDU_PARM_DENSITY);
1407	}
1408
1409	static void
1410	mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1411	{
1412	struct sta_rec_vht *vht;
1413	struct tlv *tlv;
1414
1415	/* For 6G band, this tlv is necessary to let hw work normally */
1416	if (!link_sta->he_6ghz_capa.capa && !link_sta->vht_cap.vht_supported)
1417	return;
1418
1419	tlv = mt76_connac_mcu_add_tlv(skb, tag: STA_REC_VHT, len: sizeof(*vht));
1420
1421	vht = (struct sta_rec_vht *)tlv;
1422	vht->vht_cap = cpu_to_le32(link_sta->vht_cap.cap);
1423	vht->vht_rx_mcs_map = link_sta->vht_cap.vht_mcs.rx_mcs_map;
1424	vht->vht_tx_mcs_map = link_sta->vht_cap.vht_mcs.tx_mcs_map;
1425	}
1426
1427	static void
1428	mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
1429	struct ieee80211_vif *vif,
1430	struct ieee80211_link_sta *link_sta,
1431	struct mt7996_sta_link *msta_link)
1432	{
1433	struct sta_rec_amsdu *amsdu;
1434	struct tlv *tlv;
1435
1436	if (vif->type != NL80211_IFTYPE_STATION &&
1437	vif->type != NL80211_IFTYPE_MESH_POINT &&
1438	vif->type != NL80211_IFTYPE_AP)
1439	return;
1440
1441	if (!link_sta->agg.max_amsdu_len)
1442	return;
1443
1444	tlv = mt76_connac_mcu_add_tlv(skb, tag: STA_REC_HW_AMSDU, len: sizeof(*amsdu));
1445	amsdu = (struct sta_rec_amsdu *)tlv;
1446	amsdu->max_amsdu_num = 8;
1447	amsdu->amsdu_en = true;
1448	msta_link->wcid.amsdu = true;
1449
1450	switch (link_sta->agg.max_amsdu_len) {
1451	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1452	amsdu->max_mpdu_size =
1453	IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1454	return;
1455	case IEEE80211_MAX_MPDU_LEN_HT_7935:
1456	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1457	amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1458	return;
1459	default:
1460	amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1461	return;
1462	}
1463	}
1464
1465	static void
1466	mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
1467	struct ieee80211_bss_conf *link_conf,
1468	struct ieee80211_link_sta *link_sta)
1469	{
1470	struct ieee80211_he_cap_elem *elem = &link_sta->he_cap.he_cap_elem;
1471	struct sta_rec_muru *muru;
1472	struct tlv *tlv;
1473
1474	if (link_conf->vif->type != NL80211_IFTYPE_STATION &&
1475	link_conf->vif->type != NL80211_IFTYPE_AP)
1476	return;
1477
1478	tlv = mt76_connac_mcu_add_tlv(skb, tag: STA_REC_MURU, len: sizeof(*muru));
1479
1480	muru = (struct sta_rec_muru *)tlv;
1481	muru->cfg.mimo_dl_en = link_conf->eht_mu_beamformer ||
1482	link_conf->he_mu_beamformer ||
1483	link_conf->vht_mu_beamformer ||
1484	link_conf->vht_mu_beamformee;
1485	muru->cfg.ofdma_dl_en = true;
1486
1487	if (link_sta->vht_cap.vht_supported)
1488	muru->mimo_dl.vht_mu_bfee =
1489	!!(link_sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
1490
1491	if (!link_sta->he_cap.has_he)
1492	return;
1493
1494	muru->mimo_dl.partial_bw_dl_mimo =
1495	HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
1496
1497	muru->mimo_ul.full_ul_mimo =
1498	HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
1499	muru->mimo_ul.partial_ul_mimo =
1500	HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
1501
1502	muru->ofdma_dl.punc_pream_rx =
1503	HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
1504	muru->ofdma_dl.he_20m_in_40m_2g =
1505	HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
1506	muru->ofdma_dl.he_20m_in_160m =
1507	HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1508	muru->ofdma_dl.he_80m_in_160m =
1509	HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
1510
1511	muru->ofdma_ul.t_frame_dur =
1512	HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
1513	muru->ofdma_ul.mu_cascading =
1514	HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
1515	muru->ofdma_ul.uo_ra =
1516	HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
1517	muru->ofdma_ul.rx_ctrl_frame_to_mbss =
1518	HE_MAC(CAP3_RX_CTRL_FRAME_TO_MULTIBSS, elem->mac_cap_info[3]);
1519	}
1520
1521	static inline bool
1522	mt7996_is_ebf_supported(struct mt7996_phy *phy,
1523	struct ieee80211_bss_conf *link_conf,
1524	struct ieee80211_link_sta *link_sta, bool bfee)
1525	{
1526	int sts = hweight16(phy->mt76->chainmask);
1527
1528	if (link_conf->vif->type != NL80211_IFTYPE_STATION &&
1529	link_conf->vif->type != NL80211_IFTYPE_AP)
1530	return false;
1531
1532	if (!bfee && sts < 2)
1533	return false;
1534
1535	if (link_sta->eht_cap.has_eht) {
1536	struct ieee80211_sta_eht_cap *pc = &link_sta->eht_cap;
1537	struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
1538
1539	if (bfee)
1540	return link_conf->eht_su_beamformee &&
1541	EHT_PHY(CAP0_SU_BEAMFORMER, pe->phy_cap_info[0]);
1542	else
1543	return link_conf->eht_su_beamformer &&
1544	EHT_PHY(CAP0_SU_BEAMFORMEE, pe->phy_cap_info[0]);
1545	}
1546
1547	if (link_sta->he_cap.has_he) {
1548	struct ieee80211_he_cap_elem *pe = &link_sta->he_cap.he_cap_elem;
1549
1550	if (bfee)
1551	return link_conf->he_su_beamformee &&
1552	HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
1553	else
1554	return link_conf->he_su_beamformer &&
1555	HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
1556	}
1557
1558	if (link_sta->vht_cap.vht_supported) {
1559	u32 cap = link_sta->vht_cap.cap;
1560
1561	if (bfee)
1562	return link_conf->vht_su_beamformee &&
1563	(cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
1564	else
1565	return link_conf->vht_su_beamformer &&
1566	(cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
1567	}
1568
1569	return false;
1570	}
1571
1572	static void
1573	mt7996_mcu_sta_sounding_rate(struct sta_rec_bf *bf, struct mt7996_phy *phy)
1574	{
1575	bf->sounding_phy = MT_PHY_TYPE_OFDM;
1576	bf->ndp_rate = 0; /* mcs0 */
1577	if (is_mt7996(dev: phy->mt76->dev))
1578	bf->ndpa_rate = MT7996_CFEND_RATE_DEFAULT; /* ofdm 24m */
1579	else
1580	bf->ndpa_rate = MT7992_CFEND_RATE_DEFAULT; /* ofdm 6m */
1581
1582	bf->rept_poll_rate = MT7996_CFEND_RATE_DEFAULT; /* ofdm 24m */
1583	}
1584
1585	static void
1586	mt7996_mcu_sta_bfer_ht(struct ieee80211_link_sta *link_sta,
1587	struct mt7996_phy *phy, struct sta_rec_bf *bf,
1588	bool explicit)
1589	{
1590	struct ieee80211_mcs_info *mcs = &link_sta->ht_cap.mcs;
1591	u8 n = 0;
1592
1593	bf->tx_mode = MT_PHY_TYPE_HT;
1594
1595	if ((mcs->tx_params & IEEE80211_HT_MCS_TX_RX_DIFF) &&
1596	(mcs->tx_params & IEEE80211_HT_MCS_TX_DEFINED))
1597	n = FIELD_GET(IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK,
1598	mcs->tx_params);
1599	else if (mcs->rx_mask[3])
1600	n = 3;
1601	else if (mcs->rx_mask[2])
1602	n = 2;
1603	else if (mcs->rx_mask[1])
1604	n = 1;
1605
1606	bf->nrow = hweight8(phy->mt76->antenna_mask) - 1;
1607	bf->ncol = min_t(u8, bf->nrow, n);
1608	bf->ibf_ncol = explicit ? min_t(u8, MT7996_IBF_MAX_NC, bf->ncol) :
1609	min_t(u8, MT7996_IBF_MAX_NC, n);
1610	}
1611
1612	static void
1613	mt7996_mcu_sta_bfer_vht(struct ieee80211_link_sta *link_sta,
1614	struct mt7996_phy *phy, struct sta_rec_bf *bf,
1615	bool explicit)
1616	{
1617	struct ieee80211_sta_vht_cap *pc = &link_sta->vht_cap;
1618	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
1619	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
1620	u8 nss_mcs = mt7996_mcu_get_sta_nss(mcs_map);
1621	u8 tx_ant = hweight8(phy->mt76->antenna_mask) - 1;
1622
1623	bf->tx_mode = MT_PHY_TYPE_VHT;
1624
1625	if (explicit) {
1626	u8 sts, snd_dim;
1627
1628	mt7996_mcu_sta_sounding_rate(bf, phy);
1629
1630	sts = FIELD_GET(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK,
1631	pc->cap);
1632	snd_dim = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1633	vc->cap);
1634	bf->nrow = min_t(u8, min_t(u8, snd_dim, sts), tx_ant);
1635	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1636	bf->ibf_ncol = min_t(u8, MT7996_IBF_MAX_NC, bf->ncol);
1637
1638	if (link_sta->bandwidth == IEEE80211_STA_RX_BW_160)
1639	bf->nrow = 1;
1640	} else {
1641	bf->nrow = tx_ant;
1642	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1643	bf->ibf_ncol = min_t(u8, MT7996_IBF_MAX_NC, nss_mcs);
1644
1645	if (link_sta->bandwidth == IEEE80211_STA_RX_BW_160)
1646	bf->ibf_nrow = 1;
1647	}
1648	}
1649
1650	static void
1651	mt7996_mcu_sta_bfer_he(struct ieee80211_link_sta *link_sta,
1652	struct ieee80211_vif *vif, struct mt7996_phy *phy,
1653	struct sta_rec_bf *bf, bool explicit)
1654	{
1655	struct ieee80211_sta_he_cap *pc = &link_sta->he_cap;
1656	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
1657	const struct ieee80211_sta_he_cap *vc =
1658	mt76_connac_get_he_phy_cap(phy: phy->mt76, vif);
1659	const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
1660	u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
1661	u8 nss_mcs = mt7996_mcu_get_sta_nss(mcs_map);
1662	u8 snd_dim, sts;
1663
1664	if (!vc)
1665	return;
1666
1667	bf->tx_mode = MT_PHY_TYPE_HE_SU;
1668
1669	mt7996_mcu_sta_sounding_rate(bf, phy);
1670
1671	bf->trigger_su = HE_PHY(CAP6_TRIG_SU_BEAMFORMING_FB,
1672	pe->phy_cap_info[6]);
1673	bf->trigger_mu = HE_PHY(CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
1674	pe->phy_cap_info[6]);
1675	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1676	ve->phy_cap_info[5]);
1677	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK,
1678	pe->phy_cap_info[4]);
1679	bf->nrow = min_t(u8, snd_dim, sts);
1680	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1681	bf->ibf_ncol = explicit ? min_t(u8, MT7996_IBF_MAX_NC, bf->ncol) :
1682	min_t(u8, MT7996_IBF_MAX_NC, nss_mcs);
1683
1684	if (link_sta->bandwidth != IEEE80211_STA_RX_BW_160)
1685	return;
1686
1687	/* go over for 160MHz and 80p80 */
1688	if (pe->phy_cap_info[0] &
1689	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G) {
1690	mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
1691	nss_mcs = mt7996_mcu_get_sta_nss(mcs_map);
1692
1693	bf->ncol_gt_bw80 = nss_mcs;
1694	}
1695
1696	if (pe->phy_cap_info[0] &
1697	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
1698	mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
1699	nss_mcs = mt7996_mcu_get_sta_nss(mcs_map);
1700
1701	if (bf->ncol_gt_bw80)
1702	bf->ncol_gt_bw80 = min_t(u8, bf->ncol_gt_bw80, nss_mcs);
1703	else
1704	bf->ncol_gt_bw80 = nss_mcs;
1705	}
1706
1707	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
1708	ve->phy_cap_info[5]);
1709	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
1710	pe->phy_cap_info[4]);
1711
1712	bf->nrow_gt_bw80 = min_t(int, snd_dim, sts);
1713	}
1714
1715	static void
1716	mt7996_mcu_sta_bfer_eht(struct ieee80211_link_sta *link_sta,
1717	struct ieee80211_vif *vif, struct mt7996_phy *phy,
1718	struct sta_rec_bf *bf, bool explicit)
1719	{
1720	struct ieee80211_sta_eht_cap *pc = &link_sta->eht_cap;
1721	struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
1722	struct ieee80211_eht_mcs_nss_supp *eht_nss = &pc->eht_mcs_nss_supp;
1723	const struct ieee80211_sta_eht_cap *vc =
1724	mt76_connac_get_eht_phy_cap(phy: phy->mt76, vif);
1725	const struct ieee80211_eht_cap_elem_fixed *ve = &vc->eht_cap_elem;
1726	u8 nss_mcs = u8_get_bits(v: eht_nss->bw._80.rx_tx_mcs9_max_nss,
1727	IEEE80211_EHT_MCS_NSS_RX) - 1;
1728	u8 snd_dim, sts;
1729
1730	bf->tx_mode = MT_PHY_TYPE_EHT_MU;
1731
1732	mt7996_mcu_sta_sounding_rate(bf, phy);
1733
1734	bf->trigger_su = EHT_PHY(CAP3_TRIG_SU_BF_FDBK, pe->phy_cap_info[3]);
1735	bf->trigger_mu = EHT_PHY(CAP3_TRIG_MU_BF_PART_BW_FDBK, pe->phy_cap_info[3]);
1736	snd_dim = EHT_PHY(CAP2_SOUNDING_DIM_80MHZ_MASK, ve->phy_cap_info[2]);
1737	sts = EHT_PHY(CAP0_BEAMFORMEE_SS_80MHZ_MASK, pe->phy_cap_info[0]) +
1738	(EHT_PHY(CAP1_BEAMFORMEE_SS_80MHZ_MASK, pe->phy_cap_info[1]) << 1);
1739	bf->nrow = min_t(u8, snd_dim, sts);
1740	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
1741	bf->ibf_ncol = explicit ? min_t(u8, MT7996_IBF_MAX_NC, bf->ncol) :
1742	min_t(u8, MT7996_IBF_MAX_NC, nss_mcs);
1743
1744	if (link_sta->bandwidth < IEEE80211_STA_RX_BW_160)
1745	return;
1746
1747	switch (link_sta->bandwidth) {
1748	case IEEE80211_STA_RX_BW_160:
1749	snd_dim = EHT_PHY(CAP2_SOUNDING_DIM_160MHZ_MASK, ve->phy_cap_info[2]);
1750	sts = EHT_PHY(CAP1_BEAMFORMEE_SS_160MHZ_MASK, pe->phy_cap_info[1]);
1751	nss_mcs = u8_get_bits(v: eht_nss->bw._160.rx_tx_mcs9_max_nss,
1752	IEEE80211_EHT_MCS_NSS_RX) - 1;
1753
1754	bf->nrow_gt_bw80 = min_t(u8, snd_dim, sts);
1755	bf->ncol_gt_bw80 = nss_mcs;
1756	break;
1757	case IEEE80211_STA_RX_BW_320:
1758	snd_dim = EHT_PHY(CAP2_SOUNDING_DIM_320MHZ_MASK, ve->phy_cap_info[2]) +
1759	(EHT_PHY(CAP3_SOUNDING_DIM_320MHZ_MASK,
1760	ve->phy_cap_info[3]) << 1);
1761	sts = EHT_PHY(CAP1_BEAMFORMEE_SS_320MHZ_MASK, pe->phy_cap_info[1]);
1762	nss_mcs = u8_get_bits(v: eht_nss->bw._320.rx_tx_mcs9_max_nss,
1763	IEEE80211_EHT_MCS_NSS_RX) - 1;
1764
1765	bf->nrow_gt_bw80 = min_t(u8, snd_dim, sts) << 4;
1766	bf->ncol_gt_bw80 = nss_mcs << 4;
1767	break;
1768	default:
1769	break;
1770	}
1771	}
1772
1773	static void
1774	mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
1775	struct ieee80211_bss_conf *link_conf,
1776	struct ieee80211_link_sta *link_sta,
1777	struct mt7996_vif_link *link)
1778	{
1779	#define EBF_MODE BIT(0)
1780	#define IBF_MODE BIT(1)
1781	#define BF_MAT_ORDER 4
1782	struct ieee80211_vif *vif = link_conf->vif;
1783	struct mt7996_phy *phy = link->phy;
1784	int tx_ant = hweight16(phy->mt76->chainmask) - 1;
1785	struct sta_rec_bf *bf;
1786	struct tlv *tlv;
1787	static const u8 matrix[BF_MAT_ORDER][BF_MAT_ORDER] = {
1788	{0, 0, 0, 0},
1789	{1, 1, 0, 0}, /* 2x1, 2x2, 2x3, 2x4 */
1790	{2, 4, 4, 0}, /* 3x1, 3x2, 3x3, 3x4 */
1791	{3, 5, 6, 0} /* 4x1, 4x2, 4x3, 4x4 */
1792	};
1793	bool ebf;
1794
1795	if (!(link_sta->ht_cap.ht_supported || link_sta->he_cap.has_he))
1796	return;
1797
1798	ebf = mt7996_is_ebf_supported(phy, link_conf, link_sta, bfee: false);
1799	if (!ebf && !dev->ibf)
1800	return;
1801
1802	tlv = mt76_connac_mcu_add_tlv(skb, tag: STA_REC_BF, len: sizeof(*bf));
1803	bf = (struct sta_rec_bf *)tlv;
1804
1805	/* he/eht: eBF only, except mt7992 that has 5T on 5GHz also supports iBF
1806	* vht: support eBF and iBF
1807	* ht: iBF only, since mac80211 lacks of eBF support
1808	*/
1809	if (link_sta->eht_cap.has_eht)
1810	mt7996_mcu_sta_bfer_eht(link_sta, vif, phy: link->phy, bf, explicit: ebf);
1811	else if (link_sta->he_cap.has_he)
1812	mt7996_mcu_sta_bfer_he(link_sta, vif, phy: link->phy, bf, explicit: ebf);
1813	else if (link_sta->vht_cap.vht_supported)
1814	mt7996_mcu_sta_bfer_vht(link_sta, phy: link->phy, bf, explicit: ebf);
1815	else if (link_sta->ht_cap.ht_supported)
1816	mt7996_mcu_sta_bfer_ht(link_sta, phy: link->phy, bf, explicit: ebf);
1817	else
1818	return;
1819
1820	bf->bf_cap = ebf ? EBF_MODE : (dev->ibf ? IBF_MODE : 0);
1821	if (is_mt7992(dev: &dev->mt76) && tx_ant == 4)
1822	bf->bf_cap |= IBF_MODE;
1823
1824	bf->bw = link_sta->bandwidth;
1825	bf->ibf_dbw = link_sta->bandwidth;
1826	bf->ibf_nrow = tx_ant;
1827
1828	if (link_sta->eht_cap.has_eht || link_sta->he_cap.has_he)
1829	bf->ibf_timeout = is_mt7992(dev: &dev->mt76) ? MT7992_IBF_TIMEOUT :
1830	MT7996_IBF_TIMEOUT;
1831	else if (!ebf && link_sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
1832	bf->ibf_timeout = MT7996_IBF_TIMEOUT_LEGACY;
1833	else
1834	bf->ibf_timeout = MT7996_IBF_TIMEOUT;
1835
1836	if (bf->ncol < BF_MAT_ORDER) {
1837	if (ebf)
1838	bf->mem_20m = tx_ant < BF_MAT_ORDER ?
