xref: /linux/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c (revision 0e02f6ed6a49577e29e0b1f7900fad3ed8ae870c)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2023 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include <linux/firmware.h>
6 #include "mt7925.h"
7 #include "mcu.h"
8 #include "mac.h"
9 
10 #define MT_STA_BFER			BIT(0)
11 #define MT_STA_BFEE			BIT(1)
12 
13 static bool mt7925_disable_clc;
14 module_param_named(disable_clc, mt7925_disable_clc, bool, 0644);
15 MODULE_PARM_DESC(disable_clc, "disable CLC support");
16 
17 int mt7925_mcu_parse_response(struct mt76_dev *mdev, int cmd,
18 			      struct sk_buff *skb, int seq)
19 {
20 	int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
21 	struct mt7925_mcu_rxd *rxd;
22 	int ret = 0;
23 
24 	if (!skb) {
25 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n", cmd, seq);
26 		mt792x_reset(mdev);
27 
28 		return -ETIMEDOUT;
29 	}
30 
31 	rxd = (struct mt7925_mcu_rxd *)skb->data;
32 	if (seq != rxd->seq)
33 		return -EAGAIN;
34 
35 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL) ||
36 	    cmd == MCU_CMD(PATCH_FINISH_REQ)) {
37 		skb_pull(skb, sizeof(*rxd) - 4);
38 		ret = *skb->data;
39 	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
40 		   cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
41 		   cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
42 		   cmd == MCU_UNI_CMD(HIF_CTRL) ||
43 		   cmd == MCU_UNI_CMD(OFFLOAD) ||
44 		   cmd == MCU_UNI_CMD(SUSPEND)) {
45 		struct mt7925_mcu_uni_event *event;
46 
47 		skb_pull(skb, sizeof(*rxd));
48 		event = (struct mt7925_mcu_uni_event *)skb->data;
49 		ret = le32_to_cpu(event->status);
50 		/* skip invalid event */
51 		if (mcu_cmd != event->cid)
52 			ret = -EAGAIN;
53 	} else {
54 		skb_pull(skb, sizeof(*rxd));
55 	}
56 
57 	return ret;
58 }
59 EXPORT_SYMBOL_GPL(mt7925_mcu_parse_response);
60 
61 int mt7925_mcu_regval(struct mt792x_dev *dev, u32 regidx, u32 *val, bool set)
62 {
63 #define MT_RF_REG_HDR           GENMASK(31, 24)
64 #define MT_RF_REG_ANT           GENMASK(23, 16)
65 #define RF_REG_PREFIX           0x99
66 	struct {
67 		u8 __rsv[4];
68 		union {
69 			struct uni_cmd_access_reg_basic {
70 				__le16 tag;
71 				__le16 len;
72 				__le32 idx;
73 				__le32 data;
74 			} __packed reg;
75 			struct uni_cmd_access_rf_reg_basic {
76 				__le16 tag;
77 				__le16 len;
78 				__le16 ant;
79 				u8 __rsv[2];
80 				__le32 idx;
81 				__le32 data;
82 			} __packed rf_reg;
83 		};
84 	} __packed * res, req;
85 	struct sk_buff *skb;
86 	int ret;
87 
88 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX) {
89 		req.rf_reg.tag = cpu_to_le16(UNI_CMD_ACCESS_RF_REG_BASIC);
90 		req.rf_reg.len = cpu_to_le16(sizeof(req.rf_reg));
91 		req.rf_reg.ant = cpu_to_le16(u32_get_bits(regidx, MT_RF_REG_ANT));
92 		req.rf_reg.idx = cpu_to_le32(regidx);
93 		req.rf_reg.data = set ? cpu_to_le32(*val) : 0;
94 	} else {
95 		req.reg.tag = cpu_to_le16(UNI_CMD_ACCESS_REG_BASIC);
96 		req.reg.len = cpu_to_le16(sizeof(req.reg));
97 		req.reg.idx = cpu_to_le32(regidx);
98 		req.reg.data = set ? cpu_to_le32(*val) : 0;
99 	}
100 
101 	if (set)
102 		return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(REG_ACCESS),
103 					 &req, sizeof(req), true);
104 
105 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
106 					MCU_WM_UNI_CMD_QUERY(REG_ACCESS),
107 					&req, sizeof(req), true, &skb);
108 	if (ret)
109 		return ret;
110 
111 	res = (void *)skb->data;
112 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX)
113 		*val = le32_to_cpu(res->rf_reg.data);
114 	else
115 		*val = le32_to_cpu(res->reg.data);
116 
117 	dev_kfree_skb(skb);
118 
119 	return 0;
120 }
121 EXPORT_SYMBOL_GPL(mt7925_mcu_regval);
122 
123 int mt7925_mcu_update_arp_filter(struct mt76_dev *dev,
124 				 struct ieee80211_bss_conf *link_conf)
125 {
126 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
127 	struct ieee80211_vif *mvif = link_conf->vif;
128 	struct sk_buff *skb;
129 	int i, len = min_t(int, mvif->cfg.arp_addr_cnt,
130 			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
131 	struct {
132 		struct {
133 			u8 bss_idx;
134 			u8 pad[3];
135 		} __packed hdr;
136 		struct mt7925_arpns_tlv arp;
137 	} req = {
138 		.hdr = {
139 			.bss_idx = mconf->mt76.idx,
140 		},
141 		.arp = {
142 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
143 			.len = cpu_to_le16(sizeof(req) - 4 + len * 2 * sizeof(__be32)),
144 			.ips_num = len,
145 			.enable = true,
146 		},
147 	};
148 
149 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(req) + len * 2 * sizeof(__be32));
150 	if (!skb)
151 		return -ENOMEM;
152 
153 	skb_put_data(skb, &req, sizeof(req));
154 	for (i = 0; i < len; i++) {
155 		skb_put_data(skb, &mvif->cfg.arp_addr_list[i], sizeof(__be32));
156 		skb_put_zero(skb, sizeof(__be32));
157 	}
158 
159 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
160 }
161 
162 #ifdef CONFIG_PM
163 static int
164 mt7925_connac_mcu_set_wow_ctrl(struct mt76_phy *phy, struct ieee80211_vif *vif,
165 			       bool suspend, struct cfg80211_wowlan *wowlan)
166 {
167 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
168 	struct mt76_dev *dev = phy->dev;
169 	struct {
170 		struct {
171 			u8 bss_idx;
172 			u8 pad[3];
173 		} __packed hdr;
174 		struct mt76_connac_wow_ctrl_tlv wow_ctrl_tlv;
175 		struct mt76_connac_wow_gpio_param_tlv gpio_tlv;
176 	} req = {
177 		.hdr = {
178 			.bss_idx = mvif->idx,
179 		},
180 		.wow_ctrl_tlv = {
181 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
182 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_ctrl_tlv)),
183 			.cmd = suspend ? 1 : 2,
184 		},
185 		.gpio_tlv = {
186 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_GPIO_PARAM),
187 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_gpio_param_tlv)),
188 			.gpio_pin = 0xff, /* follow fw about GPIO pin */
189 		},
190 	};
191 
192 	if (wowlan->magic_pkt)
193 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_MAGIC;
194 	if (wowlan->disconnect)
195 		req.wow_ctrl_tlv.trigger |= (UNI_WOW_DETECT_TYPE_DISCONNECT |
196 					     UNI_WOW_DETECT_TYPE_BCN_LOST);
197 	if (wowlan->nd_config) {
198 		mt7925_mcu_sched_scan_req(phy, vif, wowlan->nd_config);
199 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_SCH_SCAN_HIT;
200 		mt7925_mcu_sched_scan_enable(phy, vif, suspend);
201 	}
202 	if (wowlan->n_patterns)
203 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_BITMAP;
204 
205 	if (mt76_is_mmio(dev))
206 		req.wow_ctrl_tlv.wakeup_hif = WOW_PCIE;
207 	else if (mt76_is_usb(dev))
208 		req.wow_ctrl_tlv.wakeup_hif = WOW_USB;
209 	else if (mt76_is_sdio(dev))
210 		req.wow_ctrl_tlv.wakeup_hif = WOW_GPIO;
211 
212 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(SUSPEND), &req,
213 				 sizeof(req), true);
214 }
215 
216 static int
217 mt7925_mcu_set_wow_pattern(struct mt76_dev *dev,
218 			   struct ieee80211_vif *vif,
219 			   u8 index, bool enable,
220 			   struct cfg80211_pkt_pattern *pattern)
221 {
222 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
223 	struct mt7925_wow_pattern_tlv *tlv;
224 	struct sk_buff *skb;
225 	struct {
226 		u8 bss_idx;
227 		u8 pad[3];
228 	} __packed hdr = {
229 		.bss_idx = mvif->idx,
230 	};
231 
232 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(hdr) + sizeof(*tlv));
233 	if (!skb)
234 		return -ENOMEM;
235 
236 	skb_put_data(skb, &hdr, sizeof(hdr));
237 	tlv = (struct mt7925_wow_pattern_tlv *)skb_put(skb, sizeof(*tlv));
238 	tlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
239 	tlv->len = cpu_to_le16(sizeof(*tlv));
240 	tlv->bss_idx = 0xF;
241 	tlv->data_len = pattern->pattern_len;
242 	tlv->enable = enable;
243 	tlv->index = index;
244 	tlv->offset = 0;
245 
246 	memcpy(tlv->pattern, pattern->pattern, pattern->pattern_len);
247 	memcpy(tlv->mask, pattern->mask, DIV_ROUND_UP(pattern->pattern_len, 8));
248 
249 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SUSPEND), true);
250 }
251 
252 void mt7925_mcu_set_suspend_iter(void *priv, u8 *mac,
253 				 struct ieee80211_vif *vif)
254 {
255 	struct mt76_phy *phy = priv;
256 	bool suspend = !test_bit(MT76_STATE_RUNNING, &phy->state);
257 	struct ieee80211_hw *hw = phy->hw;
258 	struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
259 	int i;
260 
261 	mt76_connac_mcu_set_gtk_rekey(phy->dev, vif, suspend);
262 
263 	mt76_connac_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
264 
265 	for (i = 0; i < wowlan->n_patterns; i++)
266 		mt7925_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
267 					   &wowlan->patterns[i]);
268 	mt7925_connac_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
269 }
270 
271 #endif /* CONFIG_PM */
272 
273 static void
274 mt7925_mcu_connection_loss_iter(void *priv, u8 *mac,
275 				struct ieee80211_vif *vif)
276 {
277 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
278 	struct mt7925_uni_beacon_loss_event *event = priv;
279 
280 	if (mvif->idx != event->hdr.bss_idx)
281 		return;
282 
283 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER) ||
284 	    vif->type != NL80211_IFTYPE_STATION)
285 		return;
286 
287 	ieee80211_connection_loss(vif);
288 }
289 
290 static void
291 mt7925_mcu_connection_loss_event(struct mt792x_dev *dev, struct sk_buff *skb)
292 {
293 	struct mt7925_uni_beacon_loss_event *event;
294 	struct mt76_phy *mphy = &dev->mt76.phy;
295 
296 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd));
297 	event = (struct mt7925_uni_beacon_loss_event *)skb->data;
298 
299 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
300 					IEEE80211_IFACE_ITER_RESUME_ALL,
301 					mt7925_mcu_connection_loss_iter, event);
302 }
303 
304 static void
305 mt7925_mcu_roc_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
306 {
307 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
308 	struct mt7925_roc_grant_tlv *grant = priv;
309 
310 	if (ieee80211_vif_is_mld(vif) && vif->type == NL80211_IFTYPE_STATION)
311 		return;
312 
313 	if (mvif->idx != grant->bss_idx)
314 		return;
315 
316 	mvif->band_idx = grant->dbdcband;
317 }
318 
319 static void mt7925_mcu_roc_handle_grant(struct mt792x_dev *dev,
320 					struct tlv *tlv)
321 {
322 	struct ieee80211_hw *hw = dev->mt76.hw;
323 	struct mt7925_roc_grant_tlv *grant;
324 	int duration;
325 
326 	grant = (struct mt7925_roc_grant_tlv *)tlv;
327 
328 	/* should never happen */
329 	WARN_ON_ONCE((le16_to_cpu(grant->tag) != UNI_EVENT_ROC_GRANT));
330 
331 	if (grant->reqtype == MT7925_ROC_REQ_ROC)
332 		ieee80211_ready_on_channel(hw);
333 	else if (grant->reqtype == MT7925_ROC_REQ_JOIN)
334 		ieee80211_iterate_active_interfaces_atomic(hw,
335 						IEEE80211_IFACE_ITER_RESUME_ALL,
336 						mt7925_mcu_roc_iter, grant);
337 	dev->phy.roc_grant = true;
338 	wake_up(&dev->phy.roc_wait);
339 	duration = le32_to_cpu(grant->max_interval);
340 	mod_timer(&dev->phy.roc_timer,
341 		  jiffies + msecs_to_jiffies(duration));
342 }
343 
344 static void
345 mt7925_mcu_uni_roc_event(struct mt792x_dev *dev, struct sk_buff *skb)
346 {
347 	struct tlv *tlv;
348 	int i = 0;
349 
350 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
351 
352 	while (i < skb->len) {
353 		tlv = (struct tlv *)(skb->data + i);
354 
355 		switch (le16_to_cpu(tlv->tag)) {
356 		case UNI_EVENT_ROC_GRANT:
357 			mt7925_mcu_roc_handle_grant(dev, tlv);
358 			break;
359 		case UNI_EVENT_ROC_GRANT_SUB_LINK:
360 			break;
361 		}
362 
363 		i += le16_to_cpu(tlv->len);
364 	}
365 }
366 
367 static void
368 mt7925_mcu_scan_event(struct mt792x_dev *dev, struct sk_buff *skb)
369 {
370 	struct mt76_phy *mphy = &dev->mt76.phy;
371 	struct mt792x_phy *phy = mphy->priv;
372 
373 	spin_lock_bh(&dev->mt76.lock);
374 	__skb_queue_tail(&phy->scan_event_list, skb);
375 	spin_unlock_bh(&dev->mt76.lock);
376 
377 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
378 				     MT792x_HW_SCAN_TIMEOUT);
379 }
380 
381 static void
382 mt7925_mcu_tx_done_event(struct mt792x_dev *dev, struct sk_buff *skb)
383 {
384 #define UNI_EVENT_TX_DONE_MSG 0
385 #define UNI_EVENT_TX_DONE_RAW 1
386 	struct mt7925_mcu_txs_event {
387 		u8 ver;
388 		u8 rsv[3];
389 		u8 data[0];
390 	} __packed * txs;
391 	struct tlv *tlv;
392 	u32 tlv_len;
393 
394 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
395 	tlv = (struct tlv *)skb->data;
396 	tlv_len = skb->len;
397 
398 	while (tlv_len > 0 && le16_to_cpu(tlv->len) <= tlv_len) {
399 		switch (le16_to_cpu(tlv->tag)) {
400 		case UNI_EVENT_TX_DONE_RAW:
401 			txs = (struct mt7925_mcu_txs_event *)tlv->data;
402 			mt7925_mac_add_txs(dev, txs->data);
403 			break;
404 		default:
405 			break;
406 		}
407 		tlv_len -= le16_to_cpu(tlv->len);
408 		tlv = (struct tlv *)((char *)(tlv) + le16_to_cpu(tlv->len));
409 	}
410 }
411 
412 static void
413 mt7925_mcu_uni_debug_msg_event(struct mt792x_dev *dev, struct sk_buff *skb)
414 {
415 	struct mt7925_uni_debug_msg {
416 		__le16 tag;
417 		__le16 len;
418 		u8 fmt;
419 		u8 rsv[3];
420 		u8 id;
421 		u8 type:3;
422 		u8 nr_args:5;
423 		union {
424 			struct idxlog {
425 				__le16 rsv;
426 				__le32 ts;
427 				__le32 idx;
428 				u8 data[];
429 			} __packed idx;
430 			struct txtlog {
431 				u8 len;
432 				u8 rsv;
433 				__le32 ts;
434 				u8 data[];
435 			} __packed txt;
436 		};
437 	} __packed * hdr;
438 
439 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
440 	hdr = (struct mt7925_uni_debug_msg *)skb->data;
441 
442 	if (hdr->id == 0x28) {
443 		skb_pull(skb, offsetof(struct mt7925_uni_debug_msg, id));
444 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", skb->len, skb->data);
445 		return;
446 	} else if (hdr->id != 0xa8) {
447 		return;
448 	}
449 
450 	if (hdr->type == 0) { /* idx log */
451 		int i, ret, len = PAGE_SIZE - 1, nr_val;
452 		struct page *page = dev_alloc_pages(get_order(len));
453 		__le32 *val;
454 		char *buf, *cur;
455 
456 		if (!page)
457 			return;
458 
459 		buf = page_address(page);
460 		cur = buf;
461 
462 		nr_val = (le16_to_cpu(hdr->len) - sizeof(*hdr)) / 4;
463 		val = (__le32 *)hdr->idx.data;
464 		for (i = 0; i < nr_val && len > 0; i++) {
465 			ret = snprintf(cur, len, "0x%x,", le32_to_cpu(val[i]));
466 			if (ret <= 0)
467 				break;
468 
469 			cur += ret;
470 			len -= ret;
471 		}
472 		if (cur > buf)
473 			wiphy_info(mt76_hw(dev)->wiphy, "idx: 0x%X,%d,%s",
474 				   le32_to_cpu(hdr->idx.idx), nr_val, buf);
475 		put_page(page);
476 	} else if (hdr->type == 2) { /* str log */
477 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", hdr->txt.len, hdr->txt.data);
478 	}
479 }
480 
481 static void
482 mt7925_mcu_uni_rx_unsolicited_event(struct mt792x_dev *dev,
483 				    struct sk_buff *skb)
484 {
485 	struct mt7925_mcu_rxd *rxd;
486 
487 	rxd = (struct mt7925_mcu_rxd *)skb->data;
488 
489 	switch (rxd->eid) {
490 	case MCU_UNI_EVENT_FW_LOG_2_HOST:
491 		mt7925_mcu_uni_debug_msg_event(dev, skb);
492 		break;
493 	case MCU_UNI_EVENT_ROC:
494 		mt7925_mcu_uni_roc_event(dev, skb);
495 		break;
496 	case MCU_UNI_EVENT_SCAN_DONE:
497 		mt7925_mcu_scan_event(dev, skb);
498 		return;
499 	case MCU_UNI_EVENT_TX_DONE:
500 		mt7925_mcu_tx_done_event(dev, skb);
501 		break;
502 	case MCU_UNI_EVENT_BSS_BEACON_LOSS:
503 		mt7925_mcu_connection_loss_event(dev, skb);
504 		break;
505 	case MCU_UNI_EVENT_COREDUMP:
506 		dev->fw_assert = true;
507 		mt76_connac_mcu_coredump_event(&dev->mt76, skb, &dev->coredump);
508 		return;
509 	default:
510 		break;
511 	}
512 	dev_kfree_skb(skb);
513 }
514 
515 void mt7925_mcu_rx_event(struct mt792x_dev *dev, struct sk_buff *skb)
516 {
517 	struct mt7925_mcu_rxd *rxd = (struct mt7925_mcu_rxd *)skb->data;
518 
519 	if (skb_linearize(skb))
520 		return;
521 
522 	if (rxd->option & MCU_UNI_CMD_UNSOLICITED_EVENT) {
523 		mt7925_mcu_uni_rx_unsolicited_event(dev, skb);
524 		return;
525 	}
526 
527 	mt76_mcu_rx_event(&dev->mt76, skb);
528 }
529 
530 static int
531 mt7925_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
532 		  struct ieee80211_ampdu_params *params,
533 		  bool enable, bool tx)
534 {
535 	struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv;
536 	struct sta_rec_ba_uni *ba;
537 	struct sk_buff *skb;
538 	struct tlv *tlv;
539 	int len;
540 
541 	len = sizeof(struct sta_req_hdr) + sizeof(*ba);
542 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid,
543 					      len);
544 	if (IS_ERR(skb))
545 		return PTR_ERR(skb);
546 
547 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
548 
549 	ba = (struct sta_rec_ba_uni *)tlv;
550 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
551 	ba->winsize = cpu_to_le16(params->buf_size);
552 	ba->ssn = cpu_to_le16(params->ssn);
553 	ba->ba_en = enable << params->tid;
554 	ba->amsdu = params->amsdu;
555 	ba->tid = params->tid;
556 
557 	return mt76_mcu_skb_send_msg(dev, skb,
558 				     MCU_UNI_CMD(STA_REC_UPDATE), true);
559 }
560 
561 /** starec & wtbl **/
562 int mt7925_mcu_uni_tx_ba(struct mt792x_dev *dev,
563 			 struct ieee80211_ampdu_params *params,
564 			 bool enable)
565 {
566 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
567 	struct mt792x_vif *mvif = msta->vif;
568 
569 	if (enable && !params->amsdu)
570 		msta->deflink.wcid.amsdu = false;
571 
572 	return mt7925_mcu_sta_ba(&dev->mt76, &mvif->bss_conf.mt76, params,
573 				 enable, true);
574 }
575 
576 int mt7925_mcu_uni_rx_ba(struct mt792x_dev *dev,
577 			 struct ieee80211_ampdu_params *params,
578 			 bool enable)
579 {
580 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
581 	struct mt792x_vif *mvif = msta->vif;
582 
583 	return mt7925_mcu_sta_ba(&dev->mt76, &mvif->bss_conf.mt76, params,
584 				 enable, false);
585 }
586 
587 static int mt7925_load_clc(struct mt792x_dev *dev, const char *fw_name)
588 {
589 	const struct mt76_connac2_fw_trailer *hdr;
590 	const struct mt76_connac2_fw_region *region;
591 	const struct mt7925_clc *clc;
592 	struct mt76_dev *mdev = &dev->mt76;
593 	struct mt792x_phy *phy = &dev->phy;
594 	const struct firmware *fw;
595 	int ret, i, len, offset = 0;
596 	u8 *clc_base = NULL;
597 
598 	if (mt7925_disable_clc ||
599 	    mt76_is_usb(&dev->mt76))
600 		return 0;
601 
602 	ret = request_firmware(&fw, fw_name, mdev->dev);
603 	if (ret)
604 		return ret;
605 
606 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
607 		dev_err(mdev->dev, "Invalid firmware\n");
608 		ret = -EINVAL;
609 		goto out;
610 	}
611 
612 	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
613 	for (i = 0; i < hdr->n_region; i++) {
614 		region = (const void *)((const u8 *)hdr -
615 					(hdr->n_region - i) * sizeof(*region));
616 		len = le32_to_cpu(region->len);
617 
618 		/* check if we have valid buffer size */
619 		if (offset + len > fw->size) {
620 			dev_err(mdev->dev, "Invalid firmware region\n");
621 			ret = -EINVAL;
622 			goto out;
623 		}
624 
625 		if ((region->feature_set & FW_FEATURE_NON_DL) &&
626 		    region->type == FW_TYPE_CLC) {
627 			clc_base = (u8 *)(fw->data + offset);
628 			break;
629 		}
630 		offset += len;
631 	}
632 
633 	if (!clc_base)
634 		goto out;
635 
636 	for (offset = 0; offset < len; offset += le32_to_cpu(clc->len)) {
637 		clc = (const struct mt7925_clc *)(clc_base + offset);
638 
639 		if (clc->idx >= ARRAY_SIZE(phy->clc))
640 			break;
641 
642 		/* do not init buf again if chip reset triggered */
643 		if (phy->clc[clc->idx])
644 			continue;
645 
646 		phy->clc[clc->idx] = devm_kmemdup(mdev->dev, clc,
647 						  le32_to_cpu(clc->len),
648 						  GFP_KERNEL);
649 
650 		if (!phy->clc[clc->idx]) {
651 			ret = -ENOMEM;
652 			goto out;
653 		}
654 	}
655 
656 	ret = mt7925_mcu_set_clc(dev, "00", ENVIRON_INDOOR);
657 out:
658 	release_firmware(fw);
659 
660 	return ret;
661 }
662 
663 int mt7925_mcu_fw_log_2_host(struct mt792x_dev *dev, u8 ctrl)
664 {
665 	struct {
666 		u8 _rsv[4];
667 
668 		__le16 tag;
669 		__le16 len;
670 		u8 ctrl;
671 		u8 interval;
672 		u8 _rsv2[2];
673 	} __packed req = {
674 		.tag = cpu_to_le16(UNI_WSYS_CONFIG_FW_LOG_CTRL),
675 		.len = cpu_to_le16(sizeof(req) - 4),
676 		.ctrl = ctrl,
677 	};
678 	int ret;
679 
680 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(WSYS_CONFIG),
681 					&req, sizeof(req), false, NULL);
682 	return ret;
683 }
684 
685 int mt7925_mcu_get_temperature(struct mt792x_phy *phy)
686 {
687 	struct {
688 		u8 _rsv[4];
689 
690 		__le16 tag;
691 		__le16 len;
692 		u8 _rsv2[4];
693 	} __packed req = {
694 		.tag = cpu_to_le16(0x0),
695 		.len = cpu_to_le16(sizeof(req) - 4),
696 	};
697 	struct mt7925_thermal_evt {
698 		u8 rsv[4];
699 		__le32 temperature;
700 	} __packed * evt;
701 	struct mt792x_dev *dev = phy->dev;
702 	int temperature, ret;
703 	struct sk_buff *skb;
704 
705 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
706 					MCU_WM_UNI_CMD_QUERY(THERMAL),
707 					&req, sizeof(req), true, &skb);
708 	if (ret)
709 		return ret;
710 
711 	skb_pull(skb, 4 + sizeof(struct tlv));
712 	evt = (struct mt7925_thermal_evt *)skb->data;
713 
714 	temperature = le32_to_cpu(evt->temperature);
715 
716 	dev_kfree_skb(skb);
717 
718 	return temperature;
719 }
720 
721 static void
722 mt7925_mcu_parse_phy_cap(struct mt792x_dev *dev, char *data)
723 {
724 	struct mt76_phy *mphy = &dev->mt76.phy;
725 	struct mt76_dev *mdev = mphy->dev;
726 	struct mt7925_mcu_phy_cap {
727 		u8 ht;
728 		u8 vht;
729 		u8 _5g;
730 		u8 max_bw;
731 		u8 nss;
732 		u8 dbdc;
733 		u8 tx_ldpc;
734 		u8 rx_ldpc;
735 		u8 tx_stbc;
736 		u8 rx_stbc;
737 		u8 hw_path;
738 		u8 he;
739 		u8 eht;
740 	} __packed * cap;
741 	enum {
742 		WF0_24G,
743 		WF0_5G
744 	};
745 
746 	cap = (struct mt7925_mcu_phy_cap *)data;
747 
748 	mdev->phy.antenna_mask = BIT(cap->nss) - 1;
749 	mdev->phy.chainmask = mdev->phy.antenna_mask;
750 	mdev->phy.cap.has_2ghz = cap->hw_path & BIT(WF0_24G);
751 	mdev->phy.cap.has_5ghz = cap->hw_path & BIT(WF0_5G);
752 	dev->has_eht = cap->eht;
753 }
754 
755 static void
756 mt7925_mcu_parse_eml_cap(struct mt792x_dev *dev, char *data)
757 {
758 	struct mt7925_mcu_eml_cap {
759 		u8 rsv[4];
760 		__le16 eml_cap;
761 		u8 rsv2[6];
762 	} __packed * cap;
763 
764 	cap = (struct mt7925_mcu_eml_cap *)data;
765 
766 	dev->phy.eml_cap = le16_to_cpu(cap->eml_cap);
767 }
768 
769 static int
770 mt7925_mcu_get_nic_capability(struct mt792x_dev *dev)
771 {
772 	struct mt76_phy *mphy = &dev->mt76.phy;
773 	struct {
774 		u8 _rsv[4];
775 
776 		__le16 tag;
777 		__le16 len;
778 	} __packed req = {
779 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_NIC_CAPA),
780 		.len = cpu_to_le16(sizeof(req) - 4),
781 	};
782 	struct mt76_connac_cap_hdr {
783 		__le16 n_element;
784 		u8 rsv[2];
785 	} __packed * hdr;
786 	struct sk_buff *skb;
787 	int ret, i;
788 
789 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
790 					&req, sizeof(req), true, &skb);
791 	if (ret)
792 		return ret;
793 
794 	hdr = (struct mt76_connac_cap_hdr *)skb->data;
795 	if (skb->len < sizeof(*hdr)) {
796 		ret = -EINVAL;
797 		goto out;
798 	}
799 
800 	skb_pull(skb, sizeof(*hdr));
801 
802 	for (i = 0; i < le16_to_cpu(hdr->n_element); i++) {
803 		struct tlv *tlv = (struct tlv *)skb->data;
804 		int len;
805 
806 		if (skb->len < sizeof(*tlv))
807 			break;
808 
809 		len = le16_to_cpu(tlv->len);
810 		if (skb->len < len)
811 			break;
812 
813 		switch (le16_to_cpu(tlv->tag)) {
814 		case MT_NIC_CAP_6G:
815 			mphy->cap.has_6ghz = !!tlv->data[0];
816 			break;
817 		case MT_NIC_CAP_MAC_ADDR:
818 			memcpy(mphy->macaddr, (void *)tlv->data, ETH_ALEN);
819 			break;
820 		case MT_NIC_CAP_PHY:
821 			mt7925_mcu_parse_phy_cap(dev, tlv->data);
822 			break;
823 		case MT_NIC_CAP_CHIP_CAP:
824 			dev->phy.chip_cap = le64_to_cpu(*(__le64 *)tlv->data);
825 			break;
826 		case MT_NIC_CAP_EML_CAP:
827 			mt7925_mcu_parse_eml_cap(dev, tlv->data);
828 			break;
829 		default:
830 			break;
831 		}
832 		skb_pull(skb, len);
833 	}
834 out:
835 	dev_kfree_skb(skb);
836 	return ret;
837 }
838 
839 int mt7925_mcu_chip_config(struct mt792x_dev *dev, const char *cmd)
840 {
841 	u16 len = strlen(cmd) + 1;
842 	struct {
843 		u8 _rsv[4];
844 		__le16 tag;
845 		__le16 len;
846 		struct mt76_connac_config config;
847 	} __packed req = {
848 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_CHIP_CFG),
849 		.len = cpu_to_le16(sizeof(req) - 4),
850 		.config = {
851 			.resp_type = 0,
852 			.type = 0,
853 			.data_size = cpu_to_le16(len),
854 		},
855 	};
856 
857 	memcpy(req.config.data, cmd, len);
858 
859 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
860 				 &req, sizeof(req), false);
861 }
862 
863 int mt7925_mcu_set_deep_sleep(struct mt792x_dev *dev, bool enable)
864 {
865 	char cmd[16];
866 
867 	snprintf(cmd, sizeof(cmd), "KeepFullPwr %d", !enable);
868 
869 	return mt7925_mcu_chip_config(dev, cmd);
870 }
871 EXPORT_SYMBOL_GPL(mt7925_mcu_set_deep_sleep);
872 
873 int mt7925_run_firmware(struct mt792x_dev *dev)
874 {
875 	int err;
876 
877 	err = mt792x_load_firmware(dev);
878 	if (err)
879 		return err;
880 
881 	err = mt7925_mcu_get_nic_capability(dev);
882 	if (err)
883 		return err;
884 
885 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
886 	err = mt7925_load_clc(dev, mt792x_ram_name(dev));
887 	if (err)
888 		return err;
889 
890 	return mt7925_mcu_fw_log_2_host(dev, 1);
891 }
892 EXPORT_SYMBOL_GPL(mt7925_run_firmware);
893 
894 static void
895 mt7925_mcu_sta_hdr_trans_tlv(struct sk_buff *skb,
896 			     struct ieee80211_vif *vif,
897 			     struct ieee80211_link_sta *link_sta)
898 {
899 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
900 	struct sta_rec_hdr_trans *hdr_trans;
901 	struct mt76_wcid *wcid;
902 	struct tlv *tlv;
903 
904 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HDR_TRANS, sizeof(*hdr_trans));
905 	hdr_trans = (struct sta_rec_hdr_trans *)tlv;
906 	hdr_trans->dis_rx_hdr_tran = true;
907 
908 	if (vif->type == NL80211_IFTYPE_STATION)
909 		hdr_trans->to_ds = true;
910 	else
911 		hdr_trans->from_ds = true;
912 
913 	if (link_sta) {
914 		struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
915 		struct mt792x_link_sta *mlink;
916 
917 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
918 		wcid = &mlink->wcid;
919 	} else {
920 		wcid = &mvif->sta.deflink.wcid;
921 	}
922 
923 	if (!wcid)
924 		return;
925 
926 	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
927 	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
928 		hdr_trans->to_ds = true;
929 		hdr_trans->from_ds = true;
930 	}
931 }
932 
933 int mt7925_mcu_wtbl_update_hdr_trans(struct mt792x_dev *dev,
934 				     struct ieee80211_vif *vif,
935 				     struct ieee80211_sta *sta,
936 				     int link_id)
937 {
938 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
939 	struct ieee80211_link_sta *link_sta = sta ? &sta->deflink : NULL;
940 	struct mt792x_link_sta *mlink;
941 	struct mt792x_bss_conf *mconf;
942 	struct mt792x_sta *msta;
943 	struct sk_buff *skb;
944 
945 	msta = sta ? (struct mt792x_sta *)sta->drv_priv : &mvif->sta;
946 
947 	mlink = mt792x_sta_to_link(msta, link_id);
948 	link_sta = mt792x_sta_to_link_sta(vif, sta, link_id);
949 	mconf = mt792x_vif_to_link(mvif, link_id);
950 
951 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
952 					      &mlink->wcid,
953 					      MT7925_STA_UPDATE_MAX_SIZE);
954 	if (IS_ERR(skb))
955 		return PTR_ERR(skb);
956 
957 	/* starec hdr trans */
958 	mt7925_mcu_sta_hdr_trans_tlv(skb, vif, link_sta);
959 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
960 				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
961 }
962 
963 int mt7925_mcu_set_tx(struct mt792x_dev *dev,
964 		      struct ieee80211_bss_conf *bss_conf)
965 {
966 #define MCU_EDCA_AC_PARAM	0
967 #define WMM_AIFS_SET		BIT(0)
968 #define WMM_CW_MIN_SET		BIT(1)
969 #define WMM_CW_MAX_SET		BIT(2)
970 #define WMM_TXOP_SET		BIT(3)
971 #define WMM_PARAM_SET		(WMM_AIFS_SET | WMM_CW_MIN_SET | \
972 				 WMM_CW_MAX_SET | WMM_TXOP_SET)
973 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(bss_conf);
974 	struct {
975 		u8 bss_idx;
976 		u8 __rsv[3];
977 	} __packed hdr = {
978 		.bss_idx = mconf->mt76.idx,
979 	};
980 	struct sk_buff *skb;
981 	int len = sizeof(hdr) + IEEE80211_NUM_ACS * sizeof(struct edca);
982 	int ac;
983 
984 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
985 	if (!skb)
986 		return -ENOMEM;
987 
988 	skb_put_data(skb, &hdr, sizeof(hdr));
989 
990 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
991 		struct ieee80211_tx_queue_params *q = &mconf->queue_params[ac];
992 		struct edca *e;
993 		struct tlv *tlv;
994 
995 		tlv = mt76_connac_mcu_add_tlv(skb, MCU_EDCA_AC_PARAM, sizeof(*e));
996 
997 		e = (struct edca *)tlv;
998 		e->set = WMM_PARAM_SET;
999 		e->queue = ac;
1000 		e->aifs = q->aifs;
1001 		e->txop = cpu_to_le16(q->txop);
1002 
1003 		if (q->cw_min)
1004 			e->cw_min = fls(q->cw_min);
1005 		else
1006 			e->cw_min = 5;
1007 
1008 		if (q->cw_max)
1009 			e->cw_max = fls(q->cw_max);
1010 		else
1011 			e->cw_max = 10;
1012 	}
1013 
1014 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1015 				     MCU_UNI_CMD(EDCA_UPDATE), true);
1016 }
1017 
1018 static int
1019 mt7925_mcu_sta_key_tlv(struct mt76_wcid *wcid,
1020 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1021 		       struct sk_buff *skb,
1022 		       struct ieee80211_key_conf *key,
1023 		       enum set_key_cmd cmd,
1024 		       struct mt792x_sta *msta)
1025 {
1026 	struct mt792x_vif *mvif = msta->vif;
1027 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1028 	struct sta_rec_sec_uni *sec;
1029 	struct ieee80211_sta *sta;
1030 	struct ieee80211_vif *vif;
1031 	struct tlv *tlv;
1032 
1033 	sta = msta == &mvif->sta ?
