xref: /linux/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c (revision 8f7aa3d3c7323f4ca2768a9e74ebbe359c4f8f88)
1 // SPDX-License-Identifier: BSD-3-Clause-Clear
2 /* Copyright (C) 2023 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include <linux/firmware.h>
6 #include "mt7925.h"
7 #include "regd.h"
8 #include "mcu.h"
9 #include "mac.h"
10 
11 #define MT_STA_BFER			BIT(0)
12 #define MT_STA_BFEE			BIT(1)
13 
14 int mt7925_mcu_parse_response(struct mt76_dev *mdev, int cmd,
15 			      struct sk_buff *skb, int seq)
16 {
17 	int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
18 	struct mt7925_mcu_rxd *rxd;
19 	int ret = 0;
20 
21 	if (!skb) {
22 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n", cmd, seq);
23 		mt792x_reset(mdev);
24 
25 		return -ETIMEDOUT;
26 	}
27 
28 	rxd = (struct mt7925_mcu_rxd *)skb->data;
29 	if (seq != rxd->seq)
30 		return -EAGAIN;
31 
32 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL) ||
33 	    cmd == MCU_CMD(PATCH_FINISH_REQ)) {
34 		skb_pull(skb, sizeof(*rxd) - 4);
35 		ret = *skb->data;
36 	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
37 		   cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
38 		   cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
39 		   cmd == MCU_UNI_CMD(OFFLOAD) ||
40 		   cmd == MCU_UNI_CMD(SUSPEND)) {
41 		struct mt7925_mcu_uni_event *event;
42 
43 		skb_pull(skb, sizeof(*rxd));
44 		event = (struct mt7925_mcu_uni_event *)skb->data;
45 		ret = le32_to_cpu(event->status);
46 		/* skip invalid event */
47 		if (mcu_cmd != event->cid)
48 			ret = -EAGAIN;
49 	} else {
50 		skb_pull(skb, sizeof(*rxd));
51 	}
52 
53 	return ret;
54 }
55 EXPORT_SYMBOL_GPL(mt7925_mcu_parse_response);
56 
57 int mt7925_mcu_regval(struct mt792x_dev *dev, u32 regidx, u32 *val, bool set)
58 {
59 #define MT_RF_REG_HDR           GENMASK(31, 24)
60 #define MT_RF_REG_ANT           GENMASK(23, 16)
61 #define RF_REG_PREFIX           0x99
62 	struct {
63 		u8 __rsv[4];
64 		union {
65 			struct uni_cmd_access_reg_basic {
66 				__le16 tag;
67 				__le16 len;
68 				__le32 idx;
69 				__le32 data;
70 			} __packed reg;
71 			struct uni_cmd_access_rf_reg_basic {
72 				__le16 tag;
73 				__le16 len;
74 				__le16 ant;
75 				u8 __rsv[2];
76 				__le32 idx;
77 				__le32 data;
78 			} __packed rf_reg;
79 		};
80 	} __packed * res, req;
81 	struct sk_buff *skb;
82 	int ret;
83 
84 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX) {
85 		req.rf_reg.tag = cpu_to_le16(UNI_CMD_ACCESS_RF_REG_BASIC);
86 		req.rf_reg.len = cpu_to_le16(sizeof(req.rf_reg));
87 		req.rf_reg.ant = cpu_to_le16(u32_get_bits(regidx, MT_RF_REG_ANT));
88 		req.rf_reg.idx = cpu_to_le32(regidx);
89 		req.rf_reg.data = set ? cpu_to_le32(*val) : 0;
90 	} else {
91 		req.reg.tag = cpu_to_le16(UNI_CMD_ACCESS_REG_BASIC);
92 		req.reg.len = cpu_to_le16(sizeof(req.reg));
93 		req.reg.idx = cpu_to_le32(regidx);
94 		req.reg.data = set ? cpu_to_le32(*val) : 0;
95 	}
96 
97 	if (set)
98 		return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(REG_ACCESS),
99 					 &req, sizeof(req), true);
100 
101 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
102 					MCU_WM_UNI_CMD_QUERY(REG_ACCESS),
103 					&req, sizeof(req), true, &skb);
104 	if (ret)
105 		return ret;
106 
107 	res = (void *)skb->data;
108 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX)
109 		*val = le32_to_cpu(res->rf_reg.data);
110 	else
111 		*val = le32_to_cpu(res->reg.data);
112 
113 	dev_kfree_skb(skb);
114 
115 	return 0;
116 }
117 EXPORT_SYMBOL_GPL(mt7925_mcu_regval);
118 
119 int mt7925_mcu_update_arp_filter(struct mt76_dev *dev,
120 				 struct ieee80211_bss_conf *link_conf)
121 {
122 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
123 	struct ieee80211_vif *mvif = link_conf->vif;
124 	struct sk_buff *skb;
125 	int i, len = min_t(int, mvif->cfg.arp_addr_cnt,
126 			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
127 	struct {
128 		struct {
129 			u8 bss_idx;
130 			u8 pad[3];
131 		} __packed hdr;
132 		struct mt7925_arpns_tlv arp;
133 	} req = {
134 		.hdr = {
135 			.bss_idx = mconf->mt76.idx,
136 		},
137 		.arp = {
138 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
139 			.len = cpu_to_le16(sizeof(req) - 4 + len * 2 * sizeof(__be32)),
140 			.ips_num = len,
141 			.enable = true,
142 		},
143 	};
144 
145 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(req) + len * 2 * sizeof(__be32));
146 	if (!skb)
147 		return -ENOMEM;
148 
149 	skb_put_data(skb, &req, sizeof(req));
150 	for (i = 0; i < len; i++) {
151 		skb_put_data(skb, &mvif->cfg.arp_addr_list[i], sizeof(__be32));
152 		skb_put_zero(skb, sizeof(__be32));
153 	}
154 
155 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
156 }
157 
158 #ifdef CONFIG_PM
159 static int
160 mt7925_connac_mcu_set_wow_ctrl(struct mt76_phy *phy, struct ieee80211_vif *vif,
161 			       bool suspend, struct cfg80211_wowlan *wowlan)
162 {
163 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
164 	struct ieee80211_scan_ies ies = {};
165 	struct mt76_dev *dev = phy->dev;
166 	struct {
167 		struct {
168 			u8 bss_idx;
169 			u8 pad[3];
170 		} __packed hdr;
171 		struct mt76_connac_wow_ctrl_tlv wow_ctrl_tlv;
172 		struct mt76_connac_wow_gpio_param_tlv gpio_tlv;
173 	} req = {
174 		.hdr = {
175 			.bss_idx = mvif->idx,
176 		},
177 		.wow_ctrl_tlv = {
178 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
179 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_ctrl_tlv)),
180 			.cmd = suspend ? 1 : 2,
181 		},
182 		.gpio_tlv = {
183 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_GPIO_PARAM),
184 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_gpio_param_tlv)),
185 			.gpio_pin = 0xff, /* follow fw about GPIO pin */
186 		},
187 	};
188 
189 	if (wowlan->magic_pkt)
190 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_MAGIC;
191 	if (wowlan->disconnect)
192 		req.wow_ctrl_tlv.trigger |= (UNI_WOW_DETECT_TYPE_DISCONNECT |
193 					     UNI_WOW_DETECT_TYPE_BCN_LOST);
194 	if (wowlan->nd_config) {
195 		mt7925_mcu_sched_scan_req(phy, vif, wowlan->nd_config, &ies);
196 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_SCH_SCAN_HIT;
197 		mt7925_mcu_sched_scan_enable(phy, vif, suspend);
198 	}
199 	if (wowlan->n_patterns)
200 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_BITMAP;
201 
202 	if (mt76_is_mmio(dev))
203 		req.wow_ctrl_tlv.wakeup_hif = WOW_PCIE;
204 	else if (mt76_is_usb(dev))
205 		req.wow_ctrl_tlv.wakeup_hif = WOW_USB;
206 	else if (mt76_is_sdio(dev))
207 		req.wow_ctrl_tlv.wakeup_hif = WOW_GPIO;
208 
209 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(SUSPEND), &req,
210 				 sizeof(req), true);
211 }
212 
213 static int
214 mt7925_mcu_set_wow_pattern(struct mt76_dev *dev,
215 			   struct ieee80211_vif *vif,
216 			   u8 index, bool enable,
217 			   struct cfg80211_pkt_pattern *pattern)
218 {
219 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
220 	struct mt7925_wow_pattern_tlv *tlv;
221 	struct sk_buff *skb;
222 	struct {
223 		u8 bss_idx;
224 		u8 pad[3];
225 	} __packed hdr = {
226 		.bss_idx = mvif->idx,
227 	};
228 
229 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(hdr) + sizeof(*tlv));
230 	if (!skb)
231 		return -ENOMEM;
232 
233 	skb_put_data(skb, &hdr, sizeof(hdr));
234 	tlv = (struct mt7925_wow_pattern_tlv *)skb_put(skb, sizeof(*tlv));
235 	tlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
236 	tlv->len = cpu_to_le16(sizeof(*tlv));
237 	tlv->bss_idx = 0xF;
238 	tlv->data_len = pattern->pattern_len;
239 	tlv->enable = enable;
240 	tlv->index = index;
241 	tlv->offset = 0;
242 
243 	memcpy(tlv->pattern, pattern->pattern, pattern->pattern_len);
244 	memcpy(tlv->mask, pattern->mask, DIV_ROUND_UP(pattern->pattern_len, 8));
245 
246 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SUSPEND), true);
247 }
248 
249 void mt7925_mcu_set_suspend_iter(void *priv, u8 *mac,
250 				 struct ieee80211_vif *vif)
251 {
252 	struct mt76_phy *phy = priv;
253 	bool suspend = !test_bit(MT76_STATE_RUNNING, &phy->state);
254 	struct ieee80211_hw *hw = phy->hw;
255 	struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
256 	int i;
257 
258 	mt76_connac_mcu_set_gtk_rekey(phy->dev, vif, suspend);
259 
260 	mt76_connac_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
261 
262 	for (i = 0; i < wowlan->n_patterns; i++)
263 		mt7925_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
264 					   &wowlan->patterns[i]);
265 	mt7925_connac_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
266 }
267 
268 #endif /* CONFIG_PM */
269 
270 static void
271 mt7925_mcu_connection_loss_iter(void *priv, u8 *mac,
272 				struct ieee80211_vif *vif)
273 {
274 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
275 	struct mt7925_uni_beacon_loss_event *event = priv;
276 
277 	if (mvif->idx != event->hdr.bss_idx)
278 		return;
279 
280 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER) ||
281 	    vif->type != NL80211_IFTYPE_STATION)
282 		return;
283 
284 	ieee80211_connection_loss(vif);
285 }
286 
287 static void
288 mt7925_mcu_connection_loss_event(struct mt792x_dev *dev, struct sk_buff *skb)
289 {
290 	struct mt7925_uni_beacon_loss_event *event;
291 	struct mt76_phy *mphy = &dev->mt76.phy;
292 
293 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd));
294 	event = (struct mt7925_uni_beacon_loss_event *)skb->data;
295 
296 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
297 					IEEE80211_IFACE_ITER_RESUME_ALL,
298 					mt7925_mcu_connection_loss_iter, event);
299 }
300 
301 static void
302 mt7925_mcu_roc_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
303 {
304 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
305 	struct mt7925_roc_grant_tlv *grant = priv;
306 
307 	if (ieee80211_vif_is_mld(vif) && vif->type == NL80211_IFTYPE_STATION)
308 		return;
309 
310 	if (mvif->idx != grant->bss_idx)
311 		return;
312 
313 	mvif->band_idx = grant->dbdcband;
314 }
315 
316 static void mt7925_mcu_roc_handle_grant(struct mt792x_dev *dev,
317 					struct tlv *tlv)
318 {
319 	struct ieee80211_hw *hw = dev->mt76.hw;
320 	struct mt7925_roc_grant_tlv *grant;
321 	int duration;
322 
323 	grant = (struct mt7925_roc_grant_tlv *)tlv;
324 
325 	/* should never happen */
326 	WARN_ON_ONCE((le16_to_cpu(grant->tag) != UNI_EVENT_ROC_GRANT));
327 
328 	if (grant->reqtype == MT7925_ROC_REQ_ROC)
329 		ieee80211_ready_on_channel(hw);
330 	else if (grant->reqtype == MT7925_ROC_REQ_JOIN)
331 		ieee80211_iterate_active_interfaces_atomic(hw,
332 						IEEE80211_IFACE_ITER_RESUME_ALL,
333 						mt7925_mcu_roc_iter, grant);
334 	dev->phy.roc_grant = true;
335 	wake_up(&dev->phy.roc_wait);
336 	duration = le32_to_cpu(grant->max_interval);
337 	mod_timer(&dev->phy.roc_timer,
338 		  jiffies + msecs_to_jiffies(duration));
339 }
340 
341 static void
342 mt7925_mcu_handle_hif_ctrl_basic(struct mt792x_dev *dev, struct tlv *tlv)
343 {
344 	struct mt7925_mcu_hif_ctrl_basic_tlv *basic;
345 
346 	basic = (struct mt7925_mcu_hif_ctrl_basic_tlv *)tlv;
347 
348 	if (basic->hifsuspend) {
349 		dev->hif_idle = true;
350 		if (!(basic->hif_tx_traffic_status == HIF_TRAFFIC_IDLE &&
351 		      basic->hif_rx_traffic_status == HIF_TRAFFIC_IDLE))
352 			dev_info(dev->mt76.dev, "Hif traffic not idle.\n");
353 	} else {
354 		dev->hif_resumed = true;
355 	}
356 	wake_up(&dev->wait);
357 }
358 
359 static void
360 mt7925_mcu_uni_hif_ctrl_event(struct mt792x_dev *dev, struct sk_buff *skb)
361 {
362 	struct tlv *tlv;
363 	u32 tlv_len;
364 
365 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
366 	tlv = (struct tlv *)skb->data;
367 	tlv_len = skb->len;
368 
369 	while (tlv_len > 0 && le16_to_cpu(tlv->len) <= tlv_len) {
370 		switch (le16_to_cpu(tlv->tag)) {
371 		case UNI_EVENT_HIF_CTRL_BASIC:
372 			mt7925_mcu_handle_hif_ctrl_basic(dev, tlv);
373 			break;
374 		default:
375 			break;
376 		}
377 		tlv_len -= le16_to_cpu(tlv->len);
378 		tlv = (struct tlv *)((char *)(tlv) + le16_to_cpu(tlv->len));
379 	}
380 }
381 
382 static void
383 mt7925_mcu_uni_roc_event(struct mt792x_dev *dev, struct sk_buff *skb)
384 {
385 	struct tlv *tlv;
386 	int i = 0;
387 
388 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
389 
390 	while (i < skb->len) {
391 		tlv = (struct tlv *)(skb->data + i);
392 
393 		switch (le16_to_cpu(tlv->tag)) {
394 		case UNI_EVENT_ROC_GRANT:
395 			mt7925_mcu_roc_handle_grant(dev, tlv);
396 			break;
397 		case UNI_EVENT_ROC_GRANT_SUB_LINK:
398 			break;
399 		}
400 
401 		i += le16_to_cpu(tlv->len);
402 	}
403 }
404 
405 static void
406 mt7925_mcu_scan_event(struct mt792x_dev *dev, struct sk_buff *skb)
407 {
408 	struct mt76_phy *mphy = &dev->mt76.phy;
409 	struct mt792x_phy *phy = mphy->priv;
410 
411 	spin_lock_bh(&dev->mt76.lock);
412 	__skb_queue_tail(&phy->scan_event_list, skb);
413 	spin_unlock_bh(&dev->mt76.lock);
414 
415 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
416 				     MT792x_HW_SCAN_TIMEOUT);
417 }
418 
419 static void
420 mt7925_mcu_tx_done_event(struct mt792x_dev *dev, struct sk_buff *skb)
421 {
422 #define UNI_EVENT_TX_DONE_MSG 0
423 #define UNI_EVENT_TX_DONE_RAW 1
424 	struct mt7925_mcu_txs_event {