1839	matrix[tx_ant][bf->ncol] : 0;
1840	else
1841	bf->mem_20m = bf->nrow < BF_MAT_ORDER ?
1842	matrix[bf->nrow][bf->ncol] : 0;
1843	}
1844	}
1845
1846	static void
1847	mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
1848	struct ieee80211_bss_conf *link_conf,
1849	struct ieee80211_link_sta *link_sta,
1850	struct mt7996_vif_link *link)
1851	{
1852	struct mt7996_phy *phy = link->phy;
1853	int tx_ant = hweight8(phy->mt76->antenna_mask) - 1;
1854	struct sta_rec_bfee *bfee;
1855	struct tlv *tlv;
1856	u8 nrow = 0;
1857
1858	if (!(link_sta->vht_cap.vht_supported || link_sta->he_cap.has_he))
1859	return;
1860
1861	if (!mt7996_is_ebf_supported(phy, link_conf, link_sta, bfee: true))
1862	return;
1863
1864	tlv = mt76_connac_mcu_add_tlv(skb, tag: STA_REC_BFEE, len: sizeof(*bfee));
1865	bfee = (struct sta_rec_bfee *)tlv;
1866
1867	if (link_sta->he_cap.has_he) {
1868	struct ieee80211_he_cap_elem *pe = &link_sta->he_cap.he_cap_elem;
1869
1870	nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
1871	pe->phy_cap_info[5]);
1872	} else if (link_sta->vht_cap.vht_supported) {
1873	struct ieee80211_sta_vht_cap *pc = &link_sta->vht_cap;
1874
1875	nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
1876	pc->cap);
1877	}
1878
1879	/* reply with identity matrix to avoid 2x2 BF negative gain */
1880	bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
1881	}
1882
1883	static void
1884	mt7996_mcu_sta_tx_proc_tlv(struct sk_buff *skb)
1885	{
1886	struct sta_rec_tx_proc *tx_proc;
1887	struct tlv *tlv;
1888
1889	tlv = mt76_connac_mcu_add_tlv(skb, tag: STA_REC_TX_PROC, len: sizeof(*tx_proc));
1890
1891	tx_proc = (struct sta_rec_tx_proc *)tlv;
1892	tx_proc->flag = cpu_to_le32(0);
1893	}
1894
1895	static void
1896	mt7996_mcu_sta_hdrt_tlv(struct mt7996_dev *dev, struct sk_buff *skb)
1897	{
1898	struct sta_rec_hdrt *hdrt;
1899	struct tlv *tlv;
1900
1901	tlv = mt76_connac_mcu_add_tlv(skb, tag: STA_REC_HDRT, len: sizeof(*hdrt));
1902
1903	hdrt = (struct sta_rec_hdrt *)tlv;
1904	hdrt->hdrt_mode = 1;
1905	}
1906
1907	static void
1908	mt7996_mcu_sta_hdr_trans_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
1909	struct ieee80211_vif *vif, struct mt76_wcid *wcid)
1910	{
1911	struct sta_rec_hdr_trans *hdr_trans;
1912	struct tlv *tlv;
1913
1914	tlv = mt76_connac_mcu_add_tlv(skb, tag: STA_REC_HDR_TRANS, len: sizeof(*hdr_trans));
1915	hdr_trans = (struct sta_rec_hdr_trans *)tlv;
1916	hdr_trans->dis_rx_hdr_tran = true;
1917
1918	if (vif->type == NL80211_IFTYPE_STATION)
1919	hdr_trans->to_ds = true;
1920	else
1921	hdr_trans->from_ds = true;
1922
1923	if (!wcid)
1924	return;
1925
1926	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
1927	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
1928	hdr_trans->to_ds = true;
1929	hdr_trans->from_ds = true;
1930	}
1931
1932	if (vif->type == NL80211_IFTYPE_MESH_POINT) {
1933	hdr_trans->to_ds = true;
1934	hdr_trans->from_ds = true;
1935	hdr_trans->mesh = true;
1936	}
1937	}
1938
1939	static enum mcu_mmps_mode
1940	mt7996_mcu_get_mmps_mode(enum ieee80211_smps_mode smps)
1941	{
1942	switch (smps) {
1943	case IEEE80211_SMPS_OFF:
1944	return MCU_MMPS_DISABLE;
1945	case IEEE80211_SMPS_STATIC:
1946	return MCU_MMPS_STATIC;
1947	case IEEE80211_SMPS_DYNAMIC:
1948	return MCU_MMPS_DYNAMIC;
1949	default:
1950	return MCU_MMPS_DISABLE;
1951	}
1952	}
1953
1954	int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
1955	void *data, u16 version)
1956	{
1957	struct uni_header hdr = {};
1958	struct ra_fixed_rate *req;
1959	struct sk_buff *skb;
1960	struct tlv *tlv;
1961	int len;
1962
1963	len = sizeof(hdr) + sizeof(*req);
1964
1965	skb = mt76_mcu_msg_alloc(dev: &dev->mt76, NULL, data_len: len);
1966	if (!skb)
1967	return -ENOMEM;
1968
1969	skb_put_data(skb, data: &hdr, len: sizeof(hdr));
1970
1971	tlv = mt7996_mcu_add_uni_tlv(skb, tag: UNI_RA_FIXED_RATE, len: sizeof(*req));
1972	req = (struct ra_fixed_rate *)tlv;
1973	req->version = cpu_to_le16(version);
1974	memcpy(&req->rate, data, sizeof(req->rate));
1975
1976	return mt76_mcu_skb_send_msg(dev: &dev->mt76, skb,
1977	MCU_WM_UNI_CMD(RA), wait_resp: true);
1978	}
1979
1980	int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct mt7996_sta *msta,
1981	void *data, u8 link_id, u32 field)
1982	{
1983	struct mt7996_vif *mvif = msta->vif;
1984	struct mt7996_sta_link *msta_link;
1985	struct sta_rec_ra_fixed_uni *ra;
1986	struct sta_phy_uni *phy = data;
1987	struct mt76_vif_link *mlink;
1988	struct sk_buff *skb;
1989	int err = -ENODEV;
1990	struct tlv *tlv;
1991
1992	rcu_read_lock();
1993
1994	mlink = rcu_dereference(mvif->mt76.link[link_id]);
1995	if (!mlink)
1996	goto error_unlock;
1997
1998	msta_link = rcu_dereference(msta->link[link_id]);
1999	if (!msta_link)
2000	goto error_unlock;
2001
2002	skb = __mt76_connac_mcu_alloc_sta_req(dev: &dev->mt76, mvif: mlink,
2003	wcid: &msta_link->wcid,
2004	MT7996_STA_UPDATE_MAX_SIZE);
2005	if (IS_ERR(ptr: skb)) {
2006	err = PTR_ERR(ptr: skb);
2007	goto error_unlock;
2008	}
2009
2010	tlv = mt76_connac_mcu_add_tlv(skb, tag: STA_REC_RA_UPDATE, len: sizeof(*ra));
2011	ra = (struct sta_rec_ra_fixed_uni *)tlv;
2012
2013	switch (field) {
2014	case RATE_PARAM_AUTO:
2015	break;
2016	case RATE_PARAM_FIXED:
2017	case RATE_PARAM_FIXED_MCS:
2018	case RATE_PARAM_FIXED_GI:
2019	case RATE_PARAM_FIXED_HE_LTF:
2020	if (phy)
2021	ra->phy = *phy;
2022	break;
2023	case RATE_PARAM_MMPS_UPDATE: {
2024	struct ieee80211_sta *sta = wcid_to_sta(wcid: &msta_link->wcid);
2025	struct ieee80211_link_sta *link_sta;
2026
2027	link_sta = rcu_dereference(sta->link[link_id]);
2028	if (!link_sta) {
2029	dev_kfree_skb(skb);
2030	goto error_unlock;
2031	}
2032
2033	ra->mmps_mode = mt7996_mcu_get_mmps_mode(smps: link_sta->smps_mode);
2034	break;
2035	}
2036	default:
2037	break;
2038	}
2039	ra->field = cpu_to_le32(field);
2040
2041	rcu_read_unlock();
2042
2043	return mt76_mcu_skb_send_msg(dev: &dev->mt76, skb,
2044	MCU_WMWA_UNI_CMD(STA_REC_UPDATE), wait_resp: true);
2045	error_unlock:
2046	rcu_read_unlock();
2047
2048	return err;
2049	}
2050
2051	static int
2052	mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct mt7996_sta *msta,
2053	struct ieee80211_vif *vif, u8 link_id)
2054	{
2055	struct ieee80211_link_sta *link_sta;
2056	struct cfg80211_bitrate_mask mask;
2057	struct mt7996_sta_link *msta_link;
2058	struct mt7996_vif_link *link;
2059	struct sta_phy_uni phy = {};
2060	struct ieee80211_sta *sta;
2061	int ret, nrates = 0, idx;
2062	enum nl80211_band band;
2063	bool has_he;
2064
2065	#define __sta_phy_bitrate_mask_check(_mcs, _gi, _ht, _he) \
2066	do { \
2067	u8 i, gi = mask.control[band]._gi; \
2068	gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI; \
2069	phy.sgi = gi; \
2070	phy.he_ltf = mask.control[band].he_ltf; \
2071	for (i = 0; i < ARRAY_SIZE(mask.control[band]._mcs); i++) { \
2072	if (!mask.control[band]._mcs[i]) \
2073	continue; \
2074	nrates += hweight16(mask.control[band]._mcs[i]); \
2075	phy.mcs = ffs(mask.control[band]._mcs[i]) - 1; \
2076	if (_ht) \
2077	phy.mcs += 8 * i; \
2078	} \
2079	} while (0)
2080
2081	rcu_read_lock();
2082
2083	link = mt7996_vif_link(dev, vif, link_id);
2084	if (!link)
2085	goto error_unlock;
2086
2087	msta_link = rcu_dereference(msta->link[link_id]);
2088	if (!msta_link)
2089	goto error_unlock;
2090
2091	sta = wcid_to_sta(wcid: &msta_link->wcid);
2092	link_sta = rcu_dereference(sta->link[link_id]);
2093	if (!link_sta)
2094	goto error_unlock;
2095
2096	band = link->phy->mt76->chandef.chan->band;
2097	has_he = link_sta->he_cap.has_he;
2098	mask = link->bitrate_mask;
2099	idx = msta_link->wcid.idx;
2100
2101	if (has_he) {
2102	__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
2103	} else if (link_sta->vht_cap.vht_supported) {
2104	__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
2105	} else if (link_sta->ht_cap.ht_supported) {
2106	__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
2107	} else {
2108	nrates = hweight32(mask.control[band].legacy);
2109	phy.mcs = ffs(mask.control[band].legacy) - 1;
2110	}
2111
2112	rcu_read_unlock();
2113
2114	#undef __sta_phy_bitrate_mask_check
2115
2116	/* fall back to auto rate control */
2117	if (mask.control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
2118	mask.control[band].he_gi == GENMASK(7, 0) &&
2119	mask.control[band].he_ltf == GENMASK(7, 0) &&
2120	nrates != 1)
2121	return 0;
2122
2123	/* fixed single rate */
2124	if (nrates == 1) {
2125	ret = mt7996_mcu_set_fixed_field(dev, msta, data: &phy, link_id,
2126	field: RATE_PARAM_FIXED_MCS);
2127	if (ret)
2128	return ret;
2129	}
2130
2131	/* fixed GI */
2132	if (mask.control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
2133	mask.control[band].he_gi != GENMASK(7, 0)) {
2134	u32 addr;
2135
2136	/* firmware updates only TXCMD but doesn't take WTBL into
2137	* account, so driver should update here to reflect the
2138	* actual txrate hardware sends out.
2139	*/
2140	addr = mt7996_mac_wtbl_lmac_addr(dev, wcid: idx, dw: 7);
2141	if (has_he)
2142	mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
2143	else
2144	mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
2145
2146	ret = mt7996_mcu_set_fixed_field(dev, msta, data: &phy, link_id,
2147	field: RATE_PARAM_FIXED_GI);
2148	if (ret)
2149	return ret;
2150	}
2151
2152	/* fixed HE_LTF */
2153	if (mask.control[band].he_ltf != GENMASK(7, 0)) {
2154	ret = mt7996_mcu_set_fixed_field(dev, msta, data: &phy, link_id,
2155	field: RATE_PARAM_FIXED_HE_LTF);
2156	if (ret)
2157	return ret;
2158	}
2159
2160	return 0;
2161
2162	error_unlock:
2163	rcu_read_unlock();
2164
2165	return -ENODEV;
2166	}
2167
2168	static void
2169	mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
2170	struct ieee80211_vif *vif,
2171	struct ieee80211_bss_conf *link_conf,
2172	struct ieee80211_link_sta *link_sta,
2173	struct mt7996_vif_link *link)
2174	{
2175	#define INIT_RCPI 180
2176	struct mt76_phy *mphy = link->phy->mt76;
2177	struct cfg80211_chan_def *chandef = &mphy->chandef;
2178	struct cfg80211_bitrate_mask *mask = &link->bitrate_mask;
2179	u32 cap = link_sta->sta->wme ? STA_CAP_WMM : 0;
2180	enum nl80211_band band = chandef->chan->band;
2181	struct sta_rec_ra_uni *ra;
2182	struct tlv *tlv;
2183	u32 supp_rate = link_sta->supp_rates[band];
2184
2185	tlv = mt76_connac_mcu_add_tlv(skb, tag: STA_REC_RA, len: sizeof(*ra));
2186	ra = (struct sta_rec_ra_uni *)tlv;
2187
2188	ra->valid = true;
2189	ra->auto_rate = true;
2190	ra->phy_mode = mt76_connac_get_phy_mode(phy: mphy, vif, band, sta: link_sta);
2191	ra->channel = chandef->chan->hw_value;
2192	ra->bw = (link_sta->bandwidth == IEEE80211_STA_RX_BW_320) ?
