xref: /freebsd/sys/contrib/dev/mediatek/mt76/mt7925/mcu.c (revision b670c9bafc0e31c7609969bf374b2e80bdc00211)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2023 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include <linux/firmware.h>
6 #include "mt7925.h"
7 #include "mcu.h"
8 #include "mac.h"
9 
10 #define MT_STA_BFER			BIT(0)
11 #define MT_STA_BFEE			BIT(1)
12 
13 static bool mt7925_disable_clc;
14 module_param_named(disable_clc, mt7925_disable_clc, bool, 0644);
15 MODULE_PARM_DESC(disable_clc, "disable CLC support");
16 
17 int mt7925_mcu_parse_response(struct mt76_dev *mdev, int cmd,
18 			      struct sk_buff *skb, int seq)
19 {
20 	int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
21 	struct mt7925_mcu_rxd *rxd;
22 	int ret = 0;
23 
24 	if (!skb) {
25 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n", cmd, seq);
26 		mt792x_reset(mdev);
27 
28 		return -ETIMEDOUT;
29 	}
30 
31 	rxd = (struct mt7925_mcu_rxd *)skb->data;
32 	if (seq != rxd->seq)
33 		return -EAGAIN;
34 
35 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL) ||
36 	    cmd == MCU_CMD(PATCH_FINISH_REQ)) {
37 		skb_pull(skb, sizeof(*rxd) - 4);
38 		ret = *skb->data;
39 	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
40 		   cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
41 		   cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
42 		   cmd == MCU_UNI_CMD(OFFLOAD) ||
43 		   cmd == MCU_UNI_CMD(SUSPEND)) {
44 		struct mt7925_mcu_uni_event *event;
45 
46 		skb_pull(skb, sizeof(*rxd));
47 		event = (struct mt7925_mcu_uni_event *)skb->data;
48 		ret = le32_to_cpu(event->status);
49 		/* skip invalid event */
50 		if (mcu_cmd != event->cid)
51 			ret = -EAGAIN;
52 	} else {
53 		skb_pull(skb, sizeof(*rxd));
54 	}
55 
56 	return ret;
57 }
58 EXPORT_SYMBOL_GPL(mt7925_mcu_parse_response);
59 
60 int mt7925_mcu_regval(struct mt792x_dev *dev, u32 regidx, u32 *val, bool set)
61 {
62 #define MT_RF_REG_HDR           GENMASK(31, 24)
63 #define MT_RF_REG_ANT           GENMASK(23, 16)
64 #define RF_REG_PREFIX           0x99
65 	struct {
66 		u8 __rsv[4];
67 		union {
68 			struct uni_cmd_access_reg_basic {
69 				__le16 tag;
70 				__le16 len;
71 				__le32 idx;
72 				__le32 data;
73 			} __packed reg;
74 			struct uni_cmd_access_rf_reg_basic {
75 				__le16 tag;
76 				__le16 len;
77 				__le16 ant;
78 				u8 __rsv[2];
79 				__le32 idx;
80 				__le32 data;
81 			} __packed rf_reg;
82 		};
83 	} __packed * res, req;
84 	struct sk_buff *skb;
85 	int ret;
86 
87 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX) {
88 		req.rf_reg.tag = cpu_to_le16(UNI_CMD_ACCESS_RF_REG_BASIC);
89 		req.rf_reg.len = cpu_to_le16(sizeof(req.rf_reg));
90 		req.rf_reg.ant = cpu_to_le16(u32_get_bits(regidx, MT_RF_REG_ANT));
91 		req.rf_reg.idx = cpu_to_le32(regidx);
92 		req.rf_reg.data = set ? cpu_to_le32(*val) : 0;
93 	} else {
94 		req.reg.tag = cpu_to_le16(UNI_CMD_ACCESS_REG_BASIC);
95 		req.reg.len = cpu_to_le16(sizeof(req.reg));
96 		req.reg.idx = cpu_to_le32(regidx);
97 		req.reg.data = set ? cpu_to_le32(*val) : 0;
98 	}
99 
100 	if (set)
101 		return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(REG_ACCESS),
102 					 &req, sizeof(req), true);
103 
104 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
105 					MCU_WM_UNI_CMD_QUERY(REG_ACCESS),
106 					&req, sizeof(req), true, &skb);
107 	if (ret)
108 		return ret;
109 
110 	res = (void *)skb->data;
111 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX)
112 		*val = le32_to_cpu(res->rf_reg.data);
113 	else
114 		*val = le32_to_cpu(res->reg.data);
115 
116 	dev_kfree_skb(skb);
117 
118 	return 0;
119 }
120 EXPORT_SYMBOL_GPL(mt7925_mcu_regval);
121 
122 int mt7925_mcu_update_arp_filter(struct mt76_dev *dev,
123 				 struct ieee80211_bss_conf *link_conf)
124 {
125 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
126 	struct ieee80211_vif *mvif = link_conf->vif;
127 	struct sk_buff *skb;
128 	int i, len = min_t(int, mvif->cfg.arp_addr_cnt,
129 			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
130 	struct {
131 		struct {
132 			u8 bss_idx;
133 			u8 pad[3];
134 		} __packed hdr;
135 		struct mt7925_arpns_tlv arp;
136 	} req = {
137 		.hdr = {
138 			.bss_idx = mconf->mt76.idx,
139 		},
140 		.arp = {
141 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
142 			.len = cpu_to_le16(sizeof(req) - 4 + len * 2 * sizeof(__be32)),
143 			.ips_num = len,
144 			.enable = true,
145 		},
146 	};
147 
148 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(req) + len * 2 * sizeof(__be32));
149 	if (!skb)
150 		return -ENOMEM;
151 
152 	skb_put_data(skb, &req, sizeof(req));
153 	for (i = 0; i < len; i++) {
154 		skb_put_data(skb, &mvif->cfg.arp_addr_list[i], sizeof(__be32));
155 		skb_put_zero(skb, sizeof(__be32));
156 	}
157 
158 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
159 }
160 
161 #ifdef CONFIG_PM
162 static int
163 mt7925_connac_mcu_set_wow_ctrl(struct mt76_phy *phy, struct ieee80211_vif *vif,
164 			       bool suspend, struct cfg80211_wowlan *wowlan)
165 {
166 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
167 	struct mt76_dev *dev = phy->dev;
168 	struct {
169 		struct {
170 			u8 bss_idx;
171 			u8 pad[3];
172 		} __packed hdr;
173 		struct mt76_connac_wow_ctrl_tlv wow_ctrl_tlv;
174 		struct mt76_connac_wow_gpio_param_tlv gpio_tlv;
175 	} req = {
176 		.hdr = {
177 			.bss_idx = mvif->idx,
178 		},
179 		.wow_ctrl_tlv = {
180 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
181 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_ctrl_tlv)),
182 			.cmd = suspend ? 1 : 2,
183 		},
184 		.gpio_tlv = {
185 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_GPIO_PARAM),
186 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_gpio_param_tlv)),
187 			.gpio_pin = 0xff, /* follow fw about GPIO pin */
188 		},
189 	};
190 
191 	if (wowlan->magic_pkt)
192 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_MAGIC;
193 	if (wowlan->disconnect)
194 		req.wow_ctrl_tlv.trigger |= (UNI_WOW_DETECT_TYPE_DISCONNECT |
195 					     UNI_WOW_DETECT_TYPE_BCN_LOST);
196 	if (wowlan->nd_config) {
197 		mt7925_mcu_sched_scan_req(phy, vif, wowlan->nd_config);
198 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_SCH_SCAN_HIT;
199 		mt7925_mcu_sched_scan_enable(phy, vif, suspend);
200 	}
201 	if (wowlan->n_patterns)
202 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_BITMAP;
203 
204 	if (mt76_is_mmio(dev))
205 		req.wow_ctrl_tlv.wakeup_hif = WOW_PCIE;
206 	else if (mt76_is_usb(dev))
207 		req.wow_ctrl_tlv.wakeup_hif = WOW_USB;
208 	else if (mt76_is_sdio(dev))
209 		req.wow_ctrl_tlv.wakeup_hif = WOW_GPIO;
210 
211 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(SUSPEND), &req,
212 				 sizeof(req), true);
213 }
214 
215 static int
216 mt7925_mcu_set_wow_pattern(struct mt76_dev *dev,
217 			   struct ieee80211_vif *vif,
218 			   u8 index, bool enable,
219 			   struct cfg80211_pkt_pattern *pattern)
220 {
221 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
222 	struct mt7925_wow_pattern_tlv *tlv;
223 	struct sk_buff *skb;
224 	struct {
225 		u8 bss_idx;
226 		u8 pad[3];
227 	} __packed hdr = {
228 		.bss_idx = mvif->idx,
229 	};
230 
231 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(hdr) + sizeof(*tlv));
232 	if (!skb)
233 		return -ENOMEM;
234 
235 	skb_put_data(skb, &hdr, sizeof(hdr));
236 	tlv = (struct mt7925_wow_pattern_tlv *)skb_put(skb, sizeof(*tlv));
237 	tlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
238 	tlv->len = cpu_to_le16(sizeof(*tlv));
239 	tlv->bss_idx = 0xF;
240 	tlv->data_len = pattern->pattern_len;
241 	tlv->enable = enable;
242 	tlv->index = index;
243 	tlv->offset = 0;
244 
245 	memcpy(tlv->pattern, pattern->pattern, pattern->pattern_len);
246 	memcpy(tlv->mask, pattern->mask, DIV_ROUND_UP(pattern->pattern_len, 8));
247 
248 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SUSPEND), true);
249 }
250 
251 void mt7925_mcu_set_suspend_iter(void *priv, u8 *mac,
252 				 struct ieee80211_vif *vif)
253 {
254 	struct mt76_phy *phy = priv;
255 	bool suspend = !test_bit(MT76_STATE_RUNNING, &phy->state);
256 	struct ieee80211_hw *hw = phy->hw;
257 	struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
258 	int i;
259 
260 	mt76_connac_mcu_set_gtk_rekey(phy->dev, vif, suspend);
261 
262 	mt76_connac_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
263 
264 	for (i = 0; i < wowlan->n_patterns; i++)
265 		mt7925_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
266 					   &wowlan->patterns[i]);
267 	mt7925_connac_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
268 }
269 
270 #endif /* CONFIG_PM */
271 
272 static void
273 mt7925_mcu_connection_loss_iter(void *priv, u8 *mac,
274 				struct ieee80211_vif *vif)
275 {
276 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
277 	struct mt7925_uni_beacon_loss_event *event = priv;
278 
279 	if (mvif->idx != event->hdr.bss_idx)
280 		return;
281 
282 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER) ||
283 	    vif->type != NL80211_IFTYPE_STATION)
284 		return;
285 
286 	ieee80211_connection_loss(vif);
287 }
288 
289 static void
290 mt7925_mcu_connection_loss_event(struct mt792x_dev *dev, struct sk_buff *skb)
291 {
292 	struct mt7925_uni_beacon_loss_event *event;
293 	struct mt76_phy *mphy = &dev->mt76.phy;
294 
295 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd));
296 	event = (struct mt7925_uni_beacon_loss_event *)skb->data;
297 
298 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
299 					IEEE80211_IFACE_ITER_RESUME_ALL,
300 					mt7925_mcu_connection_loss_iter, event);
301 }
302 
303 static void
304 mt7925_mcu_roc_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
305 {
306 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
307 	struct mt7925_roc_grant_tlv *grant = priv;
308 
309 	if (ieee80211_vif_is_mld(vif) && vif->type == NL80211_IFTYPE_STATION)
310 		return;
311 
312 	if (mvif->idx != grant->bss_idx)
313 		return;
314 
315 	mvif->band_idx = grant->dbdcband;
316 }
317 
318 static void mt7925_mcu_roc_handle_grant(struct mt792x_dev *dev,
319 					struct tlv *tlv)
320 {
321 	struct ieee80211_hw *hw = dev->mt76.hw;
322 	struct mt7925_roc_grant_tlv *grant;
323 	int duration;
324 
325 	grant = (struct mt7925_roc_grant_tlv *)tlv;
326 
327 	/* should never happen */
328 	WARN_ON_ONCE((le16_to_cpu(grant->tag) != UNI_EVENT_ROC_GRANT));
329 
330 	if (grant->reqtype == MT7925_ROC_REQ_ROC)
331 		ieee80211_ready_on_channel(hw);
332 	else if (grant->reqtype == MT7925_ROC_REQ_JOIN)
333 		ieee80211_iterate_active_interfaces_atomic(hw,
334 						IEEE80211_IFACE_ITER_RESUME_ALL,
335 						mt7925_mcu_roc_iter, grant);
336 	dev->phy.roc_grant = true;
337 	wake_up(&dev->phy.roc_wait);
338 	duration = le32_to_cpu(grant->max_interval);
339 	mod_timer(&dev->phy.roc_timer,
340 		  jiffies + msecs_to_jiffies(duration));
341 }
342 
343 static void
344 mt7925_mcu_handle_hif_ctrl_basic(struct mt792x_dev *dev, struct tlv *tlv)
345 {
346 	struct mt7925_mcu_hif_ctrl_basic_tlv *basic;
347 
348 	basic = (struct mt7925_mcu_hif_ctrl_basic_tlv *)tlv;
349 
350 	if (basic->hifsuspend) {
351 		if (basic->hif_tx_traffic_status == HIF_TRAFFIC_IDLE &&
352 		    basic->hif_rx_traffic_status == HIF_TRAFFIC_IDLE)
353 			/* success */
354 			dev->hif_idle = true;
355 		else
356 			/* busy */
357 			/* invalid */
358 			dev->hif_idle = false;
359 	} else {
360 		dev->hif_resumed = true;
361 	}
362 	wake_up(&dev->wait);
363 }
364 
365 static void
366 mt7925_mcu_uni_hif_ctrl_event(struct mt792x_dev *dev, struct sk_buff *skb)
367 {
368 	struct tlv *tlv;
369 	u32 tlv_len;
370 
371 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
372 	tlv = (struct tlv *)skb->data;
373 	tlv_len = skb->len;
374 
375 	while (tlv_len > 0 && le16_to_cpu(tlv->len) <= tlv_len) {
376 		switch (le16_to_cpu(tlv->tag)) {
377 		case UNI_EVENT_HIF_CTRL_BASIC:
378 			mt7925_mcu_handle_hif_ctrl_basic(dev, tlv);
379 			break;
380 		default:
381 			break;
382 		}
383 		tlv_len -= le16_to_cpu(tlv->len);
384 		tlv = (struct tlv *)((char *)(tlv) + le16_to_cpu(tlv->len));
385 	}
386 }
387 
388 static void
389 mt7925_mcu_uni_roc_event(struct mt792x_dev *dev, struct sk_buff *skb)
390 {
391 	struct tlv *tlv;
392 	int i = 0;
393 
394 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