425 		u8 ver;
426 		u8 rsv[3];
427 		u8 data[];
428 	} __packed * txs;
429 	struct tlv *tlv;
430 	u32 tlv_len;
431 
432 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
433 	tlv = (struct tlv *)skb->data;
434 	tlv_len = skb->len;
435 
436 	while (tlv_len > 0 && le16_to_cpu(tlv->len) <= tlv_len) {
437 		switch (le16_to_cpu(tlv->tag)) {
438 		case UNI_EVENT_TX_DONE_RAW:
439 			txs = (struct mt7925_mcu_txs_event *)tlv->data;
440 			mt7925_mac_add_txs(dev, txs->data);
441 			break;
442 		default:
443 			break;
444 		}
445 		tlv_len -= le16_to_cpu(tlv->len);
446 		tlv = (struct tlv *)((char *)(tlv) + le16_to_cpu(tlv->len));
447 	}
448 }
449 
450 static void
451 mt7925_mcu_rssi_monitor_iter(void *priv, u8 *mac,
452 			     struct ieee80211_vif *vif)
453 {
454 	struct mt7925_uni_rssi_monitor_event *event = priv;
455 	enum nl80211_cqm_rssi_threshold_event nl_event;
456 	s32 rssi = le32_to_cpu(event->rssi);
457 
458 	if (vif->type != NL80211_IFTYPE_STATION)
459 		return;
460 
461 	if (!(vif->driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI))
462 		return;
463 
464 	if (rssi > vif->bss_conf.cqm_rssi_thold)
465 		nl_event = NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH;
466 	else
467 		nl_event = NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW;
468 
469 	ieee80211_cqm_rssi_notify(vif, nl_event, rssi, GFP_KERNEL);
470 }
471 
472 static void
473 mt7925_mcu_rssi_monitor_event(struct mt792x_dev *dev, struct sk_buff *skb)
474 {
475 	struct tlv *tlv;
476 	u32 tlv_len;
477 	struct mt7925_uni_rssi_monitor_event *event;
478 
479 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
480 	tlv = (struct tlv *)skb->data;
481 	tlv_len = skb->len;
482 
483 	while (tlv_len > 0 && le16_to_cpu(tlv->len) <= tlv_len) {
484 		switch (le16_to_cpu(tlv->tag)) {
485 		case UNI_EVENT_RSSI_MONITOR_INFO:
486 			event = (struct mt7925_uni_rssi_monitor_event *)skb->data;
487 			ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
488 								   IEEE80211_IFACE_ITER_RESUME_ALL,
489 								   mt7925_mcu_rssi_monitor_iter,
490 								   event);
491 			break;
492 		default:
493 			break;
494 		}
495 		tlv_len -= le16_to_cpu(tlv->len);
496 		tlv = (struct tlv *)((char *)(tlv) + le16_to_cpu(tlv->len));
497 	}
498 }
499 
500 static void
501 mt7925_mcu_uni_debug_msg_event(struct mt792x_dev *dev, struct sk_buff *skb)
502 {
503 	struct mt7925_uni_debug_msg {
504 		__le16 tag;
505 		__le16 len;
506 		u8 fmt;
507 		u8 rsv[3];
508 		u8 id;
509 		u8 type:3;
510 		u8 nr_args:5;
511 		union {
512 			struct idxlog {
513 				__le16 rsv;
514 				__le32 ts;
515 				__le32 idx;
516 				u8 data[];
517 			} __packed idx;
518 			struct txtlog {
519 				u8 len;
520 				u8 rsv;
521 				__le32 ts;
522 				u8 data[];
523 			} __packed txt;
524 		};
525 	} __packed * hdr;
526 
527 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
528 	hdr = (struct mt7925_uni_debug_msg *)skb->data;
529 
530 	if (hdr->id == 0x28) {
531 		skb_pull(skb, offsetof(struct mt7925_uni_debug_msg, id));
532 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", skb->len, skb->data);
533 		return;
534 	} else if (hdr->id != 0xa8) {
535 		return;
536 	}
537 
538 	if (hdr->type == 0) { /* idx log */
539 		int i, ret, len = PAGE_SIZE - 1, nr_val;
540 		struct page *page = dev_alloc_pages(get_order(len));
541 		__le32 *val;
542 		char *buf, *cur;
543 
544 		if (!page)
545 			return;
546 
547 		buf = page_address(page);
548 		cur = buf;
549 
550 		nr_val = (le16_to_cpu(hdr->len) - sizeof(*hdr)) / 4;
551 		val = (__le32 *)hdr->idx.data;
552 		for (i = 0; i < nr_val && len > 0; i++) {
553 			ret = snprintf(cur, len, "0x%x,", le32_to_cpu(val[i]));
554 			if (ret <= 0)
555 				break;
556 
557 			cur += ret;
558 			len -= ret;
559 		}
560 		if (cur > buf)
561 			wiphy_info(mt76_hw(dev)->wiphy, "idx: 0x%X,%d,%s",
562 				   le32_to_cpu(hdr->idx.idx), nr_val, buf);
563 		put_page(page);
564 	} else if (hdr->type == 2) { /* str log */
565 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", hdr->txt.len, hdr->txt.data);
566 	}
567 }
568 
569 static void
570 mt7925_mcu_uni_rx_unsolicited_event(struct mt792x_dev *dev,
571 				    struct sk_buff *skb)
572 {
573 	struct mt7925_mcu_rxd *rxd;
574 
575 	rxd = (struct mt7925_mcu_rxd *)skb->data;
576 
577 	switch (rxd->eid) {
578 	case MCU_UNI_EVENT_HIF_CTRL:
579 		mt7925_mcu_uni_hif_ctrl_event(dev, skb);
580 		break;
581 	case MCU_UNI_EVENT_FW_LOG_2_HOST:
582 		mt7925_mcu_uni_debug_msg_event(dev, skb);
583 		break;
584 	case MCU_UNI_EVENT_ROC:
585 		mt7925_mcu_uni_roc_event(dev, skb);
586 		break;
587 	case MCU_UNI_EVENT_SCAN_DONE:
588 		mt7925_mcu_scan_event(dev, skb);
589 		return;
590 	case MCU_UNI_EVENT_TX_DONE:
591 		mt7925_mcu_tx_done_event(dev, skb);
592 		break;
593 	case MCU_UNI_EVENT_BSS_BEACON_LOSS:
594 		mt7925_mcu_connection_loss_event(dev, skb);
595 		break;
596 	case MCU_UNI_EVENT_RSSI_MONITOR:
597 		mt7925_mcu_rssi_monitor_event(dev, skb);
598 		break;
599 	case MCU_UNI_EVENT_COREDUMP:
600 		dev->fw_assert = true;
601 		mt76_connac_mcu_coredump_event(&dev->mt76, skb, &dev->coredump);
602 		return;
603 	default:
604 		break;
605 	}
606 	dev_kfree_skb(skb);
607 }
608 
609 void mt7925_mcu_rx_event(struct mt792x_dev *dev, struct sk_buff *skb)
610 {
611 	struct mt7925_mcu_rxd *rxd = (struct mt7925_mcu_rxd *)skb->data;
612 
613 	if (skb_linearize(skb))
614 		return;
615 
616 	if (rxd->option & MCU_UNI_CMD_UNSOLICITED_EVENT) {
617 		mt7925_mcu_uni_rx_unsolicited_event(dev, skb);
618 		return;
619 	}
620 
621 	mt76_mcu_rx_event(&dev->mt76, skb);
622 }
623 
624 static int
625 mt7925_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif_link *mvif,
626 		  struct ieee80211_ampdu_params *params,
627 		  bool enable, bool tx)
628 {
629 	struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv;
630 	struct sta_rec_ba_uni *ba;
631 	struct sk_buff *skb;
632 	struct tlv *tlv;
633 	int len;
634 
635 	len = sizeof(struct sta_req_hdr) + sizeof(*ba);
636 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid,
637 					      len);
638 	if (IS_ERR(skb))
639 		return PTR_ERR(skb);
640 
641 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
642 
643 	ba = (struct sta_rec_ba_uni *)tlv;
644 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
645 	ba->winsize = cpu_to_le16(params->buf_size);
646 	ba->ssn = cpu_to_le16(params->ssn);
647 	ba->ba_en = enable << params->tid;
648 	ba->amsdu = params->amsdu;
649 	ba->tid = params->tid;
650 
651 	return mt76_mcu_skb_send_msg(dev, skb,
652 				     MCU_UNI_CMD(STA_REC_UPDATE), true);
653 }
654 
655 /** starec & wtbl **/
656 int mt7925_mcu_uni_tx_ba(struct mt792x_dev *dev,
657 			 struct ieee80211_ampdu_params *params,
658 			 bool enable)
659 {
660 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
661 	struct mt792x_vif *mvif = msta->vif;
662 
663 	if (enable && !params->amsdu)
664 		msta->deflink.wcid.amsdu = false;
665 
666 	return mt7925_mcu_sta_ba(&dev->mt76, &mvif->bss_conf.mt76, params,
667 				 enable, true);
668 }
669 
670 int mt7925_mcu_uni_rx_ba(struct mt792x_dev *dev,
671 			 struct ieee80211_ampdu_params *params,
672 			 bool enable)
673 {
674 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
675 	struct mt792x_vif *mvif = msta->vif;
676 
677 	return mt7925_mcu_sta_ba(&dev->mt76, &mvif->bss_conf.mt76, params,
678 				 enable, false);
679 }
680 
681 static int mt7925_mcu_read_eeprom(struct mt792x_dev *dev, u32 offset, u8 *val)
682 {
683 	struct {
684 		u8 rsv[4];
685 
686 		__le16 tag;
687 		__le16 len;
688 
689 		__le32 addr;
690 		__le32 valid;
691 		u8 data[MT7925_EEPROM_BLOCK_SIZE];
692 	} __packed req = {
693 		.tag = cpu_to_le16(1),
694 		.len = cpu_to_le16(sizeof(req) - 4),
695 		.addr = cpu_to_le32(round_down(offset,
696 				    MT7925_EEPROM_BLOCK_SIZE)),
697 	};
698 	struct evt {
699 		u8 rsv[4];
700 
701 		__le16 tag;
702 		__le16 len;
703 
704 		__le32 ver;
705 		__le32 addr;
706 		__le32 valid;
707 		__le32 size;
708 		__le32 magic_num;
709 		__le32 type;
710 		__le32 rsv1[4];
711 		u8 data[32];
712 	} __packed *res;
713 	struct sk_buff *skb;
714 	int ret;
715 
716 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL),
717 					&req, sizeof(req), true, &skb);
718 	if (ret)
719 		return ret;
720 
721 	res = (struct evt *)skb->data;
722 	*val = res->data[offset % MT7925_EEPROM_BLOCK_SIZE];
723 
724 	dev_kfree_skb(skb);
725 
726 	return 0;
727 }
728 
729 static int mt7925_load_clc(struct mt792x_dev *dev, const char *fw_name)
730 {
731 	const struct mt76_connac2_fw_trailer *hdr;
732 	const struct mt76_connac2_fw_region *region;
733 	const struct mt7925_clc *clc;
734 	struct mt76_dev *mdev = &dev->mt76;
735 	struct mt792x_phy *phy = &dev->phy;
736 	const struct firmware *fw;
737 	u8 *clc_base = NULL, hw_encap = 0;
738 	int ret, i, len, offset = 0;
739 
740 	dev->phy.clc_chan_conf = 0xff;
741 	dev->regd_user = false;
742 	if (!mt7925_regd_clc_supported(dev))
743 		return 0;
744 
745 	if (mt76_is_mmio(&dev->mt76)) {
746 		ret = mt7925_mcu_read_eeprom(dev, MT_EE_HW_TYPE, &hw_encap);
747 		if (ret)
748 			return ret;
749 		hw_encap = u8_get_bits(hw_encap, MT_EE_HW_TYPE_ENCAP);
750 	}
751 
752 	ret = request_firmware(&fw, fw_name, mdev->dev);
753 	if (ret)
754 		return ret;
755 
756 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
757 		dev_err(mdev->dev, "Invalid firmware\n");
758 		ret = -EINVAL;
759 		goto out;
760 	}
761 
762 	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
763 	for (i = 0; i < hdr->n_region; i++) {
764 		region = (const void *)((const u8 *)hdr -
765 					(hdr->n_region - i) * sizeof(*region));
766 		len = le32_to_cpu(region->len);
767 
768 		/* check if we have valid buffer size */
769 		if (offset + len > fw->size) {
770 			dev_err(mdev->dev, "Invalid firmware region\n");
771 			ret = -EINVAL;
772 			goto out;
773 		}
774 
775 		if ((region->feature_set & FW_FEATURE_NON_DL) &&
776 		    region->type == FW_TYPE_CLC) {
777 			clc_base = (u8 *)(fw->data + offset);
778 			break;
779 		}
780 		offset += len;
781 	}
782 
783 	if (!clc_base)
784 		goto out;
785 
786 	for (offset = 0; offset < len; offset += le32_to_cpu(clc->len)) {
787 		clc = (const struct mt7925_clc *)(clc_base + offset);
788 
789 		if (clc->idx >= ARRAY_SIZE(phy->clc))
790 			break;
791 
792 		/* do not init buf again if chip reset triggered */
793 		if (phy->clc[clc->idx])
794 			continue;
795 
796 		/* header content sanity */
797 		if ((clc->idx == MT792x_CLC_BE_CTRL &&
798 		     u8_get_bits(clc->t2.type, MT_EE_HW_TYPE_ENCAP) != hw_encap) ||
799 		    u8_get_bits(clc->t0.type, MT_EE_HW_TYPE_ENCAP) != hw_encap)
800 			continue;
801 
802 		phy->clc[clc->idx] = devm_kmemdup(mdev->dev, clc,
803 						  le32_to_cpu(clc->len),
804 						  GFP_KERNEL);
805 
806 		if (!phy->clc[clc->idx]) {
807 			ret = -ENOMEM;
808 			goto out;
809 		}
810 	}
811 
812 	ret = mt7925_regd_init(phy);
813 out:
814 	release_firmware(fw);
815 
816 	return ret;
817 }
818 
819 int mt7925_mcu_fw_log_2_host(struct mt792x_dev *dev, u8 ctrl)
820 {
821 	struct {
822 		u8 _rsv[4];
823 
824 		__le16 tag;
825 		__le16 len;
826 		u8 ctrl;
827 		u8 interval;
828 		u8 _rsv2[2];
829 	} __packed req = {
830 		.tag = cpu_to_le16(UNI_WSYS_CONFIG_FW_LOG_CTRL),
831 		.len = cpu_to_le16(sizeof(req) - 4),
832 		.ctrl = ctrl,
833 	};
834 	int ret;
835 
836 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(WSYS_CONFIG),
837 					&req, sizeof(req), true, NULL);
838 	return ret;
839 }
840 
841 int mt7925_mcu_get_temperature(struct mt792x_phy *phy)
842 {
843 	struct {
844 		u8 _rsv[4];
845 
846 		__le16 tag;
847 		__le16 len;
848 		u8 _rsv2[4];
849 	} __packed req = {
850 		.tag = cpu_to_le16(0x0),
851 		.len = cpu_to_le16(sizeof(req) - 4),
852 	};
853 	struct mt7925_thermal_evt {
854 		u8 rsv[4];
855 		__le32 temperature;
856 	} __packed * evt;
857 	struct mt792x_dev *dev = phy->dev;
858 	int temperature, ret;
859 	struct sk_buff *skb;
860 
861 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
862 					MCU_WM_UNI_CMD_QUERY(THERMAL),
863 					&req, sizeof(req), true, &skb);
864 	if (ret)
865 		return ret;
866 
867 	skb_pull(skb, 4 + sizeof(struct tlv));
868 	evt = (struct mt7925_thermal_evt *)skb->data;
869 
870 	temperature = le32_to_cpu(evt->temperature);
871 
872 	dev_kfree_skb(skb);
873 
874 	return temperature;
875 }
876 
877 static void
878 mt7925_mcu_parse_phy_cap(struct mt792x_dev *dev, char *data)
879 {
880 	struct mt76_phy *mphy = &dev->mt76.phy;
881 	struct mt76_dev *mdev = mphy->dev;
882 	struct mt7925_mcu_phy_cap {
883 		u8 ht;
884 		u8 vht;
885 		u8 _5g;
886 		u8 max_bw;
887 		u8 nss;
888 		u8 dbdc;
889 		u8 tx_ldpc;
890 		u8 rx_ldpc;
891 		u8 tx_stbc;
892 		u8 rx_stbc;
893 		u8 hw_path;
894 		u8 he;
895 		u8 eht;
896 	} __packed * cap;
897 	enum {
898 		WF0_24G,
899 		WF0_5G
900 	};
901 
902 	cap = (struct mt7925_mcu_phy_cap *)data;
903 
904 	mdev->phy.antenna_mask = BIT(cap->nss) - 1;
905 	mdev->phy.chainmask = mdev->phy.antenna_mask;
906 	mdev->phy.cap.has_2ghz = cap->hw_path & BIT(WF0_24G);
907 	mdev->phy.cap.has_5ghz = cap->hw_path & BIT(WF0_5G);
908 }
909 
910 static void