1034 		      NULL :
1035 		      container_of((void *)msta, struct ieee80211_sta, drv_priv);
1036 	vif = container_of((void *)mvif, struct ieee80211_vif, drv_priv);
1037 
1038 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V3, sizeof(*sec));
1039 	sec = (struct sta_rec_sec_uni *)tlv;
1040 	sec->bss_idx = mconf->mt76.idx;
1041 	sec->is_authenticator = 0;
1042 	sec->mgmt_prot = 1; /* only used in MLO mode */
1043 	sec->wlan_idx = (u8)wcid->idx;
1044 
1045 	if (sta) {
1046 		struct ieee80211_link_sta *link_sta;
1047 
1048 		sec->tx_key = 1;
1049 		sec->key_type = 1;
1050 		link_sta = mt792x_sta_to_link_sta(vif, sta, wcid->link_id);
1051 
1052 		if (link_sta)
1053 			memcpy(sec->peer_addr, link_sta->addr, ETH_ALEN);
1054 	} else {
1055 		struct ieee80211_bss_conf *link_conf;
1056 
1057 		link_conf = mt792x_vif_to_bss_conf(vif, wcid->link_id);
1058 
1059 		if (link_conf)
1060 			memcpy(sec->peer_addr, link_conf->bssid, ETH_ALEN);
1061 	}
1062 
1063 	if (cmd == SET_KEY) {
1064 		u8 cipher;
1065 
1066 		sec->add = 1;
1067 		cipher = mt7925_mcu_get_cipher(key->cipher);
1068 		if (cipher == CONNAC3_CIPHER_NONE)
1069 			return -EOPNOTSUPP;
1070 
1071 		if (cipher == CONNAC3_CIPHER_BIP_CMAC_128) {
1072 			sec->cipher_id = CONNAC3_CIPHER_BIP_CMAC_128;
1073 			sec->key_id = sta_key_conf->keyidx;
1074 			sec->key_len = 32;
1075 			memcpy(sec->key, sta_key_conf->key, 16);
1076 			memcpy(sec->key + 16, key->key, 16);
1077 		} else {
1078 			sec->cipher_id = cipher;
1079 			sec->key_id = key->keyidx;
1080 			sec->key_len = key->keylen;
1081 			memcpy(sec->key, key->key, key->keylen);
1082 
1083 			if (cipher == CONNAC3_CIPHER_TKIP) {
1084 				/* Rx/Tx MIC keys are swapped */
1085 				memcpy(sec->key + 16, key->key + 24, 8);
1086 				memcpy(sec->key + 24, key->key + 16, 8);
1087 			}
1088 
1089 			/* store key_conf for BIP batch update */
1090 			if (cipher == CONNAC3_CIPHER_AES_CCMP) {
1091 				memcpy(sta_key_conf->key, key->key, key->keylen);
1092 				sta_key_conf->keyidx = key->keyidx;
1093 			}
1094 		}
1095 	} else {
1096 		sec->add = 0;
1097 	}
1098 
1099 	return 0;
1100 }
1101 
1102 int mt7925_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
1103 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1104 		       struct ieee80211_key_conf *key, int mcu_cmd,
1105 		       struct mt76_wcid *wcid, enum set_key_cmd cmd,
1106 		       struct mt792x_sta *msta)
1107 {
1108 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1109 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1110 	struct sk_buff *skb;
1111 	int ret;
1112 
1113 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, wcid,
1114 					      MT7925_STA_UPDATE_MAX_SIZE);
1115 	if (IS_ERR(skb))
1116 		return PTR_ERR(skb);
1117 
1118 	ret = mt7925_mcu_sta_key_tlv(wcid, sta_key_conf, skb, key, cmd, msta);
1119 	if (ret)
1120 		return ret;
1121 
1122 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
1123 }
1124 
1125 int mt7925_mcu_set_mlo_roc(struct mt792x_bss_conf *mconf, u16 sel_links,
1126 			   int duration, u8 token_id)
1127 {
1128 	struct mt792x_vif *mvif = mconf->vif;
1129 	struct ieee80211_vif *vif = container_of((void *)mvif,
1130 						 struct ieee80211_vif, drv_priv);
1131 	struct ieee80211_bss_conf *link_conf;
1132 	struct ieee80211_channel *chan;
1133 	const u8 ch_band[] = {
1134 		[NL80211_BAND_2GHZ] = 1,
1135 		[NL80211_BAND_5GHZ] = 2,
1136 		[NL80211_BAND_6GHZ] = 3,
1137 	};
1138 	enum mt7925_roc_req type;
1139 	int center_ch, i = 0;
1140 	bool is_AG_band = false;
1141 	struct {
1142 		u8 id;
1143 		u8 bss_idx;
1144 		u16 tag;
1145 		struct mt792x_bss_conf *mconf;
1146 		struct ieee80211_channel *chan;
1147 	} links[2];
1148 
1149 	struct {
1150 		struct {
1151 			u8 rsv[4];
1152 		} __packed hdr;
1153 		struct roc_acquire_tlv roc[2];
1154 	} __packed req = {
1155 			.roc[0].tag = cpu_to_le16(UNI_ROC_NUM),
1156 			.roc[0].len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1157 			.roc[1].tag = cpu_to_le16(UNI_ROC_NUM),
1158 			.roc[1].len = cpu_to_le16(sizeof(struct roc_acquire_tlv))
1159 	};
1160 
1161 	if (!mconf || hweight16(vif->valid_links) < 2 ||
1162 	    hweight16(sel_links) != 2)
1163 		return -EPERM;
1164 
1165 	for (i = 0; i < ARRAY_SIZE(links); i++) {
1166 		links[i].id = i ? __ffs(~BIT(mconf->link_id) & sel_links) :
1167 				 mconf->link_id;
1168 		link_conf = mt792x_vif_to_bss_conf(vif, links[i].id);
1169 		if (WARN_ON_ONCE(!link_conf))
1170 			return -EPERM;
1171 
1172 		links[i].chan = link_conf->chanreq.oper.chan;
1173 		if (WARN_ON_ONCE(!links[i].chan))
1174 			return -EPERM;
1175 
1176 		links[i].mconf = mt792x_vif_to_link(mvif, links[i].id);
1177 		links[i].tag = links[i].id == mconf->link_id ?
1178 			       UNI_ROC_ACQUIRE : UNI_ROC_SUB_LINK;
1179 
1180 		is_AG_band |= links[i].chan->band == NL80211_BAND_2GHZ;
1181 	}
1182 
1183 	if (vif->cfg.eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP)
1184 		type = is_AG_band ? MT7925_ROC_REQ_MLSR_AG :
1185 				    MT7925_ROC_REQ_MLSR_AA;
1186 	else
1187 		type = MT7925_ROC_REQ_JOIN;
1188 
1189 	for (i = 0; i < ARRAY_SIZE(links) && i < hweight16(vif->active_links); i++) {
1190 		if (WARN_ON_ONCE(!links[i].mconf || !links[i].chan))
1191 			continue;
1192 
1193 		chan = links[i].chan;
1194 		center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1195 		req.roc[i].len = cpu_to_le16(sizeof(struct roc_acquire_tlv));
1196 		req.roc[i].tag = cpu_to_le16(links[i].tag);
1197 		req.roc[i].tokenid = token_id;
1198 		req.roc[i].reqtype = type;
1199 		req.roc[i].maxinterval = cpu_to_le32(duration);
1200 		req.roc[i].bss_idx = links[i].mconf->mt76.idx;
1201 		req.roc[i].control_channel = chan->hw_value;
1202 		req.roc[i].bw = CMD_CBW_20MHZ;
1203 		req.roc[i].bw_from_ap = CMD_CBW_20MHZ;
1204 		req.roc[i].center_chan = center_ch;
1205 		req.roc[i].center_chan_from_ap = center_ch;
1206 		req.roc[i].center_chan2 = 0;
1207 		req.roc[i].center_chan2_from_ap = 0;
1208 
1209 		/* STR : 0xfe indicates BAND_ALL with enabling DBDC
1210 		 * EMLSR : 0xff indicates (BAND_AUTO) without DBDC
1211 		 */
1212 		req.roc[i].dbdcband = type == MT7925_ROC_REQ_JOIN ? 0xfe : 0xff;
1213 
1214 		if (chan->hw_value < center_ch)
1215 			req.roc[i].sco = 1; /* SCA */
1216 		else if (chan->hw_value > center_ch)
1217 			req.roc[i].sco = 3; /* SCB */
1218 
1219 		req.roc[i].band = ch_band[chan->band];
1220 	}
1221 
1222 	return mt76_mcu_send_msg(&mvif->phy->dev->mt76, MCU_UNI_CMD(ROC),
1223 				 &req, sizeof(req), false);
1224 }
1225 
1226 int mt7925_mcu_set_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1227 		       struct ieee80211_channel *chan, int duration,
1228 		       enum mt7925_roc_req type, u8 token_id)
1229 {
1230 	int center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1231 	struct mt792x_dev *dev = phy->dev;
1232 	struct {
1233 		struct {
1234 			u8 rsv[4];
1235 		} __packed hdr;
1236 		struct roc_acquire_tlv roc;
1237 	} __packed req = {
1238 		.roc = {
1239 			.tag = cpu_to_le16(UNI_ROC_ACQUIRE),
1240 			.len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1241 			.tokenid = token_id,
1242 			.reqtype = type,
1243 			.maxinterval = cpu_to_le32(duration),
1244 			.bss_idx = mconf->mt76.idx,
1245 			.control_channel = chan->hw_value,
1246 			.bw = CMD_CBW_20MHZ,
1247 			.bw_from_ap = CMD_CBW_20MHZ,
1248 			.center_chan = center_ch,
1249 			.center_chan_from_ap = center_ch,
1250 			.dbdcband = 0xff, /* auto */
1251 		},
1252 	};
1253 
1254 	if (chan->hw_value < center_ch)
1255 		req.roc.sco = 1; /* SCA */
1256 	else if (chan->hw_value > center_ch)
1257 		req.roc.sco = 3; /* SCB */
1258 
1259 	switch (chan->band) {
1260 	case NL80211_BAND_6GHZ:
1261 		req.roc.band = 3;
1262 		break;
1263 	case NL80211_BAND_5GHZ:
1264 		req.roc.band = 2;
1265 		break;
1266 	default:
1267 		req.roc.band = 1;
1268 		break;
1269 	}
1270 
1271 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1272 				 &req, sizeof(req), false);
1273 }
1274 
1275 int mt7925_mcu_abort_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1276 			 u8 token_id)
1277 {
1278 	struct mt792x_dev *dev = phy->dev;
1279 	struct {
1280 		struct {
1281 			u8 rsv[4];
1282 		} __packed hdr;
1283 		struct roc_abort_tlv {
1284 			__le16 tag;
1285 			__le16 len;
1286 			u8 bss_idx;
1287 			u8 tokenid;
1288 			u8 dbdcband;
1289 			u8 rsv[5];
1290 		} __packed abort;
1291 	} __packed req = {
1292 		.abort = {
1293 			.tag = cpu_to_le16(UNI_ROC_ABORT),
1294 			.len = cpu_to_le16(sizeof(struct roc_abort_tlv)),
1295 			.tokenid = token_id,
1296 			.bss_idx = mconf->mt76.idx,
1297 			.dbdcband = 0xff, /* auto*/
1298 		},
1299 	};
1300 
1301 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1302 				 &req, sizeof(req), false);
1303 }
1304 
1305 int mt7925_mcu_set_eeprom(struct mt792x_dev *dev)
1306 {
1307 	struct {
1308 		u8 _rsv[4];
1309 
1310 		__le16 tag;
1311 		__le16 len;
1312 		u8 buffer_mode;
1313 		u8 format;
1314 		__le16 buf_len;
1315 	} __packed req = {
1316 		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
1317 		.len = cpu_to_le16(sizeof(req) - 4),
1318 		.buffer_mode = EE_MODE_EFUSE,
1319 		.format = EE_FORMAT_WHOLE
1320 	};
1321 
1322 	return mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(EFUSE_CTRL),
1323 					 &req, sizeof(req), false, NULL);
1324 }
1325 EXPORT_SYMBOL_GPL(mt7925_mcu_set_eeprom);
1326 
1327 int mt7925_mcu_uni_bss_ps(struct mt792x_dev *dev,
1328 			  struct ieee80211_bss_conf *link_conf)
1329 {
1330 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1331 	struct {
1332 		struct {
1333 			u8 bss_idx;
1334 			u8 pad[3];
1335 		} __packed hdr;
1336 		struct ps_tlv {
1337 			__le16 tag;
1338 			__le16 len;
1339 			u8 ps_state; /* 0: device awake
1340 				      * 1: static power save
1341 				      * 2: dynamic power saving
1342 				      * 3: enter TWT power saving
1343 				      * 4: leave TWT power saving
1344 				      */
1345 			u8 pad[3];
1346 		} __packed ps;
1347 	} __packed ps_req = {
1348 		.hdr = {
1349 			.bss_idx = mconf->mt76.idx,
1350 		},
1351 		.ps = {
1352 			.tag = cpu_to_le16(UNI_BSS_INFO_PS),
1353 			.len = cpu_to_le16(sizeof(struct ps_tlv)),
1354 			.ps_state = link_conf->vif->cfg.ps ? 2 : 0,
1355 		},
1356 	};
1357 
1358 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1359 		return -EOPNOTSUPP;
1360 
1361 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1362 				 &ps_req, sizeof(ps_req), true);
1363 }
1364 
1365 static int
1366 mt7925_mcu_uni_bss_bcnft(struct mt792x_dev *dev,
1367 			 struct ieee80211_bss_conf *link_conf, bool enable)
1368 {
1369 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1370 	struct {
1371 		struct {
1372 			u8 bss_idx;
1373 			u8 pad[3];
1374 		} __packed hdr;
1375 		struct bcnft_tlv {
1376 			__le16 tag;
1377 			__le16 len;
1378 			__le16 bcn_interval;
1379 			u8 dtim_period;
1380 			u8 bmc_delivered_ac;
1381 			u8 bmc_triggered_ac;
1382 			u8 pad[3];
1383 		} __packed bcnft;
1384 	} __packed bcnft_req = {
1385 		.hdr = {
1386 			.bss_idx = mconf->mt76.idx,
1387 		},
1388 		.bcnft = {
1389 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1390 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1391 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1392 			.dtim_period = link_conf->dtim_period,
1393 		},
1394 	};
1395 
1396 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1397 		return 0;
1398 
1399 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1400 				 &bcnft_req, sizeof(bcnft_req), true);
1401 }
1402 
1403 int
1404 mt7925_mcu_set_bss_pm(struct mt792x_dev *dev,
1405 		      struct ieee80211_bss_conf *link_conf,
1406 		      bool enable)
1407 {
1408 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1409 	struct {
1410 		struct {
1411 			u8 bss_idx;
1412 			u8 pad[3];
1413 		} __packed hdr;
1414 		struct bcnft_tlv {
1415 			__le16 tag;
1416 			__le16 len;
1417 			__le16 bcn_interval;
1418 			u8 dtim_period;
1419 			u8 bmc_delivered_ac;
1420 			u8 bmc_triggered_ac;
1421 			u8 pad[3];
1422 		} __packed enable;
1423 	} req = {
1424 		.hdr = {
1425 			.bss_idx = mconf->mt76.idx,
1426 		},
1427 		.enable = {
1428 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1429 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1430 			.dtim_period = link_conf->dtim_period,
1431 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1432 		},
1433 	};
1434 	struct {
1435 		struct {
1436 			u8 bss_idx;
1437 			u8 pad[3];
1438 		} __packed hdr;
1439 		struct pm_disable {
1440 			__le16 tag;
1441 			__le16 len;
1442 		} __packed disable;
1443 	} req1 = {
1444 		.hdr = {
1445 			.bss_idx = mconf->mt76.idx,
1446 		},
1447 		.disable = {
1448 			.tag = cpu_to_le16(UNI_BSS_INFO_PM_DISABLE),
1449 			.len = cpu_to_le16(sizeof(struct pm_disable))
1450 		},
1451 	};
1452 	int err;
1453 
1454 	err = mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1455 				&req1, sizeof(req1), false);
1456 	if (err < 0 || !enable)
1457 		return err;
1458 
1459 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1460 				 &req, sizeof(req), false);
1461 }
1462 
1463 static void
1464 mt7925_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1465 {
1466 	if (!link_sta->he_cap.has_he)
1467 		return;
1468 
1469 	mt76_connac_mcu_sta_he_tlv_v2(skb, link_sta->sta);
1470 }
1471 
1472 static void
1473 mt7925_mcu_sta_he_6g_tlv(struct sk_buff *skb,
1474 			 struct ieee80211_link_sta *link_sta)
1475 {
1476 	struct sta_rec_he_6g_capa *he_6g;
1477 	struct tlv *tlv;
1478 
1479 	if (!link_sta->he_6ghz_capa.capa)
1480 		return;
1481 
1482 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G, sizeof(*he_6g));
1483 
1484 	he_6g = (struct sta_rec_he_6g_capa *)tlv;
1485 	he_6g->capa = link_sta->he_6ghz_capa.capa;
1486 }
1487 
1488 static void
1489 mt7925_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1490 {
1491 	struct ieee80211_eht_mcs_nss_supp *mcs_map;
1492 	struct ieee80211_eht_cap_elem_fixed *elem;
1493 	struct sta_rec_eht *eht;
1494 	struct tlv *tlv;
1495 
1496 	if (!link_sta->eht_cap.has_eht)
1497 		return;
1498 
1499 	mcs_map = &link_sta->eht_cap.eht_mcs_nss_supp;
1500 	elem = &link_sta->eht_cap.eht_cap_elem;
1501 
1502 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT, sizeof(*eht));
1503 
1504 	eht = (struct sta_rec_eht *)tlv;
1505 	eht->tid_bitmap = 0xff;
1506 	eht->mac_cap = cpu_to_le16(*(u16 *)elem->mac_cap_info);
1507 	eht->phy_cap = cpu_to_le64(*(u64 *)elem->phy_cap_info);
1508 	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
1509 
1510 	if (link_sta->bandwidth == IEEE80211_STA_RX_BW_20)
1511 		memcpy(eht->mcs_map_bw20, &mcs_map->only_20mhz, sizeof(eht->mcs_map_bw20));