395 
396 	while (i < skb->len) {
397 		tlv = (struct tlv *)(skb->data + i);
398 
399 		switch (le16_to_cpu(tlv->tag)) {
400 		case UNI_EVENT_ROC_GRANT:
401 			mt7925_mcu_roc_handle_grant(dev, tlv);
402 			break;
403 		case UNI_EVENT_ROC_GRANT_SUB_LINK:
404 			break;
405 		}
406 
407 		i += le16_to_cpu(tlv->len);
408 	}
409 }
410 
411 static void
412 mt7925_mcu_scan_event(struct mt792x_dev *dev, struct sk_buff *skb)
413 {
414 	struct mt76_phy *mphy = &dev->mt76.phy;
415 	struct mt792x_phy *phy = mphy->priv;
416 
417 	spin_lock_bh(&dev->mt76.lock);
418 	__skb_queue_tail(&phy->scan_event_list, skb);
419 	spin_unlock_bh(&dev->mt76.lock);
420 
421 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
422 				     MT792x_HW_SCAN_TIMEOUT);
423 }
424 
425 static void
426 mt7925_mcu_tx_done_event(struct mt792x_dev *dev, struct sk_buff *skb)
427 {
428 #define UNI_EVENT_TX_DONE_MSG 0
429 #define UNI_EVENT_TX_DONE_RAW 1
430 	struct mt7925_mcu_txs_event {
431 		u8 ver;
432 		u8 rsv[3];
433 		u8 data[];
434 	} __packed * txs;
435 	struct tlv *tlv;
436 	u32 tlv_len;
437 
438 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
439 	tlv = (struct tlv *)skb->data;
440 	tlv_len = skb->len;
441 
442 	while (tlv_len > 0 && le16_to_cpu(tlv->len) <= tlv_len) {
443 		switch (le16_to_cpu(tlv->tag)) {
444 		case UNI_EVENT_TX_DONE_RAW:
445 			txs = (struct mt7925_mcu_txs_event *)tlv->data;
446 			mt7925_mac_add_txs(dev, txs->data);
447 			break;
448 		default:
449 			break;
450 		}
451 		tlv_len -= le16_to_cpu(tlv->len);
452 		tlv = (struct tlv *)((char *)(tlv) + le16_to_cpu(tlv->len));
453 	}
454 }
455 
456 static void
457 mt7925_mcu_uni_debug_msg_event(struct mt792x_dev *dev, struct sk_buff *skb)
458 {
459 	struct mt7925_uni_debug_msg {
460 		__le16 tag;
461 		__le16 len;
462 		u8 fmt;
463 		u8 rsv[3];
464 		u8 id;
465 		u8 type:3;
466 		u8 nr_args:5;
467 		union {
468 			struct idxlog {
469 				__le16 rsv;
470 				__le32 ts;
471 				__le32 idx;
472 				u8 data[];
473 			} __packed idx;
474 			struct txtlog {
475 				u8 len;
476 				u8 rsv;
477 				__le32 ts;
478 				u8 data[];
479 			} __packed txt;
480 		};
481 	} __packed * hdr;
482 
483 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
484 	hdr = (struct mt7925_uni_debug_msg *)skb->data;
485 
486 	if (hdr->id == 0x28) {
487 		skb_pull(skb, offsetof(struct mt7925_uni_debug_msg, id));
488 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", skb->len, skb->data);
489 		return;
490 	} else if (hdr->id != 0xa8) {
491 		return;
492 	}
493 
494 	if (hdr->type == 0) { /* idx log */
495 		int i, ret, len = PAGE_SIZE - 1, nr_val;
496 		struct page *page = dev_alloc_pages(get_order(len));
497 		__le32 *val;
498 		char *buf, *cur;
499 
500 		if (!page)
501 			return;
502 
503 		buf = page_address(page);
504 		cur = buf;
505 
506 		nr_val = (le16_to_cpu(hdr->len) - sizeof(*hdr)) / 4;
507 		val = (__le32 *)hdr->idx.data;
508 		for (i = 0; i < nr_val && len > 0; i++) {
509 			ret = snprintf(cur, len, "0x%x,", le32_to_cpu(val[i]));
510 			if (ret <= 0)
511 				break;
512 
513 			cur += ret;
514 			len -= ret;
515 		}
516 		if (cur > buf)
517 			wiphy_info(mt76_hw(dev)->wiphy, "idx: 0x%X,%d,%s",
518 				   le32_to_cpu(hdr->idx.idx), nr_val, buf);
519 		put_page(page);
520 	} else if (hdr->type == 2) { /* str log */
521 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", hdr->txt.len, hdr->txt.data);
522 	}
523 }
524 
525 static void
526 mt7925_mcu_uni_rx_unsolicited_event(struct mt792x_dev *dev,
527 				    struct sk_buff *skb)
528 {
529 	struct mt7925_mcu_rxd *rxd;
530 
531 	rxd = (struct mt7925_mcu_rxd *)skb->data;
532 
533 	switch (rxd->eid) {
534 	case MCU_UNI_EVENT_HIF_CTRL:
535 		mt7925_mcu_uni_hif_ctrl_event(dev, skb);
536 		break;
537 	case MCU_UNI_EVENT_FW_LOG_2_HOST:
538 		mt7925_mcu_uni_debug_msg_event(dev, skb);
539 		break;
540 	case MCU_UNI_EVENT_ROC:
541 		mt7925_mcu_uni_roc_event(dev, skb);
542 		break;
543 	case MCU_UNI_EVENT_SCAN_DONE:
544 		mt7925_mcu_scan_event(dev, skb);
545 		return;
546 	case MCU_UNI_EVENT_TX_DONE:
547 		mt7925_mcu_tx_done_event(dev, skb);
548 		break;
549 	case MCU_UNI_EVENT_BSS_BEACON_LOSS:
550 		mt7925_mcu_connection_loss_event(dev, skb);
551 		break;
552 	case MCU_UNI_EVENT_COREDUMP:
553 		dev->fw_assert = true;
554 		mt76_connac_mcu_coredump_event(&dev->mt76, skb, &dev->coredump);
555 		return;
556 	default:
557 		break;
558 	}
559 	dev_kfree_skb(skb);
560 }
561 
562 void mt7925_mcu_rx_event(struct mt792x_dev *dev, struct sk_buff *skb)
563 {
564 	struct mt7925_mcu_rxd *rxd = (struct mt7925_mcu_rxd *)skb->data;
565 
566 	if (skb_linearize(skb))
567 		return;
568 
569 	if (rxd->option & MCU_UNI_CMD_UNSOLICITED_EVENT) {
570 		mt7925_mcu_uni_rx_unsolicited_event(dev, skb);
571 		return;
572 	}
573 
574 	mt76_mcu_rx_event(&dev->mt76, skb);
575 }
576 
577 static int
578 mt7925_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif_link *mvif,
579 		  struct mt76_wcid *wcid,
580 		  struct ieee80211_ampdu_params *params,
581 		  bool enable, bool tx)
582 {
583 	struct sta_rec_ba_uni *ba;
584 	struct sk_buff *skb;
585 	struct tlv *tlv;
586 	int len;
587 
588 	len = sizeof(struct sta_req_hdr) + sizeof(*ba);
589 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid,
590 					      len);
591 	if (IS_ERR(skb))
592 		return PTR_ERR(skb);
593 
594 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
595 
596 	ba = (struct sta_rec_ba_uni *)tlv;
597 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
598 	ba->winsize = cpu_to_le16(params->buf_size);
599 	ba->ssn = cpu_to_le16(params->ssn);
600 	ba->ba_en = enable << params->tid;
601 	ba->amsdu = params->amsdu;
602 	ba->tid = params->tid;
603 
604 	return mt76_mcu_skb_send_msg(dev, skb,
605 				     MCU_UNI_CMD(STA_REC_UPDATE), true);
606 }
607 
608 /** starec & wtbl **/
609 int mt7925_mcu_uni_tx_ba(struct mt792x_dev *dev,
610 			 struct ieee80211_vif *vif,
611 			 struct ieee80211_ampdu_params *params,
612 			 bool enable)
613 {
614 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
615 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
616 	struct mt792x_link_sta *mlink;
617 	struct mt792x_bss_conf *mconf;
618 	unsigned long usable_links = ieee80211_vif_usable_links(vif);
619 	struct mt76_wcid *wcid;
620 	u8 link_id, ret;
621 
622 	for_each_set_bit(link_id, &usable_links, IEEE80211_MLD_MAX_NUM_LINKS) {
623 		mconf = mt792x_vif_to_link(mvif, link_id);
624 		mlink = mt792x_sta_to_link(msta, link_id);
625 		wcid = &mlink->wcid;
626 
627 		if (enable && !params->amsdu)
628 			mlink->wcid.amsdu = false;
629 
630 		ret = mt7925_mcu_sta_ba(&dev->mt76, &mconf->mt76, wcid, params,
631 					enable, true);
632 		if (ret < 0)
633 			break;
634 	}
635 
636 	return ret;
637 }
638 
639 int mt7925_mcu_uni_rx_ba(struct mt792x_dev *dev,
640 			 struct ieee80211_vif *vif,
641 			 struct ieee80211_ampdu_params *params,
642 			 bool enable)
643 {
644 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
645 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
646 	struct mt792x_link_sta *mlink;
647 	struct mt792x_bss_conf *mconf;
648 	unsigned long usable_links = ieee80211_vif_usable_links(vif);
649 	struct mt76_wcid *wcid;
650 	u8 link_id, ret;
651 
652 	for_each_set_bit(link_id, &usable_links, IEEE80211_MLD_MAX_NUM_LINKS) {
653 		mconf = mt792x_vif_to_link(mvif, link_id);
654 		mlink = mt792x_sta_to_link(msta, link_id);
655 		wcid = &mlink->wcid;
656 
657 		ret = mt7925_mcu_sta_ba(&dev->mt76, &mconf->mt76, wcid, params,
658 					enable, false);
659 		if (ret < 0)
660 			break;
661 	}
662 
663 	return ret;
664 }
665 
666 static int mt7925_load_clc(struct mt792x_dev *dev, const char *fw_name)
667 {
668 	const struct mt76_connac2_fw_trailer *hdr;
669 	const struct mt76_connac2_fw_region *region;
670 	const struct mt7925_clc *clc;
671 	struct mt76_dev *mdev = &dev->mt76;
672 	struct mt792x_phy *phy = &dev->phy;
673 	const struct firmware *fw;
674 	int ret, i, len, offset = 0;
675 #if defined(__linux__)
676 	u8 *clc_base = NULL;
677 #elif defined(__FreeBSD__)
678 	const u8 *clc_base = NULL;
679 #endif
680 
681 	if (mt7925_disable_clc ||
682 	    mt76_is_usb(&dev->mt76))
683 		return 0;
684 
685 	ret = request_firmware(&fw, fw_name, mdev->dev);
686 	if (ret)
687 		return ret;
688 
689 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
690 		dev_err(mdev->dev, "Invalid firmware\n");
691 		ret = -EINVAL;
692 		goto out;
693 	}
694 
695 	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
696 	for (i = 0; i < hdr->n_region; i++) {
697 		region = (const void *)((const u8 *)hdr -
698 					(hdr->n_region - i) * sizeof(*region));
699 		len = le32_to_cpu(region->len);
700 
701 		/* check if we have valid buffer size */
702 		if (offset + len > fw->size) {
703 			dev_err(mdev->dev, "Invalid firmware region\n");
704 			ret = -EINVAL;
705 			goto out;
706 		}
707 
708 		if ((region->feature_set & FW_FEATURE_NON_DL) &&
709 		    region->type == FW_TYPE_CLC) {
710 #if defined(__linux__)
711 			clc_base = (u8 *)(fw->data + offset);
712 #elif defined(__FreeBSD__)
713 			clc_base = (const u8 *)(fw->data + offset);
714 #endif
715 			break;
716 		}
717 		offset += len;
718 	}
719 
720 	if (!clc_base)
721 		goto out;
722 
723 	for (offset = 0; offset < len; offset += le32_to_cpu(clc->len)) {
724 		clc = (const struct mt7925_clc *)(clc_base + offset);
725 
726 		if (clc->idx >= ARRAY_SIZE(phy->clc))
727 			break;
728 
729 		/* do not init buf again if chip reset triggered */
730 		if (phy->clc[clc->idx])
731 			continue;
732 
733 		phy->clc[clc->idx] = devm_kmemdup(mdev->dev, clc,
734 						  le32_to_cpu(clc->len),
735 						  GFP_KERNEL);
736 
737 		if (!phy->clc[clc->idx]) {
738 			ret = -ENOMEM;
739 			goto out;
740 		}
741 	}
742 
743 	ret = mt7925_mcu_set_clc(dev, "00", ENVIRON_INDOOR);
744 out:
745 	release_firmware(fw);
746 
747 	return ret;
748 }
749 
750 int mt7925_mcu_fw_log_2_host(struct mt792x_dev *dev, u8 ctrl)
751 {
752 	struct {
753 		u8 _rsv[4];
754 
755 		__le16 tag;
756 		__le16 len;
757 		u8 ctrl;
758 		u8 interval;
759 		u8 _rsv2[2];
760 	} __packed req = {
761 		.tag = cpu_to_le16(UNI_WSYS_CONFIG_FW_LOG_CTRL),
762 		.len = cpu_to_le16(sizeof(req) - 4),
763 		.ctrl = ctrl,
764 	};
765 	int ret;
766 
767 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(WSYS_CONFIG),
768 					&req, sizeof(req), false, NULL);
769 	return ret;
770 }
771 
772 int mt7925_mcu_get_temperature(struct mt792x_phy *phy)
773 {
774 	struct {
775 		u8 _rsv[4];
776 
777 		__le16 tag;
778 		__le16 len;
779 		u8 _rsv2[4];
780 	} __packed req = {
781 		.tag = cpu_to_le16(0x0),
782 		.len = cpu_to_le16(sizeof(req) - 4),
783 	};
784 	struct mt7925_thermal_evt {
785 		u8 rsv[4];
786 		__le32 temperature;
787 	} __packed * evt;
788 	struct mt792x_dev *dev = phy->dev;
789 	int temperature, ret;
790 	struct sk_buff *skb;
791 
792 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
793 					MCU_WM_UNI_CMD_QUERY(THERMAL),
794 					&req, sizeof(req), true, &skb);
795 	if (ret)
796 		return ret;
797 
798 	skb_pull(skb, 4 + sizeof(struct tlv));
799 	evt = (struct mt7925_thermal_evt *)skb->data;
800 
801 	temperature = le32_to_cpu(evt->temperature);
802 
803 	dev_kfree_skb(skb);
804 
805 	return temperature;
806 }
807 
808 static void
809 mt7925_mcu_parse_phy_cap(struct mt792x_dev *dev, char *data)
810 {
811 	struct mt76_phy *mphy = &dev->mt76.phy;
812 	struct mt76_dev *mdev = mphy->dev;
813 	struct mt7925_mcu_phy_cap {
814 		u8 ht;
815 		u8 vht;
816 		u8 _5g;
817 		u8 max_bw;
818 		u8 nss;
819 		u8 dbdc;
820 		u8 tx_ldpc;
821 		u8 rx_ldpc;
822 		u8 tx_stbc;
823 		u8 rx_stbc;
824 		u8 hw_path;
825 		u8 he;
826 		u8 eht;
827 	} __packed * cap;
828 	enum {
829 		WF0_24G,
830 		WF0_5G
831 	};
832 
833 	cap = (struct mt7925_mcu_phy_cap *)data;
834 
835 	mdev->phy.antenna_mask = BIT(cap->nss) - 1;
836 	mdev->phy.chainmask = mdev->phy.antenna_mask;
837 	mdev->phy.cap.has_2ghz = cap->hw_path & BIT(WF0_24G);
838 	mdev->phy.cap.has_5ghz = cap->hw_path & BIT(WF0_5G);
839 	dev->has_eht = cap->eht;
840 }
841 
842 static void
843 mt7925_mcu_parse_eml_cap(struct mt792x_dev *dev, char *data)
844 {
845 	struct mt7925_mcu_eml_cap {
846 		u8 rsv[4];
847 		__le16 eml_cap;
848 		u8 rsv2[6];
849 	} __packed * cap;
850 
851 	cap = (struct mt7925_mcu_eml_cap *)data;