911 mt7925_mcu_parse_eml_cap(struct mt792x_dev *dev, char *data)
912 {
913 	struct mt7925_mcu_eml_cap {
914 		u8 rsv[4];
915 		__le16 eml_cap;
916 		u8 rsv2[6];
917 	} __packed * cap;
918 
919 	cap = (struct mt7925_mcu_eml_cap *)data;
920 
921 	dev->phy.eml_cap = le16_to_cpu(cap->eml_cap);
922 }
923 
924 static int
925 mt7925_mcu_get_nic_capability(struct mt792x_dev *dev)
926 {
927 	struct mt76_phy *mphy = &dev->mt76.phy;
928 	struct {
929 		u8 _rsv[4];
930 
931 		__le16 tag;
932 		__le16 len;
933 	} __packed req = {
934 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_NIC_CAPA),
935 		.len = cpu_to_le16(sizeof(req) - 4),
936 	};
937 	struct mt76_connac_cap_hdr {
938 		__le16 n_element;
939 		u8 rsv[2];
940 	} __packed * hdr;
941 	struct sk_buff *skb;
942 	int ret, i;
943 
944 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
945 					&req, sizeof(req), true, &skb);
946 	if (ret)
947 		return ret;
948 
949 	hdr = (struct mt76_connac_cap_hdr *)skb->data;
950 	if (skb->len < sizeof(*hdr)) {
951 		ret = -EINVAL;
952 		goto out;
953 	}
954 
955 	skb_pull(skb, sizeof(*hdr));
956 
957 	for (i = 0; i < le16_to_cpu(hdr->n_element); i++) {
958 		struct tlv *tlv = (struct tlv *)skb->data;
959 		int len;
960 
961 		if (skb->len < sizeof(*tlv))
962 			break;
963 
964 		len = le16_to_cpu(tlv->len);
965 		if (skb->len < len)
966 			break;
967 
968 		switch (le16_to_cpu(tlv->tag)) {
969 		case MT_NIC_CAP_6G:
970 			mphy->cap.has_6ghz = !!tlv->data[0];
971 			break;
972 		case MT_NIC_CAP_MAC_ADDR:
973 			memcpy(mphy->macaddr, (void *)tlv->data, ETH_ALEN);
974 			break;
975 		case MT_NIC_CAP_PHY:
976 			mt7925_mcu_parse_phy_cap(dev, tlv->data);
977 			break;
978 		case MT_NIC_CAP_CHIP_CAP:
979 			dev->phy.chip_cap = le64_to_cpu(*(__le64 *)tlv->data);
980 			break;
981 		case MT_NIC_CAP_EML_CAP:
982 			mt7925_mcu_parse_eml_cap(dev, tlv->data);
983 			break;
984 		default:
985 			break;
986 		}
987 		skb_pull(skb, len);
988 	}
989 out:
990 	dev_kfree_skb(skb);
991 	return ret;
992 }
993 
994 int mt7925_mcu_chip_config(struct mt792x_dev *dev, const char *cmd)
995 {
996 	u16 len = strlen(cmd) + 1;
997 	struct {
998 		u8 _rsv[4];
999 		__le16 tag;
1000 		__le16 len;
1001 		struct mt76_connac_config config;
1002 	} __packed req = {
1003 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_CHIP_CFG),
1004 		.len = cpu_to_le16(sizeof(req) - 4),
1005 		.config = {
1006 			.resp_type = 0,
1007 			.type = 0,
1008 			.data_size = cpu_to_le16(len),
1009 		},
1010 	};
1011 
1012 	memcpy(req.config.data, cmd, len);
1013 
1014 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
1015 				 &req, sizeof(req), false);
1016 }
1017 
1018 int mt7925_mcu_set_deep_sleep(struct mt792x_dev *dev, bool enable)
1019 {
1020 	char cmd[16];
1021 
1022 	snprintf(cmd, sizeof(cmd), "KeepFullPwr %d", !enable);
1023 
1024 	return mt7925_mcu_chip_config(dev, cmd);
1025 }
1026 EXPORT_SYMBOL_GPL(mt7925_mcu_set_deep_sleep);
1027 
1028 int mt7925_mcu_set_thermal_protect(struct mt792x_dev *dev)
1029 {
1030 	char cmd[64];
1031 	int ret = 0;
1032 
1033 	snprintf(cmd, sizeof(cmd), "ThermalProtGband %d %d %d %d %d %d %d %d %d %d",
1034 		 0, 100, 90, 80, 30, 1, 1, 115, 105, 5);
1035 	ret = mt7925_mcu_chip_config(dev, cmd);
1036 
1037 	snprintf(cmd, sizeof(cmd), "ThermalProtAband %d %d %d %d %d %d %d %d %d %d",
1038 		 1, 100, 90, 80, 30, 1, 1, 115, 105, 5);
1039 	ret |= mt7925_mcu_chip_config(dev, cmd);
1040 
1041 	return ret;
1042 }
1043 EXPORT_SYMBOL_GPL(mt7925_mcu_set_thermal_protect);
1044 
1045 int mt7925_run_firmware(struct mt792x_dev *dev)
1046 {
1047 	int err;
1048 
1049 	err = mt792x_load_firmware(dev);
1050 	if (err)
1051 		return err;
1052 
1053 	err = mt7925_mcu_get_nic_capability(dev);
1054 	if (err)
1055 		return err;
1056 
1057 	err = mt7925_load_clc(dev, mt792x_ram_name(dev));
1058 	if (err)
1059 		return err;
1060 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
1061 
1062 	return mt7925_mcu_fw_log_2_host(dev, 1);
1063 }
1064 EXPORT_SYMBOL_GPL(mt7925_run_firmware);
1065 
1066 static void
1067 mt7925_mcu_sta_hdr_trans_tlv(struct sk_buff *skb,
1068 			     struct ieee80211_vif *vif,
1069 			     struct ieee80211_link_sta *link_sta)
1070 {
1071 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1072 	struct sta_rec_hdr_trans *hdr_trans;
1073 	struct mt76_wcid *wcid;
1074 	struct tlv *tlv;
1075 
1076 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HDR_TRANS, sizeof(*hdr_trans));
1077 	hdr_trans = (struct sta_rec_hdr_trans *)tlv;
1078 	hdr_trans->dis_rx_hdr_tran = true;
1079 
1080 	if (vif->type == NL80211_IFTYPE_STATION)
1081 		hdr_trans->to_ds = true;
1082 	else
1083 		hdr_trans->from_ds = true;
1084 
1085 	if (link_sta) {
1086 		struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1087 		struct mt792x_link_sta *mlink;
1088 
1089 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1090 		wcid = &mlink->wcid;
1091 	} else {
1092 		wcid = &mvif->sta.deflink.wcid;
1093 	}
1094 
1095 	if (!wcid)
1096 		return;
1097 
1098 	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
1099 	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
1100 		hdr_trans->to_ds = true;
1101 		hdr_trans->from_ds = true;
1102 	}
1103 }
1104 
1105 int mt7925_mcu_wtbl_update_hdr_trans(struct mt792x_dev *dev,
1106 				     struct ieee80211_vif *vif,
1107 				     struct ieee80211_sta *sta,
1108 				     int link_id)
1109 {
1110 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1111 	struct ieee80211_link_sta *link_sta = sta ? &sta->deflink : NULL;
1112 	struct mt792x_link_sta *mlink;
1113 	struct mt792x_bss_conf *mconf;
1114 	struct mt792x_sta *msta;
1115 	struct sk_buff *skb;
1116 
1117 	msta = sta ? (struct mt792x_sta *)sta->drv_priv : &mvif->sta;
1118 
1119 	mlink = mt792x_sta_to_link(msta, link_id);
1120 	link_sta = mt792x_sta_to_link_sta(vif, sta, link_id);
1121 	mconf = mt792x_vif_to_link(mvif, link_id);
1122 
1123 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
1124 					      &mlink->wcid,
1125 					      MT7925_STA_UPDATE_MAX_SIZE);
1126 	if (IS_ERR(skb))
1127 		return PTR_ERR(skb);
1128 
1129 	/* starec hdr trans */
1130 	mt7925_mcu_sta_hdr_trans_tlv(skb, vif, link_sta);
1131 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1132 				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
1133 }
1134 
1135 int mt7925_mcu_set_tx(struct mt792x_dev *dev,
1136 		      struct ieee80211_bss_conf *bss_conf)
1137 {
1138 #define MCU_EDCA_AC_PARAM	0
1139 #define WMM_AIFS_SET		BIT(0)
1140 #define WMM_CW_MIN_SET		BIT(1)
1141 #define WMM_CW_MAX_SET		BIT(2)
1142 #define WMM_TXOP_SET		BIT(3)
1143 #define WMM_PARAM_SET		(WMM_AIFS_SET | WMM_CW_MIN_SET | \
1144 				 WMM_CW_MAX_SET | WMM_TXOP_SET)
1145 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(bss_conf);
1146 	struct {
1147 		u8 bss_idx;
1148 		u8 __rsv[3];
1149 	} __packed hdr = {
1150 		.bss_idx = mconf->mt76.idx,
1151 	};
1152 	struct sk_buff *skb;
1153 	int len = sizeof(hdr) + IEEE80211_NUM_ACS * sizeof(struct edca);
1154 	int ac;
1155 
1156 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
1157 	if (!skb)
1158 		return -ENOMEM;
1159 
1160 	skb_put_data(skb, &hdr, sizeof(hdr));
1161 
1162 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1163 		struct ieee80211_tx_queue_params *q = &mconf->queue_params[ac];
1164 		struct edca *e;
1165 		struct tlv *tlv;
1166 
1167 		tlv = mt76_connac_mcu_add_tlv(skb, MCU_EDCA_AC_PARAM, sizeof(*e));
1168 
1169 		e = (struct edca *)tlv;
1170 		e->set = WMM_PARAM_SET;
1171 		e->queue = ac;
1172 		e->aifs = q->aifs;
1173 		e->txop = cpu_to_le16(q->txop);
1174 
1175 		if (q->cw_min)
1176 			e->cw_min = fls(q->cw_min);
1177 		else
1178 			e->cw_min = 5;
1179 
1180 		if (q->cw_max)
1181 			e->cw_max = fls(q->cw_max);
1182 		else
1183 			e->cw_max = 10;
1184 	}
1185 
1186 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1187 				     MCU_UNI_CMD(EDCA_UPDATE), true);
1188 }
1189 
1190 static int
1191 mt7925_mcu_sta_key_tlv(struct mt76_wcid *wcid,
1192 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1193 		       struct sk_buff *skb,
1194 		       struct ieee80211_key_conf *key,
1195 		       enum set_key_cmd cmd,
1196 		       struct mt792x_sta *msta)
1197 {
1198 	struct mt792x_vif *mvif = msta->vif;
1199 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1200 	struct sta_rec_sec_uni *sec;
1201 	struct ieee80211_sta *sta;
1202 	struct ieee80211_vif *vif;
1203 	struct tlv *tlv;
1204 
1205 	sta = msta == &mvif->sta ?
1206 		      NULL :
1207 		      container_of((void *)msta, struct ieee80211_sta, drv_priv);
1208 	vif = container_of((void *)mvif, struct ieee80211_vif, drv_priv);
1209 
1210 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V3, sizeof(*sec));
1211 	sec = (struct sta_rec_sec_uni *)tlv;
1212 	sec->bss_idx = mconf->mt76.idx;
1213 	sec->is_authenticator = 0;
1214 	sec->mgmt_prot = 1; /* only used in MLO mode */
1215 	sec->wlan_idx = (u8)wcid->idx;
1216 
1217 	if (sta) {
1218 		struct ieee80211_link_sta *link_sta;
1219 
1220 		sec->tx_key = 1;
1221 		sec->key_type = 1;
1222 		link_sta = mt792x_sta_to_link_sta(vif, sta, wcid->link_id);
1223 
1224 		if (link_sta)
1225 			memcpy(sec->peer_addr, link_sta->addr, ETH_ALEN);
1226 	} else {
1227 		struct ieee80211_bss_conf *link_conf;
1228 
1229 		link_conf = mt792x_vif_to_bss_conf(vif, wcid->link_id);
1230 
1231 		if (link_conf)
1232 			memcpy(sec->peer_addr, link_conf->bssid, ETH_ALEN);
1233 	}
1234 
1235 	if (cmd == SET_KEY) {
1236 		u8 cipher;
1237 
1238 		sec->add = 1;
1239 		cipher = mt7925_mcu_get_cipher(key->cipher);
1240 		if (cipher == CONNAC3_CIPHER_NONE)
1241 			return -EOPNOTSUPP;
1242 
1243 		if (cipher == CONNAC3_CIPHER_BIP_CMAC_128) {
1244 			sec->cipher_id = CONNAC3_CIPHER_BIP_CMAC_128;
1245 			sec->key_id = sta_key_conf->keyidx;
1246 			sec->key_len = 32;
1247 			memcpy(sec->key, sta_key_conf->key, 16);
1248 			memcpy(sec->key + 16, key->key, 16);
1249 		} else {
1250 			sec->cipher_id = cipher;
1251 			sec->key_id = key->keyidx;
1252 			sec->key_len = key->keylen;
1253 			memcpy(sec->key, key->key, key->keylen);
1254 
1255 			if (cipher == CONNAC3_CIPHER_TKIP) {
1256 				/* Rx/Tx MIC keys are swapped */
1257 				memcpy(sec->key + 16, key->key + 24, 8);
1258 				memcpy(sec->key + 24, key->key + 16, 8);
1259 			}
1260 
1261 			/* store key_conf for BIP batch update */
1262 			if (cipher == CONNAC3_CIPHER_AES_CCMP) {
1263 				memcpy(sta_key_conf->key, key->key, key->keylen);
1264 				sta_key_conf->keyidx = key->keyidx;
1265 			}
1266 		}
1267 	} else {
1268 		sec->add = 0;
1269 	}
1270 
1271 	return 0;
1272 }
1273 
1274 int mt7925_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
1275 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1276 		       struct ieee80211_key_conf *key, int mcu_cmd,
1277 		       struct mt76_wcid *wcid, enum set_key_cmd cmd,
1278 		       struct mt792x_sta *msta)
1279 {
1280 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1281 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1282 	struct sk_buff *skb;
1283 	int ret;
1284 
1285 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, wcid,
1286 					      MT7925_STA_UPDATE_MAX_SIZE);
1287 	if (IS_ERR(skb))
1288 		return PTR_ERR(skb);
1289 
1290 	ret = mt7925_mcu_sta_key_tlv(wcid, sta_key_conf, skb, key, cmd, msta);
1291 	if (ret)
1292 		return ret;
1293 
1294 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
1295 }
1296 
1297 int mt7925_mcu_set_mlo_roc(struct mt792x_bss_conf *mconf, u16 sel_links,
1298 			   int duration, u8 token_id)
1299 {
1300 	struct mt792x_vif *mvif = mconf->vif;
1301 	struct ieee80211_vif *vif = container_of((void *)mvif,
1302 						 struct ieee80211_vif, drv_priv);
1303 	struct ieee80211_bss_conf *link_conf;
1304 	struct ieee80211_channel *chan;
1305 	const u8 ch_band[] = {
1306 		[NL80211_BAND_2GHZ] = 1,
1307 		[NL80211_BAND_5GHZ] = 2,
1308 		[NL80211_BAND_6GHZ] = 3,
1309 	};
1310 	enum mt7925_roc_req type;
1311 	int center_ch, i = 0;
1312 	bool is_AG_band = false;
1313 	struct {
1314 		u8 id;
1315 		u8 bss_idx;
1316 		u16 tag;
1317 		struct mt792x_bss_conf *mconf;
1318 		struct ieee80211_channel *chan;
1319 	} links[2];
1320 
1321 	struct {
1322 		struct {
1323 			u8 rsv[4];
1324 		} __packed hdr;
1325 		struct roc_acquire_tlv roc[2];
1326 	} __packed req = {
1327 			.roc[0].tag = cpu_to_le16(UNI_ROC_NUM),
1328 			.roc[0].len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1329 			.roc[1].tag = cpu_to_le16(UNI_ROC_NUM),
1330 			.roc[1].len = cpu_to_le16(sizeof(struct roc_acquire_tlv))
1331 	};
1332 
1333 	if (!mconf || hweight16(vif->valid_links) < 2 ||
1334 	    hweight16(sel_links) != 2)
1335 		return -EPERM;
1336 
1337 	for (i = 0; i < ARRAY_SIZE(links); i++) {
1338 		links[i].id = i ? __ffs(~BIT(mconf->link_id) & sel_links) :
1339 				 mconf->link_id;
1340 		link_conf = mt792x_vif_to_bss_conf(vif, links[i].id);
1341 		if (WARN_ON_ONCE(!link_conf))
1342 			return -EPERM;
1343 
1344 		links[i].chan = link_conf->chanreq.oper.chan;
1345 		if (WARN_ON_ONCE(!links[i].chan))
1346 			return -EPERM;
1347 
1348 		links[i].mconf = mt792x_vif_to_link(mvif, links[i].id);
1349 		links[i].tag = links[i].id == mconf->link_id ?