1512 	memcpy(eht->mcs_map_bw80, &mcs_map->bw._80, sizeof(eht->mcs_map_bw80));
1513 	memcpy(eht->mcs_map_bw160, &mcs_map->bw._160, sizeof(eht->mcs_map_bw160));
1514 }
1515 
1516 static void
1517 mt7925_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1518 {
1519 	struct sta_rec_ht *ht;
1520 	struct tlv *tlv;
1521 
1522 	if (!link_sta->ht_cap.ht_supported)
1523 		return;
1524 
1525 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1526 
1527 	ht = (struct sta_rec_ht *)tlv;
1528 	ht->ht_cap = cpu_to_le16(link_sta->ht_cap.cap);
1529 }
1530 
1531 static void
1532 mt7925_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1533 {
1534 	struct sta_rec_vht *vht;
1535 	struct tlv *tlv;
1536 
1537 	/* For 6G band, this tlv is necessary to let hw work normally */
1538 	if (!link_sta->he_6ghz_capa.capa && !link_sta->vht_cap.vht_supported)
1539 		return;
1540 
1541 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1542 
1543 	vht = (struct sta_rec_vht *)tlv;
1544 	vht->vht_cap = cpu_to_le32(link_sta->vht_cap.cap);
1545 	vht->vht_rx_mcs_map = link_sta->vht_cap.vht_mcs.rx_mcs_map;
1546 	vht->vht_tx_mcs_map = link_sta->vht_cap.vht_mcs.tx_mcs_map;
1547 }
1548 
1549 static void
1550 mt7925_mcu_sta_amsdu_tlv(struct sk_buff *skb,
1551 			 struct ieee80211_vif *vif,
1552 			 struct ieee80211_link_sta *link_sta)
1553 {
1554 	struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1555 	struct mt792x_link_sta *mlink;
1556 	struct sta_rec_amsdu *amsdu;
1557 	struct tlv *tlv;
1558 
1559 	if (vif->type != NL80211_IFTYPE_STATION &&
1560 	    vif->type != NL80211_IFTYPE_AP)
1561 		return;
1562 
1563 	if (!link_sta->agg.max_amsdu_len)
1564 		return;
1565 
1566 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1567 	amsdu = (struct sta_rec_amsdu *)tlv;
1568 	amsdu->max_amsdu_num = 8;
1569 	amsdu->amsdu_en = true;
1570 
1571 	mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1572 	mlink->wcid.amsdu = true;
1573 
1574 	switch (link_sta->agg.max_amsdu_len) {
1575 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1576 		amsdu->max_mpdu_size =
1577 			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1578 		return;
1579 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
1580 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1581 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1582 		return;
1583 	default:
1584 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1585 		return;
1586 	}
1587 }
1588 
1589 static void
1590 mt7925_mcu_sta_phy_tlv(struct sk_buff *skb,
1591 		       struct ieee80211_vif *vif,
1592 		       struct ieee80211_link_sta *link_sta)
1593 {
1594 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1595 	struct ieee80211_bss_conf *link_conf;
1596 	struct cfg80211_chan_def *chandef;
1597 	struct mt792x_bss_conf *mconf;
1598 	struct sta_rec_phy *phy;
1599 	struct tlv *tlv;
1600 	u8 af = 0, mm = 0;
1601 
1602 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1603 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1604 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1605 				    &link_conf->chanreq.oper;
1606 
1607 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PHY, sizeof(*phy));
1608 	phy = (struct sta_rec_phy *)tlv;
1609 	phy->phy_type = mt76_connac_get_phy_mode_v2(mvif->phy->mt76, vif,
1610 						    chandef->chan->band,
1611 						    link_sta);
1612 	phy->basic_rate = cpu_to_le16((u16)link_conf->basic_rates);
1613 	if (link_sta->ht_cap.ht_supported) {
1614 		af = link_sta->ht_cap.ampdu_factor;
1615 		mm = link_sta->ht_cap.ampdu_density;
1616 	}
1617 
1618 	if (link_sta->vht_cap.vht_supported) {
1619 		u8 vht_af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1620 				      link_sta->vht_cap.cap);
1621 
1622 		af = max_t(u8, af, vht_af);
1623 	}
1624 
1625 	if (link_sta->he_6ghz_capa.capa) {
1626 		af = le16_get_bits(link_sta->he_6ghz_capa.capa,
1627 				   IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1628 		mm = le16_get_bits(link_sta->he_6ghz_capa.capa,
1629 				   IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
1630 	}
1631 
1632 	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR, af) |
1633 		     FIELD_PREP(IEEE80211_HT_AMPDU_PARM_DENSITY, mm);
1634 	phy->max_ampdu_len = af;
1635 }
1636 
1637 static void
1638 mt7925_mcu_sta_state_v2_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
1639 			    struct ieee80211_link_sta *link_sta,
1640 			    struct ieee80211_vif *vif,
1641 			    u8 rcpi, u8 sta_state)
1642 {
1643 	struct sta_rec_state_v2 {
1644 		__le16 tag;
1645 		__le16 len;
1646 		u8 state;
1647 		u8 rsv[3];
1648 		__le32 flags;
1649 		u8 vht_opmode;
1650 		u8 action;
1651 		u8 rsv2[2];
1652 	} __packed * state;
1653 	struct tlv *tlv;
1654 
1655 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_STATE, sizeof(*state));
1656 	state = (struct sta_rec_state_v2 *)tlv;
1657 	state->state = sta_state;
1658 
1659 	if (link_sta->vht_cap.vht_supported) {
1660 		state->vht_opmode = link_sta->bandwidth;
1661 		state->vht_opmode |= link_sta->rx_nss <<
1662 			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
1663 	}
1664 }
1665 
1666 static void
1667 mt7925_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb,
1668 			     struct ieee80211_vif *vif,
1669 			     struct ieee80211_link_sta *link_sta)
1670 {
1671 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1672 	struct ieee80211_bss_conf *link_conf;
1673 	struct cfg80211_chan_def *chandef;
1674 	struct sta_rec_ra_info *ra_info;
1675 	struct mt792x_bss_conf *mconf;
1676 	enum nl80211_band band;
1677 	struct tlv *tlv;
1678 	u16 supp_rates;
1679 
1680 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1681 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1682 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1683 				    &link_conf->chanreq.oper;
1684 	band = chandef->chan->band;
1685 
1686 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra_info));
1687 	ra_info = (struct sta_rec_ra_info *)tlv;
1688 
1689 	supp_rates = link_sta->supp_rates[band];
1690 	if (band == NL80211_BAND_2GHZ)
1691 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
1692 			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
1693 	else
1694 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates);
1695 
1696 	ra_info->legacy = cpu_to_le16(supp_rates);
1697 
1698 	if (link_sta->ht_cap.ht_supported)
1699 		memcpy(ra_info->rx_mcs_bitmask,
1700 		       link_sta->ht_cap.mcs.rx_mask,
1701 		       HT_MCS_MASK_NUM);
1702 }
1703 
1704 static void
1705 mt7925_mcu_sta_eht_mld_tlv(struct sk_buff *skb,
1706 			   struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1707 {
1708 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1709 	struct wiphy *wiphy = mvif->phy->mt76->hw->wiphy;
1710 	const struct wiphy_iftype_ext_capab *ext_capa;
1711 	struct sta_rec_eht_mld *eht_mld;
1712 	struct tlv *tlv;
1713 	u16 eml_cap;
1714 
1715 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT_MLD, sizeof(*eht_mld));
1716 	eht_mld = (struct sta_rec_eht_mld *)tlv;
1717 	eht_mld->mld_type = 0xff;
1718 
1719 	if (!ieee80211_vif_is_mld(vif))
1720 		return;
1721 
1722 	ext_capa = cfg80211_get_iftype_ext_capa(wiphy,
1723 						ieee80211_vif_type_p2p(vif));
1724 	if (!ext_capa)
1725 		return;
1726 
1727 	eml_cap = (vif->cfg.eml_cap & (IEEE80211_EML_CAP_EMLSR_SUPP |
1728 				       IEEE80211_EML_CAP_TRANSITION_TIMEOUT)) |
1729 		  (ext_capa->eml_capabilities & (IEEE80211_EML_CAP_EMLSR_PADDING_DELAY |
1730 						IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY));
1731 
1732 	if (eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP) {
1733 		eht_mld->eml_cap[0] = u16_get_bits(eml_cap, GENMASK(7, 0));
1734 		eht_mld->eml_cap[1] = u16_get_bits(eml_cap, GENMASK(15, 8));
1735 	} else {
1736 		eht_mld->str_cap[0] = BIT(1);
1737 	}
1738 }
1739 
1740 static void
1741 mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,
1742 		       struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1743 {
1744 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1745 	struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv;
1746 	unsigned long valid = mvif->valid_links;
1747 	struct mt792x_bss_conf *mconf;
1748 	struct mt792x_link_sta *mlink;
1749 	struct sta_rec_mld *mld;
1750 	struct tlv *tlv;
1751 	int i, cnt = 0;
1752 
1753 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MLD, sizeof(*mld));
1754 	mld = (struct sta_rec_mld *)tlv;
1755 	memcpy(mld->mac_addr, sta->addr, ETH_ALEN);
1756 	mld->primary_id = cpu_to_le16(msta->deflink.wcid.idx);
1757 	mld->wlan_id = cpu_to_le16(msta->deflink.wcid.idx);
1758 	mld->link_num = min_t(u8, hweight16(mvif->valid_links), 2);
1759 
1760 	for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
1761 		if (cnt == mld->link_num)
1762 			break;
1763 
1764 		mconf = mt792x_vif_to_link(mvif, i);
1765 		mlink = mt792x_sta_to_link(msta, i);
1766 		mld->link[cnt].wlan_id = cpu_to_le16(mlink->wcid.idx);
1767 		mld->link[cnt++].bss_idx = mconf->mt76.idx;
1768 
1769 		if (mlink != &msta->deflink)
1770 			mld->secondary_id = cpu_to_le16(mlink->wcid.idx);
1771 	}
1772 }
1773 
1774 static int
1775 mt7925_mcu_sta_cmd(struct mt76_phy *phy,
1776 		   struct mt76_sta_cmd_info *info)
1777 {
1778 	struct mt76_vif *mvif = (struct mt76_vif *)info->vif->drv_priv;
1779 	struct mt76_dev *dev = phy->dev;
1780 	struct sk_buff *skb;
1781 	int conn_state;
1782 
1783 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, info->wcid,
1784 					      MT7925_STA_UPDATE_MAX_SIZE);
1785 	if (IS_ERR(skb))
1786 		return PTR_ERR(skb);
1787 
1788 	conn_state = info->enable ? CONN_STATE_PORT_SECURE :
1789 				    CONN_STATE_DISCONNECT;
1790 	if (info->link_sta)
1791 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif,
1792 					      info->link_sta,
1793 					      conn_state, info->newly);
1794 	if (info->link_sta && info->enable) {
1795 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1796 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1797 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1798 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1799 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1800 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1801 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1802 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1803 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1804 					     info->link_sta);
1805 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1806 					    info->vif, info->rcpi,
1807 					    info->state);
1808 		mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1809 	}
1810 
1811 	if (info->enable)
1812 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
1813 
1814 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1815 }
1816 
1817 static void
1818 mt7925_mcu_sta_remove_tlv(struct sk_buff *skb)
1819 {
1820 	struct sta_rec_remove *rem;
1821 	struct tlv *tlv;
1822 
1823 	tlv = mt76_connac_mcu_add_tlv(skb, 0x25, sizeof(*rem));
1824 	rem = (struct sta_rec_remove *)tlv;
1825 	rem->action = 0;
1826 }
1827 
1828 static int
1829 mt7925_mcu_mlo_sta_cmd(struct mt76_phy *phy,
1830 		       struct mt76_sta_cmd_info *info)
1831 {
1832 	struct mt792x_vif *mvif = (struct mt792x_vif *)info->vif->drv_priv;
1833 	struct mt76_dev *dev = phy->dev;
1834 	struct mt792x_bss_conf *mconf;
1835 	struct sk_buff *skb;
1836 
1837 	mconf = mt792x_vif_to_link(mvif, info->wcid->link_id);
1838 
1839 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, info->wcid,
1840 					      MT7925_STA_UPDATE_MAX_SIZE);
1841 	if (IS_ERR(skb))
1842 		return PTR_ERR(skb);
1843 
1844 	if (info->enable)
1845 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif,
1846 					      info->link_sta,
1847 					      info->enable, info->newly);
1848 
1849 	if (info->enable && info->link_sta) {
1850 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1851 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1852 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1853 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1854 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1855 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1856 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1857 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1858 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1859 					     info->link_sta);
1860 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1861 					    info->vif, info->rcpi,
1862 					    info->state);
1863 
1864 		if (info->state != MT76_STA_INFO_STATE_NONE) {
1865 			mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1866 			mt7925_mcu_sta_eht_mld_tlv(skb, info->vif, info->link_sta->sta);
1867 		}
1868 
1869 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
1870 	}
1871 
1872 	if (!info->enable) {
1873 		mt7925_mcu_sta_remove_tlv(skb);
1874 		mt76_connac_mcu_add_tlv(skb, STA_REC_MLD_OFF,
1875 					sizeof(struct tlv));
1876 	}
1877 
1878 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1879 }
1880 
1881 int mt7925_mcu_sta_update(struct mt792x_dev *dev,
1882 			  struct ieee80211_link_sta *link_sta,
1883 			  struct ieee80211_vif *vif, bool enable,
1884 			  enum mt76_sta_info_state state)
1885 {
1886 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1887 	int rssi = -ewma_rssi_read(&mvif->bss_conf.rssi);
1888 	struct mt76_sta_cmd_info info = {
1889 		.link_sta = link_sta,
1890 		.vif = vif,
1891 		.enable = enable,
1892 		.cmd = MCU_UNI_CMD(STA_REC_UPDATE),
1893 		.state = state,
1894 		.offload_fw = true,
1895 		.rcpi = to_rcpi(rssi),
1896 	};
1897 	struct mt792x_sta *msta;
1898 	struct mt792x_link_sta *mlink;
1899 	int err;
1900 
1901 	if (link_sta) {
1902 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1903 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1904 	}
1905 	info.wcid = link_sta ? &mlink->wcid : &mvif->sta.deflink.wcid;
1906 
1907 	if (link_sta)
1908 		info.newly = state != MT76_STA_INFO_STATE_ASSOC;
1909 	else
1910 		info.newly = state == MT76_STA_INFO_STATE_ASSOC ? false : true;
1911 
1912 	if (ieee80211_vif_is_mld(vif))
1913 		err = mt7925_mcu_mlo_sta_cmd(&dev->mphy, &info);
1914 	else
1915 		err = mt7925_mcu_sta_cmd(&dev->mphy, &info);
1916 
1917 	return err;
1918 }
1919 
1920 int mt7925_mcu_set_beacon_filter(struct mt792x_dev *dev,
1921 				 struct ieee80211_vif *vif,
1922 				 bool enable)
1923 {
1924 #define MT7925_FIF_BIT_CLR		BIT(1)
1925 #define MT7925_FIF_BIT_SET		BIT(0)
1926 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1927 	unsigned long valid = ieee80211_vif_is_mld(vif) ?