852 
853 	dev->phy.eml_cap = le16_to_cpu(cap->eml_cap);
854 }
855 
856 static int
857 mt7925_mcu_get_nic_capability(struct mt792x_dev *dev)
858 {
859 	struct mt76_phy *mphy = &dev->mt76.phy;
860 	struct {
861 		u8 _rsv[4];
862 
863 		__le16 tag;
864 		__le16 len;
865 	} __packed req = {
866 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_NIC_CAPA),
867 		.len = cpu_to_le16(sizeof(req) - 4),
868 	};
869 	struct mt76_connac_cap_hdr {
870 		__le16 n_element;
871 		u8 rsv[2];
872 	} __packed * hdr;
873 	struct sk_buff *skb;
874 	int ret, i;
875 
876 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
877 					&req, sizeof(req), true, &skb);
878 	if (ret)
879 		return ret;
880 
881 	hdr = (struct mt76_connac_cap_hdr *)skb->data;
882 	if (skb->len < sizeof(*hdr)) {
883 		ret = -EINVAL;
884 		goto out;
885 	}
886 
887 	skb_pull(skb, sizeof(*hdr));
888 
889 	for (i = 0; i < le16_to_cpu(hdr->n_element); i++) {
890 		struct tlv *tlv = (struct tlv *)skb->data;
891 		int len;
892 
893 		if (skb->len < sizeof(*tlv))
894 			break;
895 
896 		len = le16_to_cpu(tlv->len);
897 		if (skb->len < len)
898 			break;
899 
900 		switch (le16_to_cpu(tlv->tag)) {
901 		case MT_NIC_CAP_6G:
902 			mphy->cap.has_6ghz = !!tlv->data[0];
903 			break;
904 		case MT_NIC_CAP_MAC_ADDR:
905 			memcpy(mphy->macaddr, (void *)tlv->data, ETH_ALEN);
906 			break;
907 		case MT_NIC_CAP_PHY:
908 			mt7925_mcu_parse_phy_cap(dev, tlv->data);
909 			break;
910 		case MT_NIC_CAP_CHIP_CAP:
911 			dev->phy.chip_cap = le64_to_cpu(*(__le64 *)tlv->data);
912 			break;
913 		case MT_NIC_CAP_EML_CAP:
914 			mt7925_mcu_parse_eml_cap(dev, tlv->data);
915 			break;
916 		default:
917 			break;
918 		}
919 		skb_pull(skb, len);
920 	}
921 out:
922 	dev_kfree_skb(skb);
923 	return ret;
924 }
925 
926 int mt7925_mcu_chip_config(struct mt792x_dev *dev, const char *cmd)
927 {
928 	u16 len = strlen(cmd) + 1;
929 	struct {
930 		u8 _rsv[4];
931 		__le16 tag;
932 		__le16 len;
933 		struct mt76_connac_config config;
934 	} __packed req = {
935 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_CHIP_CFG),
936 		.len = cpu_to_le16(sizeof(req) - 4),
937 		.config = {
938 			.resp_type = 0,
939 			.type = 0,
940 			.data_size = cpu_to_le16(len),
941 		},
942 	};
943 
944 	memcpy(req.config.data, cmd, len);
945 
946 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
947 				 &req, sizeof(req), false);
948 }
949 
950 int mt7925_mcu_set_deep_sleep(struct mt792x_dev *dev, bool enable)
951 {
952 	char cmd[16];
953 
954 	snprintf(cmd, sizeof(cmd), "KeepFullPwr %d", !enable);
955 
956 	return mt7925_mcu_chip_config(dev, cmd);
957 }
958 EXPORT_SYMBOL_GPL(mt7925_mcu_set_deep_sleep);
959 
960 int mt7925_run_firmware(struct mt792x_dev *dev)
961 {
962 	int err;
963 
964 	err = mt792x_load_firmware(dev);
965 	if (err)
966 		return err;
967 
968 	err = mt7925_mcu_get_nic_capability(dev);
969 	if (err)
970 		return err;
971 
972 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
973 	err = mt7925_load_clc(dev, mt792x_ram_name(dev));
974 	if (err)
975 		return err;
976 
977 	return mt7925_mcu_fw_log_2_host(dev, 1);
978 }
979 EXPORT_SYMBOL_GPL(mt7925_run_firmware);
980 
981 static void
982 mt7925_mcu_sta_hdr_trans_tlv(struct sk_buff *skb,
983 			     struct ieee80211_vif *vif,
984 			     struct ieee80211_link_sta *link_sta)
985 {
986 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
987 	struct sta_rec_hdr_trans *hdr_trans;
988 	struct mt76_wcid *wcid;
989 	struct tlv *tlv;
990 
991 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HDR_TRANS, sizeof(*hdr_trans));
992 	hdr_trans = (struct sta_rec_hdr_trans *)tlv;
993 	hdr_trans->dis_rx_hdr_tran = true;
994 
995 	if (vif->type == NL80211_IFTYPE_STATION)
996 		hdr_trans->to_ds = true;
997 	else
998 		hdr_trans->from_ds = true;
999 
1000 	if (link_sta) {
1001 		struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1002 		struct mt792x_link_sta *mlink;
1003 
1004 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1005 		wcid = &mlink->wcid;
1006 	} else {
1007 		wcid = &mvif->sta.deflink.wcid;
1008 	}
1009 
1010 	if (!wcid)
1011 		return;
1012 
1013 	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
1014 	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
1015 		hdr_trans->to_ds = true;
1016 		hdr_trans->from_ds = true;
1017 	}
1018 }
1019 
1020 int mt7925_mcu_wtbl_update_hdr_trans(struct mt792x_dev *dev,
1021 				     struct ieee80211_vif *vif,
1022 				     struct ieee80211_sta *sta,
1023 				     int link_id)
1024 {
1025 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1026 	struct ieee80211_link_sta *link_sta = sta ? &sta->deflink : NULL;
1027 	struct mt792x_link_sta *mlink;
1028 	struct mt792x_bss_conf *mconf;
1029 	struct mt792x_sta *msta;
1030 	struct sk_buff *skb;
1031 
1032 	msta = sta ? (struct mt792x_sta *)sta->drv_priv : &mvif->sta;
1033 
1034 	mlink = mt792x_sta_to_link(msta, link_id);
1035 	link_sta = mt792x_sta_to_link_sta(vif, sta, link_id);
1036 	mconf = mt792x_vif_to_link(mvif, link_id);
1037 
1038 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
1039 					      &mlink->wcid,
1040 					      MT7925_STA_UPDATE_MAX_SIZE);
1041 	if (IS_ERR(skb))
1042 		return PTR_ERR(skb);
1043 
1044 	/* starec hdr trans */
1045 	mt7925_mcu_sta_hdr_trans_tlv(skb, vif, link_sta);
1046 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1047 				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
1048 }
1049 
1050 int mt7925_mcu_set_tx(struct mt792x_dev *dev,
1051 		      struct ieee80211_bss_conf *bss_conf)
1052 {
1053 #define MCU_EDCA_AC_PARAM	0
1054 #define WMM_AIFS_SET		BIT(0)
1055 #define WMM_CW_MIN_SET		BIT(1)
1056 #define WMM_CW_MAX_SET		BIT(2)
1057 #define WMM_TXOP_SET		BIT(3)
1058 #define WMM_PARAM_SET		(WMM_AIFS_SET | WMM_CW_MIN_SET | \
1059 				 WMM_CW_MAX_SET | WMM_TXOP_SET)
1060 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(bss_conf);
1061 	struct {
1062 		u8 bss_idx;
1063 		u8 __rsv[3];
1064 	} __packed hdr = {
1065 		.bss_idx = mconf->mt76.idx,
1066 	};
1067 	struct sk_buff *skb;
1068 	int len = sizeof(hdr) + IEEE80211_NUM_ACS * sizeof(struct edca);
1069 	int ac;
1070 
1071 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
1072 	if (!skb)
1073 		return -ENOMEM;
1074 
1075 	skb_put_data(skb, &hdr, sizeof(hdr));
1076 
1077 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1078 		struct ieee80211_tx_queue_params *q = &mconf->queue_params[ac];
1079 		struct edca *e;
1080 		struct tlv *tlv;
1081 
1082 		tlv = mt76_connac_mcu_add_tlv(skb, MCU_EDCA_AC_PARAM, sizeof(*e));
1083 
1084 		e = (struct edca *)tlv;
1085 		e->set = WMM_PARAM_SET;
1086 		e->queue = ac;
1087 		e->aifs = q->aifs;
1088 		e->txop = cpu_to_le16(q->txop);
1089 
1090 		if (q->cw_min)
1091 			e->cw_min = fls(q->cw_min);
1092 		else
1093 			e->cw_min = 5;
1094 
1095 		if (q->cw_max)
1096 			e->cw_max = fls(q->cw_max);
1097 		else
1098 			e->cw_max = 10;
1099 	}
1100 
1101 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1102 				     MCU_UNI_CMD(EDCA_UPDATE), true);
1103 }
1104 
1105 static int
1106 mt7925_mcu_sta_key_tlv(struct mt76_wcid *wcid,
1107 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1108 		       struct sk_buff *skb,
1109 		       struct ieee80211_key_conf *key,
1110 		       enum set_key_cmd cmd,
1111 		       struct mt792x_sta *msta)
1112 {
1113 	struct mt792x_vif *mvif = msta->vif;
1114 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1115 	struct sta_rec_sec_uni *sec;
1116 	struct ieee80211_sta *sta;
1117 	struct ieee80211_vif *vif;
1118 	struct tlv *tlv;
1119 
1120 	sta = msta == &mvif->sta ?
1121 		      NULL :
1122 		      container_of((void *)msta, struct ieee80211_sta, drv_priv);
1123 	vif = container_of((void *)mvif, struct ieee80211_vif, drv_priv);
1124 
1125 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V3, sizeof(*sec));
1126 	sec = (struct sta_rec_sec_uni *)tlv;
1127 	sec->bss_idx = mconf->mt76.idx;
1128 	sec->is_authenticator = 0;
1129 	sec->mgmt_prot = 1; /* only used in MLO mode */
1130 	sec->wlan_idx = (u8)wcid->idx;
1131 
1132 	if (sta) {
1133 		struct ieee80211_link_sta *link_sta;
1134 
1135 		sec->tx_key = 1;
1136 		sec->key_type = 1;
1137 		link_sta = mt792x_sta_to_link_sta(vif, sta, wcid->link_id);
1138 
1139 		if (link_sta)
1140 			memcpy(sec->peer_addr, link_sta->addr, ETH_ALEN);
1141 	} else {
1142 		struct ieee80211_bss_conf *link_conf;
1143 
1144 		link_conf = mt792x_vif_to_bss_conf(vif, wcid->link_id);
1145 
1146 		if (link_conf)
1147 			memcpy(sec->peer_addr, link_conf->bssid, ETH_ALEN);
1148 	}
1149 
1150 	if (cmd == SET_KEY) {
1151 		u8 cipher;
1152 
1153 		sec->add = 1;
1154 		cipher = mt7925_mcu_get_cipher(key->cipher);
1155 		if (cipher == CONNAC3_CIPHER_NONE)
1156 			return -EOPNOTSUPP;
1157 
1158 		if (cipher == CONNAC3_CIPHER_BIP_CMAC_128) {
1159 			sec->cipher_id = CONNAC3_CIPHER_BIP_CMAC_128;
1160 			sec->key_id = sta_key_conf->keyidx;
1161 			sec->key_len = 32;
1162 			memcpy(sec->key, sta_key_conf->key, 16);
1163 			memcpy(sec->key + 16, key->key, 16);
1164 		} else {
1165 			sec->cipher_id = cipher;
1166 			sec->key_id = key->keyidx;
1167 			sec->key_len = key->keylen;
1168 			memcpy(sec->key, key->key, key->keylen);
1169 
1170 			if (cipher == CONNAC3_CIPHER_TKIP) {
1171 				/* Rx/Tx MIC keys are swapped */
1172 				memcpy(sec->key + 16, key->key + 24, 8);
1173 				memcpy(sec->key + 24, key->key + 16, 8);
1174 			}
1175 
1176 			/* store key_conf for BIP batch update */
1177 			if (cipher == CONNAC3_CIPHER_AES_CCMP) {
1178 				memcpy(sta_key_conf->key, key->key, key->keylen);
1179 				sta_key_conf->keyidx = key->keyidx;
1180 			}
1181 		}
1182 	} else {
1183 		sec->add = 0;
1184 	}
1185 
1186 	return 0;
1187 }
1188 
1189 int mt7925_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
1190 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1191 		       struct ieee80211_key_conf *key, int mcu_cmd,
1192 		       struct mt76_wcid *wcid, enum set_key_cmd cmd,
1193 		       struct mt792x_sta *msta)
1194 {
1195 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1196 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1197 	struct sk_buff *skb;
1198 	int ret;
1199 
1200 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, wcid,
1201 					      MT7925_STA_UPDATE_MAX_SIZE);
1202 	if (IS_ERR(skb))
1203 		return PTR_ERR(skb);
1204 
1205 	ret = mt7925_mcu_sta_key_tlv(wcid, sta_key_conf, skb, key, cmd, msta);
1206 	if (ret)
1207 		return ret;
1208 
1209 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
1210 }
1211 
1212 int mt7925_mcu_set_mlo_roc(struct mt792x_bss_conf *mconf, u16 sel_links,
1213 			   int duration, u8 token_id)
1214 {
1215 	struct mt792x_vif *mvif = mconf->vif;
1216 	struct ieee80211_vif *vif = container_of((void *)mvif,
1217 						 struct ieee80211_vif, drv_priv);
1218 	struct ieee80211_bss_conf *link_conf;
1219 	struct ieee80211_channel *chan;
1220 	const u8 ch_band[] = {
1221 		[NL80211_BAND_2GHZ] = 1,
1222 		[NL80211_BAND_5GHZ] = 2,
1223 		[NL80211_BAND_6GHZ] = 3,
1224 	};
1225 	enum mt7925_roc_req type;
1226 	int center_ch, i = 0;
1227 	bool is_AG_band = false;
1228 	struct {
1229 		u8 id;
1230 		u8 bss_idx;
1231 		u16 tag;
1232 		struct mt792x_bss_conf *mconf;
1233 		struct ieee80211_channel *chan;
1234 	} links[2];
1235 
1236 	struct {
1237 		struct {
1238 			u8 rsv[4];
1239 		} __packed hdr;
1240 		struct roc_acquire_tlv roc[2];
1241 	} __packed req = {
1242 			.roc[0].tag = cpu_to_le16(UNI_ROC_NUM),
1243 			.roc[0].len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1244 			.roc[1].tag = cpu_to_le16(UNI_ROC_NUM),
1245 			.roc[1].len = cpu_to_le16(sizeof(struct roc_acquire_tlv))
1246 	};
1247 
1248 	if (!mconf || hweight16(vif->valid_links) < 2 ||
1249 	    hweight16(sel_links) != 2)
1250 		return -EPERM;
1251 
1252 	for (i = 0; i < ARRAY_SIZE(links); i++) {
1253 		links[i].id = i ? __ffs(~BIT(mconf->link_id) & sel_links) :
1254 				 mconf->link_id;
1255 		link_conf = mt792x_vif_to_bss_conf(vif, links[i].id);
1256 		if (WARN_ON_ONCE(!link_conf))
1257 			return -EPERM;
1258 
1259 		links[i].chan = link_conf->chanreq.oper.chan;
1260 		if (WARN_ON_ONCE(!links[i].chan))
1261 			return -EPERM;
1262 
1263 		links[i].mconf = mt792x_vif_to_link(mvif, links[i].id);
1264 		links[i].tag = links[i].id == mconf->link_id ?
