xref: /linux/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c (revision 4a596010b246816d7589d8d775b83833a59e63f9)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2023 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include <linux/firmware.h>
6 #include "mt7925.h"
7 #include "mcu.h"
8 #include "mac.h"
9 
10 #define MT_STA_BFER			BIT(0)
11 #define MT_STA_BFEE			BIT(1)
12 
13 static bool mt7925_disable_clc;
14 module_param_named(disable_clc, mt7925_disable_clc, bool, 0644);
15 MODULE_PARM_DESC(disable_clc, "disable CLC support");
16 
17 int mt7925_mcu_parse_response(struct mt76_dev *mdev, int cmd,
18 			      struct sk_buff *skb, int seq)
19 {
20 	int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
21 	struct mt7925_mcu_rxd *rxd;
22 	int ret = 0;
23 
24 	if (!skb) {
25 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n", cmd, seq);
26 		mt792x_reset(mdev);
27 
28 		return -ETIMEDOUT;
29 	}
30 
31 	rxd = (struct mt7925_mcu_rxd *)skb->data;
32 	if (seq != rxd->seq)
33 		return -EAGAIN;
34 
35 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL) ||
36 	    cmd == MCU_CMD(PATCH_FINISH_REQ)) {
37 		skb_pull(skb, sizeof(*rxd) - 4);
38 		ret = *skb->data;
39 	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
40 		   cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
41 		   cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
42 		   cmd == MCU_UNI_CMD(HIF_CTRL) ||
43 		   cmd == MCU_UNI_CMD(OFFLOAD) ||
44 		   cmd == MCU_UNI_CMD(SUSPEND)) {
45 		struct mt7925_mcu_uni_event *event;
46 
47 		skb_pull(skb, sizeof(*rxd));
48 		event = (struct mt7925_mcu_uni_event *)skb->data;
49 		ret = le32_to_cpu(event->status);
50 		/* skip invalid event */
51 		if (mcu_cmd != event->cid)
52 			ret = -EAGAIN;
53 	} else {
54 		skb_pull(skb, sizeof(*rxd));
55 	}
56 
57 	return ret;
58 }
59 EXPORT_SYMBOL_GPL(mt7925_mcu_parse_response);
60 
61 int mt7925_mcu_regval(struct mt792x_dev *dev, u32 regidx, u32 *val, bool set)
62 {
63 #define MT_RF_REG_HDR           GENMASK(31, 24)
64 #define MT_RF_REG_ANT           GENMASK(23, 16)
65 #define RF_REG_PREFIX           0x99
66 	struct {
67 		u8 __rsv[4];
68 		union {
69 			struct uni_cmd_access_reg_basic {
70 				__le16 tag;
71 				__le16 len;
72 				__le32 idx;
73 				__le32 data;
74 			} __packed reg;
75 			struct uni_cmd_access_rf_reg_basic {
76 				__le16 tag;
77 				__le16 len;
78 				__le16 ant;
79 				u8 __rsv[2];
80 				__le32 idx;
81 				__le32 data;
82 			} __packed rf_reg;
83 		};
84 	} __packed * res, req;
85 	struct sk_buff *skb;
86 	int ret;
87 
88 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX) {
89 		req.rf_reg.tag = cpu_to_le16(UNI_CMD_ACCESS_RF_REG_BASIC);
90 		req.rf_reg.len = cpu_to_le16(sizeof(req.rf_reg));
91 		req.rf_reg.ant = cpu_to_le16(u32_get_bits(regidx, MT_RF_REG_ANT));
92 		req.rf_reg.idx = cpu_to_le32(regidx);
93 		req.rf_reg.data = set ? cpu_to_le32(*val) : 0;
94 	} else {
95 		req.reg.tag = cpu_to_le16(UNI_CMD_ACCESS_REG_BASIC);
96 		req.reg.len = cpu_to_le16(sizeof(req.reg));
97 		req.reg.idx = cpu_to_le32(regidx);
98 		req.reg.data = set ? cpu_to_le32(*val) : 0;
99 	}
100 
101 	if (set)
102 		return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(REG_ACCESS),
103 					 &req, sizeof(req), true);
104 
105 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
106 					MCU_WM_UNI_CMD_QUERY(REG_ACCESS),
107 					&req, sizeof(req), true, &skb);
108 	if (ret)
109 		return ret;
110 
111 	res = (void *)skb->data;
112 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX)
113 		*val = le32_to_cpu(res->rf_reg.data);
114 	else
115 		*val = le32_to_cpu(res->reg.data);
116 
117 	dev_kfree_skb(skb);
118 
119 	return 0;
120 }
121 EXPORT_SYMBOL_GPL(mt7925_mcu_regval);
122 
123 int mt7925_mcu_update_arp_filter(struct mt76_dev *dev,
124 				 struct ieee80211_bss_conf *link_conf)
125 {
126 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
127 	struct ieee80211_vif *mvif = link_conf->vif;
128 	struct sk_buff *skb;
129 	int i, len = min_t(int, mvif->cfg.arp_addr_cnt,
130 			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
131 	struct {
132 		struct {
133 			u8 bss_idx;
134 			u8 pad[3];
135 		} __packed hdr;
136 		struct mt7925_arpns_tlv arp;
137 	} req = {
138 		.hdr = {
139 			.bss_idx = mconf->mt76.idx,
140 		},
141 		.arp = {
142 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
143 			.len = cpu_to_le16(sizeof(req) - 4 + len * 2 * sizeof(__be32)),
144 			.ips_num = len,
145 			.enable = true,
146 		},
147 	};
148 
149 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(req) + len * 2 * sizeof(__be32));
150 	if (!skb)
151 		return -ENOMEM;
152 
153 	skb_put_data(skb, &req, sizeof(req));
154 	for (i = 0; i < len; i++) {
155 		skb_put_data(skb, &mvif->cfg.arp_addr_list[i], sizeof(__be32));
156 		skb_put_zero(skb, sizeof(__be32));
157 	}
158 
159 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
160 }
161 
162 #ifdef CONFIG_PM
163 static int
164 mt7925_connac_mcu_set_wow_ctrl(struct mt76_phy *phy, struct ieee80211_vif *vif,
165 			       bool suspend, struct cfg80211_wowlan *wowlan)
166 {
167 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
168 	struct mt76_dev *dev = phy->dev;
169 	struct {
170 		struct {
171 			u8 bss_idx;
172 			u8 pad[3];
173 		} __packed hdr;
174 		struct mt76_connac_wow_ctrl_tlv wow_ctrl_tlv;
175 		struct mt76_connac_wow_gpio_param_tlv gpio_tlv;
176 	} req = {
177 		.hdr = {
178 			.bss_idx = mvif->idx,
179 		},
180 		.wow_ctrl_tlv = {
181 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
182 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_ctrl_tlv)),
183 			.cmd = suspend ? 1 : 2,
184 		},
185 		.gpio_tlv = {
186 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_GPIO_PARAM),
187 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_gpio_param_tlv)),
188 			.gpio_pin = 0xff, /* follow fw about GPIO pin */
189 		},
190 	};
191 
192 	if (wowlan->magic_pkt)
193 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_MAGIC;
194 	if (wowlan->disconnect)
195 		req.wow_ctrl_tlv.trigger |= (UNI_WOW_DETECT_TYPE_DISCONNECT |
196 					     UNI_WOW_DETECT_TYPE_BCN_LOST);
197 	if (wowlan->nd_config) {
198 		mt7925_mcu_sched_scan_req(phy, vif, wowlan->nd_config);
199 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_SCH_SCAN_HIT;
200 		mt7925_mcu_sched_scan_enable(phy, vif, suspend);
201 	}
202 	if (wowlan->n_patterns)
203 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_BITMAP;
204 
205 	if (mt76_is_mmio(dev))
206 		req.wow_ctrl_tlv.wakeup_hif = WOW_PCIE;
207 	else if (mt76_is_usb(dev))
208 		req.wow_ctrl_tlv.wakeup_hif = WOW_USB;
209 	else if (mt76_is_sdio(dev))
210 		req.wow_ctrl_tlv.wakeup_hif = WOW_GPIO;
211 
212 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(SUSPEND), &req,
213 				 sizeof(req), true);
214 }
215 
216 static int
217 mt7925_mcu_set_wow_pattern(struct mt76_dev *dev,
218 			   struct ieee80211_vif *vif,
219 			   u8 index, bool enable,
220 			   struct cfg80211_pkt_pattern *pattern)
221 {
222 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
223 	struct mt7925_wow_pattern_tlv *tlv;
224 	struct sk_buff *skb;
225 	struct {
226 		u8 bss_idx;
227 		u8 pad[3];
228 	} __packed hdr = {
229 		.bss_idx = mvif->idx,
230 	};
231 
232 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(hdr) + sizeof(*tlv));
233 	if (!skb)
234 		return -ENOMEM;
235 
236 	skb_put_data(skb, &hdr, sizeof(hdr));
237 	tlv = (struct mt7925_wow_pattern_tlv *)skb_put(skb, sizeof(*tlv));
238 	tlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
239 	tlv->len = cpu_to_le16(sizeof(*tlv));
240 	tlv->bss_idx = 0xF;
241 	tlv->data_len = pattern->pattern_len;
242 	tlv->enable = enable;
243 	tlv->index = index;
244 	tlv->offset = 0;
245 
246 	memcpy(tlv->pattern, pattern->pattern, pattern->pattern_len);
247 	memcpy(tlv->mask, pattern->mask, DIV_ROUND_UP(pattern->pattern_len, 8));
248 
249 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SUSPEND), true);
250 }
251 
252 void mt7925_mcu_set_suspend_iter(void *priv, u8 *mac,
253 				 struct ieee80211_vif *vif)
254 {
255 	struct mt76_phy *phy = priv;
256 	bool suspend = !test_bit(MT76_STATE_RUNNING, &phy->state);
257 	struct ieee80211_hw *hw = phy->hw;
258 	struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
259 	int i;
260 
261 	mt76_connac_mcu_set_gtk_rekey(phy->dev, vif, suspend);
262 
263 	mt76_connac_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
264 
265 	for (i = 0; i < wowlan->n_patterns; i++)
266 		mt7925_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
267 					   &wowlan->patterns[i]);
268 	mt7925_connac_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
269 }
270 
271 #endif /* CONFIG_PM */
272 
273 static void
274 mt7925_mcu_connection_loss_iter(void *priv, u8 *mac,
275 				struct ieee80211_vif *vif)
276 {
277 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
278 	struct mt7925_uni_beacon_loss_event *event = priv;
279 
280 	if (mvif->idx != event->hdr.bss_idx)
281 		return;
282 
283 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER) ||
284 	    vif->type != NL80211_IFTYPE_STATION)
285 		return;
286 
287 	ieee80211_connection_loss(vif);
288 }
289 
290 static void
291 mt7925_mcu_connection_loss_event(struct mt792x_dev *dev, struct sk_buff *skb)
292 {
293 	struct mt7925_uni_beacon_loss_event *event;
294 	struct mt76_phy *mphy = &dev->mt76.phy;
295 
296 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd));
297 	event = (struct mt7925_uni_beacon_loss_event *)skb->data;
298 
299 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
300 					IEEE80211_IFACE_ITER_RESUME_ALL,
301 					mt7925_mcu_connection_loss_iter, event);
302 }
303 
304 static void
305 mt7925_mcu_roc_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
306 {
307 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
308 	struct mt7925_roc_grant_tlv *grant = priv;
309 
310 	if (ieee80211_vif_is_mld(vif) && vif->type == NL80211_IFTYPE_STATION)
311 		return;
312 
313 	if (mvif->idx != grant->bss_idx)
314 		return;
315 
316 	mvif->band_idx = grant->dbdcband;
317 }
318 
319 static void mt7925_mcu_roc_handle_grant(struct mt792x_dev *dev,
320 					struct tlv *tlv)
321 {
322 	struct ieee80211_hw *hw = dev->mt76.hw;
323 	struct mt7925_roc_grant_tlv *grant;
324 	int duration;
325 
326 	grant = (struct mt7925_roc_grant_tlv *)tlv;
327 
328 	/* should never happen */
329 	WARN_ON_ONCE((le16_to_cpu(grant->tag) != UNI_EVENT_ROC_GRANT));
330 
331 	if (grant->reqtype == MT7925_ROC_REQ_ROC)
332 		ieee80211_ready_on_channel(hw);
333 	else if (grant->reqtype == MT7925_ROC_REQ_JOIN)
334 		ieee80211_iterate_active_interfaces_atomic(hw,
335 						IEEE80211_IFACE_ITER_RESUME_ALL,
336 						mt7925_mcu_roc_iter, grant);
337 	dev->phy.roc_grant = true;
338 	wake_up(&dev->phy.roc_wait);
339 	duration = le32_to_cpu(grant->max_interval);
340 	mod_timer(&dev->phy.roc_timer,
341 		  jiffies + msecs_to_jiffies(duration));
342 }
343 
344 static void
345 mt7925_mcu_uni_roc_event(struct mt792x_dev *dev, struct sk_buff *skb)
346 {
347 	struct tlv *tlv;
348 	int i = 0;
349 
350 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
351 
352 	while (i < skb->len) {
353 		tlv = (struct tlv *)(skb->data + i);
354 
355 		switch (le16_to_cpu(tlv->tag)) {
356 		case UNI_EVENT_ROC_GRANT:
357 			mt7925_mcu_roc_handle_grant(dev, tlv);
358 			break;
359 		case UNI_EVENT_ROC_GRANT_SUB_LINK:
360 			break;
361 		}
362 
363 		i += le16_to_cpu(tlv->len);
