xref: /linux/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c (revision 3f0d2178aaf1ed1c017e61cde9ce8a4432c804d1)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2023 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include <linux/firmware.h>
6 #include "mt7925.h"
7 #include "mcu.h"
8 #include "mac.h"
9 
10 #define MT_STA_BFER			BIT(0)
11 #define MT_STA_BFEE			BIT(1)
12 
13 static bool mt7925_disable_clc;
14 module_param_named(disable_clc, mt7925_disable_clc, bool, 0644);
15 MODULE_PARM_DESC(disable_clc, "disable CLC support");
16 
17 int mt7925_mcu_parse_response(struct mt76_dev *mdev, int cmd,
18 			      struct sk_buff *skb, int seq)
19 {
20 	int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
21 	struct mt7925_mcu_rxd *rxd;
22 	int ret = 0;
23 
24 	if (!skb) {
25 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n", cmd, seq);
26 		mt792x_reset(mdev);
27 
28 		return -ETIMEDOUT;
29 	}
30 
31 	rxd = (struct mt7925_mcu_rxd *)skb->data;
32 	if (seq != rxd->seq)
33 		return -EAGAIN;
34 
35 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL) ||
36 	    cmd == MCU_CMD(PATCH_FINISH_REQ)) {
37 		skb_pull(skb, sizeof(*rxd) - 4);
38 		ret = *skb->data;
39 	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
40 		   cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
41 		   cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
42 		   cmd == MCU_UNI_CMD(HIF_CTRL) ||
43 		   cmd == MCU_UNI_CMD(OFFLOAD) ||
44 		   cmd == MCU_UNI_CMD(SUSPEND)) {
45 		struct mt7925_mcu_uni_event *event;
46 
47 		skb_pull(skb, sizeof(*rxd));
48 		event = (struct mt7925_mcu_uni_event *)skb->data;
49 		ret = le32_to_cpu(event->status);
50 		/* skip invalid event */
51 		if (mcu_cmd != event->cid)
52 			ret = -EAGAIN;
53 	} else {
54 		skb_pull(skb, sizeof(*rxd));
55 	}
56 
57 	return ret;
58 }
59 EXPORT_SYMBOL_GPL(mt7925_mcu_parse_response);
60 
61 int mt7925_mcu_regval(struct mt792x_dev *dev, u32 regidx, u32 *val, bool set)
62 {
63 #define MT_RF_REG_HDR           GENMASK(31, 24)
64 #define MT_RF_REG_ANT           GENMASK(23, 16)
65 #define RF_REG_PREFIX           0x99
66 	struct {
67 		u8 __rsv[4];
68 		union {
69 			struct uni_cmd_access_reg_basic {
70 				__le16 tag;
71 				__le16 len;
72 				__le32 idx;
73 				__le32 data;
74 			} __packed reg;
75 			struct uni_cmd_access_rf_reg_basic {
76 				__le16 tag;
77 				__le16 len;
78 				__le16 ant;
79 				u8 __rsv[2];
80 				__le32 idx;
81 				__le32 data;
82 			} __packed rf_reg;
83 		};
84 	} __packed * res, req;
85 	struct sk_buff *skb;
86 	int ret;
87 
88 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX) {
89 		req.rf_reg.tag = cpu_to_le16(UNI_CMD_ACCESS_RF_REG_BASIC);
90 		req.rf_reg.len = cpu_to_le16(sizeof(req.rf_reg));
91 		req.rf_reg.ant = cpu_to_le16(u32_get_bits(regidx, MT_RF_REG_ANT));
92 		req.rf_reg.idx = cpu_to_le32(regidx);
93 		req.rf_reg.data = set ? cpu_to_le32(*val) : 0;
94 	} else {
95 		req.reg.tag = cpu_to_le16(UNI_CMD_ACCESS_REG_BASIC);
96 		req.reg.len = cpu_to_le16(sizeof(req.reg));
97 		req.reg.idx = cpu_to_le32(regidx);
98 		req.reg.data = set ? cpu_to_le32(*val) : 0;
99 	}
100 
101 	if (set)
102 		return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(REG_ACCESS),
103 					 &req, sizeof(req), true);
104 
105 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
106 					MCU_WM_UNI_CMD_QUERY(REG_ACCESS),
107 					&req, sizeof(req), true, &skb);
108 	if (ret)
109 		return ret;
110 
111 	res = (void *)skb->data;
112 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX)
113 		*val = le32_to_cpu(res->rf_reg.data);
114 	else
115 		*val = le32_to_cpu(res->reg.data);
116 
117 	dev_kfree_skb(skb);
118 
119 	return 0;
120 }
121 EXPORT_SYMBOL_GPL(mt7925_mcu_regval);
122 
123 int mt7925_mcu_update_arp_filter(struct mt76_dev *dev,
124 				 struct ieee80211_bss_conf *link_conf)
125 {
126 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
127 	struct ieee80211_vif *mvif = link_conf->vif;
128 	struct sk_buff *skb;
129 	int i, len = min_t(int, mvif->cfg.arp_addr_cnt,
130 			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
131 	struct {
132 		struct {
133 			u8 bss_idx;
134 			u8 pad[3];
135 		} __packed hdr;
136 		struct mt7925_arpns_tlv arp;
137 	} req = {
138 		.hdr = {
139 			.bss_idx = mconf->mt76.idx,
140 		},
141 		.arp = {
142 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
143 			.len = cpu_to_le16(sizeof(req) - 4 + len * 2 * sizeof(__be32)),
144 			.ips_num = len,
145 			.enable = true,
146 		},
147 	};
148 
149 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(req) + len * 2 * sizeof(__be32));
150 	if (!skb)
151 		return -ENOMEM;
152 
153 	skb_put_data(skb, &req, sizeof(req));
154 	for (i = 0; i < len; i++) {
155 		skb_put_data(skb, &mvif->cfg.arp_addr_list[i], sizeof(__be32));
156 		skb_put_zero(skb, sizeof(__be32));
157 	}
158 
159 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
160 }
161 
162 #ifdef CONFIG_PM
163 static int
164 mt7925_connac_mcu_set_wow_ctrl(struct mt76_phy *phy, struct ieee80211_vif *vif,
165 			       bool suspend, struct cfg80211_wowlan *wowlan)
166 {
167 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
168 	struct mt76_dev *dev = phy->dev;
169 	struct {
170 		struct {
171 			u8 bss_idx;
172 			u8 pad[3];
173 		} __packed hdr;
174 		struct mt76_connac_wow_ctrl_tlv wow_ctrl_tlv;
175 		struct mt76_connac_wow_gpio_param_tlv gpio_tlv;
176 	} req = {
177 		.hdr = {
178 			.bss_idx = mvif->idx,
179 		},
180 		.wow_ctrl_tlv = {
181 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
182 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_ctrl_tlv)),
183 			.cmd = suspend ? 1 : 2,
184 		},
185 		.gpio_tlv = {
186 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_GPIO_PARAM),
187 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_gpio_param_tlv)),
188 			.gpio_pin = 0xff, /* follow fw about GPIO pin */
189 		},
190 	};
191 
192 	if (wowlan->magic_pkt)
193 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_MAGIC;
194 	if (wowlan->disconnect)
195 		req.wow_ctrl_tlv.trigger |= (UNI_WOW_DETECT_TYPE_DISCONNECT |
196 					     UNI_WOW_DETECT_TYPE_BCN_LOST);
197 	if (wowlan->nd_config) {
198 		mt7925_mcu_sched_scan_req(phy, vif, wowlan->nd_config);
199 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_SCH_SCAN_HIT;
200 		mt7925_mcu_sched_scan_enable(phy, vif, suspend);
201 	}
202 	if (wowlan->n_patterns)
203 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_BITMAP;
204 
205 	if (mt76_is_mmio(dev))
206 		req.wow_ctrl_tlv.wakeup_hif = WOW_PCIE;
207 	else if (mt76_is_usb(dev))
208 		req.wow_ctrl_tlv.wakeup_hif = WOW_USB;
209 	else if (mt76_is_sdio(dev))
210 		req.wow_ctrl_tlv.wakeup_hif = WOW_GPIO;
211 
212 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(SUSPEND), &req,
213 				 sizeof(req), true);
214 }
215 
216 static int
217 mt7925_mcu_set_wow_pattern(struct mt76_dev *dev,
218 			   struct ieee80211_vif *vif,
219 			   u8 index, bool enable,
220 			   struct cfg80211_pkt_pattern *pattern)
221 {
222 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
223 	struct mt7925_wow_pattern_tlv *tlv;
224 	struct sk_buff *skb;
225 	struct {
226 		u8 bss_idx;
227 		u8 pad[3];
228 	} __packed hdr = {
229 		.bss_idx = mvif->idx,
230 	};
231 
232 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(hdr) + sizeof(*tlv));
233 	if (!skb)
234 		return -ENOMEM;
235 
236 	skb_put_data(skb, &hdr, sizeof(hdr));
237 	tlv = (struct mt7925_wow_pattern_tlv *)skb_put(skb, sizeof(*tlv));
238 	tlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
239 	tlv->len = cpu_to_le16(sizeof(*tlv));
240 	tlv->bss_idx = 0xF;
241 	tlv->data_len = pattern->pattern_len;
242 	tlv->enable = enable;
243 	tlv->index = index;
244 	tlv->offset = 0;
245 
246 	memcpy(tlv->pattern, pattern->pattern, pattern->pattern_len);
247 	memcpy(tlv->mask, pattern->mask, DIV_ROUND_UP(pattern->pattern_len, 8));
248 
249 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SUSPEND), true);
250 }
251 
252 void mt7925_mcu_set_suspend_iter(void *priv, u8 *mac,
253 				 struct ieee80211_vif *vif)
254 {
255 	struct mt76_phy *phy = priv;
256 	bool suspend = !test_bit(MT76_STATE_RUNNING, &phy->state);
257 	struct ieee80211_hw *hw = phy->hw;
258 	struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
259 	int i;
260 
261 	mt76_connac_mcu_set_gtk_rekey(phy->dev, vif, suspend);
262 
263 	mt76_connac_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
264 
265 	for (i = 0; i < wowlan->n_patterns; i++)
266 		mt7925_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
267 					   &wowlan->patterns[i]);
268 	mt7925_connac_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
269 }
270 
271 #endif /* CONFIG_PM */
272 
273 static void
274 mt7925_mcu_connection_loss_iter(void *priv, u8 *mac,
275 				struct ieee80211_vif *vif)
276 {
277 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
278 	struct mt7925_uni_beacon_loss_event *event = priv;
279 
280 	if (mvif->idx != event->hdr.bss_idx)
281 		return;
282 
283 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER) ||
284 	    vif->type != NL80211_IFTYPE_STATION)
285 		return;
286 
287 	ieee80211_connection_loss(vif);
288 }
289 
290 static void
291 mt7925_mcu_connection_loss_event(struct mt792x_dev *dev, struct sk_buff *skb)
292 {
293 	struct mt7925_uni_beacon_loss_event *event;
294 	struct mt76_phy *mphy = &dev->mt76.phy;
295 
296 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd));
297 	event = (struct mt7925_uni_beacon_loss_event *)skb->data;
298 
299 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
300 					IEEE80211_IFACE_ITER_RESUME_ALL,
301 					mt7925_mcu_connection_loss_iter, event);
302 }
303 
304 static void
305 mt7925_mcu_roc_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
306 {
307 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
308 	struct mt7925_roc_grant_tlv *grant = priv;
309 
310 	if (ieee80211_vif_is_mld(vif) && vif->type == NL80211_IFTYPE_STATION)
311 		return;
312 
313 	if (mvif->idx != grant->bss_idx)
314 		return;
315 
316 	mvif->band_idx = grant->dbdcband;
317 }
318 
319 static void mt7925_mcu_roc_handle_grant(struct mt792x_dev *dev,
320 					struct tlv *tlv)
321 {
322 	struct ieee80211_hw *hw = dev->mt76.hw;
323 	struct mt7925_roc_grant_tlv *grant;
324 	int duration;
325 
326 	grant = (struct mt7925_roc_grant_tlv *)tlv;
327 
328 	/* should never happen */
329 	WARN_ON_ONCE((le16_to_cpu(grant->tag) != UNI_EVENT_ROC_GRANT));
330 
331 	if (grant->reqtype == MT7925_ROC_REQ_ROC)
332 		ieee80211_ready_on_channel(hw);
333 	else if (grant->reqtype == MT7925_ROC_REQ_JOIN)
334 		ieee80211_iterate_active_interfaces_atomic(hw,
335 						IEEE80211_IFACE_ITER_RESUME_ALL,
336 						mt7925_mcu_roc_iter, grant);
337 	dev->phy.roc_grant = true;
338 	wake_up(&dev->phy.roc_wait);
339 	duration = le32_to_cpu(grant->max_interval);
340 	mod_timer(&dev->phy.roc_timer,
341 		  jiffies + msecs_to_jiffies(duration));
342 }
343 
344 static void
345 mt7925_mcu_uni_roc_event(struct mt792x_dev *dev, struct sk_buff *skb)
346 {
347 	struct tlv *tlv;
348 	int i = 0;
349 
350 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
351 
352 	while (i < skb->len) {
353 		tlv = (struct tlv *)(skb->data + i);
354 
355 		switch (le16_to_cpu(tlv->tag)) {
356 		case UNI_EVENT_ROC_GRANT:
357 			mt7925_mcu_roc_handle_grant(dev, tlv);
358 			break;
359 		case UNI_EVENT_ROC_GRANT_SUB_LINK:
360 			break;
361 		}
362 
363 		i += le16_to_cpu(tlv->len);
364 	}
365 }
366 
367 static void
368 mt7925_mcu_scan_event(struct mt792x_dev *dev, struct sk_buff *skb)
369 {
370 	struct mt76_phy *mphy = &dev->mt76.phy;
371 	struct mt792x_phy *phy = mphy->priv;
372 
373 	spin_lock_bh(&dev->mt76.lock);
374 	__skb_queue_tail(&phy->scan_event_list, skb);
375 	spin_unlock_bh(&dev->mt76.lock);
376 
377 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
378 				     MT792x_HW_SCAN_TIMEOUT);
379 }
380 
381 static void
382 mt7925_mcu_tx_done_event(struct mt792x_dev *dev, struct sk_buff *skb)
383 {
384 #define UNI_EVENT_TX_DONE_MSG 0
385 #define UNI_EVENT_TX_DONE_RAW 1
386 	struct mt7925_mcu_txs_event {
387 		u8 ver;
388 		u8 rsv[3];
389 		u8 data[0];
390 	} __packed * txs;
391 	struct tlv *tlv;
392 	u32 tlv_len;
393 
394 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
395 	tlv = (struct tlv *)skb->data;
396 	tlv_len = skb->len;
397 
398 	while (tlv_len > 0 && le16_to_cpu(tlv->len) <= tlv_len) {
399 		switch (le16_to_cpu(tlv->tag)) {
400 		case UNI_EVENT_TX_DONE_RAW:
401 			txs = (struct mt7925_mcu_txs_event *)tlv->data;
402 			mt7925_mac_add_txs(dev, txs->data);
403 			break;
404 		default:
405 			break;
406 		}
407 		tlv_len -= le16_to_cpu(tlv->len);
408 		tlv = (struct tlv *)((char *)(tlv) + le16_to_cpu(tlv->len));
409 	}
410 }
411 
412 static void
413 mt7925_mcu_uni_debug_msg_event(struct mt792x_dev *dev, struct sk_buff *skb)
414 {
415 	struct mt7925_uni_debug_msg {
416 		__le16 tag;
417 		__le16 len;
418 		u8 fmt;
419 		u8 rsv[3];
420 		u8 id;
421 		u8 type:3;
422 		u8 nr_args:5;
423 		union {
424 			struct idxlog {
425 				__le16 rsv;
426 				__le32 ts;
427 				__le32 idx;
428 				u8 data[];
429 			} __packed idx;
430 			struct txtlog {
431 				u8 len;
432 				u8 rsv;
433 				__le32 ts;
434 				u8 data[];
435 			} __packed txt;
436 		};
437 	} __packed * hdr;
438 
439 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
440 	hdr = (struct mt7925_uni_debug_msg *)skb->data;
441 
442 	if (hdr->id == 0x28) {
443 		skb_pull(skb, offsetof(struct mt7925_uni_debug_msg, id));
444 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", skb->len, skb->data);
445 		return;
446 	} else if (hdr->id != 0xa8) {
447 		return;
448 	}
449 
450 	if (hdr->type == 0) { /* idx log */
451 		int i, ret, len = PAGE_SIZE - 1, nr_val;
452 		struct page *page = dev_alloc_pages(get_order(len));
453 		__le32 *val;
454 		char *buf, *cur;
455 
456 		if (!page)
457 			return;
458 
459 		buf = page_address(page);
460 		cur = buf;
461 
462 		nr_val = (le16_to_cpu(hdr->len) - sizeof(*hdr)) / 4;
463 		val = (__le32 *)hdr->idx.data;
464 		for (i = 0; i < nr_val && len > 0; i++) {
465 			ret = snprintf(cur, len, "0x%x,", le32_to_cpu(val[i]));
466 			if (ret <= 0)
467 				break;
468 
469 			cur += ret;
470 			len -= ret;
471 		}
472 		if (cur > buf)
473 			wiphy_info(mt76_hw(dev)->wiphy, "idx: 0x%X,%d,%s",
474 				   le32_to_cpu(hdr->idx.idx), nr_val, buf);
475 		put_page(page);
476 	} else if (hdr->type == 2) { /* str log */
477 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", hdr->txt.len, hdr->txt.data);
478 	}
479 }
480 
481 static void
482 mt7925_mcu_uni_rx_unsolicited_event(struct mt792x_dev *dev,
483 				    struct sk_buff *skb)
484 {
485 	struct mt7925_mcu_rxd *rxd;
486 
487 	rxd = (struct mt7925_mcu_rxd *)skb->data;
488 
489 	switch (rxd->eid) {
490 	case MCU_UNI_EVENT_FW_LOG_2_HOST:
491 		mt7925_mcu_uni_debug_msg_event(dev, skb);
492 		break;
493 	case MCU_UNI_EVENT_ROC:
494 		mt7925_mcu_uni_roc_event(dev, skb);
495 		break;
496 	case MCU_UNI_EVENT_SCAN_DONE:
497 		mt7925_mcu_scan_event(dev, skb);
498 		return;
499 	case MCU_UNI_EVENT_TX_DONE:
500 		mt7925_mcu_tx_done_event(dev, skb);
501 		break;
502 	case MCU_UNI_EVENT_BSS_BEACON_LOSS:
503 		mt7925_mcu_connection_loss_event(dev, skb);
504 		break;
505 	case MCU_UNI_EVENT_COREDUMP:
506 		dev->fw_assert = true;
507 		mt76_connac_mcu_coredump_event(&dev->mt76, skb, &dev->coredump);
508 		return;
509 	default:
510 		break;
511 	}
512 	dev_kfree_skb(skb);
513 }
514 
515 void mt7925_mcu_rx_event(struct mt792x_dev *dev, struct sk_buff *skb)
516 {
517 	struct mt7925_mcu_rxd *rxd = (struct mt7925_mcu_rxd *)skb->data;
518 
519 	if (skb_linearize(skb))
520 		return;
521 
522 	if (rxd->option & MCU_UNI_CMD_UNSOLICITED_EVENT) {
523 		mt7925_mcu_uni_rx_unsolicited_event(dev, skb);
524 		return;
525 	}
526 
527 	mt76_mcu_rx_event(&dev->mt76, skb);
528 }
529 
530 static int
531 mt7925_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
532 		  struct ieee80211_ampdu_params *params,
533 		  bool enable, bool tx)
534 {
535 	struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv;
536 	struct sta_rec_ba_uni *ba;
537 	struct sk_buff *skb;
538 	struct tlv *tlv;
539 	int len;
540 
541 	len = sizeof(struct sta_req_hdr) + sizeof(*ba);
542 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid,
543 					      len);
544 	if (IS_ERR(skb))
545 		return PTR_ERR(skb);
546 
547 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
548 
549 	ba = (struct sta_rec_ba_uni *)tlv;
550 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
551 	ba->winsize = cpu_to_le16(params->buf_size);
552 	ba->ssn = cpu_to_le16(params->ssn);
553 	ba->ba_en = enable << params->tid;
554 	ba->amsdu = params->amsdu;
555 	ba->tid = params->tid;
556 
557 	return mt76_mcu_skb_send_msg(dev, skb,
558 				     MCU_UNI_CMD(STA_REC_UPDATE), true);
559 }
560 
561 /** starec & wtbl **/
562 int mt7925_mcu_uni_tx_ba(struct mt792x_dev *dev,
563 			 struct ieee80211_ampdu_params *params,
564 			 bool enable)
565 {
566 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
567 	struct mt792x_vif *mvif = msta->vif;
568 
569 	if (enable && !params->amsdu)
570 		msta->deflink.wcid.amsdu = false;
571 
572 	return mt7925_mcu_sta_ba(&dev->mt76, &mvif->bss_conf.mt76, params,
573 				 enable, true);
574 }
575 
576 int mt7925_mcu_uni_rx_ba(struct mt792x_dev *dev,
577 			 struct ieee80211_ampdu_params *params,
578 			 bool enable)
579 {
580 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
581 	struct mt792x_vif *mvif = msta->vif;
582 
583 	return mt7925_mcu_sta_ba(&dev->mt76, &mvif->bss_conf.mt76, params,
584 				 enable, false);
585 }
586 
587 static int mt7925_load_clc(struct mt792x_dev *dev, const char *fw_name)
588 {
589 	const struct mt76_connac2_fw_trailer *hdr;
590 	const struct mt76_connac2_fw_region *region;
591 	const struct mt7925_clc *clc;
592 	struct mt76_dev *mdev = &dev->mt76;
593 	struct mt792x_phy *phy = &dev->phy;
594 	const struct firmware *fw;
595 	int ret, i, len, offset = 0;
596 	u8 *clc_base = NULL;
597 
598 	if (mt7925_disable_clc ||
599 	    mt76_is_usb(&dev->mt76))
600 		return 0;
601 
602 	ret = request_firmware(&fw, fw_name, mdev->dev);
603 	if (ret)
604 		return ret;
605 
606 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
607 		dev_err(mdev->dev, "Invalid firmware\n");
608 		ret = -EINVAL;
609 		goto out;
610 	}
611 
612 	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
613 	for (i = 0; i < hdr->n_region; i++) {
614 		region = (const void *)((const u8 *)hdr -
615 					(hdr->n_region - i) * sizeof(*region));
616 		len = le32_to_cpu(region->len);
617 
618 		/* check if we have valid buffer size */
619 		if (offset + len > fw->size) {
620 			dev_err(mdev->dev, "Invalid firmware region\n");
621 			ret = -EINVAL;
622 			goto out;
623 		}
624 
625 		if ((region->feature_set & FW_FEATURE_NON_DL) &&
626 		    region->type == FW_TYPE_CLC) {
627 			clc_base = (u8 *)(fw->data + offset);
628 			break;
629 		}
630 		offset += len;
631 	}
632 
633 	if (!clc_base)
634 		goto out;
635 
636 	for (offset = 0; offset < len; offset += le32_to_cpu(clc->len)) {
637 		clc = (const struct mt7925_clc *)(clc_base + offset);
638 
639 		if (clc->idx >= ARRAY_SIZE(phy->clc))
640 			break;
641 
642 		/* do not init buf again if chip reset triggered */
643 		if (phy->clc[clc->idx])
644 			continue;
645 
646 		phy->clc[clc->idx] = devm_kmemdup(mdev->dev, clc,
647 						  le32_to_cpu(clc->len),
648 						  GFP_KERNEL);
649 
650 		if (!phy->clc[clc->idx]) {
651 			ret = -ENOMEM;
652 			goto out;
653 		}
654 	}
655 
656 	ret = mt7925_mcu_set_clc(dev, "00", ENVIRON_INDOOR);
657 out:
658 	release_firmware(fw);
659 
660 	return ret;
661 }
662 
663 int mt7925_mcu_fw_log_2_host(struct mt792x_dev *dev, u8 ctrl)
664 {
665 	struct {
666 		u8 _rsv[4];
667 
668 		__le16 tag;
669 		__le16 len;
670 		u8 ctrl;
671 		u8 interval;
672 		u8 _rsv2[2];
673 	} __packed req = {
674 		.tag = cpu_to_le16(UNI_WSYS_CONFIG_FW_LOG_CTRL),
675 		.len = cpu_to_le16(sizeof(req) - 4),
676 		.ctrl = ctrl,
677 	};
678 	int ret;
679 
680 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(WSYS_CONFIG),
681 					&req, sizeof(req), false, NULL);
682 	return ret;
683 }
684 
685 int mt7925_mcu_get_temperature(struct mt792x_phy *phy)
686 {
687 	struct {
688 		u8 _rsv[4];
689 
690 		__le16 tag;
691 		__le16 len;
692 		u8 _rsv2[4];
693 	} __packed req = {
694 		.tag = cpu_to_le16(0x0),
695 		.len = cpu_to_le16(sizeof(req) - 4),
696 	};
697 	struct mt7925_thermal_evt {
698 		u8 rsv[4];
699 		__le32 temperature;
700 	} __packed * evt;
701 	struct mt792x_dev *dev = phy->dev;
702 	int temperature, ret;
703 	struct sk_buff *skb;
704 
705 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
706 					MCU_WM_UNI_CMD_QUERY(THERMAL),
707 					&req, sizeof(req), true, &skb);
708 	if (ret)
709 		return ret;
710 
711 	skb_pull(skb, 4 + sizeof(struct tlv));
712 	evt = (struct mt7925_thermal_evt *)skb->data;
713 
714 	temperature = le32_to_cpu(evt->temperature);
715 
716 	dev_kfree_skb(skb);
717 
718 	return temperature;
719 }
720 
721 static void
722 mt7925_mcu_parse_phy_cap(struct mt792x_dev *dev, char *data)
723 {
724 	struct mt76_phy *mphy = &dev->mt76.phy;
725 	struct mt76_dev *mdev = mphy->dev;
726 	struct mt7925_mcu_phy_cap {
727 		u8 ht;
728 		u8 vht;
729 		u8 _5g;
730 		u8 max_bw;
731 		u8 nss;
732 		u8 dbdc;
733 		u8 tx_ldpc;
734 		u8 rx_ldpc;
735 		u8 tx_stbc;
736 		u8 rx_stbc;
737 		u8 hw_path;
738 		u8 he;
739 		u8 eht;
740 	} __packed * cap;
741 	enum {
742 		WF0_24G,
743 		WF0_5G
744 	};
745 
746 	cap = (struct mt7925_mcu_phy_cap *)data;
747 
748 	mdev->phy.antenna_mask = BIT(cap->nss) - 1;
749 	mdev->phy.chainmask = mdev->phy.antenna_mask;
750 	mdev->phy.cap.has_2ghz = cap->hw_path & BIT(WF0_24G);
751 	mdev->phy.cap.has_5ghz = cap->hw_path & BIT(WF0_5G);
752 	dev->has_eht = cap->eht;
753 }
754 
755 static void
756 mt7925_mcu_parse_eml_cap(struct mt792x_dev *dev, char *data)
757 {
758 	struct mt7925_mcu_eml_cap {
759 		u8 rsv[4];
760 		__le16 eml_cap;
761 		u8 rsv2[6];
762 	} __packed * cap;
763 
764 	cap = (struct mt7925_mcu_eml_cap *)data;
765 
766 	dev->phy.eml_cap = le16_to_cpu(cap->eml_cap);
767 }
768 
769 static int
770 mt7925_mcu_get_nic_capability(struct mt792x_dev *dev)
771 {
772 	struct mt76_phy *mphy = &dev->mt76.phy;
773 	struct {
774 		u8 _rsv[4];
775 
776 		__le16 tag;
777 		__le16 len;
778 	} __packed req = {
779 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_NIC_CAPA),
780 		.len = cpu_to_le16(sizeof(req) - 4),
781 	};
782 	struct mt76_connac_cap_hdr {
783 		__le16 n_element;
784 		u8 rsv[2];
785 	} __packed * hdr;
786 	struct sk_buff *skb;
787 	int ret, i;
788 
789 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
790 					&req, sizeof(req), true, &skb);
791 	if (ret)
792 		return ret;
793 
794 	hdr = (struct mt76_connac_cap_hdr *)skb->data;
795 	if (skb->len < sizeof(*hdr)) {
796 		ret = -EINVAL;
797 		goto out;
798 	}
799 
800 	skb_pull(skb, sizeof(*hdr));
801 
802 	for (i = 0; i < le16_to_cpu(hdr->n_element); i++) {
803 		struct tlv *tlv = (struct tlv *)skb->data;
804 		int len;
805 
806 		if (skb->len < sizeof(*tlv))
807 			break;
808 
809 		len = le16_to_cpu(tlv->len);
810 		if (skb->len < len)
811 			break;
812 
813 		switch (le16_to_cpu(tlv->tag)) {
814 		case MT_NIC_CAP_6G:
815 			mphy->cap.has_6ghz = !!tlv->data[0];
816 			break;
817 		case MT_NIC_CAP_MAC_ADDR:
818 			memcpy(mphy->macaddr, (void *)tlv->data, ETH_ALEN);
819 			break;
820 		case MT_NIC_CAP_PHY:
821 			mt7925_mcu_parse_phy_cap(dev, tlv->data);
822 			break;
823 		case MT_NIC_CAP_CHIP_CAP:
824 			dev->phy.chip_cap = le64_to_cpu(*(__le64 *)tlv->data);
825 			break;
826 		case MT_NIC_CAP_EML_CAP:
827 			mt7925_mcu_parse_eml_cap(dev, tlv->data);
828 			break;
829 		default:
830 			break;
831 		}
832 		skb_pull(skb, len);
833 	}
834 out:
835 	dev_kfree_skb(skb);
836 	return ret;
837 }
838 
839 int mt7925_mcu_chip_config(struct mt792x_dev *dev, const char *cmd)
840 {
841 	u16 len = strlen(cmd) + 1;
842 	struct {
843 		u8 _rsv[4];
844 		__le16 tag;
845 		__le16 len;
846 		struct mt76_connac_config config;
847 	} __packed req = {
848 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_CHIP_CFG),
849 		.len = cpu_to_le16(sizeof(req) - 4),
850 		.config = {
851 			.resp_type = 0,
852 			.type = 0,
853 			.data_size = cpu_to_le16(len),
854 		},
855 	};
856 
857 	memcpy(req.config.data, cmd, len);
858 
859 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
860 				 &req, sizeof(req), false);
861 }
862 
863 int mt7925_mcu_set_deep_sleep(struct mt792x_dev *dev, bool enable)
864 {
865 	char cmd[16];
866 
867 	snprintf(cmd, sizeof(cmd), "KeepFullPwr %d", !enable);
868 
869 	return mt7925_mcu_chip_config(dev, cmd);
870 }
871 EXPORT_SYMBOL_GPL(mt7925_mcu_set_deep_sleep);
872 
873 int mt7925_run_firmware(struct mt792x_dev *dev)
874 {
875 	int err;
876 
877 	err = mt792x_load_firmware(dev);
878 	if (err)
879 		return err;
880 
881 	err = mt7925_mcu_get_nic_capability(dev);
882 	if (err)
883 		return err;
884 
885 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
886 	err = mt7925_load_clc(dev, mt792x_ram_name(dev));
887 	if (err)
888 		return err;
889 
890 	return mt7925_mcu_fw_log_2_host(dev, 1);
891 }
892 EXPORT_SYMBOL_GPL(mt7925_run_firmware);
893 
894 static void
895 mt7925_mcu_sta_hdr_trans_tlv(struct sk_buff *skb,
896 			     struct ieee80211_vif *vif,
897 			     struct ieee80211_link_sta *link_sta)
898 {
899 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
900 	struct sta_rec_hdr_trans *hdr_trans;
901 	struct mt76_wcid *wcid;
902 	struct tlv *tlv;
903 
904 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HDR_TRANS, sizeof(*hdr_trans));
905 	hdr_trans = (struct sta_rec_hdr_trans *)tlv;
906 	hdr_trans->dis_rx_hdr_tran = true;
907 
908 	if (vif->type == NL80211_IFTYPE_STATION)
909 		hdr_trans->to_ds = true;
910 	else
911 		hdr_trans->from_ds = true;
912 
913 	if (link_sta) {
914 		struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
915 		struct mt792x_link_sta *mlink;
916 
917 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
918 		wcid = &mlink->wcid;
919 	} else {
920 		wcid = &mvif->sta.deflink.wcid;
921 	}
922 
923 	if (!wcid)
924 		return;
925 
926 	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
927 	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
928 		hdr_trans->to_ds = true;
929 		hdr_trans->from_ds = true;
930 	}
931 }
932 
933 int mt7925_mcu_wtbl_update_hdr_trans(struct mt792x_dev *dev,
934 				     struct ieee80211_vif *vif,
935 				     struct ieee80211_sta *sta,
936 				     int link_id)
937 {
938 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
939 	struct ieee80211_link_sta *link_sta = sta ? &sta->deflink : NULL;
940 	struct mt792x_link_sta *mlink;
941 	struct mt792x_bss_conf *mconf;
942 	struct mt792x_sta *msta;
943 	struct sk_buff *skb;
944 
945 	msta = sta ? (struct mt792x_sta *)sta->drv_priv : &mvif->sta;
946 
947 	mlink = mt792x_sta_to_link(msta, link_id);
948 	link_sta = mt792x_sta_to_link_sta(vif, sta, link_id);
949 	mconf = mt792x_vif_to_link(mvif, link_id);
950 
951 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
952 					      &mlink->wcid,
953 					      MT7925_STA_UPDATE_MAX_SIZE);
954 	if (IS_ERR(skb))
955 		return PTR_ERR(skb);
956 
957 	/* starec hdr trans */
958 	mt7925_mcu_sta_hdr_trans_tlv(skb, vif, link_sta);
959 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
960 				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
961 }
962 
963 int mt7925_mcu_set_tx(struct mt792x_dev *dev,
964 		      struct ieee80211_bss_conf *bss_conf)
965 {
966 #define MCU_EDCA_AC_PARAM	0
967 #define WMM_AIFS_SET		BIT(0)
968 #define WMM_CW_MIN_SET		BIT(1)
969 #define WMM_CW_MAX_SET		BIT(2)
970 #define WMM_TXOP_SET		BIT(3)
971 #define WMM_PARAM_SET		(WMM_AIFS_SET | WMM_CW_MIN_SET | \
972 				 WMM_CW_MAX_SET | WMM_TXOP_SET)
973 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(bss_conf);
974 	struct {
975 		u8 bss_idx;
976 		u8 __rsv[3];
977 	} __packed hdr = {
978 		.bss_idx = mconf->mt76.idx,
979 	};
980 	struct sk_buff *skb;
981 	int len = sizeof(hdr) + IEEE80211_NUM_ACS * sizeof(struct edca);
982 	int ac;
983 
984 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
985 	if (!skb)
986 		return -ENOMEM;
987 
988 	skb_put_data(skb, &hdr, sizeof(hdr));
989 
990 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
991 		struct ieee80211_tx_queue_params *q = &mconf->queue_params[ac];
992 		struct edca *e;
993 		struct tlv *tlv;
994 
995 		tlv = mt76_connac_mcu_add_tlv(skb, MCU_EDCA_AC_PARAM, sizeof(*e));
996 
997 		e = (struct edca *)tlv;
998 		e->set = WMM_PARAM_SET;
999 		e->queue = ac;
1000 		e->aifs = q->aifs;
1001 		e->txop = cpu_to_le16(q->txop);
1002 
1003 		if (q->cw_min)
1004 			e->cw_min = fls(q->cw_min);
1005 		else
1006 			e->cw_min = 5;
1007 
1008 		if (q->cw_max)
1009 			e->cw_max = fls(q->cw_max);
1010 		else
1011 			e->cw_max = 10;
1012 	}
1013 
1014 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1015 				     MCU_UNI_CMD(EDCA_UPDATE), true);
1016 }
1017 
1018 static int
1019 mt7925_mcu_sta_key_tlv(struct mt76_wcid *wcid,
1020 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1021 		       struct sk_buff *skb,
1022 		       struct ieee80211_key_conf *key,
1023 		       enum set_key_cmd cmd,
1024 		       struct mt792x_sta *msta)
1025 {
1026 	struct mt792x_vif *mvif = msta->vif;
1027 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1028 	struct sta_rec_sec_uni *sec;
1029 	struct ieee80211_sta *sta;
1030 	struct ieee80211_vif *vif;
1031 	struct tlv *tlv;
1032 
1033 	sta = msta == &mvif->sta ?