1265 			       UNI_ROC_ACQUIRE : UNI_ROC_SUB_LINK;
1266 
1267 		is_AG_band |= links[i].chan->band == NL80211_BAND_2GHZ;
1268 	}
1269 
1270 	if (vif->cfg.eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP)
1271 		type = is_AG_band ? MT7925_ROC_REQ_MLSR_AG :
1272 				    MT7925_ROC_REQ_MLSR_AA;
1273 	else
1274 		type = MT7925_ROC_REQ_JOIN;
1275 
1276 	for (i = 0; i < ARRAY_SIZE(links) && i < hweight16(vif->active_links); i++) {
1277 		if (WARN_ON_ONCE(!links[i].mconf || !links[i].chan))
1278 			continue;
1279 
1280 		chan = links[i].chan;
1281 		center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1282 		req.roc[i].len = cpu_to_le16(sizeof(struct roc_acquire_tlv));
1283 		req.roc[i].tag = cpu_to_le16(links[i].tag);
1284 		req.roc[i].tokenid = token_id;
1285 		req.roc[i].reqtype = type;
1286 		req.roc[i].maxinterval = cpu_to_le32(duration);
1287 		req.roc[i].bss_idx = links[i].mconf->mt76.idx;
1288 		req.roc[i].control_channel = chan->hw_value;
1289 		req.roc[i].bw = CMD_CBW_20MHZ;
1290 		req.roc[i].bw_from_ap = CMD_CBW_20MHZ;
1291 		req.roc[i].center_chan = center_ch;
1292 		req.roc[i].center_chan_from_ap = center_ch;
1293 		req.roc[i].center_chan2 = 0;
1294 		req.roc[i].center_chan2_from_ap = 0;
1295 
1296 		/* STR : 0xfe indicates BAND_ALL with enabling DBDC
1297 		 * EMLSR : 0xff indicates (BAND_AUTO) without DBDC
1298 		 */
1299 		req.roc[i].dbdcband = type == MT7925_ROC_REQ_JOIN ? 0xfe : 0xff;
1300 
1301 		if (chan->hw_value < center_ch)
1302 			req.roc[i].sco = 1; /* SCA */
1303 		else if (chan->hw_value > center_ch)
1304 			req.roc[i].sco = 3; /* SCB */
1305 
1306 		req.roc[i].band = ch_band[chan->band];
1307 	}
1308 
1309 	return mt76_mcu_send_msg(&mvif->phy->dev->mt76, MCU_UNI_CMD(ROC),
1310 				 &req, sizeof(req), true);
1311 }
1312 
1313 int mt7925_mcu_set_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1314 		       struct ieee80211_channel *chan, int duration,
1315 		       enum mt7925_roc_req type, u8 token_id)
1316 {
1317 	int center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1318 	struct mt792x_dev *dev = phy->dev;
1319 	struct {
1320 		struct {
1321 			u8 rsv[4];
1322 		} __packed hdr;
1323 		struct roc_acquire_tlv roc;
1324 	} __packed req = {
1325 		.roc = {
1326 			.tag = cpu_to_le16(UNI_ROC_ACQUIRE),
1327 			.len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1328 			.tokenid = token_id,
1329 			.reqtype = type,
1330 			.maxinterval = cpu_to_le32(duration),
1331 			.bss_idx = mconf->mt76.idx,
1332 			.control_channel = chan->hw_value,
1333 			.bw = CMD_CBW_20MHZ,
1334 			.bw_from_ap = CMD_CBW_20MHZ,
1335 			.center_chan = center_ch,
1336 			.center_chan_from_ap = center_ch,
1337 			.dbdcband = 0xff, /* auto */
1338 		},
1339 	};
1340 
1341 	if (chan->hw_value < center_ch)
1342 		req.roc.sco = 1; /* SCA */
1343 	else if (chan->hw_value > center_ch)
1344 		req.roc.sco = 3; /* SCB */
1345 
1346 	switch (chan->band) {
1347 	case NL80211_BAND_6GHZ:
1348 		req.roc.band = 3;
1349 		break;
1350 	case NL80211_BAND_5GHZ:
1351 		req.roc.band = 2;
1352 		break;
1353 	default:
1354 		req.roc.band = 1;
1355 		break;
1356 	}
1357 
1358 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1359 				 &req, sizeof(req), true);
1360 }
1361 
1362 int mt7925_mcu_abort_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1363 			 u8 token_id)
1364 {
1365 	struct mt792x_dev *dev = phy->dev;
1366 	struct {
1367 		struct {
1368 			u8 rsv[4];
1369 		} __packed hdr;
1370 		struct roc_abort_tlv {
1371 			__le16 tag;
1372 			__le16 len;
1373 			u8 bss_idx;
1374 			u8 tokenid;
1375 			u8 dbdcband;
1376 			u8 rsv[5];
1377 		} __packed abort;
1378 	} __packed req = {
1379 		.abort = {
1380 			.tag = cpu_to_le16(UNI_ROC_ABORT),
1381 			.len = cpu_to_le16(sizeof(struct roc_abort_tlv)),
1382 			.tokenid = token_id,
1383 			.bss_idx = mconf->mt76.idx,
1384 			.dbdcband = 0xff, /* auto*/
1385 		},
1386 	};
1387 
1388 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1389 				 &req, sizeof(req), true);
1390 }
1391 
1392 int mt7925_mcu_set_eeprom(struct mt792x_dev *dev)
1393 {
1394 	struct {
1395 		u8 _rsv[4];
1396 
1397 		__le16 tag;
1398 		__le16 len;
1399 		u8 buffer_mode;
1400 		u8 format;
1401 		__le16 buf_len;
1402 	} __packed req = {
1403 		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
1404 		.len = cpu_to_le16(sizeof(req) - 4),
1405 		.buffer_mode = EE_MODE_EFUSE,
1406 		.format = EE_FORMAT_WHOLE
1407 	};
1408 
1409 	return mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(EFUSE_CTRL),
1410 					 &req, sizeof(req), false, NULL);
1411 }
1412 EXPORT_SYMBOL_GPL(mt7925_mcu_set_eeprom);
1413 
1414 int mt7925_mcu_uni_bss_ps(struct mt792x_dev *dev,
1415 			  struct ieee80211_bss_conf *link_conf)
1416 {
1417 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1418 	struct {
1419 		struct {
1420 			u8 bss_idx;
1421 			u8 pad[3];
1422 		} __packed hdr;
1423 		struct ps_tlv {
1424 			__le16 tag;
1425 			__le16 len;
1426 			u8 ps_state; /* 0: device awake
1427 				      * 1: static power save
1428 				      * 2: dynamic power saving
1429 				      * 3: enter TWT power saving
1430 				      * 4: leave TWT power saving
1431 				      */
1432 			u8 pad[3];
1433 		} __packed ps;
1434 	} __packed ps_req = {
1435 		.hdr = {
1436 			.bss_idx = mconf->mt76.idx,
1437 		},
1438 		.ps = {
1439 			.tag = cpu_to_le16(UNI_BSS_INFO_PS),
1440 			.len = cpu_to_le16(sizeof(struct ps_tlv)),
1441 			.ps_state = link_conf->vif->cfg.ps ? 2 : 0,
1442 		},
1443 	};
1444 
1445 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1446 		return -EOPNOTSUPP;
1447 
1448 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1449 				 &ps_req, sizeof(ps_req), true);
1450 }
1451 
1452 int
1453 mt7925_mcu_uni_bss_bcnft(struct mt792x_dev *dev,
1454 			 struct ieee80211_bss_conf *link_conf, bool enable)
1455 {
1456 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1457 	struct {
1458 		struct {
1459 			u8 bss_idx;
1460 			u8 pad[3];
1461 		} __packed hdr;
1462 		struct bcnft_tlv {
1463 			__le16 tag;
1464 			__le16 len;
1465 			__le16 bcn_interval;
1466 			u8 dtim_period;
1467 			u8 bmc_delivered_ac;
1468 			u8 bmc_triggered_ac;
1469 			u8 pad[3];
1470 		} __packed bcnft;
1471 	} __packed bcnft_req = {
1472 		.hdr = {
1473 			.bss_idx = mconf->mt76.idx,
1474 		},
1475 		.bcnft = {
1476 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1477 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1478 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1479 			.dtim_period = link_conf->dtim_period,
1480 		},
1481 	};
1482 
1483 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1484 		return 0;
1485 
1486 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1487 				 &bcnft_req, sizeof(bcnft_req), true);
1488 }
1489 
1490 int
1491 mt7925_mcu_set_bss_pm(struct mt792x_dev *dev,
1492 		      struct ieee80211_bss_conf *link_conf,
1493 		      bool enable)
1494 {
1495 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1496 	struct {
1497 		struct {
1498 			u8 bss_idx;
1499 			u8 pad[3];
1500 		} __packed hdr;
1501 		struct bcnft_tlv {
1502 			__le16 tag;
1503 			__le16 len;
1504 			__le16 bcn_interval;
1505 			u8 dtim_period;
1506 			u8 bmc_delivered_ac;
1507 			u8 bmc_triggered_ac;
1508 			u8 pad[3];
1509 		} __packed enable;
1510 	} req = {
1511 		.hdr = {
1512 			.bss_idx = mconf->mt76.idx,
1513 		},
1514 		.enable = {
1515 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1516 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1517 			.dtim_period = link_conf->dtim_period,
1518 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1519 		},
1520 	};
1521 	struct {
1522 		struct {
1523 			u8 bss_idx;
1524 			u8 pad[3];
1525 		} __packed hdr;
1526 		struct pm_disable {
1527 			__le16 tag;
1528 			__le16 len;
1529 		} __packed disable;
1530 	} req1 = {
1531 		.hdr = {
1532 			.bss_idx = mconf->mt76.idx,
1533 		},
1534 		.disable = {
1535 			.tag = cpu_to_le16(UNI_BSS_INFO_PM_DISABLE),
1536 			.len = cpu_to_le16(sizeof(struct pm_disable))
1537 		},
1538 	};
1539 	int err;
1540 
1541 	err = mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1542 				&req1, sizeof(req1), true);
1543 	if (err < 0 || !enable)
1544 		return err;
1545 
1546 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1547 				 &req, sizeof(req), true);
1548 }
1549 
1550 static void
1551 mt7925_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1552 {
1553 	if (!link_sta->he_cap.has_he)
1554 		return;
1555 
1556 	mt76_connac_mcu_sta_he_tlv_v2(skb, link_sta->sta);
1557 }
1558 
1559 static void
1560 mt7925_mcu_sta_he_6g_tlv(struct sk_buff *skb,
1561 			 struct ieee80211_link_sta *link_sta)
1562 {
1563 	struct sta_rec_he_6g_capa *he_6g;
1564 	struct tlv *tlv;
1565 
1566 	if (!link_sta->he_6ghz_capa.capa)
1567 		return;
1568 
1569 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G, sizeof(*he_6g));
1570 
1571 	he_6g = (struct sta_rec_he_6g_capa *)tlv;
1572 	he_6g->capa = link_sta->he_6ghz_capa.capa;
1573 }
1574 
1575 static void
1576 mt7925_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1577 {
1578 	struct ieee80211_eht_mcs_nss_supp *mcs_map;
1579 	struct ieee80211_eht_cap_elem_fixed *elem;
1580 	struct sta_rec_eht *eht;
1581 	struct tlv *tlv;
1582 
1583 	if (!link_sta->eht_cap.has_eht)
1584 		return;
1585 
1586 	mcs_map = &link_sta->eht_cap.eht_mcs_nss_supp;
1587 	elem = &link_sta->eht_cap.eht_cap_elem;
1588 
1589 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT, sizeof(*eht));
1590 
1591 	eht = (struct sta_rec_eht *)tlv;
1592 	eht->tid_bitmap = 0xff;
1593 	eht->mac_cap = cpu_to_le16(*(u16 *)elem->mac_cap_info);
1594 	eht->phy_cap = cpu_to_le64(*(u64 *)elem->phy_cap_info);
1595 	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
1596 
1597 	if (link_sta->bandwidth == IEEE80211_STA_RX_BW_20)
1598 		memcpy(eht->mcs_map_bw20, &mcs_map->only_20mhz, sizeof(eht->mcs_map_bw20));
1599 	memcpy(eht->mcs_map_bw80, &mcs_map->bw._80, sizeof(eht->mcs_map_bw80));
1600 	memcpy(eht->mcs_map_bw160, &mcs_map->bw._160, sizeof(eht->mcs_map_bw160));
1601 }
1602 
1603 static void
1604 mt7925_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1605 {
1606 	struct sta_rec_ht *ht;
1607 	struct tlv *tlv;
1608 
1609 	if (!link_sta->ht_cap.ht_supported)
1610 		return;
1611 
1612 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1613 
1614 	ht = (struct sta_rec_ht *)tlv;
1615 	ht->ht_cap = cpu_to_le16(link_sta->ht_cap.cap);
1616 }
1617 
1618 static void
1619 mt7925_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1620 {
1621 	struct sta_rec_vht *vht;
1622 	struct tlv *tlv;
1623 
1624 	/* For 6G band, this tlv is necessary to let hw work normally */
1625 	if (!link_sta->he_6ghz_capa.capa && !link_sta->vht_cap.vht_supported)
1626 		return;
1627 
1628 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1629 
1630 	vht = (struct sta_rec_vht *)tlv;
1631 	vht->vht_cap = cpu_to_le32(link_sta->vht_cap.cap);
1632 	vht->vht_rx_mcs_map = link_sta->vht_cap.vht_mcs.rx_mcs_map;
1633 	vht->vht_tx_mcs_map = link_sta->vht_cap.vht_mcs.tx_mcs_map;
1634 }
1635 
1636 static void
1637 mt7925_mcu_sta_amsdu_tlv(struct sk_buff *skb,
1638 			 struct ieee80211_vif *vif,
1639 			 struct ieee80211_link_sta *link_sta)
1640 {
1641 	struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1642 	struct mt792x_link_sta *mlink;
1643 	struct sta_rec_amsdu *amsdu;
1644 	struct tlv *tlv;
1645 
1646 	if (vif->type != NL80211_IFTYPE_STATION &&
1647 	    vif->type != NL80211_IFTYPE_AP)
1648 		return;
1649 
1650 	if (!link_sta->agg.max_amsdu_len)
1651 		return;
1652 
1653 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1654 	amsdu = (struct sta_rec_amsdu *)tlv;
1655 	amsdu->max_amsdu_num = 8;
1656 	amsdu->amsdu_en = true;
1657 
1658 	mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1659 	mlink->wcid.amsdu = true;
1660 
1661 	switch (link_sta->agg.max_amsdu_len) {
1662 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1663 		amsdu->max_mpdu_size =
1664 			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1665 		return;
1666 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
1667 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1668 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1669 		return;
1670 	default:
1671 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1672 		return;
1673 	}
1674 }
1675 
1676 static void
1677 mt7925_mcu_sta_phy_tlv(struct sk_buff *skb,
1678 		       struct ieee80211_vif *vif,
1679 		       struct ieee80211_link_sta *link_sta)
1680 {
1681 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1682 	struct ieee80211_bss_conf *link_conf;
1683 	struct cfg80211_chan_def *chandef;
1684 	struct mt792x_bss_conf *mconf;
1685 	struct sta_rec_phy *phy;
1686 	struct tlv *tlv;
1687 	u8 af = 0, mm = 0;
1688 
1689 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1690 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1691 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1692 				    &link_conf->chanreq.oper;
1693 
1694 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PHY, sizeof(*phy));
1695 	phy = (struct sta_rec_phy *)tlv;
1696 	phy->phy_type = mt76_connac_get_phy_mode_v2(mvif->phy->mt76, vif,
1697 						    chandef->chan->band,
1698 						    link_sta);
1699 	phy->basic_rate = cpu_to_le16((u16)link_conf->basic_rates);
1700 	if (link_sta->ht_cap.ht_supported) {
1701 		af = link_sta->ht_cap.ampdu_factor;
1702 		mm = link_sta->ht_cap.ampdu_density;
1703 	}
1704 
1705 	if (link_sta->vht_cap.vht_supported) {
1706 		u8 vht_af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1707 				      link_sta->vht_cap.cap);
1708 
1709 		af = max_t(u8, af, vht_af);
1710 	}
1711 
1712 	if (link_sta->he_6ghz_capa.capa) {
1713 		af = le16_get_bits(link_sta->he_6ghz_capa.capa,
1714 				   IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1715 		mm = le16_get_bits(link_sta->he_6ghz_capa.capa,
1716 				   IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
1717 	}
1718 
1719 	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR, af) |
1720 		     FIELD_PREP(IEEE80211_HT_AMPDU_PARM_DENSITY, mm);
1721 	phy->max_ampdu_len = af;
1722 }
1723 
1724 static void
1725 mt7925_mcu_sta_state_v2_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
1726 			    struct ieee80211_link_sta *link_sta,
1727 			    struct ieee80211_vif *vif,
1728 			    u8 rcpi, u8 sta_state)
1729 {
1730 	struct sta_rec_state_v2 {
1731 		__le16 tag;
1732 		__le16 len;
1733 		u8 state;
1734 		u8 rsv[3];
1735 		__le32 flags;
1736 		u8 vht_opmode;
1737 		u8 action;