2193	CMD_CBW_320MHZ : link_sta->bandwidth;
2194	ra->phy.bw = ra->bw;
2195	ra->mmps_mode = mt7996_mcu_get_mmps_mode(smps: link_sta->smps_mode);
2196
2197	if (supp_rate) {
2198	supp_rate &= mask->control[band].legacy;
2199	ra->rate_len = hweight32(supp_rate);
2200
2201	if (band == NL80211_BAND_2GHZ) {
2202	ra->supp_mode = MODE_CCK;
2203	ra->supp_cck_rate = supp_rate & GENMASK(3, 0);
2204
2205	if (ra->rate_len > 4) {
2206	ra->supp_mode |= MODE_OFDM;
2207	ra->supp_ofdm_rate = supp_rate >> 4;
2208	}
2209	} else {
2210	ra->supp_mode = MODE_OFDM;
2211	ra->supp_ofdm_rate = supp_rate;
2212	}
2213	}
2214
2215	if (link_sta->ht_cap.ht_supported) {
2216	ra->supp_mode |= MODE_HT;
2217	ra->af = link_sta->ht_cap.ampdu_factor;
2218	ra->ht_gf = !!(link_sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
2219
2220	cap |= STA_CAP_HT;
2221	if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
2222	cap |= STA_CAP_SGI_20;
2223	if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
2224	cap |= STA_CAP_SGI_40;
2225	if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
2226	cap |= STA_CAP_TX_STBC;
2227	if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
2228	cap |= STA_CAP_RX_STBC;
2229	if (link_conf->ht_ldpc &&
2230	(link_sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
2231	cap |= STA_CAP_LDPC;
2232
2233	mt7996_mcu_set_sta_ht_mcs(link_sta, ht_mcs: ra->ht_mcs,
2234	mask: mask->control[band].ht_mcs);
2235	ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
2236	}
2237
2238	if (link_sta->vht_cap.vht_supported) {
2239	u8 af;
2240
2241	ra->supp_mode |= MODE_VHT;
2242	af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
2243	link_sta->vht_cap.cap);
2244	ra->af = max_t(u8, ra->af, af);
2245
2246	cap |= STA_CAP_VHT;
2247	if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
2248	cap |= STA_CAP_VHT_SGI_80;
2249	if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
2250	cap |= STA_CAP_VHT_SGI_160;
2251	if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
2252	cap |= STA_CAP_VHT_TX_STBC;
2253	if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
2254	cap |= STA_CAP_VHT_RX_STBC;
2255	if ((vif->type != NL80211_IFTYPE_AP || link_conf->vht_ldpc) &&
2256	(link_sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
2257	cap |= STA_CAP_VHT_LDPC;
2258
2259	mt7996_mcu_set_sta_vht_mcs(link_sta, vht_mcs: ra->supp_vht_mcs,
2260	mask: mask->control[band].vht_mcs);
2261	}
2262
2263	if (link_sta->he_cap.has_he) {
2264	ra->supp_mode |= MODE_HE;
2265	cap |= STA_CAP_HE;
2266
2267	if (link_sta->he_6ghz_capa.capa)
2268	ra->af = le16_get_bits(v: link_sta->he_6ghz_capa.capa,
2269	IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
2270	}
2271	ra->sta_cap = cpu_to_le32(cap);
2272
2273	memset(ra->rx_rcpi, INIT_RCPI, sizeof(ra->rx_rcpi));
2274	}
2275
2276	int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct mt7996_sta *msta,
2277	struct ieee80211_vif *vif, u8 link_id,
2278	bool changed)
2279	{
2280	struct ieee80211_bss_conf *link_conf;
2281	struct ieee80211_link_sta *link_sta;
2282	struct mt7996_sta_link *msta_link;
2283	struct mt7996_vif_link *link;
2284	struct ieee80211_sta *sta;
2285	struct sk_buff *skb;
2286	int ret = -ENODEV;
2287
2288	rcu_read_lock();
2289
2290	link = mt7996_vif_link(dev, vif, link_id);
2291	if (!link)
2292	goto error_unlock;
2293
2294	msta_link = rcu_dereference(msta->link[link_id]);
2295	if (!msta_link)
2296	goto error_unlock;
2297
2298	sta = wcid_to_sta(wcid: &msta_link->wcid);
2299	link_sta = rcu_dereference(sta->link[link_id]);
2300	if (!link_sta)
2301	goto error_unlock;
2302
2303	link_conf = rcu_dereference(vif->link_conf[link_id]);
2304	if (!link_conf)
2305	goto error_unlock;
2306
2307	skb = __mt76_connac_mcu_alloc_sta_req(dev: &dev->mt76, mvif: &link->mt76,
2308	wcid: &msta_link->wcid,
2309	MT7996_STA_UPDATE_MAX_SIZE);
2310	if (IS_ERR(ptr: skb)) {
2311	ret = PTR_ERR(ptr: skb);
2312	goto error_unlock;
2313	}
2314
2315	/* firmware rc algorithm refers to sta_rec_he for HE control.
2316	* once dev->rc_work changes the settings driver should also
2317	* update sta_rec_he here.
2318	*/
2319	if (changed)
2320	mt7996_mcu_sta_he_tlv(skb, link_sta, link);
2321
2322	/* sta_rec_ra accommodates BW, NSS and only MCS range format
2323	* i.e 0-{7,8,9} for VHT.
2324	*/
2325	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, vif, link_conf, link_sta, link);
2326
2327	rcu_read_unlock();
2328
2329	ret = mt76_mcu_skb_send_msg(dev: &dev->mt76, skb,
2330	MCU_WMWA_UNI_CMD(STA_REC_UPDATE), wait_resp: true);
2331	if (ret)
2332	return ret;
2333
2334	return mt7996_mcu_add_rate_ctrl_fixed(dev, msta, vif, link_id);
2335
2336	error_unlock:
2337	rcu_read_unlock();
2338
2339	return ret;
2340	}
2341
2342	static int
2343	mt7996_mcu_add_group(struct mt7996_dev *dev, struct mt7996_vif_link *link,
2344	struct mt76_wcid *wcid)
2345	{
2346	#define MT_STA_BSS_GROUP 1
2347	struct {
2348	u8 __rsv1[4];
2349
2350	__le16 tag;
2351	__le16 len;
2352	__le16 wlan_idx;
2353	u8 __rsv2[2];
2354	__le32 action;
2355	__le32 val;
2356	u8 __rsv3[8];
2357	} __packed req = {
2358	.tag = cpu_to_le16(UNI_VOW_DRR_CTRL),
2359	.len = cpu_to_le16(sizeof(req) - 4),
2360	.action = cpu_to_le32(MT_STA_BSS_GROUP),
2361	.val = cpu_to_le32(link->mt76.idx % 16),
2362	.wlan_idx = cpu_to_le16(wcid->idx),
2363	};
2364
2365	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(VOW), data: &req,
2366	len: sizeof(req), wait_resp: true);
2367	}
2368
2369	static void
2370	mt7996_mcu_sta_mld_setup_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
2371	struct ieee80211_vif *vif,
2372	struct ieee80211_sta *sta)
2373	{
2374	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
2375	unsigned int nlinks = hweight16(sta->valid_links);
2376	struct mld_setup_link *mld_setup_link;
2377	struct ieee80211_link_sta *link_sta;
2378	struct sta_rec_mld_setup *mld_setup;
2379	struct mt7996_sta_link *msta_link;
2380	unsigned int link_id;
2381	struct tlv *tlv;
2382
2383	msta_link = mt76_dereference(msta->link[msta->deflink_id], &dev->mt76);
2384	if (!msta_link)
2385	return;
2386
2387	tlv = mt76_connac_mcu_add_tlv(skb, tag: STA_REC_MLD,
2388	len: sizeof(struct sta_rec_mld_setup) +
2389	sizeof(struct mld_setup_link) * nlinks);
2390
2391	mld_setup = (struct sta_rec_mld_setup *)tlv;
2392	memcpy(mld_setup->mld_addr, sta->addr, ETH_ALEN);
2393	mld_setup->setup_wcid = cpu_to_le16(msta_link->wcid.idx);
2394	mld_setup->primary_id = cpu_to_le16(msta_link->wcid.idx);
2395
2396	if (nlinks > 1) {
2397	msta_link = mt76_dereference(msta->link[msta->seclink_id],
2398	&dev->mt76);
2399	if (!msta_link)
2400	return;
2401	}
2402	mld_setup->seconed_id = cpu_to_le16(msta_link->wcid.idx);
2403	mld_setup->link_num = nlinks;
2404
2405	mld_setup_link = (struct mld_setup_link *)mld_setup->link_info;
2406	for_each_sta_active_link(vif, sta, link_sta, link_id) {
2407	struct mt7996_vif_link *link;
2408
2409	msta_link = mt76_dereference(msta->link[link_id], &dev->mt76);
2410	if (!msta_link)
2411	continue;
2412
2413	link = mt7996_vif_link(dev, vif, link_id);
2414	if (!link)
2415	continue;
2416
2417	mld_setup_link->wcid = cpu_to_le16(msta_link->wcid.idx);
2418	mld_setup_link->bss_idx = link->mt76.idx;
2419	mld_setup_link++;
2420	}
2421	}
2422
2423	static void
2424	mt7996_mcu_sta_eht_mld_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
2425	struct ieee80211_sta *sta)
2426	{
2427	struct sta_rec_eht_mld *eht_mld;
2428	struct tlv *tlv;
2429	int i;
2430
2431	tlv = mt76_connac_mcu_add_tlv(skb, tag: STA_REC_EHT_MLD, len: sizeof(*eht_mld));
2432	eht_mld = (struct sta_rec_eht_mld *)tlv;
2433
2434	for (i = 0; i < ARRAY_SIZE(eht_mld->str_cap); i++)
2435	eht_mld->str_cap[i] = 0x7;
2436	}
2437
2438	int mt7996_mcu_add_sta(struct mt7996_dev *dev,
2439	struct ieee80211_bss_conf *link_conf,
2440	struct ieee80211_link_sta *link_sta,
2441	struct mt7996_vif_link *link,
2442	struct mt7996_sta_link *msta_link,
2443	int conn_state, bool newly)
2444	{
2445	struct mt76_wcid *wcid = msta_link ? &msta_link->wcid : link->mt76.wcid;
2446	struct ieee80211_sta *sta = link_sta ? link_sta->sta : NULL;
2447	struct sk_buff *skb;
2448	int ret;
2449
2450	skb = __mt76_connac_mcu_alloc_sta_req(dev: &dev->mt76, mvif: &link->mt76, wcid,
2451	MT7996_STA_UPDATE_MAX_SIZE);
2452	if (IS_ERR(ptr: skb))
2453	return PTR_ERR(ptr: skb);
2454
2455	/* starec basic */
2456	mt76_connac_mcu_sta_basic_tlv(dev: &dev->mt76, skb, link_conf, link_sta,
2457	state: conn_state, newly);
2458
2459	if (conn_state == CONN_STATE_DISCONNECT)
2460	goto out;
2461
2462	/* starec hdr trans */
2463	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif: link_conf->vif, wcid);
2464	/* starec tx proc */
2465	mt7996_mcu_sta_tx_proc_tlv(skb);
2466
2467	/* tag order is in accordance with firmware dependency. */
2468	if (link_sta) {
2469	/* starec hdrt mode */
2470	mt7996_mcu_sta_hdrt_tlv(dev, skb);
2471	if (conn_state == CONN_STATE_CONNECT) {
2472	/* starec bfer */
2473	mt7996_mcu_sta_bfer_tlv(dev, skb, link_conf, link_sta,
2474	link);
2475	/* starec bfee */
2476	mt7996_mcu_sta_bfee_tlv(dev, skb, link_conf, link_sta,
2477	link);
2478	}
2479	/* starec ht */
2480	mt7996_mcu_sta_ht_tlv(skb, link_sta);
2481	/* starec vht */
2482	mt7996_mcu_sta_vht_tlv(skb, link_sta);
2483	/* starec uapsd */
2484	mt76_connac_mcu_sta_uapsd(skb, vif: link_conf->vif, sta);
2485	/* starec amsdu */
2486	mt7996_mcu_sta_amsdu_tlv(dev, skb, vif: link_conf->vif, link_sta,
2487	msta_link);
2488	/* starec he */
2489	mt7996_mcu_sta_he_tlv(skb, link_sta, link);
2490	/* starec he 6g*/
2491	mt7996_mcu_sta_he_6g_tlv(skb, link_sta);
2492	/* starec eht */
2493	mt7996_mcu_sta_eht_tlv(skb, link_sta);
2494	/* starec muru */
2495	mt7996_mcu_sta_muru_tlv(dev, skb, link_conf, link_sta);
2496
2497	if (sta->mlo) {
2498	mt7996_mcu_sta_mld_setup_tlv(dev, skb, vif: link_conf->vif,
2499	sta);
2500	mt7996_mcu_sta_eht_mld_tlv(dev, skb, sta);
2501	}
2502	}
2503
2504	ret = mt7996_mcu_add_group(dev, link, wcid);
2505	if (ret) {
2506	dev_kfree_skb(skb);
2507	return ret;
2508	}
2509	out:
2510	return mt76_mcu_skb_send_msg(dev: &dev->mt76, skb,
2511	MCU_WMWA_UNI_CMD(STA_REC_UPDATE), wait_resp: true);
2512	}
2513
2514	int mt7996_mcu_teardown_mld_sta(struct mt7996_dev *dev,
2515	struct mt7996_vif_link *link,
2516	struct mt7996_sta_link *msta_link)
2517	{
2518	struct sk_buff *skb;
2519
2520	skb = __mt76_connac_mcu_alloc_sta_req(dev: &dev->mt76, mvif: &link->mt76,
2521	wcid: &msta_link->wcid,
2522	MT7996_STA_UPDATE_MAX_SIZE);
2523	if (IS_ERR(ptr: skb))
2524	return PTR_ERR(ptr: skb);
2525
2526	mt76_connac_mcu_add_tlv(skb, tag: STA_REC_MLD_OFF, len: sizeof(struct tlv));
2527
2528	return mt76_mcu_skb_send_msg(dev: &dev->mt76, skb,
2529	MCU_WMWA_UNI_CMD(STA_REC_UPDATE), wait_resp: true);
2530	}
2531
2532	static int
2533	mt7996_mcu_sta_key_tlv(struct mt76_dev *dev, struct mt76_wcid *wcid,
2534	struct sk_buff *skb,
2535	struct ieee80211_key_conf *key,
2536	enum set_key_cmd cmd)
2537	{
2538	struct sta_rec_sec_uni *sec;
2539	struct sec_key_uni *sec_key;
2540	struct tlv *tlv;
2541	u8 cipher;
2542
2543	tlv = mt76_connac_mcu_add_tlv(skb, tag: STA_REC_KEY_V2, len: sizeof(*sec));
2544	sec = (struct sta_rec_sec_uni *)tlv;
2545	/* due to connac3 FW design, we only do remove key for BIGTK; even for
2546	* removal, the field should be filled with SET_KEY
2547	*/
2548	sec->add = SET_KEY;
2549	sec->n_cipher = 1;
2550	sec_key = &sec->key[0];
2551	sec_key->wlan_idx = cpu_to_le16(wcid->idx);
2552	sec_key->key_id = key->keyidx;
2553
2554	if (cmd != SET_KEY)
2555	return 0;
2556
2557	cipher = mt76_connac_mcu_get_cipher(cipher: key->cipher);
2558	if (cipher == MCU_CIPHER_NONE)
2559	return -EOPNOTSUPP;
2560
2561	sec_key->mgmt_prot = 0;
2562	sec_key->cipher_id = cipher;
2563	sec_key->cipher_len = sizeof(*sec_key);
2564	sec_key->key_len = key->keylen;
2565	sec_key->need_resp = 0;
2566	memcpy(sec_key->key, key->key, key->keylen);
2567
2568	if (cipher == MCU_CIPHER_TKIP) {
2569	/* Rx/Tx MIC keys are swapped */
2570	memcpy(sec_key->key + 16, key->key + 24, 8);
2571	memcpy(sec_key->key + 24, key->key + 16, 8);
2572	return 0;
2573	}
2574
2575	if (sec_key->key_id != 6 && sec_key->key_id != 7)
2576	return 0;
2577
2578	switch (key->cipher) {
2579	case WLAN_CIPHER_SUITE_AES_CMAC:
2580	sec_key->cipher_id = MCU_CIPHER_BCN_PROT_CMAC_128;
2581	break;
2582	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
2583	sec_key->cipher_id = MCU_CIPHER_BCN_PROT_GMAC_128;
2584	break;
2585	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
2586	sec_key->cipher_id = MCU_CIPHER_BCN_PROT_GMAC_256;
2587	break;
2588	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
2589	if (!is_mt7990(dev))
2590	return -EOPNOTSUPP;
2591	sec_key->cipher_id = MCU_CIPHER_BCN_PROT_CMAC_256;
2592	break;
2593	default:
2594	return -EOPNOTSUPP;
2595	}
2596
2597	sec_key->bcn_mode = is_mt7990(dev) ? BP_HW_MODE : BP_SW_MODE;
2598
2599	return 0;
2600	}
2601
2602	int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_vif_link *link,
2603	struct ieee80211_key_conf *key, int mcu_cmd,
2604	struct mt76_wcid *wcid, enum set_key_cmd cmd)
2605	{
2606	struct sk_buff *skb;
2607	int ret;
2608