1350 			       UNI_ROC_ACQUIRE : UNI_ROC_SUB_LINK;
1351 
1352 		is_AG_band |= links[i].chan->band == NL80211_BAND_2GHZ;
1353 	}
1354 
1355 	if (vif->cfg.eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP)
1356 		type = is_AG_band ? MT7925_ROC_REQ_MLSR_AG :
1357 				    MT7925_ROC_REQ_MLSR_AA;
1358 	else
1359 		type = MT7925_ROC_REQ_JOIN;
1360 
1361 	for (i = 0; i < ARRAY_SIZE(links) && i < hweight16(vif->active_links); i++) {
1362 		if (WARN_ON_ONCE(!links[i].mconf || !links[i].chan))
1363 			continue;
1364 
1365 		chan = links[i].chan;
1366 		center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1367 		req.roc[i].len = cpu_to_le16(sizeof(struct roc_acquire_tlv));
1368 		req.roc[i].tag = cpu_to_le16(links[i].tag);
1369 		req.roc[i].tokenid = token_id;
1370 		req.roc[i].reqtype = type;
1371 		req.roc[i].maxinterval = cpu_to_le32(duration);
1372 		req.roc[i].bss_idx = links[i].mconf->mt76.idx;
1373 		req.roc[i].control_channel = chan->hw_value;
1374 		req.roc[i].bw = CMD_CBW_20MHZ;
1375 		req.roc[i].bw_from_ap = CMD_CBW_20MHZ;
1376 		req.roc[i].center_chan = center_ch;
1377 		req.roc[i].center_chan_from_ap = center_ch;
1378 		req.roc[i].center_chan2 = 0;
1379 		req.roc[i].center_chan2_from_ap = 0;
1380 
1381 		/* STR : 0xfe indicates BAND_ALL with enabling DBDC
1382 		 * EMLSR : 0xff indicates (BAND_AUTO) without DBDC
1383 		 */
1384 		req.roc[i].dbdcband = type == MT7925_ROC_REQ_JOIN ? 0xfe : 0xff;
1385 
1386 		if (chan->hw_value < center_ch)
1387 			req.roc[i].sco = 1; /* SCA */
1388 		else if (chan->hw_value > center_ch)
1389 			req.roc[i].sco = 3; /* SCB */
1390 
1391 		req.roc[i].band = ch_band[chan->band];
1392 	}
1393 
1394 	return mt76_mcu_send_msg(&mvif->phy->dev->mt76, MCU_UNI_CMD(ROC),
1395 				 &req, sizeof(req), true);
1396 }
1397 
1398 int mt7925_mcu_set_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1399 		       struct ieee80211_channel *chan, int duration,
1400 		       enum mt7925_roc_req type, u8 token_id)
1401 {
1402 	int center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1403 	struct mt792x_dev *dev = phy->dev;
1404 	struct {
1405 		struct {
1406 			u8 rsv[4];
1407 		} __packed hdr;
1408 		struct roc_acquire_tlv roc;
1409 	} __packed req = {
1410 		.roc = {
1411 			.tag = cpu_to_le16(UNI_ROC_ACQUIRE),
1412 			.len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1413 			.tokenid = token_id,
1414 			.reqtype = type,
1415 			.maxinterval = cpu_to_le32(duration),
1416 			.bss_idx = mconf->mt76.idx,
1417 			.control_channel = chan->hw_value,
1418 			.bw = CMD_CBW_20MHZ,
1419 			.bw_from_ap = CMD_CBW_20MHZ,
1420 			.center_chan = center_ch,
1421 			.center_chan_from_ap = center_ch,
1422 			.dbdcband = 0xff, /* auto */
1423 		},
1424 	};
1425 
1426 	if (chan->hw_value < center_ch)
1427 		req.roc.sco = 1; /* SCA */
1428 	else if (chan->hw_value > center_ch)
1429 		req.roc.sco = 3; /* SCB */
1430 
1431 	switch (chan->band) {
1432 	case NL80211_BAND_6GHZ:
1433 		req.roc.band = 3;
1434 		break;
1435 	case NL80211_BAND_5GHZ:
1436 		req.roc.band = 2;
1437 		break;
1438 	default:
1439 		req.roc.band = 1;
1440 		break;
1441 	}
1442 
1443 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1444 				 &req, sizeof(req), true);
1445 }
1446 
1447 int mt7925_mcu_abort_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1448 			 u8 token_id)
1449 {
1450 	struct mt792x_dev *dev = phy->dev;
1451 	struct {
1452 		struct {
1453 			u8 rsv[4];
1454 		} __packed hdr;
1455 		struct roc_abort_tlv {
1456 			__le16 tag;
1457 			__le16 len;
1458 			u8 bss_idx;
1459 			u8 tokenid;
1460 			u8 dbdcband;
1461 			u8 rsv[5];
1462 		} __packed abort;
1463 	} __packed req = {
1464 		.abort = {
1465 			.tag = cpu_to_le16(UNI_ROC_ABORT),
1466 			.len = cpu_to_le16(sizeof(struct roc_abort_tlv)),
1467 			.tokenid = token_id,
1468 			.bss_idx = mconf->mt76.idx,
1469 			.dbdcband = 0xff, /* auto*/
1470 		},
1471 	};
1472 
1473 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1474 				 &req, sizeof(req), true);
1475 }
1476 
1477 int mt7925_mcu_set_eeprom(struct mt792x_dev *dev)
1478 {
1479 	struct {
1480 		u8 _rsv[4];
1481 
1482 		__le16 tag;
1483 		__le16 len;
1484 		u8 buffer_mode;
1485 		u8 format;
1486 		__le16 buf_len;
1487 	} __packed req = {
1488 		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
1489 		.len = cpu_to_le16(sizeof(req) - 4),
1490 		.buffer_mode = EE_MODE_EFUSE,
1491 		.format = EE_FORMAT_WHOLE
1492 	};
1493 
1494 	return mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(EFUSE_CTRL),
1495 					 &req, sizeof(req), true, NULL);
1496 }
1497 EXPORT_SYMBOL_GPL(mt7925_mcu_set_eeprom);
1498 
1499 int mt7925_mcu_uni_bss_ps(struct mt792x_dev *dev,
1500 			  struct ieee80211_bss_conf *link_conf)
1501 {
1502 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1503 	struct {
1504 		struct {
1505 			u8 bss_idx;
1506 			u8 pad[3];
1507 		} __packed hdr;
1508 		struct ps_tlv {
1509 			__le16 tag;
1510 			__le16 len;
1511 			u8 ps_state; /* 0: device awake
1512 				      * 1: static power save
1513 				      * 2: dynamic power saving
1514 				      * 3: enter TWT power saving
1515 				      * 4: leave TWT power saving
1516 				      */
1517 			u8 pad[3];
1518 		} __packed ps;
1519 	} __packed ps_req = {
1520 		.hdr = {
1521 			.bss_idx = mconf->mt76.idx,
1522 		},
1523 		.ps = {
1524 			.tag = cpu_to_le16(UNI_BSS_INFO_PS),
1525 			.len = cpu_to_le16(sizeof(struct ps_tlv)),
1526 			.ps_state = link_conf->vif->cfg.ps ? 2 : 0,
1527 		},
1528 	};
1529 
1530 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1531 		return -EOPNOTSUPP;
1532 
1533 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1534 				 &ps_req, sizeof(ps_req), true);
1535 }
1536 
1537 int
1538 mt7925_mcu_uni_bss_bcnft(struct mt792x_dev *dev,
1539 			 struct ieee80211_bss_conf *link_conf, bool enable)
1540 {
1541 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1542 	struct {
1543 		struct {
1544 			u8 bss_idx;
1545 			u8 pad[3];
1546 		} __packed hdr;
1547 		struct bcnft_tlv {
1548 			__le16 tag;
1549 			__le16 len;
1550 			__le16 bcn_interval;
1551 			u8 dtim_period;
1552 			u8 bmc_delivered_ac;
1553 			u8 bmc_triggered_ac;
1554 			u8 pad[3];
1555 		} __packed bcnft;
1556 	} __packed bcnft_req = {
1557 		.hdr = {
1558 			.bss_idx = mconf->mt76.idx,
1559 		},
1560 		.bcnft = {
1561 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1562 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1563 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1564 			.dtim_period = link_conf->dtim_period,
1565 		},
1566 	};
1567 
1568 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1569 		return 0;
1570 
1571 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1572 				 &bcnft_req, sizeof(bcnft_req), true);
1573 }
1574 
1575 int
1576 mt7925_mcu_set_bss_pm(struct mt792x_dev *dev,
1577 		      struct ieee80211_bss_conf *link_conf,
1578 		      bool enable)
1579 {
1580 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1581 	struct {
1582 		struct {
1583 			u8 bss_idx;
1584 			u8 pad[3];
1585 		} __packed hdr;
1586 		struct bcnft_tlv {
1587 			__le16 tag;
1588 			__le16 len;
1589 			__le16 bcn_interval;
1590 			u8 dtim_period;
1591 			u8 bmc_delivered_ac;
1592 			u8 bmc_triggered_ac;
1593 			u8 pad[3];
1594 		} __packed enable;
1595 	} req = {
1596 		.hdr = {
1597 			.bss_idx = mconf->mt76.idx,
1598 		},
1599 		.enable = {
1600 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1601 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1602 			.dtim_period = link_conf->dtim_period,
1603 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1604 		},
1605 	};
1606 	struct {
1607 		struct {
1608 			u8 bss_idx;
1609 			u8 pad[3];
1610 		} __packed hdr;
1611 		struct pm_disable {
1612 			__le16 tag;
1613 			__le16 len;
1614 		} __packed disable;
1615 	} req1 = {
1616 		.hdr = {
1617 			.bss_idx = mconf->mt76.idx,
1618 		},
1619 		.disable = {
1620 			.tag = cpu_to_le16(UNI_BSS_INFO_PM_DISABLE),
1621 			.len = cpu_to_le16(sizeof(struct pm_disable))
1622 		},
1623 	};
1624 	int err;
1625 
1626 	err = mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1627 				&req1, sizeof(req1), true);
1628 	if (err < 0 || !enable)
1629 		return err;
1630 
1631 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1632 				 &req, sizeof(req), true);
1633 }
1634 
1635 static void
1636 mt7925_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1637 {
1638 	if (!link_sta->he_cap.has_he)
1639 		return;
1640 
1641 	mt76_connac_mcu_sta_he_tlv_v2(skb, link_sta->sta);
1642 }
1643 
1644 static void
1645 mt7925_mcu_sta_he_6g_tlv(struct sk_buff *skb,
1646 			 struct ieee80211_link_sta *link_sta)
1647 {
1648 	struct sta_rec_he_6g_capa *he_6g;
1649 	struct tlv *tlv;
1650 
1651 	if (!link_sta->he_6ghz_capa.capa)
1652 		return;
1653 
1654 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G, sizeof(*he_6g));
1655 
1656 	he_6g = (struct sta_rec_he_6g_capa *)tlv;
1657 	he_6g->capa = link_sta->he_6ghz_capa.capa;
1658 }
1659 
1660 static void
1661 mt7925_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1662 {
1663 	struct ieee80211_eht_mcs_nss_supp *mcs_map;
1664 	struct ieee80211_eht_cap_elem_fixed *elem;
1665 	struct sta_rec_eht *eht;
1666 	struct tlv *tlv;
1667 
1668 	if (!link_sta->eht_cap.has_eht)
1669 		return;
1670 
1671 	mcs_map = &link_sta->eht_cap.eht_mcs_nss_supp;
1672 	elem = &link_sta->eht_cap.eht_cap_elem;
1673 
1674 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT, sizeof(*eht));
1675 
1676 	eht = (struct sta_rec_eht *)tlv;
1677 	eht->tid_bitmap = 0xff;
1678 	eht->mac_cap = cpu_to_le16(*(u16 *)elem->mac_cap_info);
1679 	eht->phy_cap = cpu_to_le64(*(u64 *)elem->phy_cap_info);
1680 	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
1681 
1682 	if (link_sta->bandwidth == IEEE80211_STA_RX_BW_20)
1683 		memcpy(eht->mcs_map_bw20, &mcs_map->only_20mhz, sizeof(eht->mcs_map_bw20));
1684 	memcpy(eht->mcs_map_bw80, &mcs_map->bw._80, sizeof(eht->mcs_map_bw80));
1685 	memcpy(eht->mcs_map_bw160, &mcs_map->bw._160, sizeof(eht->mcs_map_bw160));
1686 }
1687 
1688 static void
1689 mt7925_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1690 {
1691 	struct sta_rec_ht *ht;
1692 	struct tlv *tlv;
1693 
1694 	if (!link_sta->ht_cap.ht_supported)
1695 		return;
1696 
1697 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1698 
1699 	ht = (struct sta_rec_ht *)tlv;
1700 	ht->ht_cap = cpu_to_le16(link_sta->ht_cap.cap);
1701 }
1702 
1703 static void
1704 mt7925_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1705 {
1706 	struct sta_rec_vht *vht;
1707 	struct tlv *tlv;
1708 
1709 	/* For 6G band, this tlv is necessary to let hw work normally */
1710 	if (!link_sta->he_6ghz_capa.capa && !link_sta->vht_cap.vht_supported)
1711 		return;
1712 
1713 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1714 
1715 	vht = (struct sta_rec_vht *)tlv;
1716 	vht->vht_cap = cpu_to_le32(link_sta->vht_cap.cap);
1717 	vht->vht_rx_mcs_map = link_sta->vht_cap.vht_mcs.rx_mcs_map;
1718 	vht->vht_tx_mcs_map = link_sta->vht_cap.vht_mcs.tx_mcs_map;
1719 }
1720 
1721 static void
1722 mt7925_mcu_sta_amsdu_tlv(struct sk_buff *skb,
1723 			 struct ieee80211_vif *vif,
1724 			 struct ieee80211_link_sta *link_sta)
1725 {
1726 	struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1727 	struct mt792x_link_sta *mlink;
1728 	struct sta_rec_amsdu *amsdu;
1729 	struct tlv *tlv;
1730 
1731 	if (vif->type != NL80211_IFTYPE_STATION &&
1732 	    vif->type != NL80211_IFTYPE_AP)
1733 		return;
1734 
1735 	if (!link_sta->agg.max_amsdu_len)
1736 		return;
1737 
1738 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1739 	amsdu = (struct sta_rec_amsdu *)tlv;
1740 	amsdu->max_amsdu_num = 8;
1741 	amsdu->amsdu_en = true;
1742 
1743 	mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1744 	mlink->wcid.amsdu = true;
1745 
1746 	switch (link_sta->agg.max_amsdu_len) {
1747 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1748 		amsdu->max_mpdu_size =
1749 			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1750 		return;
1751 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
1752 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1753 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1754 		return;
1755 	default:
1756 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1757 		return;
1758 	}
1759 }
1760 
1761 static void
1762 mt7925_mcu_sta_phy_tlv(struct sk_buff *skb,
1763 		       struct ieee80211_vif *vif,
1764 		       struct ieee80211_link_sta *link_sta)
1765 {
1766 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1767 	struct ieee80211_bss_conf *link_conf;
1768 	struct cfg80211_chan_def *chandef;
1769 	struct mt792x_bss_conf *mconf;
1770 	struct sta_rec_phy *phy;
1771 	struct tlv *tlv;
1772 	u8 af = 0, mm = 0;
1773 
1774 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1775 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1776 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1777 				    &link_conf->chanreq.oper;
1778 
1779 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PHY, sizeof(*phy));
1780 	phy = (struct sta_rec_phy *)tlv;
1781 	phy->phy_type = mt76_connac_get_phy_mode_v2(mvif->phy->mt76, vif,
1782 						    chandef->chan->band,
1783 						    link_sta);
1784 	phy->basic_rate = cpu_to_le16((u16)link_conf->basic_rates);
1785 	if (link_sta->ht_cap.ht_supported) {
1786 		af = link_sta->ht_cap.ampdu_factor;
1787 		mm = link_sta->ht_cap.ampdu_density;
1788 	}
1789 
1790 	if (link_sta->vht_cap.vht_supported) {
1791 		u8 vht_af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1792 				      link_sta->vht_cap.cap);
1793 
1794 		af = max_t(u8, af, vht_af);
1795 	}
1796 
1797 	if (link_sta->he_6ghz_capa.capa) {
1798 		af = le16_get_bits(link_sta->he_6ghz_capa.capa,
1799 				   IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1800 		mm = le16_get_bits(link_sta->he_6ghz_capa.capa,
1801 				   IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
1802 	}
1803 
1804 	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR, af) |
1805 		     FIELD_PREP(IEEE80211_HT_AMPDU_PARM_DENSITY, mm);
1806 	phy->max_ampdu_len = af;
1807 }
1808 
1809 static void
1810 mt7925_mcu_sta_state_v2_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
1811 			    struct ieee80211_link_sta *link_sta,
1812 			    struct ieee80211_vif *vif,
1813 			    u8 rcpi, u8 sta_state)
1814 {
1815 	struct sta_rec_state_v2 {
1816 		__le16 tag;
1817 		__le16 len;
1818 		u8 state;
1819 		u8 rsv[3];
1820 		__le32 flags;
1821 		u8 vht_opmode;
1822 		u8 action;
1823 		u8 rsv2[2];
1824 	} __packed * state;
1825 	struct tlv *tlv;
1826 
1827 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_STATE, sizeof(*state));
1828 	state = (struct sta_rec_state_v2 *)tlv;
1829 	state->state = sta_state;
1830 
1831 	if (link_sta->vht_cap.vht_supported) {
1832 		state->vht_opmode = link_sta->bandwidth;
1833 		state->vht_opmode |= link_sta->rx_nss <<
1834 			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
1835 	}
1836 }
1837 
1838 static void
1839 mt7925_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb,
1840 			     struct ieee80211_vif *vif,
1841 			     struct ieee80211_link_sta *link_sta)
1842 {
1843 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1844 	struct ieee80211_bss_conf *link_conf;
1845 	struct cfg80211_chan_def *chandef;
1846 	struct sta_rec_ra_info *ra_info;
1847 	struct mt792x_bss_conf *mconf;
1848 	enum nl80211_band band;
1849 	struct tlv *tlv;
1850 	u16 supp_rates;
1851 
1852 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1853 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1854 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1855 				    &link_conf->chanreq.oper;
1856 	band = chandef->chan->band;
1857 
1858 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra_info));
1859 	ra_info = (struct sta_rec_ra_info *)tlv;
1860 
1861 	supp_rates = link_sta->supp_rates[band];
1862 	if (band == NL80211_BAND_2GHZ)
1863 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
1864 			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
1865 	else
1866 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates);
1867 
1868 	ra_info->legacy = cpu_to_le16(supp_rates);
1869 
1870 	if (link_sta->ht_cap.ht_supported)
1871 		memcpy(ra_info->rx_mcs_bitmask,
1872 		       link_sta->ht_cap.mcs.rx_mask,
1873 		       HT_MCS_MASK_NUM);
1874 }
1875 
1876 static void
1877 mt7925_mcu_sta_eht_mld_tlv(struct sk_buff *skb,
1878 			   struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1879 {
1880 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1881 	struct wiphy *wiphy = mvif->phy->mt76->hw->wiphy;
1882 	const struct wiphy_iftype_ext_capab *ext_capa;
1883 	struct sta_rec_eht_mld *eht_mld;
1884 	struct tlv *tlv;
1885 	u16 eml_cap;
1886 
1887 	if (!ieee80211_vif_is_mld(vif))
1888 		return;
1889 
1890 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT_MLD, sizeof(*eht_mld));
1891 	eht_mld = (struct sta_rec_eht_mld *)tlv;
1892 	eht_mld->mld_type = 0xff;
1893 
1894 	ext_capa = cfg80211_get_iftype_ext_capa(wiphy,
1895 						ieee80211_vif_type_p2p(vif));
1896 	if (!ext_capa)
1897 		return;
1898 
1899 	eml_cap = (vif->cfg.eml_cap & (IEEE80211_EML_CAP_EMLSR_SUPP |
1900 				       IEEE80211_EML_CAP_TRANSITION_TIMEOUT)) |
1901 		  (ext_capa->eml_capabilities & (IEEE80211_EML_CAP_EMLSR_PADDING_DELAY |
1902 						IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY));
1903 
1904 	if (eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP) {
1905 		eht_mld->eml_cap[0] = u16_get_bits(eml_cap, GENMASK(7, 0));
1906 		eht_mld->eml_cap[1] = u16_get_bits(eml_cap, GENMASK(15, 8));
1907 	} else {
1908 		eht_mld->str_cap[0] = BIT(1);
1909 	}
1910 }
1911 
1912 static void
1913 mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,
1914 		       struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1915 {
1916 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1917 	struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv;
1918 	unsigned long valid = mvif->valid_links;
1919 	struct mt792x_bss_conf *mconf;
1920 	struct mt792x_link_sta *mlink;
1921 	struct sta_rec_mld *mld;
1922 	struct tlv *tlv;
1923 	int i, cnt = 0;
1924 
1925 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MLD, sizeof(*mld));
1926 	mld = (struct sta_rec_mld *)tlv;
1927 	memcpy(mld->mac_addr, sta->addr, ETH_ALEN);
1928 	mld->primary_id = cpu_to_le16(msta->deflink.wcid.idx);
1929 	mld->wlan_id = cpu_to_le16(msta->deflink.wcid.idx);
1930 	mld->link_num = min_t(u8, hweight16(mvif->valid_links), 2);
1931 
1932 	for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
1933 		if (cnt == mld->link_num)
1934 			break;
1935 
1936 		mconf = mt792x_vif_to_link(mvif, i);
1937 		mlink = mt792x_sta_to_link(msta, i);
1938 		mld->link[cnt].wlan_id = cpu_to_le16(mlink->wcid.idx);
1939 		mld->link[cnt++].bss_idx = mconf->mt76.idx;
1940 
1941 		if (mlink != &msta->deflink)
1942 			mld->secondary_id = cpu_to_le16(mlink->wcid.idx);
1943 	}
1944 }
1945 
1946 static void
1947 mt7925_mcu_sta_remove_tlv(struct sk_buff *skb)
1948 {
1949 	struct sta_rec_remove *rem;
1950 	struct tlv *tlv;
1951 
1952 	tlv = mt76_connac_mcu_add_tlv(skb, 0x25, sizeof(*rem));
1953 	rem = (struct sta_rec_remove *)tlv;
1954 	rem->action = 0;
1955 }
1956 
1957 static int
1958 mt7925_mcu_sta_cmd(struct mt76_phy *phy,
1959 		   struct mt76_sta_cmd_info *info)
1960 {
1961 	struct mt792x_vif *mvif = (struct mt792x_vif *)info->vif->drv_priv;
1962 	struct mt76_dev *dev = phy->dev;
1963 	struct mt792x_bss_conf *mconf;
1964 	struct sk_buff *skb;
1965 	int conn_state;
1966 
1967 	mconf = mt792x_vif_to_link(mvif, info->wcid->link_id);
1968 
1969 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, info->wcid,
1970 					      MT7925_STA_UPDATE_MAX_SIZE);