364 	}
365 }
366 
367 static void
368 mt7925_mcu_scan_event(struct mt792x_dev *dev, struct sk_buff *skb)
369 {
370 	struct mt76_phy *mphy = &dev->mt76.phy;
371 	struct mt792x_phy *phy = mphy->priv;
372 
373 	spin_lock_bh(&dev->mt76.lock);
374 	__skb_queue_tail(&phy->scan_event_list, skb);
375 	spin_unlock_bh(&dev->mt76.lock);
376 
377 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
378 				     MT792x_HW_SCAN_TIMEOUT);
379 }
380 
381 static void
382 mt7925_mcu_tx_done_event(struct mt792x_dev *dev, struct sk_buff *skb)
383 {
384 #define UNI_EVENT_TX_DONE_MSG 0
385 #define UNI_EVENT_TX_DONE_RAW 1
386 	struct mt7925_mcu_txs_event {
387 		u8 ver;
388 		u8 rsv[3];
389 		u8 data[0];
390 	} __packed * txs;
391 	struct tlv *tlv;
392 	u32 tlv_len;
393 
394 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
395 	tlv = (struct tlv *)skb->data;
396 	tlv_len = skb->len;
397 
398 	while (tlv_len > 0 && le16_to_cpu(tlv->len) <= tlv_len) {
399 		switch (le16_to_cpu(tlv->tag)) {
400 		case UNI_EVENT_TX_DONE_RAW:
401 			txs = (struct mt7925_mcu_txs_event *)tlv->data;
402 			mt7925_mac_add_txs(dev, txs->data);
403 			break;
404 		default:
405 			break;
406 		}
407 		tlv_len -= le16_to_cpu(tlv->len);
408 		tlv = (struct tlv *)((char *)(tlv) + le16_to_cpu(tlv->len));
409 	}
410 }
411 
412 static void
413 mt7925_mcu_uni_debug_msg_event(struct mt792x_dev *dev, struct sk_buff *skb)
414 {
415 	struct mt7925_uni_debug_msg {
416 		__le16 tag;
417 		__le16 len;
418 		u8 fmt;
419 		u8 rsv[3];
420 		u8 id;
421 		u8 type:3;
422 		u8 nr_args:5;
423 		union {
424 			struct idxlog {
425 				__le16 rsv;
426 				__le32 ts;
427 				__le32 idx;
428 				u8 data[];
429 			} __packed idx;
430 			struct txtlog {
431 				u8 len;
432 				u8 rsv;
433 				__le32 ts;
434 				u8 data[];
435 			} __packed txt;
436 		};
437 	} __packed * hdr;
438 
439 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
440 	hdr = (struct mt7925_uni_debug_msg *)skb->data;
441 
442 	if (hdr->id == 0x28) {
443 		skb_pull(skb, offsetof(struct mt7925_uni_debug_msg, id));
444 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", skb->len, skb->data);
445 		return;
446 	} else if (hdr->id != 0xa8) {
447 		return;
448 	}
449 
450 	if (hdr->type == 0) { /* idx log */
451 		int i, ret, len = PAGE_SIZE - 1, nr_val;
452 		struct page *page = dev_alloc_pages(get_order(len));
453 		__le32 *val;
454 		char *buf, *cur;
455 
456 		if (!page)
457 			return;
458 
459 		buf = page_address(page);
460 		cur = buf;
461 
462 		nr_val = (le16_to_cpu(hdr->len) - sizeof(*hdr)) / 4;
463 		val = (__le32 *)hdr->idx.data;
464 		for (i = 0; i < nr_val && len > 0; i++) {
465 			ret = snprintf(cur, len, "0x%x,", le32_to_cpu(val[i]));
466 			if (ret <= 0)
467 				break;
468 
469 			cur += ret;
470 			len -= ret;
471 		}
472 		if (cur > buf)
473 			wiphy_info(mt76_hw(dev)->wiphy, "idx: 0x%X,%d,%s",
474 				   le32_to_cpu(hdr->idx.idx), nr_val, buf);
475 		put_page(page);
476 	} else if (hdr->type == 2) { /* str log */
477 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", hdr->txt.len, hdr->txt.data);
478 	}
479 }
480 
481 static void
482 mt7925_mcu_uni_rx_unsolicited_event(struct mt792x_dev *dev,
483 				    struct sk_buff *skb)
484 {
485 	struct mt7925_mcu_rxd *rxd;
486 
487 	rxd = (struct mt7925_mcu_rxd *)skb->data;
488 
489 	switch (rxd->eid) {
490 	case MCU_UNI_EVENT_FW_LOG_2_HOST:
491 		mt7925_mcu_uni_debug_msg_event(dev, skb);
492 		break;
493 	case MCU_UNI_EVENT_ROC:
494 		mt7925_mcu_uni_roc_event(dev, skb);
495 		break;
496 	case MCU_UNI_EVENT_SCAN_DONE:
497 		mt7925_mcu_scan_event(dev, skb);
498 		return;
499 	case MCU_UNI_EVENT_TX_DONE:
500 		mt7925_mcu_tx_done_event(dev, skb);
501 		break;
502 	case MCU_UNI_EVENT_BSS_BEACON_LOSS:
503 		mt7925_mcu_connection_loss_event(dev, skb);
504 		break;
505 	case MCU_UNI_EVENT_COREDUMP:
506 		dev->fw_assert = true;
507 		mt76_connac_mcu_coredump_event(&dev->mt76, skb, &dev->coredump);
508 		return;
509 	default:
510 		break;
511 	}
512 	dev_kfree_skb(skb);
513 }
514 
515 void mt7925_mcu_rx_event(struct mt792x_dev *dev, struct sk_buff *skb)
516 {
517 	struct mt7925_mcu_rxd *rxd = (struct mt7925_mcu_rxd *)skb->data;
518 
519 	if (skb_linearize(skb))
520 		return;
521 
522 	if (rxd->option & MCU_UNI_CMD_UNSOLICITED_EVENT) {
523 		mt7925_mcu_uni_rx_unsolicited_event(dev, skb);
524 		return;
525 	}
526 
527 	mt76_mcu_rx_event(&dev->mt76, skb);
528 }
529 
530 static int
531 mt7925_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
532 		  struct ieee80211_ampdu_params *params,
533 		  bool enable, bool tx)
534 {
535 	struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv;
536 	struct sta_rec_ba_uni *ba;
537 	struct sk_buff *skb;
538 	struct tlv *tlv;
539 	int len;
540 
541 	len = sizeof(struct sta_req_hdr) + sizeof(*ba);
542 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid,
543 					      len);
544 	if (IS_ERR(skb))
545 		return PTR_ERR(skb);
546 
547 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
548 
549 	ba = (struct sta_rec_ba_uni *)tlv;
550 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
551 	ba->winsize = cpu_to_le16(params->buf_size);
552 	ba->ssn = cpu_to_le16(params->ssn);
553 	ba->ba_en = enable << params->tid;
554 	ba->amsdu = params->amsdu;
555 	ba->tid = params->tid;
556 
557 	return mt76_mcu_skb_send_msg(dev, skb,
558 				     MCU_UNI_CMD(STA_REC_UPDATE), true);
559 }
560 
561 /** starec & wtbl **/
562 int mt7925_mcu_uni_tx_ba(struct mt792x_dev *dev,
563 			 struct ieee80211_ampdu_params *params,
564 			 bool enable)
565 {
566 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
567 	struct mt792x_vif *mvif = msta->vif;
568 
569 	if (enable && !params->amsdu)
570 		msta->deflink.wcid.amsdu = false;
571 
572 	return mt7925_mcu_sta_ba(&dev->mt76, &mvif->bss_conf.mt76, params,
573 				 enable, true);
574 }
575 
576 int mt7925_mcu_uni_rx_ba(struct mt792x_dev *dev,
577 			 struct ieee80211_ampdu_params *params,
578 			 bool enable)
579 {
580 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
581 	struct mt792x_vif *mvif = msta->vif;
582 
583 	return mt7925_mcu_sta_ba(&dev->mt76, &mvif->bss_conf.mt76, params,
584 				 enable, false);
585 }
586 
587 static int mt7925_load_clc(struct mt792x_dev *dev, const char *fw_name)
588 {
589 	const struct mt76_connac2_fw_trailer *hdr;
590 	const struct mt76_connac2_fw_region *region;
591 	const struct mt7925_clc *clc;
592 	struct mt76_dev *mdev = &dev->mt76;
593 	struct mt792x_phy *phy = &dev->phy;
594 	const struct firmware *fw;
595 	int ret, i, len, offset = 0;
596 	u8 *clc_base = NULL;
597 
598 	if (mt7925_disable_clc ||
599 	    mt76_is_usb(&dev->mt76))
600 		return 0;
601 
602 	ret = request_firmware(&fw, fw_name, mdev->dev);
603 	if (ret)
604 		return ret;
605 
606 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
607 		dev_err(mdev->dev, "Invalid firmware\n");
608 		ret = -EINVAL;
609 		goto out;
610 	}
611 
612 	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
613 	for (i = 0; i < hdr->n_region; i++) {
614 		region = (const void *)((const u8 *)hdr -
615 					(hdr->n_region - i) * sizeof(*region));
616 		len = le32_to_cpu(region->len);
617 
618 		/* check if we have valid buffer size */
619 		if (offset + len > fw->size) {
620 			dev_err(mdev->dev, "Invalid firmware region\n");
621 			ret = -EINVAL;
622 			goto out;
623 		}
624 
625 		if ((region->feature_set & FW_FEATURE_NON_DL) &&
626 		    region->type == FW_TYPE_CLC) {
627 			clc_base = (u8 *)(fw->data + offset);
628 			break;
629 		}
630 		offset += len;
631 	}
632 
633 	if (!clc_base)
634 		goto out;
635 
636 	for (offset = 0; offset < len; offset += le32_to_cpu(clc->len)) {
637 		clc = (const struct mt7925_clc *)(clc_base + offset);
638 
639 		if (clc->idx >= ARRAY_SIZE(phy->clc))
640 			break;
641 
642 		/* do not init buf again if chip reset triggered */
643 		if (phy->clc[clc->idx])
644 			continue;
645 
646 		phy->clc[clc->idx] = devm_kmemdup(mdev->dev, clc,
647 						  le32_to_cpu(clc->len),
648 						  GFP_KERNEL);
649 
650 		if (!phy->clc[clc->idx]) {
651 			ret = -ENOMEM;
652 			goto out;
653 		}
654 	}
655 
656 	ret = mt7925_mcu_set_clc(dev, "00", ENVIRON_INDOOR);
657 out:
658 	release_firmware(fw);
659 
660 	return ret;
661 }
662 
663 int mt7925_mcu_fw_log_2_host(struct mt792x_dev *dev, u8 ctrl)
664 {
665 	struct {
666 		u8 _rsv[4];
667 
668 		__le16 tag;
669 		__le16 len;
670 		u8 ctrl;
671 		u8 interval;
672 		u8 _rsv2[2];
673 	} __packed req = {
674 		.tag = cpu_to_le16(UNI_WSYS_CONFIG_FW_LOG_CTRL),
675 		.len = cpu_to_le16(sizeof(req) - 4),
676 		.ctrl = ctrl,
677 	};
678 	int ret;
679 
680 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(WSYS_CONFIG),
681 					&req, sizeof(req), false, NULL);
682 	return ret;
683 }
684 
685 int mt7925_mcu_get_temperature(struct mt792x_phy *phy)
686 {
687 	struct {
688 		u8 _rsv[4];
689 
690 		__le16 tag;
691 		__le16 len;
692 		u8 _rsv2[4];
693 	} __packed req = {
694 		.tag = cpu_to_le16(0x0),
695 		.len = cpu_to_le16(sizeof(req) - 4),
696 	};
697 	struct mt7925_thermal_evt {
698 		u8 rsv[4];
699 		__le32 temperature;
700 	} __packed * evt;
701 	struct mt792x_dev *dev = phy->dev;
702 	int temperature, ret;
703 	struct sk_buff *skb;
704 
705 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
706 					MCU_WM_UNI_CMD_QUERY(THERMAL),
707 					&req, sizeof(req), true, &skb);
708 	if (ret)
709 		return ret;
710 
711 	skb_pull(skb, 4 + sizeof(struct tlv));
712 	evt = (struct mt7925_thermal_evt *)skb->data;
713 
714 	temperature = le32_to_cpu(evt->temperature);
715 
716 	dev_kfree_skb(skb);
717 
718 	return temperature;
719 }
720 
721 static void
722 mt7925_mcu_parse_phy_cap(struct mt792x_dev *dev, char *data)
723 {
724 	struct mt76_phy *mphy = &dev->mt76.phy;
725 	struct mt76_dev *mdev = mphy->dev;
726 	struct mt7925_mcu_phy_cap {
727 		u8 ht;
728 		u8 vht;
729 		u8 _5g;
730 		u8 max_bw;
731 		u8 nss;
732 		u8 dbdc;
733 		u8 tx_ldpc;
734 		u8 rx_ldpc;
735 		u8 tx_stbc;
736 		u8 rx_stbc;
737 		u8 hw_path;
738 		u8 he;
739 		u8 eht;
740 	} __packed * cap;
741 	enum {
742 		WF0_24G,
743 		WF0_5G
744 	};
745 
746 	cap = (struct mt7925_mcu_phy_cap *)data;
747 
748 	mdev->phy.antenna_mask = BIT(cap->nss) - 1;
749 	mdev->phy.chainmask = mdev->phy.antenna_mask;
750 	mdev->phy.cap.has_2ghz = cap->hw_path & BIT(WF0_24G);
751 	mdev->phy.cap.has_5ghz = cap->hw_path & BIT(WF0_5G);
752 	dev->has_eht = cap->eht;
753 }
754 
755 static void
756 mt7925_mcu_parse_eml_cap(struct mt792x_dev *dev, char *data)
757 {
758 	struct mt7925_mcu_eml_cap {
759 		u8 rsv[4];
760 		__le16 eml_cap;
761 		u8 rsv2[6];
762 	} __packed * cap;
763 
764 	cap = (struct mt7925_mcu_eml_cap *)data;
765 
766 	dev->phy.eml_cap = le16_to_cpu(cap->eml_cap);
767 }
768 
769 static int
770 mt7925_mcu_get_nic_capability(struct mt792x_dev *dev)
771 {
772 	struct mt76_phy *mphy = &dev->mt76.phy;
773 	struct {
774 		u8 _rsv[4];
775 
776 		__le16 tag;
777 		__le16 len;
778 	} __packed req = {
779 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_NIC_CAPA),
780 		.len = cpu_to_le16(sizeof(req) - 4),
781 	};
782 	struct mt76_connac_cap_hdr {
783 		__le16 n_element;
784 		u8 rsv[2];
785 	} __packed * hdr;
786 	struct sk_buff *skb;
787 	int ret, i;
788 
789 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
790 					&req, sizeof(req), true, &skb);
791 	if (ret)
792 		return ret;
793 
794 	hdr = (struct mt76_connac_cap_hdr *)skb->data;
795 	if (skb->len < sizeof(*hdr)) {