1034 		      NULL :
1035 		      container_of((void *)msta, struct ieee80211_sta, drv_priv);
1036 	vif = container_of((void *)mvif, struct ieee80211_vif, drv_priv);
1037 
1038 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V3, sizeof(*sec));
1039 	sec = (struct sta_rec_sec_uni *)tlv;
1040 	sec->bss_idx = mconf->mt76.idx;
1041 	sec->is_authenticator = 0;
1042 	sec->mgmt_prot = 1; /* only used in MLO mode */
1043 	sec->wlan_idx = (u8)wcid->idx;
1044 
1045 	if (sta) {
1046 		struct ieee80211_link_sta *link_sta;
1047 
1048 		sec->tx_key = 1;
1049 		sec->key_type = 1;
1050 		link_sta = mt792x_sta_to_link_sta(vif, sta, wcid->link_id);
1051 
1052 		if (link_sta)
1053 			memcpy(sec->peer_addr, link_sta->addr, ETH_ALEN);
1054 	} else {
1055 		struct ieee80211_bss_conf *link_conf;
1056 
1057 		link_conf = mt792x_vif_to_bss_conf(vif, wcid->link_id);
1058 
1059 		if (link_conf)
1060 			memcpy(sec->peer_addr, link_conf->bssid, ETH_ALEN);
1061 	}
1062 
1063 	if (cmd == SET_KEY) {
1064 		u8 cipher;
1065 
1066 		sec->add = 1;
1067 		cipher = mt7925_mcu_get_cipher(key->cipher);
1068 		if (cipher == CONNAC3_CIPHER_NONE)
1069 			return -EOPNOTSUPP;
1070 
1071 		if (cipher == CONNAC3_CIPHER_BIP_CMAC_128) {
1072 			sec->cipher_id = CONNAC3_CIPHER_BIP_CMAC_128;
1073 			sec->key_id = sta_key_conf->keyidx;
1074 			sec->key_len = 32;
1075 			memcpy(sec->key, sta_key_conf->key, 16);
1076 			memcpy(sec->key + 16, key->key, 16);
1077 		} else {
1078 			sec->cipher_id = cipher;
1079 			sec->key_id = key->keyidx;
1080 			sec->key_len = key->keylen;
1081 			memcpy(sec->key, key->key, key->keylen);
1082 
1083 			if (cipher == CONNAC3_CIPHER_TKIP) {
1084 				/* Rx/Tx MIC keys are swapped */
1085 				memcpy(sec->key + 16, key->key + 24, 8);
1086 				memcpy(sec->key + 24, key->key + 16, 8);
1087 			}
1088 
1089 			/* store key_conf for BIP batch update */
1090 			if (cipher == CONNAC3_CIPHER_AES_CCMP) {
1091 				memcpy(sta_key_conf->key, key->key, key->keylen);
1092 				sta_key_conf->keyidx = key->keyidx;
1093 			}
1094 		}
1095 	} else {
1096 		sec->add = 0;
1097 	}
1098 
1099 	return 0;
1100 }
1101 
1102 int mt7925_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
1103 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1104 		       struct ieee80211_key_conf *key, int mcu_cmd,
1105 		       struct mt76_wcid *wcid, enum set_key_cmd cmd,
1106 		       struct mt792x_sta *msta)
1107 {
1108 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1109 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1110 	struct sk_buff *skb;
1111 	int ret;
1112 
1113 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, wcid,
1114 					      MT7925_STA_UPDATE_MAX_SIZE);
1115 	if (IS_ERR(skb))
1116 		return PTR_ERR(skb);
1117 
1118 	ret = mt7925_mcu_sta_key_tlv(wcid, sta_key_conf, skb, key, cmd, msta);
1119 	if (ret)
1120 		return ret;
1121 
1122 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
1123 }
1124 
1125 int mt7925_mcu_set_mlo_roc(struct mt792x_bss_conf *mconf, u16 sel_links,
1126 			   int duration, u8 token_id)
1127 {
1128 	struct mt792x_vif *mvif = mconf->vif;
1129 	struct ieee80211_vif *vif = container_of((void *)mvif,
1130 						 struct ieee80211_vif, drv_priv);
1131 	struct ieee80211_bss_conf *link_conf;
1132 	struct ieee80211_channel *chan;
1133 	const u8 ch_band[] = {
1134 		[NL80211_BAND_2GHZ] = 1,
1135 		[NL80211_BAND_5GHZ] = 2,
1136 		[NL80211_BAND_6GHZ] = 3,
1137 	};
1138 	enum mt7925_roc_req type;
1139 	int center_ch, i = 0;
1140 	bool is_AG_band = false;
1141 	struct {
1142 		u8 id;
1143 		u8 bss_idx;
1144 		u16 tag;
1145 		struct mt792x_bss_conf *mconf;
1146 		struct ieee80211_channel *chan;
1147 	} links[2];
1148 
1149 	struct {
1150 		struct {
1151 			u8 rsv[4];
1152 		} __packed hdr;
1153 		struct roc_acquire_tlv roc[2];
1154 	} __packed req;
1155 
1156 	if (!mconf || hweight16(vif->valid_links) < 2 ||
1157 	    hweight16(sel_links) != 2)
1158 		return -EPERM;
1159 
1160 	for (i = 0; i < ARRAY_SIZE(links); i++) {
1161 		links[i].id = i ? __ffs(~BIT(mconf->link_id) & sel_links) :
1162 				 mconf->link_id;
1163 		link_conf = mt792x_vif_to_bss_conf(vif, links[i].id);
1164 		if (WARN_ON_ONCE(!link_conf))
1165 			return -EPERM;
1166 
1167 		links[i].chan = link_conf->chanreq.oper.chan;
1168 		if (WARN_ON_ONCE(!links[i].chan))
1169 			return -EPERM;
1170 
1171 		links[i].mconf = mt792x_vif_to_link(mvif, links[i].id);
1172 		links[i].tag = links[i].id == mconf->link_id ?
1173 			       UNI_ROC_ACQUIRE : UNI_ROC_SUB_LINK;
1174 
1175 		is_AG_band |= links[i].chan->band == NL80211_BAND_2GHZ;
1176 	}
1177 
1178 	if (vif->cfg.eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP)
1179 		type = is_AG_band ? MT7925_ROC_REQ_MLSR_AG :
1180 				    MT7925_ROC_REQ_MLSR_AA;
1181 	else
1182 		type = MT7925_ROC_REQ_JOIN;
1183 
1184 	for (i = 0; i < ARRAY_SIZE(links) && i < hweight16(vif->active_links); i++) {
1185 		if (WARN_ON_ONCE(!links[i].mconf || !links[i].chan))
1186 			continue;
1187 
1188 		chan = links[i].chan;
1189 		center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1190 		req.roc[i].len = cpu_to_le16(sizeof(struct roc_acquire_tlv));
1191 		req.roc[i].tag = cpu_to_le16(links[i].tag);
1192 		req.roc[i].tokenid = token_id;
1193 		req.roc[i].reqtype = type;
1194 		req.roc[i].maxinterval = cpu_to_le32(duration);
1195 		req.roc[i].bss_idx = links[i].mconf->mt76.idx;
1196 		req.roc[i].control_channel = chan->hw_value;
1197 		req.roc[i].bw = CMD_CBW_20MHZ;
1198 		req.roc[i].bw_from_ap = CMD_CBW_20MHZ;
1199 		req.roc[i].center_chan = center_ch;
1200 		req.roc[i].center_chan_from_ap = center_ch;
1201 		req.roc[i].center_chan2 = 0;
1202 		req.roc[i].center_chan2_from_ap = 0;
1203 
1204 		/* STR : 0xfe indicates BAND_ALL with enabling DBDC
1205 		 * EMLSR : 0xff indicates (BAND_AUTO) without DBDC
1206 		 */
1207 		req.roc[i].dbdcband = type == MT7925_ROC_REQ_JOIN ? 0xfe : 0xff;
1208 
1209 		if (chan->hw_value < center_ch)
1210 			req.roc[i].sco = 1; /* SCA */
1211 		else if (chan->hw_value > center_ch)
1212 			req.roc[i].sco = 3; /* SCB */
1213 
1214 		req.roc[i].band = ch_band[chan->band];
1215 	}
1216 
1217 	return mt76_mcu_send_msg(&mvif->phy->dev->mt76, MCU_UNI_CMD(ROC),
1218 				 &req, sizeof(req), false);
1219 }
1220 
1221 int mt7925_mcu_set_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1222 		       struct ieee80211_channel *chan, int duration,
1223 		       enum mt7925_roc_req type, u8 token_id)
1224 {
1225 	int center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1226 	struct mt792x_dev *dev = phy->dev;
1227 	struct {
1228 		struct {
1229 			u8 rsv[4];
1230 		} __packed hdr;
1231 		struct roc_acquire_tlv roc;
1232 	} __packed req = {
1233 		.roc = {
1234 			.tag = cpu_to_le16(UNI_ROC_ACQUIRE),
1235 			.len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1236 			.tokenid = token_id,
1237 			.reqtype = type,
1238 			.maxinterval = cpu_to_le32(duration),
1239 			.bss_idx = mconf->mt76.idx,
1240 			.control_channel = chan->hw_value,
1241 			.bw = CMD_CBW_20MHZ,
1242 			.bw_from_ap = CMD_CBW_20MHZ,
1243 			.center_chan = center_ch,
1244 			.center_chan_from_ap = center_ch,
1245 			.dbdcband = 0xff, /* auto */
1246 		},
1247 	};
1248 
1249 	if (chan->hw_value < center_ch)
1250 		req.roc.sco = 1; /* SCA */
1251 	else if (chan->hw_value > center_ch)
1252 		req.roc.sco = 3; /* SCB */
1253 
1254 	switch (chan->band) {
1255 	case NL80211_BAND_6GHZ:
1256 		req.roc.band = 3;
1257 		break;
1258 	case NL80211_BAND_5GHZ:
1259 		req.roc.band = 2;
1260 		break;
1261 	default:
1262 		req.roc.band = 1;
1263 		break;
1264 	}
1265 
1266 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1267 				 &req, sizeof(req), false);
1268 }
1269 
1270 int mt7925_mcu_abort_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1271 			 u8 token_id)
1272 {
1273 	struct mt792x_dev *dev = phy->dev;
1274 	struct {
1275 		struct {
1276 			u8 rsv[4];
1277 		} __packed hdr;
1278 		struct roc_abort_tlv {
1279 			__le16 tag;
1280 			__le16 len;
1281 			u8 bss_idx;
1282 			u8 tokenid;
1283 			u8 dbdcband;
1284 			u8 rsv[5];
1285 		} __packed abort;
1286 	} __packed req = {
1287 		.abort = {
1288 			.tag = cpu_to_le16(UNI_ROC_ABORT),
1289 			.len = cpu_to_le16(sizeof(struct roc_abort_tlv)),
1290 			.tokenid = token_id,
1291 			.bss_idx = mconf->mt76.idx,
1292 			.dbdcband = 0xff, /* auto*/
1293 		},
1294 	};
1295 
1296 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1297 				 &req, sizeof(req), false);
1298 }
1299 
1300 int mt7925_mcu_set_eeprom(struct mt792x_dev *dev)
1301 {
1302 	struct {
1303 		u8 _rsv[4];
1304 
1305 		__le16 tag;
1306 		__le16 len;
1307 		u8 buffer_mode;
1308 		u8 format;
1309 		__le16 buf_len;
1310 	} __packed req = {
1311 		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
1312 		.len = cpu_to_le16(sizeof(req) - 4),
1313 		.buffer_mode = EE_MODE_EFUSE,
1314 		.format = EE_FORMAT_WHOLE
1315 	};
1316 
1317 	return mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(EFUSE_CTRL),
1318 					 &req, sizeof(req), false, NULL);
1319 }
1320 EXPORT_SYMBOL_GPL(mt7925_mcu_set_eeprom);
1321 
1322 int mt7925_mcu_uni_bss_ps(struct mt792x_dev *dev,
1323 			  struct ieee80211_bss_conf *link_conf)
1324 {
1325 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1326 	struct {
1327 		struct {
1328 			u8 bss_idx;
1329 			u8 pad[3];
1330 		} __packed hdr;
1331 		struct ps_tlv {
1332 			__le16 tag;
1333 			__le16 len;
1334 			u8 ps_state; /* 0: device awake
1335 				      * 1: static power save
1336 				      * 2: dynamic power saving
1337 				      * 3: enter TWT power saving
1338 				      * 4: leave TWT power saving
1339 				      */
1340 			u8 pad[3];
1341 		} __packed ps;
1342 	} __packed ps_req = {
1343 		.hdr = {
1344 			.bss_idx = mconf->mt76.idx,
1345 		},
1346 		.ps = {
1347 			.tag = cpu_to_le16(UNI_BSS_INFO_PS),
1348 			.len = cpu_to_le16(sizeof(struct ps_tlv)),
1349 			.ps_state = link_conf->vif->cfg.ps ? 2 : 0,
1350 		},
1351 	};
1352 
1353 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1354 		return -EOPNOTSUPP;
1355 
1356 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1357 				 &ps_req, sizeof(ps_req), true);
1358 }
1359 
1360 static int
1361 mt7925_mcu_uni_bss_bcnft(struct mt792x_dev *dev,
1362 			 struct ieee80211_bss_conf *link_conf, bool enable)
1363 {
1364 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1365 	struct {
1366 		struct {
1367 			u8 bss_idx;
1368 			u8 pad[3];
1369 		} __packed hdr;
1370 		struct bcnft_tlv {
1371 			__le16 tag;
1372 			__le16 len;
1373 			__le16 bcn_interval;
1374 			u8 dtim_period;
1375 			u8 bmc_delivered_ac;
1376 			u8 bmc_triggered_ac;
1377 			u8 pad[3];
1378 		} __packed bcnft;
1379 	} __packed bcnft_req = {
1380 		.hdr = {
1381 			.bss_idx = mconf->mt76.idx,
1382 		},
1383 		.bcnft = {
1384 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1385 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1386 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1387 			.dtim_period = link_conf->dtim_period,
1388 		},
1389 	};
1390 
1391 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1392 		return 0;
1393 
1394 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1395 				 &bcnft_req, sizeof(bcnft_req), true);
1396 }
1397 
1398 int
1399 mt7925_mcu_set_bss_pm(struct mt792x_dev *dev,
1400 		      struct ieee80211_bss_conf *link_conf,
1401 		      bool enable)
1402 {
1403 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1404 	struct {
1405 		struct {
1406 			u8 bss_idx;
1407 			u8 pad[3];
1408 		} __packed hdr;
1409 		struct bcnft_tlv {
1410 			__le16 tag;
1411 			__le16 len;
1412 			__le16 bcn_interval;
1413 			u8 dtim_period;
1414 			u8 bmc_delivered_ac;
1415 			u8 bmc_triggered_ac;
1416 			u8 pad[3];
1417 		} __packed enable;
1418 	} req = {
1419 		.hdr = {
1420 			.bss_idx = mconf->mt76.idx,
1421 		},
1422 		.enable = {
1423 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1424 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1425 			.dtim_period = link_conf->dtim_period,
1426 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1427 		},
1428 	};
1429 	struct {
1430 		struct {
1431 			u8 bss_idx;
1432 			u8 pad[3];
1433 		} __packed hdr;
1434 		struct pm_disable {
1435 			__le16 tag;
1436 			__le16 len;
1437 		} __packed disable;
1438 	} req1 = {
1439 		.hdr = {
1440 			.bss_idx = mconf->mt76.idx,
1441 		},
1442 		.disable = {
1443 			.tag = cpu_to_le16(UNI_BSS_INFO_PM_DISABLE),
1444 			.len = cpu_to_le16(sizeof(struct pm_disable))
1445 		},
1446 	};
1447 	int err;
1448 
1449 	err = mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1450 				&req1, sizeof(req1), false);
1451 	if (err < 0 || !enable)
1452 		return err;
1453 
1454 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1455 				 &req, sizeof(req), false);
1456 }
1457 
1458 static void
1459 mt7925_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1460 {
1461 	if (!link_sta->he_cap.has_he)
1462 		return;
1463 
1464 	mt76_connac_mcu_sta_he_tlv_v2(skb, link_sta->sta);
1465 }
1466 
1467 static void
1468 mt7925_mcu_sta_he_6g_tlv(struct sk_buff *skb,
1469 			 struct ieee80211_link_sta *link_sta)
1470 {
1471 	struct sta_rec_he_6g_capa *he_6g;
1472 	struct tlv *tlv;
1473 
1474 	if (!link_sta->he_6ghz_capa.capa)
1475 		return;
1476 
1477 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G, sizeof(*he_6g));
1478 
1479 	he_6g = (struct sta_rec_he_6g_capa *)tlv;
1480 	he_6g->capa = link_sta->he_6ghz_capa.capa;
1481 }
1482 
1483 static void
1484 mt7925_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1485 {
1486 	struct ieee80211_eht_mcs_nss_supp *mcs_map;
1487 	struct ieee80211_eht_cap_elem_fixed *elem;
1488 	struct sta_rec_eht *eht;
1489 	struct tlv *tlv;
1490 
1491 	if (!link_sta->eht_cap.has_eht)
1492 		return;
1493 
1494 	mcs_map = &link_sta->eht_cap.eht_mcs_nss_supp;
1495 	elem = &link_sta->eht_cap.eht_cap_elem;
1496 
1497 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT, sizeof(*eht));
1498 
1499 	eht = (struct sta_rec_eht *)tlv;
1500 	eht->tid_bitmap = 0xff;
1501 	eht->mac_cap = cpu_to_le16(*(u16 *)elem->mac_cap_info);
1502 	eht->phy_cap = cpu_to_le64(*(u64 *)elem->phy_cap_info);
1503 	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
1504 
1505 	if (link_sta->bandwidth == IEEE80211_STA_RX_BW_20)
1506 		memcpy(eht->mcs_map_bw20, &mcs_map->only_20mhz, sizeof(eht->mcs_map_bw20));
1507 	memcpy(eht->mcs_map_bw80, &mcs_map->bw._80, sizeof(eht->mcs_map_bw80));