1928 				      mvif->valid_links : BIT(0);
1929 	struct ieee80211_bss_conf *bss_conf;
1930 	int err = 0;
1931 	int i;
1932 
1933 	if (enable) {
1934 		for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
1935 			bss_conf = mt792x_vif_to_bss_conf(vif, i);
1936 			err = mt7925_mcu_uni_bss_bcnft(dev, bss_conf, true);
1937 			if (err < 0)
1938 				return err;
1939 		}
1940 
1941 		return mt7925_mcu_set_rxfilter(dev, 0,
1942 					       MT7925_FIF_BIT_SET,
1943 					       MT_WF_RFCR_DROP_OTHER_BEACON);
1944 	}
1945 
1946 	for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
1947 		bss_conf = mt792x_vif_to_bss_conf(vif, i);
1948 		err = mt7925_mcu_set_bss_pm(dev, bss_conf, false);
1949 		if (err)
1950 			return err;
1951 	}
1952 
1953 	return mt7925_mcu_set_rxfilter(dev, 0,
1954 				       MT7925_FIF_BIT_CLR,
1955 				       MT_WF_RFCR_DROP_OTHER_BEACON);
1956 }
1957 
1958 int mt7925_get_txpwr_info(struct mt792x_dev *dev, u8 band_idx, struct mt7925_txpwr *txpwr)
1959 {
1960 #define TX_POWER_SHOW_INFO 0x7
1961 #define TXPOWER_ALL_RATE_POWER_INFO 0x2
1962 	struct mt7925_txpwr_event *event;
1963 	struct mt7925_txpwr_req req = {
1964 		.tag = cpu_to_le16(TX_POWER_SHOW_INFO),
1965 		.len = cpu_to_le16(sizeof(req) - 4),
1966 		.catg = TXPOWER_ALL_RATE_POWER_INFO,
1967 		.band_idx = band_idx,
1968 	};
1969 	struct sk_buff *skb;
1970 	int ret;
1971 
1972 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(TXPOWER),
1973 					&req, sizeof(req), true, &skb);
1974 	if (ret)
1975 		return ret;
1976 
1977 	event = (struct mt7925_txpwr_event *)skb->data;
1978 	memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
1979 
1980 	dev_kfree_skb(skb);
1981 
1982 	return 0;
1983 }
1984 
1985 int mt7925_mcu_set_sniffer(struct mt792x_dev *dev, struct ieee80211_vif *vif,
1986 			   bool enable)
1987 {
1988 	struct {
1989 		struct {
1990 			u8 band_idx;
1991 			u8 pad[3];
1992 		} __packed hdr;
1993 		struct sniffer_enable_tlv {
1994 			__le16 tag;
1995 			__le16 len;
1996 			u8 enable;
1997 			u8 pad[3];
1998 		} __packed enable;
1999 	} __packed req = {
2000 		.hdr = {
2001 			.band_idx = 0,
2002 		},
2003 		.enable = {
2004 			.tag = cpu_to_le16(UNI_SNIFFER_ENABLE),
2005 			.len = cpu_to_le16(sizeof(struct sniffer_enable_tlv)),
2006 			.enable = enable,
2007 		},
2008 	};
2009 
2010 	mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req), true);
2011 
2012 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req),
2013 				 true);
2014 }
2015 
2016 int mt7925_mcu_config_sniffer(struct mt792x_vif *vif,
2017 			      struct ieee80211_chanctx_conf *ctx)
2018 {
2019 	struct mt76_phy *mphy = vif->phy->mt76;
2020 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def : &mphy->chandef;
2021 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2022 
2023 	static const u8 ch_band[] = {
2024 		[NL80211_BAND_2GHZ] = 1,
2025 		[NL80211_BAND_5GHZ] = 2,
2026 		[NL80211_BAND_6GHZ] = 3,
2027 	};
2028 	static const u8 ch_width[] = {
2029 		[NL80211_CHAN_WIDTH_20_NOHT] = 0,
2030 		[NL80211_CHAN_WIDTH_20] = 0,
2031 		[NL80211_CHAN_WIDTH_40] = 0,
2032 		[NL80211_CHAN_WIDTH_80] = 1,
2033 		[NL80211_CHAN_WIDTH_160] = 2,
2034 		[NL80211_CHAN_WIDTH_80P80] = 3,
2035 		[NL80211_CHAN_WIDTH_5] = 4,
2036 		[NL80211_CHAN_WIDTH_10] = 5,
2037 		[NL80211_CHAN_WIDTH_320] = 6,
2038 	};
2039 
2040 	struct {
2041 		struct {
2042 			u8 band_idx;
2043 			u8 pad[3];
2044 		} __packed hdr;
2045 		struct config_tlv {
2046 			__le16 tag;
2047 			__le16 len;
2048 			u16 aid;
2049 			u8 ch_band;
2050 			u8 bw;
2051 			u8 control_ch;
2052 			u8 sco;
2053 			u8 center_ch;
2054 			u8 center_ch2;
2055 			u8 drop_err;
2056 			u8 pad[3];
2057 		} __packed tlv;
2058 	} __packed req = {
2059 		.hdr = {
2060 			.band_idx = 0,
2061 		},
2062 		.tlv = {
2063 			.tag = cpu_to_le16(UNI_SNIFFER_CONFIG),
2064 			.len = cpu_to_le16(sizeof(req.tlv)),
2065 			.control_ch = chandef->chan->hw_value,
2066 			.center_ch = ieee80211_frequency_to_channel(freq1),
2067 			.drop_err = 1,
2068 		},
2069 	};
2070 
2071 	if (chandef->chan->band < ARRAY_SIZE(ch_band))
2072 		req.tlv.ch_band = ch_band[chandef->chan->band];
2073 	if (chandef->width < ARRAY_SIZE(ch_width))
2074 		req.tlv.bw = ch_width[chandef->width];
2075 
2076 	if (freq2)
2077 		req.tlv.center_ch2 = ieee80211_frequency_to_channel(freq2);
2078 
2079 	if (req.tlv.control_ch < req.tlv.center_ch)
2080 		req.tlv.sco = 1; /* SCA */
2081 	else if (req.tlv.control_ch > req.tlv.center_ch)
2082 		req.tlv.sco = 3; /* SCB */
2083 
2084 	return mt76_mcu_send_msg(mphy->dev, MCU_UNI_CMD(SNIFFER),
2085 				 &req, sizeof(req), true);
2086 }
2087 
2088 int
2089 mt7925_mcu_uni_add_beacon_offload(struct mt792x_dev *dev,
2090 				  struct ieee80211_hw *hw,
2091 				  struct ieee80211_vif *vif,
2092 				  bool enable)
2093 {
2094 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
2095 	struct ieee80211_mutable_offsets offs;
2096 	struct {
2097 		struct req_hdr {
2098 			u8 bss_idx;
2099 			u8 pad[3];
2100 		} __packed hdr;
2101 		struct bcn_content_tlv {
2102 			__le16 tag;
2103 			__le16 len;
2104 			__le16 tim_ie_pos;
2105 			__le16 csa_ie_pos;
2106 			__le16 bcc_ie_pos;
2107 			/* 0: disable beacon offload
2108 			 * 1: enable beacon offload
2109 			 * 2: update probe respond offload
2110 			 */
2111 			u8 enable;
2112 			/* 0: legacy format (TXD + payload)
2113 			 * 1: only cap field IE
2114 			 */
2115 			u8 type;
2116 			__le16 pkt_len;
2117 			u8 pkt[512];
2118 		} __packed beacon_tlv;
2119 	} req = {
2120 		.hdr = {
2121 			.bss_idx = mvif->bss_conf.mt76.idx,
2122 		},
2123 		.beacon_tlv = {
2124 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
2125 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
2126 			.enable = enable,
2127 			.type = 1,
2128 		},
2129 	};
2130 	struct sk_buff *skb;
2131 	u8 cap_offs;
2132 
2133 	/* support enable/update process only
2134 	 * disable flow would be handled in bss stop handler automatically
2135 	 */
2136 	if (!enable)
2137 		return -EOPNOTSUPP;
2138 
2139 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs, 0);
2140 	if (!skb)
2141 		return -EINVAL;
2142 
2143 	cap_offs = offsetof(struct ieee80211_mgmt, u.beacon.capab_info);
2144 	if (!skb_pull(skb, cap_offs)) {
2145 		dev_err(dev->mt76.dev, "beacon format err\n");
2146 		dev_kfree_skb(skb);
2147 		return -EINVAL;
2148 	}
2149 
2150 	if (skb->len > 512) {
2151 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
2152 		dev_kfree_skb(skb);
2153 		return -EINVAL;
2154 	}
2155 
2156 	memcpy(req.beacon_tlv.pkt, skb->data, skb->len);
2157 	req.beacon_tlv.pkt_len = cpu_to_le16(skb->len);
2158 	offs.tim_offset -= cap_offs;
2159 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(offs.tim_offset);
2160 
2161 	if (offs.cntdwn_counter_offs[0]) {
2162 		u16 csa_offs;
2163 
2164 		csa_offs = offs.cntdwn_counter_offs[0] - cap_offs - 4;
2165 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
2166 	}
2167 	dev_kfree_skb(skb);
2168 
2169 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
2170 				 &req, sizeof(req), true);
2171 }
2172 
2173 static
2174 void mt7925_mcu_bss_rlm_tlv(struct sk_buff *skb, struct mt76_phy *phy,
2175 			    struct ieee80211_bss_conf *link_conf,
2176 			    struct ieee80211_chanctx_conf *ctx)
2177 {
2178 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2179 						  &link_conf->chanreq.oper;
2180 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2181 	enum nl80211_band band = chandef->chan->band;
2182 	struct bss_rlm_tlv *req;
2183 	struct tlv *tlv;
2184 
2185 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RLM, sizeof(*req));
2186 	req = (struct bss_rlm_tlv *)tlv;
2187 	req->control_channel = chandef->chan->hw_value;
2188 	req->center_chan = ieee80211_frequency_to_channel(freq1);
2189 	req->center_chan2 = 0;
2190 	req->tx_streams = hweight8(phy->antenna_mask);
2191 	req->ht_op_info = 4; /* set HT 40M allowed */
2192 	req->rx_streams = hweight8(phy->antenna_mask);
2193 	req->center_chan2 = 0;
2194 	req->sco = 0;
2195 	req->band = 1;
2196 
2197 	switch (band) {
2198 	case NL80211_BAND_2GHZ:
2199 		req->band = 1;
2200 		break;
2201 	case NL80211_BAND_5GHZ:
2202 		req->band = 2;
2203 		break;
2204 	case NL80211_BAND_6GHZ:
2205 		req->band = 3;
2206 		break;
2207 	default:
2208 		break;
2209 	}
2210 
2211 	switch (chandef->width) {
2212 	case NL80211_CHAN_WIDTH_40:
2213 		req->bw = CMD_CBW_40MHZ;
2214 		break;
2215 	case NL80211_CHAN_WIDTH_80:
2216 		req->bw = CMD_CBW_80MHZ;
2217 		break;
2218 	case NL80211_CHAN_WIDTH_80P80:
2219 		req->bw = CMD_CBW_8080MHZ;
2220 		req->center_chan2 = ieee80211_frequency_to_channel(freq2);
2221 		break;
2222 	case NL80211_CHAN_WIDTH_160:
2223 		req->bw = CMD_CBW_160MHZ;
2224 		break;
2225 	case NL80211_CHAN_WIDTH_5:
2226 		req->bw = CMD_CBW_5MHZ;
2227 		break;
2228 	case NL80211_CHAN_WIDTH_10:
2229 		req->bw = CMD_CBW_10MHZ;
2230 		break;
2231 	case NL80211_CHAN_WIDTH_20_NOHT:
2232 	case NL80211_CHAN_WIDTH_20:
2233 	default:
2234 		req->bw = CMD_CBW_20MHZ;
2235 		req->ht_op_info = 0;
2236 		break;
2237 	}
2238 
2239 	if (req->control_channel < req->center_chan)
2240 		req->sco = 1; /* SCA */
2241 	else if (req->control_channel > req->center_chan)
2242 		req->sco = 3; /* SCB */
2243 }
2244 
2245 static struct sk_buff *
2246 __mt7925_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
2247 {
2248 	struct bss_req_hdr hdr = {
2249 		.bss_idx = mvif->idx,
2250 	};
2251 	struct sk_buff *skb;
2252 
2253 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
2254 	if (!skb)
2255 		return ERR_PTR(-ENOMEM);
2256 
2257 	skb_put_data(skb, &hdr, sizeof(hdr));
2258 
2259 	return skb;
2260 }
2261 
2262 int mt7925_mcu_set_chctx(struct mt76_phy *phy, struct mt76_vif *mvif,
2263 			 struct ieee80211_bss_conf *link_conf,