796 		ret = -EINVAL;
797 		goto out;
798 	}
799 
800 	skb_pull(skb, sizeof(*hdr));
801 
802 	for (i = 0; i < le16_to_cpu(hdr->n_element); i++) {
803 		struct tlv *tlv = (struct tlv *)skb->data;
804 		int len;
805 
806 		if (skb->len < sizeof(*tlv))
807 			break;
808 
809 		len = le16_to_cpu(tlv->len);
810 		if (skb->len < len)
811 			break;
812 
813 		switch (le16_to_cpu(tlv->tag)) {
814 		case MT_NIC_CAP_6G:
815 			mphy->cap.has_6ghz = !!tlv->data[0];
816 			break;
817 		case MT_NIC_CAP_MAC_ADDR:
818 			memcpy(mphy->macaddr, (void *)tlv->data, ETH_ALEN);
819 			break;
820 		case MT_NIC_CAP_PHY:
821 			mt7925_mcu_parse_phy_cap(dev, tlv->data);
822 			break;
823 		case MT_NIC_CAP_CHIP_CAP:
824 			dev->phy.chip_cap = le64_to_cpu(*(__le64 *)tlv->data);
825 			break;
826 		case MT_NIC_CAP_EML_CAP:
827 			mt7925_mcu_parse_eml_cap(dev, tlv->data);
828 			break;
829 		default:
830 			break;
831 		}
832 		skb_pull(skb, len);
833 	}
834 out:
835 	dev_kfree_skb(skb);
836 	return ret;
837 }
838 
839 int mt7925_mcu_chip_config(struct mt792x_dev *dev, const char *cmd)
840 {
841 	u16 len = strlen(cmd) + 1;
842 	struct {
843 		u8 _rsv[4];
844 		__le16 tag;
845 		__le16 len;
846 		struct mt76_connac_config config;
847 	} __packed req = {
848 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_CHIP_CFG),
849 		.len = cpu_to_le16(sizeof(req) - 4),
850 		.config = {
851 			.resp_type = 0,
852 			.type = 0,
853 			.data_size = cpu_to_le16(len),
854 		},
855 	};
856 
857 	memcpy(req.config.data, cmd, len);
858 
859 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
860 				 &req, sizeof(req), false);
861 }
862 
863 int mt7925_mcu_set_deep_sleep(struct mt792x_dev *dev, bool enable)
864 {
865 	char cmd[16];
866 
867 	snprintf(cmd, sizeof(cmd), "KeepFullPwr %d", !enable);
868 
869 	return mt7925_mcu_chip_config(dev, cmd);
870 }
871 EXPORT_SYMBOL_GPL(mt7925_mcu_set_deep_sleep);
872 
873 int mt7925_run_firmware(struct mt792x_dev *dev)
874 {
875 	int err;
876 
877 	err = mt792x_load_firmware(dev);
878 	if (err)
879 		return err;
880 
881 	err = mt7925_mcu_get_nic_capability(dev);
882 	if (err)
883 		return err;
884 
885 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
886 	err = mt7925_load_clc(dev, mt792x_ram_name(dev));
887 	if (err)
888 		return err;
889 
890 	return mt7925_mcu_fw_log_2_host(dev, 1);
891 }
892 EXPORT_SYMBOL_GPL(mt7925_run_firmware);
893 
894 static void
895 mt7925_mcu_sta_hdr_trans_tlv(struct sk_buff *skb,
896 			     struct ieee80211_vif *vif,
897 			     struct ieee80211_link_sta *link_sta)
898 {
899 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
900 	struct sta_rec_hdr_trans *hdr_trans;
901 	struct mt76_wcid *wcid;
902 	struct tlv *tlv;
903 
904 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HDR_TRANS, sizeof(*hdr_trans));
905 	hdr_trans = (struct sta_rec_hdr_trans *)tlv;
906 	hdr_trans->dis_rx_hdr_tran = true;
907 
908 	if (vif->type == NL80211_IFTYPE_STATION)
909 		hdr_trans->to_ds = true;
910 	else
911 		hdr_trans->from_ds = true;
912 
913 	if (link_sta) {
914 		struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
915 		struct mt792x_link_sta *mlink;
916 
917 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
918 		wcid = &mlink->wcid;
919 	} else {
920 		wcid = &mvif->sta.deflink.wcid;
921 	}
922 
923 	if (!wcid)
924 		return;
925 
926 	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
927 	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
928 		hdr_trans->to_ds = true;
929 		hdr_trans->from_ds = true;
930 	}
931 }
932 
933 int mt7925_mcu_wtbl_update_hdr_trans(struct mt792x_dev *dev,
934 				     struct ieee80211_vif *vif,
935 				     struct ieee80211_sta *sta,
936 				     int link_id)
937 {
938 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
939 	struct ieee80211_link_sta *link_sta = sta ? &sta->deflink : NULL;
940 	struct mt792x_link_sta *mlink;
941 	struct mt792x_bss_conf *mconf;
942 	struct mt792x_sta *msta;
943 	struct sk_buff *skb;
944 
945 	msta = sta ? (struct mt792x_sta *)sta->drv_priv : &mvif->sta;
946 
947 	mlink = mt792x_sta_to_link(msta, link_id);
948 	link_sta = mt792x_sta_to_link_sta(vif, sta, link_id);
949 	mconf = mt792x_vif_to_link(mvif, link_id);
950 
951 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
952 					      &mlink->wcid,
953 					      MT7925_STA_UPDATE_MAX_SIZE);
954 	if (IS_ERR(skb))
955 		return PTR_ERR(skb);
956 
957 	/* starec hdr trans */
958 	mt7925_mcu_sta_hdr_trans_tlv(skb, vif, link_sta);
959 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
960 				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
961 }
962 
963 int mt7925_mcu_set_tx(struct mt792x_dev *dev,
964 		      struct ieee80211_bss_conf *bss_conf)
965 {
966 #define MCU_EDCA_AC_PARAM	0
967 #define WMM_AIFS_SET		BIT(0)
968 #define WMM_CW_MIN_SET		BIT(1)
969 #define WMM_CW_MAX_SET		BIT(2)
970 #define WMM_TXOP_SET		BIT(3)
971 #define WMM_PARAM_SET		(WMM_AIFS_SET | WMM_CW_MIN_SET | \
972 				 WMM_CW_MAX_SET | WMM_TXOP_SET)
973 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(bss_conf);
974 	struct {
975 		u8 bss_idx;
976 		u8 __rsv[3];
977 	} __packed hdr = {
978 		.bss_idx = mconf->mt76.idx,
979 	};
980 	struct sk_buff *skb;
981 	int len = sizeof(hdr) + IEEE80211_NUM_ACS * sizeof(struct edca);
982 	int ac;
983 
984 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
985 	if (!skb)
986 		return -ENOMEM;
987 
988 	skb_put_data(skb, &hdr, sizeof(hdr));
989 
990 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
991 		struct ieee80211_tx_queue_params *q = &mconf->queue_params[ac];
992 		struct edca *e;
993 		struct tlv *tlv;
994 
995 		tlv = mt76_connac_mcu_add_tlv(skb, MCU_EDCA_AC_PARAM, sizeof(*e));
996 
997 		e = (struct edca *)tlv;
998 		e->set = WMM_PARAM_SET;
999 		e->queue = ac;
1000 		e->aifs = q->aifs;
1001 		e->txop = cpu_to_le16(q->txop);
1002 
1003 		if (q->cw_min)
1004 			e->cw_min = fls(q->cw_min);
1005 		else
1006 			e->cw_min = 5;
1007 
1008 		if (q->cw_max)
1009 			e->cw_max = fls(q->cw_max);
1010 		else
1011 			e->cw_max = 10;
1012 	}
1013 
1014 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1015 				     MCU_UNI_CMD(EDCA_UPDATE), true);
1016 }
1017 
1018 static int
1019 mt7925_mcu_sta_key_tlv(struct mt76_wcid *wcid,
1020 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1021 		       struct sk_buff *skb,
1022 		       struct ieee80211_key_conf *key,
1023 		       enum set_key_cmd cmd,
1024 		       struct mt792x_sta *msta)
1025 {
1026 	struct mt792x_vif *mvif = msta->vif;
1027 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1028 	struct sta_rec_sec_uni *sec;
1029 	struct ieee80211_sta *sta;
1030 	struct ieee80211_vif *vif;
1031 	struct tlv *tlv;
1032 
1033 	sta = msta == &mvif->sta ?
1034 		      NULL :
1035 		      container_of((void *)msta, struct ieee80211_sta, drv_priv);
1036 	vif = container_of((void *)mvif, struct ieee80211_vif, drv_priv);
1037 
1038 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V3, sizeof(*sec));
1039 	sec = (struct sta_rec_sec_uni *)tlv;
1040 	sec->bss_idx = mconf->mt76.idx;
1041 	sec->is_authenticator = 0;
1042 	sec->mgmt_prot = 1; /* only used in MLO mode */
1043 	sec->wlan_idx = (u8)wcid->idx;
1044 
1045 	if (sta) {
1046 		struct ieee80211_link_sta *link_sta;
1047 
1048 		sec->tx_key = 1;
1049 		sec->key_type = 1;
1050 		link_sta = mt792x_sta_to_link_sta(vif, sta, wcid->link_id);
1051 
1052 		if (link_sta)
1053 			memcpy(sec->peer_addr, link_sta->addr, ETH_ALEN);
1054 	} else {
1055 		struct ieee80211_bss_conf *link_conf;
1056 
1057 		link_conf = mt792x_vif_to_bss_conf(vif, wcid->link_id);
1058 
1059 		if (link_conf)
1060 			memcpy(sec->peer_addr, link_conf->bssid, ETH_ALEN);
1061 	}
1062 
1063 	if (cmd == SET_KEY) {
1064 		u8 cipher;
1065 
1066 		sec->add = 1;
1067 		cipher = mt7925_mcu_get_cipher(key->cipher);
1068 		if (cipher == CONNAC3_CIPHER_NONE)
1069 			return -EOPNOTSUPP;
1070 
1071 		if (cipher == CONNAC3_CIPHER_BIP_CMAC_128) {
1072 			sec->cipher_id = CONNAC3_CIPHER_BIP_CMAC_128;
1073 			sec->key_id = sta_key_conf->keyidx;
1074 			sec->key_len = 32;
1075 			memcpy(sec->key, sta_key_conf->key, 16);
1076 			memcpy(sec->key + 16, key->key, 16);
1077 		} else {
1078 			sec->cipher_id = cipher;
1079 			sec->key_id = key->keyidx;
1080 			sec->key_len = key->keylen;
1081 			memcpy(sec->key, key->key, key->keylen);
1082 
1083 			if (cipher == CONNAC3_CIPHER_TKIP) {
1084 				/* Rx/Tx MIC keys are swapped */
1085 				memcpy(sec->key + 16, key->key + 24, 8);
1086 				memcpy(sec->key + 24, key->key + 16, 8);
1087 			}
1088 
1089 			/* store key_conf for BIP batch update */
1090 			if (cipher == CONNAC3_CIPHER_AES_CCMP) {
1091 				memcpy(sta_key_conf->key, key->key, key->keylen);
1092 				sta_key_conf->keyidx = key->keyidx;
1093 			}
1094 		}
1095 	} else {
1096 		sec->add = 0;
1097 	}
1098 
1099 	return 0;
1100 }
1101 
1102 int mt7925_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
1103 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1104 		       struct ieee80211_key_conf *key, int mcu_cmd,
1105 		       struct mt76_wcid *wcid, enum set_key_cmd cmd,
1106 		       struct mt792x_sta *msta)
1107 {
1108 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1109 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1110 	struct sk_buff *skb;
1111 	int ret;
1112 
1113 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, wcid,
1114 					      MT7925_STA_UPDATE_MAX_SIZE);
1115 	if (IS_ERR(skb))
1116 		return PTR_ERR(skb);
1117 
1118 	ret = mt7925_mcu_sta_key_tlv(wcid, sta_key_conf, skb, key, cmd, msta);
1119 	if (ret)
1120 		return ret;
1121 
1122 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
1123 }
1124 
1125 int mt7925_mcu_set_mlo_roc(struct mt792x_bss_conf *mconf, u16 sel_links,
1126 			   int duration, u8 token_id)
1127 {
1128 	struct mt792x_vif *mvif = mconf->vif;
1129 	struct ieee80211_vif *vif = container_of((void *)mvif,
1130 						 struct ieee80211_vif, drv_priv);
1131 	struct ieee80211_bss_conf *link_conf;
1132 	struct ieee80211_channel *chan;
1133 	const u8 ch_band[] = {
1134 		[NL80211_BAND_2GHZ] = 1,
1135 		[NL80211_BAND_5GHZ] = 2,
1136 		[NL80211_BAND_6GHZ] = 3,
1137 	};
1138 	enum mt7925_roc_req type;
1139 	int center_ch, i = 0;
1140 	bool is_AG_band = false;
1141 	struct {
1142 		u8 id;
1143 		u8 bss_idx;
1144 		u16 tag;
1145 		struct mt792x_bss_conf *mconf;
1146 		struct ieee80211_channel *chan;
1147 	} links[2];
1148 
1149 	struct {
1150 		struct {
1151 			u8 rsv[4];
1152 		} __packed hdr;
1153 		struct roc_acquire_tlv roc[2];
1154 	} __packed req = {
1155 			.roc[0].tag = cpu_to_le16(UNI_ROC_NUM),
1156 			.roc[0].len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1157 			.roc[1].tag = cpu_to_le16(UNI_ROC_NUM),
1158 			.roc[1].len = cpu_to_le16(sizeof(struct roc_acquire_tlv))
1159 	};
1160 
1161 	if (!mconf || hweight16(vif->valid_links) < 2 ||
1162 	    hweight16(sel_links) != 2)
1163 		return -EPERM;
1164 
1165 	for (i = 0; i < ARRAY_SIZE(links); i++) {
1166 		links[i].id = i ? __ffs(~BIT(mconf->link_id) & sel_links) :
1167 				 mconf->link_id;
1168 		link_conf = mt792x_vif_to_bss_conf(vif, links[i].id);
1169 		if (WARN_ON_ONCE(!link_conf))
1170 			return -EPERM;
1171 
1172 		links[i].chan = link_conf->chanreq.oper.chan;
1173 		if (WARN_ON_ONCE(!links[i].chan))
1174 			return -EPERM;
1175 
1176 		links[i].mconf = mt792x_vif_to_link(mvif, links[i].id);
1177 		links[i].tag = links[i].id == mconf->link_id ?