2609	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif: (struct mt76_vif_link *)link,
2610	wcid, MT7996_STA_UPDATE_MAX_SIZE);
2611	if (IS_ERR(ptr: skb))
2612	return PTR_ERR(ptr: skb);
2613
2614	ret = mt7996_mcu_sta_key_tlv(dev, wcid, skb, key, cmd);
2615	if (ret) {
2616	dev_kfree_skb(skb);
2617	return ret;
2618	}
2619
2620	return mt76_mcu_skb_send_msg(dev, skb, cmd: mcu_cmd, wait_resp: true);
2621	}
2622
2623	int mt7996_mcu_add_dev_info(struct mt7996_phy *phy, struct ieee80211_vif *vif,
2624	struct ieee80211_bss_conf *link_conf,
2625	struct mt76_vif_link *mlink, bool enable)
2626	{
2627	struct mt7996_dev *dev = phy->dev;
2628	struct {
2629	struct req_hdr {
2630	u8 omac_idx;
2631	u8 band_idx;
2632	u8 __rsv[2];
2633	} __packed hdr;
2634	struct req_tlv {
2635	__le16 tag;
2636	__le16 len;
2637	u8 active;
2638	u8 __rsv;
2639	u8 omac_addr[ETH_ALEN];
2640	} __packed tlv;
2641	} data = {
2642	.hdr = {
2643	.omac_idx = mlink->omac_idx,
2644	.band_idx = mlink->band_idx,
2645	},
2646	.tlv = {
2647	.tag = cpu_to_le16(DEV_INFO_ACTIVE),
2648	.len = cpu_to_le16(sizeof(struct req_tlv)),
2649	.active = enable,
2650	},
2651	};
2652
2653	if (mlink->omac_idx >= REPEATER_BSSID_START)
2654	return mt7996_mcu_muar_config(dev, mlink, addr: link_conf->addr, bssid: false, enable);
2655
2656	memcpy(data.tlv.omac_addr, link_conf->addr, ETH_ALEN);
2657	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WMWA_UNI_CMD(DEV_INFO_UPDATE),
2658	data: &data, len: sizeof(data), wait_resp: true);
2659	}
2660
2661	static void
2662	mt7996_mcu_beacon_cntdwn(struct sk_buff *rskb, struct sk_buff *skb,
2663	struct ieee80211_mutable_offsets *offs,
2664	bool csa)
2665	{
2666	struct bss_bcn_cntdwn_tlv *info;
2667	struct tlv *tlv;
2668	u16 tag;
2669
2670	if (!offs->cntdwn_counter_offs[0])
2671	return;
2672
2673	tag = csa ? UNI_BSS_INFO_BCN_CSA : UNI_BSS_INFO_BCN_BCC;
2674
2675	tlv = mt7996_mcu_add_uni_tlv(skb: rskb, tag, len: sizeof(*info));
2676
2677	info = (struct bss_bcn_cntdwn_tlv *)tlv;
2678	info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
2679	}
2680
2681	static void
2682	mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
2683	struct bss_bcn_content_tlv *bcn,
2684	struct ieee80211_mutable_offsets *offs)
2685	{
2686	struct bss_bcn_mbss_tlv *mbss;
2687	const struct element *elem;
2688	struct tlv *tlv;
2689
2690	tlv = mt7996_mcu_add_uni_tlv(skb: rskb, tag: UNI_BSS_INFO_BCN_MBSSID, len: sizeof(*mbss));
2691
2692	mbss = (struct bss_bcn_mbss_tlv *)tlv;
2693	mbss->offset[0] = cpu_to_le16(offs->tim_offset);
2694	mbss->bitmap = cpu_to_le32(1);
2695
2696	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
2697	&skb->data[offs->mbssid_off],
2698	skb->len - offs->mbssid_off) {
2699	const struct element *sub_elem;
2700
2701	if (elem->datalen < 2)
2702	continue;
2703
2704	for_each_element(sub_elem, elem->data + 1, elem->datalen - 1) {
2705	const struct ieee80211_bssid_index *idx;
2706	const u8 *idx_ie;
2707
2708	/* not a valid BSS profile */
2709	if (sub_elem->id || sub_elem->datalen < 4)
2710	continue;
2711
2712	/* Find WLAN_EID_MULTI_BSSID_IDX
2713	* in the merged nontransmitted profile
2714	*/
2715	idx_ie = cfg80211_find_ie(eid: WLAN_EID_MULTI_BSSID_IDX,
2716	ies: sub_elem->data, len: sub_elem->datalen);
2717	if (!idx_ie || idx_ie[1] < sizeof(*idx))
2718	continue;
2719
2720	idx = (void *)(idx_ie + 2);
2721	if (!idx->bssid_index || idx->bssid_index > 31)
2722	continue;
2723
2724	mbss->offset[idx->bssid_index] = cpu_to_le16(idx_ie -
2725	skb->data);
2726	mbss->bitmap |= cpu_to_le32(BIT(idx->bssid_index));
2727	}
2728	}
2729	}
2730
2731	static void
2732	mt7996_mcu_beacon_cont(struct mt7996_dev *dev,
2733	struct ieee80211_bss_conf *link_conf,
2734	struct mt7996_vif_link *link,
2735	struct sk_buff *rskb, struct sk_buff *skb,
2736	struct bss_bcn_content_tlv *bcn,
2737	struct ieee80211_mutable_offsets *offs)
2738	{
2739	u8 *buf, keyidx = link->msta_link.wcid.hw_key_idx2;
2740	struct mt76_wcid *wcid;
2741
2742	if (is_mt7990(dev: &dev->mt76) && (keyidx == 6 || keyidx == 7))
2743	wcid = &link->msta_link.wcid;
2744	else
2745	wcid = &dev->mt76.global_wcid;
2746
2747	bcn->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2748	bcn->tim_ie_pos = cpu_to_le16(offs->tim_offset);
2749
2750	if (offs->cntdwn_counter_offs[0]) {
2751	u16 offset = offs->cntdwn_counter_offs[0];
2752
2753	if (link_conf->csa_active)
2754	bcn->csa_ie_pos = cpu_to_le16(offset - 4);
2755	if (link_conf->color_change_active)
2756	bcn->bcc_ie_pos = cpu_to_le16(offset - 3);
2757	}
2758
2759	buf = (u8 *)bcn + sizeof(*bcn);
2760	mt7996_mac_write_txwi(dev, txwi: (__le32 *)buf, skb, wcid, NULL, pid: 0, qid: 0,
2761	changed: BSS_CHANGED_BEACON);
2762
2763	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2764	}
2765
2766	int mt7996_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2767	struct ieee80211_bss_conf *link_conf, bool enabled)
2768	{
2769	struct mt7996_dev *dev = mt7996_hw_dev(hw);
2770	struct mt7996_vif_link *link = mt7996_vif_conf_link(dev, vif, link_conf);
2771	struct mt76_vif_link *mlink = link ? &link->mt76 : NULL;
2772	struct ieee80211_mutable_offsets offs;
2773	struct ieee80211_tx_info *info;
2774	struct sk_buff *skb, *rskb;
2775	struct tlv *tlv;
2776	struct bss_bcn_content_tlv *bcn;
2777	int len, extra_len = 0;
2778
2779	if (link_conf->nontransmitted)
2780	return 0;
2781
2782	if (!mlink)
2783	return -EINVAL;
2784
2785	if (link->phy && link->phy->mt76->offchannel)
2786	enabled = false;
2787
2788	rskb = __mt7996_mcu_alloc_bss_req(dev: &dev->mt76, mvif: mlink,
2789	MT7996_MAX_BSS_OFFLOAD_SIZE);
2790	if (IS_ERR(ptr: rskb))
2791	return PTR_ERR(ptr: rskb);
2792
2793	skb = ieee80211_beacon_get_template(hw, vif, offs: &offs, link_id: link_conf->link_id);
2794	if (enabled && !skb) {
2795	dev_kfree_skb(rskb);
2796	return -EINVAL;
2797	}
2798
2799	if (skb) {
2800	if (skb->len > MT7996_MAX_BEACON_SIZE) {
2801	dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
2802	dev_kfree_skb(rskb);
2803	dev_kfree_skb(skb);
2804	return -EINVAL;
2805	}
2806
2807	extra_len = skb->len;
2808	}
2809
2810	len = ALIGN(sizeof(*bcn) + MT_TXD_SIZE + extra_len, 4);
2811	tlv = mt7996_mcu_add_uni_tlv(skb: rskb, tag: UNI_BSS_INFO_BCN_CONTENT, len);
2812	bcn = (struct bss_bcn_content_tlv *)tlv;
2813	bcn->enable = enabled;
2814	if (!bcn->enable)
2815	goto out;
2816
2817	info = IEEE80211_SKB_CB(skb);
2818	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, mlink->band_idx);
2819
2820	mt7996_mcu_beacon_cont(dev, link_conf, link, rskb, skb, bcn, offs: &offs);
2821	if (link_conf->bssid_indicator)
2822	mt7996_mcu_beacon_mbss(rskb, skb, bcn, offs: &offs);
2823	mt7996_mcu_beacon_cntdwn(rskb, skb, offs: &offs, csa: link_conf->csa_active);
2824	out:
2825	dev_kfree_skb(skb);
2826	return mt76_mcu_skb_send_msg(dev: &dev->mt76, skb: rskb,
2827	MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), wait_resp: true);
2828	}
2829
2830	int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
2831	struct ieee80211_bss_conf *link_conf,
2832	struct mt7996_vif_link *link, u32 changed)
2833	{
2834	#define OFFLOAD_TX_MODE_SU BIT(0)
2835	#define OFFLOAD_TX_MODE_MU BIT(1)
2836	struct ieee80211_vif *vif = link_conf->vif;
2837	struct ieee80211_hw *hw = mt76_hw(dev);
2838	struct mt7996_phy *phy = link->phy;
2839	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
2840	struct bss_inband_discovery_tlv *discov;
2841	struct ieee80211_tx_info *info;
2842	struct sk_buff *rskb, *skb = NULL;
2843	struct cfg80211_chan_def *chandef;
2844	enum nl80211_band band;
2845	struct tlv *tlv;
2846	u8 *buf, interval;
2847	int len;
2848
2849	if (!phy)
2850	return -EINVAL;
2851
2852	chandef = &phy->mt76->chandef;
2853	band = chandef->chan->band;
2854
2855	if (link_conf->nontransmitted)
2856	return 0;
2857
2858	rskb = __mt7996_mcu_alloc_bss_req(dev: &dev->mt76, mvif: &link->mt76,
2859	MT7996_MAX_BSS_OFFLOAD_SIZE);
2860	if (IS_ERR(ptr: rskb))
2861	return PTR_ERR(ptr: rskb);
2862
2863	if (changed & BSS_CHANGED_FILS_DISCOVERY &&
2864	link_conf->fils_discovery.max_interval) {
2865	interval = link_conf->fils_discovery.max_interval;
2866	skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
2867	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
2868	link_conf->unsol_bcast_probe_resp_interval) {
2869	interval = link_conf->unsol_bcast_probe_resp_interval;
2870	skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
2871	}
2872
2873	if (!skb) {
2874	dev_kfree_skb(rskb);
2875	return -EINVAL;
2876	}
2877
2878	if (skb->len > MT7996_MAX_BEACON_SIZE) {
2879	dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
2880	dev_kfree_skb(rskb);
2881	dev_kfree_skb(skb);
2882	return -EINVAL;
2883	}
2884
2885	info = IEEE80211_SKB_CB(skb);
2886	info->control.vif = vif;
2887	info->band = band;
2888	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, phy->mt76->band_idx);
2889
2890	len = ALIGN(sizeof(*discov) + MT_TXD_SIZE + skb->len, 4);
2891	tlv = mt7996_mcu_add_uni_tlv(skb: rskb, tag: UNI_BSS_INFO_OFFLOAD, len);
2892
2893	discov = (struct bss_inband_discovery_tlv *)tlv;
2894	discov->tx_mode = OFFLOAD_TX_MODE_SU;
2895	/* 0: UNSOL PROBE RESP, 1: FILS DISCOV */
2896	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
2897	discov->tx_interval = interval;
2898	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
2899	discov->enable = true;
2900	discov->wcid = cpu_to_le16(MT7996_WTBL_RESERVED);
2901
2902	buf = (u8 *)tlv + sizeof(*discov);
2903
2904	mt7996_mac_write_txwi(dev, txwi: (__le32 *)buf, skb, wcid, NULL, pid: 0, qid: 0, changed);
2905
2906	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
2907
2908	dev_kfree_skb(skb);
2909
2910	return mt76_mcu_skb_send_msg(dev: &dev->mt76, skb: rskb,
2911	MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), wait_resp: true);
2912	}
2913
2914	static int mt7996_driver_own(struct mt7996_dev *dev, u8 band)
2915	{
2916	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(band), MT_TOP_LPCR_HOST_DRV_OWN);
2917	if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND(band),
2918	MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) {
2919	dev_err(dev->mt76.dev, "Timeout for driver own\n");
2920	return -EIO;
2921	}
2922
2923	/* clear irq when the driver own success */
2924	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND_IRQ_STAT(band),
2925	MT_TOP_LPCR_HOST_BAND_STAT);
2926
2927	return 0;
2928	}
2929
2930	static u32 mt7996_patch_sec_mode(u32 key_info)
2931	{
2932	u32 sec = u32_get_bits(v: key_info, MT7996_PATCH_SEC), key = 0;
2933
2934	if (key_info == GENMASK(31, 0) || sec == MT7996_SEC_MODE_PLAIN)
2935	return 0;
2936
2937	if (sec == MT7996_SEC_MODE_AES)
2938	key = u32_get_bits(v: key_info, MT7996_PATCH_AES_KEY);
2939	else
2940	key = u32_get_bits(v: key_info, MT7996_PATCH_SCRAMBLE_KEY);
2941
2942	return MT7996_SEC_ENCRYPT | MT7996_SEC_IV |
2943	u32_encode_bits(v: key, MT7996_SEC_KEY_IDX);
2944	}
2945
2946	static int mt7996_load_patch(struct mt7996_dev *dev)
2947	{
2948	const struct mt7996_patch_hdr *hdr;
2949	const struct firmware *fw = NULL;
2950	int i, ret, sem;
2951
2952	sem = mt76_connac_mcu_patch_sem_ctrl(dev: &dev->mt76, get: 1);
2953	switch (sem) {
2954	case PATCH_IS_DL:
2955	return 0;
2956	case PATCH_NOT_DL_SEM_SUCCESS:
2957	break;
2958	default:
2959	dev_err(dev->mt76.dev, "Failed to get patch semaphore\n");
2960	return -EAGAIN;
2961	}
2962
2963	ret = request_firmware(fw: &fw, fw_name(dev, ROM_PATCH), device: dev->mt76.dev);
2964	if (ret)
2965	goto out;
2966
2967	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2968	dev_err(dev->mt76.dev, "Invalid firmware\n");
2969	ret = -EINVAL;
2970	goto out;
2971	}
2972
2973	hdr = (const struct mt7996_patch_hdr *)(fw->data);
2974
2975	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2976	be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2977
2978	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2979	struct mt7996_patch_sec *sec;
2980	const u8 *dl;
2981	u32 len, addr, sec_key_idx, mode = DL_MODE_NEED_RSP;
2982
2983	sec = (struct mt7996_patch_sec *)(fw->data + sizeof(*hdr) +
2984	i * sizeof(*sec));
2985	if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2986	PATCH_SEC_TYPE_INFO) {
2987	ret = -EINVAL;
2988	goto out;
2989	}
2990
2991	addr = be32_to_cpu(sec->info.addr);
2992	len = be32_to_cpu(sec->info.len);
2993	sec_key_idx = be32_to_cpu(sec->info.sec_key_idx);
2994	dl = fw->data + be32_to_cpu(sec->offs);
2995
2996	mode |= mt7996_patch_sec_mode(key_info: sec_key_idx);
2997
2998	ret = mt76_connac_mcu_init_download(dev: &dev->mt76, addr, len,
2999	mode);
3000	if (ret) {
3001	dev_err(dev->mt76.dev, "Download request failed\n");
3002	goto out;
3003	}
3004
3005	ret = __mt76_mcu_send_firmware(dev: &dev->mt76, MCU_CMD(FW_SCATTER),
3006	data: dl, len, max_len: 4096);
3007	if (ret) {
3008	dev_err(dev->mt76.dev, "Failed to send patch\n");
3009	goto out;
3010	}
3011	}
3012
3013	ret = mt76_connac_mcu_start_patch(dev: &dev->mt76);
3014	if (ret)
3015	dev_err(dev->mt76.dev, "Failed to start patch\n");
3016
3017	out:
3018	sem = mt76_connac_mcu_patch_sem_ctrl(dev: &dev->mt76, get: 0);
3019	switch (sem) {
3020	case PATCH_REL_SEM_SUCCESS:
3021	break;
3022	default:
3023	ret = -EAGAIN;