2264 			 struct ieee80211_chanctx_conf *ctx)
2265 {
2266 	struct sk_buff *skb;
2267 
2268 	skb = __mt7925_mcu_alloc_bss_req(phy->dev, mvif,
2269 					 MT7925_BSS_UPDATE_MAX_SIZE);
2270 	if (IS_ERR(skb))
2271 		return PTR_ERR(skb);
2272 
2273 	mt7925_mcu_bss_rlm_tlv(skb, phy, link_conf, ctx);
2274 
2275 	return mt76_mcu_skb_send_msg(phy->dev, skb,
2276 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2277 }
2278 
2279 static u8
2280 mt7925_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
2281 			enum nl80211_band band,
2282 			struct ieee80211_link_sta *link_sta)
2283 {
2284 	struct ieee80211_he_6ghz_capa *he_6ghz_capa;
2285 	const struct ieee80211_sta_eht_cap *eht_cap;
2286 	__le16 capa = 0;
2287 	u8 mode = 0;
2288 
2289 	if (link_sta) {
2290 		he_6ghz_capa = &link_sta->he_6ghz_capa;
2291 		eht_cap = &link_sta->eht_cap;
2292 	} else {
2293 		struct ieee80211_supported_band *sband;
2294 
2295 		sband = phy->hw->wiphy->bands[band];
2296 		capa = ieee80211_get_he_6ghz_capa(sband, vif->type);
2297 		he_6ghz_capa = (struct ieee80211_he_6ghz_capa *)&capa;
2298 
2299 		eht_cap = ieee80211_get_eht_iftype_cap(sband, vif->type);
2300 	}
2301 
2302 	switch (band) {
2303 	case NL80211_BAND_2GHZ:
2304 		if (eht_cap && eht_cap->has_eht)
2305 			mode |= PHY_MODE_BE_24G;
2306 		break;
2307 	case NL80211_BAND_5GHZ:
2308 		if (eht_cap && eht_cap->has_eht)
2309 			mode |= PHY_MODE_BE_5G;
2310 		break;
2311 	case NL80211_BAND_6GHZ:
2312 		if (he_6ghz_capa && he_6ghz_capa->capa)
2313 			mode |= PHY_MODE_AX_6G;
2314 
2315 		if (eht_cap && eht_cap->has_eht)
2316 			mode |= PHY_MODE_BE_6G;
2317 		break;
2318 	default:
2319 		break;
2320 	}
2321 
2322 	return mode;
2323 }
2324 
2325 static void
2326 mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
2327 			 struct ieee80211_bss_conf *link_conf,
2328 			 struct ieee80211_link_sta *link_sta,
2329 			 struct ieee80211_chanctx_conf *ctx,
2330 			 struct mt76_phy *phy, u16 wlan_idx,
2331 			 bool enable)
2332 {
2333 	struct ieee80211_vif *vif = link_conf->vif;
2334 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2335 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2336 						  &link_conf->chanreq.oper;
2337 	enum nl80211_band band = chandef->chan->band;
2338 	struct mt76_connac_bss_basic_tlv *basic_req;
2339 	struct mt792x_link_sta *mlink;
2340 	struct tlv *tlv;
2341 	int conn_type;
2342 	u8 idx;
2343 
2344 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*basic_req));
2345 	basic_req = (struct mt76_connac_bss_basic_tlv *)tlv;
2346 
2347 	idx = mconf->mt76.omac_idx > EXT_BSSID_START ? HW_BSSID_0 :
2348 						      mconf->mt76.omac_idx;
2349 	basic_req->hw_bss_idx = idx;
2350 
2351 	basic_req->phymode_ext = mt7925_get_phy_mode_ext(phy, vif, band,
2352 							 link_sta);
2353 
2354 	if (band == NL80211_BAND_2GHZ)
2355 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_ERP_INDEX);
2356 	else
2357 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_OFDM_INDEX);
2358 
2359 	memcpy(basic_req->bssid, link_conf->bssid, ETH_ALEN);
2360 	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, link_sta);
2361 	basic_req->bcn_interval = cpu_to_le16(link_conf->beacon_int);
2362 	basic_req->dtim_period = link_conf->dtim_period;
2363 	basic_req->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
2364 	basic_req->link_idx = mconf->mt76.idx;
2365 
2366 	if (link_sta) {
2367 		struct mt792x_sta *msta;
2368 
2369 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
2370 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
2371 
2372 	} else {
2373 		mlink = &mconf->vif->sta.deflink;
2374 	}
2375 
2376 	basic_req->sta_idx = cpu_to_le16(mlink->wcid.idx);
2377 	basic_req->omac_idx = mconf->mt76.omac_idx;
2378 	basic_req->band_idx = mconf->mt76.band_idx;
2379 	basic_req->wmm_idx = mconf->mt76.wmm_idx;
2380 	basic_req->conn_state = !enable;
2381 
2382 	switch (vif->type) {
2383 	case NL80211_IFTYPE_MESH_POINT:
2384 	case NL80211_IFTYPE_AP:
2385 		if (vif->p2p)
2386 			conn_type = CONNECTION_P2P_GO;
2387 		else
2388 			conn_type = CONNECTION_INFRA_AP;
2389 		basic_req->conn_type = cpu_to_le32(conn_type);
2390 		basic_req->active = enable;
2391 		break;
2392 	case NL80211_IFTYPE_STATION:
2393 		if (vif->p2p)
2394 			conn_type = CONNECTION_P2P_GC;
2395 		else
2396 			conn_type = CONNECTION_INFRA_STA;
2397 		basic_req->conn_type = cpu_to_le32(conn_type);
2398 		basic_req->active = true;
2399 		break;
2400 	case NL80211_IFTYPE_ADHOC:
2401 		basic_req->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
2402 		basic_req->active = true;
2403 		break;
2404 	default:
2405 		WARN_ON(1);
2406 		break;
2407 	}
2408 }
2409 
2410 static void
2411 mt7925_mcu_bss_sec_tlv(struct sk_buff *skb,
2412 		       struct ieee80211_bss_conf *link_conf)
2413 {
2414 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2415 	struct mt76_vif *mvif = &mconf->mt76;
2416 	struct bss_sec_tlv {
2417 		__le16 tag;
2418 		__le16 len;
2419 		u8 mode;
2420 		u8 status;
2421 		u8 cipher;
2422 		u8 __rsv;
2423 	} __packed * sec;
2424 	struct tlv *tlv;
2425 
2426 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_SEC, sizeof(*sec));
2427 	sec = (struct bss_sec_tlv *)tlv;
2428 
2429 	switch (mvif->cipher) {
2430 	case CONNAC3_CIPHER_GCMP_256:
2431 	case CONNAC3_CIPHER_GCMP:
2432 		sec->mode = MODE_WPA3_SAE;
2433 		sec->status = 8;
2434 		break;
2435 	case CONNAC3_CIPHER_AES_CCMP:
2436 		sec->mode = MODE_WPA2_PSK;
2437 		sec->status = 6;
2438 		break;
2439 	case CONNAC3_CIPHER_TKIP:
2440 		sec->mode = MODE_WPA2_PSK;
2441 		sec->status = 4;
2442 		break;
2443 	case CONNAC3_CIPHER_WEP104:
2444 	case CONNAC3_CIPHER_WEP40:
2445 		sec->mode = MODE_SHARED;
2446 		sec->status = 0;
2447 		break;
2448 	default:
2449 		sec->mode = MODE_OPEN;
2450 		sec->status = 1;
2451 		break;
2452 	}
2453 
2454 	sec->cipher = mvif->cipher;
2455 }
2456 
2457 static void
2458 mt7925_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt792x_phy *phy,
2459 		       struct ieee80211_chanctx_conf *ctx,
2460 		       struct ieee80211_bss_conf *link_conf)
2461 {
2462 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2463 						  &link_conf->chanreq.oper;
2464 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2465 	enum nl80211_band band = chandef->chan->band;
2466 	struct mt76_vif *mvif = &mconf->mt76;
2467 	struct bss_rate_tlv *bmc;
2468 	struct tlv *tlv;
2469 	u8 idx = mvif->mcast_rates_idx ?
2470 		 mvif->mcast_rates_idx : mvif->basic_rates_idx;
2471 
2472 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RATE, sizeof(*bmc));
2473 
2474 	bmc = (struct bss_rate_tlv *)tlv;
2475 
2476 	if (band == NL80211_BAND_2GHZ)
2477 		bmc->basic_rate = cpu_to_le16(HR_DSSS_ERP_BASIC_RATE);
2478 	else
2479 		bmc->basic_rate = cpu_to_le16(OFDM_BASIC_RATE);
2480 
2481 	bmc->short_preamble = (band == NL80211_BAND_2GHZ);
2482 	bmc->bc_fixed_rate = idx;
2483 	bmc->mc_fixed_rate = idx;
2484 }
2485 
2486 static void
2487 mt7925_mcu_bss_mld_tlv(struct sk_buff *skb,
2488 		       struct ieee80211_bss_conf *link_conf)
2489 {
2490 	struct ieee80211_vif *vif = link_conf->vif;
2491 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2492 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2493 	struct bss_mld_tlv *mld;
2494 	struct tlv *tlv;
2495 	bool is_mld;
2496 
2497 	is_mld = ieee80211_vif_is_mld(link_conf->vif) ||
2498 		 (hweight16(mvif->valid_links) > 1);
2499 
2500 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_MLD, sizeof(*mld));
2501 	mld = (struct bss_mld_tlv *)tlv;
2502 
2503 	mld->link_id = is_mld ? link_conf->link_id : 0xff;
2504 	/* apply the index of the primary link */
2505 	mld->group_mld_id = is_mld ? mvif->bss_conf.mt76.idx : 0xff;
2506 	mld->own_mld_id = mconf->mt76.idx + 32;
2507 	mld->remap_idx = 0xff;
2508 	mld->eml_enable = !!(link_conf->vif->cfg.eml_cap &
2509 			     IEEE80211_EML_CAP_EMLSR_SUPP);
2510 
2511 	memcpy(mld->mac_addr, vif->addr, ETH_ALEN);
2512 }
2513 
2514 static void
2515 mt7925_mcu_bss_qos_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf)
2516 {
2517 	struct mt76_connac_bss_qos_tlv *qos;
2518 	struct tlv *tlv;
2519 
2520 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_QBSS, sizeof(*qos));
2521 	qos = (struct mt76_connac_bss_qos_tlv *)tlv;
2522 	qos->qos = link_conf->qos;
2523 }
2524 
2525 static void
2526 mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2527 		      struct mt792x_phy *phy)
2528 {
2529 #define DEFAULT_HE_PE_DURATION		4
2530 #define DEFAULT_HE_DURATION_RTS_THRES	1023
2531 	const struct ieee80211_sta_he_cap *cap;
2532 	struct bss_info_uni_he *he;
2533 	struct tlv *tlv;
2534 
2535 	cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
2536 
2537 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
2538 
2539 	he = (struct bss_info_uni_he *)tlv;
2540 	he->he_pe_duration = link_conf->htc_trig_based_pkt_ext;
2541 	if (!he->he_pe_duration)
2542 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
2543 
2544 	he->he_rts_thres = cpu_to_le16(link_conf->frame_time_rts_th);
2545 	if (!he->he_rts_thres)
2546 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
2547 
2548 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
2549 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
2550 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
2551 }
2552 
2553 static void
2554 mt7925_mcu_bss_color_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2555 			 bool enable)
2556 {
2557 	struct bss_info_uni_bss_color *color;
2558 	struct tlv *tlv;
2559 
2560 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BSS_COLOR, sizeof(*color));
2561 	color = (struct bss_info_uni_bss_color *)tlv;
2562 
2563 	color->enable = enable ?
2564 		link_conf->he_bss_color.enabled : 0;
2565 	color->bss_color = enable ?