1178 			       UNI_ROC_ACQUIRE : UNI_ROC_SUB_LINK;
1179 
1180 		is_AG_band |= links[i].chan->band == NL80211_BAND_2GHZ;
1181 	}
1182 
1183 	if (vif->cfg.eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP)
1184 		type = is_AG_band ? MT7925_ROC_REQ_MLSR_AG :
1185 				    MT7925_ROC_REQ_MLSR_AA;
1186 	else
1187 		type = MT7925_ROC_REQ_JOIN;
1188 
1189 	for (i = 0; i < ARRAY_SIZE(links) && i < hweight16(vif->active_links); i++) {
1190 		if (WARN_ON_ONCE(!links[i].mconf || !links[i].chan))
1191 			continue;
1192 
1193 		chan = links[i].chan;
1194 		center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1195 		req.roc[i].len = cpu_to_le16(sizeof(struct roc_acquire_tlv));
1196 		req.roc[i].tag = cpu_to_le16(links[i].tag);
1197 		req.roc[i].tokenid = token_id;
1198 		req.roc[i].reqtype = type;
1199 		req.roc[i].maxinterval = cpu_to_le32(duration);
1200 		req.roc[i].bss_idx = links[i].mconf->mt76.idx;
1201 		req.roc[i].control_channel = chan->hw_value;
1202 		req.roc[i].bw = CMD_CBW_20MHZ;
1203 		req.roc[i].bw_from_ap = CMD_CBW_20MHZ;
1204 		req.roc[i].center_chan = center_ch;
1205 		req.roc[i].center_chan_from_ap = center_ch;
1206 		req.roc[i].center_chan2 = 0;
1207 		req.roc[i].center_chan2_from_ap = 0;
1208 
1209 		/* STR : 0xfe indicates BAND_ALL with enabling DBDC
1210 		 * EMLSR : 0xff indicates (BAND_AUTO) without DBDC
1211 		 */
1212 		req.roc[i].dbdcband = type == MT7925_ROC_REQ_JOIN ? 0xfe : 0xff;
1213 
1214 		if (chan->hw_value < center_ch)
1215 			req.roc[i].sco = 1; /* SCA */
1216 		else if (chan->hw_value > center_ch)
1217 			req.roc[i].sco = 3; /* SCB */
1218 
1219 		req.roc[i].band = ch_band[chan->band];
1220 	}
1221 
1222 	return mt76_mcu_send_msg(&mvif->phy->dev->mt76, MCU_UNI_CMD(ROC),
1223 				 &req, sizeof(req), false);
1224 }
1225 
1226 int mt7925_mcu_set_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1227 		       struct ieee80211_channel *chan, int duration,
1228 		       enum mt7925_roc_req type, u8 token_id)
1229 {
1230 	int center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1231 	struct mt792x_dev *dev = phy->dev;
1232 	struct {
1233 		struct {
1234 			u8 rsv[4];
1235 		} __packed hdr;
1236 		struct roc_acquire_tlv roc;
1237 	} __packed req = {
1238 		.roc = {
1239 			.tag = cpu_to_le16(UNI_ROC_ACQUIRE),
1240 			.len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1241 			.tokenid = token_id,
1242 			.reqtype = type,
1243 			.maxinterval = cpu_to_le32(duration),
1244 			.bss_idx = mconf->mt76.idx,
1245 			.control_channel = chan->hw_value,
1246 			.bw = CMD_CBW_20MHZ,
1247 			.bw_from_ap = CMD_CBW_20MHZ,
1248 			.center_chan = center_ch,
1249 			.center_chan_from_ap = center_ch,
1250 			.dbdcband = 0xff, /* auto */
1251 		},
1252 	};
1253 
1254 	if (chan->hw_value < center_ch)
1255 		req.roc.sco = 1; /* SCA */
1256 	else if (chan->hw_value > center_ch)
1257 		req.roc.sco = 3; /* SCB */
1258 
1259 	switch (chan->band) {
1260 	case NL80211_BAND_6GHZ:
1261 		req.roc.band = 3;
1262 		break;
1263 	case NL80211_BAND_5GHZ:
1264 		req.roc.band = 2;
1265 		break;
1266 	default:
1267 		req.roc.band = 1;
1268 		break;
1269 	}
1270 
1271 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1272 				 &req, sizeof(req), false);
1273 }
1274 
1275 int mt7925_mcu_abort_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1276 			 u8 token_id)
1277 {
1278 	struct mt792x_dev *dev = phy->dev;
1279 	struct {
1280 		struct {
1281 			u8 rsv[4];
1282 		} __packed hdr;
1283 		struct roc_abort_tlv {
1284 			__le16 tag;
1285 			__le16 len;
1286 			u8 bss_idx;
1287 			u8 tokenid;
1288 			u8 dbdcband;
1289 			u8 rsv[5];
1290 		} __packed abort;
1291 	} __packed req = {
1292 		.abort = {
1293 			.tag = cpu_to_le16(UNI_ROC_ABORT),
1294 			.len = cpu_to_le16(sizeof(struct roc_abort_tlv)),
1295 			.tokenid = token_id,
1296 			.bss_idx = mconf->mt76.idx,
1297 			.dbdcband = 0xff, /* auto*/
1298 		},
1299 	};
1300 
1301 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1302 				 &req, sizeof(req), false);
1303 }
1304 
1305 int mt7925_mcu_set_eeprom(struct mt792x_dev *dev)
1306 {
1307 	struct {
1308 		u8 _rsv[4];
1309 
1310 		__le16 tag;
1311 		__le16 len;
1312 		u8 buffer_mode;
1313 		u8 format;
1314 		__le16 buf_len;
1315 	} __packed req = {
1316 		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
1317 		.len = cpu_to_le16(sizeof(req) - 4),
1318 		.buffer_mode = EE_MODE_EFUSE,
1319 		.format = EE_FORMAT_WHOLE
1320 	};
1321 
1322 	return mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(EFUSE_CTRL),
1323 					 &req, sizeof(req), false, NULL);
1324 }
1325 EXPORT_SYMBOL_GPL(mt7925_mcu_set_eeprom);
1326 
1327 int mt7925_mcu_uni_bss_ps(struct mt792x_dev *dev,
1328 			  struct ieee80211_bss_conf *link_conf)
1329 {
1330 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1331 	struct {
1332 		struct {
1333 			u8 bss_idx;
1334 			u8 pad[3];
1335 		} __packed hdr;
1336 		struct ps_tlv {
1337 			__le16 tag;
1338 			__le16 len;
1339 			u8 ps_state; /* 0: device awake
1340 				      * 1: static power save
1341 				      * 2: dynamic power saving
1342 				      * 3: enter TWT power saving
1343 				      * 4: leave TWT power saving
1344 				      */
1345 			u8 pad[3];
1346 		} __packed ps;
1347 	} __packed ps_req = {
1348 		.hdr = {
1349 			.bss_idx = mconf->mt76.idx,
1350 		},
1351 		.ps = {
1352 			.tag = cpu_to_le16(UNI_BSS_INFO_PS),
1353 			.len = cpu_to_le16(sizeof(struct ps_tlv)),
1354 			.ps_state = link_conf->vif->cfg.ps ? 2 : 0,
1355 		},
1356 	};
1357 
1358 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1359 		return -EOPNOTSUPP;
1360 
1361 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1362 				 &ps_req, sizeof(ps_req), true);
1363 }
1364 
1365 static int
1366 mt7925_mcu_uni_bss_bcnft(struct mt792x_dev *dev,
1367 			 struct ieee80211_bss_conf *link_conf, bool enable)
1368 {
1369 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1370 	struct {
1371 		struct {
1372 			u8 bss_idx;
1373 			u8 pad[3];
1374 		} __packed hdr;
1375 		struct bcnft_tlv {
1376 			__le16 tag;
1377 			__le16 len;
1378 			__le16 bcn_interval;
1379 			u8 dtim_period;
1380 			u8 bmc_delivered_ac;
1381 			u8 bmc_triggered_ac;
1382 			u8 pad[3];
1383 		} __packed bcnft;
1384 	} __packed bcnft_req = {
1385 		.hdr = {
1386 			.bss_idx = mconf->mt76.idx,
1387 		},
1388 		.bcnft = {
1389 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1390 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1391 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1392 			.dtim_period = link_conf->dtim_period,
1393 		},
1394 	};
1395 
1396 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1397 		return 0;
1398 
1399 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1400 				 &bcnft_req, sizeof(bcnft_req), true);
1401 }
1402 
1403 int
1404 mt7925_mcu_set_bss_pm(struct mt792x_dev *dev,
1405 		      struct ieee80211_bss_conf *link_conf,
1406 		      bool enable)
1407 {
1408 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1409 	struct {
1410 		struct {
1411 			u8 bss_idx;
1412 			u8 pad[3];
1413 		} __packed hdr;
1414 		struct bcnft_tlv {
1415 			__le16 tag;
1416 			__le16 len;
1417 			__le16 bcn_interval;
1418 			u8 dtim_period;
1419 			u8 bmc_delivered_ac;
1420 			u8 bmc_triggered_ac;
1421 			u8 pad[3];
1422 		} __packed enable;
1423 	} req = {
1424 		.hdr = {
1425 			.bss_idx = mconf->mt76.idx,
1426 		},
1427 		.enable = {
1428 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1429 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1430 			.dtim_period = link_conf->dtim_period,
1431 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1432 		},
1433 	};
1434 	struct {
1435 		struct {
1436 			u8 bss_idx;
1437 			u8 pad[3];
1438 		} __packed hdr;
1439 		struct pm_disable {
1440 			__le16 tag;
1441 			__le16 len;
1442 		} __packed disable;
1443 	} req1 = {
1444 		.hdr = {
1445 			.bss_idx = mconf->mt76.idx,
1446 		},
1447 		.disable = {
1448 			.tag = cpu_to_le16(UNI_BSS_INFO_PM_DISABLE),
1449 			.len = cpu_to_le16(sizeof(struct pm_disable))
1450 		},
1451 	};
1452 	int err;
1453 
1454 	err = mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1455 				&req1, sizeof(req1), false);
1456 	if (err < 0 || !enable)
1457 		return err;
1458 
1459 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1460 				 &req, sizeof(req), false);
1461 }
1462 
1463 static void
1464 mt7925_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1465 {
1466 	if (!link_sta->he_cap.has_he)
1467 		return;
1468 
1469 	mt76_connac_mcu_sta_he_tlv_v2(skb, link_sta->sta);
1470 }
1471 
1472 static void
1473 mt7925_mcu_sta_he_6g_tlv(struct sk_buff *skb,
1474 			 struct ieee80211_link_sta *link_sta)
1475 {
1476 	struct sta_rec_he_6g_capa *he_6g;
1477 	struct tlv *tlv;
1478 
1479 	if (!link_sta->he_6ghz_capa.capa)
1480 		return;
1481 
1482 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G, sizeof(*he_6g));
1483 
1484 	he_6g = (struct sta_rec_he_6g_capa *)tlv;
1485 	he_6g->capa = link_sta->he_6ghz_capa.capa;
1486 }
1487 
1488 static void
1489 mt7925_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1490 {
1491 	struct ieee80211_eht_mcs_nss_supp *mcs_map;
1492 	struct ieee80211_eht_cap_elem_fixed *elem;
1493 	struct sta_rec_eht *eht;
1494 	struct tlv *tlv;
1495 
1496 	if (!link_sta->eht_cap.has_eht)
1497 		return;
1498 
1499 	mcs_map = &link_sta->eht_cap.eht_mcs_nss_supp;
1500 	elem = &link_sta->eht_cap.eht_cap_elem;
1501 
1502 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT, sizeof(*eht));
1503 
1504 	eht = (struct sta_rec_eht *)tlv;
1505 	eht->tid_bitmap = 0xff;
1506 	eht->mac_cap = cpu_to_le16(*(u16 *)elem->mac_cap_info);
1507 	eht->phy_cap = cpu_to_le64(*(u64 *)elem->phy_cap_info);
1508 	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
1509 
1510 	if (link_sta->bandwidth == IEEE80211_STA_RX_BW_20)
1511 		memcpy(eht->mcs_map_bw20, &mcs_map->only_20mhz, sizeof(eht->mcs_map_bw20));
1512 	memcpy(eht->mcs_map_bw80, &mcs_map->bw._80, sizeof(eht->mcs_map_bw80));
1513 	memcpy(eht->mcs_map_bw160, &mcs_map->bw._160, sizeof(eht->mcs_map_bw160));
1514 }
1515 
1516 static void
1517 mt7925_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1518 {
1519 	struct sta_rec_ht *ht;
1520 	struct tlv *tlv;
1521 
1522 	if (!link_sta->ht_cap.ht_supported)
1523 		return;
1524 
1525 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1526 
1527 	ht = (struct sta_rec_ht *)tlv;
1528 	ht->ht_cap = cpu_to_le16(link_sta->ht_cap.cap);
1529 }
1530 
1531 static void
1532 mt7925_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1533 {
1534 	struct sta_rec_vht *vht;
1535 	struct tlv *tlv;
1536 
1537 	/* For 6G band, this tlv is necessary to let hw work normally */
1538 	if (!link_sta->he_6ghz_capa.capa && !link_sta->vht_cap.vht_supported)
1539 		return;
1540 
1541 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1542 
1543 	vht = (struct sta_rec_vht *)tlv;
1544 	vht->vht_cap = cpu_to_le32(link_sta->vht_cap.cap);
1545 	vht->vht_rx_mcs_map = link_sta->vht_cap.vht_mcs.rx_mcs_map;
1546 	vht->vht_tx_mcs_map = link_sta->vht_cap.vht_mcs.tx_mcs_map;
1547 }
1548 
1549 static void
1550 mt7925_mcu_sta_amsdu_tlv(struct sk_buff *skb,
1551 			 struct ieee80211_vif *vif,
1552 			 struct ieee80211_link_sta *link_sta)
1553 {
1554 	struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1555 	struct mt792x_link_sta *mlink;
1556 	struct sta_rec_amsdu *amsdu;
1557 	struct tlv *tlv;
1558 
1559 	if (vif->type != NL80211_IFTYPE_STATION &&
1560 	    vif->type != NL80211_IFTYPE_AP)
1561 		return;
1562 
1563 	if (!link_sta->agg.max_amsdu_len)
1564 		return;
1565 
1566 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1567 	amsdu = (struct sta_rec_amsdu *)tlv;
1568 	amsdu->max_amsdu_num = 8;
1569 	amsdu->amsdu_en = true;
1570 
1571 	mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1572 	mlink->wcid.amsdu = true;
1573 
1574 	switch (link_sta->agg.max_amsdu_len) {
1575 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1576 		amsdu->max_mpdu_size =
1577 			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1578 		return;
1579 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
1580 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1581 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1582 		return;
1583 	default:
1584 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1585 		return;
1586 	}
1587 }
1588 
1589 static void
1590 mt7925_mcu_sta_phy_tlv(struct sk_buff *skb,
1591 		       struct ieee80211_vif *vif,
1592 		       struct ieee80211_link_sta *link_sta)
1593 {
1594 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1595 	struct ieee80211_bss_conf *link_conf;
1596 	struct cfg80211_chan_def *chandef;
1597 	struct mt792x_bss_conf *mconf;
1598 	struct sta_rec_phy *phy;
1599 	struct tlv *tlv;
1600 	u8 af = 0, mm = 0;
1601 
1602 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1603 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1604 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1605 				    &link_conf->chanreq.oper;
1606 
1607 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PHY, sizeof(*phy));
1608 	phy = (struct sta_rec_phy *)tlv;
1609 	phy->phy_type = mt76_connac_get_phy_mode_v2(mvif->phy->mt76, vif,
1610 						    chandef->chan->band,
1611 						    link_sta);
1612 	phy->basic_rate = cpu_to_le16((u16)link_conf->basic_rates);
1613 	if (link_sta->ht_cap.ht_supported) {
1614 		af = link_sta->ht_cap.ampdu_factor;
1615 		mm = link_sta->ht_cap.ampdu_density;
1616 	}
1617 
1618 	if (link_sta->vht_cap.vht_supported) {
1619 		u8 vht_af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1620 				      link_sta->vht_cap.cap);
1621 
1622 		af = max_t(u8, af, vht_af);
1623 	}
1624 
1625 	if (link_sta->he_6ghz_capa.capa) {
1626 		af = le16_get_bits(link_sta->he_6ghz_capa.capa,
1627 				   IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1628 		mm = le16_get_bits(link_sta->he_6ghz_capa.capa,
1629 				   IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
1630 	}
1631 
1632 	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR, af) |
1633 		     FIELD_PREP(IEEE80211_HT_AMPDU_PARM_DENSITY, mm);
1634 	phy->max_ampdu_len = af;
1635 }
1636 
1637 static void
1638 mt7925_mcu_sta_state_v2_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
1639 			    struct ieee80211_link_sta *link_sta,
1640 			    struct ieee80211_vif *vif,
1641 			    u8 rcpi, u8 sta_state)
1642 {
1643 	struct sta_rec_state_v2 {
1644 		__le16 tag;
1645 		__le16 len;
1646 		u8 state;
1647 		u8 rsv[3];
1648 		__le32 flags;
1649 		u8 vht_opmode;
1650 		u8 action;
1651 		u8 rsv2[2];
1652 	} __packed * state;
1653 	struct tlv *tlv;