1738 		u8 rsv2[2];
1739 	} __packed * state;
1740 	struct tlv *tlv;
1741 
1742 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_STATE, sizeof(*state));
1743 	state = (struct sta_rec_state_v2 *)tlv;
1744 	state->state = sta_state;
1745 
1746 	if (link_sta->vht_cap.vht_supported) {
1747 		state->vht_opmode = link_sta->bandwidth;
1748 		state->vht_opmode |= link_sta->rx_nss <<
1749 			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
1750 	}
1751 }
1752 
1753 static void
1754 mt7925_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb,
1755 			     struct ieee80211_vif *vif,
1756 			     struct ieee80211_link_sta *link_sta)
1757 {
1758 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1759 	struct ieee80211_bss_conf *link_conf;
1760 	struct cfg80211_chan_def *chandef;
1761 	struct sta_rec_ra_info *ra_info;
1762 	struct mt792x_bss_conf *mconf;
1763 	enum nl80211_band band;
1764 	struct tlv *tlv;
1765 	u16 supp_rates;
1766 
1767 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1768 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1769 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1770 				    &link_conf->chanreq.oper;
1771 	band = chandef->chan->band;
1772 
1773 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra_info));
1774 	ra_info = (struct sta_rec_ra_info *)tlv;
1775 
1776 	supp_rates = link_sta->supp_rates[band];
1777 	if (band == NL80211_BAND_2GHZ)
1778 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
1779 			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
1780 	else
1781 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates);
1782 
1783 	ra_info->legacy = cpu_to_le16(supp_rates);
1784 
1785 	if (link_sta->ht_cap.ht_supported)
1786 		memcpy(ra_info->rx_mcs_bitmask,
1787 		       link_sta->ht_cap.mcs.rx_mask,
1788 		       HT_MCS_MASK_NUM);
1789 }
1790 
1791 static void
1792 mt7925_mcu_sta_eht_mld_tlv(struct sk_buff *skb,
1793 			   struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1794 {
1795 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1796 	struct wiphy *wiphy = mvif->phy->mt76->hw->wiphy;
1797 	const struct wiphy_iftype_ext_capab *ext_capa;
1798 	struct sta_rec_eht_mld *eht_mld;
1799 	struct tlv *tlv;
1800 	u16 eml_cap;
1801 
1802 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT_MLD, sizeof(*eht_mld));
1803 	eht_mld = (struct sta_rec_eht_mld *)tlv;
1804 	eht_mld->mld_type = 0xff;
1805 
1806 	if (!ieee80211_vif_is_mld(vif))
1807 		return;
1808 
1809 	ext_capa = cfg80211_get_iftype_ext_capa(wiphy,
1810 						ieee80211_vif_type_p2p(vif));
1811 	if (!ext_capa)
1812 		return;
1813 
1814 	eml_cap = (vif->cfg.eml_cap & (IEEE80211_EML_CAP_EMLSR_SUPP |
1815 				       IEEE80211_EML_CAP_TRANSITION_TIMEOUT)) |
1816 		  (ext_capa->eml_capabilities & (IEEE80211_EML_CAP_EMLSR_PADDING_DELAY |
1817 						IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY));
1818 
1819 	if (eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP) {
1820 		eht_mld->eml_cap[0] = u16_get_bits(eml_cap, GENMASK(7, 0));
1821 		eht_mld->eml_cap[1] = u16_get_bits(eml_cap, GENMASK(15, 8));
1822 	} else {
1823 		eht_mld->str_cap[0] = BIT(1);
1824 	}
1825 }
1826 
1827 static void
1828 mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,
1829 		       struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1830 {
1831 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1832 	struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv;
1833 	unsigned long valid = mvif->valid_links;
1834 	struct mt792x_bss_conf *mconf;
1835 	struct mt792x_link_sta *mlink;
1836 	struct sta_rec_mld *mld;
1837 	struct tlv *tlv;
1838 	int i, cnt = 0;
1839 
1840 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MLD, sizeof(*mld));
1841 	mld = (struct sta_rec_mld *)tlv;
1842 	memcpy(mld->mac_addr, sta->addr, ETH_ALEN);
1843 	mld->primary_id = cpu_to_le16(msta->deflink.wcid.idx);
1844 	mld->wlan_id = cpu_to_le16(msta->deflink.wcid.idx);
1845 	mld->link_num = min_t(u8, hweight16(mvif->valid_links), 2);
1846 
1847 	for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
1848 		if (cnt == mld->link_num)
1849 			break;
1850 
1851 		mconf = mt792x_vif_to_link(mvif, i);
1852 		mlink = mt792x_sta_to_link(msta, i);
1853 		mld->link[cnt].wlan_id = cpu_to_le16(mlink->wcid.idx);
1854 		mld->link[cnt++].bss_idx = mconf->mt76.idx;
1855 
1856 		if (mlink != &msta->deflink)
1857 			mld->secondary_id = cpu_to_le16(mlink->wcid.idx);
1858 	}
1859 }
1860 
1861 static int
1862 mt7925_mcu_sta_cmd(struct mt76_phy *phy,
1863 		   struct mt76_sta_cmd_info *info)
1864 {
1865 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)info->vif->drv_priv;
1866 	struct mt76_dev *dev = phy->dev;
1867 	struct sk_buff *skb;
1868 	int conn_state;
1869 
1870 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, info->wcid,
1871 					      MT7925_STA_UPDATE_MAX_SIZE);
1872 	if (IS_ERR(skb))
1873 		return PTR_ERR(skb);
1874 
1875 	conn_state = info->enable ? CONN_STATE_PORT_SECURE :
1876 				    CONN_STATE_DISCONNECT;
1877 	if (info->link_sta)
1878 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->link_conf,
1879 					      info->link_sta,
1880 					      conn_state, info->newly);
1881 	if (info->link_sta && info->enable) {
1882 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1883 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1884 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1885 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1886 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1887 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1888 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1889 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1890 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1891 					     info->link_sta);
1892 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1893 					    info->vif, info->rcpi,
1894 					    info->state);
1895 		mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1896 	}
1897 
1898 	if (info->enable)
1899 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
1900 
1901 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1902 }
1903 
1904 static void
1905 mt7925_mcu_sta_remove_tlv(struct sk_buff *skb)
1906 {
1907 	struct sta_rec_remove *rem;
1908 	struct tlv *tlv;
1909 
1910 	tlv = mt76_connac_mcu_add_tlv(skb, 0x25, sizeof(*rem));
1911 	rem = (struct sta_rec_remove *)tlv;
1912 	rem->action = 0;
1913 }
1914 
1915 static int
1916 mt7925_mcu_mlo_sta_cmd(struct mt76_phy *phy,
1917 		       struct mt76_sta_cmd_info *info)
1918 {
1919 	struct mt792x_vif *mvif = (struct mt792x_vif *)info->vif->drv_priv;
1920 	struct mt76_dev *dev = phy->dev;
1921 	struct mt792x_bss_conf *mconf;
1922 	struct sk_buff *skb;
1923 
1924 	mconf = mt792x_vif_to_link(mvif, info->wcid->link_id);
1925 
1926 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, info->wcid,
1927 					      MT7925_STA_UPDATE_MAX_SIZE);
1928 	if (IS_ERR(skb))
1929 		return PTR_ERR(skb);
1930 
1931 	if (info->enable)
1932 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->link_conf,
1933 					      info->link_sta,
1934 					      info->enable, info->newly);
1935 
1936 	if (info->enable && info->link_sta) {
1937 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1938 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1939 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1940 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1941 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1942 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1943 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1944 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1945 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1946 					     info->link_sta);
1947 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1948 					    info->vif, info->rcpi,
1949 					    info->state);
1950 
1951 		if (info->state != MT76_STA_INFO_STATE_NONE) {
1952 			mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1953 			mt7925_mcu_sta_eht_mld_tlv(skb, info->vif, info->link_sta->sta);
1954 		}
1955 
1956 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
1957 	}
1958 
1959 	if (!info->enable) {
1960 		mt7925_mcu_sta_remove_tlv(skb);
1961 		mt76_connac_mcu_add_tlv(skb, STA_REC_MLD_OFF,
1962 					sizeof(struct tlv));
1963 	}
1964 
1965 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1966 }
1967 
1968 int mt7925_mcu_sta_update(struct mt792x_dev *dev,
1969 			  struct ieee80211_link_sta *link_sta,
1970 			  struct ieee80211_vif *vif, bool enable,
1971 			  enum mt76_sta_info_state state)
1972 {
1973 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1974 	int rssi = -ewma_rssi_read(&mvif->bss_conf.rssi);
1975 	struct mt76_sta_cmd_info info = {
1976 		.link_sta = link_sta,
1977 		.vif = vif,
1978 		.link_conf = &vif->bss_conf,
1979 		.enable = enable,
1980 		.cmd = MCU_UNI_CMD(STA_REC_UPDATE),
1981 		.state = state,
1982 		.offload_fw = true,
1983 		.rcpi = to_rcpi(rssi),
1984 	};
1985 	struct mt792x_sta *msta;
1986 	struct mt792x_link_sta *mlink;
1987 	int err;
1988 
1989 	if (link_sta) {
1990 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1991 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1992 	}
1993 	info.wcid = link_sta ? &mlink->wcid : &mvif->sta.deflink.wcid;
1994 
1995 	if (link_sta)
1996 		info.newly = state != MT76_STA_INFO_STATE_ASSOC;
1997 	else
1998 		info.newly = state == MT76_STA_INFO_STATE_ASSOC ? false : true;
1999 
2000 	if (ieee80211_vif_is_mld(vif))
2001 		err = mt7925_mcu_mlo_sta_cmd(&dev->mphy, &info);
2002 	else
2003 		err = mt7925_mcu_sta_cmd(&dev->mphy, &info);
2004 
2005 	return err;
2006 }
2007 
2008 int mt7925_mcu_set_beacon_filter(struct mt792x_dev *dev,
2009 				 struct ieee80211_vif *vif,
2010 				 bool enable)
2011 {
2012 #define MT7925_FIF_BIT_CLR		BIT(1)
2013 #define MT7925_FIF_BIT_SET		BIT(0)
2014 	int err = 0;
2015 
2016 	if (enable) {
2017 		err = mt7925_mcu_uni_bss_bcnft(dev, &vif->bss_conf, true);
2018 		if (err < 0)
2019 			return err;
2020 
2021 		return mt7925_mcu_set_rxfilter(dev, 0,
2022 					       MT7925_FIF_BIT_SET,
2023 					       MT_WF_RFCR_DROP_OTHER_BEACON);
2024 	}
2025 
2026 	err = mt7925_mcu_set_bss_pm(dev, &vif->bss_conf, false);
2027 	if (err < 0)
2028 		return err;
2029 
2030 	return mt7925_mcu_set_rxfilter(dev, 0,
2031 				       MT7925_FIF_BIT_CLR,
2032 				       MT_WF_RFCR_DROP_OTHER_BEACON);
2033 }
2034 
2035 int mt7925_get_txpwr_info(struct mt792x_dev *dev, u8 band_idx, struct mt7925_txpwr *txpwr)
2036 {
2037 #define TX_POWER_SHOW_INFO 0x7
2038 #define TXPOWER_ALL_RATE_POWER_INFO 0x2
2039 	struct mt7925_txpwr_event *event;
2040 	struct mt7925_txpwr_req req = {
2041 		.tag = cpu_to_le16(TX_POWER_SHOW_INFO),
2042 		.len = cpu_to_le16(sizeof(req) - 4),
2043 		.catg = TXPOWER_ALL_RATE_POWER_INFO,
2044 		.band_idx = band_idx,
2045 	};
2046 	struct sk_buff *skb;
2047 	int ret;
2048 
2049 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(TXPOWER),
2050 					&req, sizeof(req), true, &skb);
2051 	if (ret)
2052 		return ret;
2053 
2054 	event = (struct mt7925_txpwr_event *)skb->data;
2055 	memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
2056 
2057 	dev_kfree_skb(skb);
2058 
2059 	return 0;
2060 }
2061 
2062 int mt7925_mcu_set_sniffer(struct mt792x_dev *dev, struct ieee80211_vif *vif,
2063 			   bool enable)
2064 {
2065 	struct {
2066 		struct {
2067 			u8 band_idx;
2068 			u8 pad[3];
2069 		} __packed hdr;
2070 		struct sniffer_enable_tlv {
2071 			__le16 tag;
2072 			__le16 len;
2073 			u8 enable;
2074 			u8 pad[3];
2075 		} __packed enable;
2076 	} __packed req = {
2077 		.hdr = {
2078 			.band_idx = 0,
2079 		},
2080 		.enable = {
2081 			.tag = cpu_to_le16(UNI_SNIFFER_ENABLE),
2082 			.len = cpu_to_le16(sizeof(struct sniffer_enable_tlv)),
2083 			.enable = enable,
2084 		},
2085 	};
2086 
2087 	mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req), true);
2088 
2089 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req),
2090 				 true);
2091 }
2092 
2093 int mt7925_mcu_config_sniffer(struct mt792x_vif *vif,
2094 			      struct ieee80211_chanctx_conf *ctx)
2095 {
2096 	struct mt76_phy *mphy = vif->phy->mt76;
2097 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def : &mphy->chandef;
2098 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2099 
2100 	static const u8 ch_band[] = {
2101 		[NL80211_BAND_2GHZ] = 1,
2102 		[NL80211_BAND_5GHZ] = 2,
2103 		[NL80211_BAND_6GHZ] = 3,
2104 	};
2105 	static const u8 ch_width[] = {
2106 		[NL80211_CHAN_WIDTH_20_NOHT] = 0,
2107 		[NL80211_CHAN_WIDTH_20] = 0,
2108 		[NL80211_CHAN_WIDTH_40] = 0,
2109 		[NL80211_CHAN_WIDTH_80] = 1,
2110 		[NL80211_CHAN_WIDTH_160] = 2,
2111 		[NL80211_CHAN_WIDTH_80P80] = 3,
2112 		[NL80211_CHAN_WIDTH_5] = 4,
2113 		[NL80211_CHAN_WIDTH_10] = 5,
2114 		[NL80211_CHAN_WIDTH_320] = 6,
2115 	};
2116 
2117 	struct {
2118 		struct {
2119 			u8 band_idx;
2120 			u8 pad[3];
2121 		} __packed hdr;
2122 		struct config_tlv {
2123 			__le16 tag;
2124 			__le16 len;
2125 			u16 aid;
2126 			u8 ch_band;
2127 			u8 bw;
2128 			u8 control_ch;
2129 			u8 sco;
2130 			u8 center_ch;
2131 			u8 center_ch2;
2132 			u8 drop_err;
2133 			u8 pad[3];
2134 		} __packed tlv;
2135 	} __packed req = {
2136 		.hdr = {
2137 			.band_idx = 0,
2138 		},
2139 		.tlv = {
2140 			.tag = cpu_to_le16(UNI_SNIFFER_CONFIG),
2141 			.len = cpu_to_le16(sizeof(req.tlv)),
2142 			.control_ch = chandef->chan->hw_value,
2143 			.center_ch = ieee80211_frequency_to_channel(freq1),
2144 			.drop_err = 1,
2145 		},
2146 	};
2147 
2148 	if (chandef->chan->band < ARRAY_SIZE(ch_band))
2149 		req.tlv.ch_band = ch_band[chandef->chan->band];
2150 	if (chandef->width < ARRAY_SIZE(ch_width))
2151 		req.tlv.bw = ch_width[chandef->width];
2152 
2153 	if (freq2)
2154 		req.tlv.center_ch2 = ieee80211_frequency_to_channel(freq2);
2155 
2156 	if (req.tlv.control_ch < req.tlv.center_ch)
2157 		req.tlv.sco = 1; /* SCA */
2158 	else if (req.tlv.control_ch > req.tlv.center_ch)
2159 		req.tlv.sco = 3; /* SCB */
2160 
2161 	return mt76_mcu_send_msg(mphy->dev, MCU_UNI_CMD(SNIFFER),
2162 				 &req, sizeof(req), true);
2163 }
2164 
2165 int
2166 mt7925_mcu_uni_add_beacon_offload(struct mt792x_dev *dev,
2167 				  struct ieee80211_hw *hw,
2168 				  struct ieee80211_vif *vif,
2169 				  bool enable)
2170 {
2171 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
2172 	struct ieee80211_mutable_offsets offs;
2173 	struct {
2174 		struct req_hdr {
2175 			u8 bss_idx;
2176 			u8 pad[3];
2177 		} __packed hdr;