2566 		link_conf->he_bss_color.color : 0;
2567 }
2568 
2569 static void
2570 mt7925_mcu_bss_ifs_tlv(struct sk_buff *skb,
2571 		       struct ieee80211_bss_conf *link_conf)
2572 {
2573 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2574 	struct mt792x_phy *phy = mvif->phy;
2575 	struct bss_ifs_time_tlv *ifs_time;
2576 	struct tlv *tlv;
2577 
2578 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_IFS_TIME, sizeof(*ifs_time));
2579 	ifs_time = (struct bss_ifs_time_tlv *)tlv;
2580 	ifs_time->slot_valid = true;
2581 	ifs_time->slot_time = cpu_to_le16(phy->slottime);
2582 }
2583 
2584 int mt7925_mcu_set_timing(struct mt792x_phy *phy,
2585 			  struct ieee80211_bss_conf *link_conf)
2586 {
2587 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2588 	struct mt792x_dev *dev = phy->dev;
2589 	struct sk_buff *skb;
2590 
2591 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2592 					 MT7925_BSS_UPDATE_MAX_SIZE);
2593 	if (IS_ERR(skb))
2594 		return PTR_ERR(skb);
2595 
2596 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2597 
2598 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2599 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2600 }
2601 
2602 int mt7925_mcu_add_bss_info(struct mt792x_phy *phy,
2603 			    struct ieee80211_chanctx_conf *ctx,
2604 			    struct ieee80211_bss_conf *link_conf,
2605 			    struct ieee80211_link_sta *link_sta,
2606 			    int enable)
2607 {
2608 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2609 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2610 	struct mt792x_dev *dev = phy->dev;
2611 	struct mt792x_link_sta *mlink_bc;
2612 	struct sk_buff *skb;
2613 
2614 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2615 					 MT7925_BSS_UPDATE_MAX_SIZE);
2616 	if (IS_ERR(skb))
2617 		return PTR_ERR(skb);
2618 
2619 	mlink_bc = mt792x_sta_to_link(&mvif->sta, mconf->link_id);
2620 
2621 	/* bss_basic must be first */
2622 	mt7925_mcu_bss_basic_tlv(skb, link_conf, link_sta, ctx, phy->mt76,
2623 				 mlink_bc->wcid.idx, enable);
2624 	mt7925_mcu_bss_sec_tlv(skb, link_conf);
2625 	mt7925_mcu_bss_bmc_tlv(skb, phy, ctx, link_conf);
2626 	mt7925_mcu_bss_qos_tlv(skb, link_conf);
2627 	mt7925_mcu_bss_mld_tlv(skb, link_conf);
2628 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2629 
2630 	if (link_conf->he_support) {
2631 		mt7925_mcu_bss_he_tlv(skb, link_conf, phy);
2632 		mt7925_mcu_bss_color_tlv(skb, link_conf, enable);
2633 	}
2634 
2635 	if (enable)
2636 		mt7925_mcu_bss_rlm_tlv(skb, phy->mt76, link_conf, ctx);
2637 
2638 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2639 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2640 }
2641 
2642 int mt7925_mcu_set_dbdc(struct mt76_phy *phy)
2643 {
2644 	struct mt76_dev *mdev = phy->dev;
2645 
2646 	struct mbmc_conf_tlv *conf;
2647 	struct mbmc_set_req *hdr;
2648 	struct sk_buff *skb;
2649 	struct tlv *tlv;
2650 	int max_len, err;
2651 
2652 	max_len = sizeof(*hdr) + sizeof(*conf);
2653 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2654 	if (!skb)
2655 		return -ENOMEM;
2656 
2657 	hdr = (struct mbmc_set_req *)skb_put(skb, sizeof(*hdr));
2658 
2659 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_MBMC_SETTING, sizeof(*conf));
2660 	conf = (struct mbmc_conf_tlv *)tlv;
2661 
2662 	conf->mbmc_en = 1;
2663 	conf->band = 0; /* unused */
2664 
2665 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SET_DBDC_PARMS),
2666 				    false);
2667 
2668 	return err;
2669 }
2670 
2671 #define MT76_CONNAC_SCAN_CHANNEL_TIME		60
2672 
2673 int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
2674 		       struct ieee80211_scan_request *scan_req)
2675 {
2676 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2677 	struct cfg80211_scan_request *sreq = &scan_req->req;
2678 	int n_ssids = 0, err, i, duration;
2679 	struct ieee80211_channel **scan_list = sreq->channels;
2680 	struct mt76_dev *mdev = phy->dev;
2681 	struct mt76_connac_mcu_scan_channel *chan;
2682 	struct sk_buff *skb;
2683 
2684 	struct scan_hdr_tlv *hdr;
2685 	struct scan_req_tlv *req;
2686 	struct scan_ssid_tlv *ssid;
2687 	struct scan_bssid_tlv *bssid;
2688 	struct scan_chan_info_tlv *chan_info;
2689 	struct scan_ie_tlv *ie;
2690 	struct scan_misc_tlv *misc;
2691 	struct tlv *tlv;
2692 	int max_len;
2693 
2694 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2695 				sizeof(*bssid) + sizeof(*chan_info) +
2696 				sizeof(*misc) + sizeof(*ie);
2697 
2698 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2699 	if (!skb)
2700 		return -ENOMEM;
2701 
2702 	set_bit(MT76_HW_SCANNING, &phy->state);
2703 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2704 
2705 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2706 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2707 	hdr->bss_idx = mvif->idx;
2708 
2709 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_REQ, sizeof(*req));
2710 	req = (struct scan_req_tlv *)tlv;
2711 	req->scan_type = sreq->n_ssids ? 1 : 0;
2712 	req->probe_req_num = sreq->n_ssids ? 2 : 0;
2713 
2714 	duration = MT76_CONNAC_SCAN_CHANNEL_TIME;
2715 	/* increase channel time for passive scan */
2716 	if (!sreq->n_ssids)
2717 		duration *= 2;
2718 	req->timeout_value = cpu_to_le16(sreq->n_channels * duration);
2719 	req->channel_min_dwell_time = cpu_to_le16(duration);
2720 	req->channel_dwell_time = cpu_to_le16(duration);
2721 
2722 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2723 	ssid = (struct scan_ssid_tlv *)tlv;
2724 	for (i = 0; i < sreq->n_ssids; i++) {
2725 		if (!sreq->ssids[i].ssid_len)
2726 			continue;
2727 
2728 		ssid->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
2729 		memcpy(ssid->ssids[i].ssid, sreq->ssids[i].ssid,
2730 		       sreq->ssids[i].ssid_len);
2731 		n_ssids++;
2732 	}
2733 	ssid->ssid_type = n_ssids ? BIT(2) : BIT(0);
2734 	ssid->ssids_num = n_ssids;
2735 
2736 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_BSSID, sizeof(*bssid));
2737 	bssid = (struct scan_bssid_tlv *)tlv;
2738 
2739 	memcpy(bssid->bssid, sreq->bssid, ETH_ALEN);
2740 
2741 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
2742 	chan_info = (struct scan_chan_info_tlv *)tlv;
2743 	chan_info->channels_num = min_t(u8, sreq->n_channels,
2744 					ARRAY_SIZE(chan_info->channels));
2745 	for (i = 0; i < chan_info->channels_num; i++) {
2746 		chan = &chan_info->channels[i];
2747 
2748 		switch (scan_list[i]->band) {
2749 		case NL80211_BAND_2GHZ:
2750 			chan->band = 1;
2751 			break;
2752 		case NL80211_BAND_6GHZ:
2753 			chan->band = 3;
2754 			break;
2755 		default:
2756 			chan->band = 2;
2757 			break;
2758 		}
2759 		chan->channel_num = scan_list[i]->hw_value;
2760 	}
2761 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
2762 
2763 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
2764 	ie = (struct scan_ie_tlv *)tlv;
2765 	if (sreq->ie_len > 0) {
2766 		memcpy(ie->ies, sreq->ie, sreq->ie_len);
2767 		ie->ies_len = cpu_to_le16(sreq->ie_len);
2768 	}
2769 
2770 	req->scan_func |= SCAN_FUNC_SPLIT_SCAN;
2771 
2772 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_MISC, sizeof(*misc));
2773 	misc = (struct scan_misc_tlv *)tlv;
2774 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
2775 		get_random_mask_addr(misc->random_mac, sreq->mac_addr,
2776 				     sreq->mac_addr_mask);
2777 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
2778 	}
2779 
2780 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2781 				    false);
2782 	if (err < 0)
2783 		clear_bit(MT76_HW_SCANNING, &phy->state);
2784 
2785 	return err;
2786 }
2787 EXPORT_SYMBOL_GPL(mt7925_mcu_hw_scan);
2788 
2789 int mt7925_mcu_sched_scan_req(struct mt76_phy *phy,
2790 			      struct ieee80211_vif *vif,
2791 			      struct cfg80211_sched_scan_request *sreq)
2792 {
2793 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2794 	struct ieee80211_channel **scan_list = sreq->channels;
2795 	struct mt76_connac_mcu_scan_channel *chan;
2796 	struct mt76_dev *mdev = phy->dev;
2797 	struct cfg80211_match_set *cfg_match;
2798 	struct cfg80211_ssid *cfg_ssid;
2799 
2800 	struct scan_hdr_tlv *hdr;
2801 	struct scan_sched_req *req;
2802 	struct scan_ssid_tlv *ssid;
2803 	struct scan_chan_info_tlv *chan_info;
2804 	struct scan_ie_tlv *ie;
2805 	struct scan_sched_ssid_match_sets *match;
2806 	struct sk_buff *skb;
2807 	struct tlv *tlv;
2808 	int i, max_len;
2809 
2810 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2811 		  sizeof(*chan_info) + sizeof(*ie) +
2812 		  sizeof(*match);
2813 
2814 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2815 	if (!skb)
2816 		return -ENOMEM;
2817 
2818 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2819 
2820 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2821 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2822 	hdr->bss_idx = mvif->idx;
2823 
2824 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_REQ, sizeof(*req));
2825 	req = (struct scan_sched_req *)tlv;
2826 	req->version = 1;
2827 
2828 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
2829 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
2830 
2831 	req->intervals_num = sreq->n_scan_plans;
2832 	for (i = 0; i < req->intervals_num; i++)
2833 		req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
2834 
2835 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2836 	ssid = (struct scan_ssid_tlv *)tlv;
2837 
2838 	ssid->ssids_num = sreq->n_ssids;
2839 	ssid->ssid_type = BIT(2);
2840 	for (i = 0; i < ssid->ssids_num; i++) {
2841 		cfg_ssid = &sreq->ssids[i];
2842 		memcpy(ssid->ssids[i].ssid, cfg_ssid->ssid, cfg_ssid->ssid_len);
2843 		ssid->ssids[i].ssid_len = cpu_to_le32(cfg_ssid->ssid_len);
2844 	}
2845 
2846 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID_MATCH_SETS, sizeof(*match));
2847 	match = (struct scan_sched_ssid_match_sets *)tlv;
2848 	match->match_num = sreq->n_match_sets;
2849 	for (i = 0; i < match->match_num; i++) {
2850 		cfg_match = &sreq->match_sets[i];
2851 		memcpy(match->match[i].ssid, cfg_match->ssid.ssid,
2852 		       cfg_match->ssid.ssid_len);
2853 		match->match[i].rssi_th = cpu_to_le32(cfg_match->rssi_thold);
2854 		match->match[i].ssid_len = cfg_match->ssid.ssid_len;
2855 	}
2856 
2857 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
2858 	chan_info = (struct scan_chan_info_tlv *)tlv;
2859 	chan_info->channels_num = min_t(u8, sreq->n_channels,
2860 					ARRAY_SIZE(chan_info->channels));
2861 	for (i = 0; i < chan_info->channels_num; i++) {
2862 		chan = &chan_info->channels[i];
2863 
2864 		switch (scan_list[i]->band) {
2865 		case NL80211_BAND_2GHZ:
2866 			chan->band = 1;
2867 			break;
2868 		case NL80211_BAND_6GHZ:
2869 			chan->band = 3;
2870 			break;
2871 		default:
2872 			chan->band = 2;
2873 			break;
2874 		}
2875 		chan->channel_num = scan_list[i]->hw_value;
2876 	}
2877 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
2878 
2879 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
2880 	ie = (struct scan_ie_tlv *)tlv;
2881 	if (sreq->ie_len > 0) {
2882 		memcpy(ie->ies, sreq->ie, sreq->ie_len);
2883 		ie->ies_len = cpu_to_le16(sreq->ie_len);
2884 	}
2885 
2886 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2887 				     false);
2888 }
2889 EXPORT_SYMBOL_GPL(mt7925_mcu_sched_scan_req);
2890 
2891 int
2892 mt7925_mcu_sched_scan_enable(struct mt76_phy *phy,
2893 			     struct ieee80211_vif *vif,
2894 			     bool enable)
2895 {
2896 	struct mt76_dev *mdev = phy->dev;
2897 	struct scan_sched_enable *req;
2898 	struct scan_hdr_tlv *hdr;
2899 	struct sk_buff *skb;
2900 	struct tlv *tlv;
2901 	int max_len;
2902 
2903 	max_len = sizeof(*hdr) + sizeof(*req);
2904 
2905 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2906 	if (!skb)
2907 		return -ENOMEM;
2908 
2909 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2910 	hdr->seq_num = 0;
2911 	hdr->bss_idx = 0;
2912 
2913 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_ENABLE, sizeof(*req));
2914 	req = (struct scan_sched_enable *)tlv;
2915 	req->active = !enable;
2916 
2917 	if (enable)
2918 		set_bit(MT76_HW_SCHED_SCANNING, &phy->state);
2919 	else
2920 		clear_bit(MT76_HW_SCHED_SCANNING, &phy->state);
2921 
2922 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2923 				     false);
2924 }
2925 
2926 int mt7925_mcu_cancel_hw_scan(struct mt76_phy *phy,
2927 			      struct ieee80211_vif *vif)
2928 {
2929 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2930 	struct {
2931 		struct scan_hdr {
2932 			u8 seq_num;
2933 			u8 bss_idx;
2934 			u8 pad[2];
2935 		} __packed hdr;
2936 		struct scan_cancel_tlv {
2937 			__le16 tag;
2938 			__le16 len;
2939 			u8 is_ext_channel;
2940 			u8 rsv[3];
2941 		} __packed cancel;
2942 	} req = {
2943 		.hdr = {
2944 			.seq_num = mvif->scan_seq_num,
2945 			.bss_idx = mvif->idx,
2946 		},
2947 		.cancel = {
2948 			.tag = cpu_to_le16(UNI_SCAN_CANCEL),
2949 			.len = cpu_to_le16(sizeof(struct scan_cancel_tlv)),
2950 		},
2951 	};
2952 
2953 	if (test_and_clear_bit(MT76_HW_SCANNING, &phy->state)) {
2954 		struct cfg80211_scan_info info = {
2955 			.aborted = true,
2956 		};
2957 
2958 		ieee80211_scan_completed(phy->hw, &info);
2959 	}
2960 
2961 	return mt76_mcu_send_msg(phy->dev, MCU_UNI_CMD(SCAN_REQ),
2962 				 &req, sizeof(req), false);
2963 }
2964 EXPORT_SYMBOL_GPL(mt7925_mcu_cancel_hw_scan);
2965 
2966 int mt7925_mcu_set_channel_domain(struct mt76_phy *phy)
2967 {
2968 	int len, i, n_max_channels, n_2ch = 0, n_5ch = 0, n_6ch = 0;
2969 	struct {
2970 		struct {
2971 			u8 alpha2[4]; /* regulatory_request.alpha2 */
2972 			u8 bw_2g; /* BW_20_40M		0
2973 				   * BW_20M		1
2974 				   * BW_20_40_80M	2
2975 				   * BW_20_40_80_160M	3
2976 				   * BW_20_40_80_8080M	4
2977 				   */
2978 			u8 bw_5g;
2979 			u8 bw_6g;
2980 			u8 pad;
2981 		} __packed hdr;
2982 		struct n_chan {
2983 			__le16 tag;
2984 			__le16 len;
2985 			u8 n_2ch;
2986 			u8 n_5ch;
2987 			u8 n_6ch;
2988 			u8 pad;
2989 		} __packed n_ch;
2990 	} req = {
2991 		.hdr = {
2992 			.bw_2g = 0,
2993 			.bw_5g = 3, /* BW_20_40_80_160M */
2994 			.bw_6g = 3,
2995 		},
2996 		.n_ch = {
2997 			.tag = cpu_to_le16(2),
2998 		},
2999 	};
3000 	struct mt76_connac_mcu_chan {
3001 		__le16 hw_value;
3002 		__le16 pad;
3003 		__le32 flags;
3004 	} __packed channel;
3005 	struct mt76_dev *dev = phy->dev;
3006 	struct ieee80211_channel *chan;
3007 	struct sk_buff *skb;
3008 
3009 	n_max_channels = phy->sband_2g.sband.n_channels +
3010 			 phy->sband_5g.sband.n_channels +
3011 			 phy->sband_6g.sband.n_channels;
3012 	len = sizeof(req) + n_max_channels * sizeof(channel);
3013 
3014 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
3015 	if (!skb)
3016 		return -ENOMEM;
3017 
3018 	skb_reserve(skb, sizeof(req));
3019 
3020 	for (i = 0; i < phy->sband_2g.sband.n_channels; i++) {
3021 		chan = &phy->sband_2g.sband.channels[i];
3022 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3023 			continue;
3024 
3025 		channel.hw_value = cpu_to_le16(chan->hw_value);
3026 		channel.flags = cpu_to_le32(chan->flags);