1654 
1655 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_STATE, sizeof(*state));
1656 	state = (struct sta_rec_state_v2 *)tlv;
1657 	state->state = sta_state;
1658 
1659 	if (link_sta->vht_cap.vht_supported) {
1660 		state->vht_opmode = link_sta->bandwidth;
1661 		state->vht_opmode |= link_sta->rx_nss <<
1662 			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
1663 	}
1664 }
1665 
1666 static void
1667 mt7925_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb,
1668 			     struct ieee80211_vif *vif,
1669 			     struct ieee80211_link_sta *link_sta)
1670 {
1671 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1672 	struct ieee80211_bss_conf *link_conf;
1673 	struct cfg80211_chan_def *chandef;
1674 	struct sta_rec_ra_info *ra_info;
1675 	struct mt792x_bss_conf *mconf;
1676 	enum nl80211_band band;
1677 	struct tlv *tlv;
1678 	u16 supp_rates;
1679 
1680 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1681 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1682 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1683 				    &link_conf->chanreq.oper;
1684 	band = chandef->chan->band;
1685 
1686 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra_info));
1687 	ra_info = (struct sta_rec_ra_info *)tlv;
1688 
1689 	supp_rates = link_sta->supp_rates[band];
1690 	if (band == NL80211_BAND_2GHZ)
1691 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
1692 			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
1693 	else
1694 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates);
1695 
1696 	ra_info->legacy = cpu_to_le16(supp_rates);
1697 
1698 	if (link_sta->ht_cap.ht_supported)
1699 		memcpy(ra_info->rx_mcs_bitmask,
1700 		       link_sta->ht_cap.mcs.rx_mask,
1701 		       HT_MCS_MASK_NUM);
1702 }
1703 
1704 static void
1705 mt7925_mcu_sta_eht_mld_tlv(struct sk_buff *skb,
1706 			   struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1707 {
1708 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1709 	struct wiphy *wiphy = mvif->phy->mt76->hw->wiphy;
1710 	const struct wiphy_iftype_ext_capab *ext_capa;
1711 	struct sta_rec_eht_mld *eht_mld;
1712 	struct tlv *tlv;
1713 	u16 eml_cap;
1714 
1715 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT_MLD, sizeof(*eht_mld));
1716 	eht_mld = (struct sta_rec_eht_mld *)tlv;
1717 	eht_mld->mld_type = 0xff;
1718 
1719 	if (!ieee80211_vif_is_mld(vif))
1720 		return;
1721 
1722 	ext_capa = cfg80211_get_iftype_ext_capa(wiphy,
1723 						ieee80211_vif_type_p2p(vif));
1724 	if (!ext_capa)
1725 		return;
1726 
1727 	eml_cap = (vif->cfg.eml_cap & (IEEE80211_EML_CAP_EMLSR_SUPP |
1728 				       IEEE80211_EML_CAP_TRANSITION_TIMEOUT)) |
1729 		  (ext_capa->eml_capabilities & (IEEE80211_EML_CAP_EMLSR_PADDING_DELAY |
1730 						IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY));
1731 
1732 	if (eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP) {
1733 		eht_mld->eml_cap[0] = u16_get_bits(eml_cap, GENMASK(7, 0));
1734 		eht_mld->eml_cap[1] = u16_get_bits(eml_cap, GENMASK(15, 8));
1735 	} else {
1736 		eht_mld->str_cap[0] = BIT(1);
1737 	}
1738 }
1739 
1740 static void
1741 mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,
1742 		       struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1743 {
1744 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1745 	struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv;
1746 	unsigned long valid = mvif->valid_links;
1747 	struct mt792x_bss_conf *mconf;
1748 	struct mt792x_link_sta *mlink;
1749 	struct sta_rec_mld *mld;
1750 	struct tlv *tlv;
1751 	int i, cnt = 0;
1752 
1753 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MLD, sizeof(*mld));
1754 	mld = (struct sta_rec_mld *)tlv;
1755 	memcpy(mld->mac_addr, sta->addr, ETH_ALEN);
1756 	mld->primary_id = cpu_to_le16(msta->deflink.wcid.idx);
1757 	mld->wlan_id = cpu_to_le16(msta->deflink.wcid.idx);
1758 	mld->link_num = min_t(u8, hweight16(mvif->valid_links), 2);
1759 
1760 	for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
1761 		if (cnt == mld->link_num)
1762 			break;
1763 
1764 		mconf = mt792x_vif_to_link(mvif, i);
1765 		mlink = mt792x_sta_to_link(msta, i);
1766 		mld->link[cnt].wlan_id = cpu_to_le16(mlink->wcid.idx);
1767 		mld->link[cnt++].bss_idx = mconf->mt76.idx;
1768 
1769 		if (mlink != &msta->deflink)
1770 			mld->secondary_id = cpu_to_le16(mlink->wcid.idx);
1771 	}
1772 }
1773 
1774 static int
1775 mt7925_mcu_sta_cmd(struct mt76_phy *phy,
1776 		   struct mt76_sta_cmd_info *info)
1777 {
1778 	struct mt76_vif *mvif = (struct mt76_vif *)info->vif->drv_priv;
1779 	struct mt76_dev *dev = phy->dev;
1780 	struct sk_buff *skb;
1781 	int conn_state;
1782 
1783 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, info->wcid,
1784 					      MT7925_STA_UPDATE_MAX_SIZE);
1785 	if (IS_ERR(skb))
1786 		return PTR_ERR(skb);
1787 
1788 	conn_state = info->enable ? CONN_STATE_PORT_SECURE :
1789 				    CONN_STATE_DISCONNECT;
1790 	if (info->link_sta)
1791 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif,
1792 					      info->link_sta,
1793 					      conn_state, info->newly);
1794 	if (info->link_sta && info->enable) {
1795 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1796 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1797 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1798 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1799 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1800 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1801 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1802 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1803 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1804 					     info->link_sta);
1805 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1806 					    info->vif, info->rcpi,
1807 					    info->state);
1808 		mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1809 	}
1810 
1811 	if (info->enable)
1812 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
1813 
1814 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1815 }
1816 
1817 static void
1818 mt7925_mcu_sta_remove_tlv(struct sk_buff *skb)
1819 {
1820 	struct sta_rec_remove *rem;
1821 	struct tlv *tlv;
1822 
1823 	tlv = mt76_connac_mcu_add_tlv(skb, 0x25, sizeof(*rem));
1824 	rem = (struct sta_rec_remove *)tlv;
1825 	rem->action = 0;
1826 }
1827 
1828 static int
1829 mt7925_mcu_mlo_sta_cmd(struct mt76_phy *phy,
1830 		       struct mt76_sta_cmd_info *info)
1831 {
1832 	struct mt792x_vif *mvif = (struct mt792x_vif *)info->vif->drv_priv;
1833 	struct mt76_dev *dev = phy->dev;
1834 	struct mt792x_bss_conf *mconf;
1835 	struct sk_buff *skb;
1836 
1837 	mconf = mt792x_vif_to_link(mvif, info->wcid->link_id);
1838 
1839 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, info->wcid,
1840 					      MT7925_STA_UPDATE_MAX_SIZE);
1841 	if (IS_ERR(skb))
1842 		return PTR_ERR(skb);
1843 
1844 	if (info->enable)
1845 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif,
1846 					      info->link_sta,
1847 					      info->enable, info->newly);
1848 
1849 	if (info->enable && info->link_sta) {
1850 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1851 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1852 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1853 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1854 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1855 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1856 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1857 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1858 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1859 					     info->link_sta);
1860 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1861 					    info->vif, info->rcpi,
1862 					    info->state);
1863 
1864 		if (info->state != MT76_STA_INFO_STATE_NONE) {
1865 			mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1866 			mt7925_mcu_sta_eht_mld_tlv(skb, info->vif, info->link_sta->sta);
1867 		}
1868 
1869 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
1870 	}
1871 
1872 	if (!info->enable) {
1873 		mt7925_mcu_sta_remove_tlv(skb);
1874 		mt76_connac_mcu_add_tlv(skb, STA_REC_MLD_OFF,
1875 					sizeof(struct tlv));
1876 	}
1877 
1878 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1879 }
1880 
1881 int mt7925_mcu_sta_update(struct mt792x_dev *dev,
1882 			  struct ieee80211_link_sta *link_sta,
1883 			  struct ieee80211_vif *vif, bool enable,
1884 			  enum mt76_sta_info_state state)
1885 {
1886 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1887 	int rssi = -ewma_rssi_read(&mvif->bss_conf.rssi);
1888 	struct mt76_sta_cmd_info info = {
1889 		.link_sta = link_sta,
1890 		.vif = vif,
1891 		.enable = enable,
1892 		.cmd = MCU_UNI_CMD(STA_REC_UPDATE),
1893 		.state = state,
1894 		.offload_fw = true,
1895 		.rcpi = to_rcpi(rssi),
1896 	};
1897 	struct mt792x_sta *msta;
1898 	struct mt792x_link_sta *mlink;
1899 	int err;
1900 
1901 	if (link_sta) {
1902 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1903 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1904 	}
1905 	info.wcid = link_sta ? &mlink->wcid : &mvif->sta.deflink.wcid;
1906 	info.newly = link_sta ? state != MT76_STA_INFO_STATE_ASSOC : true;
1907 
1908 	if (ieee80211_vif_is_mld(vif))
1909 		err = mt7925_mcu_mlo_sta_cmd(&dev->mphy, &info);
1910 	else
1911 		err = mt7925_mcu_sta_cmd(&dev->mphy, &info);
1912 
1913 	return err;
1914 }
1915 
1916 int mt7925_mcu_set_beacon_filter(struct mt792x_dev *dev,
1917 				 struct ieee80211_vif *vif,
1918 				 bool enable)
1919 {
1920 #define MT7925_FIF_BIT_CLR		BIT(1)
1921 #define MT7925_FIF_BIT_SET		BIT(0)
1922 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1923 	unsigned long valid = ieee80211_vif_is_mld(vif) ?
1924 				      mvif->valid_links : BIT(0);
1925 	struct ieee80211_bss_conf *bss_conf;
1926 	int err = 0;
1927 	int i;
1928 
1929 	if (enable) {
1930 		for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
1931 			bss_conf = mt792x_vif_to_bss_conf(vif, i);
1932 			err = mt7925_mcu_uni_bss_bcnft(dev, bss_conf, true);
1933 			if (err < 0)
1934 				return err;
1935 		}
1936 
1937 		return mt7925_mcu_set_rxfilter(dev, 0,
1938 					       MT7925_FIF_BIT_SET,
1939 					       MT_WF_RFCR_DROP_OTHER_BEACON);
1940 	}
1941 
1942 	for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
1943 		bss_conf = mt792x_vif_to_bss_conf(vif, i);
1944 		err = mt7925_mcu_set_bss_pm(dev, bss_conf, false);
1945 		if (err)
1946 			return err;
1947 	}
1948 
1949 	return mt7925_mcu_set_rxfilter(dev, 0,
1950 				       MT7925_FIF_BIT_CLR,
1951 				       MT_WF_RFCR_DROP_OTHER_BEACON);
1952 }
1953 
1954 int mt7925_get_txpwr_info(struct mt792x_dev *dev, u8 band_idx, struct mt7925_txpwr *txpwr)
1955 {
1956 #define TX_POWER_SHOW_INFO 0x7
1957 #define TXPOWER_ALL_RATE_POWER_INFO 0x2
1958 	struct mt7925_txpwr_event *event;
1959 	struct mt7925_txpwr_req req = {
1960 		.tag = cpu_to_le16(TX_POWER_SHOW_INFO),
1961 		.len = cpu_to_le16(sizeof(req) - 4),
1962 		.catg = TXPOWER_ALL_RATE_POWER_INFO,
1963 		.band_idx = band_idx,
1964 	};
1965 	struct sk_buff *skb;
1966 	int ret;
1967 
1968 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(TXPOWER),
1969 					&req, sizeof(req), true, &skb);
1970 	if (ret)
1971 		return ret;
1972 
1973 	event = (struct mt7925_txpwr_event *)skb->data;
1974 	memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
1975 
1976 	dev_kfree_skb(skb);
1977 
1978 	return 0;
1979 }
1980 
1981 int mt7925_mcu_set_sniffer(struct mt792x_dev *dev, struct ieee80211_vif *vif,
1982 			   bool enable)
1983 {
1984 	struct {
1985 		struct {
1986 			u8 band_idx;
1987 			u8 pad[3];
1988 		} __packed hdr;
1989 		struct sniffer_enable_tlv {
1990 			__le16 tag;
1991 			__le16 len;
1992 			u8 enable;
1993 			u8 pad[3];
1994 		} __packed enable;
1995 	} __packed req = {
1996 		.hdr = {
1997 			.band_idx = 0,
1998 		},
1999 		.enable = {
2000 			.tag = cpu_to_le16(UNI_SNIFFER_ENABLE),
2001 			.len = cpu_to_le16(sizeof(struct sniffer_enable_tlv)),
2002 			.enable = enable,
2003 		},
2004 	};
2005 
2006 	mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req), true);
2007 
2008 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req),
2009 				 true);
2010 }
2011 
2012 int mt7925_mcu_config_sniffer(struct mt792x_vif *vif,
2013 			      struct ieee80211_chanctx_conf *ctx)
2014 {
2015 	struct mt76_phy *mphy = vif->phy->mt76;
2016 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def : &mphy->chandef;
2017 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2018 
2019 	static const u8 ch_band[] = {
2020 		[NL80211_BAND_2GHZ] = 1,
2021 		[NL80211_BAND_5GHZ] = 2,
2022 		[NL80211_BAND_6GHZ] = 3,
2023 	};
2024 	static const u8 ch_width[] = {
2025 		[NL80211_CHAN_WIDTH_20_NOHT] = 0,
2026 		[NL80211_CHAN_WIDTH_20] = 0,
2027 		[NL80211_CHAN_WIDTH_40] = 0,
2028 		[NL80211_CHAN_WIDTH_80] = 1,
2029 		[NL80211_CHAN_WIDTH_160] = 2,
2030 		[NL80211_CHAN_WIDTH_80P80] = 3,
2031 		[NL80211_CHAN_WIDTH_5] = 4,
2032 		[NL80211_CHAN_WIDTH_10] = 5,
2033 		[NL80211_CHAN_WIDTH_320] = 6,
2034 	};
2035 
2036 	struct {
2037 		struct {
2038 			u8 band_idx;
2039 			u8 pad[3];
2040 		} __packed hdr;
2041 		struct config_tlv {
2042 			__le16 tag;
2043 			__le16 len;
2044 			u16 aid;
2045 			u8 ch_band;
2046 			u8 bw;
2047 			u8 control_ch;
2048 			u8 sco;
2049 			u8 center_ch;
2050 			u8 center_ch2;
2051 			u8 drop_err;
2052 			u8 pad[3];
2053 		} __packed tlv;
2054 	} __packed req = {
2055 		.hdr = {
2056 			.band_idx = 0,
2057 		},
2058 		.tlv = {
2059 			.tag = cpu_to_le16(UNI_SNIFFER_CONFIG),
2060 			.len = cpu_to_le16(sizeof(req.tlv)),
2061 			.control_ch = chandef->chan->hw_value,
2062 			.center_ch = ieee80211_frequency_to_channel(freq1),
2063 			.drop_err = 1,
2064 		},
2065 	};
2066 
2067 	if (chandef->chan->band < ARRAY_SIZE(ch_band))
2068 		req.tlv.ch_band = ch_band[chandef->chan->band];
2069 	if (chandef->width < ARRAY_SIZE(ch_width))
2070 		req.tlv.bw = ch_width[chandef->width];
2071 
2072 	if (freq2)
2073 		req.tlv.center_ch2 = ieee80211_frequency_to_channel(freq2);
2074 
2075 	if (req.tlv.control_ch < req.tlv.center_ch)
2076 		req.tlv.sco = 1; /* SCA */
2077 	else if (req.tlv.control_ch > req.tlv.center_ch)
2078 		req.tlv.sco = 3; /* SCB */
2079 
2080 	return mt76_mcu_send_msg(mphy->dev, MCU_UNI_CMD(SNIFFER),
2081 				 &req, sizeof(req), true);
2082 }
2083 
2084 int
2085 mt7925_mcu_uni_add_beacon_offload(struct mt792x_dev *dev,
2086 				  struct ieee80211_hw *hw,
2087 				  struct ieee80211_vif *vif,
2088 				  bool enable)
2089 {
2090 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