2178 		struct bcn_content_tlv {
2179 			__le16 tag;
2180 			__le16 len;
2181 			__le16 tim_ie_pos;
2182 			__le16 csa_ie_pos;
2183 			__le16 bcc_ie_pos;
2184 			/* 0: disable beacon offload
2185 			 * 1: enable beacon offload
2186 			 * 2: update probe respond offload
2187 			 */
2188 			u8 enable;
2189 			/* 0: legacy format (TXD + payload)
2190 			 * 1: only cap field IE
2191 			 */
2192 			u8 type;
2193 			__le16 pkt_len;
2194 			u8 pkt[512];
2195 		} __packed beacon_tlv;
2196 	} req = {
2197 		.hdr = {
2198 			.bss_idx = mvif->bss_conf.mt76.idx,
2199 		},
2200 		.beacon_tlv = {
2201 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
2202 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
2203 			.enable = enable,
2204 			.type = 1,
2205 		},
2206 	};
2207 	struct sk_buff *skb;
2208 	u8 cap_offs;
2209 
2210 	/* support enable/update process only
2211 	 * disable flow would be handled in bss stop handler automatically
2212 	 */
2213 	if (!enable)
2214 		return -EOPNOTSUPP;
2215 
2216 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs, 0);
2217 	if (!skb)
2218 		return -EINVAL;
2219 
2220 	cap_offs = offsetof(struct ieee80211_mgmt, u.beacon.capab_info);
2221 	if (!skb_pull(skb, cap_offs)) {
2222 		dev_err(dev->mt76.dev, "beacon format err\n");
2223 		dev_kfree_skb(skb);
2224 		return -EINVAL;
2225 	}
2226 
2227 	if (skb->len > 512) {
2228 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
2229 		dev_kfree_skb(skb);
2230 		return -EINVAL;
2231 	}
2232 
2233 	memcpy(req.beacon_tlv.pkt, skb->data, skb->len);
2234 	req.beacon_tlv.pkt_len = cpu_to_le16(skb->len);
2235 	offs.tim_offset -= cap_offs;
2236 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(offs.tim_offset);
2237 
2238 	if (offs.cntdwn_counter_offs[0]) {
2239 		u16 csa_offs;
2240 
2241 		csa_offs = offs.cntdwn_counter_offs[0] - cap_offs - 4;
2242 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
2243 	}
2244 	dev_kfree_skb(skb);
2245 
2246 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
2247 				 &req, sizeof(req), true);
2248 }
2249 
2250 static
2251 void mt7925_mcu_bss_rlm_tlv(struct sk_buff *skb, struct mt76_phy *phy,
2252 			    struct ieee80211_bss_conf *link_conf,
2253 			    struct ieee80211_chanctx_conf *ctx)
2254 {
2255 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2256 						  &link_conf->chanreq.oper;
2257 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2258 	enum nl80211_band band = chandef->chan->band;
2259 	struct bss_rlm_tlv *req;
2260 	struct tlv *tlv;
2261 
2262 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RLM, sizeof(*req));
2263 	req = (struct bss_rlm_tlv *)tlv;
2264 	req->control_channel = chandef->chan->hw_value;
2265 	req->center_chan = ieee80211_frequency_to_channel(freq1);
2266 	req->center_chan2 = 0;
2267 	req->tx_streams = hweight8(phy->antenna_mask);
2268 	req->ht_op_info = 4; /* set HT 40M allowed */
2269 	req->rx_streams = hweight8(phy->antenna_mask);
2270 	req->center_chan2 = 0;
2271 	req->sco = 0;
2272 	req->band = 1;
2273 
2274 	switch (band) {
2275 	case NL80211_BAND_2GHZ:
2276 		req->band = 1;
2277 		break;
2278 	case NL80211_BAND_5GHZ:
2279 		req->band = 2;
2280 		break;
2281 	case NL80211_BAND_6GHZ:
2282 		req->band = 3;
2283 		break;
2284 	default:
2285 		break;
2286 	}
2287 
2288 	switch (chandef->width) {
2289 	case NL80211_CHAN_WIDTH_40:
2290 		req->bw = CMD_CBW_40MHZ;
2291 		break;
2292 	case NL80211_CHAN_WIDTH_80:
2293 		req->bw = CMD_CBW_80MHZ;
2294 		break;
2295 	case NL80211_CHAN_WIDTH_80P80:
2296 		req->bw = CMD_CBW_8080MHZ;
2297 		req->center_chan2 = ieee80211_frequency_to_channel(freq2);
2298 		break;
2299 	case NL80211_CHAN_WIDTH_160:
2300 		req->bw = CMD_CBW_160MHZ;
2301 		break;
2302 	case NL80211_CHAN_WIDTH_5:
2303 		req->bw = CMD_CBW_5MHZ;
2304 		break;
2305 	case NL80211_CHAN_WIDTH_10:
2306 		req->bw = CMD_CBW_10MHZ;
2307 		break;
2308 	case NL80211_CHAN_WIDTH_20_NOHT:
2309 	case NL80211_CHAN_WIDTH_20:
2310 	default:
2311 		req->bw = CMD_CBW_20MHZ;
2312 		req->ht_op_info = 0;
2313 		break;
2314 	}
2315 
2316 	if (req->control_channel < req->center_chan)
2317 		req->sco = 1; /* SCA */
2318 	else if (req->control_channel > req->center_chan)
2319 		req->sco = 3; /* SCB */
2320 }
2321 
2322 static struct sk_buff *
2323 __mt7925_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif_link *mvif, int len)
2324 {
2325 	struct bss_req_hdr hdr = {
2326 		.bss_idx = mvif->idx,
2327 	};
2328 	struct sk_buff *skb;
2329 
2330 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
2331 	if (!skb)
2332 		return ERR_PTR(-ENOMEM);
2333 
2334 	skb_put_data(skb, &hdr, sizeof(hdr));
2335 
2336 	return skb;
2337 }
2338 
2339 int mt7925_mcu_set_chctx(struct mt76_phy *phy, struct mt76_vif_link *mvif,
2340 			 struct ieee80211_bss_conf *link_conf,
2341 			 struct ieee80211_chanctx_conf *ctx)
2342 {
2343 	struct sk_buff *skb;
2344 
2345 	skb = __mt7925_mcu_alloc_bss_req(phy->dev, mvif,
2346 					 MT7925_BSS_UPDATE_MAX_SIZE);
2347 	if (IS_ERR(skb))
2348 		return PTR_ERR(skb);
2349 
2350 	mt7925_mcu_bss_rlm_tlv(skb, phy, link_conf, ctx);
2351 
2352 	return mt76_mcu_skb_send_msg(phy->dev, skb,
2353 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2354 }
2355 
2356 static u8
2357 mt7925_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
2358 			enum nl80211_band band,
2359 			struct ieee80211_link_sta *link_sta)
2360 {
2361 	struct ieee80211_he_6ghz_capa *he_6ghz_capa;
2362 	const struct ieee80211_sta_eht_cap *eht_cap;
2363 	__le16 capa = 0;
2364 	u8 mode = 0;
2365 
2366 	if (link_sta) {
2367 		he_6ghz_capa = &link_sta->he_6ghz_capa;
2368 		eht_cap = &link_sta->eht_cap;
2369 	} else {
2370 		struct ieee80211_supported_band *sband;
2371 
2372 		sband = phy->hw->wiphy->bands[band];
2373 		capa = ieee80211_get_he_6ghz_capa(sband, vif->type);
2374 		he_6ghz_capa = (struct ieee80211_he_6ghz_capa *)&capa;
2375 
2376 		eht_cap = ieee80211_get_eht_iftype_cap(sband, vif->type);
2377 	}
2378 
2379 	switch (band) {
2380 	case NL80211_BAND_2GHZ:
2381 		if (eht_cap && eht_cap->has_eht)
2382 			mode |= PHY_MODE_BE_24G;
2383 		break;
2384 	case NL80211_BAND_5GHZ:
2385 		if (eht_cap && eht_cap->has_eht)
2386 			mode |= PHY_MODE_BE_5G;
2387 		break;
2388 	case NL80211_BAND_6GHZ:
2389 		if (he_6ghz_capa && he_6ghz_capa->capa)
2390 			mode |= PHY_MODE_AX_6G;
2391 
2392 		if (eht_cap && eht_cap->has_eht)
2393 			mode |= PHY_MODE_BE_6G;
2394 		break;
2395 	default:
2396 		break;
2397 	}
2398 
2399 	return mode;
2400 }
2401 
2402 static void
2403 mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
2404 			 struct ieee80211_bss_conf *link_conf,
2405 			 struct ieee80211_link_sta *link_sta,
2406 			 struct ieee80211_chanctx_conf *ctx,
2407 			 struct mt76_phy *phy, u16 wlan_idx,
2408 			 bool enable)
2409 {
2410 	struct ieee80211_vif *vif = link_conf->vif;
2411 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2412 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2413 						  &link_conf->chanreq.oper;
2414 	enum nl80211_band band = chandef->chan->band;
2415 	struct mt76_connac_bss_basic_tlv *basic_req;
2416 	struct mt792x_link_sta *mlink;
2417 	struct tlv *tlv;
2418 	int conn_type;
2419 	u8 idx;
2420 
2421 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*basic_req));
2422 	basic_req = (struct mt76_connac_bss_basic_tlv *)tlv;
2423 
2424 	idx = mconf->mt76.omac_idx > EXT_BSSID_START ? HW_BSSID_0 :
2425 						      mconf->mt76.omac_idx;
2426 	basic_req->hw_bss_idx = idx;
2427 
2428 	basic_req->phymode_ext = mt7925_get_phy_mode_ext(phy, vif, band,
2429 							 link_sta);
2430 
2431 	if (band == NL80211_BAND_2GHZ)
2432 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_ERP_INDEX);
2433 	else
2434 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_OFDM_INDEX);
2435 
2436 	memcpy(basic_req->bssid, link_conf->bssid, ETH_ALEN);
2437 	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, link_sta);
2438 	basic_req->bcn_interval = cpu_to_le16(link_conf->beacon_int);
2439 	basic_req->dtim_period = link_conf->dtim_period;
2440 	basic_req->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
2441 	basic_req->link_idx = mconf->mt76.idx;
2442 
2443 	if (link_sta) {
2444 		struct mt792x_sta *msta;
2445 
2446 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
2447 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
2448 
2449 	} else {
2450 		mlink = &mconf->vif->sta.deflink;
2451 	}
2452 
2453 	basic_req->sta_idx = cpu_to_le16(mlink->wcid.idx);
2454 	basic_req->omac_idx = mconf->mt76.omac_idx;
2455 	basic_req->band_idx = mconf->mt76.band_idx;
2456 	basic_req->wmm_idx = mconf->mt76.wmm_idx;
2457 	basic_req->conn_state = !enable;
2458 
2459 	switch (vif->type) {
2460 	case NL80211_IFTYPE_MESH_POINT:
2461 	case NL80211_IFTYPE_AP:
2462 		if (vif->p2p)
2463 			conn_type = CONNECTION_P2P_GO;
2464 		else
2465 			conn_type = CONNECTION_INFRA_AP;
2466 		basic_req->conn_type = cpu_to_le32(conn_type);
2467 		basic_req->active = enable;
2468 		break;
2469 	case NL80211_IFTYPE_STATION:
2470 		if (vif->p2p)
2471 			conn_type = CONNECTION_P2P_GC;
2472 		else
2473 			conn_type = CONNECTION_INFRA_STA;
2474 		basic_req->conn_type = cpu_to_le32(conn_type);
2475 		basic_req->active = true;
2476 		break;
2477 	case NL80211_IFTYPE_ADHOC:
2478 		basic_req->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
2479 		basic_req->active = true;
2480 		break;
2481 	default:
2482 		WARN_ON(1);
2483 		break;
2484 	}
2485 }
2486 
2487 static void
2488 mt7925_mcu_bss_sec_tlv(struct sk_buff *skb,
2489 		       struct ieee80211_bss_conf *link_conf)
2490 {
2491 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2492 	struct mt76_vif_link *mvif = &mconf->mt76;
2493 	struct bss_sec_tlv {
2494 		__le16 tag;
2495 		__le16 len;
2496 		u8 mode;
2497 		u8 status;
2498 		u8 cipher;
2499 		u8 __rsv;
2500 	} __packed * sec;
2501 	struct tlv *tlv;
2502 
2503 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_SEC, sizeof(*sec));
2504 	sec = (struct bss_sec_tlv *)tlv;
2505 
2506 	switch (mvif->cipher) {
2507 	case CONNAC3_CIPHER_GCMP_256:
2508 	case CONNAC3_CIPHER_GCMP:
2509 		sec->mode = MODE_WPA3_SAE;
2510 		sec->status = 8;
2511 		break;
2512 	case CONNAC3_CIPHER_AES_CCMP:
2513 		sec->mode = MODE_WPA2_PSK;
2514 		sec->status = 6;
2515 		break;
2516 	case CONNAC3_CIPHER_TKIP:
2517 		sec->mode = MODE_WPA2_PSK;
2518 		sec->status = 4;
2519 		break;
2520 	case CONNAC3_CIPHER_WEP104:
2521 	case CONNAC3_CIPHER_WEP40:
2522 		sec->mode = MODE_SHARED;
2523 		sec->status = 0;
2524 		break;
2525 	default:
2526 		sec->mode = MODE_OPEN;
2527 		sec->status = 1;
2528 		break;
2529 	}
2530 
2531 	sec->cipher = mvif->cipher;
2532 }
2533 
2534 static void
2535 mt7925_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt792x_phy *phy,
2536 		       struct ieee80211_chanctx_conf *ctx,
2537 		       struct ieee80211_bss_conf *link_conf)
2538 {
2539 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2540 						  &link_conf->chanreq.oper;
2541 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2542 	enum nl80211_band band = chandef->chan->band;
2543 	struct mt76_vif_link *mvif = &mconf->mt76;
2544 	struct bss_rate_tlv *bmc;
2545 	struct tlv *tlv;
2546 	u8 idx = mvif->mcast_rates_idx ?
2547 		 mvif->mcast_rates_idx : mvif->basic_rates_idx;
2548 
2549 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RATE, sizeof(*bmc));
2550 
2551 	bmc = (struct bss_rate_tlv *)tlv;
2552 
2553 	if (band == NL80211_BAND_2GHZ)
2554 		bmc->basic_rate = cpu_to_le16(HR_DSSS_ERP_BASIC_RATE);
2555 	else
2556 		bmc->basic_rate = cpu_to_le16(OFDM_BASIC_RATE);
2557 
2558 	bmc->short_preamble = (band == NL80211_BAND_2GHZ);
2559 	bmc->bc_fixed_rate = idx;
2560 	bmc->mc_fixed_rate = idx;
2561 }
2562 
2563 static void
2564 mt7925_mcu_bss_mld_tlv(struct sk_buff *skb,
2565 		       struct ieee80211_bss_conf *link_conf)
2566 {
2567 	struct ieee80211_vif *vif = link_conf->vif;
2568 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2569 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2570 	struct bss_mld_tlv *mld;
2571 	struct tlv *tlv;
2572 	bool is_mld;
2573 
2574 	is_mld = ieee80211_vif_is_mld(link_conf->vif) ||
2575 		 (hweight16(mvif->valid_links) > 1);
2576 
2577 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_MLD, sizeof(*mld));
2578 	mld = (struct bss_mld_tlv *)tlv;
2579 
2580 	mld->link_id = is_mld ? link_conf->link_id : 0xff;
2581 	/* apply the index of the primary link */
2582 	mld->group_mld_id = is_mld ? mvif->bss_conf.mt76.idx : 0xff;
2583 	mld->own_mld_id = mconf->mt76.idx + 32;
2584 	mld->remap_idx = 0xff;
2585 	mld->eml_enable = !!(link_conf->vif->cfg.eml_cap &
2586 			     IEEE80211_EML_CAP_EMLSR_SUPP);
2587 
2588 	memcpy(mld->mac_addr, vif->addr, ETH_ALEN);
2589 }
2590 
2591 static void
2592 mt7925_mcu_bss_qos_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf)
2593 {
2594 	struct mt76_connac_bss_qos_tlv *qos;
2595 	struct tlv *tlv;
2596 
2597 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_QBSS, sizeof(*qos));
2598 	qos = (struct mt76_connac_bss_qos_tlv *)tlv;
2599 	qos->qos = link_conf->qos;
2600 }
2601 
2602 static void
2603 mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2604 		      struct mt792x_phy *phy)
2605 {
2606 #define DEFAULT_HE_PE_DURATION		4
2607 #define DEFAULT_HE_DURATION_RTS_THRES	1023
2608 	const struct ieee80211_sta_he_cap *cap;
2609 	struct bss_info_uni_he *he;
2610 	struct tlv *tlv;
2611 
2612 	cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
2613 
2614 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
2615 
2616 	he = (struct bss_info_uni_he *)tlv;
2617 	he->he_pe_duration = link_conf->htc_trig_based_pkt_ext;
2618 	if (!he->he_pe_duration)
2619 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
2620 
2621 	he->he_rts_thres = cpu_to_le16(link_conf->frame_time_rts_th);
2622 	if (!he->he_rts_thres)
2623 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
2624 
2625 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
2626 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
2627 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
2628 }
2629 
2630 static void
2631 mt7925_mcu_bss_color_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2632 			 bool enable)
2633 {
2634 	struct bss_info_uni_bss_color *color;
2635 	struct tlv *tlv;
2636 
2637 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BSS_COLOR, sizeof(*color));
2638 	color = (struct bss_info_uni_bss_color *)tlv;
2639 
2640 	color->enable = enable ?
2641 		link_conf->he_bss_color.enabled : 0;
2642 	color->bss_color = enable ?