1971 	if (IS_ERR(skb))
1972 		return PTR_ERR(skb);
1973 
1974 	conn_state = info->enable ? CONN_STATE_PORT_SECURE :
1975 				    CONN_STATE_DISCONNECT;
1976 
1977 	if (info->enable && info->link_sta) {
1978 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->link_conf,
1979 					      info->link_sta,
1980 					      conn_state, info->newly);
1981 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1982 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1983 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1984 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1985 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1986 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1987 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1988 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1989 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1990 					     info->link_sta);
1991 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1992 					    info->vif, info->rcpi,
1993 					    info->state);
1994 
1995 		if (info->state != MT76_STA_INFO_STATE_NONE) {
1996 			mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1997 			mt7925_mcu_sta_eht_mld_tlv(skb, info->vif, info->link_sta->sta);
1998 		}
1999 	}
2000 
2001 	if (!info->enable) {
2002 		mt7925_mcu_sta_remove_tlv(skb);
2003 		mt76_connac_mcu_add_tlv(skb, STA_REC_MLD_OFF,
2004 					sizeof(struct tlv));
2005 	} else {
2006 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
2007 	}
2008 
2009 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
2010 }
2011 
2012 int mt7925_mcu_sta_update(struct mt792x_dev *dev,
2013 			  struct ieee80211_link_sta *link_sta,
2014 			  struct ieee80211_vif *vif, bool enable,
2015 			  enum mt76_sta_info_state state)
2016 {
2017 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
2018 	int rssi = -ewma_rssi_read(&mvif->bss_conf.rssi);
2019 	struct mt76_sta_cmd_info info = {
2020 		.link_sta = link_sta,
2021 		.vif = vif,
2022 		.link_conf = &vif->bss_conf,
2023 		.enable = enable,
2024 		.cmd = MCU_UNI_CMD(STA_REC_UPDATE),
2025 		.state = state,
2026 		.offload_fw = true,
2027 		.rcpi = to_rcpi(rssi),
2028 	};
2029 	struct mt792x_sta *msta;
2030 	struct mt792x_link_sta *mlink;
2031 
2032 	if (link_sta) {
2033 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
2034 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
2035 	}
2036 	info.wcid = link_sta ? &mlink->wcid : &mvif->sta.deflink.wcid;
2037 	info.newly = state != MT76_STA_INFO_STATE_ASSOC;
2038 
2039 	return mt7925_mcu_sta_cmd(&dev->mphy, &info);
2040 }
2041 
2042 int mt7925_mcu_set_beacon_filter(struct mt792x_dev *dev,
2043 				 struct ieee80211_vif *vif,
2044 				 bool enable)
2045 {
2046 #define MT7925_FIF_BIT_CLR		BIT(1)
2047 #define MT7925_FIF_BIT_SET		BIT(0)
2048 	int err = 0;
2049 
2050 	if (enable) {
2051 		err = mt7925_mcu_uni_bss_bcnft(dev, &vif->bss_conf, true);
2052 		if (err < 0)
2053 			return err;
2054 
2055 		return mt7925_mcu_set_rxfilter(dev, 0,
2056 					       MT7925_FIF_BIT_SET,
2057 					       MT_WF_RFCR_DROP_OTHER_BEACON);
2058 	}
2059 
2060 	err = mt7925_mcu_set_bss_pm(dev, &vif->bss_conf, false);
2061 	if (err < 0)
2062 		return err;
2063 
2064 	return mt7925_mcu_set_rxfilter(dev, 0,
2065 				       MT7925_FIF_BIT_CLR,
2066 				       MT_WF_RFCR_DROP_OTHER_BEACON);
2067 }
2068 
2069 int mt7925_get_txpwr_info(struct mt792x_dev *dev, u8 band_idx, struct mt7925_txpwr *txpwr)
2070 {
2071 #define TX_POWER_SHOW_INFO 0x7
2072 #define TXPOWER_ALL_RATE_POWER_INFO 0x2
2073 	struct mt7925_txpwr_event *event;
2074 	struct mt7925_txpwr_req req = {
2075 		.tag = cpu_to_le16(TX_POWER_SHOW_INFO),
2076 		.len = cpu_to_le16(sizeof(req) - 4),
2077 		.catg = TXPOWER_ALL_RATE_POWER_INFO,
2078 		.band_idx = band_idx,
2079 	};
2080 	struct sk_buff *skb;
2081 	int ret;
2082 
2083 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(TXPOWER),
2084 					&req, sizeof(req), true, &skb);
2085 	if (ret)
2086 		return ret;
2087 
2088 	event = (struct mt7925_txpwr_event *)skb->data;
2089 	memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
2090 
2091 	dev_kfree_skb(skb);
2092 
2093 	return 0;
2094 }
2095 
2096 int mt7925_mcu_set_sniffer(struct mt792x_dev *dev, struct ieee80211_vif *vif,
2097 			   bool enable)
2098 {
2099 	struct {
2100 		struct {
2101 			u8 band_idx;
2102 			u8 pad[3];
2103 		} __packed hdr;
2104 		struct sniffer_enable_tlv {
2105 			__le16 tag;
2106 			__le16 len;
2107 			u8 enable;
2108 			u8 pad[3];
2109 		} __packed enable;
2110 	} __packed req = {
2111 		.hdr = {
2112 			.band_idx = 0,
2113 		},
2114 		.enable = {
2115 			.tag = cpu_to_le16(UNI_SNIFFER_ENABLE),
2116 			.len = cpu_to_le16(sizeof(struct sniffer_enable_tlv)),
2117 			.enable = enable,
2118 		},
2119 	};
2120 
2121 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req),
2122 				 true);
2123 }
2124 
2125 int mt7925_mcu_config_sniffer(struct mt792x_vif *vif,
2126 			      struct ieee80211_chanctx_conf *ctx)
2127 {
2128 	struct mt76_phy *mphy = vif->phy->mt76;
2129 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def : &mphy->chandef;
2130 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2131 
2132 	static const u8 ch_band[] = {
2133 		[NL80211_BAND_2GHZ] = 1,
2134 		[NL80211_BAND_5GHZ] = 2,
2135 		[NL80211_BAND_6GHZ] = 3,
2136 	};
2137 	static const u8 ch_width[] = {
2138 		[NL80211_CHAN_WIDTH_20_NOHT] = 0,
2139 		[NL80211_CHAN_WIDTH_20] = 0,
2140 		[NL80211_CHAN_WIDTH_40] = 0,
2141 		[NL80211_CHAN_WIDTH_80] = 1,
2142 		[NL80211_CHAN_WIDTH_160] = 2,
2143 		[NL80211_CHAN_WIDTH_80P80] = 3,
2144 		[NL80211_CHAN_WIDTH_5] = 4,
2145 		[NL80211_CHAN_WIDTH_10] = 5,
2146 		[NL80211_CHAN_WIDTH_320] = 6,
2147 	};
2148 
2149 	struct {
2150 		struct {
2151 			u8 band_idx;
2152 			u8 pad[3];
2153 		} __packed hdr;
2154 		struct config_tlv {
2155 			__le16 tag;
2156 			__le16 len;
2157 			u16 aid;
2158 			u8 ch_band;
2159 			u8 bw;
2160 			u8 control_ch;
2161 			u8 sco;
2162 			u8 center_ch;
2163 			u8 center_ch2;
2164 			u8 drop_err;
2165 			u8 pad[3];
2166 		} __packed tlv;
2167 	} __packed req = {
2168 		.hdr = {
2169 			.band_idx = 0,
2170 		},
2171 		.tlv = {
2172 			.tag = cpu_to_le16(UNI_SNIFFER_CONFIG),
2173 			.len = cpu_to_le16(sizeof(req.tlv)),
2174 			.control_ch = chandef->chan->hw_value,
2175 			.center_ch = ieee80211_frequency_to_channel(freq1),
2176 			.drop_err = 1,
2177 		},
2178 	};
2179 
2180 	if (chandef->chan->band < ARRAY_SIZE(ch_band))
2181 		req.tlv.ch_band = ch_band[chandef->chan->band];
2182 	if (chandef->width < ARRAY_SIZE(ch_width))
2183 		req.tlv.bw = ch_width[chandef->width];
2184 
2185 	if (freq2)
2186 		req.tlv.center_ch2 = ieee80211_frequency_to_channel(freq2);
2187 
2188 	if (req.tlv.control_ch < req.tlv.center_ch)
2189 		req.tlv.sco = 1; /* SCA */
2190 	else if (req.tlv.control_ch > req.tlv.center_ch)
2191 		req.tlv.sco = 3; /* SCB */
2192 
2193 	return mt76_mcu_send_msg(mphy->dev, MCU_UNI_CMD(SNIFFER),
2194 				 &req, sizeof(req), true);
2195 }
2196 
2197 int
2198 mt7925_mcu_uni_add_beacon_offload(struct mt792x_dev *dev,
2199 				  struct ieee80211_hw *hw,
2200 				  struct ieee80211_vif *vif,
2201 				  bool enable)
2202 {
2203 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
2204 	struct ieee80211_mutable_offsets offs;
2205 	struct {
2206 		struct req_hdr {
2207 			u8 bss_idx;
2208 			u8 pad[3];
2209 		} __packed hdr;
2210 		struct bcn_content_tlv {
2211 			__le16 tag;
2212 			__le16 len;
2213 			__le16 tim_ie_pos;
2214 			__le16 csa_ie_pos;
2215 			__le16 bcc_ie_pos;
2216 			/* 0: disable beacon offload
2217 			 * 1: enable beacon offload
2218 			 * 2: update probe respond offload
2219 			 */
2220 			u8 enable;
2221 			/* 0: legacy format (TXD + payload)
2222 			 * 1: only cap field IE
2223 			 */
2224 			u8 type;
2225 			__le16 pkt_len;
2226 			u8 pkt[512];
2227 		} __packed beacon_tlv;
2228 	} req = {
2229 		.hdr = {
2230 			.bss_idx = mvif->bss_conf.mt76.idx,
2231 		},
2232 		.beacon_tlv = {
2233 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
2234 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
2235 			.enable = enable,
2236 			.type = 1,
2237 		},
2238 	};
2239 	struct sk_buff *skb;
2240 	u8 cap_offs;
2241 
2242 	/* support enable/update process only
2243 	 * disable flow would be handled in bss stop handler automatically
2244 	 */
2245 	if (!enable)
2246 		return -EOPNOTSUPP;
2247 
2248 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs, 0);
2249 	if (!skb)
2250 		return -EINVAL;
2251 
2252 	cap_offs = offsetof(struct ieee80211_mgmt, u.beacon.capab_info);
2253 	if (!skb_pull(skb, cap_offs)) {
2254 		dev_err(dev->mt76.dev, "beacon format err\n");
2255 		dev_kfree_skb(skb);
2256 		return -EINVAL;
2257 	}
2258 
2259 	if (skb->len > 512) {
2260 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
2261 		dev_kfree_skb(skb);
2262 		return -EINVAL;
2263 	}
2264 
2265 	memcpy(req.beacon_tlv.pkt, skb->data, skb->len);
2266 	req.beacon_tlv.pkt_len = cpu_to_le16(skb->len);
2267 	offs.tim_offset -= cap_offs;
2268 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(offs.tim_offset);
2269 
2270 	if (offs.cntdwn_counter_offs[0]) {
2271 		u16 csa_offs;
2272 
2273 		csa_offs = offs.cntdwn_counter_offs[0] - cap_offs - 4;
2274 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
2275 	}
2276 	dev_kfree_skb(skb);
2277 
2278 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
2279 				 &req, sizeof(req), true);
2280 }
2281 
2282 static
2283 void mt7925_mcu_bss_rlm_tlv(struct sk_buff *skb, struct mt76_phy *phy,
2284 			    struct ieee80211_bss_conf *link_conf,
2285 			    struct ieee80211_chanctx_conf *ctx)
2286 {
2287 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2288 						  &link_conf->chanreq.oper;
2289 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2290 	enum nl80211_band band = chandef->chan->band;
2291 	struct bss_rlm_tlv *req;
2292 	struct tlv *tlv;
2293 
2294 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RLM, sizeof(*req));
2295 	req = (struct bss_rlm_tlv *)tlv;
2296 	req->control_channel = chandef->chan->hw_value;
2297 	req->center_chan = ieee80211_frequency_to_channel(freq1);
2298 	req->center_chan2 = 0;
2299 	req->tx_streams = hweight8(phy->antenna_mask);
2300 	req->ht_op_info = 4; /* set HT 40M allowed */
2301 	req->rx_streams = hweight8(phy->antenna_mask);
2302 	req->center_chan2 = 0;
2303 	req->sco = 0;
2304 	req->band = 1;
2305 
2306 	switch (band) {
2307 	case NL80211_BAND_2GHZ:
2308 		req->band = 1;
2309 		break;
2310 	case NL80211_BAND_5GHZ:
2311 		req->band = 2;
2312 		break;
2313 	case NL80211_BAND_6GHZ:
2314 		req->band = 3;
2315 		break;
2316 	default:
2317 		break;
2318 	}
2319 
2320 	switch (chandef->width) {
2321 	case NL80211_CHAN_WIDTH_40:
2322 		req->bw = CMD_CBW_40MHZ;
2323 		break;
2324 	case NL80211_CHAN_WIDTH_80:
2325 		req->bw = CMD_CBW_80MHZ;
2326 		break;
2327 	case NL80211_CHAN_WIDTH_80P80:
2328 		req->bw = CMD_CBW_8080MHZ;
2329 		req->center_chan2 = ieee80211_frequency_to_channel(freq2);
2330 		break;
2331 	case NL80211_CHAN_WIDTH_160:
2332 		req->bw = CMD_CBW_160MHZ;
2333 		break;
2334 	case NL80211_CHAN_WIDTH_5:
2335 		req->bw = CMD_CBW_5MHZ;
2336 		break;
2337 	case NL80211_CHAN_WIDTH_10:
2338 		req->bw = CMD_CBW_10MHZ;
2339 		break;
2340 	case NL80211_CHAN_WIDTH_20_NOHT:
2341 	case NL80211_CHAN_WIDTH_20:
2342 	default:
2343 		req->bw = CMD_CBW_20MHZ;
2344 		req->ht_op_info = 0;
2345 		break;
2346 	}
2347 
2348 	if (req->control_channel < req->center_chan)
2349 		req->sco = 1; /* SCA */
2350 	else if (req->control_channel > req->center_chan)
2351 		req->sco = 3; /* SCB */
2352 }
2353 
2354 static struct sk_buff *
2355 __mt7925_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif_link *mvif, int len)
2356 {
2357 	struct bss_req_hdr hdr = {
2358 		.bss_idx = mvif->idx,
2359 	};
2360 	struct sk_buff *skb;
2361 
2362 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
2363 	if (!skb)
2364 		return ERR_PTR(-ENOMEM);
2365 
2366 	skb_put_data(skb, &hdr, sizeof(hdr));
2367 
2368 	return skb;
2369 }
2370 
2371 static
2372 void mt7925_mcu_bss_eht_tlv(struct sk_buff *skb, struct mt76_phy *phy,
2373 			    struct ieee80211_bss_conf *link_conf,
2374 			    struct ieee80211_chanctx_conf *ctx)
2375 {
2376 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2377 						  &link_conf->chanreq.oper;
2378 
2379 	struct bss_eht_tlv *req;
2380 	struct tlv *tlv;
2381 
2382 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_EHT, sizeof(*req));
2383 	req = (struct bss_eht_tlv *)tlv;
2384 	req->is_eth_dscb_present = chandef->punctured ? 1 : 0;
2385 	req->eht_dis_sub_chan_bitmap = cpu_to_le16(chandef->punctured);
2386 }
2387 
2388 int mt7925_mcu_set_eht_pp(struct mt76_phy *phy, struct mt76_vif_link *mvif,
2389 			  struct ieee80211_bss_conf *link_conf,
2390 			  struct ieee80211_chanctx_conf *ctx)
2391 {
2392 	struct sk_buff *skb;
2393 
2394 	skb = __mt7925_mcu_alloc_bss_req(phy->dev, mvif,
2395 					 MT7925_BSS_UPDATE_MAX_SIZE);
2396 	if (IS_ERR(skb))
2397 		return PTR_ERR(skb);
2398 
2399 	mt7925_mcu_bss_eht_tlv(skb, phy, link_conf, ctx);
2400 
2401 	return mt76_mcu_skb_send_msg(phy->dev, skb,
2402 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2403 }
2404 
2405 int mt7925_mcu_set_chctx(struct mt76_phy *phy, struct mt76_vif_link *mvif,
2406 			 struct ieee80211_bss_conf *link_conf,
2407 			 struct ieee80211_chanctx_conf *ctx)
2408 {
2409 	struct sk_buff *skb;
2410 
2411 	skb = __mt7925_mcu_alloc_bss_req(phy->dev, mvif,
2412 					 MT7925_BSS_UPDATE_MAX_SIZE);
2413 	if (IS_ERR(skb))
2414 		return PTR_ERR(skb);
2415 
2416 	mt7925_mcu_bss_rlm_tlv(skb, phy, link_conf, ctx);
2417 
2418 	return mt76_mcu_skb_send_msg(phy->dev, skb,
2419 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2420 }
2421 
2422 static u8
2423 mt7925_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
2424 			enum nl80211_band band,
2425 			struct ieee80211_link_sta *link_sta)
2426 {
2427 	struct ieee80211_he_6ghz_capa *he_6ghz_capa;
2428 	const struct ieee80211_sta_eht_cap *eht_cap;
2429 	__le16 capa = 0;
2430 	u8 mode = 0;
2431 
2432 	if (link_sta) {
2433 		he_6ghz_capa = &link_sta->he_6ghz_capa;
2434 		eht_cap = &link_sta->eht_cap;
2435 	} else {
2436 		struct ieee80211_supported_band *sband;
2437 
2438 		sband = phy->hw->wiphy->bands[band];
2439 		capa = ieee80211_get_he_6ghz_capa(sband, vif->type);
2440 		he_6ghz_capa = (struct ieee80211_he_6ghz_capa *)&capa;
2441 
2442 		eht_cap = ieee80211_get_eht_iftype_cap(sband, vif->type);
2443 	}
2444 
2445 	switch (band) {
2446 	case NL80211_BAND_2GHZ:
2447 		if (eht_cap && eht_cap->has_eht)
2448 			mode |= PHY_MODE_BE_24G;
2449 		break;
2450 	case NL80211_BAND_5GHZ:
2451 		if (eht_cap && eht_cap->has_eht)
2452 			mode |= PHY_MODE_BE_5G;
2453 		break;
2454 	case NL80211_BAND_6GHZ:
2455 		if (he_6ghz_capa && he_6ghz_capa->capa)
2456 			mode |= PHY_MODE_AX_6G;
2457 
2458 		if (eht_cap && eht_cap->has_eht)
2459 			mode |= PHY_MODE_BE_6G;
2460 		break;
2461 	default:
2462 		break;
2463 	}
2464 
2465 	return mode;
2466 }
2467 
2468 static void
2469 mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
2470 			 struct ieee80211_bss_conf *link_conf,
2471 			 struct ieee80211_link_sta *link_sta,
2472 			 struct ieee80211_chanctx_conf *ctx,
2473 			 struct mt76_phy *phy, u16 wlan_idx,
2474 			 bool enable)
2475 {
2476 	struct ieee80211_vif *vif = link_conf->vif;
2477 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2478 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2479 						  &link_conf->chanreq.oper;
2480 	enum nl80211_band band = chandef->chan->band;
2481 	struct mt76_connac_bss_basic_tlv *basic_req;
2482 	struct mt792x_link_sta *mlink;
2483 	struct tlv *tlv;
2484 	int conn_type;
2485 	u8 idx;
2486 
2487 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*basic_req));
2488 	basic_req = (struct mt76_connac_bss_basic_tlv *)tlv;
2489 
2490 	idx = mconf->mt76.omac_idx > EXT_BSSID_START ? HW_BSSID_0 :
2491 						      mconf->mt76.omac_idx;
2492 	basic_req->hw_bss_idx = idx;
2493 
2494 	basic_req->phymode_ext = mt7925_get_phy_mode_ext(phy, vif, band,
2495 							 link_sta);
2496 
2497 	if (band == NL80211_BAND_2GHZ)
2498 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_ERP_INDEX);
2499 	else
2500 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_OFDM_INDEX);
2501 
2502 	memcpy(basic_req->bssid, link_conf->bssid, ETH_ALEN);
2503 	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, link_sta);
2504 	basic_req->bcn_interval = cpu_to_le16(link_conf->beacon_int);
2505 	basic_req->dtim_period = link_conf->dtim_period;
2506 	basic_req->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
2507 	basic_req->link_idx = mconf->mt76.idx;
2508 
2509 	if (link_sta) {
2510 		struct mt792x_sta *msta;
2511 
2512 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
2513 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
2514 
2515 	} else {
2516 		mlink = &mconf->vif->sta.deflink;
2517 	}
2518 
2519 	basic_req->sta_idx = cpu_to_le16(mlink->wcid.idx);
2520 	basic_req->omac_idx = mconf->mt76.omac_idx;
2521 	basic_req->band_idx = mconf->mt76.band_idx;
2522 	basic_req->wmm_idx = mconf->mt76.wmm_idx;
2523 	basic_req->conn_state = !enable;
2524 
2525 	switch (vif->type) {
2526 	case NL80211_IFTYPE_MESH_POINT:
2527 	case NL80211_IFTYPE_AP:
2528 		if (vif->p2p)
2529 			conn_type = CONNECTION_P2P_GO;
2530 		else
2531 			conn_type = CONNECTION_INFRA_AP;
2532 		basic_req->conn_type = cpu_to_le32(conn_type);
2533 		basic_req->active = enable;
2534 		break;
2535 	case NL80211_IFTYPE_STATION:
2536 		if (vif->p2p)
2537 			conn_type = CONNECTION_P2P_GC;
2538 		else
2539 			conn_type = CONNECTION_INFRA_STA;
2540 		basic_req->conn_type = cpu_to_le32(conn_type);
2541 		basic_req->active = true;
2542 		break;
2543 	case NL80211_IFTYPE_ADHOC:
2544 		basic_req->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
2545 		basic_req->active = true;
2546 		break;
2547 	default:
2548 		WARN_ON(1);
2549 		break;
2550 	}
2551 }
2552 
2553 static void
2554 mt7925_mcu_bss_sec_tlv(struct sk_buff *skb,
2555 		       struct ieee80211_bss_conf *link_conf)
2556 {
2557 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2558 	struct mt76_vif_link *mvif = &mconf->mt76;
2559 	struct bss_sec_tlv {
2560 		__le16 tag;
2561 		__le16 len;
2562 		u8 mode;
2563 		u8 status;
2564 		u8 cipher;
2565 		u8 __rsv;
2566 	} __packed * sec;
2567 	struct tlv *tlv;
2568 
2569 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_SEC, sizeof(*sec));
2570 	sec = (struct bss_sec_tlv *)tlv;
2571 
2572 	switch (mvif->cipher) {
2573 	case CONNAC3_CIPHER_GCMP_256:
2574 	case CONNAC3_CIPHER_GCMP:
2575 		sec->mode = MODE_WPA3_SAE;
2576 		sec->status = 8;
2577 		break;
2578 	case CONNAC3_CIPHER_AES_CCMP:
2579 		sec->mode = MODE_WPA2_PSK;
2580 		sec->status = 6;
2581 		break;
2582 	case CONNAC3_CIPHER_TKIP:
2583 		sec->mode = MODE_WPA2_PSK;
2584 		sec->status = 4;
2585 		break;
2586 	case CONNAC3_CIPHER_WEP104:
2587 	case CONNAC3_CIPHER_WEP40:
2588 		sec->mode = MODE_SHARED;
2589 		sec->status = 0;
2590 		break;
2591 	default:
2592 		sec->mode = MODE_OPEN;
2593 		sec->status = 1;
2594 		break;
2595 	}
2596 
2597 	sec->cipher = mvif->cipher;
2598 }
2599 
2600 static void
2601 mt7925_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt792x_phy *phy,
2602 		       struct ieee80211_chanctx_conf *ctx,
2603 		       struct ieee80211_bss_conf *link_conf)
2604 {
2605 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2606 						  &link_conf->chanreq.oper;
2607 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2608 	enum nl80211_band band = chandef->chan->band;
2609 	struct mt76_vif_link *mvif = &mconf->mt76;
2610 	struct bss_rate_tlv *bmc;
2611 	struct tlv *tlv;
2612 	u8 idx = mvif->mcast_rates_idx ?