3024	dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
3025	break;
3026	}
3027	release_firmware(fw);
3028
3029	return ret;
3030	}
3031
3032	static int
3033	mt7996_mcu_send_ram_firmware(struct mt7996_dev *dev,
3034	const struct mt7996_fw_trailer *hdr,
3035	const u8 *data, enum mt7996_ram_type type)
3036	{
3037	int i, offset = 0;
3038	u32 override = 0, option = 0;
3039
3040	for (i = 0; i < hdr->n_region; i++) {
3041	const struct mt7996_fw_region *region;
3042	int err;
3043	u32 len, addr, mode;
3044
3045	region = (const struct mt7996_fw_region *)((const u8 *)hdr -
3046	(hdr->n_region - i) * sizeof(*region));
3047	/* DSP and WA use same mode */
3048	mode = mt76_connac_mcu_gen_dl_mode(dev: &dev->mt76,
3049	feature_set: region->feature_set,
3050	is_wa: type != MT7996_RAM_TYPE_WM);
3051	len = le32_to_cpu(region->len);
3052	addr = le32_to_cpu(region->addr);
3053
3054	if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
3055	override = addr;
3056
3057	err = mt76_connac_mcu_init_download(dev: &dev->mt76, addr, len,
3058	mode);
3059	if (err) {
3060	dev_err(dev->mt76.dev, "Download request failed\n");
3061	return err;
3062	}
3063
3064	err = __mt76_mcu_send_firmware(dev: &dev->mt76, MCU_CMD(FW_SCATTER),
3065	data: data + offset, len, max_len: 4096);
3066	if (err) {
3067	dev_err(dev->mt76.dev, "Failed to send firmware.\n");
3068	return err;
3069	}
3070
3071	offset += len;
3072	}
3073
3074	if (override)
3075	option |= FW_START_OVERRIDE;
3076
3077	if (type == MT7996_RAM_TYPE_WA)
3078	option |= FW_START_WORKING_PDA_CR4;
3079	else if (type == MT7996_RAM_TYPE_DSP)
3080	option |= FW_START_WORKING_PDA_DSP;
3081
3082	return mt76_connac_mcu_start_firmware(dev: &dev->mt76, addr: override, option);
3083	}
3084
3085	static int __mt7996_load_ram(struct mt7996_dev *dev, const char *fw_type,
3086	const char *fw_file, enum mt7996_ram_type ram_type)
3087	{
3088	const struct mt7996_fw_trailer *hdr;
3089	const struct firmware *fw;
3090	int ret;
3091
3092	ret = request_firmware(fw: &fw, name: fw_file, device: dev->mt76.dev);
3093	if (ret)
3094	return ret;
3095
3096	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
3097	dev_err(dev->mt76.dev, "Invalid firmware\n");
3098	ret = -EINVAL;
3099	goto out;
3100	}
3101
3102	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
3103	dev_info(dev->mt76.dev, "%s Firmware Version: %.10s, Build Time: %.15s\n",
3104	fw_type, hdr->fw_ver, hdr->build_date);
3105
3106	ret = mt7996_mcu_send_ram_firmware(dev, hdr, data: fw->data, type: ram_type);
3107	if (ret) {
3108	dev_err(dev->mt76.dev, "Failed to start %s firmware\n", fw_type);
3109	goto out;
3110	}
3111
3112	snprintf(buf: dev->mt76.hw->wiphy->fw_version,
3113	size: sizeof(dev->mt76.hw->wiphy->fw_version),
3114	fmt: "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
3115
3116	out:
3117	release_firmware(fw);
3118
3119	return ret;
3120	}
3121
3122	static int mt7996_load_ram(struct mt7996_dev *dev)
3123	{
3124	int ret;
3125
3126	ret = __mt7996_load_ram(dev, fw_type: "WM", fw_name(dev, FIRMWARE_WM),
3127	ram_type: MT7996_RAM_TYPE_WM);
3128	if (ret)
3129	return ret;
3130
3131	if (!mt7996_has_wa(dev))
3132	return 0;
3133
3134	ret = __mt7996_load_ram(dev, fw_type: "DSP", fw_name(dev, FIRMWARE_DSP),
3135	ram_type: MT7996_RAM_TYPE_DSP);
3136	if (ret)
3137	return ret;
3138
3139	return __mt7996_load_ram(dev, fw_type: "WA", fw_name(dev, FIRMWARE_WA),
3140	ram_type: MT7996_RAM_TYPE_WA);
3141	}
3142
3143	static int
3144	mt7996_firmware_state(struct mt7996_dev *dev, u8 fw_state)
3145	{
3146	u32 state = FIELD_PREP(MT_TOP_MISC_FW_STATE, fw_state);
3147
3148	if (!mt76_poll_msec(dev, MT_TOP_MISC, MT_TOP_MISC_FW_STATE,
3149	state, 1000)) {
3150	dev_err(dev->mt76.dev, "Timeout for initializing firmware\n");
3151	return -EIO;
3152	}
3153	return 0;
3154	}
3155
3156	static int
3157	mt7996_mcu_restart(struct mt76_dev *dev)
3158	{
3159	struct {
3160	u8 __rsv1[4];
3161
3162	__le16 tag;
3163	__le16 len;
3164	u8 power_mode;
3165	u8 __rsv2[3];
3166	} __packed req = {
3167	.tag = cpu_to_le16(UNI_POWER_OFF),
3168	.len = cpu_to_le16(sizeof(req) - 4),
3169	.power_mode = 1,
3170	};
3171
3172	return mt76_mcu_send_msg(dev, MCU_WM_UNI_CMD(POWER_CTRL), data: &req,
3173	len: sizeof(req), wait_resp: false);
3174	}
3175
3176	static int mt7996_load_firmware(struct mt7996_dev *dev)
3177	{
3178	u8 fw_state;
3179	int ret;
3180
3181	/* make sure fw is download state */
3182	if (mt7996_firmware_state(dev, fw_state: FW_STATE_FW_DOWNLOAD)) {
3183	/* restart firmware once */
3184	mt7996_mcu_restart(dev: &dev->mt76);
3185	ret = mt7996_firmware_state(dev, fw_state: FW_STATE_FW_DOWNLOAD);
3186	if (ret) {
3187	dev_err(dev->mt76.dev,
3188	"Firmware is not ready for download\n");
3189	return ret;
3190	}
3191	}
3192
3193	ret = mt7996_load_patch(dev);
3194	if (ret)
3195	return ret;
3196
3197	ret = mt7996_load_ram(dev);
3198	if (ret)
3199	return ret;
3200
3201	fw_state = mt7996_has_wa(dev) ? FW_STATE_RDY : FW_STATE_NORMAL_TRX;
3202	ret = mt7996_firmware_state(dev, fw_state);
3203	if (ret)
3204	return ret;
3205
3206	mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false);
3207
3208	dev_dbg(dev->mt76.dev, "Firmware init done\n");
3209
3210	return 0;
3211	}
3212
3213	int mt7996_mcu_fw_log_2_host(struct mt7996_dev *dev, u8 type, u8 ctrl)
3214	{
3215	struct {
3216	u8 _rsv[4];
3217
3218	__le16 tag;
3219	__le16 len;
3220	u8 ctrl;
3221	u8 interval;
3222	u8 _rsv2[2];
3223	} __packed data = {
3224	.tag = cpu_to_le16(UNI_WSYS_CONFIG_FW_LOG_CTRL),
3225	.len = cpu_to_le16(sizeof(data) - 4),
3226	.ctrl = ctrl,
3227	};
3228
3229	if (type == MCU_FW_LOG_WA)
3230	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WA_UNI_CMD(WSYS_CONFIG),
3231	data: &data, len: sizeof(data), wait_resp: true);
3232
3233	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(WSYS_CONFIG), data: &data,
3234	len: sizeof(data), wait_resp: true);
3235	}
3236
3237	int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level)
3238	{
3239	struct {
3240	u8 _rsv[4];
3241
3242	__le16 tag;
3243	__le16 len;
3244	__le32 module_idx;
3245	u8 level;
3246	u8 _rsv2[3];
3247	} data = {
3248	.tag = cpu_to_le16(UNI_WSYS_CONFIG_FW_DBG_CTRL),
3249	.len = cpu_to_le16(sizeof(data) - 4),
3250	.module_idx = cpu_to_le32(module),
3251	.level = level,
3252	};
3253
3254	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(WSYS_CONFIG), data: &data,
3255	len: sizeof(data), wait_resp: false);
3256	}
3257
3258	static int mt7996_mcu_set_mwds(struct mt7996_dev *dev, bool enabled)
3259	{
3260	struct {
3261	u8 enable;
3262	u8 _rsv[3];
3263	} __packed req = {
3264	.enable = enabled
3265	};
3266
3267	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WA_EXT_CMD(MWDS_SUPPORT), data: &req,
3268	len: sizeof(req), wait_resp: false);
3269	}
3270
3271	static void mt7996_add_rx_airtime_tlv(struct sk_buff *skb, u8 band_idx)
3272	{
3273	struct vow_rx_airtime *req;
3274	struct tlv *tlv;
3275
3276	tlv = mt7996_mcu_add_uni_tlv(skb, tag: UNI_VOW_RX_AT_AIRTIME_CLR_EN, len: sizeof(*req));
3277	req = (struct vow_rx_airtime *)tlv;
3278	req->enable = true;
3279	req->band = band_idx;
3280
3281	tlv = mt7996_mcu_add_uni_tlv(skb, tag: UNI_VOW_RX_AT_AIRTIME_EN, len: sizeof(*req));
3282	req = (struct vow_rx_airtime *)tlv;
3283	req->enable = true;
3284	req->band = band_idx;
3285	}
3286
3287	static int
3288	mt7996_mcu_init_rx_airtime(struct mt7996_dev *dev)
3289	{
3290	struct uni_header hdr = {};
3291	struct sk_buff *skb;
3292	int len, num, i;
3293
3294	num = 2 + 2 * (mt7996_band_valid(dev, band: MT_BAND1) +
3295	mt7996_band_valid(dev, band: MT_BAND2));
3296	len = sizeof(hdr) + num * sizeof(struct vow_rx_airtime);
3297	skb = mt76_mcu_msg_alloc(dev: &dev->mt76, NULL, data_len: len);
3298	if (!skb)
3299	return -ENOMEM;
3300
3301	skb_put_data(skb, data: &hdr, len: sizeof(hdr));
3302
3303	for (i = 0; i < __MT_MAX_BAND; i++) {
3304	if (mt7996_band_valid(dev, band: i))
3305	mt7996_add_rx_airtime_tlv(skb, band_idx: i);
3306	}
3307
3308	return mt76_mcu_skb_send_msg(dev: &dev->mt76, skb,
3309	MCU_WM_UNI_CMD(VOW), wait_resp: true);
3310	}
3311
3312	int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
3313	{
3314	int ret;
3315
3316	/* force firmware operation mode into normal state,
3317	* which should be set before firmware download stage.
3318	*/
3319	mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
3320
3321	ret = mt7996_driver_own(dev, band: 0);
3322	if (ret)
3323	return ret;
3324	/* set driver own for band1 when two hif exist */
3325	if (dev->hif2) {
3326	ret = mt7996_driver_own(dev, band: 1);
3327	if (ret)
3328	return ret;
3329	}
3330
3331	ret = mt7996_load_firmware(dev);
3332	if (ret)
3333	return ret;
3334
3335	set_bit(nr: MT76_STATE_MCU_RUNNING, addr: &dev->mphy.state);
3336	ret = mt7996_mcu_fw_log_2_host(dev, type: MCU_FW_LOG_WM, ctrl: 0);
3337	if (ret)
3338	return ret;
3339
3340	if (mt7996_has_wa(dev)) {
3341	ret = mt7996_mcu_fw_log_2_host(dev, type: MCU_FW_LOG_WA, ctrl: 0);
3342	if (ret)
3343	return ret;
3344
3345	ret = mt7996_mcu_set_mwds(dev, enabled: 1);
3346	if (ret)
3347	return ret;
3348	}
3349
3350	ret = mt7996_mcu_init_rx_airtime(dev);
3351	if (ret)
3352	return ret;
3353
3354	return mt7996_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
3355	a1: MCU_WA_PARAM_RED, a2: 0, a3: 0);
3356	}
3357
3358	int mt7996_mcu_init(struct mt7996_dev *dev)
3359	{
3360	static const struct mt76_mcu_ops mt7996_mcu_ops = {
3361	.headroom = sizeof(struct mt76_connac2_mcu_txd), /* reuse */
3362	.mcu_skb_send_msg = mt7996_mcu_send_message,
3363	.mcu_parse_response = mt7996_mcu_parse_response,
3364	};
3365
3366	dev->mt76.mcu_ops = &mt7996_mcu_ops;
3367
3368	return mt7996_mcu_init_firmware(dev);
3369	}
3370
3371	void mt7996_mcu_exit(struct mt7996_dev *dev)
3372	{
3373	mt7996_mcu_restart(dev: &dev->mt76);
3374	if (mt7996_firmware_state(dev, fw_state: FW_STATE_FW_DOWNLOAD)) {
3375	dev_err(dev->mt76.dev, "Failed to exit mcu\n");
3376	goto out;
3377	}
3378
3379	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN);
3380	if (dev->hif2)
3381	mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1),
3382	MT_TOP_LPCR_HOST_FW_OWN);
3383	out:
3384	skb_queue_purge(list: &dev->mt76.mcu.res_q);
3385	}
3386
3387	int mt7996_mcu_set_hdr_trans(struct mt7996_dev *dev, bool hdr_trans)
3388	{
3389	struct {
3390	u8 __rsv[4];
3391	} __packed hdr = {};
3392	struct hdr_trans_blacklist *req_blacklist;
3393	struct hdr_trans_en *req_en;
3394	struct sk_buff *skb;
3395	struct tlv *tlv;
3396	int len = MT7996_HDR_TRANS_MAX_SIZE + sizeof(hdr);
3397
3398	skb = mt76_mcu_msg_alloc(dev: &dev->mt76, NULL, data_len: len);
3399	if (!skb)
3400	return -ENOMEM;
3401
3402	skb_put_data(skb, data: &hdr, len: sizeof(hdr));
3403
3404	tlv = mt7996_mcu_add_uni_tlv(skb, tag: UNI_HDR_TRANS_EN, len: sizeof(*req_en));
3405	req_en = (struct hdr_trans_en *)tlv;
3406	req_en->enable = hdr_trans;
3407
3408	tlv = mt7996_mcu_add_uni_tlv(skb, tag: UNI_HDR_TRANS_VLAN,
3409	len: sizeof(struct hdr_trans_vlan));
3410
3411	if (hdr_trans) {
3412	tlv = mt7996_mcu_add_uni_tlv(skb, tag: UNI_HDR_TRANS_BLACKLIST,
3413	len: sizeof(*req_blacklist));
3414	req_blacklist = (struct hdr_trans_blacklist *)tlv;
3415	req_blacklist->enable = 1;
3416	req_blacklist->type = cpu_to_le16(ETH_P_PAE);
3417	}
3418
3419	return mt76_mcu_skb_send_msg(dev: &dev->mt76, skb,
3420	MCU_WM_UNI_CMD(RX_HDR_TRANS), wait_resp: true);
3421	}
3422
3423	int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif,
3424	struct ieee80211_bss_conf *link_conf)
3425	{
3426	#define MCU_EDCA_AC_PARAM 0
3427	#define WMM_AIFS_SET BIT(0)
3428	#define WMM_CW_MIN_SET BIT(1)
3429	#define WMM_CW_MAX_SET BIT(2)
3430	#define WMM_TXOP_SET BIT(3)
3431	#define WMM_PARAM_SET (WMM_AIFS_SET | WMM_CW_MIN_SET | \
3432	WMM_CW_MAX_SET | WMM_TXOP_SET)
3433	struct mt7996_vif_link *link = mt7996_vif_conf_link(dev, vif, link_conf);
3434	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
3435	unsigned int link_id = link_conf->link_id;
3436	struct mt7996_vif_link_info *link_info = &mvif->link_info[link_id];
3437	struct {
3438	u8 bss_idx;
3439	u8 __rsv[3];
3440	} __packed hdr = {
3441	.bss_idx = link->mt76.idx,
3442	};
3443	struct sk_buff *skb;
3444	int len = sizeof(hdr) + IEEE80211_NUM_ACS * sizeof(struct edca);
3445	int ac;
3446
3447	skb = mt76_mcu_msg_alloc(dev: &dev->mt76, NULL, data_len: len);
3448	if (!skb)
3449	return -ENOMEM;
3450
3451	skb_put_data(skb, data: &hdr, len: sizeof(hdr));
3452
3453	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
3454	struct ieee80211_tx_queue_params *q = &link_info->queue_params[ac];
3455	struct edca *e;
3456	struct tlv *tlv;
3457
3458	tlv = mt7996_mcu_add_uni_tlv(skb, MCU_EDCA_AC_PARAM, len: sizeof(*e));
3459
3460	e = (struct edca *)tlv;
3461	e->set = WMM_PARAM_SET;
3462	e->queue = ac;
3463	e->aifs = q->aifs;
3464	e->txop = cpu_to_le16(q->txop);
3465
3466	if (q->cw_min)
3467	e->cw_min = fls(x: q->cw_min);
3468	else
3469	e->cw_min = 5;
3470
3471	if (q->cw_max)
3472	e->cw_max = fls(x: q->cw_max);
3473	else
3474	e->cw_max = 10;
3475	}
3476
3477	return mt76_mcu_skb_send_msg(dev: &dev->mt76, skb,
3478	MCU_WM_UNI_CMD(EDCA_UPDATE), wait_resp: true);
3479	}
3480