2643 		link_conf->he_bss_color.color : 0;
2644 }
2645 
2646 static void
2647 mt7925_mcu_bss_ifs_tlv(struct sk_buff *skb,
2648 		       struct ieee80211_bss_conf *link_conf)
2649 {
2650 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2651 	struct mt792x_phy *phy = mvif->phy;
2652 	struct bss_ifs_time_tlv *ifs_time;
2653 	struct tlv *tlv;
2654 
2655 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_IFS_TIME, sizeof(*ifs_time));
2656 	ifs_time = (struct bss_ifs_time_tlv *)tlv;
2657 	ifs_time->slot_valid = true;
2658 	ifs_time->slot_time = cpu_to_le16(phy->slottime);
2659 }
2660 
2661 int mt7925_mcu_set_timing(struct mt792x_phy *phy,
2662 			  struct ieee80211_bss_conf *link_conf)
2663 {
2664 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2665 	struct mt792x_dev *dev = phy->dev;
2666 	struct sk_buff *skb;
2667 
2668 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2669 					 MT7925_BSS_UPDATE_MAX_SIZE);
2670 	if (IS_ERR(skb))
2671 		return PTR_ERR(skb);
2672 
2673 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2674 
2675 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2676 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2677 }
2678 
2679 int mt7925_mcu_add_bss_info(struct mt792x_phy *phy,
2680 			    struct ieee80211_chanctx_conf *ctx,
2681 			    struct ieee80211_bss_conf *link_conf,
2682 			    struct ieee80211_link_sta *link_sta,
2683 			    int enable)
2684 {
2685 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2686 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2687 	struct mt792x_dev *dev = phy->dev;
2688 	struct mt792x_link_sta *mlink_bc;
2689 	struct sk_buff *skb;
2690 
2691 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2692 					 MT7925_BSS_UPDATE_MAX_SIZE);
2693 	if (IS_ERR(skb))
2694 		return PTR_ERR(skb);
2695 
2696 	mlink_bc = mt792x_sta_to_link(&mvif->sta, mconf->link_id);
2697 
2698 	/* bss_basic must be first */
2699 	mt7925_mcu_bss_basic_tlv(skb, link_conf, link_sta, ctx, phy->mt76,
2700 				 mlink_bc->wcid.idx, enable);
2701 	mt7925_mcu_bss_sec_tlv(skb, link_conf);
2702 	mt7925_mcu_bss_bmc_tlv(skb, phy, ctx, link_conf);
2703 	mt7925_mcu_bss_qos_tlv(skb, link_conf);
2704 	mt7925_mcu_bss_mld_tlv(skb, link_conf);
2705 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2706 
2707 	if (link_conf->he_support) {
2708 		mt7925_mcu_bss_he_tlv(skb, link_conf, phy);
2709 		mt7925_mcu_bss_color_tlv(skb, link_conf, enable);
2710 	}
2711 
2712 	if (enable)
2713 		mt7925_mcu_bss_rlm_tlv(skb, phy->mt76, link_conf, ctx);
2714 
2715 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2716 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2717 }
2718 
2719 int mt7925_mcu_set_dbdc(struct mt76_phy *phy, bool enable)
2720 {
2721 	struct mt76_dev *mdev = phy->dev;
2722 
2723 	struct mbmc_conf_tlv *conf;
2724 	struct mbmc_set_req *hdr;
2725 	struct sk_buff *skb;
2726 	struct tlv *tlv;
2727 	int max_len, err;
2728 
2729 	max_len = sizeof(*hdr) + sizeof(*conf);
2730 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2731 	if (!skb)
2732 		return -ENOMEM;
2733 
2734 	hdr = (struct mbmc_set_req *)skb_put(skb, sizeof(*hdr));
2735 
2736 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_MBMC_SETTING, sizeof(*conf));
2737 	conf = (struct mbmc_conf_tlv *)tlv;
2738 
2739 	conf->mbmc_en = enable;
2740 	conf->band = 0; /* unused */
2741 
2742 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SET_DBDC_PARMS),
2743 				    false);
2744 
2745 	return err;
2746 }
2747 
2748 int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
2749 		       struct ieee80211_scan_request *scan_req)
2750 {
2751 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
2752 	struct cfg80211_scan_request *sreq = &scan_req->req;
2753 	int n_ssids = 0, err, i;
2754 	struct ieee80211_channel **scan_list = sreq->channels;
2755 	struct mt76_dev *mdev = phy->dev;
2756 	struct mt76_connac_mcu_scan_channel *chan;
2757 	struct sk_buff *skb;
2758 
2759 	struct scan_hdr_tlv *hdr;
2760 	struct scan_req_tlv *req;
2761 	struct scan_ssid_tlv *ssid;
2762 	struct scan_bssid_tlv *bssid;
2763 	struct scan_chan_info_tlv *chan_info;
2764 	struct scan_ie_tlv *ie;
2765 	struct scan_misc_tlv *misc;
2766 	struct tlv *tlv;
2767 	int max_len;
2768 
2769 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2770 				sizeof(*bssid) + sizeof(*chan_info) +
2771 				sizeof(*misc) + sizeof(*ie);
2772 
2773 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2774 	if (!skb)
2775 		return -ENOMEM;
2776 
2777 	set_bit(MT76_HW_SCANNING, &phy->state);
2778 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2779 
2780 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2781 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2782 	hdr->bss_idx = mvif->idx;
2783 
2784 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_REQ, sizeof(*req));
2785 	req = (struct scan_req_tlv *)tlv;
2786 	req->scan_type = sreq->n_ssids ? 1 : 0;
2787 	req->probe_req_num = sreq->n_ssids ? 2 : 0;
2788 
2789 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2790 	ssid = (struct scan_ssid_tlv *)tlv;
2791 	for (i = 0; i < sreq->n_ssids; i++) {
2792 		if (!sreq->ssids[i].ssid_len)
2793 			continue;
2794 
2795 		ssid->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
2796 		memcpy(ssid->ssids[i].ssid, sreq->ssids[i].ssid,
2797 		       sreq->ssids[i].ssid_len);
2798 		n_ssids++;
2799 	}
2800 	ssid->ssid_type = n_ssids ? BIT(2) : BIT(0);
2801 	ssid->ssids_num = n_ssids;
2802 
2803 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_BSSID, sizeof(*bssid));
2804 	bssid = (struct scan_bssid_tlv *)tlv;
2805 
2806 	memcpy(bssid->bssid, sreq->bssid, ETH_ALEN);
2807 
2808 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
2809 	chan_info = (struct scan_chan_info_tlv *)tlv;
2810 	chan_info->channels_num = min_t(u8, sreq->n_channels,
2811 					ARRAY_SIZE(chan_info->channels));
2812 	for (i = 0; i < chan_info->channels_num; i++) {
2813 		chan = &chan_info->channels[i];
2814 
2815 		switch (scan_list[i]->band) {
2816 		case NL80211_BAND_2GHZ:
2817 			chan->band = 1;
2818 			break;
2819 		case NL80211_BAND_6GHZ:
2820 			chan->band = 3;
2821 			break;
2822 		default:
2823 			chan->band = 2;
2824 			break;
2825 		}
2826 		chan->channel_num = scan_list[i]->hw_value;
2827 	}
2828 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
2829 
2830 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
2831 	ie = (struct scan_ie_tlv *)tlv;
2832 	if (sreq->ie_len > 0) {
2833 		memcpy(ie->ies, sreq->ie, sreq->ie_len);
2834 		ie->ies_len = cpu_to_le16(sreq->ie_len);
2835 	}
2836 
2837 	req->scan_func |= SCAN_FUNC_SPLIT_SCAN;
2838 
2839 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_MISC, sizeof(*misc));
2840 	misc = (struct scan_misc_tlv *)tlv;
2841 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
2842 		get_random_mask_addr(misc->random_mac, sreq->mac_addr,
2843 				     sreq->mac_addr_mask);
2844 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
2845 	}
2846 
2847 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2848 				    false);
2849 	if (err < 0)
2850 		clear_bit(MT76_HW_SCANNING, &phy->state);
2851 
2852 	return err;
2853 }
2854 EXPORT_SYMBOL_GPL(mt7925_mcu_hw_scan);
2855 
2856 int mt7925_mcu_sched_scan_req(struct mt76_phy *phy,
2857 			      struct ieee80211_vif *vif,
2858 			      struct cfg80211_sched_scan_request *sreq)
2859 {
2860 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
2861 	struct ieee80211_channel **scan_list = sreq->channels;
2862 	struct mt76_connac_mcu_scan_channel *chan;
2863 	struct mt76_dev *mdev = phy->dev;
2864 	struct cfg80211_match_set *cfg_match;
2865 	struct cfg80211_ssid *cfg_ssid;
2866 
2867 	struct scan_hdr_tlv *hdr;
2868 	struct scan_sched_req *req;
2869 	struct scan_ssid_tlv *ssid;
2870 	struct scan_chan_info_tlv *chan_info;
2871 	struct scan_ie_tlv *ie;
2872 	struct scan_sched_ssid_match_sets *match;
2873 	struct sk_buff *skb;
2874 	struct tlv *tlv;
2875 	int i, max_len;
2876 
2877 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2878 		  sizeof(*chan_info) + sizeof(*ie) +
2879 		  sizeof(*match);
2880 
2881 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2882 	if (!skb)
2883 		return -ENOMEM;
2884 
2885 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2886 
2887 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2888 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2889 	hdr->bss_idx = mvif->idx;
2890 
2891 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_REQ, sizeof(*req));
2892 	req = (struct scan_sched_req *)tlv;
2893 	req->version = 1;
2894 
2895 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
2896 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
2897 
2898 	req->intervals_num = sreq->n_scan_plans;
2899 	for (i = 0; i < req->intervals_num; i++)
2900 		req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
2901 
2902 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2903 	ssid = (struct scan_ssid_tlv *)tlv;
2904 
2905 	ssid->ssids_num = sreq->n_ssids;
2906 	ssid->ssid_type = BIT(2);
2907 	for (i = 0; i < ssid->ssids_num; i++) {
2908 		cfg_ssid = &sreq->ssids[i];
2909 		memcpy(ssid->ssids[i].ssid, cfg_ssid->ssid, cfg_ssid->ssid_len);
2910 		ssid->ssids[i].ssid_len = cpu_to_le32(cfg_ssid->ssid_len);
2911 	}
2912 
2913 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID_MATCH_SETS, sizeof(*match));
2914 	match = (struct scan_sched_ssid_match_sets *)tlv;
2915 	match->match_num = sreq->n_match_sets;
2916 	for (i = 0; i < match->match_num; i++) {
2917 		cfg_match = &sreq->match_sets[i];
2918 		memcpy(match->match[i].ssid, cfg_match->ssid.ssid,
2919 		       cfg_match->ssid.ssid_len);
2920 		match->match[i].rssi_th = cpu_to_le32(cfg_match->rssi_thold);
2921 		match->match[i].ssid_len = cfg_match->ssid.ssid_len;
2922 	}
2923 
2924 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
2925 	chan_info = (struct scan_chan_info_tlv *)tlv;
2926 	chan_info->channels_num = min_t(u8, sreq->n_channels,
2927 					ARRAY_SIZE(chan_info->channels));
2928 	for (i = 0; i < chan_info->channels_num; i++) {
2929 		chan = &chan_info->channels[i];
2930 
2931 		switch (scan_list[i]->band) {
2932 		case NL80211_BAND_2GHZ:
2933 			chan->band = 1;
2934 			break;
2935 		case NL80211_BAND_6GHZ:
2936 			chan->band = 3;
2937 			break;
2938 		default:
2939 			chan->band = 2;
2940 			break;
2941 		}
2942 		chan->channel_num = scan_list[i]->hw_value;
2943 	}
2944 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
2945 
2946 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
2947 	ie = (struct scan_ie_tlv *)tlv;
2948 	if (sreq->ie_len > 0) {
2949 		memcpy(ie->ies, sreq->ie, sreq->ie_len);
2950 		ie->ies_len = cpu_to_le16(sreq->ie_len);
2951 	}
2952 
2953 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2954 				     false);
2955 }
2956 EXPORT_SYMBOL_GPL(mt7925_mcu_sched_scan_req);
2957 
2958 int
2959 mt7925_mcu_sched_scan_enable(struct mt76_phy *phy,
2960 			     struct ieee80211_vif *vif,
2961 			     bool enable)
2962 {
2963 	struct mt76_dev *mdev = phy->dev;
2964 	struct scan_sched_enable *req;
2965 	struct scan_hdr_tlv *hdr;
2966 	struct sk_buff *skb;
2967 	struct tlv *tlv;
2968 	int max_len;
2969 
2970 	max_len = sizeof(*hdr) + sizeof(*req);
2971 
2972 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2973 	if (!skb)
2974 		return -ENOMEM;
2975 
2976 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2977 	hdr->seq_num = 0;
2978 	hdr->bss_idx = 0;
2979 
2980 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_ENABLE, sizeof(*req));
2981 	req = (struct scan_sched_enable *)tlv;
2982 	req->active = !enable;
2983 
2984 	if (enable)
2985 		set_bit(MT76_HW_SCHED_SCANNING, &phy->state);
2986 	else
2987 		clear_bit(MT76_HW_SCHED_SCANNING, &phy->state);
2988 
2989 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2990 				     false);
2991 }
2992 
2993 int mt7925_mcu_cancel_hw_scan(struct mt76_phy *phy,
2994 			      struct ieee80211_vif *vif)
2995 {
2996 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
2997 	struct {
2998 		struct scan_hdr {
2999 			u8 seq_num;
3000 			u8 bss_idx;
3001 			u8 pad[2];
3002 		} __packed hdr;
3003 		struct scan_cancel_tlv {
3004 			__le16 tag;
3005 			__le16 len;
3006 			u8 is_ext_channel;
3007 			u8 rsv[3];
3008 		} __packed cancel;
3009 	} req = {
3010 		.hdr = {
3011 			.seq_num = mvif->scan_seq_num,
3012 			.bss_idx = mvif->idx,
3013 		},
3014 		.cancel = {
3015 			.tag = cpu_to_le16(UNI_SCAN_CANCEL),
3016 			.len = cpu_to_le16(sizeof(struct scan_cancel_tlv)),
3017 		},
3018 	};
3019 
3020 	if (test_and_clear_bit(MT76_HW_SCANNING, &phy->state)) {
3021 		struct cfg80211_scan_info info = {
3022 			.aborted = true,
3023 		};
3024 
3025 		ieee80211_scan_completed(phy->hw, &info);
3026 	}
3027 
3028 	return mt76_mcu_send_msg(phy->dev, MCU_UNI_CMD(SCAN_REQ),
3029 				 &req, sizeof(req), false);
3030 }
3031 EXPORT_SYMBOL_GPL(mt7925_mcu_cancel_hw_scan);
3032 
3033 int mt7925_mcu_set_channel_domain(struct mt76_phy *phy)
3034 {
3035 	int len, i, n_max_channels, n_2ch = 0, n_5ch = 0, n_6ch = 0;
3036 	struct {
3037 		struct {
3038 			u8 alpha2[4]; /* regulatory_request.alpha2 */
3039 			u8 bw_2g; /* BW_20_40M		0
3040 				   * BW_20M		1
3041 				   * BW_20_40_80M	2
3042 				   * BW_20_40_80_160M	3
3043 				   * BW_20_40_80_8080M	4
3044 				   */
3045 			u8 bw_5g;
3046 			u8 bw_6g;
3047 			u8 pad;
3048 		} __packed hdr;
3049 		struct n_chan {
3050 			__le16 tag;
3051 			__le16 len;
3052 			u8 n_2ch;
3053 			u8 n_5ch;
3054 			u8 n_6ch;
3055 			u8 pad;
3056 		} __packed n_ch;
3057 	} req = {
3058 		.hdr = {
3059 			.bw_2g = 0,
3060 			.bw_5g = 3, /* BW_20_40_80_160M */
3061 			.bw_6g = 3,
3062 		},
3063 		.n_ch = {
3064 			.tag = cpu_to_le16(2),
3065 		},
3066 	};
3067 	struct mt76_connac_mcu_chan {
3068 		__le16 hw_value;
3069 		__le16 pad;
3070 		__le32 flags;
3071 	} __packed channel;
3072 	struct mt76_dev *dev = phy->dev;
3073 	struct ieee80211_channel *chan;
3074 	struct sk_buff *skb;
3075 
3076 	n_max_channels = phy->sband_2g.sband.n_channels +
3077 			 phy->sband_5g.sband.n_channels +
3078 			 phy->sband_6g.sband.n_channels;
3079 	len = sizeof(req) + n_max_channels * sizeof(channel);
3080 
3081 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
3082 	if (!skb)
3083 		return -ENOMEM;
3084 
3085 	skb_reserve(skb, sizeof(req));
3086 
3087 	for (i = 0; i < phy->sband_2g.sband.n_channels; i++) {
3088 		chan = &phy->sband_2g.sband.channels[i];
3089 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3090 			continue;
3091 
3092 		channel.hw_value = cpu_to_le16(chan->hw_value);
3093 		channel.flags = cpu_to_le32(chan->flags);
3094 		channel.pad = 0;
3095 
3096 		skb_put_data(skb, &channel, sizeof(channel));
3097 		n_2ch++;
3098 	}
3099 	for (i = 0; i < phy->sband_5g.sband.n_channels; i++) {
3100 		chan = &phy->sband_5g.sband.channels[i];