1508 	memcpy(eht->mcs_map_bw160, &mcs_map->bw._160, sizeof(eht->mcs_map_bw160));
1509 }
1510 
1511 static void
1512 mt7925_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1513 {
1514 	struct sta_rec_ht *ht;
1515 	struct tlv *tlv;
1516 
1517 	if (!link_sta->ht_cap.ht_supported)
1518 		return;
1519 
1520 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1521 
1522 	ht = (struct sta_rec_ht *)tlv;
1523 	ht->ht_cap = cpu_to_le16(link_sta->ht_cap.cap);
1524 }
1525 
1526 static void
1527 mt7925_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1528 {
1529 	struct sta_rec_vht *vht;
1530 	struct tlv *tlv;
1531 
1532 	/* For 6G band, this tlv is necessary to let hw work normally */
1533 	if (!link_sta->he_6ghz_capa.capa && !link_sta->vht_cap.vht_supported)
1534 		return;
1535 
1536 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1537 
1538 	vht = (struct sta_rec_vht *)tlv;
1539 	vht->vht_cap = cpu_to_le32(link_sta->vht_cap.cap);
1540 	vht->vht_rx_mcs_map = link_sta->vht_cap.vht_mcs.rx_mcs_map;
1541 	vht->vht_tx_mcs_map = link_sta->vht_cap.vht_mcs.tx_mcs_map;
1542 }
1543 
1544 static void
1545 mt7925_mcu_sta_amsdu_tlv(struct sk_buff *skb,
1546 			 struct ieee80211_vif *vif,
1547 			 struct ieee80211_link_sta *link_sta)
1548 {
1549 	struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1550 	struct mt792x_link_sta *mlink;
1551 	struct sta_rec_amsdu *amsdu;
1552 	struct tlv *tlv;
1553 
1554 	if (vif->type != NL80211_IFTYPE_STATION &&
1555 	    vif->type != NL80211_IFTYPE_AP)
1556 		return;
1557 
1558 	if (!link_sta->agg.max_amsdu_len)
1559 		return;
1560 
1561 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1562 	amsdu = (struct sta_rec_amsdu *)tlv;
1563 	amsdu->max_amsdu_num = 8;
1564 	amsdu->amsdu_en = true;
1565 
1566 	mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1567 	mlink->wcid.amsdu = true;
1568 
1569 	switch (link_sta->agg.max_amsdu_len) {
1570 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1571 		amsdu->max_mpdu_size =
1572 			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1573 		return;
1574 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
1575 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1576 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1577 		return;
1578 	default:
1579 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1580 		return;
1581 	}
1582 }
1583 
1584 static void
1585 mt7925_mcu_sta_phy_tlv(struct sk_buff *skb,
1586 		       struct ieee80211_vif *vif,
1587 		       struct ieee80211_link_sta *link_sta)
1588 {
1589 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1590 	struct ieee80211_bss_conf *link_conf;
1591 	struct cfg80211_chan_def *chandef;
1592 	struct mt792x_bss_conf *mconf;
1593 	struct sta_rec_phy *phy;
1594 	struct tlv *tlv;
1595 	u8 af = 0, mm = 0;
1596 
1597 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1598 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1599 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1600 				    &link_conf->chanreq.oper;
1601 
1602 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PHY, sizeof(*phy));
1603 	phy = (struct sta_rec_phy *)tlv;
1604 	phy->phy_type = mt76_connac_get_phy_mode_v2(mvif->phy->mt76, vif,
1605 						    chandef->chan->band,
1606 						    link_sta);
1607 	phy->basic_rate = cpu_to_le16((u16)link_conf->basic_rates);
1608 	if (link_sta->ht_cap.ht_supported) {
1609 		af = link_sta->ht_cap.ampdu_factor;
1610 		mm = link_sta->ht_cap.ampdu_density;
1611 	}
1612 
1613 	if (link_sta->vht_cap.vht_supported) {
1614 		u8 vht_af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1615 				      link_sta->vht_cap.cap);
1616 
1617 		af = max_t(u8, af, vht_af);
1618 	}
1619 
1620 	if (link_sta->he_6ghz_capa.capa) {
1621 		af = le16_get_bits(link_sta->he_6ghz_capa.capa,
1622 				   IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1623 		mm = le16_get_bits(link_sta->he_6ghz_capa.capa,
1624 				   IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
1625 	}
1626 
1627 	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR, af) |
1628 		     FIELD_PREP(IEEE80211_HT_AMPDU_PARM_DENSITY, mm);
1629 	phy->max_ampdu_len = af;
1630 }
1631 
1632 static void
1633 mt7925_mcu_sta_state_v2_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
1634 			    struct ieee80211_link_sta *link_sta,
1635 			    struct ieee80211_vif *vif,
1636 			    u8 rcpi, u8 sta_state)
1637 {
1638 	struct sta_rec_state_v2 {
1639 		__le16 tag;
1640 		__le16 len;
1641 		u8 state;
1642 		u8 rsv[3];
1643 		__le32 flags;
1644 		u8 vht_opmode;
1645 		u8 action;
1646 		u8 rsv2[2];
1647 	} __packed * state;
1648 	struct tlv *tlv;
1649 
1650 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_STATE, sizeof(*state));
1651 	state = (struct sta_rec_state_v2 *)tlv;
1652 	state->state = sta_state;
1653 
1654 	if (link_sta->vht_cap.vht_supported) {
1655 		state->vht_opmode = link_sta->bandwidth;
1656 		state->vht_opmode |= link_sta->rx_nss <<
1657 			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
1658 	}
1659 }
1660 
1661 static void
1662 mt7925_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb,
1663 			     struct ieee80211_vif *vif,
1664 			     struct ieee80211_link_sta *link_sta)
1665 {
1666 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1667 	struct ieee80211_bss_conf *link_conf;
1668 	struct cfg80211_chan_def *chandef;
1669 	struct sta_rec_ra_info *ra_info;
1670 	struct mt792x_bss_conf *mconf;
1671 	enum nl80211_band band;
1672 	struct tlv *tlv;
1673 	u16 supp_rates;
1674 
1675 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1676 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1677 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1678 				    &link_conf->chanreq.oper;
1679 	band = chandef->chan->band;
1680 
1681 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra_info));
1682 	ra_info = (struct sta_rec_ra_info *)tlv;
1683 
1684 	supp_rates = link_sta->supp_rates[band];
1685 	if (band == NL80211_BAND_2GHZ)
1686 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
1687 			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
1688 	else
1689 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates);
1690 
1691 	ra_info->legacy = cpu_to_le16(supp_rates);
1692 
1693 	if (link_sta->ht_cap.ht_supported)
1694 		memcpy(ra_info->rx_mcs_bitmask,
1695 		       link_sta->ht_cap.mcs.rx_mask,
1696 		       HT_MCS_MASK_NUM);
1697 }
1698 
1699 static void
1700 mt7925_mcu_sta_eht_mld_tlv(struct sk_buff *skb,
1701 			   struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1702 {
1703 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1704 	struct wiphy *wiphy = mvif->phy->mt76->hw->wiphy;
1705 	const struct wiphy_iftype_ext_capab *ext_capa;
1706 	struct sta_rec_eht_mld *eht_mld;
1707 	struct tlv *tlv;
1708 	u16 eml_cap;
1709 
1710 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT_MLD, sizeof(*eht_mld));
1711 	eht_mld = (struct sta_rec_eht_mld *)tlv;
1712 	eht_mld->mld_type = 0xff;
1713 
1714 	if (!ieee80211_vif_is_mld(vif))
1715 		return;
1716 
1717 	ext_capa = cfg80211_get_iftype_ext_capa(wiphy,
1718 						ieee80211_vif_type_p2p(vif));
1719 	if (!ext_capa)
1720 		return;
1721 
1722 	eml_cap = (vif->cfg.eml_cap & (IEEE80211_EML_CAP_EMLSR_SUPP |
1723 				       IEEE80211_EML_CAP_TRANSITION_TIMEOUT)) |
1724 		  (ext_capa->eml_capabilities & (IEEE80211_EML_CAP_EMLSR_PADDING_DELAY |
1725 						IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY));
1726 
1727 	if (eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP) {
1728 		eht_mld->eml_cap[0] = u16_get_bits(eml_cap, GENMASK(7, 0));
1729 		eht_mld->eml_cap[1] = u16_get_bits(eml_cap, GENMASK(15, 8));
1730 	} else {
1731 		eht_mld->str_cap[0] = BIT(1);
1732 	}
1733 }
1734 
1735 static void
1736 mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,
1737 		       struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1738 {
1739 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1740 	struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv;
1741 	unsigned long valid = mvif->valid_links;
1742 	struct mt792x_bss_conf *mconf;
1743 	struct mt792x_link_sta *mlink;
1744 	struct sta_rec_mld *mld;
1745 	struct tlv *tlv;
1746 	int i, cnt = 0;
1747 
1748 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MLD, sizeof(*mld));
1749 	mld = (struct sta_rec_mld *)tlv;
1750 	memcpy(mld->mac_addr, sta->addr, ETH_ALEN);
1751 	mld->primary_id = cpu_to_le16(msta->deflink.wcid.idx);
1752 	mld->wlan_id = cpu_to_le16(msta->deflink.wcid.idx);
1753 	mld->link_num = min_t(u8, hweight16(mvif->valid_links), 2);
1754 
1755 	for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
1756 		if (cnt == mld->link_num)
1757 			break;
1758 
1759 		mconf = mt792x_vif_to_link(mvif, i);
1760 		mlink = mt792x_sta_to_link(msta, i);
1761 		mld->link[cnt].wlan_id = cpu_to_le16(mlink->wcid.idx);
1762 		mld->link[cnt++].bss_idx = mconf->mt76.idx;
1763 
1764 		if (mlink != &msta->deflink)
1765 			mld->secondary_id = cpu_to_le16(mlink->wcid.idx);
1766 	}
1767 }
1768 
1769 static int
1770 mt7925_mcu_sta_cmd(struct mt76_phy *phy,
1771 		   struct mt76_sta_cmd_info *info)
1772 {
1773 	struct mt76_vif *mvif = (struct mt76_vif *)info->vif->drv_priv;
1774 	struct mt76_dev *dev = phy->dev;
1775 	struct sk_buff *skb;
1776 	int conn_state;
1777 
1778 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, info->wcid,
1779 					      MT7925_STA_UPDATE_MAX_SIZE);
1780 	if (IS_ERR(skb))
1781 		return PTR_ERR(skb);
1782 
1783 	conn_state = info->enable ? CONN_STATE_PORT_SECURE :
1784 				    CONN_STATE_DISCONNECT;
1785 	if (info->link_sta)
1786 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif,
1787 					      info->link_sta,
1788 					      conn_state, info->newly);
1789 	if (info->link_sta && info->enable) {
1790 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1791 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1792 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1793 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1794 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1795 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1796 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1797 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1798 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1799 					     info->link_sta);
1800 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1801 					    info->vif, info->rcpi,
1802 					    info->state);
1803 		mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1804 	}
1805 
1806 	if (info->enable)
1807 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
1808 
1809 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1810 }
1811 
1812 static void
1813 mt7925_mcu_sta_remove_tlv(struct sk_buff *skb)
1814 {
1815 	struct sta_rec_remove *rem;
1816 	struct tlv *tlv;
1817 
1818 	tlv = mt76_connac_mcu_add_tlv(skb, 0x25, sizeof(*rem));
1819 	rem = (struct sta_rec_remove *)tlv;
1820 	rem->action = 0;
1821 }
1822 
1823 static int
1824 mt7925_mcu_mlo_sta_cmd(struct mt76_phy *phy,
1825 		       struct mt76_sta_cmd_info *info)
1826 {
1827 	struct mt792x_vif *mvif = (struct mt792x_vif *)info->vif->drv_priv;
1828 	struct mt76_dev *dev = phy->dev;
1829 	struct mt792x_bss_conf *mconf;
1830 	struct sk_buff *skb;
1831 
1832 	mconf = mt792x_vif_to_link(mvif, info->wcid->link_id);
1833 
1834 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, info->wcid,
1835 					      MT7925_STA_UPDATE_MAX_SIZE);
1836 	if (IS_ERR(skb))
1837 		return PTR_ERR(skb);
1838 
1839 	if (info->enable)
1840 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif,
1841 					      info->link_sta,
1842 					      info->enable, info->newly);
1843 
1844 	if (info->enable && info->link_sta) {
1845 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1846 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1847 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1848 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1849 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1850 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1851 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1852 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1853 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1854 					     info->link_sta);
1855 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1856 					    info->vif, info->rcpi,
1857 					    info->state);
1858 
1859 		if (info->state != MT76_STA_INFO_STATE_NONE) {
1860 			mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1861 			mt7925_mcu_sta_eht_mld_tlv(skb, info->vif, info->link_sta->sta);
1862 		}
1863 
1864 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
1865 	}
1866 
1867 	if (!info->enable) {
1868 		mt7925_mcu_sta_remove_tlv(skb);
1869 		mt76_connac_mcu_add_tlv(skb, STA_REC_MLD_OFF,
1870 					sizeof(struct tlv));
1871 	}
1872 
1873 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1874 }
1875 
1876 int mt7925_mcu_sta_update(struct mt792x_dev *dev,
1877 			  struct ieee80211_link_sta *link_sta,
1878 			  struct ieee80211_vif *vif, bool enable,
1879 			  enum mt76_sta_info_state state)
1880 {
1881 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1882 	int rssi = -ewma_rssi_read(&mvif->bss_conf.rssi);
1883 	struct mt76_sta_cmd_info info = {
1884 		.link_sta = link_sta,
1885 		.vif = vif,
1886 		.enable = enable,
1887 		.cmd = MCU_UNI_CMD(STA_REC_UPDATE),
1888 		.state = state,
1889 		.offload_fw = true,
1890 		.rcpi = to_rcpi(rssi),
1891 	};
1892 	struct mt792x_sta *msta;
1893 	struct mt792x_link_sta *mlink;
1894 	int err;
1895 
1896 	if (link_sta) {
1897 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1898 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1899 	}
1900 	info.wcid = link_sta ? &mlink->wcid : &mvif->sta.deflink.wcid;
1901 	info.newly = link_sta ? state != MT76_STA_INFO_STATE_ASSOC : true;
1902 
1903 	if (ieee80211_vif_is_mld(vif))
1904 		err = mt7925_mcu_mlo_sta_cmd(&dev->mphy, &info);
1905 	else
1906 		err = mt7925_mcu_sta_cmd(&dev->mphy, &info);
1907 
1908 	return err;
1909 }
1910 
1911 int mt7925_mcu_set_beacon_filter(struct mt792x_dev *dev,
1912 				 struct ieee80211_vif *vif,
1913 				 bool enable)
1914 {
1915 #define MT7925_FIF_BIT_CLR		BIT(1)
1916 #define MT7925_FIF_BIT_SET		BIT(0)
1917 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1918 	unsigned long valid = ieee80211_vif_is_mld(vif) ?