2613 		 mvif->mcast_rates_idx : mvif->basic_rates_idx;
2614 
2615 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RATE, sizeof(*bmc));
2616 
2617 	bmc = (struct bss_rate_tlv *)tlv;
2618 
2619 	if (band == NL80211_BAND_2GHZ)
2620 		bmc->basic_rate = cpu_to_le16(HR_DSSS_ERP_BASIC_RATE);
2621 	else
2622 		bmc->basic_rate = cpu_to_le16(OFDM_BASIC_RATE);
2623 
2624 	bmc->short_preamble = (band == NL80211_BAND_2GHZ);
2625 	bmc->bc_fixed_rate = idx;
2626 	bmc->mc_fixed_rate = idx;
2627 }
2628 
2629 static void
2630 mt7925_mcu_bss_mld_tlv(struct sk_buff *skb,
2631 		       struct ieee80211_bss_conf *link_conf)
2632 {
2633 	struct ieee80211_vif *vif = link_conf->vif;
2634 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2635 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2636 	struct mt792x_phy *phy = mvif->phy;
2637 	struct bss_mld_tlv *mld;
2638 	struct tlv *tlv;
2639 	bool is_mld;
2640 
2641 	is_mld = ieee80211_vif_is_mld(link_conf->vif) ||
2642 		 (hweight16(mvif->valid_links) > 1);
2643 
2644 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_MLD, sizeof(*mld));
2645 	mld = (struct bss_mld_tlv *)tlv;
2646 
2647 	mld->link_id = is_mld ? link_conf->link_id : 0xff;
2648 	/* apply the index of the primary link */
2649 	mld->group_mld_id = is_mld ? mvif->bss_conf.mt76.idx : 0xff;
2650 	mld->own_mld_id = mconf->mt76.idx + 32;
2651 	mld->remap_idx = 0xff;
2652 
2653 	if (phy->chip_cap & MT792x_CHIP_CAP_MLO_EML_EN) {
2654 		mld->eml_enable = !!(link_conf->vif->cfg.eml_cap &
2655 				     IEEE80211_EML_CAP_EMLSR_SUPP);
2656 	} else {
2657 		mld->eml_enable = 0;
2658 	}
2659 
2660 	memcpy(mld->mac_addr, vif->addr, ETH_ALEN);
2661 }
2662 
2663 static void
2664 mt7925_mcu_bss_qos_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf)
2665 {
2666 	struct mt76_connac_bss_qos_tlv *qos;
2667 	struct tlv *tlv;
2668 
2669 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_QBSS, sizeof(*qos));
2670 	qos = (struct mt76_connac_bss_qos_tlv *)tlv;
2671 	qos->qos = link_conf->qos;
2672 }
2673 
2674 static void
2675 mt7925_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2676 			  bool enable)
2677 {
2678 	struct bss_info_uni_mbssid *mbssid;
2679 	struct tlv *tlv;
2680 
2681 	if (!enable && !link_conf->bssid_indicator)
2682 		return;
2683 
2684 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_11V_MBSSID,
2685 				      sizeof(*mbssid));
2686 
2687 	mbssid = (struct bss_info_uni_mbssid *)tlv;
2688 	mbssid->max_indicator = link_conf->bssid_indicator;
2689 	mbssid->mbss_idx = link_conf->bssid_index;
2690 	mbssid->tx_bss_omac_idx = 0;
2691 }
2692 
2693 static void
2694 mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2695 		      struct mt792x_phy *phy)
2696 {
2697 #define DEFAULT_HE_PE_DURATION		4
2698 #define DEFAULT_HE_DURATION_RTS_THRES	1023
2699 	const struct ieee80211_sta_he_cap *cap;
2700 	struct bss_info_uni_he *he;
2701 	struct tlv *tlv;
2702 
2703 	cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
2704 
2705 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
2706 
2707 	he = (struct bss_info_uni_he *)tlv;
2708 	he->he_pe_duration = link_conf->htc_trig_based_pkt_ext;
2709 	if (!he->he_pe_duration)
2710 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
2711 
2712 	he->he_rts_thres = cpu_to_le16(link_conf->frame_time_rts_th);
2713 	if (!he->he_rts_thres)
2714 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
2715 
2716 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
2717 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
2718 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
2719 }
2720 
2721 static void
2722 mt7925_mcu_bss_color_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2723 			 bool enable)
2724 {
2725 	struct bss_info_uni_bss_color *color;
2726 	struct tlv *tlv;
2727 
2728 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BSS_COLOR, sizeof(*color));
2729 	color = (struct bss_info_uni_bss_color *)tlv;
2730 
2731 	color->enable = enable ?
2732 		link_conf->he_bss_color.enabled : 0;
2733 	color->bss_color = enable ?
2734 		link_conf->he_bss_color.color : 0;
2735 }
2736 
2737 static void
2738 mt7925_mcu_bss_ifs_tlv(struct sk_buff *skb,
2739 		       struct ieee80211_bss_conf *link_conf)
2740 {
2741 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2742 	struct mt792x_phy *phy = mvif->phy;
2743 	struct bss_ifs_time_tlv *ifs_time;
2744 	struct tlv *tlv;
2745 
2746 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_IFS_TIME, sizeof(*ifs_time));
2747 	ifs_time = (struct bss_ifs_time_tlv *)tlv;
2748 	ifs_time->slot_valid = true;
2749 	ifs_time->slot_time = cpu_to_le16(phy->slottime);
2750 }
2751 
2752 int mt7925_mcu_set_timing(struct mt792x_phy *phy,
2753 			  struct ieee80211_bss_conf *link_conf)
2754 {
2755 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2756 	struct mt792x_dev *dev = phy->dev;
2757 	struct sk_buff *skb;
2758 
2759 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2760 					 MT7925_BSS_UPDATE_MAX_SIZE);
2761 	if (IS_ERR(skb))
2762 		return PTR_ERR(skb);
2763 
2764 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2765 
2766 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2767 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2768 }
2769 
2770 void mt7925_mcu_del_dev(struct mt76_dev *mdev,
2771 			struct ieee80211_vif *vif)
2772 {
2773 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
2774 	struct {
2775 		struct {
2776 			u8 omac_idx;
2777 			u8 band_idx;
2778 			__le16 pad;
2779 		} __packed hdr;
2780 		struct req_tlv {
2781 			__le16 tag;
2782 			__le16 len;
2783 			u8 active;
2784 			u8 link_idx; /* hw link idx */
2785 			u8 omac_addr[ETH_ALEN];
2786 		} __packed tlv;
2787 	} dev_req = {
2788 		.tlv = {
2789 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
2790 			.len = cpu_to_le16(sizeof(struct req_tlv)),
2791 			.active = true,
2792 		},
2793 	};
2794 	struct {
2795 		struct {
2796 			u8 bss_idx;
2797 			u8 pad[3];
2798 		} __packed hdr;
2799 		struct mt76_connac_bss_basic_tlv basic;
2800 	} basic_req = {
2801 		.basic = {
2802 			.tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
2803 			.len = cpu_to_le16(sizeof(struct mt76_connac_bss_basic_tlv)),
2804 			.active = true,
2805 			.conn_state = 1,
2806 		},
2807 	};
2808 
2809 	dev_req.hdr.omac_idx = mvif->omac_idx;
2810 	dev_req.hdr.band_idx = mvif->band_idx;
2811 
2812 	basic_req.hdr.bss_idx = mvif->idx;
2813 	basic_req.basic.omac_idx = mvif->omac_idx;
2814 	basic_req.basic.band_idx = mvif->band_idx;
2815 	basic_req.basic.link_idx = mvif->link_idx;
2816 
2817 	mt76_mcu_send_msg(mdev, MCU_UNI_CMD(BSS_INFO_UPDATE),
2818 			  &basic_req, sizeof(basic_req), true);
2819 
2820 	/* recovery omac address for the legacy interface */
2821 	memcpy(dev_req.tlv.omac_addr, vif->addr, ETH_ALEN);
2822 	mt76_mcu_send_msg(mdev, MCU_UNI_CMD(DEV_INFO_UPDATE),
2823 			  &dev_req, sizeof(dev_req), true);
2824 }
2825 
2826 int mt7925_mcu_add_bss_info(struct mt792x_phy *phy,
2827 			    struct ieee80211_chanctx_conf *ctx,
2828 			    struct ieee80211_bss_conf *link_conf,
2829 			    struct ieee80211_link_sta *link_sta,
2830 			    int enable)
2831 {
2832 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2833 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2834 	struct mt792x_dev *dev = phy->dev;
2835 	struct mt792x_link_sta *mlink_bc;
2836 	struct sk_buff *skb;
2837 
2838 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2839 					 MT7925_BSS_UPDATE_MAX_SIZE);
2840 	if (IS_ERR(skb))
2841 		return PTR_ERR(skb);
2842 
2843 	mlink_bc = mt792x_sta_to_link(&mvif->sta, mconf->link_id);
2844 
2845 	/* bss_basic must be first */
2846 	mt7925_mcu_bss_basic_tlv(skb, link_conf, link_sta, ctx, phy->mt76,
2847 				 mlink_bc->wcid.idx, enable);
2848 	mt7925_mcu_bss_sec_tlv(skb, link_conf);
2849 	mt7925_mcu_bss_bmc_tlv(skb, phy, ctx, link_conf);
2850 	mt7925_mcu_bss_qos_tlv(skb, link_conf);
2851 	mt7925_mcu_bss_mld_tlv(skb, link_conf);
2852 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2853 
2854 	if (link_conf->he_support) {
2855 		mt7925_mcu_bss_he_tlv(skb, link_conf, phy);
2856 		mt7925_mcu_bss_color_tlv(skb, link_conf, enable);
2857 	}
2858 
2859 	if (enable) {
2860 		mt7925_mcu_bss_rlm_tlv(skb, phy->mt76, link_conf, ctx);
2861 		mt7925_mcu_bss_mbssid_tlv(skb, link_conf, enable);
2862 	}
2863 
2864 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2865 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2866 }
2867 
2868 int mt7925_mcu_set_dbdc(struct mt76_phy *phy, bool enable)
2869 {
2870 	struct mt76_dev *mdev = phy->dev;
2871 
2872 	struct mbmc_conf_tlv *conf;
2873 	struct mbmc_set_req *hdr;
2874 	struct sk_buff *skb;
2875 	struct tlv *tlv;
2876 	int max_len, err;
2877 
2878 	max_len = sizeof(*hdr) + sizeof(*conf);
2879 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2880 	if (!skb)
2881 		return -ENOMEM;
2882 
2883 	hdr = (struct mbmc_set_req *)skb_put(skb, sizeof(*hdr));
2884 
2885 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_MBMC_SETTING, sizeof(*conf));
2886 	conf = (struct mbmc_conf_tlv *)tlv;
2887 
2888 	conf->mbmc_en = enable;
2889 	conf->band = 0; /* unused */
2890 
2891 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SET_DBDC_PARMS),
2892 				    true);
2893 
2894 	return err;
2895 }
2896 
2897 static void
2898 mt7925_mcu_build_scan_ie_tlv(struct mt76_dev *mdev,
2899 			     struct sk_buff *skb,
2900 			     struct ieee80211_scan_ies *scan_ies)
2901 {
2902 	u32 max_len = sizeof(struct scan_ie_tlv) + MT76_CONNAC_SCAN_IE_LEN;
2903 	struct scan_ie_tlv *ie;
2904 	enum nl80211_band i;
2905 	struct tlv *tlv;
2906 	const u8 *ies;
2907 	u16 ies_len;
2908 
2909 	for (i = 0; i <= NL80211_BAND_6GHZ; i++) {
2910 		if (i == NL80211_BAND_60GHZ)
2911 			continue;
2912 
2913 		ies = scan_ies->ies[i];
2914 		ies_len = scan_ies->len[i];
2915 
2916 		if (!ies || !ies_len)
2917 			continue;
2918 
2919 		if (ies_len > max_len)
2920 			return;
2921 
2922 		tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE,
2923 					      sizeof(*ie) + ies_len);
2924 		ie = (struct scan_ie_tlv *)tlv;
2925 
2926 		memcpy(ie->ies, ies, ies_len);
2927 		ie->ies_len = cpu_to_le16(ies_len);
2928 
2929 		switch (i) {
2930 		case NL80211_BAND_2GHZ:
2931 			ie->band = 1;
2932 			break;
2933 		case NL80211_BAND_6GHZ:
2934 			ie->band = 3;
2935 			break;
2936 		default:
2937 			ie->band = 2;
2938 			break;
2939 		}
2940 
2941 		max_len -= (sizeof(*ie) + ies_len);
2942 	}
2943 }
2944 
2945 int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
2946 		       struct ieee80211_scan_request *scan_req)
2947 {
2948 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
2949 	struct cfg80211_scan_request *sreq = &scan_req->req;
2950 	int n_ssids = 0, err, i;
2951 	struct ieee80211_channel **scan_list = sreq->channels;
2952 	struct mt76_dev *mdev = phy->dev;
2953 	struct mt76_connac_mcu_scan_channel *chan;
2954 	struct sk_buff *skb;
2955 	struct scan_hdr_tlv *hdr;
2956 	struct scan_req_tlv *req;
2957 	struct scan_ssid_tlv *ssid;
2958 	struct scan_bssid_tlv *bssid;
2959 	struct scan_chan_info_tlv *chan_info;
2960 	struct scan_ie_tlv *ie;
2961 	struct scan_misc_tlv *misc;
2962 	struct tlv *tlv;
2963 	int max_len;
2964 
2965 	if (test_bit(MT76_HW_SCANNING, &phy->state))
2966 		return -EBUSY;
2967 
2968 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2969 		  sizeof(*bssid) * MT7925_RNR_SCAN_MAX_BSSIDS +
2970 		  sizeof(*chan_info) + sizeof(*misc) + sizeof(*ie) +
2971 		  MT76_CONNAC_SCAN_IE_LEN;
2972 
2973 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2974 	if (!skb)
2975 		return -ENOMEM;
2976 
2977 	set_bit(MT76_HW_SCANNING, &phy->state);
2978 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2979 
2980 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2981 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2982 	hdr->bss_idx = mvif->idx;
2983 
2984 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_REQ, sizeof(*req));
2985 	req = (struct scan_req_tlv *)tlv;
2986 	req->scan_type = sreq->n_ssids ? 1 : 0;
2987 	req->probe_req_num = sreq->n_ssids ? 2 : 0;
2988 
2989 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2990 	ssid = (struct scan_ssid_tlv *)tlv;
2991 	for (i = 0; i < sreq->n_ssids; i++) {
2992 		if (!sreq->ssids[i].ssid_len)
2993 			continue;
2994 		if (i >= MT7925_RNR_SCAN_MAX_BSSIDS)
2995 			break;
2996 
2997 		ssid->ssids[n_ssids].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
2998 		memcpy(ssid->ssids[n_ssids].ssid, sreq->ssids[i].ssid,
2999 		       sreq->ssids[i].ssid_len);
3000 		n_ssids++;
3001 	}
3002 	ssid->ssid_type = n_ssids ? BIT(2) : BIT(0);
3003 	ssid->ssids_num = n_ssids;
3004 
3005 	if (sreq->n_6ghz_params) {
3006 		u8 j;
3007 
3008 		mt76_connac_mcu_build_rnr_scan_param(mdev, sreq);
3009 
3010 		for (j = 0; j < mdev->rnr.bssid_num; j++) {
3011 			if (j >= MT7925_RNR_SCAN_MAX_BSSIDS)
3012 				break;
3013 
3014 			tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_BSSID,
3015 						      sizeof(*bssid));
3016 			bssid = (struct scan_bssid_tlv *)tlv;
3017 
3018 			ether_addr_copy(bssid->bssid, mdev->rnr.bssid[j]);
3019 			bssid->match_ch = mdev->rnr.channel[j];
3020 			bssid->match_ssid_ind = MT7925_RNR_SCAN_MAX_BSSIDS;
3021 			bssid->match_short_ssid_ind = MT7925_RNR_SCAN_MAX_BSSIDS;
3022 		}