2091 	struct ieee80211_mutable_offsets offs;
2092 	struct {
2093 		struct req_hdr {
2094 			u8 bss_idx;
2095 			u8 pad[3];
2096 		} __packed hdr;
2097 		struct bcn_content_tlv {
2098 			__le16 tag;
2099 			__le16 len;
2100 			__le16 tim_ie_pos;
2101 			__le16 csa_ie_pos;
2102 			__le16 bcc_ie_pos;
2103 			/* 0: disable beacon offload
2104 			 * 1: enable beacon offload
2105 			 * 2: update probe respond offload
2106 			 */
2107 			u8 enable;
2108 			/* 0: legacy format (TXD + payload)
2109 			 * 1: only cap field IE
2110 			 */
2111 			u8 type;
2112 			__le16 pkt_len;
2113 			u8 pkt[512];
2114 		} __packed beacon_tlv;
2115 	} req = {
2116 		.hdr = {
2117 			.bss_idx = mvif->bss_conf.mt76.idx,
2118 		},
2119 		.beacon_tlv = {
2120 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
2121 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
2122 			.enable = enable,
2123 			.type = 1,
2124 		},
2125 	};
2126 	struct sk_buff *skb;
2127 	u8 cap_offs;
2128 
2129 	/* support enable/update process only
2130 	 * disable flow would be handled in bss stop handler automatically
2131 	 */
2132 	if (!enable)
2133 		return -EOPNOTSUPP;
2134 
2135 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs, 0);
2136 	if (!skb)
2137 		return -EINVAL;
2138 
2139 	cap_offs = offsetof(struct ieee80211_mgmt, u.beacon.capab_info);
2140 	if (!skb_pull(skb, cap_offs)) {
2141 		dev_err(dev->mt76.dev, "beacon format err\n");
2142 		dev_kfree_skb(skb);
2143 		return -EINVAL;
2144 	}
2145 
2146 	if (skb->len > 512) {
2147 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
2148 		dev_kfree_skb(skb);
2149 		return -EINVAL;
2150 	}
2151 
2152 	memcpy(req.beacon_tlv.pkt, skb->data, skb->len);
2153 	req.beacon_tlv.pkt_len = cpu_to_le16(skb->len);
2154 	offs.tim_offset -= cap_offs;
2155 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(offs.tim_offset);
2156 
2157 	if (offs.cntdwn_counter_offs[0]) {
2158 		u16 csa_offs;
2159 
2160 		csa_offs = offs.cntdwn_counter_offs[0] - cap_offs - 4;
2161 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
2162 	}
2163 	dev_kfree_skb(skb);
2164 
2165 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
2166 				 &req, sizeof(req), true);
2167 }
2168 
2169 static
2170 void mt7925_mcu_bss_rlm_tlv(struct sk_buff *skb, struct mt76_phy *phy,
2171 			    struct ieee80211_bss_conf *link_conf,
2172 			    struct ieee80211_chanctx_conf *ctx)
2173 {
2174 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2175 						  &link_conf->chanreq.oper;
2176 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2177 	enum nl80211_band band = chandef->chan->band;
2178 	struct bss_rlm_tlv *req;
2179 	struct tlv *tlv;
2180 
2181 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RLM, sizeof(*req));
2182 	req = (struct bss_rlm_tlv *)tlv;
2183 	req->control_channel = chandef->chan->hw_value;
2184 	req->center_chan = ieee80211_frequency_to_channel(freq1);
2185 	req->center_chan2 = 0;
2186 	req->tx_streams = hweight8(phy->antenna_mask);
2187 	req->ht_op_info = 4; /* set HT 40M allowed */
2188 	req->rx_streams = hweight8(phy->antenna_mask);
2189 	req->center_chan2 = 0;
2190 	req->sco = 0;
2191 	req->band = 1;
2192 
2193 	switch (band) {
2194 	case NL80211_BAND_2GHZ:
2195 		req->band = 1;
2196 		break;
2197 	case NL80211_BAND_5GHZ:
2198 		req->band = 2;
2199 		break;
2200 	case NL80211_BAND_6GHZ:
2201 		req->band = 3;
2202 		break;
2203 	default:
2204 		break;
2205 	}
2206 
2207 	switch (chandef->width) {
2208 	case NL80211_CHAN_WIDTH_40:
2209 		req->bw = CMD_CBW_40MHZ;
2210 		break;
2211 	case NL80211_CHAN_WIDTH_80:
2212 		req->bw = CMD_CBW_80MHZ;
2213 		break;
2214 	case NL80211_CHAN_WIDTH_80P80:
2215 		req->bw = CMD_CBW_8080MHZ;
2216 		req->center_chan2 = ieee80211_frequency_to_channel(freq2);
2217 		break;
2218 	case NL80211_CHAN_WIDTH_160:
2219 		req->bw = CMD_CBW_160MHZ;
2220 		break;
2221 	case NL80211_CHAN_WIDTH_5:
2222 		req->bw = CMD_CBW_5MHZ;
2223 		break;
2224 	case NL80211_CHAN_WIDTH_10:
2225 		req->bw = CMD_CBW_10MHZ;
2226 		break;
2227 	case NL80211_CHAN_WIDTH_20_NOHT:
2228 	case NL80211_CHAN_WIDTH_20:
2229 	default:
2230 		req->bw = CMD_CBW_20MHZ;
2231 		req->ht_op_info = 0;
2232 		break;
2233 	}
2234 
2235 	if (req->control_channel < req->center_chan)
2236 		req->sco = 1; /* SCA */
2237 	else if (req->control_channel > req->center_chan)
2238 		req->sco = 3; /* SCB */
2239 }
2240 
2241 static struct sk_buff *
2242 __mt7925_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
2243 {
2244 	struct bss_req_hdr hdr = {
2245 		.bss_idx = mvif->idx,
2246 	};
2247 	struct sk_buff *skb;
2248 
2249 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
2250 	if (!skb)
2251 		return ERR_PTR(-ENOMEM);
2252 
2253 	skb_put_data(skb, &hdr, sizeof(hdr));
2254 
2255 	return skb;
2256 }
2257 
2258 int mt7925_mcu_set_chctx(struct mt76_phy *phy, struct mt76_vif *mvif,
2259 			 struct ieee80211_bss_conf *link_conf,
2260 			 struct ieee80211_chanctx_conf *ctx)
2261 {
2262 	struct sk_buff *skb;
2263 
2264 	skb = __mt7925_mcu_alloc_bss_req(phy->dev, mvif,
2265 					 MT7925_BSS_UPDATE_MAX_SIZE);
2266 	if (IS_ERR(skb))
2267 		return PTR_ERR(skb);
2268 
2269 	mt7925_mcu_bss_rlm_tlv(skb, phy, link_conf, ctx);
2270 
2271 	return mt76_mcu_skb_send_msg(phy->dev, skb,
2272 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2273 }
2274 
2275 static u8
2276 mt7925_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
2277 			enum nl80211_band band,
2278 			struct ieee80211_link_sta *link_sta)
2279 {
2280 	struct ieee80211_he_6ghz_capa *he_6ghz_capa;
2281 	const struct ieee80211_sta_eht_cap *eht_cap;
2282 	__le16 capa = 0;
2283 	u8 mode = 0;
2284 
2285 	if (link_sta) {
2286 		he_6ghz_capa = &link_sta->he_6ghz_capa;
2287 		eht_cap = &link_sta->eht_cap;
2288 	} else {
2289 		struct ieee80211_supported_band *sband;
2290 
2291 		sband = phy->hw->wiphy->bands[band];
2292 		capa = ieee80211_get_he_6ghz_capa(sband, vif->type);
2293 		he_6ghz_capa = (struct ieee80211_he_6ghz_capa *)&capa;
2294 
2295 		eht_cap = ieee80211_get_eht_iftype_cap(sband, vif->type);
2296 	}
2297 
2298 	switch (band) {
2299 	case NL80211_BAND_2GHZ:
2300 		if (eht_cap && eht_cap->has_eht)
2301 			mode |= PHY_MODE_BE_24G;
2302 		break;
2303 	case NL80211_BAND_5GHZ:
2304 		if (eht_cap && eht_cap->has_eht)
2305 			mode |= PHY_MODE_BE_5G;
2306 		break;
2307 	case NL80211_BAND_6GHZ:
2308 		if (he_6ghz_capa && he_6ghz_capa->capa)
2309 			mode |= PHY_MODE_AX_6G;
2310 
2311 		if (eht_cap && eht_cap->has_eht)
2312 			mode |= PHY_MODE_BE_6G;
2313 		break;
2314 	default:
2315 		break;
2316 	}
2317 
2318 	return mode;
2319 }
2320 
2321 static void
2322 mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
2323 			 struct ieee80211_bss_conf *link_conf,
2324 			 struct ieee80211_link_sta *link_sta,
2325 			 struct ieee80211_chanctx_conf *ctx,
2326 			 struct mt76_phy *phy, u16 wlan_idx,
2327 			 bool enable)
2328 {
2329 	struct ieee80211_vif *vif = link_conf->vif;
2330 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2331 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2332 						  &link_conf->chanreq.oper;
2333 	enum nl80211_band band = chandef->chan->band;
2334 	struct mt76_connac_bss_basic_tlv *basic_req;
2335 	struct mt792x_link_sta *mlink;
2336 	struct tlv *tlv;
2337 	int conn_type;
2338 	u8 idx;
2339 
2340 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*basic_req));
2341 	basic_req = (struct mt76_connac_bss_basic_tlv *)tlv;
2342 
2343 	idx = mconf->mt76.omac_idx > EXT_BSSID_START ? HW_BSSID_0 :
2344 						      mconf->mt76.omac_idx;
2345 	basic_req->hw_bss_idx = idx;
2346 
2347 	basic_req->phymode_ext = mt7925_get_phy_mode_ext(phy, vif, band,
2348 							 link_sta);
2349 
2350 	if (band == NL80211_BAND_2GHZ)
2351 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_ERP_INDEX);
2352 	else
2353 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_OFDM_INDEX);
2354 
2355 	memcpy(basic_req->bssid, link_conf->bssid, ETH_ALEN);
2356 	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, link_sta);
2357 	basic_req->bcn_interval = cpu_to_le16(link_conf->beacon_int);
2358 	basic_req->dtim_period = link_conf->dtim_period;
2359 	basic_req->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
2360 	basic_req->link_idx = mconf->mt76.idx;
2361 
2362 	if (link_sta) {
2363 		struct mt792x_sta *msta;
2364 
2365 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
2366 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
2367 
2368 	} else {
2369 		mlink = &mconf->vif->sta.deflink;
2370 	}
2371 
2372 	basic_req->sta_idx = cpu_to_le16(mlink->wcid.idx);
2373 	basic_req->omac_idx = mconf->mt76.omac_idx;
2374 	basic_req->band_idx = mconf->mt76.band_idx;
2375 	basic_req->wmm_idx = mconf->mt76.wmm_idx;
2376 	basic_req->conn_state = !enable;
2377 
2378 	switch (vif->type) {
2379 	case NL80211_IFTYPE_MESH_POINT:
2380 	case NL80211_IFTYPE_AP:
2381 		if (vif->p2p)
2382 			conn_type = CONNECTION_P2P_GO;
2383 		else
2384 			conn_type = CONNECTION_INFRA_AP;
2385 		basic_req->conn_type = cpu_to_le32(conn_type);
2386 		basic_req->active = enable;
2387 		break;
2388 	case NL80211_IFTYPE_STATION:
2389 		if (vif->p2p)
2390 			conn_type = CONNECTION_P2P_GC;
2391 		else
2392 			conn_type = CONNECTION_INFRA_STA;
2393 		basic_req->conn_type = cpu_to_le32(conn_type);
2394 		basic_req->active = true;
2395 		break;
2396 	case NL80211_IFTYPE_ADHOC:
2397 		basic_req->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
2398 		basic_req->active = true;
2399 		break;
2400 	default:
2401 		WARN_ON(1);
2402 		break;
2403 	}
2404 }
2405 
2406 static void
2407 mt7925_mcu_bss_sec_tlv(struct sk_buff *skb,
2408 		       struct ieee80211_bss_conf *link_conf)
2409 {
2410 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2411 	struct mt76_vif *mvif = &mconf->mt76;
2412 	struct bss_sec_tlv {
2413 		__le16 tag;
2414 		__le16 len;
2415 		u8 mode;
2416 		u8 status;
2417 		u8 cipher;
2418 		u8 __rsv;
2419 	} __packed * sec;
2420 	struct tlv *tlv;
2421 
2422 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_SEC, sizeof(*sec));
2423 	sec = (struct bss_sec_tlv *)tlv;
2424 
2425 	switch (mvif->cipher) {
2426 	case CONNAC3_CIPHER_GCMP_256:
2427 	case CONNAC3_CIPHER_GCMP:
2428 		sec->mode = MODE_WPA3_SAE;
2429 		sec->status = 8;
2430 		break;
2431 	case CONNAC3_CIPHER_AES_CCMP:
2432 		sec->mode = MODE_WPA2_PSK;
2433 		sec->status = 6;
2434 		break;
2435 	case CONNAC3_CIPHER_TKIP:
2436 		sec->mode = MODE_WPA2_PSK;
2437 		sec->status = 4;
2438 		break;
2439 	case CONNAC3_CIPHER_WEP104:
2440 	case CONNAC3_CIPHER_WEP40:
2441 		sec->mode = MODE_SHARED;
2442 		sec->status = 0;
2443 		break;
2444 	default:
2445 		sec->mode = MODE_OPEN;
2446 		sec->status = 1;
2447 		break;
2448 	}
2449 
2450 	sec->cipher = mvif->cipher;
2451 }
2452 
2453 static void
2454 mt7925_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt792x_phy *phy,
2455 		       struct ieee80211_chanctx_conf *ctx,
2456 		       struct ieee80211_bss_conf *link_conf)
2457 {
2458 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2459 						  &link_conf->chanreq.oper;
2460 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2461 	enum nl80211_band band = chandef->chan->band;
2462 	struct mt76_vif *mvif = &mconf->mt76;
2463 	struct bss_rate_tlv *bmc;
2464 	struct tlv *tlv;
2465 	u8 idx = mvif->mcast_rates_idx ?
2466 		 mvif->mcast_rates_idx : mvif->basic_rates_idx;
2467 
2468 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RATE, sizeof(*bmc));
2469 
2470 	bmc = (struct bss_rate_tlv *)tlv;
2471 
2472 	if (band == NL80211_BAND_2GHZ)
2473 		bmc->basic_rate = cpu_to_le16(HR_DSSS_ERP_BASIC_RATE);
2474 	else
2475 		bmc->basic_rate = cpu_to_le16(OFDM_BASIC_RATE);
2476 
2477 	bmc->short_preamble = (band == NL80211_BAND_2GHZ);
2478 	bmc->bc_fixed_rate = idx;
2479 	bmc->mc_fixed_rate = idx;
2480 }
2481 
2482 static void
2483 mt7925_mcu_bss_mld_tlv(struct sk_buff *skb,
2484 		       struct ieee80211_bss_conf *link_conf)
2485 {
2486 	struct ieee80211_vif *vif = link_conf->vif;
2487 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2488 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2489 	struct bss_mld_tlv *mld;
2490 	struct tlv *tlv;
2491 	bool is_mld;
2492 
2493 	is_mld = ieee80211_vif_is_mld(link_conf->vif) ||
2494 		 (hweight16(mvif->valid_links) > 1);
2495 
2496 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_MLD, sizeof(*mld));
2497 	mld = (struct bss_mld_tlv *)tlv;
2498 
2499 	mld->link_id = is_mld ? link_conf->link_id : 0xff;
2500 	/* apply the index of the primary link */
2501 	mld->group_mld_id = is_mld ? mvif->bss_conf.mt76.idx : 0xff;
2502 	mld->own_mld_id = mconf->mt76.idx + 32;
2503 	mld->remap_idx = 0xff;
2504 	mld->eml_enable = !!(link_conf->vif->cfg.eml_cap &
2505 			     IEEE80211_EML_CAP_EMLSR_SUPP);
2506 
2507 	memcpy(mld->mac_addr, vif->addr, ETH_ALEN);
2508 }
2509 
2510 static void
2511 mt7925_mcu_bss_qos_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf)
2512 {
2513 	struct mt76_connac_bss_qos_tlv *qos;
2514 	struct tlv *tlv;
2515 
2516 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_QBSS, sizeof(*qos));
2517 	qos = (struct mt76_connac_bss_qos_tlv *)tlv;
2518 	qos->qos = link_conf->qos;
2519 }
2520 
2521 static void
2522 mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2523 		      struct mt792x_phy *phy)
2524 {
2525 #define DEFAULT_HE_PE_DURATION		4
2526 #define DEFAULT_HE_DURATION_RTS_THRES	1023
2527 	const struct ieee80211_sta_he_cap *cap;
2528 	struct bss_info_uni_he *he;
2529 	struct tlv *tlv;
2530 
2531 	cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
2532 
2533 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
2534 
2535 	he = (struct bss_info_uni_he *)tlv;
2536 	he->he_pe_duration = link_conf->htc_trig_based_pkt_ext;
2537 	if (!he->he_pe_duration)
2538 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
2539 
2540 	he->he_rts_thres = cpu_to_le16(link_conf->frame_time_rts_th);
2541 	if (!he->he_rts_thres)
2542 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
2543 
2544 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
2545 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
2546 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
2547 }
2548 
2549 static void
2550 mt7925_mcu_bss_color_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2551 			 bool enable)
2552 {
2553 	struct bss_info_uni_bss_color *color;
2554 	struct tlv *tlv;
2555 
2556 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BSS_COLOR, sizeof(*color));
2557 	color = (struct bss_info_uni_bss_color *)tlv;
2558 
2559 	color->enable = enable ?