1919 				      mvif->valid_links : BIT(0);
1920 	struct ieee80211_bss_conf *bss_conf;
1921 	int err = 0;
1922 	int i;
1923 
1924 	if (enable) {
1925 		for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
1926 			bss_conf = mt792x_vif_to_bss_conf(vif, i);
1927 			err = mt7925_mcu_uni_bss_bcnft(dev, bss_conf, true);
1928 			if (err < 0)
1929 				return err;
1930 		}
1931 
1932 		return mt7925_mcu_set_rxfilter(dev, 0,
1933 					       MT7925_FIF_BIT_SET,
1934 					       MT_WF_RFCR_DROP_OTHER_BEACON);
1935 	}
1936 
1937 	for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
1938 		bss_conf = mt792x_vif_to_bss_conf(vif, i);
1939 		err = mt7925_mcu_set_bss_pm(dev, bss_conf, false);
1940 		if (err)
1941 			return err;
1942 	}
1943 
1944 	return mt7925_mcu_set_rxfilter(dev, 0,
1945 				       MT7925_FIF_BIT_CLR,
1946 				       MT_WF_RFCR_DROP_OTHER_BEACON);
1947 }
1948 
1949 int mt7925_get_txpwr_info(struct mt792x_dev *dev, u8 band_idx, struct mt7925_txpwr *txpwr)
1950 {
1951 #define TX_POWER_SHOW_INFO 0x7
1952 #define TXPOWER_ALL_RATE_POWER_INFO 0x2
1953 	struct mt7925_txpwr_event *event;
1954 	struct mt7925_txpwr_req req = {
1955 		.tag = cpu_to_le16(TX_POWER_SHOW_INFO),
1956 		.len = cpu_to_le16(sizeof(req) - 4),
1957 		.catg = TXPOWER_ALL_RATE_POWER_INFO,
1958 		.band_idx = band_idx,
1959 	};
1960 	struct sk_buff *skb;
1961 	int ret;
1962 
1963 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(TXPOWER),
1964 					&req, sizeof(req), true, &skb);
1965 	if (ret)
1966 		return ret;
1967 
1968 	event = (struct mt7925_txpwr_event *)skb->data;
1969 	memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
1970 
1971 	dev_kfree_skb(skb);
1972 
1973 	return 0;
1974 }
1975 
1976 int mt7925_mcu_set_sniffer(struct mt792x_dev *dev, struct ieee80211_vif *vif,
1977 			   bool enable)
1978 {
1979 	struct {
1980 		struct {
1981 			u8 band_idx;
1982 			u8 pad[3];
1983 		} __packed hdr;
1984 		struct sniffer_enable_tlv {
1985 			__le16 tag;
1986 			__le16 len;
1987 			u8 enable;
1988 			u8 pad[3];
1989 		} __packed enable;
1990 	} __packed req = {
1991 		.hdr = {
1992 			.band_idx = 0,
1993 		},
1994 		.enable = {
1995 			.tag = cpu_to_le16(UNI_SNIFFER_ENABLE),
1996 			.len = cpu_to_le16(sizeof(struct sniffer_enable_tlv)),
1997 			.enable = enable,
1998 		},
1999 	};
2000 
2001 	mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req), true);
2002 
2003 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req),
2004 				 true);
2005 }
2006 
2007 int mt7925_mcu_config_sniffer(struct mt792x_vif *vif,
2008 			      struct ieee80211_chanctx_conf *ctx)
2009 {
2010 	struct mt76_phy *mphy = vif->phy->mt76;
2011 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def : &mphy->chandef;
2012 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2013 
2014 	static const u8 ch_band[] = {
2015 		[NL80211_BAND_2GHZ] = 1,
2016 		[NL80211_BAND_5GHZ] = 2,
2017 		[NL80211_BAND_6GHZ] = 3,
2018 	};
2019 	static const u8 ch_width[] = {
2020 		[NL80211_CHAN_WIDTH_20_NOHT] = 0,
2021 		[NL80211_CHAN_WIDTH_20] = 0,
2022 		[NL80211_CHAN_WIDTH_40] = 0,
2023 		[NL80211_CHAN_WIDTH_80] = 1,
2024 		[NL80211_CHAN_WIDTH_160] = 2,
2025 		[NL80211_CHAN_WIDTH_80P80] = 3,
2026 		[NL80211_CHAN_WIDTH_5] = 4,
2027 		[NL80211_CHAN_WIDTH_10] = 5,
2028 		[NL80211_CHAN_WIDTH_320] = 6,
2029 	};
2030 
2031 	struct {
2032 		struct {
2033 			u8 band_idx;
2034 			u8 pad[3];
2035 		} __packed hdr;
2036 		struct config_tlv {
2037 			__le16 tag;
2038 			__le16 len;
2039 			u16 aid;
2040 			u8 ch_band;
2041 			u8 bw;
2042 			u8 control_ch;
2043 			u8 sco;
2044 			u8 center_ch;
2045 			u8 center_ch2;
2046 			u8 drop_err;
2047 			u8 pad[3];
2048 		} __packed tlv;
2049 	} __packed req = {
2050 		.hdr = {
2051 			.band_idx = 0,
2052 		},
2053 		.tlv = {
2054 			.tag = cpu_to_le16(UNI_SNIFFER_CONFIG),
2055 			.len = cpu_to_le16(sizeof(req.tlv)),
2056 			.control_ch = chandef->chan->hw_value,
2057 			.center_ch = ieee80211_frequency_to_channel(freq1),
2058 			.drop_err = 1,
2059 		},
2060 	};
2061 
2062 	if (chandef->chan->band < ARRAY_SIZE(ch_band))
2063 		req.tlv.ch_band = ch_band[chandef->chan->band];
2064 	if (chandef->width < ARRAY_SIZE(ch_width))
2065 		req.tlv.bw = ch_width[chandef->width];
2066 
2067 	if (freq2)
2068 		req.tlv.center_ch2 = ieee80211_frequency_to_channel(freq2);
2069 
2070 	if (req.tlv.control_ch < req.tlv.center_ch)
2071 		req.tlv.sco = 1; /* SCA */
2072 	else if (req.tlv.control_ch > req.tlv.center_ch)
2073 		req.tlv.sco = 3; /* SCB */
2074 
2075 	return mt76_mcu_send_msg(mphy->dev, MCU_UNI_CMD(SNIFFER),
2076 				 &req, sizeof(req), true);
2077 }
2078 
2079 int
2080 mt7925_mcu_uni_add_beacon_offload(struct mt792x_dev *dev,
2081 				  struct ieee80211_hw *hw,
2082 				  struct ieee80211_vif *vif,
2083 				  bool enable)
2084 {
2085 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
2086 	struct ieee80211_mutable_offsets offs;
2087 	struct {
2088 		struct req_hdr {
2089 			u8 bss_idx;
2090 			u8 pad[3];
2091 		} __packed hdr;
2092 		struct bcn_content_tlv {
2093 			__le16 tag;
2094 			__le16 len;
2095 			__le16 tim_ie_pos;
2096 			__le16 csa_ie_pos;
2097 			__le16 bcc_ie_pos;
2098 			/* 0: disable beacon offload
2099 			 * 1: enable beacon offload
2100 			 * 2: update probe respond offload
2101 			 */
2102 			u8 enable;
2103 			/* 0: legacy format (TXD + payload)
2104 			 * 1: only cap field IE
2105 			 */
2106 			u8 type;
2107 			__le16 pkt_len;
2108 			u8 pkt[512];
2109 		} __packed beacon_tlv;
2110 	} req = {
2111 		.hdr = {
2112 			.bss_idx = mvif->bss_conf.mt76.idx,
2113 		},
2114 		.beacon_tlv = {
2115 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
2116 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
2117 			.enable = enable,
2118 			.type = 1,
2119 		},
2120 	};
2121 	struct sk_buff *skb;
2122 	u8 cap_offs;
2123 
2124 	/* support enable/update process only
2125 	 * disable flow would be handled in bss stop handler automatically
2126 	 */
2127 	if (!enable)
2128 		return -EOPNOTSUPP;
2129 
2130 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs, 0);
2131 	if (!skb)
2132 		return -EINVAL;
2133 
2134 	cap_offs = offsetof(struct ieee80211_mgmt, u.beacon.capab_info);
2135 	if (!skb_pull(skb, cap_offs)) {
2136 		dev_err(dev->mt76.dev, "beacon format err\n");
2137 		dev_kfree_skb(skb);
2138 		return -EINVAL;
2139 	}
2140 
2141 	if (skb->len > 512) {
2142 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
2143 		dev_kfree_skb(skb);
2144 		return -EINVAL;
2145 	}
2146 
2147 	memcpy(req.beacon_tlv.pkt, skb->data, skb->len);
2148 	req.beacon_tlv.pkt_len = cpu_to_le16(skb->len);
2149 	offs.tim_offset -= cap_offs;
2150 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(offs.tim_offset);
2151 
2152 	if (offs.cntdwn_counter_offs[0]) {
2153 		u16 csa_offs;
2154 
2155 		csa_offs = offs.cntdwn_counter_offs[0] - cap_offs - 4;
2156 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
2157 	}
2158 	dev_kfree_skb(skb);
2159 
2160 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
2161 				 &req, sizeof(req), true);
2162 }
2163 
2164 static
2165 void mt7925_mcu_bss_rlm_tlv(struct sk_buff *skb, struct mt76_phy *phy,
2166 			    struct ieee80211_bss_conf *link_conf,
2167 			    struct ieee80211_chanctx_conf *ctx)
2168 {
2169 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2170 						  &link_conf->chanreq.oper;
2171 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2172 	enum nl80211_band band = chandef->chan->band;
2173 	struct bss_rlm_tlv *req;
2174 	struct tlv *tlv;
2175 
2176 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RLM, sizeof(*req));
2177 	req = (struct bss_rlm_tlv *)tlv;
2178 	req->control_channel = chandef->chan->hw_value;
2179 	req->center_chan = ieee80211_frequency_to_channel(freq1);
2180 	req->center_chan2 = 0;
2181 	req->tx_streams = hweight8(phy->antenna_mask);
2182 	req->ht_op_info = 4; /* set HT 40M allowed */
2183 	req->rx_streams = hweight8(phy->antenna_mask);
2184 	req->center_chan2 = 0;
2185 	req->sco = 0;
2186 	req->band = 1;
2187 
2188 	switch (band) {
2189 	case NL80211_BAND_2GHZ:
2190 		req->band = 1;
2191 		break;
2192 	case NL80211_BAND_5GHZ:
2193 		req->band = 2;
2194 		break;
2195 	case NL80211_BAND_6GHZ:
2196 		req->band = 3;
2197 		break;
2198 	default:
2199 		break;
2200 	}
2201 
2202 	switch (chandef->width) {
2203 	case NL80211_CHAN_WIDTH_40:
2204 		req->bw = CMD_CBW_40MHZ;
2205 		break;
2206 	case NL80211_CHAN_WIDTH_80:
2207 		req->bw = CMD_CBW_80MHZ;
2208 		break;
2209 	case NL80211_CHAN_WIDTH_80P80:
2210 		req->bw = CMD_CBW_8080MHZ;
2211 		req->center_chan2 = ieee80211_frequency_to_channel(freq2);
2212 		break;
2213 	case NL80211_CHAN_WIDTH_160:
2214 		req->bw = CMD_CBW_160MHZ;
2215 		break;
2216 	case NL80211_CHAN_WIDTH_5:
2217 		req->bw = CMD_CBW_5MHZ;
2218 		break;
2219 	case NL80211_CHAN_WIDTH_10:
2220 		req->bw = CMD_CBW_10MHZ;
2221 		break;
2222 	case NL80211_CHAN_WIDTH_20_NOHT:
2223 	case NL80211_CHAN_WIDTH_20:
2224 	default:
2225 		req->bw = CMD_CBW_20MHZ;
2226 		req->ht_op_info = 0;
2227 		break;
2228 	}
2229 
2230 	if (req->control_channel < req->center_chan)
2231 		req->sco = 1; /* SCA */
2232 	else if (req->control_channel > req->center_chan)
2233 		req->sco = 3; /* SCB */
2234 }
2235 
2236 static struct sk_buff *
2237 __mt7925_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
2238 {
2239 	struct bss_req_hdr hdr = {
2240 		.bss_idx = mvif->idx,
2241 	};
2242 	struct sk_buff *skb;
2243 
2244 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
2245 	if (!skb)
2246 		return ERR_PTR(-ENOMEM);
2247 
2248 	skb_put_data(skb, &hdr, sizeof(hdr));
2249 
2250 	return skb;
2251 }
2252 
2253 int mt7925_mcu_set_chctx(struct mt76_phy *phy, struct mt76_vif *mvif,
2254 			 struct ieee80211_bss_conf *link_conf,