3481	int mt7996_mcu_set_fcc5_lpn(struct mt7996_dev *dev, int val)
3482	{
3483	struct {
3484	u8 _rsv[4];
3485
3486	__le16 tag;
3487	__le16 len;
3488
3489	__le32 ctrl;
3490	__le16 min_lpn;
3491	u8 rsv[2];
3492	} __packed req = {
3493	.tag = cpu_to_le16(UNI_RDD_CTRL_SET_TH),
3494	.len = cpu_to_le16(sizeof(req) - 4),
3495
3496	.ctrl = cpu_to_le32(0x1),
3497	.min_lpn = cpu_to_le16(val),
3498	};
3499
3500	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(RDD_CTRL),
3501	data: &req, len: sizeof(req), wait_resp: true);
3502	}
3503
3504	int mt7996_mcu_set_pulse_th(struct mt7996_dev *dev,
3505	const struct mt7996_dfs_pulse *pulse)
3506	{
3507	struct {
3508	u8 _rsv[4];
3509
3510	__le16 tag;
3511	__le16 len;
3512
3513	__le32 ctrl;
3514
3515	__le32 max_width; /* us */
3516	__le32 max_pwr; /* dbm */
3517	__le32 min_pwr; /* dbm */
3518	__le32 min_stgr_pri; /* us */
3519	__le32 max_stgr_pri; /* us */
3520	__le32 min_cr_pri; /* us */
3521	__le32 max_cr_pri; /* us */
3522	} __packed req = {
3523	.tag = cpu_to_le16(UNI_RDD_CTRL_SET_TH),
3524	.len = cpu_to_le16(sizeof(req) - 4),
3525
3526	.ctrl = cpu_to_le32(0x3),
3527
3528	#define __req_field(field) .field = cpu_to_le32(pulse->field)
3529	__req_field(max_width),
3530	__req_field(max_pwr),
3531	__req_field(min_pwr),
3532	__req_field(min_stgr_pri),
3533	__req_field(max_stgr_pri),
3534	__req_field(min_cr_pri),
3535	__req_field(max_cr_pri),
3536	#undef __req_field
3537	};
3538
3539	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(RDD_CTRL),
3540	data: &req, len: sizeof(req), wait_resp: true);
3541	}
3542
3543	int mt7996_mcu_set_radar_th(struct mt7996_dev *dev, int index,
3544	const struct mt7996_dfs_pattern *pattern)
3545	{
3546	struct {
3547	u8 _rsv[4];
3548
3549	__le16 tag;
3550	__le16 len;
3551
3552	__le32 ctrl;
3553	__le16 radar_type;
3554
3555	u8 enb;
3556	u8 stgr;
3557	u8 min_crpn;
3558	u8 max_crpn;
3559	u8 min_crpr;
3560	u8 min_pw;
3561	__le32 min_pri;
3562	__le32 max_pri;
3563	u8 max_pw;
3564	u8 min_crbn;
3565	u8 max_crbn;
3566	u8 min_stgpn;
3567	u8 max_stgpn;
3568	u8 min_stgpr;
3569	u8 rsv[2];
3570	__le32 min_stgpr_diff;
3571	} __packed req = {
3572	.tag = cpu_to_le16(UNI_RDD_CTRL_SET_TH),
3573	.len = cpu_to_le16(sizeof(req) - 4),
3574
3575	.ctrl = cpu_to_le32(0x2),
3576	.radar_type = cpu_to_le16(index),
3577
3578	#define __req_field_u8(field) .field = pattern->field
3579	#define __req_field_u32(field) .field = cpu_to_le32(pattern->field)
3580	__req_field_u8(enb),
3581	__req_field_u8(stgr),
3582	__req_field_u8(min_crpn),
3583	__req_field_u8(max_crpn),
3584	__req_field_u8(min_crpr),
3585	__req_field_u8(min_pw),
3586	__req_field_u32(min_pri),
3587	__req_field_u32(max_pri),
3588	__req_field_u8(max_pw),
3589	__req_field_u8(min_crbn),
3590	__req_field_u8(max_crbn),
3591	__req_field_u8(min_stgpn),
3592	__req_field_u8(max_stgpn),
3593	__req_field_u8(min_stgpr),
3594	__req_field_u32(min_stgpr_diff),
3595	#undef __req_field_u8
3596	#undef __req_field_u32
3597	};
3598
3599	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(RDD_CTRL),
3600	data: &req, len: sizeof(req), wait_resp: true);
3601	}
3602
3603	static int
3604	mt7996_mcu_background_chain_ctrl(struct mt7996_phy *phy,
3605	struct cfg80211_chan_def *chandef,
3606	int cmd)
3607	{
3608	struct mt7996_dev *dev = phy->dev;
3609	struct mt76_phy *mphy = phy->mt76;
3610	struct ieee80211_channel *chan = mphy->chandef.chan;
3611	int freq = mphy->chandef.center_freq1;
3612	struct mt7996_mcu_background_chain_ctrl req = {
3613	.tag = cpu_to_le16(0),
3614	.len = cpu_to_le16(sizeof(req) - 4),
3615	.monitor_scan_type = 2, /* simple rx */
3616	};
3617
3618	if (!chandef && cmd != CH_SWITCH_BACKGROUND_SCAN_STOP)
3619	return -EINVAL;
3620
3621	if (!cfg80211_chandef_valid(chandef: &mphy->chandef))
3622	return -EINVAL;
3623
3624	switch (cmd) {
3625	case CH_SWITCH_BACKGROUND_SCAN_START: {
3626	req.chan = chan->hw_value;
3627	req.central_chan = ieee80211_frequency_to_channel(freq);
3628	req.bw = mt76_connac_chan_bw(chandef: &mphy->chandef);
3629	req.monitor_chan = chandef->chan->hw_value;
3630	req.monitor_central_chan =
3631	ieee80211_frequency_to_channel(freq: chandef->center_freq1);
3632	req.monitor_bw = mt76_connac_chan_bw(chandef);
3633	req.band_idx = phy->mt76->band_idx;
3634	req.scan_mode = 1;
3635	break;
3636	}
3637	case CH_SWITCH_BACKGROUND_SCAN_RUNNING:
3638	req.monitor_chan = chandef->chan->hw_value;
3639	req.monitor_central_chan =
3640	ieee80211_frequency_to_channel(freq: chandef->center_freq1);
3641	req.band_idx = phy->mt76->band_idx;
3642	req.scan_mode = 2;
3643	break;
3644	case CH_SWITCH_BACKGROUND_SCAN_STOP:
3645	req.chan = chan->hw_value;
3646	req.central_chan = ieee80211_frequency_to_channel(freq);
3647	req.bw = mt76_connac_chan_bw(chandef: &mphy->chandef);
3648	req.tx_stream = hweight8(mphy->antenna_mask);
3649	req.rx_stream = mphy->antenna_mask;
3650	break;
3651	default:
3652	return -EINVAL;
3653	}
3654	req.band = chandef ? chandef->chan->band == NL80211_BAND_5GHZ : 1;
3655
3656	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(OFFCH_SCAN_CTRL),
3657	data: &req, len: sizeof(req), wait_resp: false);
3658	}
3659
3660	int mt7996_mcu_rdd_background_enable(struct mt7996_phy *phy,
3661	struct cfg80211_chan_def *chandef)
3662	{
3663	struct mt7996_dev *dev = phy->dev;
3664	int err, region, rdd_idx = mt7996_get_rdd_idx(phy, is_background: true);
3665
3666	if (!chandef) { /* disable offchain */
3667	err = mt7996_mcu_rdd_cmd(dev, cmd: RDD_STOP, rdd_idx, val: 0);
3668	if (err)
3669	return err;
3670
3671	return mt7996_mcu_background_chain_ctrl(phy, NULL,
3672	cmd: CH_SWITCH_BACKGROUND_SCAN_STOP);
3673	}
3674
3675	err = mt7996_mcu_background_chain_ctrl(phy, chandef,
3676	cmd: CH_SWITCH_BACKGROUND_SCAN_START);
3677	if (err)
3678	return err;
3679
3680	switch (dev->mt76.region) {
3681	case NL80211_DFS_ETSI:
3682	region = 0;
3683	break;
3684	case NL80211_DFS_JP:
3685	region = 2;
3686	break;
3687	case NL80211_DFS_FCC:
3688	default:
3689	region = 1;
3690	break;
3691	}
3692
3693	return mt7996_mcu_rdd_cmd(dev, cmd: RDD_START, rdd_idx, val: region);
3694	}
3695
3696	int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
3697	{
3698	static const u8 ch_band[] = {
3699	[NL80211_BAND_2GHZ] = 0,
3700	[NL80211_BAND_5GHZ] = 1,
3701	[NL80211_BAND_6GHZ] = 2,
3702	};
3703	struct mt7996_dev *dev = phy->dev;
3704	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
3705	int freq1 = chandef->center_freq1;
3706	u8 band_idx = phy->mt76->band_idx;
3707	struct {
3708	/* fixed field */
3709	u8 __rsv[4];
3710
3711	__le16 tag;
3712	__le16 len;
3713	u8 control_ch;
3714	u8 center_ch;
3715	u8 bw;
3716	u8 tx_path_num;
3717	u8 rx_path; /* mask or num */
3718	u8 switch_reason;
3719	u8 band_idx;
3720	u8 center_ch2; /* for 80+80 only */
3721	__le16 cac_case;
3722	u8 channel_band;
3723	u8 rsv0;
3724	__le32 outband_freq;
3725	u8 txpower_drop;
3726	u8 ap_bw;
3727	u8 ap_center_ch;
3728	u8 rsv1[53];
3729	} __packed req = {
3730	.tag = cpu_to_le16(tag),
3731	.len = cpu_to_le16(sizeof(req) - 4),
3732	.control_ch = chandef->chan->hw_value,
3733	.center_ch = ieee80211_frequency_to_channel(freq: freq1),
3734	.bw = mt76_connac_chan_bw(chandef),
3735	.tx_path_num = hweight16(phy->mt76->chainmask),
3736	.rx_path = mt7996_rx_chainmask(phy) >> dev->chainshift[band_idx],
3737	.band_idx = band_idx,
3738	.channel_band = ch_band[chandef->chan->band],
3739	};
3740
3741	if (phy->mt76->hw->conf.flags & IEEE80211_CONF_MONITOR)
3742	req.switch_reason = CH_SWITCH_NORMAL;
3743	else if (phy->mt76->offchannel ||
3744	phy->mt76->hw->conf.flags & IEEE80211_CONF_IDLE)
3745	req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
3746	else if (!cfg80211_reg_can_beacon(wiphy: phy->mt76->hw->wiphy, chandef,
3747	iftype: NL80211_IFTYPE_AP))
3748	req.switch_reason = CH_SWITCH_DFS;
3749	else
3750	req.switch_reason = CH_SWITCH_NORMAL;
3751
3752	if (tag == UNI_CHANNEL_SWITCH)
3753	req.rx_path = hweight8(req.rx_path);
3754
3755	if (chandef->width == NL80211_CHAN_WIDTH_80P80) {
3756	int freq2 = chandef->center_freq2;
3757
3758	req.center_ch2 = ieee80211_frequency_to_channel(freq: freq2);
3759	}
3760
3761	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WMWA_UNI_CMD(CHANNEL_SWITCH),
3762	data: &req, len: sizeof(req), wait_resp: true);
3763	}
3764
3765	static int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
3766	{
3767	#define MAX_PAGE_IDX_MASK GENMASK(7, 5)
3768	#define PAGE_IDX_MASK GENMASK(4, 2)
3769	#define PER_PAGE_SIZE 0x400
3770	struct mt7996_mcu_eeprom req = {
3771	.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
3772	.buffer_mode = EE_MODE_BUFFER
3773	};
3774	u16 eeprom_size = MT7996_EEPROM_SIZE;
3775	u8 total = DIV_ROUND_UP(eeprom_size, PER_PAGE_SIZE);
3776	u8 *eep = (u8 *)dev->mt76.eeprom.data;
3777	int eep_len, i;
3778
3779	for (i = 0; i < total; i++, eep += eep_len) {
3780	struct sk_buff *skb;
3781	int ret, msg_len;
3782
3783	if (i == total - 1 && !!(eeprom_size % PER_PAGE_SIZE))
3784	eep_len = eeprom_size % PER_PAGE_SIZE;
3785	else
3786	eep_len = PER_PAGE_SIZE;
3787
3788	msg_len = sizeof(req) + eep_len;
3789	skb = mt76_mcu_msg_alloc(dev: &dev->mt76, NULL, data_len: msg_len);
3790	if (!skb)
3791	return -ENOMEM;
3792
3793	req.len = cpu_to_le16(msg_len - 4);
3794	req.format = FIELD_PREP(MAX_PAGE_IDX_MASK, total - 1) |
3795	FIELD_PREP(PAGE_IDX_MASK, i) | EE_FORMAT_WHOLE;
3796	req.buf_len = cpu_to_le16(eep_len);
3797
3798	skb_put_data(skb, data: &req, len: sizeof(req));
3799	skb_put_data(skb, data: eep, len: eep_len);
3800
3801	ret = mt76_mcu_skb_send_msg(dev: &dev->mt76, skb,
3802	MCU_WM_UNI_CMD(EFUSE_CTRL), wait_resp: true);
3803	if (ret)
3804	return ret;
3805	}
3806
3807	return 0;
3808	}
3809
3810	int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
3811	{
3812	struct mt7996_mcu_eeprom req = {
3813	.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
3814	.len = cpu_to_le16(sizeof(req) - 4),
3815	.buffer_mode = EE_MODE_EFUSE,
3816	.format = EE_FORMAT_WHOLE
3817	};
3818
3819	if (dev->flash_mode)
3820	return mt7996_mcu_set_eeprom_flash(dev);
3821
3822	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(EFUSE_CTRL),
3823	data: &req, len: sizeof(req), wait_resp: true);
3824	}
3825
3826	int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len)
3827	{
3828	struct {
3829	u8 _rsv[4];
3830
3831	__le16 tag;
3832	__le16 len;
3833	__le32 addr;
3834	__le32 valid;
3835	u8 data[16];
3836	} __packed req = {
3837	.tag = cpu_to_le16(UNI_EFUSE_ACCESS),
3838	.len = cpu_to_le16(sizeof(req) - 4),
3839	.addr = cpu_to_le32(round_down(offset,
3840	MT7996_EEPROM_BLOCK_SIZE)),
3841	};
3842	struct sk_buff *skb;
3843	bool valid;
3844	int ret;
3845
3846	ret = mt76_mcu_send_and_get_msg(dev: &dev->mt76,
3847	MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL),
3848	data: &req, len: sizeof(req), wait_resp: true, ret: &skb);
3849	if (ret)
3850	return ret;
3851
3852	valid = le32_to_cpu(*(__le32 *)(skb->data + 16));
3853	if (valid) {
3854	u32 addr = le32_to_cpu(*(__le32 *)(skb->data + 12));
3855
3856	if (!buf)
3857	buf = (u8 *)dev->mt76.eeprom.data + addr;
3858	if (!buf_len || buf_len > MT7996_EEPROM_BLOCK_SIZE)
3859	buf_len = MT7996_EEPROM_BLOCK_SIZE;
3860
3861	skb_pull(skb, len: 48);
3862	memcpy(buf, skb->data, buf_len);
3863	} else {
3864	ret = -EINVAL;
3865	}
3866
3867	dev_kfree_skb(skb);
3868
3869	return ret;
3870	}
3871
3872	int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num)
3873	{
3874	struct {
3875	u8 _rsv[4];
3876
3877	__le16 tag;
3878	__le16 len;
3879	u8 num;
3880	u8 version;
3881	u8 die_idx;
3882	u8 _rsv2;
3883	} __packed req = {
3884	.tag = cpu_to_le16(UNI_EFUSE_FREE_BLOCK),
3885	.len = cpu_to_le16(sizeof(req) - 4),
3886	.version = 2,
3887	};
3888	struct sk_buff *skb;
3889	int ret;
3890
3891	ret = mt76_mcu_send_and_get_msg(dev: &dev->mt76, MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL), data: &req,
3892	len: sizeof(req), wait_resp: true, ret: &skb);
3893	if (ret)
3894	return ret;
3895
3896	*block_num = *(u8 *)(skb->data + 8);
3897	dev_kfree_skb(skb);
3898
3899	return 0;
3900	}
3901
3902	int mt7996_mcu_get_chip_config(struct mt7996_dev *dev, u32 *cap)
3903	{
3904	#define NIC_CAP 3
3905	#define UNI_EVENT_CHIP_CONFIG_EFUSE_VERSION 0x21
3906	struct {
3907	u8 _rsv[4];
3908
3909	__le16 tag;
3910	__le16 len;
3911	} __packed req = {
3912	.tag = cpu_to_le16(NIC_CAP),
3913	.len = cpu_to_le16(sizeof(req) - 4),
3914	};
3915	struct sk_buff *skb;
3916	u8 *buf;
3917	int ret;
3918
3919	ret = mt76_mcu_send_and_get_msg(dev: &dev->mt76,
3920	MCU_WM_UNI_CMD_QUERY(CHIP_CONFIG), data: &req,
3921	len: sizeof(req), wait_resp: true, ret: &skb);
3922	if (ret)
3923	return ret;
3924
3925	/* fixed field */
3926	skb_pull(skb, len: 4);
3927
3928	buf = skb->data;
3929	while (buf - skb->data < skb->len) {
3930	struct tlv *tlv = (struct tlv *)buf;
3931
3932	switch (le16_to_cpu(tlv->tag)) {
3933	case UNI_EVENT_CHIP_CONFIG_EFUSE_VERSION:
3934	*cap = le32_to_cpu(*(__le32 *)(buf + sizeof(*tlv)));
3935	break;
3936	default:
3937	break;
3938	}
3939
3940	buf += le16_to_cpu(tlv->len);
3941	}
3942
3943	dev_kfree_skb(skb);
3944
3945	return 0;
3946	}
3947