3027 		channel.pad = 0;
3028 
3029 		skb_put_data(skb, &channel, sizeof(channel));
3030 		n_2ch++;
3031 	}
3032 	for (i = 0; i < phy->sband_5g.sband.n_channels; i++) {
3033 		chan = &phy->sband_5g.sband.channels[i];
3034 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3035 			continue;
3036 
3037 		channel.hw_value = cpu_to_le16(chan->hw_value);
3038 		channel.flags = cpu_to_le32(chan->flags);
3039 		channel.pad = 0;
3040 
3041 		skb_put_data(skb, &channel, sizeof(channel));
3042 		n_5ch++;
3043 	}
3044 	for (i = 0; i < phy->sband_6g.sband.n_channels; i++) {
3045 		chan = &phy->sband_6g.sband.channels[i];
3046 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3047 			continue;
3048 
3049 		channel.hw_value = cpu_to_le16(chan->hw_value);
3050 		channel.flags = cpu_to_le32(chan->flags);
3051 		channel.pad = 0;
3052 
3053 		skb_put_data(skb, &channel, sizeof(channel));
3054 		n_6ch++;
3055 	}
3056 
3057 	BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(req.hdr.alpha2));
3058 	memcpy(req.hdr.alpha2, dev->alpha2, sizeof(dev->alpha2));
3059 	req.n_ch.n_2ch = n_2ch;
3060 	req.n_ch.n_5ch = n_5ch;
3061 	req.n_ch.n_6ch = n_6ch;
3062 	len = sizeof(struct n_chan) + (n_2ch + n_5ch + n_6ch) * sizeof(channel);
3063 	req.n_ch.len = cpu_to_le16(len);
3064 	memcpy(__skb_push(skb, sizeof(req)), &req, sizeof(req));
3065 
3066 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SET_DOMAIN_INFO),
3067 				     false);
3068 }
3069 EXPORT_SYMBOL_GPL(mt7925_mcu_set_channel_domain);
3070 
3071 static int
3072 __mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3073 		     enum environment_cap env_cap,
3074 		     struct mt7925_clc *clc, u8 idx)
3075 {
3076 	struct mt7925_clc_segment *seg;
3077 	struct sk_buff *skb;
3078 	struct {
3079 		u8 rsv[4];
3080 		__le16 tag;
3081 		__le16 len;
3082 
3083 		u8 ver;
3084 		u8 pad0;
3085 		__le16 size;
3086 		u8 idx;
3087 		u8 env;
3088 		u8 acpi_conf;
3089 		u8 pad1;
3090 		u8 alpha2[2];
3091 		u8 type[2];
3092 		u8 rsvd[64];
3093 	} __packed req = {
3094 		.tag = cpu_to_le16(0x3),
3095 		.len = cpu_to_le16(sizeof(req) - 4),
3096 
3097 		.idx = idx,
3098 		.env = env_cap,
3099 		.acpi_conf = mt792x_acpi_get_flags(&dev->phy),
3100 	};
3101 	int ret, valid_cnt = 0;
3102 	u8 i, *pos;
3103 
3104 	if (!clc)
3105 		return 0;
3106 
3107 	pos = clc->data + sizeof(*seg) * clc->nr_seg;
3108 	for (i = 0; i < clc->nr_country; i++) {
3109 		struct mt7925_clc_rule *rule = (struct mt7925_clc_rule *)pos;
3110 
3111 		pos += sizeof(*rule);
3112 		if (rule->alpha2[0] != alpha2[0] ||
3113 		    rule->alpha2[1] != alpha2[1])
3114 			continue;
3115 
3116 		seg = (struct mt7925_clc_segment *)clc->data
3117 			  + rule->seg_idx - 1;
3118 
3119 		memcpy(req.alpha2, rule->alpha2, 2);
3120 		memcpy(req.type, rule->type, 2);
3121 
3122 		req.size = cpu_to_le16(seg->len);
3123 		skb = __mt76_mcu_msg_alloc(&dev->mt76, &req,
3124 					   le16_to_cpu(req.size) + sizeof(req),
3125 					   sizeof(req), GFP_KERNEL);
3126 		if (!skb)
3127 			return -ENOMEM;
3128 		skb_put_data(skb, clc->data + seg->offset, seg->len);
3129 
3130 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3131 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3132 					    true);
3133 		if (ret < 0)
3134 			return ret;
3135 		valid_cnt++;
3136 	}
3137 
3138 	if (!valid_cnt)
3139 		return -ENOENT;
3140 
3141 	return 0;
3142 }
3143 
3144 int mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3145 		       enum environment_cap env_cap)
3146 {
3147 	struct mt792x_phy *phy = (struct mt792x_phy *)&dev->phy;
3148 	int i, ret;
3149 
3150 	/* submit all clc config */
3151 	for (i = 0; i < ARRAY_SIZE(phy->clc); i++) {
3152 		ret = __mt7925_mcu_set_clc(dev, alpha2, env_cap,
3153 					   phy->clc[i], i);
3154 
3155 		/* If no country found, set "00" as default */
3156 		if (ret == -ENOENT)
3157 			ret = __mt7925_mcu_set_clc(dev, "00",
3158 						   ENVIRON_INDOOR,
3159 						   phy->clc[i], i);
3160 		if (ret < 0)
3161 			return ret;
3162 	}
3163 	return 0;
3164 }
3165 
3166 int mt7925_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb,
3167 			    int cmd, int *wait_seq)
3168 {
3169 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
3170 	struct mt76_connac2_mcu_uni_txd *uni_txd;
3171 	struct mt76_connac2_mcu_txd *mcu_txd;
3172 	__le32 *txd;
3173 	u32 val;
3174 	u8 seq;
3175 
3176 	/* TODO: make dynamic based on msg type */
3177 	mdev->mcu.timeout = 20 * HZ;
3178 
3179 	seq = ++mdev->mcu.msg_seq & 0xf;
3180 	if (!seq)
3181 		seq = ++mdev->mcu.msg_seq & 0xf;
3182 
3183 	if (cmd == MCU_CMD(FW_SCATTER))
3184 		goto exit;
3185 
3186 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
3187 	txd = (__le32 *)skb_push(skb, txd_len);
3188 
3189 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
3190 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
3191 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
3192 	txd[0] = cpu_to_le32(val);
3193 
3194 	val = FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
3195 	txd[1] = cpu_to_le32(val);
3196 
3197 	if (cmd & __MCU_CMD_FIELD_UNI) {
3198 		uni_txd = (struct mt76_connac2_mcu_uni_txd *)txd;
3199 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
3200 		uni_txd->cid = cpu_to_le16(mcu_cmd);
3201 		uni_txd->s2d_index = MCU_S2D_H2N;
3202 		uni_txd->pkt_type = MCU_PKT_ID;
3203 		uni_txd->seq = seq;
3204 
3205 		if (cmd & __MCU_CMD_FIELD_QUERY)
3206 			uni_txd->option = MCU_CMD_UNI_QUERY_ACK;
3207 		else
3208 			uni_txd->option = MCU_CMD_UNI_EXT_ACK;
3209 
3210 		goto exit;
3211 	}
3212 
3213 	mcu_txd = (struct mt76_connac2_mcu_txd *)txd;
3214 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
3215 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
3216 					       MT_TX_MCU_PORT_RX_Q0));
3217 	mcu_txd->pkt_type = MCU_PKT_ID;
3218 	mcu_txd->seq = seq;
3219 	mcu_txd->cid = mcu_cmd;
3220 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
3221 
3222 	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
3223 		if (cmd & __MCU_CMD_FIELD_QUERY)
3224 			mcu_txd->set_query = MCU_Q_QUERY;
3225 		else
3226 			mcu_txd->set_query = MCU_Q_SET;
3227 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
3228 	} else {
3229 		mcu_txd->set_query = MCU_Q_NA;
3230 	}
3231 
3232 	if (cmd & __MCU_CMD_FIELD_WA)
3233 		mcu_txd->s2d_index = MCU_S2D_H2C;
3234 	else
3235 		mcu_txd->s2d_index = MCU_S2D_H2N;
3236 
3237 exit:
3238 	if (wait_seq)
3239 		*wait_seq = seq;
3240 
3241 	return 0;
3242 }
3243 EXPORT_SYMBOL_GPL(mt7925_mcu_fill_message);
3244 
3245 int mt7925_mcu_set_rts_thresh(struct mt792x_phy *phy, u32 val)
3246 {
3247 	struct {
3248 		u8 band_idx;
3249 		u8 _rsv[3];
3250 
3251 		__le16 tag;
3252 		__le16 len;
3253 		__le32 len_thresh;
3254 		__le32 pkt_thresh;
3255 	} __packed req = {
3256 		.band_idx = phy->mt76->band_idx,
3257 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RTS_THRESHOLD),
3258 		.len = cpu_to_le16(sizeof(req) - 4),
3259 		.len_thresh = cpu_to_le32(val),
3260 		.pkt_thresh = cpu_to_le32(0x2),
3261 	};
3262 
3263 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3264 				 &req, sizeof(req), true);
3265 }
3266 
3267 int mt7925_mcu_set_radio_en(struct mt792x_phy *phy, bool enable)
3268 {
3269 	struct {
3270 		u8 band_idx;
3271 		u8 _rsv[3];
3272 
3273 		__le16 tag;
3274 		__le16 len;
3275 		u8 enable;
3276 		u8 _rsv2[3];
3277 	} __packed req = {
3278 		.band_idx = phy->mt76->band_idx,
3279 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RADIO_ENABLE),
3280 		.len = cpu_to_le16(sizeof(req) - 4),
3281 		.enable = enable,
3282 	};
3283 
3284 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3285 				 &req, sizeof(req), true);
3286 }
3287 
3288 static void
3289 mt7925_mcu_build_sku(struct mt76_dev *dev, s8 *sku,
3290 		     struct mt76_power_limits *limits,
3291 		     enum nl80211_band band)
3292 {
3293 	int i, offset = sizeof(limits->cck);
3294 
3295 	memset(sku, 127, MT_CONNAC3_SKU_POWER_LIMIT);
3296 
3297 	if (band == NL80211_BAND_2GHZ) {
3298 		/* cck */
3299 		memcpy(sku, limits->cck, sizeof(limits->cck));
3300 	}
3301 
3302 	/* ofdm */
3303 	memcpy(&sku[offset], limits->ofdm, sizeof(limits->ofdm));
3304 	offset += (sizeof(limits->ofdm) * 5);
3305 
3306 	/* ht */
3307 	for (i = 0; i < 2; i++) {
3308 		memcpy(&sku[offset], limits->mcs[i], 8);
3309 		offset += 8;
3310 	}
3311 	sku[offset++] = limits->mcs[0][0];
3312 
3313 	/* vht */
3314 	for (i = 0; i < ARRAY_SIZE(limits->mcs); i++) {
3315 		memcpy(&sku[offset], limits->mcs[i],
3316 		       ARRAY_SIZE(limits->mcs[i]));
3317 		offset += 12;
3318 	}
3319 
3320 	/* he */
3321 	for (i = 0; i < ARRAY_SIZE(limits->ru); i++) {
3322 		memcpy(&sku[offset], limits->ru[i], ARRAY_SIZE(limits->ru[i]));
3323 		offset += ARRAY_SIZE(limits->ru[i]);
3324 	}
3325 
3326 	/* eht */
3327 	for (i = 0; i < ARRAY_SIZE(limits->eht); i++) {
3328 		memcpy(&sku[offset], limits->eht[i], ARRAY_SIZE(limits->eht[i]));
3329 		offset += ARRAY_SIZE(limits->eht[i]);
3330 	}
3331 }
3332 
3333 static int
3334 mt7925_mcu_rate_txpower_band(struct mt76_phy *phy,
3335 			     enum nl80211_band band)
3336 {
3337 	int tx_power, n_chan, last_ch, err = 0, idx = 0;
3338 	int i, sku_len, batch_size, batch_len = 3;
3339 	struct mt76_dev *dev = phy->dev;
3340 	static const u8 chan_list_2ghz[] = {
3341 		1, 2,  3,  4,  5,  6,  7,
3342 		8, 9, 10, 11, 12, 13, 14
3343 	};
3344 	static const u8 chan_list_5ghz[] = {
3345 		 36,  38,  40,  42,  44,  46,  48,
3346 		 50,  52,  54,  56,  58,  60,  62,
3347 		 64, 100, 102, 104, 106, 108, 110,
3348 		112, 114, 116, 118, 120, 122, 124,
3349 		126, 128, 132, 134, 136, 138, 140,
3350 		142, 144, 149, 151, 153, 155, 157,
3351 		159, 161, 165, 167
3352 	};
3353 	static const u8 chan_list_6ghz[] = {
3354 		  1,   3,   5,   7,   9,  11,  13,
3355 		 15,  17,  19,  21,  23,  25,  27,
3356 		 29,  33,  35,  37,  39,  41,  43,
3357 		 45,  47,  49,  51,  53,  55,  57,
3358 		 59,  61,  65,  67,  69,  71,  73,
3359 		 75,  77,  79,  81,  83,  85,  87,
3360 		 89,  91,  93,  97,  99, 101, 103,
3361 		105, 107, 109, 111, 113, 115, 117,
3362 		119, 121, 123, 125, 129, 131, 133,
3363 		135, 137, 139, 141, 143, 145, 147,
3364 		149, 151, 153, 155, 157, 161, 163,
3365 		165, 167, 169, 171, 173, 175, 177,
3366 		179, 181, 183, 185, 187, 189, 193,
3367 		195, 197, 199, 201, 203, 205, 207,
3368 		209, 211, 213, 215, 217, 219, 221,
3369 		225, 227, 229, 233
3370 	};
3371 	struct mt76_power_limits *limits;
3372 	struct mt7925_sku_tlv *sku_tlbv;
3373 	const u8 *ch_list;
3374 
3375 	sku_len = sizeof(*sku_tlbv);
3376 	tx_power = 2 * phy->hw->conf.power_level;
3377 	if (!tx_power)
3378 		tx_power = 127;
3379 
3380 	if (band == NL80211_BAND_2GHZ) {
3381 		n_chan = ARRAY_SIZE(chan_list_2ghz);
3382 		ch_list = chan_list_2ghz;
3383 		last_ch = chan_list_2ghz[ARRAY_SIZE(chan_list_2ghz) - 1];
3384 	} else if (band == NL80211_BAND_6GHZ) {
3385 		n_chan = ARRAY_SIZE(chan_list_6ghz);
3386 		ch_list = chan_list_6ghz;
3387 		last_ch = chan_list_6ghz[ARRAY_SIZE(chan_list_6ghz) - 1];
3388 	} else {
3389 		n_chan = ARRAY_SIZE(chan_list_5ghz);
3390 		ch_list = chan_list_5ghz;
3391 		last_ch = chan_list_5ghz[ARRAY_SIZE(chan_list_5ghz) - 1];
3392 	}
3393 	batch_size = DIV_ROUND_UP(n_chan, batch_len);
3394 
3395 	limits = devm_kmalloc(dev->dev, sizeof(*limits), GFP_KERNEL);
3396 	if (!limits)
3397 		return -ENOMEM;
3398 
3399 	sku_tlbv = devm_kmalloc(dev->dev, sku_len, GFP_KERNEL);
3400 	if (!sku_tlbv) {
3401 		devm_kfree(dev->dev, limits);
3402 		return -ENOMEM;
3403 	}
3404 
3405 	for (i = 0; i < batch_size; i++) {
3406 		struct mt7925_tx_power_limit_tlv *tx_power_tlv;
3407 		int j, msg_len, num_ch;
3408 		struct sk_buff *skb;
3409 
3410 		num_ch = i == batch_size - 1 ? n_chan % batch_len : batch_len;
3411 		msg_len = sizeof(*tx_power_tlv) + num_ch * sku_len;
3412 		skb = mt76_mcu_msg_alloc(dev, NULL, msg_len);
3413 		if (!skb) {
3414 			err = -ENOMEM;
3415 			goto out;
3416 		}
3417 
3418 		tx_power_tlv = (struct mt7925_tx_power_limit_tlv *)
3419 			       skb_put(skb, sizeof(*tx_power_tlv));
3420 
3421 		BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(tx_power_tlv->alpha2));
3422 		memcpy(tx_power_tlv->alpha2, dev->alpha2, sizeof(dev->alpha2));
3423 		tx_power_tlv->n_chan = num_ch;
3424 		tx_power_tlv->tag = cpu_to_le16(0x1);
3425 		tx_power_tlv->len = cpu_to_le16(sizeof(*tx_power_tlv));
3426 
3427 		switch (band) {
3428 		case NL80211_BAND_2GHZ:
3429 			tx_power_tlv->band = 1;
3430 			break;
3431 		case NL80211_BAND_6GHZ:
3432 			tx_power_tlv->band = 3;
3433 			break;
3434 		default:
3435 			tx_power_tlv->band = 2;
3436 			break;
3437 		}
3438 
3439 		for (j = 0; j < num_ch; j++, idx++) {
3440 			struct ieee80211_channel chan = {
3441 				.hw_value = ch_list[idx],
3442 				.band = band,
3443 			};
3444 			s8 reg_power, sar_power;
3445 
3446 			reg_power = mt76_connac_get_ch_power(phy, &chan,
3447 							     tx_power);
3448 			sar_power = mt76_get_sar_power(phy, &chan, reg_power);
3449 
3450 			mt76_get_rate_power_limits(phy, &chan, limits,
3451 						   sar_power);
3452 
3453 			tx_power_tlv->last_msg = ch_list[idx] == last_ch;
3454 			sku_tlbv->channel = ch_list[idx];
3455 
3456 			mt7925_mcu_build_sku(dev, sku_tlbv->pwr_limit,
3457 					     limits, band);
3458 			skb_put_data(skb, sku_tlbv, sku_len);
3459 		}
3460 		err = mt76_mcu_skb_send_msg(dev, skb,
3461 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3462 					    true);
3463 		if (err < 0)
3464 			goto out;
3465 	}
3466 
3467 out:
3468 	devm_kfree(dev->dev, sku_tlbv);
3469 	devm_kfree(dev->dev, limits);
3470 	return err;
3471 }
3472 
3473 int mt7925_mcu_set_rate_txpower(struct mt76_phy *phy)
3474 {
3475 	int err;
3476 
3477 	if (phy->cap.has_2ghz) {
3478 		err = mt7925_mcu_rate_txpower_band(phy,
3479 						   NL80211_BAND_2GHZ);
3480 		if (err < 0)
3481 			return err;
3482 	}
3483 
3484 	if (phy->cap.has_5ghz) {
3485 		err = mt7925_mcu_rate_txpower_band(phy,
3486 						   NL80211_BAND_5GHZ);
3487 		if (err < 0)
3488 			return err;
3489 	}
3490 
3491 	if (phy->cap.has_6ghz) {
3492 		err = mt7925_mcu_rate_txpower_band(phy,
3493 						   NL80211_BAND_6GHZ);
3494 		if (err < 0)
3495 			return err;
3496 	}
3497 
3498 	return 0;
3499 }
3500 
3501 int mt7925_mcu_set_rxfilter(struct mt792x_dev *dev, u32 fif,
3502 			    u8 bit_op, u32 bit_map)
3503 {
3504 	struct mt792x_phy *phy = &dev->phy;
3505 	struct {
3506 		u8 band_idx;
3507 		u8 rsv1[3];
3508 
3509 		__le16 tag;
3510 		__le16 len;
3511 		u8 mode;
3512 		u8 rsv2[3];
3513 		__le32 fif;
3514 		__le32 bit_map; /* bit_* for bitmap update */
3515 		u8 bit_op;
3516 		u8 pad[51];
3517 	} __packed req = {
3518 		.band_idx = phy->mt76->band_idx,
3519 		.tag = cpu_to_le16(UNI_BAND_CONFIG_SET_MAC80211_RX_FILTER),
3520 		.len = cpu_to_le16(sizeof(req) - 4),
3521 
3522 		.mode = fif ? 0 : 1,
3523 		.fif = cpu_to_le32(fif),
3524 		.bit_map = cpu_to_le32(bit_map),
3525 		.bit_op = bit_op,
3526 	};
3527 
3528 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3529 				 &req, sizeof(req), true);
3530 }
3531