2255 			 struct ieee80211_chanctx_conf *ctx)
2256 {
2257 	struct sk_buff *skb;
2258 
2259 	skb = __mt7925_mcu_alloc_bss_req(phy->dev, mvif,
2260 					 MT7925_BSS_UPDATE_MAX_SIZE);
2261 	if (IS_ERR(skb))
2262 		return PTR_ERR(skb);
2263 
2264 	mt7925_mcu_bss_rlm_tlv(skb, phy, link_conf, ctx);
2265 
2266 	return mt76_mcu_skb_send_msg(phy->dev, skb,
2267 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2268 }
2269 
2270 static u8
2271 mt7925_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
2272 			enum nl80211_band band,
2273 			struct ieee80211_link_sta *link_sta)
2274 {
2275 	struct ieee80211_he_6ghz_capa *he_6ghz_capa;
2276 	const struct ieee80211_sta_eht_cap *eht_cap;
2277 	__le16 capa = 0;
2278 	u8 mode = 0;
2279 
2280 	if (link_sta) {
2281 		he_6ghz_capa = &link_sta->he_6ghz_capa;
2282 		eht_cap = &link_sta->eht_cap;
2283 	} else {
2284 		struct ieee80211_supported_band *sband;
2285 
2286 		sband = phy->hw->wiphy->bands[band];
2287 		capa = ieee80211_get_he_6ghz_capa(sband, vif->type);
2288 		he_6ghz_capa = (struct ieee80211_he_6ghz_capa *)&capa;
2289 
2290 		eht_cap = ieee80211_get_eht_iftype_cap(sband, vif->type);
2291 	}
2292 
2293 	switch (band) {
2294 	case NL80211_BAND_2GHZ:
2295 		if (eht_cap && eht_cap->has_eht)
2296 			mode |= PHY_MODE_BE_24G;
2297 		break;
2298 	case NL80211_BAND_5GHZ:
2299 		if (eht_cap && eht_cap->has_eht)
2300 			mode |= PHY_MODE_BE_5G;
2301 		break;
2302 	case NL80211_BAND_6GHZ:
2303 		if (he_6ghz_capa && he_6ghz_capa->capa)
2304 			mode |= PHY_MODE_AX_6G;
2305 
2306 		if (eht_cap && eht_cap->has_eht)
2307 			mode |= PHY_MODE_BE_6G;
2308 		break;
2309 	default:
2310 		break;
2311 	}
2312 
2313 	return mode;
2314 }
2315 
2316 static void
2317 mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
2318 			 struct ieee80211_bss_conf *link_conf,
2319 			 struct ieee80211_link_sta *link_sta,
2320 			 struct ieee80211_chanctx_conf *ctx,
2321 			 struct mt76_phy *phy, u16 wlan_idx,
2322 			 bool enable)
2323 {
2324 	struct ieee80211_vif *vif = link_conf->vif;
2325 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2326 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2327 						  &link_conf->chanreq.oper;
2328 	enum nl80211_band band = chandef->chan->band;
2329 	struct mt76_connac_bss_basic_tlv *basic_req;
2330 	struct mt792x_link_sta *mlink;
2331 	struct tlv *tlv;
2332 	int conn_type;
2333 	u8 idx;
2334 
2335 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*basic_req));
2336 	basic_req = (struct mt76_connac_bss_basic_tlv *)tlv;
2337 
2338 	idx = mconf->mt76.omac_idx > EXT_BSSID_START ? HW_BSSID_0 :
2339 						      mconf->mt76.omac_idx;
2340 	basic_req->hw_bss_idx = idx;
2341 
2342 	basic_req->phymode_ext = mt7925_get_phy_mode_ext(phy, vif, band,
2343 							 link_sta);
2344 
2345 	if (band == NL80211_BAND_2GHZ)
2346 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_ERP_INDEX);
2347 	else
2348 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_OFDM_INDEX);
2349 
2350 	memcpy(basic_req->bssid, link_conf->bssid, ETH_ALEN);
2351 	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, link_sta);
2352 	basic_req->bcn_interval = cpu_to_le16(link_conf->beacon_int);
2353 	basic_req->dtim_period = link_conf->dtim_period;
2354 	basic_req->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
2355 	basic_req->link_idx = mconf->mt76.idx;
2356 
2357 	if (link_sta) {
2358 		struct mt792x_sta *msta;
2359 
2360 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
2361 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
2362 
2363 	} else {
2364 		mlink = &mconf->vif->sta.deflink;
2365 	}
2366 
2367 	basic_req->sta_idx = cpu_to_le16(mlink->wcid.idx);
2368 	basic_req->omac_idx = mconf->mt76.omac_idx;
2369 	basic_req->band_idx = mconf->mt76.band_idx;
2370 	basic_req->wmm_idx = mconf->mt76.wmm_idx;
2371 	basic_req->conn_state = !enable;
2372 
2373 	switch (vif->type) {
2374 	case NL80211_IFTYPE_MESH_POINT:
2375 	case NL80211_IFTYPE_AP:
2376 		if (vif->p2p)
2377 			conn_type = CONNECTION_P2P_GO;
2378 		else
2379 			conn_type = CONNECTION_INFRA_AP;
2380 		basic_req->conn_type = cpu_to_le32(conn_type);
2381 		basic_req->active = enable;
2382 		break;
2383 	case NL80211_IFTYPE_STATION:
2384 		if (vif->p2p)
2385 			conn_type = CONNECTION_P2P_GC;
2386 		else
2387 			conn_type = CONNECTION_INFRA_STA;
2388 		basic_req->conn_type = cpu_to_le32(conn_type);
2389 		basic_req->active = true;
2390 		break;
2391 	case NL80211_IFTYPE_ADHOC:
2392 		basic_req->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
2393 		basic_req->active = true;
2394 		break;
2395 	default:
2396 		WARN_ON(1);
2397 		break;
2398 	}
2399 }
2400 
2401 static void
2402 mt7925_mcu_bss_sec_tlv(struct sk_buff *skb,
2403 		       struct ieee80211_bss_conf *link_conf)
2404 {
2405 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2406 	struct mt76_vif *mvif = &mconf->mt76;
2407 	struct bss_sec_tlv {
2408 		__le16 tag;
2409 		__le16 len;
2410 		u8 mode;
2411 		u8 status;
2412 		u8 cipher;
2413 		u8 __rsv;
2414 	} __packed * sec;
2415 	struct tlv *tlv;
2416 
2417 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_SEC, sizeof(*sec));
2418 	sec = (struct bss_sec_tlv *)tlv;
2419 
2420 	switch (mvif->cipher) {
2421 	case CONNAC3_CIPHER_GCMP_256:
2422 	case CONNAC3_CIPHER_GCMP:
2423 		sec->mode = MODE_WPA3_SAE;
2424 		sec->status = 8;
2425 		break;
2426 	case CONNAC3_CIPHER_AES_CCMP:
2427 		sec->mode = MODE_WPA2_PSK;
2428 		sec->status = 6;
2429 		break;
2430 	case CONNAC3_CIPHER_TKIP:
2431 		sec->mode = MODE_WPA2_PSK;
2432 		sec->status = 4;
2433 		break;
2434 	case CONNAC3_CIPHER_WEP104:
2435 	case CONNAC3_CIPHER_WEP40:
2436 		sec->mode = MODE_SHARED;
2437 		sec->status = 0;
2438 		break;
2439 	default:
2440 		sec->mode = MODE_OPEN;
2441 		sec->status = 1;
2442 		break;
2443 	}
2444 
2445 	sec->cipher = mvif->cipher;
2446 }
2447 
2448 static void
2449 mt7925_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt792x_phy *phy,
2450 		       struct ieee80211_chanctx_conf *ctx,
2451 		       struct ieee80211_bss_conf *link_conf)
2452 {
2453 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2454 						  &link_conf->chanreq.oper;
2455 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2456 	enum nl80211_band band = chandef->chan->band;
2457 	struct mt76_vif *mvif = &mconf->mt76;
2458 	struct bss_rate_tlv *bmc;
2459 	struct tlv *tlv;
2460 	u8 idx = mvif->mcast_rates_idx ?
2461 		 mvif->mcast_rates_idx : mvif->basic_rates_idx;
2462 
2463 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RATE, sizeof(*bmc));
2464 
2465 	bmc = (struct bss_rate_tlv *)tlv;
2466 
2467 	if (band == NL80211_BAND_2GHZ)
2468 		bmc->basic_rate = cpu_to_le16(HR_DSSS_ERP_BASIC_RATE);
2469 	else
2470 		bmc->basic_rate = cpu_to_le16(OFDM_BASIC_RATE);
2471 
2472 	bmc->short_preamble = (band == NL80211_BAND_2GHZ);
2473 	bmc->bc_fixed_rate = idx;
2474 	bmc->mc_fixed_rate = idx;
2475 }
2476 
2477 static void
2478 mt7925_mcu_bss_mld_tlv(struct sk_buff *skb,
2479 		       struct ieee80211_bss_conf *link_conf)
2480 {
2481 	struct ieee80211_vif *vif = link_conf->vif;
2482 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2483 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2484 	struct bss_mld_tlv *mld;
2485 	struct tlv *tlv;
2486 	bool is_mld;
2487 
2488 	is_mld = ieee80211_vif_is_mld(link_conf->vif) ||
2489 		 (hweight16(mvif->valid_links) > 1);
2490 
2491 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_MLD, sizeof(*mld));
2492 	mld = (struct bss_mld_tlv *)tlv;
2493 
2494 	mld->link_id = is_mld ? link_conf->link_id : 0xff;
2495 	/* apply the index of the primary link */
2496 	mld->group_mld_id = is_mld ? mvif->bss_conf.mt76.idx : 0xff;
2497 	mld->own_mld_id = mconf->mt76.idx + 32;
2498 	mld->remap_idx = 0xff;
2499 	mld->eml_enable = !!(link_conf->vif->cfg.eml_cap &
2500 			     IEEE80211_EML_CAP_EMLSR_SUPP);
2501 
2502 	memcpy(mld->mac_addr, vif->addr, ETH_ALEN);
2503 }
2504 
2505 static void
2506 mt7925_mcu_bss_qos_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf)
2507 {
2508 	struct mt76_connac_bss_qos_tlv *qos;
2509 	struct tlv *tlv;
2510 
2511 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_QBSS, sizeof(*qos));
2512 	qos = (struct mt76_connac_bss_qos_tlv *)tlv;
2513 	qos->qos = link_conf->qos;
2514 }
2515 
2516 static void
2517 mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2518 		      struct mt792x_phy *phy)
2519 {
2520 #define DEFAULT_HE_PE_DURATION		4
2521 #define DEFAULT_HE_DURATION_RTS_THRES	1023
2522 	const struct ieee80211_sta_he_cap *cap;
2523 	struct bss_info_uni_he *he;
2524 	struct tlv *tlv;
2525 
2526 	cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
2527 
2528 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
2529 
2530 	he = (struct bss_info_uni_he *)tlv;
2531 	he->he_pe_duration = link_conf->htc_trig_based_pkt_ext;
2532 	if (!he->he_pe_duration)
2533 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
2534 
2535 	he->he_rts_thres = cpu_to_le16(link_conf->frame_time_rts_th);
2536 	if (!he->he_rts_thres)
2537 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
2538 
2539 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
2540 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
2541 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
2542 }
2543 
2544 static void
2545 mt7925_mcu_bss_color_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2546 			 bool enable)
2547 {
2548 	struct bss_info_uni_bss_color *color;
2549 	struct tlv *tlv;
2550 
2551 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BSS_COLOR, sizeof(*color));
2552 	color = (struct bss_info_uni_bss_color *)tlv;
2553 
2554 	color->enable = enable ?
2555 		link_conf->he_bss_color.enabled : 0;
2556 	color->bss_color = enable ?