3948	int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch)
3949	{
3950	enum {
3951	IDX_TX_TIME,
3952	IDX_RX_TIME,
3953	IDX_OBSS_AIRTIME,
3954	IDX_NON_WIFI_TIME,
3955	IDX_NUM
3956	};
3957	struct {
3958	struct {
3959	u8 band;
3960	u8 __rsv[3];
3961	} hdr;
3962	struct {
3963	__le16 tag;
3964	__le16 len;
3965	__le32 offs;
3966	} data[IDX_NUM];
3967	} __packed req = {
3968	.hdr.band = phy->mt76->band_idx,
3969	};
3970	static const u32 offs[] = {
3971	[IDX_TX_TIME] = UNI_MIB_TX_TIME,
3972	[IDX_RX_TIME] = UNI_MIB_RX_TIME,
3973	[IDX_OBSS_AIRTIME] = UNI_MIB_OBSS_AIRTIME,
3974	[IDX_NON_WIFI_TIME] = UNI_MIB_NON_WIFI_TIME,
3975	};
3976	struct mt76_channel_state *state = phy->mt76->chan_state;
3977	struct mt76_channel_state *state_ts = &phy->state_ts;
3978	struct mt7996_dev *dev = phy->dev;
3979	struct mt7996_mcu_mib *res;
3980	struct sk_buff *skb;
3981	int i, ret;
3982
3983	for (i = 0; i < IDX_NUM; i++) {
3984	req.data[i].tag = cpu_to_le16(UNI_CMD_MIB_DATA);
3985	req.data[i].len = cpu_to_le16(sizeof(req.data[i]));
3986	req.data[i].offs = cpu_to_le32(offs[i]);
3987	}
3988
3989	ret = mt76_mcu_send_and_get_msg(dev: &dev->mt76, MCU_WM_UNI_CMD_QUERY(GET_MIB_INFO),
3990	data: &req, len: sizeof(req), wait_resp: true, ret: &skb);
3991	if (ret)
3992	return ret;
3993
3994	skb_pull(skb, len: sizeof(req.hdr));
3995
3996	res = (struct mt7996_mcu_mib *)(skb->data);
3997
3998	if (chan_switch)
3999	goto out;
4000
4001	#define __res_u64(s) le64_to_cpu(res[s].data)
4002	state->cc_tx += __res_u64(IDX_TX_TIME) - state_ts->cc_tx;
4003	state->cc_bss_rx += __res_u64(IDX_RX_TIME) - state_ts->cc_bss_rx;
4004	state->cc_rx += __res_u64(IDX_RX_TIME) +
4005	__res_u64(IDX_OBSS_AIRTIME) -
4006	state_ts->cc_rx;
4007	state->cc_busy += __res_u64(IDX_TX_TIME) +
4008	__res_u64(IDX_RX_TIME) +
4009	__res_u64(IDX_OBSS_AIRTIME) +
4010	__res_u64(IDX_NON_WIFI_TIME) -
4011	state_ts->cc_busy;
4012	out:
4013	state_ts->cc_tx = __res_u64(IDX_TX_TIME);
4014	state_ts->cc_bss_rx = __res_u64(IDX_RX_TIME);
4015	state_ts->cc_rx = __res_u64(IDX_RX_TIME) + __res_u64(IDX_OBSS_AIRTIME);
4016	state_ts->cc_busy = __res_u64(IDX_TX_TIME) +
4017	__res_u64(IDX_RX_TIME) +
4018	__res_u64(IDX_OBSS_AIRTIME) +
4019	__res_u64(IDX_NON_WIFI_TIME);
4020	#undef __res_u64
4021
4022	dev_kfree_skb(skb);
4023
4024	return 0;
4025	}
4026
4027	int mt7996_mcu_get_temperature(struct mt7996_phy *phy)
4028	{
4029	#define TEMPERATURE_QUERY 0
4030	#define GET_TEMPERATURE 0
4031	struct {
4032	u8 _rsv[4];
4033
4034	__le16 tag;
4035	__le16 len;
4036
4037	u8 rsv1;
4038	u8 action;
4039	u8 band_idx;
4040	u8 rsv2;
4041	} req = {
4042	.tag = cpu_to_le16(TEMPERATURE_QUERY),
4043	.len = cpu_to_le16(sizeof(req) - 4),
4044	.action = GET_TEMPERATURE,
4045	.band_idx = phy->mt76->band_idx,
4046	};
4047	struct mt7996_mcu_thermal {
4048	u8 _rsv[4];
4049
4050	__le16 tag;
4051	__le16 len;
4052
4053	__le32 rsv;
4054	__le32 temperature;
4055	} __packed * res;
4056	struct sk_buff *skb;
4057	int ret;
4058	u32 temp;
4059
4060	ret = mt76_mcu_send_and_get_msg(dev: &phy->dev->mt76, MCU_WM_UNI_CMD(THERMAL),
4061	data: &req, len: sizeof(req), wait_resp: true, ret: &skb);
4062	if (ret)
4063	return ret;
4064
4065	res = (void *)skb->data;
4066	temp = le32_to_cpu(res->temperature);
4067	dev_kfree_skb(skb);
4068
4069	return temp;
4070	}
4071
4072	int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state)
4073	{
4074	struct {
4075	u8 _rsv[4];
4076
4077	__le16 tag;
4078	__le16 len;
4079
4080	struct mt7996_mcu_thermal_ctrl ctrl;
4081	} __packed req = {
4082	.tag = cpu_to_le16(UNI_CMD_THERMAL_PROTECT_DUTY_CONFIG),
4083	.len = cpu_to_le16(sizeof(req) - 4),
4084	.ctrl = {
4085	.band_idx = phy->mt76->band_idx,
4086	},
4087	};
4088	int level, ret;
4089
4090	/* set duty cycle and level */
4091	for (level = 0; level < 4; level++) {
4092	req.ctrl.duty.duty_level = level;
4093	req.ctrl.duty.duty_cycle = state;
4094	state /= 2;
4095
4096	ret = mt76_mcu_send_msg(dev: &phy->dev->mt76, MCU_WM_UNI_CMD(THERMAL),
4097	data: &req, len: sizeof(req), wait_resp: false);
4098	if (ret)
4099	return ret;
4100	}
4101
4102	return 0;
4103	}
4104
4105	int mt7996_mcu_set_thermal_protect(struct mt7996_phy *phy, bool enable)
4106	{
4107	#define SUSTAIN_PERIOD 10
4108	struct {
4109	u8 _rsv[4];
4110
4111	__le16 tag;
4112	__le16 len;
4113
4114	struct mt7996_mcu_thermal_ctrl ctrl;
4115	struct mt7996_mcu_thermal_enable enable;
4116	} __packed req = {
4117	.len = cpu_to_le16(sizeof(req) - 4 - sizeof(req.enable)),
4118	.ctrl = {
4119	.band_idx = phy->mt76->band_idx,
4120	.type.protect_type = 1,
4121	.type.trigger_type = 1,
4122	},
4123	};
4124	int ret;
4125
4126	req.tag = cpu_to_le16(UNI_CMD_THERMAL_PROTECT_DISABLE);
4127
4128	ret = mt76_mcu_send_msg(dev: &phy->dev->mt76, MCU_WM_UNI_CMD(THERMAL),
4129	data: &req, len: sizeof(req) - sizeof(req.enable), wait_resp: false);
4130	if (ret || !enable)
4131	return ret;
4132
4133	/* set high-temperature trigger threshold */
4134	req.tag = cpu_to_le16(UNI_CMD_THERMAL_PROTECT_ENABLE);
4135	req.enable.restore_temp = cpu_to_le32(phy->throttle_temp[0]);
4136	req.enable.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
4137	req.enable.sustain_time = cpu_to_le16(SUSTAIN_PERIOD);
4138
4139	req.len = cpu_to_le16(sizeof(req) - 4);
4140
4141	return mt76_mcu_send_msg(dev: &phy->dev->mt76, MCU_WM_UNI_CMD(THERMAL),
4142	data: &req, len: sizeof(req), wait_resp: false);
4143	}
4144
4145	int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 val, u8 band)
4146	{
4147	struct {
4148	u8 rsv[4];
4149
4150	__le16 tag;
4151	__le16 len;
4152
4153	union {
4154	struct {
4155	__le32 mask;
4156	} __packed set;
4157
4158	struct {
4159	u8 method;
4160	u8 band;
4161	u8 rsv2[2];
4162	} __packed trigger;
4163	};
4164	} __packed req = {
4165	.tag = cpu_to_le16(action),
4166	.len = cpu_to_le16(sizeof(req) - 4),
4167	};
4168
4169	switch (action) {
4170	case UNI_CMD_SER_SET:
4171	req.set.mask = cpu_to_le32(val);
4172	break;
4173	case UNI_CMD_SER_TRIGGER:
4174	req.trigger.method = val;
4175	req.trigger.band = band;
4176	break;
4177	default:
4178	return -EINVAL;
4179	}
4180
4181	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(SER),
4182	data: &req, len: sizeof(req), wait_resp: false);
4183	}
4184
4185	int mt7996_mcu_set_txbf(struct mt7996_dev *dev, u8 action)
4186	{
4187	#define MT7996_BF_MAX_SIZE sizeof(union bf_tag_tlv)
4188	#define BF_PROCESSING 4
4189	struct uni_header hdr;
4190	struct sk_buff *skb;
4191	struct tlv *tlv;
4192	int len = sizeof(hdr) + MT7996_BF_MAX_SIZE;
4193
4194	memset(&hdr, 0, sizeof(hdr));
4195
4196	skb = mt76_mcu_msg_alloc(dev: &dev->mt76, NULL, data_len: len);
4197	if (!skb)
4198	return -ENOMEM;
4199
4200	skb_put_data(skb, data: &hdr, len: sizeof(hdr));
4201
4202	switch (action) {
4203	case BF_SOUNDING_ON: {
4204	struct bf_sounding_on *req_snd_on;
4205
4206	tlv = mt7996_mcu_add_uni_tlv(skb, tag: action, len: sizeof(*req_snd_on));
4207	req_snd_on = (struct bf_sounding_on *)tlv;
4208	req_snd_on->snd_mode = BF_PROCESSING;
4209	break;
4210	}
4211	case BF_HW_EN_UPDATE: {
4212	struct bf_hw_en_status_update *req_hw_en;
4213
4214	tlv = mt7996_mcu_add_uni_tlv(skb, tag: action, len: sizeof(*req_hw_en));
4215	req_hw_en = (struct bf_hw_en_status_update *)tlv;
4216	req_hw_en->ebf = true;
4217	req_hw_en->ibf = dev->ibf;
4218	break;
4219	}
4220	case BF_MOD_EN_CTRL: {
4221	struct bf_mod_en_ctrl *req_mod_en;
4222
4223	tlv = mt7996_mcu_add_uni_tlv(skb, tag: action, len: sizeof(*req_mod_en));
4224	req_mod_en = (struct bf_mod_en_ctrl *)tlv;
4225	req_mod_en->bf_num = mt7996_band_valid(dev, band: MT_BAND2) ? 3 : 2;
4226	req_mod_en->bf_bitmap = mt7996_band_valid(dev, band: MT_BAND2) ?
4227	GENMASK(2, 0) : GENMASK(1, 0);
4228	break;
4229	}
4230	default:
4231	return -EINVAL;
4232	}
4233
4234	return mt76_mcu_skb_send_msg(dev: &dev->mt76, skb, MCU_WM_UNI_CMD(BF), wait_resp: true);
4235	}
4236
4237	static int
4238	mt7996_mcu_enable_obss_spr(struct mt7996_phy *phy, u16 action, u8 val)
4239	{
4240	struct mt7996_dev *dev = phy->dev;
4241	struct {
4242	u8 band_idx;
4243	u8 __rsv[3];
4244
4245	__le16 tag;
4246	__le16 len;
4247
4248	__le32 val;
4249	} __packed req = {
4250	.band_idx = phy->mt76->band_idx,
4251	.tag = cpu_to_le16(action),
4252	.len = cpu_to_le16(sizeof(req) - 4),
4253	.val = cpu_to_le32(val),
4254	};
4255
4256	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(SR),
4257	data: &req, len: sizeof(req), wait_resp: true);
4258	}
4259
4260	static int
4261	mt7996_mcu_set_obss_spr_pd(struct mt7996_phy *phy,
4262	struct ieee80211_he_obss_pd *he_obss_pd)
4263	{
4264	struct mt7996_dev *dev = phy->dev;
4265	u8 max_th = 82, non_srg_max_th = 62;
4266	struct {
4267	u8 band_idx;
4268	u8 __rsv[3];
4269
4270	__le16 tag;
4271	__le16 len;
4272
4273	u8 pd_th_non_srg;
4274	u8 pd_th_srg;
4275	u8 period_offs;
4276	u8 rcpi_src;
4277	__le16 obss_pd_min;
4278	__le16 obss_pd_min_srg;
4279	u8 resp_txpwr_mode;
4280	u8 txpwr_restrict_mode;
4281	u8 txpwr_ref;
4282	u8 __rsv2[3];
4283	} __packed req = {
4284	.band_idx = phy->mt76->band_idx,
4285	.tag = cpu_to_le16(UNI_CMD_SR_SET_PARAM),
4286	.len = cpu_to_le16(sizeof(req) - 4),
4287	.obss_pd_min = cpu_to_le16(max_th),
4288	.obss_pd_min_srg = cpu_to_le16(max_th),
4289	.txpwr_restrict_mode = 2,
4290	.txpwr_ref = 21
4291	};
4292	int ret;
4293
4294	/* disable firmware dynamical PD asjustment */
4295	ret = mt7996_mcu_enable_obss_spr(phy, action: UNI_CMD_SR_ENABLE_DPD, val: false);
4296	if (ret)
4297	return ret;
4298
4299	if (he_obss_pd->sr_ctrl &
4300	IEEE80211_HE_SPR_NON_SRG_OBSS_PD_SR_DISALLOWED)
4301	req.pd_th_non_srg = max_th;
4302	else if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_NON_SRG_OFFSET_PRESENT)
4303	req.pd_th_non_srg = max_th - he_obss_pd->non_srg_max_offset;
4304	else
4305	req.pd_th_non_srg = non_srg_max_th;
4306
4307	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_SRG_INFORMATION_PRESENT)
4308	req.pd_th_srg = max_th - he_obss_pd->max_offset;
4309
4310	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(SR),
4311	data: &req, len: sizeof(req), wait_resp: true);
4312	}
4313
4314	static int
4315	mt7996_mcu_set_obss_spr_siga(struct mt7996_phy *phy,
4316	struct mt7996_vif_link *link,
4317	struct ieee80211_he_obss_pd *he_obss_pd)
4318	{
4319	struct mt7996_dev *dev = phy->dev;
4320	u8 omac = link->mt76.omac_idx;
4321	struct {
4322	u8 band_idx;
4323	u8 __rsv[3];
4324
4325	__le16 tag;
4326	__le16 len;
4327
4328	u8 omac;
4329	u8 __rsv2[3];
4330	u8 flag[20];
4331	} __packed req = {
4332	.band_idx = phy->mt76->band_idx,
4333	.tag = cpu_to_le16(UNI_CMD_SR_SET_SIGA),
4334	.len = cpu_to_le16(sizeof(req) - 4),
4335	.omac = omac > HW_BSSID_MAX ? omac - 12 : omac,
4336	};
4337	int ret;
4338
4339	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_HESIGA_SR_VAL15_ALLOWED)
4340	req.flag[req.omac] = 0xf;
4341	else
4342	return 0;
4343
4344	/* switch to normal AP mode */
4345	ret = mt7996_mcu_enable_obss_spr(phy, action: UNI_CMD_SR_ENABLE_MODE, val: 0);
4346	if (ret)
4347	return ret;
4348
4349	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(SR),
4350	data: &req, len: sizeof(req), wait_resp: true);
4351	}
4352
4353	static int
4354	mt7996_mcu_set_obss_spr_bitmap(struct mt7996_phy *phy,
4355	struct ieee80211_he_obss_pd *he_obss_pd)
4356	{
4357	struct mt7996_dev *dev = phy->dev;
4358	struct {
4359	u8 band_idx;
4360	u8 __rsv[3];
4361
4362	__le16 tag;
4363	__le16 len;
4364
4365	__le32 color_l[2];
4366	__le32 color_h[2];
4367	__le32 bssid_l[2];
4368	__le32 bssid_h[2];
4369	} __packed req = {
4370	.band_idx = phy->mt76->band_idx,
4371	.tag = cpu_to_le16(UNI_CMD_SR_SET_SRG_BITMAP),
4372	.len = cpu_to_le16(sizeof(req) - 4),
4373	};
4374	u32 bitmap;
4375
4376	memcpy(&bitmap, he_obss_pd->bss_color_bitmap, sizeof(bitmap));
4377	req.color_l[req.band_idx] = cpu_to_le32(bitmap);
4378
4379	memcpy(&bitmap, he_obss_pd->bss_color_bitmap + 4, sizeof(bitmap));
4380	req.color_h[req.band_idx] = cpu_to_le32(bitmap);
4381
4382	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap, sizeof(bitmap));
4383	req.bssid_l[req.band_idx] = cpu_to_le32(bitmap);
4384
4385	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap + 4, sizeof(bitmap));
4386	req.bssid_h[req.band_idx] = cpu_to_le32(bitmap);
4387
4388	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(SR), data: &req,
4389	len: sizeof(req), wait_resp: true);
4390	}
4391
4392	int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy,
4393	struct mt7996_vif_link *link,
4394	struct ieee80211_he_obss_pd *he_obss_pd)
4395	{
4396	int ret;
4397
4398	/* enable firmware scene detection algorithms */
4399	ret = mt7996_mcu_enable_obss_spr(phy, action: UNI_CMD_SR_ENABLE_SD,
4400	val: sr_scene_detect);
4401	if (ret)
4402	return ret;
4403
4404	/* firmware dynamically adjusts PD threshold so skip manual control */
4405	if (sr_scene_detect && !he_obss_pd->enable)
4406	return 0;
4407
4408	/* enable spatial reuse */
4409	ret = mt7996_mcu_enable_obss_spr(phy, action: UNI_CMD_SR_ENABLE,
4410	val: he_obss_pd->enable);
4411	if (ret)
4412	return ret;
4413
4414	if (sr_scene_detect || !he_obss_pd->enable)
4415	return 0;
4416
4417	ret = mt7996_mcu_enable_obss_spr(phy, action: UNI_CMD_SR_ENABLE_TX, val: true);