3101 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3102 			continue;
3103 
3104 		channel.hw_value = cpu_to_le16(chan->hw_value);
3105 		channel.flags = cpu_to_le32(chan->flags);
3106 		channel.pad = 0;
3107 
3108 		skb_put_data(skb, &channel, sizeof(channel));
3109 		n_5ch++;
3110 	}
3111 	for (i = 0; i < phy->sband_6g.sband.n_channels; i++) {
3112 		chan = &phy->sband_6g.sband.channels[i];
3113 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3114 			continue;
3115 
3116 		channel.hw_value = cpu_to_le16(chan->hw_value);
3117 		channel.flags = cpu_to_le32(chan->flags);
3118 		channel.pad = 0;
3119 
3120 		skb_put_data(skb, &channel, sizeof(channel));
3121 		n_6ch++;
3122 	}
3123 
3124 	BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(req.hdr.alpha2));
3125 	memcpy(req.hdr.alpha2, dev->alpha2, sizeof(dev->alpha2));
3126 	req.n_ch.n_2ch = n_2ch;
3127 	req.n_ch.n_5ch = n_5ch;
3128 	req.n_ch.n_6ch = n_6ch;
3129 	len = sizeof(struct n_chan) + (n_2ch + n_5ch + n_6ch) * sizeof(channel);
3130 	req.n_ch.len = cpu_to_le16(len);
3131 	memcpy(__skb_push(skb, sizeof(req)), &req, sizeof(req));
3132 
3133 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SET_DOMAIN_INFO),
3134 				     false);
3135 }
3136 EXPORT_SYMBOL_GPL(mt7925_mcu_set_channel_domain);
3137 
3138 static int
3139 __mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3140 		     enum environment_cap env_cap,
3141 		     struct mt7925_clc *clc, u8 idx)
3142 {
3143 	struct mt7925_clc_segment *seg;
3144 	struct sk_buff *skb;
3145 	struct {
3146 		u8 rsv[4];
3147 		__le16 tag;
3148 		__le16 len;
3149 
3150 		u8 ver;
3151 		u8 pad0;
3152 		__le16 size;
3153 		u8 idx;
3154 		u8 env;
3155 		u8 acpi_conf;
3156 		u8 pad1;
3157 		u8 alpha2[2];
3158 		u8 type[2];
3159 		u8 rsvd[64];
3160 	} __packed req = {
3161 		.tag = cpu_to_le16(0x3),
3162 		.len = cpu_to_le16(sizeof(req) - 4),
3163 
3164 		.idx = idx,
3165 		.env = env_cap,
3166 		.acpi_conf = mt792x_acpi_get_flags(&dev->phy),
3167 	};
3168 	int ret, valid_cnt = 0;
3169 	u8 i, *pos;
3170 
3171 	if (!clc)
3172 		return 0;
3173 
3174 	pos = clc->data + sizeof(*seg) * clc->nr_seg;
3175 	for (i = 0; i < clc->nr_country; i++) {
3176 		struct mt7925_clc_rule *rule = (struct mt7925_clc_rule *)pos;
3177 
3178 		pos += sizeof(*rule);
3179 		if (rule->alpha2[0] != alpha2[0] ||
3180 		    rule->alpha2[1] != alpha2[1])
3181 			continue;
3182 
3183 		seg = (struct mt7925_clc_segment *)clc->data
3184 			  + rule->seg_idx - 1;
3185 
3186 		memcpy(req.alpha2, rule->alpha2, 2);
3187 		memcpy(req.type, rule->type, 2);
3188 
3189 		req.size = cpu_to_le16(seg->len);
3190 		skb = __mt76_mcu_msg_alloc(&dev->mt76, &req,
3191 					   le16_to_cpu(req.size) + sizeof(req),
3192 					   sizeof(req), GFP_KERNEL);
3193 		if (!skb)
3194 			return -ENOMEM;
3195 		skb_put_data(skb, clc->data + seg->offset, seg->len);
3196 
3197 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3198 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3199 					    true);
3200 		if (ret < 0)
3201 			return ret;
3202 		valid_cnt++;
3203 	}
3204 
3205 	if (!valid_cnt)
3206 		return -ENOENT;
3207 
3208 	return 0;
3209 }
3210 
3211 int mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3212 		       enum environment_cap env_cap)
3213 {
3214 	struct mt792x_phy *phy = (struct mt792x_phy *)&dev->phy;
3215 	int i, ret;
3216 
3217 	/* submit all clc config */
3218 	for (i = 0; i < ARRAY_SIZE(phy->clc); i++) {
3219 		ret = __mt7925_mcu_set_clc(dev, alpha2, env_cap,
3220 					   phy->clc[i], i);
3221 
3222 		/* If no country found, set "00" as default */
3223 		if (ret == -ENOENT)
3224 			ret = __mt7925_mcu_set_clc(dev, "00",
3225 						   ENVIRON_INDOOR,
3226 						   phy->clc[i], i);
3227 		if (ret < 0)
3228 			return ret;
3229 	}
3230 	return 0;
3231 }
3232 
3233 int mt7925_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb,
3234 			    int cmd, int *wait_seq)
3235 {
3236 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
3237 	struct mt76_connac2_mcu_uni_txd *uni_txd;
3238 	struct mt76_connac2_mcu_txd *mcu_txd;
3239 	__le32 *txd;
3240 	u32 val;
3241 	u8 seq;
3242 
3243 	/* TODO: make dynamic based on msg type */
3244 	mdev->mcu.timeout = 20 * HZ;
3245 
3246 	seq = ++mdev->mcu.msg_seq & 0xf;
3247 	if (!seq)
3248 		seq = ++mdev->mcu.msg_seq & 0xf;
3249 
3250 	if (cmd == MCU_CMD(FW_SCATTER))
3251 		goto exit;
3252 
3253 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
3254 	txd = (__le32 *)skb_push(skb, txd_len);
3255 
3256 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
3257 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
3258 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
3259 	txd[0] = cpu_to_le32(val);
3260 
3261 	val = FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
3262 	txd[1] = cpu_to_le32(val);
3263 
3264 	if (cmd & __MCU_CMD_FIELD_UNI) {
3265 		uni_txd = (struct mt76_connac2_mcu_uni_txd *)txd;
3266 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
3267 		uni_txd->cid = cpu_to_le16(mcu_cmd);
3268 		uni_txd->s2d_index = MCU_S2D_H2N;
3269 		uni_txd->pkt_type = MCU_PKT_ID;
3270 		uni_txd->seq = seq;
3271 
3272 		if (cmd & __MCU_CMD_FIELD_QUERY)
3273 			uni_txd->option = MCU_CMD_UNI_QUERY_ACK;
3274 		else
3275 			uni_txd->option = MCU_CMD_UNI_EXT_ACK;
3276 
3277 		goto exit;
3278 	}
3279 
3280 	mcu_txd = (struct mt76_connac2_mcu_txd *)txd;
3281 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
3282 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
3283 					       MT_TX_MCU_PORT_RX_Q0));
3284 	mcu_txd->pkt_type = MCU_PKT_ID;
3285 	mcu_txd->seq = seq;
3286 	mcu_txd->cid = mcu_cmd;
3287 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
3288 
3289 	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
3290 		if (cmd & __MCU_CMD_FIELD_QUERY)
3291 			mcu_txd->set_query = MCU_Q_QUERY;
3292 		else
3293 			mcu_txd->set_query = MCU_Q_SET;
3294 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
3295 	} else {
3296 		mcu_txd->set_query = MCU_Q_NA;
3297 	}
3298 
3299 	if (cmd & __MCU_CMD_FIELD_WA)
3300 		mcu_txd->s2d_index = MCU_S2D_H2C;
3301 	else
3302 		mcu_txd->s2d_index = MCU_S2D_H2N;
3303 
3304 exit:
3305 	if (wait_seq)
3306 		*wait_seq = seq;
3307 
3308 	return 0;
3309 }
3310 EXPORT_SYMBOL_GPL(mt7925_mcu_fill_message);
3311 
3312 int mt7925_mcu_set_rts_thresh(struct mt792x_phy *phy, u32 val)
3313 {
3314 	struct {
3315 		u8 band_idx;
3316 		u8 _rsv[3];
3317 
3318 		__le16 tag;
3319 		__le16 len;
3320 		__le32 len_thresh;
3321 		__le32 pkt_thresh;
3322 	} __packed req = {
3323 		.band_idx = phy->mt76->band_idx,
3324 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RTS_THRESHOLD),
3325 		.len = cpu_to_le16(sizeof(req) - 4),
3326 		.len_thresh = cpu_to_le32(val),
3327 		.pkt_thresh = cpu_to_le32(0x2),
3328 	};
3329 
3330 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3331 				 &req, sizeof(req), true);
3332 }
3333 
3334 int mt7925_mcu_set_radio_en(struct mt792x_phy *phy, bool enable)
3335 {
3336 	struct {
3337 		u8 band_idx;
3338 		u8 _rsv[3];
3339 
3340 		__le16 tag;
3341 		__le16 len;
3342 		u8 enable;
3343 		u8 _rsv2[3];
3344 	} __packed req = {
3345 		.band_idx = phy->mt76->band_idx,
3346 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RADIO_ENABLE),
3347 		.len = cpu_to_le16(sizeof(req) - 4),
3348 		.enable = enable,
3349 	};
3350 
3351 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3352 				 &req, sizeof(req), true);
3353 }
3354 
3355 static void
3356 mt7925_mcu_build_sku(struct mt76_dev *dev, s8 *sku,
3357 		     struct mt76_power_limits *limits,
3358 		     enum nl80211_band band)
3359 {
3360 	int i, offset = sizeof(limits->cck);
3361 
3362 	memset(sku, 127, MT_CONNAC3_SKU_POWER_LIMIT);
3363 
3364 	if (band == NL80211_BAND_2GHZ) {
3365 		/* cck */
3366 		memcpy(sku, limits->cck, sizeof(limits->cck));
3367 	}
3368 
3369 	/* ofdm */
3370 	memcpy(&sku[offset], limits->ofdm, sizeof(limits->ofdm));
3371 	offset += (sizeof(limits->ofdm) * 5);
3372 
3373 	/* ht */
3374 	for (i = 0; i < 2; i++) {
3375 		memcpy(&sku[offset], limits->mcs[i], 8);
3376 		offset += 8;
3377 	}
3378 	sku[offset++] = limits->mcs[0][0];
3379 
3380 	/* vht */
3381 	for (i = 0; i < ARRAY_SIZE(limits->mcs); i++) {
3382 		memcpy(&sku[offset], limits->mcs[i],
3383 		       ARRAY_SIZE(limits->mcs[i]));
3384 		offset += 12;
3385 	}
3386 
3387 	/* he */
3388 	for (i = 0; i < ARRAY_SIZE(limits->ru); i++) {
3389 		memcpy(&sku[offset], limits->ru[i], ARRAY_SIZE(limits->ru[i]));
3390 		offset += ARRAY_SIZE(limits->ru[i]);
3391 	}
3392 
3393 	/* eht */
3394 	for (i = 0; i < ARRAY_SIZE(limits->eht); i++) {
3395 		memcpy(&sku[offset], limits->eht[i], ARRAY_SIZE(limits->eht[i]));
3396 		offset += ARRAY_SIZE(limits->eht[i]);
3397 	}
3398 }
3399 
3400 static int
3401 mt7925_mcu_rate_txpower_band(struct mt76_phy *phy,
3402 			     enum nl80211_band band)
3403 {
3404 	int tx_power, n_chan, last_ch, err = 0, idx = 0;
3405 	int i, sku_len, batch_size, batch_len = 3;
3406 	struct mt76_dev *dev = phy->dev;
3407 	static const u8 chan_list_2ghz[] = {
3408 		1, 2,  3,  4,  5,  6,  7,
3409 		8, 9, 10, 11, 12, 13, 14
3410 	};
3411 	static const u8 chan_list_5ghz[] = {
3412 		 36,  38,  40,  42,  44,  46,  48,
3413 		 50,  52,  54,  56,  58,  60,  62,
3414 		 64, 100, 102, 104, 106, 108, 110,
3415 		112, 114, 116, 118, 120, 122, 124,
3416 		126, 128, 132, 134, 136, 138, 140,
3417 		142, 144, 149, 151, 153, 155, 157,
3418 		159, 161, 165, 167
3419 	};
3420 	static const u8 chan_list_6ghz[] = {
3421 		  1,   3,   5,   7,   9,  11,  13,
3422 		 15,  17,  19,  21,  23,  25,  27,
3423 		 29,  33,  35,  37,  39,  41,  43,
3424 		 45,  47,  49,  51,  53,  55,  57,
3425 		 59,  61,  65,  67,  69,  71,  73,
3426 		 75,  77,  79,  81,  83,  85,  87,
3427 		 89,  91,  93,  97,  99, 101, 103,
3428 		105, 107, 109, 111, 113, 115, 117,
3429 		119, 121, 123, 125, 129, 131, 133,
3430 		135, 137, 139, 141, 143, 145, 147,
3431 		149, 151, 153, 155, 157, 161, 163,
3432 		165, 167, 169, 171, 173, 175, 177,
3433 		179, 181, 183, 185, 187, 189, 193,
3434 		195, 197, 199, 201, 203, 205, 207,
3435 		209, 211, 213, 215, 217, 219, 221,
3436 		225, 227, 229, 233
3437 	};
3438 	struct mt76_power_limits *limits;
3439 	struct mt7925_sku_tlv *sku_tlbv;
3440 	const u8 *ch_list;
3441 
3442 	sku_len = sizeof(*sku_tlbv);
3443 	tx_power = 2 * phy->hw->conf.power_level;
3444 	if (!tx_power)
3445 		tx_power = 127;
3446 
3447 	if (band == NL80211_BAND_2GHZ) {
3448 		n_chan = ARRAY_SIZE(chan_list_2ghz);
3449 		ch_list = chan_list_2ghz;
3450 		last_ch = chan_list_2ghz[ARRAY_SIZE(chan_list_2ghz) - 1];
3451 	} else if (band == NL80211_BAND_6GHZ) {
3452 		n_chan = ARRAY_SIZE(chan_list_6ghz);
3453 		ch_list = chan_list_6ghz;
3454 		last_ch = chan_list_6ghz[ARRAY_SIZE(chan_list_6ghz) - 1];
3455 	} else {
3456 		n_chan = ARRAY_SIZE(chan_list_5ghz);
3457 		ch_list = chan_list_5ghz;
3458 		last_ch = chan_list_5ghz[ARRAY_SIZE(chan_list_5ghz) - 1];
3459 	}
3460 	batch_size = DIV_ROUND_UP(n_chan, batch_len);
3461 
3462 	limits = devm_kmalloc(dev->dev, sizeof(*limits), GFP_KERNEL);
3463 	if (!limits)
3464 		return -ENOMEM;
3465 
3466 	sku_tlbv = devm_kmalloc(dev->dev, sku_len, GFP_KERNEL);
3467 	if (!sku_tlbv) {
3468 		devm_kfree(dev->dev, limits);
3469 		return -ENOMEM;
3470 	}
3471 
3472 	for (i = 0; i < batch_size; i++) {
3473 		struct mt7925_tx_power_limit_tlv *tx_power_tlv;
3474 		int j, msg_len, num_ch;
3475 		struct sk_buff *skb;
3476 
3477 		num_ch = i == batch_size - 1 ? n_chan % batch_len : batch_len;
3478 		msg_len = sizeof(*tx_power_tlv) + num_ch * sku_len;
3479 		skb = mt76_mcu_msg_alloc(dev, NULL, msg_len);
3480 		if (!skb) {
3481 			err = -ENOMEM;
3482 			goto out;
3483 		}
3484 
3485 		tx_power_tlv = (struct mt7925_tx_power_limit_tlv *)
3486 			       skb_put(skb, sizeof(*tx_power_tlv));
3487 
3488 		BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(tx_power_tlv->alpha2));
3489 		memcpy(tx_power_tlv->alpha2, dev->alpha2, sizeof(dev->alpha2));
3490 		tx_power_tlv->n_chan = num_ch;
3491 		tx_power_tlv->tag = cpu_to_le16(0x1);
3492 		tx_power_tlv->len = cpu_to_le16(sizeof(*tx_power_tlv));
3493 
3494 		switch (band) {
3495 		case NL80211_BAND_2GHZ:
3496 			tx_power_tlv->band = 1;
3497 			break;
3498 		case NL80211_BAND_6GHZ:
3499 			tx_power_tlv->band = 3;
3500 			break;
3501 		default:
3502 			tx_power_tlv->band = 2;
3503 			break;
3504 		}
3505 
3506 		for (j = 0; j < num_ch; j++, idx++) {
3507 			struct ieee80211_channel chan = {
3508 				.hw_value = ch_list[idx],
3509 				.band = band,
3510 			};
3511 			s8 reg_power, sar_power;
3512 
3513 			reg_power = mt76_connac_get_ch_power(phy, &chan,
3514 							     tx_power);
3515 			sar_power = mt76_get_sar_power(phy, &chan, reg_power);
3516 
3517 			mt76_get_rate_power_limits(phy, &chan, limits,
3518 						   sar_power);
3519 
3520 			tx_power_tlv->last_msg = ch_list[idx] == last_ch;
3521 			sku_tlbv->channel = ch_list[idx];
3522 
3523 			mt7925_mcu_build_sku(dev, sku_tlbv->pwr_limit,
3524 					     limits, band);
3525 			skb_put_data(skb, sku_tlbv, sku_len);
3526 		}
3527 		err = mt76_mcu_skb_send_msg(dev, skb,
3528 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3529 					    true);
3530 		if (err < 0)
3531 			goto out;
3532 	}
3533 
3534 out:
3535 	devm_kfree(dev->dev, sku_tlbv);
3536 	devm_kfree(dev->dev, limits);
3537 	return err;
3538 }
3539 
3540 int mt7925_mcu_set_rate_txpower(struct mt76_phy *phy)
3541 {
3542 	int err;
3543 
3544 	if (phy->cap.has_2ghz) {
3545 		err = mt7925_mcu_rate_txpower_band(phy,
3546 						   NL80211_BAND_2GHZ);
3547 		if (err < 0)
3548 			return err;
3549 	}
3550 
3551 	if (phy->cap.has_5ghz) {
3552 		err = mt7925_mcu_rate_txpower_band(phy,
3553 						   NL80211_BAND_5GHZ);
3554 		if (err < 0)
3555 			return err;
3556 	}
3557 
3558 	if (phy->cap.has_6ghz) {
3559 		err = mt7925_mcu_rate_txpower_band(phy,
3560 						   NL80211_BAND_6GHZ);
3561 		if (err < 0)
3562 			return err;
3563 	}
3564 
3565 	return 0;
3566 }
3567 
3568 int mt7925_mcu_set_rxfilter(struct mt792x_dev *dev, u32 fif,
3569 			    u8 bit_op, u32 bit_map)
3570 {
3571 	struct mt792x_phy *phy = &dev->phy;
3572 	struct {
3573 		u8 band_idx;
3574 		u8 rsv1[3];
3575 
3576 		__le16 tag;
3577 		__le16 len;
3578 		u8 mode;
3579 		u8 rsv2[3];
3580 		__le32 fif;
3581 		__le32 bit_map; /* bit_* for bitmap update */
3582 		u8 bit_op;
3583 		u8 pad[51];
3584 	} __packed req = {
3585 		.band_idx = phy->mt76->band_idx,
3586 		.tag = cpu_to_le16(UNI_BAND_CONFIG_SET_MAC80211_RX_FILTER),
3587 		.len = cpu_to_le16(sizeof(req) - 4),
3588 
3589 		.mode = fif ? 0 : 1,
3590 		.fif = cpu_to_le32(fif),
3591 		.bit_map = cpu_to_le32(bit_map),
3592 		.bit_op = bit_op,
3593 	};
3594 
3595 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3596 				 &req, sizeof(req), true);
3597 }
3598