2557 		link_conf->he_bss_color.color : 0;
2558 }
2559 
2560 static void
2561 mt7925_mcu_bss_ifs_tlv(struct sk_buff *skb,
2562 		       struct ieee80211_bss_conf *link_conf)
2563 {
2564 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2565 	struct mt792x_phy *phy = mvif->phy;
2566 	struct bss_ifs_time_tlv *ifs_time;
2567 	struct tlv *tlv;
2568 
2569 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_IFS_TIME, sizeof(*ifs_time));
2570 	ifs_time = (struct bss_ifs_time_tlv *)tlv;
2571 	ifs_time->slot_valid = true;
2572 	ifs_time->slot_time = cpu_to_le16(phy->slottime);
2573 }
2574 
2575 int mt7925_mcu_set_timing(struct mt792x_phy *phy,
2576 			  struct ieee80211_bss_conf *link_conf)
2577 {
2578 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2579 	struct mt792x_dev *dev = phy->dev;
2580 	struct sk_buff *skb;
2581 
2582 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2583 					 MT7925_BSS_UPDATE_MAX_SIZE);
2584 	if (IS_ERR(skb))
2585 		return PTR_ERR(skb);
2586 
2587 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2588 
2589 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2590 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2591 }
2592 
2593 int mt7925_mcu_add_bss_info(struct mt792x_phy *phy,
2594 			    struct ieee80211_chanctx_conf *ctx,
2595 			    struct ieee80211_bss_conf *link_conf,
2596 			    struct ieee80211_link_sta *link_sta,
2597 			    int enable)
2598 {
2599 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2600 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2601 	struct mt792x_dev *dev = phy->dev;
2602 	struct mt792x_link_sta *mlink_bc;
2603 	struct sk_buff *skb;
2604 
2605 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2606 					 MT7925_BSS_UPDATE_MAX_SIZE);
2607 	if (IS_ERR(skb))
2608 		return PTR_ERR(skb);
2609 
2610 	mlink_bc = mt792x_sta_to_link(&mvif->sta, mconf->link_id);
2611 
2612 	/* bss_basic must be first */
2613 	mt7925_mcu_bss_basic_tlv(skb, link_conf, link_sta, ctx, phy->mt76,
2614 				 mlink_bc->wcid.idx, enable);
2615 	mt7925_mcu_bss_sec_tlv(skb, link_conf);
2616 	mt7925_mcu_bss_bmc_tlv(skb, phy, ctx, link_conf);
2617 	mt7925_mcu_bss_qos_tlv(skb, link_conf);
2618 	mt7925_mcu_bss_mld_tlv(skb, link_conf);
2619 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2620 
2621 	if (link_conf->he_support) {
2622 		mt7925_mcu_bss_he_tlv(skb, link_conf, phy);
2623 		mt7925_mcu_bss_color_tlv(skb, link_conf, enable);
2624 	}
2625 
2626 	if (enable)
2627 		mt7925_mcu_bss_rlm_tlv(skb, phy->mt76, link_conf, ctx);
2628 
2629 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2630 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2631 }
2632 
2633 int mt7925_mcu_set_dbdc(struct mt76_phy *phy)
2634 {
2635 	struct mt76_dev *mdev = phy->dev;
2636 
2637 	struct mbmc_conf_tlv *conf;
2638 	struct mbmc_set_req *hdr;
2639 	struct sk_buff *skb;
2640 	struct tlv *tlv;
2641 	int max_len, err;
2642 
2643 	max_len = sizeof(*hdr) + sizeof(*conf);
2644 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2645 	if (!skb)
2646 		return -ENOMEM;
2647 
2648 	hdr = (struct mbmc_set_req *)skb_put(skb, sizeof(*hdr));
2649 
2650 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_MBMC_SETTING, sizeof(*conf));
2651 	conf = (struct mbmc_conf_tlv *)tlv;
2652 
2653 	conf->mbmc_en = 1;
2654 	conf->band = 0; /* unused */
2655 
2656 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SET_DBDC_PARMS),
2657 				    false);
2658 
2659 	return err;
2660 }
2661 
2662 #define MT76_CONNAC_SCAN_CHANNEL_TIME		60
2663 
2664 int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
2665 		       struct ieee80211_scan_request *scan_req)
2666 {
2667 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2668 	struct cfg80211_scan_request *sreq = &scan_req->req;
2669 	int n_ssids = 0, err, i, duration;
2670 	struct ieee80211_channel **scan_list = sreq->channels;
2671 	struct mt76_dev *mdev = phy->dev;
2672 	struct mt76_connac_mcu_scan_channel *chan;
2673 	struct sk_buff *skb;
2674 
2675 	struct scan_hdr_tlv *hdr;
2676 	struct scan_req_tlv *req;
2677 	struct scan_ssid_tlv *ssid;
2678 	struct scan_bssid_tlv *bssid;
2679 	struct scan_chan_info_tlv *chan_info;
2680 	struct scan_ie_tlv *ie;
2681 	struct scan_misc_tlv *misc;
2682 	struct tlv *tlv;
2683 	int max_len;
2684 
2685 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2686 				sizeof(*bssid) + sizeof(*chan_info) +
2687 				sizeof(*misc) + sizeof(*ie);
2688 
2689 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2690 	if (!skb)
2691 		return -ENOMEM;
2692 
2693 	set_bit(MT76_HW_SCANNING, &phy->state);
2694 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2695 
2696 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2697 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2698 	hdr->bss_idx = mvif->idx;
2699 
2700 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_REQ, sizeof(*req));
2701 	req = (struct scan_req_tlv *)tlv;
2702 	req->scan_type = sreq->n_ssids ? 1 : 0;
2703 	req->probe_req_num = sreq->n_ssids ? 2 : 0;
2704 
2705 	duration = MT76_CONNAC_SCAN_CHANNEL_TIME;
2706 	/* increase channel time for passive scan */
2707 	if (!sreq->n_ssids)
2708 		duration *= 2;
2709 	req->timeout_value = cpu_to_le16(sreq->n_channels * duration);
2710 	req->channel_min_dwell_time = cpu_to_le16(duration);
2711 	req->channel_dwell_time = cpu_to_le16(duration);
2712 
2713 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2714 	ssid = (struct scan_ssid_tlv *)tlv;
2715 	for (i = 0; i < sreq->n_ssids; i++) {
2716 		if (!sreq->ssids[i].ssid_len)
2717 			continue;
2718 
2719 		ssid->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
2720 		memcpy(ssid->ssids[i].ssid, sreq->ssids[i].ssid,
2721 		       sreq->ssids[i].ssid_len);
2722 		n_ssids++;
2723 	}
2724 	ssid->ssid_type = n_ssids ? BIT(2) : BIT(0);
2725 	ssid->ssids_num = n_ssids;
2726 
2727 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_BSSID, sizeof(*bssid));
2728 	bssid = (struct scan_bssid_tlv *)tlv;
2729 
2730 	memcpy(bssid->bssid, sreq->bssid, ETH_ALEN);
2731 
2732 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
2733 	chan_info = (struct scan_chan_info_tlv *)tlv;
2734 	chan_info->channels_num = min_t(u8, sreq->n_channels,
2735 					ARRAY_SIZE(chan_info->channels));
2736 	for (i = 0; i < chan_info->channels_num; i++) {
2737 		chan = &chan_info->channels[i];
2738 
2739 		switch (scan_list[i]->band) {
2740 		case NL80211_BAND_2GHZ:
2741 			chan->band = 1;
2742 			break;
2743 		case NL80211_BAND_6GHZ:
2744 			chan->band = 3;
2745 			break;
2746 		default:
2747 			chan->band = 2;
2748 			break;
2749 		}
2750 		chan->channel_num = scan_list[i]->hw_value;
2751 	}
2752 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
2753 
2754 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
2755 	ie = (struct scan_ie_tlv *)tlv;
2756 	if (sreq->ie_len > 0) {
2757 		memcpy(ie->ies, sreq->ie, sreq->ie_len);
2758 		ie->ies_len = cpu_to_le16(sreq->ie_len);
2759 	}
2760 
2761 	req->scan_func |= SCAN_FUNC_SPLIT_SCAN;
2762 
2763 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_MISC, sizeof(*misc));
2764 	misc = (struct scan_misc_tlv *)tlv;
2765 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
2766 		get_random_mask_addr(misc->random_mac, sreq->mac_addr,
2767 				     sreq->mac_addr_mask);
2768 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
2769 	}
2770 
2771 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2772 				    false);
2773 	if (err < 0)
2774 		clear_bit(MT76_HW_SCANNING, &phy->state);
2775 
2776 	return err;
2777 }
2778 EXPORT_SYMBOL_GPL(mt7925_mcu_hw_scan);
2779 
2780 int mt7925_mcu_sched_scan_req(struct mt76_phy *phy,
2781 			      struct ieee80211_vif *vif,
2782 			      struct cfg80211_sched_scan_request *sreq)
2783 {
2784 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2785 	struct ieee80211_channel **scan_list = sreq->channels;
2786 	struct mt76_connac_mcu_scan_channel *chan;
2787 	struct mt76_dev *mdev = phy->dev;
2788 	struct cfg80211_match_set *cfg_match;
2789 	struct cfg80211_ssid *cfg_ssid;
2790 
2791 	struct scan_hdr_tlv *hdr;
2792 	struct scan_sched_req *req;
2793 	struct scan_ssid_tlv *ssid;
2794 	struct scan_chan_info_tlv *chan_info;
2795 	struct scan_ie_tlv *ie;
2796 	struct scan_sched_ssid_match_sets *match;
2797 	struct sk_buff *skb;
2798 	struct tlv *tlv;
2799 	int i, max_len;
2800 
2801 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2802 		  sizeof(*chan_info) + sizeof(*ie) +
2803 		  sizeof(*match);
2804 
2805 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2806 	if (!skb)
2807 		return -ENOMEM;
2808 
2809 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2810 
2811 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2812 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2813 	hdr->bss_idx = mvif->idx;
2814 
2815 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_REQ, sizeof(*req));
2816 	req = (struct scan_sched_req *)tlv;
2817 	req->version = 1;
2818 
2819 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
2820 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
2821 
2822 	req->intervals_num = sreq->n_scan_plans;
2823 	for (i = 0; i < req->intervals_num; i++)
2824 		req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
2825 
2826 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2827 	ssid = (struct scan_ssid_tlv *)tlv;
2828 
2829 	ssid->ssids_num = sreq->n_ssids;
2830 	ssid->ssid_type = BIT(2);
2831 	for (i = 0; i < ssid->ssids_num; i++) {
2832 		cfg_ssid = &sreq->ssids[i];
2833 		memcpy(ssid->ssids[i].ssid, cfg_ssid->ssid, cfg_ssid->ssid_len);
2834 		ssid->ssids[i].ssid_len = cpu_to_le32(cfg_ssid->ssid_len);
2835 	}
2836 
2837 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID_MATCH_SETS, sizeof(*match));
2838 	match = (struct scan_sched_ssid_match_sets *)tlv;
2839 	match->match_num = sreq->n_match_sets;
2840 	for (i = 0; i < match->match_num; i++) {
2841 		cfg_match = &sreq->match_sets[i];
2842 		memcpy(match->match[i].ssid, cfg_match->ssid.ssid,
2843 		       cfg_match->ssid.ssid_len);
2844 		match->match[i].rssi_th = cpu_to_le32(cfg_match->rssi_thold);
2845 		match->match[i].ssid_len = cfg_match->ssid.ssid_len;
2846 	}
2847 
2848 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
2849 	chan_info = (struct scan_chan_info_tlv *)tlv;
2850 	chan_info->channels_num = min_t(u8, sreq->n_channels,
2851 					ARRAY_SIZE(chan_info->channels));
2852 	for (i = 0; i < chan_info->channels_num; i++) {
2853 		chan = &chan_info->channels[i];
2854 
2855 		switch (scan_list[i]->band) {
2856 		case NL80211_BAND_2GHZ:
2857 			chan->band = 1;
2858 			break;
2859 		case NL80211_BAND_6GHZ:
2860 			chan->band = 3;
2861 			break;
2862 		default:
2863 			chan->band = 2;
2864 			break;
2865 		}
2866 		chan->channel_num = scan_list[i]->hw_value;
2867 	}
2868 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
2869 
2870 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
2871 	ie = (struct scan_ie_tlv *)tlv;
2872 	if (sreq->ie_len > 0) {
2873 		memcpy(ie->ies, sreq->ie, sreq->ie_len);
2874 		ie->ies_len = cpu_to_le16(sreq->ie_len);
2875 	}
2876 
2877 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2878 				     false);
2879 }
2880 EXPORT_SYMBOL_GPL(mt7925_mcu_sched_scan_req);
2881 
2882 int
2883 mt7925_mcu_sched_scan_enable(struct mt76_phy *phy,
2884 			     struct ieee80211_vif *vif,
2885 			     bool enable)
2886 {
2887 	struct mt76_dev *mdev = phy->dev;
2888 	struct scan_sched_enable *req;
2889 	struct scan_hdr_tlv *hdr;
2890 	struct sk_buff *skb;
2891 	struct tlv *tlv;
2892 	int max_len;
2893 
2894 	max_len = sizeof(*hdr) + sizeof(*req);
2895 
2896 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2897 	if (!skb)
2898 		return -ENOMEM;
2899 
2900 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2901 	hdr->seq_num = 0;
2902 	hdr->bss_idx = 0;
2903 
2904 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_ENABLE, sizeof(*req));
2905 	req = (struct scan_sched_enable *)tlv;
2906 	req->active = !enable;
2907 
2908 	if (enable)
2909 		set_bit(MT76_HW_SCHED_SCANNING, &phy->state);
2910 	else
2911 		clear_bit(MT76_HW_SCHED_SCANNING, &phy->state);
2912 
2913 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2914 				     false);
2915 }
2916 
2917 int mt7925_mcu_cancel_hw_scan(struct mt76_phy *phy,
2918 			      struct ieee80211_vif *vif)
2919 {
2920 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2921 	struct {
2922 		struct scan_hdr {
2923 			u8 seq_num;
2924 			u8 bss_idx;
2925 			u8 pad[2];
2926 		} __packed hdr;
2927 		struct scan_cancel_tlv {
2928 			__le16 tag;
2929 			__le16 len;
2930 			u8 is_ext_channel;
2931 			u8 rsv[3];
2932 		} __packed cancel;
2933 	} req = {
2934 		.hdr = {
2935 			.seq_num = mvif->scan_seq_num,
2936 			.bss_idx = mvif->idx,
2937 		},
2938 		.cancel = {
2939 			.tag = cpu_to_le16(UNI_SCAN_CANCEL),
2940 			.len = cpu_to_le16(sizeof(struct scan_cancel_tlv)),
2941 		},
2942 	};
2943 
2944 	if (test_and_clear_bit(MT76_HW_SCANNING, &phy->state)) {
2945 		struct cfg80211_scan_info info = {
2946 			.aborted = true,
2947 		};
2948 
2949 		ieee80211_scan_completed(phy->hw, &info);
2950 	}
2951 
2952 	return mt76_mcu_send_msg(phy->dev, MCU_UNI_CMD(SCAN_REQ),
2953 				 &req, sizeof(req), false);
2954 }
2955 EXPORT_SYMBOL_GPL(mt7925_mcu_cancel_hw_scan);
2956 
2957 int mt7925_mcu_set_channel_domain(struct mt76_phy *phy)
2958 {
2959 	int len, i, n_max_channels, n_2ch = 0, n_5ch = 0, n_6ch = 0;
2960 	struct {
2961 		struct {
2962 			u8 alpha2[4]; /* regulatory_request.alpha2 */
2963 			u8 bw_2g; /* BW_20_40M		0
2964 				   * BW_20M		1
2965 				   * BW_20_40_80M	2
2966 				   * BW_20_40_80_160M	3
2967 				   * BW_20_40_80_8080M	4
2968 				   */
2969 			u8 bw_5g;
2970 			u8 bw_6g;
2971 			u8 pad;
2972 		} __packed hdr;
2973 		struct n_chan {
2974 			__le16 tag;
2975 			__le16 len;
2976 			u8 n_2ch;
2977 			u8 n_5ch;
2978 			u8 n_6ch;
2979 			u8 pad;
2980 		} __packed n_ch;
2981 	} req = {
2982 		.hdr = {
2983 			.bw_2g = 0,
2984 			.bw_5g = 3, /* BW_20_40_80_160M */
2985 			.bw_6g = 3,
2986 		},
2987 		.n_ch = {
2988 			.tag = cpu_to_le16(2),
2989 		},
2990 	};
2991 	struct mt76_connac_mcu_chan {
2992 		__le16 hw_value;
2993 		__le16 pad;
2994 		__le32 flags;
2995 	} __packed channel;
2996 	struct mt76_dev *dev = phy->dev;
2997 	struct ieee80211_channel *chan;
2998 	struct sk_buff *skb;
2999 
3000 	n_max_channels = phy->sband_2g.sband.n_channels +
3001 			 phy->sband_5g.sband.n_channels +
3002 			 phy->sband_6g.sband.n_channels;
3003 	len = sizeof(req) + n_max_channels * sizeof(channel);
3004 
3005 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
3006 	if (!skb)
3007 		return -ENOMEM;
3008 
3009 	skb_reserve(skb, sizeof(req));
3010 
3011 	for (i = 0; i < phy->sband_2g.sband.n_channels; i++) {
3012 		chan = &phy->sband_2g.sband.channels[i];
3013 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3014 			continue;
3015 
3016 		channel.hw_value = cpu_to_le16(chan->hw_value);
3017 		channel.flags = cpu_to_le32(chan->flags);