3023 		req->scan_func |= SCAN_FUNC_RNR_SCAN;
3024 	} else {
3025 		tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_BSSID, sizeof(*bssid));
3026 		bssid = (struct scan_bssid_tlv *)tlv;
3027 
3028 		ether_addr_copy(bssid->bssid, sreq->bssid);
3029 	}
3030 
3031 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
3032 	chan_info = (struct scan_chan_info_tlv *)tlv;
3033 	chan_info->channels_num = min_t(u8, sreq->n_channels,
3034 					ARRAY_SIZE(chan_info->channels));
3035 	for (i = 0; i < chan_info->channels_num; i++) {
3036 		chan = &chan_info->channels[i];
3037 
3038 		switch (scan_list[i]->band) {
3039 		case NL80211_BAND_2GHZ:
3040 			chan->band = 1;
3041 			break;
3042 		case NL80211_BAND_6GHZ:
3043 			chan->band = 3;
3044 			break;
3045 		default:
3046 			chan->band = 2;
3047 			break;
3048 		}
3049 		chan->channel_num = scan_list[i]->hw_value;
3050 	}
3051 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
3052 
3053 	req->scan_func |= SCAN_FUNC_SPLIT_SCAN;
3054 
3055 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_MISC, sizeof(*misc));
3056 	misc = (struct scan_misc_tlv *)tlv;
3057 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
3058 		get_random_mask_addr(misc->random_mac, sreq->mac_addr,
3059 				     sreq->mac_addr_mask);
3060 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
3061 	}
3062 
3063 	/* Append scan probe IEs as the last tlv */
3064 	mt7925_mcu_build_scan_ie_tlv(mdev, skb, &scan_req->ies);
3065 
3066 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
3067 				    true);
3068 	if (err < 0)
3069 		clear_bit(MT76_HW_SCANNING, &phy->state);
3070 
3071 	return err;
3072 }
3073 EXPORT_SYMBOL_GPL(mt7925_mcu_hw_scan);
3074 
3075 int mt7925_mcu_sched_scan_req(struct mt76_phy *phy,
3076 			      struct ieee80211_vif *vif,
3077 			      struct cfg80211_sched_scan_request *sreq,
3078 			      struct ieee80211_scan_ies *ies)
3079 {
3080 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
3081 	struct ieee80211_channel **scan_list = sreq->channels;
3082 	struct mt76_connac_mcu_scan_channel *chan;
3083 	struct mt76_dev *mdev = phy->dev;
3084 	struct cfg80211_match_set *cfg_match;
3085 	struct cfg80211_ssid *cfg_ssid;
3086 
3087 	struct scan_hdr_tlv *hdr;
3088 	struct scan_sched_req *req;
3089 	struct scan_ssid_tlv *ssid;
3090 	struct scan_chan_info_tlv *chan_info;
3091 	struct scan_ie_tlv *ie;
3092 	struct scan_sched_ssid_match_sets *match;
3093 	struct sk_buff *skb;
3094 	struct tlv *tlv;
3095 	int i, max_len;
3096 
3097 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
3098 		  sizeof(*chan_info) + sizeof(*ie) +
3099 		  sizeof(*match);
3100 
3101 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
3102 	if (!skb)
3103 		return -ENOMEM;
3104 
3105 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
3106 
3107 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
3108 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
3109 	hdr->bss_idx = mvif->idx;
3110 
3111 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_REQ, sizeof(*req));
3112 	req = (struct scan_sched_req *)tlv;
3113 	req->version = 1;
3114 
3115 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
3116 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
3117 
3118 	req->intervals_num = sreq->n_scan_plans;
3119 	for (i = 0; i < req->intervals_num; i++)
3120 		req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
3121 
3122 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
3123 	ssid = (struct scan_ssid_tlv *)tlv;
3124 
3125 	ssid->ssids_num = sreq->n_ssids;
3126 	ssid->ssid_type = BIT(2);
3127 	for (i = 0; i < ssid->ssids_num; i++) {
3128 		cfg_ssid = &sreq->ssids[i];
3129 		memcpy(ssid->ssids[i].ssid, cfg_ssid->ssid, cfg_ssid->ssid_len);
3130 		ssid->ssids[i].ssid_len = cpu_to_le32(cfg_ssid->ssid_len);
3131 	}
3132 
3133 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID_MATCH_SETS, sizeof(*match));
3134 	match = (struct scan_sched_ssid_match_sets *)tlv;
3135 	match->match_num = sreq->n_match_sets;
3136 	for (i = 0; i < match->match_num; i++) {
3137 		cfg_match = &sreq->match_sets[i];
3138 		memcpy(match->match[i].ssid, cfg_match->ssid.ssid,
3139 		       cfg_match->ssid.ssid_len);
3140 		match->match[i].rssi_th = cpu_to_le32(cfg_match->rssi_thold);
3141 		match->match[i].ssid_len = cfg_match->ssid.ssid_len;
3142 	}
3143 
3144 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
3145 	chan_info = (struct scan_chan_info_tlv *)tlv;
3146 	chan_info->channels_num = min_t(u8, sreq->n_channels,
3147 					ARRAY_SIZE(chan_info->channels));
3148 	for (i = 0; i < chan_info->channels_num; i++) {
3149 		chan = &chan_info->channels[i];
3150 
3151 		switch (scan_list[i]->band) {
3152 		case NL80211_BAND_2GHZ:
3153 			chan->band = 1;
3154 			break;
3155 		case NL80211_BAND_6GHZ:
3156 			chan->band = 3;
3157 			break;
3158 		default:
3159 			chan->band = 2;
3160 			break;
3161 		}
3162 		chan->channel_num = scan_list[i]->hw_value;
3163 	}
3164 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
3165 
3166 	/* Append scan probe IEs as the last tlv */
3167 	mt7925_mcu_build_scan_ie_tlv(mdev, skb, ies);
3168 
3169 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
3170 				     true);
3171 }
3172 EXPORT_SYMBOL_GPL(mt7925_mcu_sched_scan_req);
3173 
3174 int
3175 mt7925_mcu_sched_scan_enable(struct mt76_phy *phy,
3176 			     struct ieee80211_vif *vif,
3177 			     bool enable)
3178 {
3179 	struct mt76_dev *mdev = phy->dev;
3180 	struct scan_sched_enable *req;
3181 	struct scan_hdr_tlv *hdr;
3182 	struct sk_buff *skb;
3183 	struct tlv *tlv;
3184 	int max_len;
3185 
3186 	max_len = sizeof(*hdr) + sizeof(*req);
3187 
3188 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
3189 	if (!skb)
3190 		return -ENOMEM;
3191 
3192 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
3193 	hdr->seq_num = 0;
3194 	hdr->bss_idx = 0;
3195 
3196 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_ENABLE, sizeof(*req));
3197 	req = (struct scan_sched_enable *)tlv;
3198 	req->active = !enable;
3199 
3200 	if (enable)
3201 		set_bit(MT76_HW_SCHED_SCANNING, &phy->state);
3202 	else
3203 		clear_bit(MT76_HW_SCHED_SCANNING, &phy->state);
3204 
3205 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
3206 				     true);
3207 }
3208 
3209 int mt7925_mcu_cancel_hw_scan(struct mt76_phy *phy,
3210 			      struct ieee80211_vif *vif)
3211 {
3212 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
3213 	struct {
3214 		struct scan_hdr {
3215 			u8 seq_num;
3216 			u8 bss_idx;
3217 			u8 pad[2];
3218 		} __packed hdr;
3219 		struct scan_cancel_tlv {
3220 			__le16 tag;
3221 			__le16 len;
3222 			u8 is_ext_channel;
3223 			u8 rsv[3];
3224 		} __packed cancel;
3225 	} req = {
3226 		.hdr = {
3227 			.seq_num = mvif->scan_seq_num,
3228 			.bss_idx = mvif->idx,
3229 		},
3230 		.cancel = {
3231 			.tag = cpu_to_le16(UNI_SCAN_CANCEL),
3232 			.len = cpu_to_le16(sizeof(struct scan_cancel_tlv)),
3233 		},
3234 	};
3235 
3236 	if (test_and_clear_bit(MT76_HW_SCANNING, &phy->state)) {
3237 		struct cfg80211_scan_info info = {
3238 			.aborted = true,
3239 		};
3240 
3241 		ieee80211_scan_completed(phy->hw, &info);
3242 	}
3243 
3244 	return mt76_mcu_send_msg(phy->dev, MCU_UNI_CMD(SCAN_REQ),
3245 				 &req, sizeof(req), true);
3246 }
3247 EXPORT_SYMBOL_GPL(mt7925_mcu_cancel_hw_scan);
3248 
3249 int mt7925_mcu_set_channel_domain(struct mt76_phy *phy)
3250 {
3251 	int len, i, n_max_channels, n_2ch = 0, n_5ch = 0, n_6ch = 0;
3252 	struct {
3253 		struct {
3254 			u8 alpha2[4]; /* regulatory_request.alpha2 */
3255 			u8 bw_2g; /* BW_20_40M		0
3256 				   * BW_20M		1
3257 				   * BW_20_40_80M	2
3258 				   * BW_20_40_80_160M	3
3259 				   * BW_20_40_80_8080M	4
3260 				   */
3261 			u8 bw_5g;
3262 			u8 bw_6g;
3263 			u8 pad;
3264 		} __packed hdr;
3265 		struct n_chan {
3266 			__le16 tag;
3267 			__le16 len;
3268 			u8 n_2ch;
3269 			u8 n_5ch;
3270 			u8 n_6ch;
3271 			u8 pad;
3272 		} __packed n_ch;
3273 	} req = {
3274 		.hdr = {
3275 			.bw_2g = 0,
3276 			.bw_5g = 3, /* BW_20_40_80_160M */
3277 			.bw_6g = 3,
3278 		},
3279 		.n_ch = {
3280 			.tag = cpu_to_le16(2),
3281 		},
3282 	};
3283 	struct mt76_connac_mcu_chan {
3284 		__le16 hw_value;
3285 		__le16 pad;
3286 		__le32 flags;
3287 	} __packed channel;
3288 	struct mt76_dev *dev = phy->dev;
3289 	struct ieee80211_channel *chan;
3290 	struct sk_buff *skb;
3291 
3292 	n_max_channels = phy->sband_2g.sband.n_channels +
3293 			 phy->sband_5g.sband.n_channels +
3294 			 phy->sband_6g.sband.n_channels;
3295 	len = sizeof(req) + n_max_channels * sizeof(channel);
3296 
3297 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
3298 	if (!skb)
3299 		return -ENOMEM;
3300 
3301 	skb_reserve(skb, sizeof(req));
3302 
3303 	for (i = 0; i < phy->sband_2g.sband.n_channels; i++) {
3304 		chan = &phy->sband_2g.sband.channels[i];
3305 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3306 			continue;
3307 
3308 		channel.hw_value = cpu_to_le16(chan->hw_value);
3309 		channel.flags = cpu_to_le32(chan->flags);
3310 		channel.pad = 0;
3311 
3312 		skb_put_data(skb, &channel, sizeof(channel));
3313 		n_2ch++;
3314 	}
3315 	for (i = 0; i < phy->sband_5g.sband.n_channels; i++) {
3316 		chan = &phy->sband_5g.sband.channels[i];
3317 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3318 			continue;
3319 
3320 		channel.hw_value = cpu_to_le16(chan->hw_value);
3321 		channel.flags = cpu_to_le32(chan->flags);
3322 		channel.pad = 0;
3323 
3324 		skb_put_data(skb, &channel, sizeof(channel));
3325 		n_5ch++;
3326 	}
3327 	for (i = 0; i < phy->sband_6g.sband.n_channels; i++) {
3328 		chan = &phy->sband_6g.sband.channels[i];
3329 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3330 			continue;
3331 
3332 		channel.hw_value = cpu_to_le16(chan->hw_value);
3333 		channel.flags = cpu_to_le32(chan->flags);
3334 		channel.pad = 0;
3335 
3336 		skb_put_data(skb, &channel, sizeof(channel));
3337 		n_6ch++;
3338 	}
3339 
3340 	BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(req.hdr.alpha2));
3341 	memcpy(req.hdr.alpha2, dev->alpha2, sizeof(dev->alpha2));
3342 	req.n_ch.n_2ch = n_2ch;
3343 	req.n_ch.n_5ch = n_5ch;
3344 	req.n_ch.n_6ch = n_6ch;
3345 	len = sizeof(struct n_chan) + (n_2ch + n_5ch + n_6ch) * sizeof(channel);
3346 	req.n_ch.len = cpu_to_le16(len);
3347 	memcpy(__skb_push(skb, sizeof(req)), &req, sizeof(req));
3348 
3349 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SET_DOMAIN_INFO),
3350 				     true);
3351 }
3352 EXPORT_SYMBOL_GPL(mt7925_mcu_set_channel_domain);
3353 
3354 static int
3355 __mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3356 		     enum environment_cap env_cap,
3357 		     struct mt7925_clc *clc, u8 idx)
3358 {
3359 	struct mt7925_clc_segment *seg;
3360 	struct sk_buff *skb;
3361 	struct {
3362 		u8 rsv[4];
3363 		__le16 tag;
3364 		__le16 len;
3365 
3366 		u8 ver;
3367 		u8 pad0;
3368 		__le16 size;
3369 		u8 idx;
3370 		u8 env;
3371 		u8 acpi_conf;
3372 		u8 pad1;
3373 		u8 alpha2[2];
3374 		u8 type[2];
3375 		u8 rsvd[64];
3376 	} __packed req = {
3377 		.tag = cpu_to_le16(0x3),
3378 		.len = cpu_to_le16(sizeof(req) - 4),
3379 
3380 		.idx = idx,
3381 		.env = env_cap,
3382 	};
3383 	int ret, valid_cnt = 0;
3384 	u8 *pos, *last_pos;
3385 
3386 	if (!clc)
3387 		return 0;
3388 
3389 	req.ver = clc->ver;
3390 	pos = clc->data + sizeof(*seg) * clc->t0.nr_seg;
3391 	last_pos = clc->data + le32_to_cpu(*(__le32 *)(clc->data + 4));
3392 	while (pos < last_pos) {
3393 		struct mt7925_clc_rule *rule = (struct mt7925_clc_rule *)pos;
3394 
3395 		pos += sizeof(*rule);
3396 		if (rule->alpha2[0] != alpha2[0] ||
3397 		    rule->alpha2[1] != alpha2[1])
3398 			continue;
3399 
3400 		seg = (struct mt7925_clc_segment *)clc->data
3401 			  + rule->seg_idx - 1;
3402 
3403 		memcpy(req.alpha2, rule->alpha2, 2);
3404 		memcpy(req.type, rule->type, 2);
3405 
3406 		req.size = cpu_to_le16(seg->len);
3407 		dev->phy.clc_chan_conf = clc->ver == 1 ? 0xff : rule->flag;
3408 		skb = __mt76_mcu_msg_alloc(&dev->mt76, &req,
3409 					   le16_to_cpu(req.size) + sizeof(req),
3410 					   sizeof(req), GFP_KERNEL);
3411 		if (!skb)
3412 			return -ENOMEM;
3413 		skb_put_data(skb, clc->data + seg->offset, seg->len);
3414 
3415 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3416 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3417 					    true);
3418 		if (ret < 0)
3419 			return ret;
3420 		valid_cnt++;
3421 	}
3422 
3423 	if (!valid_cnt) {
3424 		dev->phy.clc_chan_conf = 0xff;
3425 		return -ENOENT;
3426 	}
3427 
3428 	return 0;
3429 }
3430 
3431 int mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3432 		       enum environment_cap env_cap)
3433 {
3434 	struct mt792x_phy *phy = (struct mt792x_phy *)&dev->phy;
3435 	int i, ret;
3436 
3437 	if (!ARRAY_SIZE(phy->clc))
3438 		return -ESRCH;
3439 
3440 	/* submit all clc config */
3441 	for (i = 0; i < ARRAY_SIZE(phy->clc); i++) {
3442 		if (i == MT792x_CLC_BE_CTRL)
3443 			continue;
3444 
3445 		ret = __mt7925_mcu_set_clc(dev, alpha2, env_cap,
3446 					   phy->clc[i], i);
3447 
3448 		/* If no country found, set "00" as default */
3449 		if (ret == -ENOENT)
3450 			ret = __mt7925_mcu_set_clc(dev, "00",
3451 						   ENVIRON_INDOOR,
3452 						   phy->clc[i], i);
3453 		if (ret < 0)
3454 			return ret;
3455 	}
3456 	return 0;