2560 		link_conf->he_bss_color.enabled : 0;
2561 	color->bss_color = enable ?
2562 		link_conf->he_bss_color.color : 0;
2563 }
2564 
2565 static void
2566 mt7925_mcu_bss_ifs_tlv(struct sk_buff *skb,
2567 		       struct ieee80211_bss_conf *link_conf)
2568 {
2569 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2570 	struct mt792x_phy *phy = mvif->phy;
2571 	struct bss_ifs_time_tlv *ifs_time;
2572 	struct tlv *tlv;
2573 
2574 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_IFS_TIME, sizeof(*ifs_time));
2575 	ifs_time = (struct bss_ifs_time_tlv *)tlv;
2576 	ifs_time->slot_valid = true;
2577 	ifs_time->slot_time = cpu_to_le16(phy->slottime);
2578 }
2579 
2580 int mt7925_mcu_set_timing(struct mt792x_phy *phy,
2581 			  struct ieee80211_bss_conf *link_conf)
2582 {
2583 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2584 	struct mt792x_dev *dev = phy->dev;
2585 	struct sk_buff *skb;
2586 
2587 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2588 					 MT7925_BSS_UPDATE_MAX_SIZE);
2589 	if (IS_ERR(skb))
2590 		return PTR_ERR(skb);
2591 
2592 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2593 
2594 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2595 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2596 }
2597 
2598 int mt7925_mcu_add_bss_info(struct mt792x_phy *phy,
2599 			    struct ieee80211_chanctx_conf *ctx,
2600 			    struct ieee80211_bss_conf *link_conf,
2601 			    struct ieee80211_link_sta *link_sta,
2602 			    int enable)
2603 {
2604 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2605 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2606 	struct mt792x_dev *dev = phy->dev;
2607 	struct mt792x_link_sta *mlink_bc;
2608 	struct sk_buff *skb;
2609 
2610 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2611 					 MT7925_BSS_UPDATE_MAX_SIZE);
2612 	if (IS_ERR(skb))
2613 		return PTR_ERR(skb);
2614 
2615 	mlink_bc = mt792x_sta_to_link(&mvif->sta, mconf->link_id);
2616 
2617 	/* bss_basic must be first */
2618 	mt7925_mcu_bss_basic_tlv(skb, link_conf, link_sta, ctx, phy->mt76,
2619 				 mlink_bc->wcid.idx, enable);
2620 	mt7925_mcu_bss_sec_tlv(skb, link_conf);
2621 	mt7925_mcu_bss_bmc_tlv(skb, phy, ctx, link_conf);
2622 	mt7925_mcu_bss_qos_tlv(skb, link_conf);
2623 	mt7925_mcu_bss_mld_tlv(skb, link_conf);
2624 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2625 
2626 	if (link_conf->he_support) {
2627 		mt7925_mcu_bss_he_tlv(skb, link_conf, phy);
2628 		mt7925_mcu_bss_color_tlv(skb, link_conf, enable);
2629 	}
2630 
2631 	if (enable)
2632 		mt7925_mcu_bss_rlm_tlv(skb, phy->mt76, link_conf, ctx);
2633 
2634 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2635 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2636 }
2637 
2638 int mt7925_mcu_set_dbdc(struct mt76_phy *phy)
2639 {
2640 	struct mt76_dev *mdev = phy->dev;
2641 
2642 	struct mbmc_conf_tlv *conf;
2643 	struct mbmc_set_req *hdr;
2644 	struct sk_buff *skb;
2645 	struct tlv *tlv;
2646 	int max_len, err;
2647 
2648 	max_len = sizeof(*hdr) + sizeof(*conf);
2649 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2650 	if (!skb)
2651 		return -ENOMEM;
2652 
2653 	hdr = (struct mbmc_set_req *)skb_put(skb, sizeof(*hdr));
2654 
2655 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_MBMC_SETTING, sizeof(*conf));
2656 	conf = (struct mbmc_conf_tlv *)tlv;
2657 
2658 	conf->mbmc_en = 1;
2659 	conf->band = 0; /* unused */
2660 
2661 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SET_DBDC_PARMS),
2662 				    false);
2663 
2664 	return err;
2665 }
2666 
2667 #define MT76_CONNAC_SCAN_CHANNEL_TIME		60
2668 
2669 int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
2670 		       struct ieee80211_scan_request *scan_req)
2671 {
2672 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2673 	struct cfg80211_scan_request *sreq = &scan_req->req;
2674 	int n_ssids = 0, err, i, duration;
2675 	struct ieee80211_channel **scan_list = sreq->channels;
2676 	struct mt76_dev *mdev = phy->dev;
2677 	struct mt76_connac_mcu_scan_channel *chan;
2678 	struct sk_buff *skb;
2679 
2680 	struct scan_hdr_tlv *hdr;
2681 	struct scan_req_tlv *req;
2682 	struct scan_ssid_tlv *ssid;
2683 	struct scan_bssid_tlv *bssid;
2684 	struct scan_chan_info_tlv *chan_info;
2685 	struct scan_ie_tlv *ie;
2686 	struct scan_misc_tlv *misc;
2687 	struct tlv *tlv;
2688 	int max_len;
2689 
2690 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2691 				sizeof(*bssid) + sizeof(*chan_info) +
2692 				sizeof(*misc) + sizeof(*ie);
2693 
2694 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2695 	if (!skb)
2696 		return -ENOMEM;
2697 
2698 	set_bit(MT76_HW_SCANNING, &phy->state);
2699 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2700 
2701 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2702 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2703 	hdr->bss_idx = mvif->idx;
2704 
2705 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_REQ, sizeof(*req));
2706 	req = (struct scan_req_tlv *)tlv;
2707 	req->scan_type = sreq->n_ssids ? 1 : 0;
2708 	req->probe_req_num = sreq->n_ssids ? 2 : 0;
2709 
2710 	duration = MT76_CONNAC_SCAN_CHANNEL_TIME;
2711 	/* increase channel time for passive scan */
2712 	if (!sreq->n_ssids)
2713 		duration *= 2;
2714 	req->timeout_value = cpu_to_le16(sreq->n_channels * duration);
2715 	req->channel_min_dwell_time = cpu_to_le16(duration);
2716 	req->channel_dwell_time = cpu_to_le16(duration);
2717 
2718 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2719 	ssid = (struct scan_ssid_tlv *)tlv;
2720 	for (i = 0; i < sreq->n_ssids; i++) {
2721 		if (!sreq->ssids[i].ssid_len)
2722 			continue;
2723 
2724 		ssid->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
2725 		memcpy(ssid->ssids[i].ssid, sreq->ssids[i].ssid,
2726 		       sreq->ssids[i].ssid_len);
2727 		n_ssids++;
2728 	}
2729 	ssid->ssid_type = n_ssids ? BIT(2) : BIT(0);
2730 	ssid->ssids_num = n_ssids;
2731 
2732 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_BSSID, sizeof(*bssid));
2733 	bssid = (struct scan_bssid_tlv *)tlv;
2734 
2735 	memcpy(bssid->bssid, sreq->bssid, ETH_ALEN);
2736 
2737 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
2738 	chan_info = (struct scan_chan_info_tlv *)tlv;
2739 	chan_info->channels_num = min_t(u8, sreq->n_channels,
2740 					ARRAY_SIZE(chan_info->channels));
2741 	for (i = 0; i < chan_info->channels_num; i++) {
2742 		chan = &chan_info->channels[i];
2743 
2744 		switch (scan_list[i]->band) {
2745 		case NL80211_BAND_2GHZ:
2746 			chan->band = 1;
2747 			break;
2748 		case NL80211_BAND_6GHZ:
2749 			chan->band = 3;
2750 			break;
2751 		default:
2752 			chan->band = 2;
2753 			break;
2754 		}
2755 		chan->channel_num = scan_list[i]->hw_value;
2756 	}
2757 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
2758 
2759 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
2760 	ie = (struct scan_ie_tlv *)tlv;
2761 	if (sreq->ie_len > 0) {
2762 		memcpy(ie->ies, sreq->ie, sreq->ie_len);
2763 		ie->ies_len = cpu_to_le16(sreq->ie_len);
2764 	}
2765 
2766 	req->scan_func |= SCAN_FUNC_SPLIT_SCAN;
2767 
2768 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_MISC, sizeof(*misc));
2769 	misc = (struct scan_misc_tlv *)tlv;
2770 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
2771 		get_random_mask_addr(misc->random_mac, sreq->mac_addr,
2772 				     sreq->mac_addr_mask);
2773 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
2774 	}
2775 
2776 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2777 				    false);
2778 	if (err < 0)
2779 		clear_bit(MT76_HW_SCANNING, &phy->state);
2780 
2781 	return err;
2782 }
2783 EXPORT_SYMBOL_GPL(mt7925_mcu_hw_scan);
2784 
2785 int mt7925_mcu_sched_scan_req(struct mt76_phy *phy,
2786 			      struct ieee80211_vif *vif,
2787 			      struct cfg80211_sched_scan_request *sreq)
2788 {
2789 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2790 	struct ieee80211_channel **scan_list = sreq->channels;
2791 	struct mt76_connac_mcu_scan_channel *chan;
2792 	struct mt76_dev *mdev = phy->dev;
2793 	struct cfg80211_match_set *cfg_match;
2794 	struct cfg80211_ssid *cfg_ssid;
2795 
2796 	struct scan_hdr_tlv *hdr;
2797 	struct scan_sched_req *req;
2798 	struct scan_ssid_tlv *ssid;
2799 	struct scan_chan_info_tlv *chan_info;
2800 	struct scan_ie_tlv *ie;
2801 	struct scan_sched_ssid_match_sets *match;
2802 	struct sk_buff *skb;
2803 	struct tlv *tlv;
2804 	int i, max_len;
2805 
2806 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2807 		  sizeof(*chan_info) + sizeof(*ie) +
2808 		  sizeof(*match);
2809 
2810 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2811 	if (!skb)
2812 		return -ENOMEM;
2813 
2814 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2815 
2816 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2817 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2818 	hdr->bss_idx = mvif->idx;
2819 
2820 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_REQ, sizeof(*req));
2821 	req = (struct scan_sched_req *)tlv;
2822 	req->version = 1;
2823 
2824 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
2825 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
2826 
2827 	req->intervals_num = sreq->n_scan_plans;
2828 	for (i = 0; i < req->intervals_num; i++)
2829 		req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
2830 
2831 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2832 	ssid = (struct scan_ssid_tlv *)tlv;
2833 
2834 	ssid->ssids_num = sreq->n_ssids;
2835 	ssid->ssid_type = BIT(2);
2836 	for (i = 0; i < ssid->ssids_num; i++) {
2837 		cfg_ssid = &sreq->ssids[i];
2838 		memcpy(ssid->ssids[i].ssid, cfg_ssid->ssid, cfg_ssid->ssid_len);
2839 		ssid->ssids[i].ssid_len = cpu_to_le32(cfg_ssid->ssid_len);
2840 	}
2841 
2842 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID_MATCH_SETS, sizeof(*match));
2843 	match = (struct scan_sched_ssid_match_sets *)tlv;
2844 	match->match_num = sreq->n_match_sets;
2845 	for (i = 0; i < match->match_num; i++) {
2846 		cfg_match = &sreq->match_sets[i];
2847 		memcpy(match->match[i].ssid, cfg_match->ssid.ssid,
2848 		       cfg_match->ssid.ssid_len);
2849 		match->match[i].rssi_th = cpu_to_le32(cfg_match->rssi_thold);
2850 		match->match[i].ssid_len = cfg_match->ssid.ssid_len;
2851 	}
2852 
2853 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
2854 	chan_info = (struct scan_chan_info_tlv *)tlv;
2855 	chan_info->channels_num = min_t(u8, sreq->n_channels,
2856 					ARRAY_SIZE(chan_info->channels));
2857 	for (i = 0; i < chan_info->channels_num; i++) {
2858 		chan = &chan_info->channels[i];
2859 
2860 		switch (scan_list[i]->band) {
2861 		case NL80211_BAND_2GHZ:
2862 			chan->band = 1;
2863 			break;
2864 		case NL80211_BAND_6GHZ:
2865 			chan->band = 3;
2866 			break;
2867 		default:
2868 			chan->band = 2;
2869 			break;
2870 		}
2871 		chan->channel_num = scan_list[i]->hw_value;
2872 	}
2873 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
2874 
2875 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
2876 	ie = (struct scan_ie_tlv *)tlv;
2877 	if (sreq->ie_len > 0) {
2878 		memcpy(ie->ies, sreq->ie, sreq->ie_len);
2879 		ie->ies_len = cpu_to_le16(sreq->ie_len);
2880 	}
2881 
2882 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2883 				     false);
2884 }
2885 EXPORT_SYMBOL_GPL(mt7925_mcu_sched_scan_req);
2886 
2887 int
2888 mt7925_mcu_sched_scan_enable(struct mt76_phy *phy,
2889 			     struct ieee80211_vif *vif,
2890 			     bool enable)
2891 {
2892 	struct mt76_dev *mdev = phy->dev;
2893 	struct scan_sched_enable *req;
2894 	struct scan_hdr_tlv *hdr;
2895 	struct sk_buff *skb;
2896 	struct tlv *tlv;
2897 	int max_len;
2898 
2899 	max_len = sizeof(*hdr) + sizeof(*req);
2900 
2901 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2902 	if (!skb)
2903 		return -ENOMEM;
2904 
2905 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2906 	hdr->seq_num = 0;
2907 	hdr->bss_idx = 0;
2908 
2909 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_ENABLE, sizeof(*req));
2910 	req = (struct scan_sched_enable *)tlv;
2911 	req->active = !enable;
2912 
2913 	if (enable)
2914 		set_bit(MT76_HW_SCHED_SCANNING, &phy->state);
2915 	else
2916 		clear_bit(MT76_HW_SCHED_SCANNING, &phy->state);