4418	if (ret)
4419	return ret;
4420
4421	/* set SRG/non-SRG OBSS PD threshold */
4422	ret = mt7996_mcu_set_obss_spr_pd(phy, he_obss_pd);
4423	if (ret)
4424	return ret;
4425
4426	/* Set SR prohibit */
4427	ret = mt7996_mcu_set_obss_spr_siga(phy, link, he_obss_pd);
4428	if (ret)
4429	return ret;
4430
4431	/* set SRG BSS color/BSSID bitmap */
4432	return mt7996_mcu_set_obss_spr_bitmap(phy, he_obss_pd);
4433	}
4434
4435	int mt7996_mcu_update_bss_color(struct mt7996_dev *dev,
4436	struct mt76_vif_link *mlink,
4437	struct cfg80211_he_bss_color *he_bss_color)
4438	{
4439	int len = sizeof(struct bss_req_hdr) + sizeof(struct bss_color_tlv);
4440	struct bss_color_tlv *bss_color;
4441	struct sk_buff *skb;
4442	struct tlv *tlv;
4443
4444	skb = __mt7996_mcu_alloc_bss_req(dev: &dev->mt76, mvif: mlink, len);
4445	if (IS_ERR(ptr: skb))
4446	return PTR_ERR(ptr: skb);
4447
4448	tlv = mt76_connac_mcu_add_tlv(skb, tag: UNI_BSS_INFO_BSS_COLOR,
4449	len: sizeof(*bss_color));
4450	bss_color = (struct bss_color_tlv *)tlv;
4451	bss_color->enable = he_bss_color->enabled;
4452	bss_color->color = he_bss_color->color;
4453
4454	return mt76_mcu_skb_send_msg(dev: &dev->mt76, skb,
4455	MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), wait_resp: true);
4456	}
4457
4458	#define TWT_AGRT_TRIGGER BIT(0)
4459	#define TWT_AGRT_ANNOUNCE BIT(1)
4460	#define TWT_AGRT_PROTECT BIT(2)
4461
4462	int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
4463	struct mt7996_vif_link *link,
4464	struct mt7996_twt_flow *flow,
4465	int cmd)
4466	{
4467	struct {
4468	/* fixed field */
4469	u8 bss;
4470	u8 _rsv[3];
4471
4472	__le16 tag;
4473	__le16 len;
4474	u8 tbl_idx;
4475	u8 cmd;
4476	u8 own_mac_idx;
4477	u8 flowid; /* 0xff for group id */
4478	__le16 peer_id; /* specify the peer_id (msb=0)
4479	* or group_id (msb=1)
4480	*/
4481	u8 duration; /* 256 us */
4482	u8 bss_idx;
4483	__le64 start_tsf;
4484	__le16 mantissa;
4485	u8 exponent;
4486	u8 is_ap;
4487	u8 agrt_params;
4488	u8 __rsv2[23];
4489	} __packed req = {
4490	.tag = cpu_to_le16(UNI_CMD_TWT_ARGT_UPDATE),
4491	.len = cpu_to_le16(sizeof(req) - 4),
4492	.tbl_idx = flow->table_id,
4493	.cmd = cmd,
4494	.own_mac_idx = link->mt76.omac_idx,
4495	.flowid = flow->id,
4496	.peer_id = cpu_to_le16(flow->wcid),
4497	.duration = flow->duration,
4498	.bss = link->mt76.idx,
4499	.bss_idx = link->mt76.idx,
4500	.start_tsf = cpu_to_le64(flow->tsf),
4501	.mantissa = flow->mantissa,
4502	.exponent = flow->exp,
4503	.is_ap = true,
4504	};
4505
4506	if (flow->protection)
4507	req.agrt_params |= TWT_AGRT_PROTECT;
4508	if (!flow->flowtype)
4509	req.agrt_params |= TWT_AGRT_ANNOUNCE;
4510	if (flow->trigger)
4511	req.agrt_params |= TWT_AGRT_TRIGGER;
4512
4513	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(TWT),
4514	data: &req, len: sizeof(req), wait_resp: true);
4515	}
4516
4517	int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val)
4518	{
4519	struct {
4520	u8 band_idx;
4521	u8 _rsv[3];
4522
4523	__le16 tag;
4524	__le16 len;
4525	__le32 len_thresh;
4526	__le32 pkt_thresh;
4527	} __packed req = {
4528	.band_idx = phy->mt76->band_idx,
4529	.tag = cpu_to_le16(UNI_BAND_CONFIG_RTS_THRESHOLD),
4530	.len = cpu_to_le16(sizeof(req) - 4),
4531	.len_thresh = cpu_to_le32(val),
4532	.pkt_thresh = cpu_to_le32(0x2),
4533	};
4534
4535	return mt76_mcu_send_msg(dev: &phy->dev->mt76, MCU_WM_UNI_CMD(BAND_CONFIG),
4536	data: &req, len: sizeof(req), wait_resp: true);
4537	}
4538
4539	int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable)
4540	{
4541	struct {
4542	u8 band_idx;
4543	u8 _rsv[3];
4544
4545	__le16 tag;
4546	__le16 len;
4547	u8 enable;
4548	u8 _rsv2[3];
4549	} __packed req = {
4550	.band_idx = phy->mt76->band_idx,
4551	.tag = cpu_to_le16(UNI_BAND_CONFIG_RADIO_ENABLE),
4552	.len = cpu_to_le16(sizeof(req) - 4),
4553	.enable = enable,
4554	};
4555
4556	return mt76_mcu_send_msg(dev: &phy->dev->mt76, MCU_WM_UNI_CMD(BAND_CONFIG),
4557	data: &req, len: sizeof(req), wait_resp: true);
4558	}
4559
4560	int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 rdd_idx, u8 val)
4561	{
4562	struct {
4563	u8 _rsv[4];
4564
4565	__le16 tag;
4566	__le16 len;
4567
4568	u8 ctrl;
4569	u8 rdd_idx;
4570	u8 rdd_rx_sel;
4571	u8 val;
4572	u8 rsv[4];
4573	} __packed req = {
4574	.tag = cpu_to_le16(UNI_RDD_CTRL_PARM),
4575	.len = cpu_to_le16(sizeof(req) - 4),
4576	.ctrl = cmd,
4577	.rdd_idx = rdd_idx,
4578	.val = val,
4579	};
4580
4581	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(RDD_CTRL),
4582	data: &req, len: sizeof(req), wait_resp: true);
4583	}
4584
4585	int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
4586	struct ieee80211_vif *vif,
4587	struct mt7996_vif_link *link,
4588	struct mt7996_sta_link *msta_link)
4589	{
4590	struct sk_buff *skb;
4591
4592	skb = __mt76_connac_mcu_alloc_sta_req(dev: &dev->mt76, mvif: &link->mt76,
4593	wcid: &msta_link->wcid,
4594	MT7996_STA_UPDATE_MAX_SIZE);
4595	if (IS_ERR(ptr: skb))
4596	return PTR_ERR(ptr: skb);
4597
4598	/* starec hdr trans */
4599	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, wcid: &msta_link->wcid);
4600	return mt76_mcu_skb_send_msg(dev: &dev->mt76, skb,
4601	MCU_WMWA_UNI_CMD(STA_REC_UPDATE), wait_resp: true);
4602	}
4603
4604	int mt7996_mcu_set_fixed_rate_table(struct mt7996_phy *phy, u8 table_idx,
4605	u16 rate_idx, bool beacon)
4606	{
4607	#define UNI_FIXED_RATE_TABLE_SET 0
4608	#define SPE_IXD_SELECT_TXD 0
4609	#define SPE_IXD_SELECT_BMC_WTBL 1
4610	struct mt7996_dev *dev = phy->dev;
4611	struct fixed_rate_table_ctrl req = {
4612	.tag = cpu_to_le16(UNI_FIXED_RATE_TABLE_SET),
4613	.len = cpu_to_le16(sizeof(req) - 4),
4614	.table_idx = table_idx,
4615	.rate_idx = cpu_to_le16(rate_idx),
4616	.gi = 1,
4617	.he_ltf = 1,
4618	};
4619	u8 band_idx = phy->mt76->band_idx;
4620
4621	if (beacon) {
4622	req.spe_idx_sel = SPE_IXD_SELECT_TXD;
4623	req.spe_idx = 24 + band_idx;
4624	phy->beacon_rate = rate_idx;
4625	} else {
4626	req.spe_idx_sel = SPE_IXD_SELECT_BMC_WTBL;
4627	}
4628
4629	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(FIXED_RATE_TABLE),
4630	data: &req, len: sizeof(req), wait_resp: false);
4631	}
4632
4633	int mt7996_mcu_rf_regval(struct mt7996_dev *dev, u32 regidx, u32 *val, bool set)
4634	{
4635	struct {
4636	u8 __rsv1[4];
4637
4638	__le16 tag;
4639	__le16 len;
4640	__le16 idx;
4641	u8 __rsv2[2];
4642	__le32 ofs;
4643	__le32 data;
4644	} __packed *res, req = {
4645	.tag = cpu_to_le16(UNI_CMD_ACCESS_RF_REG_BASIC),
4646	.len = cpu_to_le16(sizeof(req) - 4),
4647
4648	.idx = cpu_to_le16(u32_get_bits(regidx, GENMASK(31, 24))),
4649	.ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(23, 0))),
4650	.data = set ? cpu_to_le32(*val) : 0,
4651	};
4652	struct sk_buff *skb;
4653	int ret;
4654
4655	if (set)
4656	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(REG_ACCESS),
4657	data: &req, len: sizeof(req), wait_resp: true);
4658
4659	ret = mt76_mcu_send_and_get_msg(dev: &dev->mt76,
4660	MCU_WM_UNI_CMD_QUERY(REG_ACCESS),
4661	data: &req, len: sizeof(req), wait_resp: true, ret: &skb);
4662	if (ret)
4663	return ret;
4664
4665	res = (void *)skb->data;
4666	*val = le32_to_cpu(res->data);
4667	dev_kfree_skb(skb);
4668
4669	return 0;
4670	}
4671
4672	int mt7996_mcu_trigger_assert(struct mt7996_dev *dev)
4673	{
4674	struct {
4675	__le16 tag;
4676	__le16 len;
4677	u8 enable;
4678	u8 rsv[3];
4679	} __packed req = {
4680	.len = cpu_to_le16(sizeof(req) - 4),
4681	.enable = true,
4682	};
4683
4684	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(ASSERT_DUMP),
4685	data: &req, len: sizeof(req), wait_resp: false);
4686	}
4687
4688	int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val)
4689	{
4690	struct {
4691	u8 __rsv1[4];
4692	__le16 tag;
4693	__le16 len;
4694	union {
4695	struct {
4696	u8 type;
4697	u8 __rsv2[3];
4698	} __packed platform_type;
4699	struct {
4700	u8 type;
4701	u8 dest;
4702	u8 __rsv2[2];
4703	} __packed bypass_mode;
4704	struct {
4705	u8 path;
4706	u8 __rsv2[3];
4707	} __packed txfree_path;
4708	struct {
4709	__le16 flush_one;
4710	__le16 flush_all;
4711	u8 __rsv2[4];
4712	} __packed timeout;
4713	};
4714	} __packed req = {
4715	.tag = cpu_to_le16(tag),
4716	.len = cpu_to_le16(sizeof(req) - 4),
4717	};
4718
4719	switch (tag) {
4720	case UNI_RRO_SET_PLATFORM_TYPE:
4721	req.platform_type.type = val;
4722	break;
4723	case UNI_RRO_SET_BYPASS_MODE:
4724	req.bypass_mode.type = val;
4725	break;
4726	case UNI_RRO_SET_TXFREE_PATH:
4727	req.txfree_path.path = val;
4728	break;
4729	case UNI_RRO_SET_FLUSH_TIMEOUT:
4730	req.timeout.flush_one = cpu_to_le16(val);
4731	req.timeout.flush_all = cpu_to_le16(2 * val);
4732	break;
4733	default:
4734	return -EINVAL;
4735	}
4736
4737	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(RRO), data: &req,
4738	len: sizeof(req), wait_resp: true);
4739	}
4740
4741	int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag)
4742	{
4743	struct mt7996_dev *dev = phy->dev;
4744	struct {
4745	u8 _rsv[4];
4746
4747	__le16 tag;
4748	__le16 len;
4749	} __packed req = {
4750	.tag = cpu_to_le16(tag),
4751	.len = cpu_to_le16(sizeof(req) - 4),
4752	};
4753
4754	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(ALL_STA_INFO),
4755	data: &req, len: sizeof(req), wait_resp: false);
4756	}
4757
4758	int mt7996_mcu_wed_rro_reset_sessions(struct mt7996_dev *dev, u16 id)
4759	{
4760	struct {
4761	u8 __rsv[4];
4762
4763	__le16 tag;
4764	__le16 len;
4765	__le16 session_id;
4766	u8 pad[4];
4767	} __packed req = {
4768	.tag = cpu_to_le16(UNI_RRO_DEL_BA_SESSION),
4769	.len = cpu_to_le16(sizeof(req) - 4),
4770	.session_id = cpu_to_le16(id),
4771	};
4772
4773	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(RRO), data: &req,
4774	len: sizeof(req), wait_resp: true);
4775	}
4776
4777	int mt7996_mcu_set_sniffer_mode(struct mt7996_phy *phy, bool enabled)
4778	{
4779	struct mt7996_dev *dev = phy->dev;
4780	struct {
4781	u8 band_idx;
4782	u8 _rsv[3];
4783	__le16 tag;
4784	__le16 len;
4785	u8 enable;
4786	u8 _pad[3];
4787	} __packed req = {
4788	.band_idx = phy->mt76->band_idx,
4789	.tag = 0,
4790	.len = cpu_to_le16(sizeof(req) - 4),
4791	.enable = enabled,
4792	};
4793
4794	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WM_UNI_CMD(SNIFFER), data: &req,
4795	len: sizeof(req), wait_resp: true);
4796	}
4797
4798	int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
4799	{
4800	#define TX_POWER_LIMIT_TABLE_RATE 0
4801	struct mt7996_dev *dev = phy->dev;
4802	struct mt76_phy *mphy = phy->mt76;
4803	struct tx_power_limit_table_ctrl {
4804	u8 __rsv1[4];
4805
4806	__le16 tag;
4807	__le16 len;
4808	u8 power_ctrl_id;
4809	u8 power_limit_type;
4810	u8 band_idx;
4811	} __packed req = {
4812	.tag = cpu_to_le16(UNI_TXPOWER_POWER_LIMIT_TABLE_CTRL),
4813	.len = cpu_to_le16(sizeof(req) + MT7996_SKU_PATH_NUM - 4),
4814	.power_ctrl_id = UNI_TXPOWER_POWER_LIMIT_TABLE_CTRL,
4815	.power_limit_type = TX_POWER_LIMIT_TABLE_RATE,
4816	.band_idx = phy->mt76->band_idx,
4817	};
4818	struct mt76_power_limits la = {};
4819	struct sk_buff *skb;
4820	int i, tx_power;
4821
4822	tx_power = mt76_get_power_bound(phy: mphy, txpower: phy->txpower);
4823	tx_power = mt76_get_rate_power_limits(phy: mphy, chan: mphy->chandef.chan,
4824	dest: &la, target_power: tx_power);
4825	mphy->txpower_cur = tx_power;
4826
4827	skb = mt76_mcu_msg_alloc(dev: &dev->mt76, NULL,
4828	data_len: sizeof(req) + MT7996_SKU_PATH_NUM);
4829	if (!skb)
4830	return -ENOMEM;
4831
4832	skb_put_data(skb, data: &req, len: sizeof(req));
4833	/* cck and ofdm */
4834	skb_put_data(skb, data: &la.cck, len: sizeof(la.cck));
4835	skb_put_data(skb, data: &la.ofdm, len: sizeof(la.ofdm));
4836	/* ht20 */
4837	skb_put_data(skb, data: &la.mcs[0], len: 8);
4838	/* ht40 */
4839	skb_put_data(skb, data: &la.mcs[1], len: 9);
4840
4841	/* vht */
4842	for (i = 0; i < 4; i++) {
4843	skb_put_data(skb, data: &la.mcs[i], len: sizeof(la.mcs[i]));
4844	skb_put_zero(skb, len: 2); /* padding */
4845	}
4846
4847	/* he */
4848	skb_put_data(skb, data: &la.ru[0], len: sizeof(la.ru));
4849	/* eht */
4850	skb_put_data(skb, data: &la.eht[0], len: sizeof(la.eht));
4851
4852	/* padding */
4853	skb_put_zero(skb, MT7996_SKU_PATH_NUM - MT7996_SKU_RATE_NUM);
4854
4855	return mt76_mcu_skb_send_msg(dev: &dev->mt76, skb,
4856	MCU_WM_UNI_CMD(TXPOWER), wait_resp: true);
4857	}
4858
4859	int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode)
4860	{
4861	__le32 cp_mode;
4862
4863	if (mode < mt76_connac_lmac_mapping(ac: IEEE80211_AC_BE) ||
4864	mode > mt76_connac_lmac_mapping(ac: IEEE80211_AC_VO))
4865	return -EINVAL;
4866
4867	if (!mt7996_has_wa(dev)) {
4868	struct {
4869	u8 _rsv[4];
4870
4871	__le16 tag;
4872	__le16 len;
4873	u8 cp_mode;
4874	u8 rsv[3];
4875	} __packed req = {
4876	.tag = cpu_to_le16(UNI_CMD_SDO_CP_MODE),
4877	.len = cpu_to_le16(sizeof(req) - 4),
4878	.cp_mode = mode,
4879	};
4880
4881	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WA_UNI_CMD(SDO),
4882	data: &req, len: sizeof(req), wait_resp: false);
4883	}
4884
4885	cp_mode = cpu_to_le32(mode);
4886
4887	return mt76_mcu_send_msg(dev: &dev->mt76, MCU_WA_EXT_CMD(CP_SUPPORT),
4888	data: &cp_mode, len: sizeof(cp_mode), wait_resp: true);
4889	}
4890