3457 }
3458 
3459 int mt7925_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb,
3460 			    int cmd, int *wait_seq)
3461 {
3462 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
3463 	struct mt76_connac2_mcu_uni_txd *uni_txd;
3464 	struct mt76_connac2_mcu_txd *mcu_txd;
3465 	__le32 *txd;
3466 	u32 val;
3467 	u8 seq;
3468 
3469 	/* TODO: make dynamic based on msg type */
3470 	mdev->mcu.timeout = 20 * HZ;
3471 
3472 	seq = ++mdev->mcu.msg_seq & 0xf;
3473 	if (!seq)
3474 		seq = ++mdev->mcu.msg_seq & 0xf;
3475 
3476 	if (cmd == MCU_CMD(FW_SCATTER))
3477 		goto exit;
3478 
3479 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
3480 	txd = (__le32 *)skb_push(skb, txd_len);
3481 
3482 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
3483 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
3484 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
3485 	txd[0] = cpu_to_le32(val);
3486 
3487 	val = FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
3488 	txd[1] = cpu_to_le32(val);
3489 
3490 	if (cmd & __MCU_CMD_FIELD_UNI) {
3491 		uni_txd = (struct mt76_connac2_mcu_uni_txd *)txd;
3492 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
3493 		uni_txd->cid = cpu_to_le16(mcu_cmd);
3494 		uni_txd->s2d_index = MCU_S2D_H2N;
3495 		uni_txd->pkt_type = MCU_PKT_ID;
3496 		uni_txd->seq = seq;
3497 
3498 		if (cmd & __MCU_CMD_FIELD_QUERY)
3499 			uni_txd->option = MCU_CMD_UNI_QUERY_ACK;
3500 		else
3501 			uni_txd->option = MCU_CMD_UNI_EXT_ACK;
3502 
3503 		if (cmd == MCU_UNI_CMD(HIF_CTRL) ||
3504 		    cmd == MCU_UNI_CMD(CHIP_CONFIG))
3505 			uni_txd->option &= ~MCU_CMD_ACK;
3506 
3507 		if (mcu_cmd == MCU_UNI_CMD_TESTMODE_CTRL ||
3508 		    mcu_cmd == MCU_UNI_CMD_TESTMODE_RX_STAT) {
3509 			if (cmd & __MCU_CMD_FIELD_QUERY)
3510 				uni_txd->option = 0x2;
3511 			else
3512 				uni_txd->option = 0x6;
3513 		}
3514 
3515 		goto exit;
3516 	}
3517 
3518 	mcu_txd = (struct mt76_connac2_mcu_txd *)txd;
3519 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
3520 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
3521 					       MT_TX_MCU_PORT_RX_Q0));
3522 	mcu_txd->pkt_type = MCU_PKT_ID;
3523 	mcu_txd->seq = seq;
3524 	mcu_txd->cid = mcu_cmd;
3525 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
3526 
3527 	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
3528 		if (cmd & __MCU_CMD_FIELD_QUERY)
3529 			mcu_txd->set_query = MCU_Q_QUERY;
3530 		else
3531 			mcu_txd->set_query = MCU_Q_SET;
3532 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
3533 	} else {
3534 		mcu_txd->set_query = MCU_Q_NA;
3535 	}
3536 
3537 	if (cmd & __MCU_CMD_FIELD_WA)
3538 		mcu_txd->s2d_index = MCU_S2D_H2C;
3539 	else
3540 		mcu_txd->s2d_index = MCU_S2D_H2N;
3541 
3542 exit:
3543 	if (wait_seq)
3544 		*wait_seq = seq;
3545 
3546 	return 0;
3547 }
3548 EXPORT_SYMBOL_GPL(mt7925_mcu_fill_message);
3549 
3550 int mt7925_mcu_set_rts_thresh(struct mt792x_phy *phy, u32 val)
3551 {
3552 	struct {
3553 		u8 band_idx;
3554 		u8 _rsv[3];
3555 
3556 		__le16 tag;
3557 		__le16 len;
3558 		__le32 len_thresh;
3559 		__le32 pkt_thresh;
3560 	} __packed req = {
3561 		.band_idx = phy->mt76->band_idx,
3562 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RTS_THRESHOLD),
3563 		.len = cpu_to_le16(sizeof(req) - 4),
3564 		.len_thresh = cpu_to_le32(val),
3565 		.pkt_thresh = cpu_to_le32(0x2),
3566 	};
3567 
3568 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3569 				 &req, sizeof(req), true);
3570 }
3571 
3572 int mt7925_mcu_set_radio_en(struct mt792x_phy *phy, bool enable)
3573 {
3574 	struct {
3575 		u8 band_idx;
3576 		u8 _rsv[3];
3577 
3578 		__le16 tag;
3579 		__le16 len;
3580 		u8 enable;
3581 		u8 _rsv2[3];
3582 	} __packed req = {
3583 		.band_idx = phy->mt76->band_idx,
3584 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RADIO_ENABLE),
3585 		.len = cpu_to_le16(sizeof(req) - 4),
3586 		.enable = enable,
3587 	};
3588 
3589 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3590 				 &req, sizeof(req), true);
3591 }
3592 
3593 static void
3594 mt7925_mcu_build_sku(struct mt76_dev *dev, s8 *sku,
3595 		     struct mt76_power_limits *limits,
3596 		     enum nl80211_band band)
3597 {
3598 	int i, offset = sizeof(limits->cck);
3599 
3600 	memset(sku, 127, MT_CONNAC3_SKU_POWER_LIMIT);
3601 
3602 	if (band == NL80211_BAND_2GHZ) {
3603 		/* cck */
3604 		memcpy(sku, limits->cck, sizeof(limits->cck));
3605 	}
3606 
3607 	/* ofdm */
3608 	memcpy(&sku[offset], limits->ofdm, sizeof(limits->ofdm));
3609 	offset += (sizeof(limits->ofdm) * 5);
3610 
3611 	/* ht */
3612 	for (i = 0; i < 2; i++) {
3613 		memcpy(&sku[offset], limits->mcs[i], 8);
3614 		offset += 8;
3615 	}
3616 	sku[offset++] = limits->mcs[0][0];
3617 
3618 	/* vht */
3619 	for (i = 0; i < ARRAY_SIZE(limits->mcs); i++) {
3620 		memcpy(&sku[offset], limits->mcs[i],
3621 		       ARRAY_SIZE(limits->mcs[i]));
3622 		offset += 12;
3623 	}
3624 
3625 	/* he */
3626 	for (i = 0; i < ARRAY_SIZE(limits->ru); i++) {
3627 		memcpy(&sku[offset], limits->ru[i], ARRAY_SIZE(limits->ru[i]));
3628 		offset += ARRAY_SIZE(limits->ru[i]);
3629 	}
3630 
3631 	/* eht */
3632 	for (i = 0; i < ARRAY_SIZE(limits->eht); i++) {
3633 		memcpy(&sku[offset], limits->eht[i], ARRAY_SIZE(limits->eht[i]));
3634 		offset += ARRAY_SIZE(limits->eht[i]);
3635 	}
3636 }
3637 
3638 static int
3639 mt7925_mcu_rate_txpower_band(struct mt76_phy *phy,
3640 			     enum nl80211_band band)
3641 {
3642 	int tx_power, n_chan, last_ch, err = 0, idx = 0;
3643 	int i, sku_len, batch_size, batch_len = 3;
3644 	struct mt76_dev *dev = phy->dev;
3645 	static const u8 chan_list_2ghz[] = {
3646 		1, 2,  3,  4,  5,  6,  7,
3647 		8, 9, 10, 11, 12, 13, 14
3648 	};
3649 	static const u8 chan_list_5ghz[] = {
3650 		 36,  38,  40,  42,  44,  46,  48,
3651 		 50,  52,  54,  56,  58,  60,  62,
3652 		 64, 100, 102, 104, 106, 108, 110,
3653 		112, 114, 116, 118, 120, 122, 124,
3654 		126, 128, 132, 134, 136, 138, 140,
3655 		142, 144, 149, 151, 153, 155, 157,
3656 		159, 161, 165, 167
3657 	};
3658 	static const u8 chan_list_6ghz[] = {
3659 		  1,   3,   5,   7,   9,  11,  13,
3660 		 15,  17,  19,  21,  23,  25,  27,
3661 		 29,  33,  35,  37,  39,  41,  43,
3662 		 45,  47,  49,  51,  53,  55,  57,
3663 		 59,  61,  65,  67,  69,  71,  73,
3664 		 75,  77,  79,  81,  83,  85,  87,
3665 		 89,  91,  93,  97,  99, 101, 103,
3666 		105, 107, 109, 111, 113, 115, 117,
3667 		119, 121, 123, 125, 129, 131, 133,
3668 		135, 137, 139, 141, 143, 145, 147,
3669 		149, 151, 153, 155, 157, 161, 163,
3670 		165, 167, 169, 171, 173, 175, 177,
3671 		179, 181, 183, 185, 187, 189, 193,
3672 		195, 197, 199, 201, 203, 205, 207,
3673 		209, 211, 213, 215, 217, 219, 221,
3674 		225, 227, 229, 233
3675 	};
3676 	struct mt76_power_limits *limits;
3677 	struct mt7925_sku_tlv *sku_tlbv;
3678 	const u8 *ch_list;
3679 
3680 	sku_len = sizeof(*sku_tlbv);
3681 	tx_power = 2 * phy->hw->conf.power_level;
3682 	if (!tx_power)
3683 		tx_power = 127;
3684 
3685 	if (band == NL80211_BAND_2GHZ) {
3686 		n_chan = ARRAY_SIZE(chan_list_2ghz);
3687 		ch_list = chan_list_2ghz;
3688 		last_ch = chan_list_2ghz[ARRAY_SIZE(chan_list_2ghz) - 1];
3689 	} else if (band == NL80211_BAND_6GHZ) {
3690 		n_chan = ARRAY_SIZE(chan_list_6ghz);
3691 		ch_list = chan_list_6ghz;
3692 		last_ch = chan_list_6ghz[ARRAY_SIZE(chan_list_6ghz) - 1];
3693 	} else {
3694 		n_chan = ARRAY_SIZE(chan_list_5ghz);
3695 		ch_list = chan_list_5ghz;
3696 		last_ch = chan_list_5ghz[ARRAY_SIZE(chan_list_5ghz) - 1];
3697 	}
3698 	batch_size = DIV_ROUND_UP(n_chan, batch_len);
3699 
3700 	limits = devm_kmalloc(dev->dev, sizeof(*limits), GFP_KERNEL);
3701 	if (!limits)
3702 		return -ENOMEM;
3703 
3704 	sku_tlbv = devm_kmalloc(dev->dev, sku_len, GFP_KERNEL);
3705 	if (!sku_tlbv) {
3706 		devm_kfree(dev->dev, limits);
3707 		return -ENOMEM;
3708 	}
3709 
3710 	for (i = 0; i < batch_size; i++) {
3711 		struct mt7925_tx_power_limit_tlv *tx_power_tlv;
3712 		int j, msg_len, num_ch;
3713 		struct sk_buff *skb;
3714 
3715 		num_ch = i == batch_size - 1 ? n_chan % batch_len : batch_len;
3716 		msg_len = sizeof(*tx_power_tlv) + num_ch * sku_len;
3717 		skb = mt76_mcu_msg_alloc(dev, NULL, msg_len);
3718 		if (!skb) {
3719 			err = -ENOMEM;
3720 			goto out;
3721 		}
3722 
3723 		tx_power_tlv = (struct mt7925_tx_power_limit_tlv *)
3724 			       skb_put(skb, sizeof(*tx_power_tlv));
3725 
3726 		BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(tx_power_tlv->alpha2));
3727 		memcpy(tx_power_tlv->alpha2, dev->alpha2, sizeof(dev->alpha2));
3728 		tx_power_tlv->n_chan = num_ch;
3729 		tx_power_tlv->tag = cpu_to_le16(0x1);
3730 		tx_power_tlv->len = cpu_to_le16(sizeof(*tx_power_tlv));
3731 
3732 		switch (band) {
3733 		case NL80211_BAND_2GHZ:
3734 			tx_power_tlv->band = 1;
3735 			break;
3736 		case NL80211_BAND_6GHZ:
3737 			tx_power_tlv->band = 3;
3738 			break;
3739 		default:
3740 			tx_power_tlv->band = 2;
3741 			break;
3742 		}
3743 
3744 		for (j = 0; j < num_ch; j++, idx++) {
3745 			struct ieee80211_channel chan = {
3746 				.hw_value = ch_list[idx],
3747 				.band = band,
3748 			};
3749 			s8 reg_power, sar_power;
3750 
3751 			reg_power = mt76_connac_get_ch_power(phy, &chan,
3752 							     tx_power);
3753 			sar_power = mt76_get_sar_power(phy, &chan, reg_power);
3754 
3755 			mt76_get_rate_power_limits(phy, &chan, limits,
3756 						   sar_power);
3757 
3758 			tx_power_tlv->last_msg = ch_list[idx] == last_ch;
3759 			sku_tlbv->channel = ch_list[idx];
3760 
3761 			mt7925_mcu_build_sku(dev, sku_tlbv->pwr_limit,
3762 					     limits, band);
3763 			skb_put_data(skb, sku_tlbv, sku_len);
3764 		}
3765 		err = mt76_mcu_skb_send_msg(dev, skb,
3766 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3767 					    true);
3768 		if (err < 0)
3769 			goto out;
3770 	}
3771 
3772 out:
3773 	devm_kfree(dev->dev, sku_tlbv);
3774 	devm_kfree(dev->dev, limits);
3775 	return err;
3776 }
3777 
3778 int mt7925_mcu_set_rate_txpower(struct mt76_phy *phy)
3779 {
3780 	struct mt76_dev *mdev = phy->dev;
3781 	struct mt792x_dev *dev = mt792x_hw_dev(mdev->hw);
3782 	int err;
3783 
3784 	if (phy->cap.has_2ghz) {
3785 		err = mt7925_mcu_rate_txpower_band(phy,
3786 						   NL80211_BAND_2GHZ);
3787 		if (err < 0)
3788 			return err;
3789 	}
3790 
3791 	if (phy->cap.has_5ghz) {
3792 		err = mt7925_mcu_rate_txpower_band(phy,
3793 						   NL80211_BAND_5GHZ);
3794 		if (err < 0)
3795 			return err;
3796 	}
3797 
3798 	if (phy->cap.has_6ghz && dev->phy.clc_chan_conf) {
3799 		err = mt7925_mcu_rate_txpower_band(phy,
3800 						   NL80211_BAND_6GHZ);
3801 		if (err < 0)
3802 			return err;
3803 	}
3804 
3805 	return 0;
3806 }
3807 
3808 int mt7925_mcu_wf_rf_pin_ctrl(struct mt792x_phy *phy)
3809 {
3810 #define UNI_CMD_RADIO_STATUS_GET	0
3811 	struct mt792x_dev *dev = phy->dev;
3812 	struct sk_buff *skb;
3813 	int ret;
3814 	struct {
3815 		__le16 tag;
3816 		__le16 len;
3817 		u8 rsv[4];
3818 	} __packed req = {
3819 		.tag = UNI_CMD_RADIO_STATUS_GET,
3820 		.len = cpu_to_le16(sizeof(req)),
3821 	};
3822 	struct mt7925_radio_status_event {
3823 		__le16 tag;
3824 		__le16 len;
3825 
3826 		u8 data;
3827 		u8 rsv[3];
3828 	} __packed *status;
3829 
3830 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3831 					MCU_UNI_CMD(RADIO_STATUS),
3832 					&req, sizeof(req), true, &skb);
3833 	if (ret)
3834 		return ret;
3835 
3836 	skb_pull(skb, sizeof(struct tlv));
3837 	status = (struct mt7925_radio_status_event *)skb->data;
3838 	ret = status->data;
3839 
3840 	dev_kfree_skb(skb);
3841 
3842 	return ret;
3843 }
3844 
3845 int mt7925_mcu_set_rxfilter(struct mt792x_dev *dev, u32 fif,
3846 			    u8 bit_op, u32 bit_map)
3847 {
3848 	struct mt792x_phy *phy = &dev->phy;
3849 	struct {
3850 		u8 band_idx;
3851 		u8 rsv1[3];
3852 
3853 		__le16 tag;
3854 		__le16 len;
3855 		u8 mode;
3856 		u8 rsv2[3];
3857 		__le32 fif;
3858 		__le32 bit_map; /* bit_* for bitmap update */
3859 		u8 bit_op;
3860 		u8 pad[51];
3861 	} __packed req = {
3862 		.band_idx = phy->mt76->band_idx,
3863 		.tag = cpu_to_le16(UNI_BAND_CONFIG_SET_MAC80211_RX_FILTER),
3864 		.len = cpu_to_le16(sizeof(req) - 4),
3865 
3866 		.mode = fif ? 0 : 1,
3867 		.fif = cpu_to_le32(fif),
3868 		.bit_map = cpu_to_le32(bit_map),
3869 		.bit_op = bit_op,
3870 	};
3871 
3872 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3873 				 &req, sizeof(req), true);
3874 }
3875 
3876 int mt7925_mcu_set_rssimonitor(struct mt792x_dev *dev, struct ieee80211_vif *vif)
3877 {
3878 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(&vif->bss_conf);
3879 	struct {
3880 		struct {
3881 			u8 bss_idx;
3882 			u8 pad[3];
3883 		} __packed hdr;
3884 		__le16 tag;
3885 		__le16 len;
3886 		u8 enable;
3887 		s8 cqm_rssi_high;
3888 		s8 cqm_rssi_low;
3889 		u8 rsv;
3890 	} req = {
3891 		.hdr = {
3892 			.bss_idx = mconf->mt76.idx,
3893 		},
3894 		.tag = cpu_to_le16(UNI_CMD_RSSI_MONITOR_SET),
3895 		.len = cpu_to_le16(sizeof(req) - 4),
3896 		.enable = vif->cfg.assoc,
3897 		.cqm_rssi_high = (s8)(vif->bss_conf.cqm_rssi_thold + vif->bss_conf.cqm_rssi_hyst),
3898 		.cqm_rssi_low = (s8)(vif->bss_conf.cqm_rssi_thold - vif->bss_conf.cqm_rssi_hyst),
3899 	};
3900 
3901 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(RSSI_MONITOR), &req,
3902 				 sizeof(req), false);
3903 }
3904