3018 		channel.pad = 0;
3019 
3020 		skb_put_data(skb, &channel, sizeof(channel));
3021 		n_2ch++;
3022 	}
3023 	for (i = 0; i < phy->sband_5g.sband.n_channels; i++) {
3024 		chan = &phy->sband_5g.sband.channels[i];
3025 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3026 			continue;
3027 
3028 		channel.hw_value = cpu_to_le16(chan->hw_value);
3029 		channel.flags = cpu_to_le32(chan->flags);
3030 		channel.pad = 0;
3031 
3032 		skb_put_data(skb, &channel, sizeof(channel));
3033 		n_5ch++;
3034 	}
3035 	for (i = 0; i < phy->sband_6g.sband.n_channels; i++) {
3036 		chan = &phy->sband_6g.sband.channels[i];
3037 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3038 			continue;
3039 
3040 		channel.hw_value = cpu_to_le16(chan->hw_value);
3041 		channel.flags = cpu_to_le32(chan->flags);
3042 		channel.pad = 0;
3043 
3044 		skb_put_data(skb, &channel, sizeof(channel));
3045 		n_6ch++;
3046 	}
3047 
3048 	BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(req.hdr.alpha2));
3049 	memcpy(req.hdr.alpha2, dev->alpha2, sizeof(dev->alpha2));
3050 	req.n_ch.n_2ch = n_2ch;
3051 	req.n_ch.n_5ch = n_5ch;
3052 	req.n_ch.n_6ch = n_6ch;
3053 	len = sizeof(struct n_chan) + (n_2ch + n_5ch + n_6ch) * sizeof(channel);
3054 	req.n_ch.len = cpu_to_le16(len);
3055 	memcpy(__skb_push(skb, sizeof(req)), &req, sizeof(req));
3056 
3057 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SET_DOMAIN_INFO),
3058 				     false);
3059 }
3060 EXPORT_SYMBOL_GPL(mt7925_mcu_set_channel_domain);
3061 
3062 static int
3063 __mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3064 		     enum environment_cap env_cap,
3065 		     struct mt7925_clc *clc, u8 idx)
3066 {
3067 	struct mt7925_clc_segment *seg;
3068 	struct sk_buff *skb;
3069 	struct {
3070 		u8 rsv[4];
3071 		__le16 tag;
3072 		__le16 len;
3073 
3074 		u8 ver;
3075 		u8 pad0;
3076 		__le16 size;
3077 		u8 idx;
3078 		u8 env;
3079 		u8 acpi_conf;
3080 		u8 pad1;
3081 		u8 alpha2[2];
3082 		u8 type[2];
3083 		u8 rsvd[64];
3084 	} __packed req = {
3085 		.tag = cpu_to_le16(0x3),
3086 		.len = cpu_to_le16(sizeof(req) - 4),
3087 
3088 		.idx = idx,
3089 		.env = env_cap,
3090 		.acpi_conf = mt792x_acpi_get_flags(&dev->phy),
3091 	};
3092 	int ret, valid_cnt = 0;
3093 	u8 i, *pos;
3094 
3095 	if (!clc)
3096 		return 0;
3097 
3098 	pos = clc->data + sizeof(*seg) * clc->nr_seg;
3099 	for (i = 0; i < clc->nr_country; i++) {
3100 		struct mt7925_clc_rule *rule = (struct mt7925_clc_rule *)pos;
3101 
3102 		pos += sizeof(*rule);
3103 		if (rule->alpha2[0] != alpha2[0] ||
3104 		    rule->alpha2[1] != alpha2[1])
3105 			continue;
3106 
3107 		seg = (struct mt7925_clc_segment *)clc->data
3108 			  + rule->seg_idx - 1;
3109 
3110 		memcpy(req.alpha2, rule->alpha2, 2);
3111 		memcpy(req.type, rule->type, 2);
3112 
3113 		req.size = cpu_to_le16(seg->len);
3114 		skb = __mt76_mcu_msg_alloc(&dev->mt76, &req,
3115 					   le16_to_cpu(req.size) + sizeof(req),
3116 					   sizeof(req), GFP_KERNEL);
3117 		if (!skb)
3118 			return -ENOMEM;
3119 		skb_put_data(skb, clc->data + seg->offset, seg->len);
3120 
3121 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3122 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3123 					    true);
3124 		if (ret < 0)
3125 			return ret;
3126 		valid_cnt++;
3127 	}
3128 
3129 	if (!valid_cnt)
3130 		return -ENOENT;
3131 
3132 	return 0;
3133 }
3134 
3135 int mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3136 		       enum environment_cap env_cap)
3137 {
3138 	struct mt792x_phy *phy = (struct mt792x_phy *)&dev->phy;
3139 	int i, ret;
3140 
3141 	/* submit all clc config */
3142 	for (i = 0; i < ARRAY_SIZE(phy->clc); i++) {
3143 		ret = __mt7925_mcu_set_clc(dev, alpha2, env_cap,
3144 					   phy->clc[i], i);
3145 
3146 		/* If no country found, set "00" as default */
3147 		if (ret == -ENOENT)
3148 			ret = __mt7925_mcu_set_clc(dev, "00",
3149 						   ENVIRON_INDOOR,
3150 						   phy->clc[i], i);
3151 		if (ret < 0)
3152 			return ret;
3153 	}
3154 	return 0;
3155 }
3156 
3157 int mt7925_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb,
3158 			    int cmd, int *wait_seq)
3159 {
3160 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
3161 	struct mt76_connac2_mcu_uni_txd *uni_txd;
3162 	struct mt76_connac2_mcu_txd *mcu_txd;
3163 	__le32 *txd;
3164 	u32 val;
3165 	u8 seq;
3166 
3167 	/* TODO: make dynamic based on msg type */
3168 	mdev->mcu.timeout = 20 * HZ;
3169 
3170 	seq = ++mdev->mcu.msg_seq & 0xf;
3171 	if (!seq)
3172 		seq = ++mdev->mcu.msg_seq & 0xf;
3173 
3174 	if (cmd == MCU_CMD(FW_SCATTER))
3175 		goto exit;
3176 
3177 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
3178 	txd = (__le32 *)skb_push(skb, txd_len);
3179 
3180 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
3181 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
3182 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
3183 	txd[0] = cpu_to_le32(val);
3184 
3185 	val = FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
3186 	txd[1] = cpu_to_le32(val);
3187 
3188 	if (cmd & __MCU_CMD_FIELD_UNI) {
3189 		uni_txd = (struct mt76_connac2_mcu_uni_txd *)txd;
3190 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
3191 		uni_txd->cid = cpu_to_le16(mcu_cmd);
3192 		uni_txd->s2d_index = MCU_S2D_H2N;
3193 		uni_txd->pkt_type = MCU_PKT_ID;
3194 		uni_txd->seq = seq;
3195 
3196 		if (cmd & __MCU_CMD_FIELD_QUERY)
3197 			uni_txd->option = MCU_CMD_UNI_QUERY_ACK;
3198 		else
3199 			uni_txd->option = MCU_CMD_UNI_EXT_ACK;
3200 
3201 		goto exit;
3202 	}
3203 
3204 	mcu_txd = (struct mt76_connac2_mcu_txd *)txd;
3205 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
3206 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
3207 					       MT_TX_MCU_PORT_RX_Q0));
3208 	mcu_txd->pkt_type = MCU_PKT_ID;
3209 	mcu_txd->seq = seq;
3210 	mcu_txd->cid = mcu_cmd;
3211 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
3212 
3213 	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
3214 		if (cmd & __MCU_CMD_FIELD_QUERY)
3215 			mcu_txd->set_query = MCU_Q_QUERY;
3216 		else
3217 			mcu_txd->set_query = MCU_Q_SET;
3218 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
3219 	} else {
3220 		mcu_txd->set_query = MCU_Q_NA;
3221 	}
3222 
3223 	if (cmd & __MCU_CMD_FIELD_WA)
3224 		mcu_txd->s2d_index = MCU_S2D_H2C;
3225 	else
3226 		mcu_txd->s2d_index = MCU_S2D_H2N;
3227 
3228 exit:
3229 	if (wait_seq)
3230 		*wait_seq = seq;
3231 
3232 	return 0;
3233 }
3234 EXPORT_SYMBOL_GPL(mt7925_mcu_fill_message);
3235 
3236 int mt7925_mcu_set_rts_thresh(struct mt792x_phy *phy, u32 val)
3237 {
3238 	struct {
3239 		u8 band_idx;
3240 		u8 _rsv[3];
3241 
3242 		__le16 tag;
3243 		__le16 len;
3244 		__le32 len_thresh;
3245 		__le32 pkt_thresh;
3246 	} __packed req = {
3247 		.band_idx = phy->mt76->band_idx,
3248 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RTS_THRESHOLD),
3249 		.len = cpu_to_le16(sizeof(req) - 4),
3250 		.len_thresh = cpu_to_le32(val),
3251 		.pkt_thresh = cpu_to_le32(0x2),
3252 	};
3253 
3254 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3255 				 &req, sizeof(req), true);
3256 }
3257 
3258 int mt7925_mcu_set_radio_en(struct mt792x_phy *phy, bool enable)
3259 {
3260 	struct {
3261 		u8 band_idx;
3262 		u8 _rsv[3];
3263 
3264 		__le16 tag;
3265 		__le16 len;
3266 		u8 enable;
3267 		u8 _rsv2[3];
3268 	} __packed req = {
3269 		.band_idx = phy->mt76->band_idx,
3270 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RADIO_ENABLE),
3271 		.len = cpu_to_le16(sizeof(req) - 4),
3272 		.enable = enable,
3273 	};
3274 
3275 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3276 				 &req, sizeof(req), true);
3277 }
3278 
3279 static void
3280 mt7925_mcu_build_sku(struct mt76_dev *dev, s8 *sku,
3281 		     struct mt76_power_limits *limits,
3282 		     enum nl80211_band band)
3283 {
3284 	int i, offset = sizeof(limits->cck);
3285 
3286 	memset(sku, 127, MT_CONNAC3_SKU_POWER_LIMIT);
3287 
3288 	if (band == NL80211_BAND_2GHZ) {
3289 		/* cck */
3290 		memcpy(sku, limits->cck, sizeof(limits->cck));
3291 	}
3292 
3293 	/* ofdm */
3294 	memcpy(&sku[offset], limits->ofdm, sizeof(limits->ofdm));
3295 	offset += (sizeof(limits->ofdm) * 5);
3296 
3297 	/* ht */
3298 	for (i = 0; i < 2; i++) {
3299 		memcpy(&sku[offset], limits->mcs[i], 8);
3300 		offset += 8;
3301 	}
3302 	sku[offset++] = limits->mcs[0][0];
3303 
3304 	/* vht */
3305 	for (i = 0; i < ARRAY_SIZE(limits->mcs); i++) {
3306 		memcpy(&sku[offset], limits->mcs[i],
3307 		       ARRAY_SIZE(limits->mcs[i]));
3308 		offset += 12;
3309 	}
3310 
3311 	/* he */
3312 	for (i = 0; i < ARRAY_SIZE(limits->ru); i++) {
3313 		memcpy(&sku[offset], limits->ru[i], ARRAY_SIZE(limits->ru[i]));
3314 		offset += ARRAY_SIZE(limits->ru[i]);
3315 	}
3316 
3317 	/* eht */
3318 	for (i = 0; i < ARRAY_SIZE(limits->eht); i++) {
3319 		memcpy(&sku[offset], limits->eht[i], ARRAY_SIZE(limits->eht[i]));
3320 		offset += ARRAY_SIZE(limits->eht[i]);
3321 	}
3322 }
3323 
3324 static int
3325 mt7925_mcu_rate_txpower_band(struct mt76_phy *phy,
3326 			     enum nl80211_band band)
3327 {
3328 	int tx_power, n_chan, last_ch, err = 0, idx = 0;
3329 	int i, sku_len, batch_size, batch_len = 3;
3330 	struct mt76_dev *dev = phy->dev;
3331 	static const u8 chan_list_2ghz[] = {
3332 		1, 2,  3,  4,  5,  6,  7,
3333 		8, 9, 10, 11, 12, 13, 14
3334 	};
3335 	static const u8 chan_list_5ghz[] = {
3336 		 36,  38,  40,  42,  44,  46,  48,
3337 		 50,  52,  54,  56,  58,  60,  62,
3338 		 64, 100, 102, 104, 106, 108, 110,
3339 		112, 114, 116, 118, 120, 122, 124,
3340 		126, 128, 132, 134, 136, 138, 140,
3341 		142, 144, 149, 151, 153, 155, 157,
3342 		159, 161, 165, 167
3343 	};
3344 	static const u8 chan_list_6ghz[] = {
3345 		  1,   3,   5,   7,   9,  11,  13,
3346 		 15,  17,  19,  21,  23,  25,  27,
3347 		 29,  33,  35,  37,  39,  41,  43,
3348 		 45,  47,  49,  51,  53,  55,  57,
3349 		 59,  61,  65,  67,  69,  71,  73,
3350 		 75,  77,  79,  81,  83,  85,  87,
3351 		 89,  91,  93,  97,  99, 101, 103,
3352 		105, 107, 109, 111, 113, 115, 117,
3353 		119, 121, 123, 125, 129, 131, 133,
3354 		135, 137, 139, 141, 143, 145, 147,
3355 		149, 151, 153, 155, 157, 161, 163,
3356 		165, 167, 169, 171, 173, 175, 177,
3357 		179, 181, 183, 185, 187, 189, 193,
3358 		195, 197, 199, 201, 203, 205, 207,
3359 		209, 211, 213, 215, 217, 219, 221,
3360 		225, 227, 229, 233
3361 	};
3362 	struct mt76_power_limits *limits;
3363 	struct mt7925_sku_tlv *sku_tlbv;
3364 	const u8 *ch_list;
3365 
3366 	sku_len = sizeof(*sku_tlbv);
3367 	tx_power = 2 * phy->hw->conf.power_level;
3368 	if (!tx_power)
3369 		tx_power = 127;
3370 
3371 	if (band == NL80211_BAND_2GHZ) {
3372 		n_chan = ARRAY_SIZE(chan_list_2ghz);
3373 		ch_list = chan_list_2ghz;
3374 		last_ch = chan_list_2ghz[ARRAY_SIZE(chan_list_2ghz) - 1];
3375 	} else if (band == NL80211_BAND_6GHZ) {
3376 		n_chan = ARRAY_SIZE(chan_list_6ghz);
3377 		ch_list = chan_list_6ghz;
3378 		last_ch = chan_list_6ghz[ARRAY_SIZE(chan_list_6ghz) - 1];
3379 	} else {
3380 		n_chan = ARRAY_SIZE(chan_list_5ghz);
3381 		ch_list = chan_list_5ghz;
3382 		last_ch = chan_list_5ghz[ARRAY_SIZE(chan_list_5ghz) - 1];
3383 	}
3384 	batch_size = DIV_ROUND_UP(n_chan, batch_len);
3385 
3386 	limits = devm_kmalloc(dev->dev, sizeof(*limits), GFP_KERNEL);
3387 	if (!limits)
3388 		return -ENOMEM;
3389 
3390 	sku_tlbv = devm_kmalloc(dev->dev, sku_len, GFP_KERNEL);
3391 	if (!sku_tlbv) {
3392 		devm_kfree(dev->dev, limits);
3393 		return -ENOMEM;
3394 	}
3395 
3396 	for (i = 0; i < batch_size; i++) {
3397 		struct mt7925_tx_power_limit_tlv *tx_power_tlv;
3398 		int j, msg_len, num_ch;
3399 		struct sk_buff *skb;
3400 
3401 		num_ch = i == batch_size - 1 ? n_chan % batch_len : batch_len;
3402 		msg_len = sizeof(*tx_power_tlv) + num_ch * sku_len;
3403 		skb = mt76_mcu_msg_alloc(dev, NULL, msg_len);
3404 		if (!skb) {
3405 			err = -ENOMEM;
3406 			goto out;
3407 		}
3408 
3409 		tx_power_tlv = (struct mt7925_tx_power_limit_tlv *)
3410 			       skb_put(skb, sizeof(*tx_power_tlv));
3411 
3412 		BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(tx_power_tlv->alpha2));
3413 		memcpy(tx_power_tlv->alpha2, dev->alpha2, sizeof(dev->alpha2));
3414 		tx_power_tlv->n_chan = num_ch;
3415 		tx_power_tlv->tag = cpu_to_le16(0x1);
3416 		tx_power_tlv->len = cpu_to_le16(sizeof(*tx_power_tlv));
3417 
3418 		switch (band) {
3419 		case NL80211_BAND_2GHZ:
3420 			tx_power_tlv->band = 1;
3421 			break;
3422 		case NL80211_BAND_6GHZ:
3423 			tx_power_tlv->band = 3;
3424 			break;
3425 		default:
3426 			tx_power_tlv->band = 2;
3427 			break;
3428 		}
3429 
3430 		for (j = 0; j < num_ch; j++, idx++) {
3431 			struct ieee80211_channel chan = {
3432 				.hw_value = ch_list[idx],
3433 				.band = band,
3434 			};
3435 			s8 reg_power, sar_power;
3436 
3437 			reg_power = mt76_connac_get_ch_power(phy, &chan,
3438 							     tx_power);
3439 			sar_power = mt76_get_sar_power(phy, &chan, reg_power);
3440 
3441 			mt76_get_rate_power_limits(phy, &chan, limits,
3442 						   sar_power);
3443 
3444 			tx_power_tlv->last_msg = ch_list[idx] == last_ch;
3445 			sku_tlbv->channel = ch_list[idx];
3446 
3447 			mt7925_mcu_build_sku(dev, sku_tlbv->pwr_limit,
3448 					     limits, band);
3449 			skb_put_data(skb, sku_tlbv, sku_len);
3450 		}
3451 		err = mt76_mcu_skb_send_msg(dev, skb,
3452 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3453 					    true);
3454 		if (err < 0)
3455 			goto out;
3456 	}
3457 
3458 out:
3459 	devm_kfree(dev->dev, sku_tlbv);
3460 	devm_kfree(dev->dev, limits);
3461 	return err;
3462 }
3463 
3464 int mt7925_mcu_set_rate_txpower(struct mt76_phy *phy)
3465 {
3466 	int err;
3467 
3468 	if (phy->cap.has_2ghz) {
3469 		err = mt7925_mcu_rate_txpower_band(phy,
3470 						   NL80211_BAND_2GHZ);
3471 		if (err < 0)
3472 			return err;
3473 	}
3474 
3475 	if (phy->cap.has_5ghz) {
3476 		err = mt7925_mcu_rate_txpower_band(phy,
3477 						   NL80211_BAND_5GHZ);
3478 		if (err < 0)
3479 			return err;
3480 	}
3481 
3482 	if (phy->cap.has_6ghz) {
3483 		err = mt7925_mcu_rate_txpower_band(phy,
3484 						   NL80211_BAND_6GHZ);
3485 		if (err < 0)
3486 			return err;
3487 	}
3488 
3489 	return 0;
3490 }
3491 
3492 int mt7925_mcu_set_rxfilter(struct mt792x_dev *dev, u32 fif,
3493 			    u8 bit_op, u32 bit_map)
3494 {
3495 	struct mt792x_phy *phy = &dev->phy;
3496 	struct {
3497 		u8 band_idx;
3498 		u8 rsv1[3];
3499 
3500 		__le16 tag;
3501 		__le16 len;
3502 		u8 mode;
3503 		u8 rsv2[3];
3504 		__le32 fif;
3505 		__le32 bit_map; /* bit_* for bitmap update */
3506 		u8 bit_op;
3507 		u8 pad[51];
3508 	} __packed req = {
3509 		.band_idx = phy->mt76->band_idx,
3510 		.tag = cpu_to_le16(UNI_BAND_CONFIG_SET_MAC80211_RX_FILTER),
3511 		.len = cpu_to_le16(sizeof(req) - 4),
3512 
3513 		.mode = fif ? 0 : 1,
3514 		.fif = cpu_to_le32(fif),
3515 		.bit_map = cpu_to_le32(bit_map),
3516 		.bit_op = bit_op,
3517 	};
3518 
3519 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3520 				 &req, sizeof(req), true);
3521 }
3522