2917 
2918 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2919 				     false);
2920 }
2921 
2922 int mt7925_mcu_cancel_hw_scan(struct mt76_phy *phy,
2923 			      struct ieee80211_vif *vif)
2924 {
2925 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2926 	struct {
2927 		struct scan_hdr {
2928 			u8 seq_num;
2929 			u8 bss_idx;
2930 			u8 pad[2];
2931 		} __packed hdr;
2932 		struct scan_cancel_tlv {
2933 			__le16 tag;
2934 			__le16 len;
2935 			u8 is_ext_channel;
2936 			u8 rsv[3];
2937 		} __packed cancel;
2938 	} req = {
2939 		.hdr = {
2940 			.seq_num = mvif->scan_seq_num,
2941 			.bss_idx = mvif->idx,
2942 		},
2943 		.cancel = {
2944 			.tag = cpu_to_le16(UNI_SCAN_CANCEL),
2945 			.len = cpu_to_le16(sizeof(struct scan_cancel_tlv)),
2946 		},
2947 	};
2948 
2949 	if (test_and_clear_bit(MT76_HW_SCANNING, &phy->state)) {
2950 		struct cfg80211_scan_info info = {
2951 			.aborted = true,
2952 		};
2953 
2954 		ieee80211_scan_completed(phy->hw, &info);
2955 	}
2956 
2957 	return mt76_mcu_send_msg(phy->dev, MCU_UNI_CMD(SCAN_REQ),
2958 				 &req, sizeof(req), false);
2959 }
2960 EXPORT_SYMBOL_GPL(mt7925_mcu_cancel_hw_scan);
2961 
2962 int mt7925_mcu_set_channel_domain(struct mt76_phy *phy)
2963 {
2964 	int len, i, n_max_channels, n_2ch = 0, n_5ch = 0, n_6ch = 0;
2965 	struct {
2966 		struct {
2967 			u8 alpha2[4]; /* regulatory_request.alpha2 */
2968 			u8 bw_2g; /* BW_20_40M		0
2969 				   * BW_20M		1
2970 				   * BW_20_40_80M	2
2971 				   * BW_20_40_80_160M	3
2972 				   * BW_20_40_80_8080M	4
2973 				   */
2974 			u8 bw_5g;
2975 			u8 bw_6g;
2976 			u8 pad;
2977 		} __packed hdr;
2978 		struct n_chan {
2979 			__le16 tag;
2980 			__le16 len;
2981 			u8 n_2ch;
2982 			u8 n_5ch;
2983 			u8 n_6ch;
2984 			u8 pad;
2985 		} __packed n_ch;
2986 	} req = {
2987 		.hdr = {
2988 			.bw_2g = 0,
2989 			.bw_5g = 3, /* BW_20_40_80_160M */
2990 			.bw_6g = 3,
2991 		},
2992 		.n_ch = {
2993 			.tag = cpu_to_le16(2),
2994 		},
2995 	};
2996 	struct mt76_connac_mcu_chan {
2997 		__le16 hw_value;
2998 		__le16 pad;
2999 		__le32 flags;
3000 	} __packed channel;
3001 	struct mt76_dev *dev = phy->dev;
3002 	struct ieee80211_channel *chan;
3003 	struct sk_buff *skb;
3004 
3005 	n_max_channels = phy->sband_2g.sband.n_channels +
3006 			 phy->sband_5g.sband.n_channels +
3007 			 phy->sband_6g.sband.n_channels;
3008 	len = sizeof(req) + n_max_channels * sizeof(channel);
3009 
3010 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
3011 	if (!skb)
3012 		return -ENOMEM;
3013 
3014 	skb_reserve(skb, sizeof(req));
3015 
3016 	for (i = 0; i < phy->sband_2g.sband.n_channels; i++) {
3017 		chan = &phy->sband_2g.sband.channels[i];
3018 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3019 			continue;
3020 
3021 		channel.hw_value = cpu_to_le16(chan->hw_value);
3022 		channel.flags = cpu_to_le32(chan->flags);
3023 		channel.pad = 0;
3024 
3025 		skb_put_data(skb, &channel, sizeof(channel));
3026 		n_2ch++;
3027 	}
3028 	for (i = 0; i < phy->sband_5g.sband.n_channels; i++) {
3029 		chan = &phy->sband_5g.sband.channels[i];
3030 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3031 			continue;
3032 
3033 		channel.hw_value = cpu_to_le16(chan->hw_value);
3034 		channel.flags = cpu_to_le32(chan->flags);
3035 		channel.pad = 0;
3036 
3037 		skb_put_data(skb, &channel, sizeof(channel));
3038 		n_5ch++;
3039 	}
3040 	for (i = 0; i < phy->sband_6g.sband.n_channels; i++) {
3041 		chan = &phy->sband_6g.sband.channels[i];
3042 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3043 			continue;
3044 
3045 		channel.hw_value = cpu_to_le16(chan->hw_value);
3046 		channel.flags = cpu_to_le32(chan->flags);
3047 		channel.pad = 0;
3048 
3049 		skb_put_data(skb, &channel, sizeof(channel));
3050 		n_6ch++;
3051 	}
3052 
3053 	BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(req.hdr.alpha2));
3054 	memcpy(req.hdr.alpha2, dev->alpha2, sizeof(dev->alpha2));
3055 	req.n_ch.n_2ch = n_2ch;
3056 	req.n_ch.n_5ch = n_5ch;
3057 	req.n_ch.n_6ch = n_6ch;
3058 	len = sizeof(struct n_chan) + (n_2ch + n_5ch + n_6ch) * sizeof(channel);
3059 	req.n_ch.len = cpu_to_le16(len);
3060 	memcpy(__skb_push(skb, sizeof(req)), &req, sizeof(req));
3061 
3062 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SET_DOMAIN_INFO),
3063 				     false);
3064 }
3065 EXPORT_SYMBOL_GPL(mt7925_mcu_set_channel_domain);
3066 
3067 static int
3068 __mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3069 		     enum environment_cap env_cap,
3070 		     struct mt7925_clc *clc, u8 idx)
3071 {
3072 	struct mt7925_clc_segment *seg;
3073 	struct sk_buff *skb;
3074 	struct {
3075 		u8 rsv[4];
3076 		__le16 tag;
3077 		__le16 len;
3078 
3079 		u8 ver;
3080 		u8 pad0;
3081 		__le16 size;
3082 		u8 idx;
3083 		u8 env;
3084 		u8 acpi_conf;
3085 		u8 pad1;
3086 		u8 alpha2[2];
3087 		u8 type[2];
3088 		u8 rsvd[64];
3089 	} __packed req = {
3090 		.tag = cpu_to_le16(0x3),
3091 		.len = cpu_to_le16(sizeof(req) - 4),
3092 
3093 		.idx = idx,
3094 		.env = env_cap,
3095 		.acpi_conf = mt792x_acpi_get_flags(&dev->phy),
3096 	};
3097 	int ret, valid_cnt = 0;
3098 	u8 i, *pos;
3099 
3100 	if (!clc)
3101 		return 0;
3102 
3103 	pos = clc->data + sizeof(*seg) * clc->nr_seg;
3104 	for (i = 0; i < clc->nr_country; i++) {
3105 		struct mt7925_clc_rule *rule = (struct mt7925_clc_rule *)pos;
3106 
3107 		pos += sizeof(*rule);
3108 		if (rule->alpha2[0] != alpha2[0] ||
3109 		    rule->alpha2[1] != alpha2[1])
3110 			continue;
3111 
3112 		seg = (struct mt7925_clc_segment *)clc->data
3113 			  + rule->seg_idx - 1;
3114 
3115 		memcpy(req.alpha2, rule->alpha2, 2);
3116 		memcpy(req.type, rule->type, 2);
3117 
3118 		req.size = cpu_to_le16(seg->len);
3119 		skb = __mt76_mcu_msg_alloc(&dev->mt76, &req,
3120 					   le16_to_cpu(req.size) + sizeof(req),
3121 					   sizeof(req), GFP_KERNEL);
3122 		if (!skb)
3123 			return -ENOMEM;
3124 		skb_put_data(skb, clc->data + seg->offset, seg->len);
3125 
3126 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3127 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3128 					    true);
3129 		if (ret < 0)
3130 			return ret;
3131 		valid_cnt++;
3132 	}
3133 
3134 	if (!valid_cnt)
3135 		return -ENOENT;
3136 
3137 	return 0;
3138 }
3139 
3140 int mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3141 		       enum environment_cap env_cap)
3142 {
3143 	struct mt792x_phy *phy = (struct mt792x_phy *)&dev->phy;
3144 	int i, ret;
3145 
3146 	/* submit all clc config */
3147 	for (i = 0; i < ARRAY_SIZE(phy->clc); i++) {
3148 		ret = __mt7925_mcu_set_clc(dev, alpha2, env_cap,
3149 					   phy->clc[i], i);
3150 
3151 		/* If no country found, set "00" as default */
3152 		if (ret == -ENOENT)
3153 			ret = __mt7925_mcu_set_clc(dev, "00",
3154 						   ENVIRON_INDOOR,
3155 						   phy->clc[i], i);
3156 		if (ret < 0)
3157 			return ret;
3158 	}
3159 	return 0;
3160 }
3161 
3162 int mt7925_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb,
3163 			    int cmd, int *wait_seq)
3164 {
3165 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
3166 	struct mt76_connac2_mcu_uni_txd *uni_txd;
3167 	struct mt76_connac2_mcu_txd *mcu_txd;
3168 	__le32 *txd;
3169 	u32 val;
3170 	u8 seq;
3171 
3172 	/* TODO: make dynamic based on msg type */
3173 	mdev->mcu.timeout = 20 * HZ;
3174 
3175 	seq = ++mdev->mcu.msg_seq & 0xf;
3176 	if (!seq)
3177 		seq = ++mdev->mcu.msg_seq & 0xf;
3178 
3179 	if (cmd == MCU_CMD(FW_SCATTER))
3180 		goto exit;
3181 
3182 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
3183 	txd = (__le32 *)skb_push(skb, txd_len);
3184 
3185 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
3186 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
3187 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
3188 	txd[0] = cpu_to_le32(val);
3189 
3190 	val = FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
3191 	txd[1] = cpu_to_le32(val);
3192 
3193 	if (cmd & __MCU_CMD_FIELD_UNI) {
3194 		uni_txd = (struct mt76_connac2_mcu_uni_txd *)txd;
3195 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
3196 		uni_txd->cid = cpu_to_le16(mcu_cmd);
3197 		uni_txd->s2d_index = MCU_S2D_H2N;
3198 		uni_txd->pkt_type = MCU_PKT_ID;
3199 		uni_txd->seq = seq;
3200 
3201 		if (cmd & __MCU_CMD_FIELD_QUERY)
3202 			uni_txd->option = MCU_CMD_UNI_QUERY_ACK;
3203 		else
3204 			uni_txd->option = MCU_CMD_UNI_EXT_ACK;
3205 
3206 		goto exit;
3207 	}
3208 
3209 	mcu_txd = (struct mt76_connac2_mcu_txd *)txd;
3210 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
3211 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
3212 					       MT_TX_MCU_PORT_RX_Q0));
3213 	mcu_txd->pkt_type = MCU_PKT_ID;
3214 	mcu_txd->seq = seq;
3215 	mcu_txd->cid = mcu_cmd;
3216 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
3217 
3218 	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
3219 		if (cmd & __MCU_CMD_FIELD_QUERY)
3220 			mcu_txd->set_query = MCU_Q_QUERY;
3221 		else
3222 			mcu_txd->set_query = MCU_Q_SET;
3223 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
3224 	} else {
3225 		mcu_txd->set_query = MCU_Q_NA;
3226 	}
3227 
3228 	if (cmd & __MCU_CMD_FIELD_WA)
3229 		mcu_txd->s2d_index = MCU_S2D_H2C;
3230 	else
3231 		mcu_txd->s2d_index = MCU_S2D_H2N;
3232 
3233 exit:
3234 	if (wait_seq)
3235 		*wait_seq = seq;
3236 
3237 	return 0;
3238 }
3239 EXPORT_SYMBOL_GPL(mt7925_mcu_fill_message);
3240 
3241 int mt7925_mcu_set_rts_thresh(struct mt792x_phy *phy, u32 val)
3242 {
3243 	struct {
3244 		u8 band_idx;
3245 		u8 _rsv[3];
3246 
3247 		__le16 tag;
3248 		__le16 len;
3249 		__le32 len_thresh;
3250 		__le32 pkt_thresh;
3251 	} __packed req = {
3252 		.band_idx = phy->mt76->band_idx,
3253 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RTS_THRESHOLD),
3254 		.len = cpu_to_le16(sizeof(req) - 4),
3255 		.len_thresh = cpu_to_le32(val),
3256 		.pkt_thresh = cpu_to_le32(0x2),
3257 	};
3258 
3259 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3260 				 &req, sizeof(req), true);
3261 }
3262 
3263 int mt7925_mcu_set_radio_en(struct mt792x_phy *phy, bool enable)
3264 {
3265 	struct {
3266 		u8 band_idx;
3267 		u8 _rsv[3];
3268 
3269 		__le16 tag;
3270 		__le16 len;
3271 		u8 enable;
3272 		u8 _rsv2[3];
3273 	} __packed req = {
3274 		.band_idx = phy->mt76->band_idx,
3275 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RADIO_ENABLE),
3276 		.len = cpu_to_le16(sizeof(req) - 4),
3277 		.enable = enable,
3278 	};
3279 
3280 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3281 				 &req, sizeof(req), true);
3282 }
3283 
3284 static void
3285 mt7925_mcu_build_sku(struct mt76_dev *dev, s8 *sku,
3286 		     struct mt76_power_limits *limits,
3287 		     enum nl80211_band band)
3288 {
3289 	int i, offset = sizeof(limits->cck);
3290 
3291 	memset(sku, 127, MT_CONNAC3_SKU_POWER_LIMIT);
3292 
3293 	if (band == NL80211_BAND_2GHZ) {
3294 		/* cck */
3295 		memcpy(sku, limits->cck, sizeof(limits->cck));
3296 	}
3297 
3298 	/* ofdm */
3299 	memcpy(&sku[offset], limits->ofdm, sizeof(limits->ofdm));
3300 	offset += (sizeof(limits->ofdm) * 5);
3301 
3302 	/* ht */
3303 	for (i = 0; i < 2; i++) {
3304 		memcpy(&sku[offset], limits->mcs[i], 8);
3305 		offset += 8;
3306 	}
3307 	sku[offset++] = limits->mcs[0][0];
3308 
3309 	/* vht */
3310 	for (i = 0; i < ARRAY_SIZE(limits->mcs); i++) {
3311 		memcpy(&sku[offset], limits->mcs[i],
3312 		       ARRAY_SIZE(limits->mcs[i]));
3313 		offset += 12;
3314 	}
3315 
3316 	/* he */
3317 	for (i = 0; i < ARRAY_SIZE(limits->ru); i++) {
3318 		memcpy(&sku[offset], limits->ru[i], ARRAY_SIZE(limits->ru[i]));
3319 		offset += ARRAY_SIZE(limits->ru[i]);
3320 	}
3321 
3322 	/* eht */
3323 	for (i = 0; i < ARRAY_SIZE(limits->eht); i++) {
3324 		memcpy(&sku[offset], limits->eht[i], ARRAY_SIZE(limits->eht[i]));
3325 		offset += ARRAY_SIZE(limits->eht[i]);
3326 	}
3327 }
3328 
3329 static int
3330 mt7925_mcu_rate_txpower_band(struct mt76_phy *phy,
3331 			     enum nl80211_band band)
3332 {
3333 	int tx_power, n_chan, last_ch, err = 0, idx = 0;
3334 	int i, sku_len, batch_size, batch_len = 3;
3335 	struct mt76_dev *dev = phy->dev;
3336 	static const u8 chan_list_2ghz[] = {
3337 		1, 2,  3,  4,  5,  6,  7,
3338 		8, 9, 10, 11, 12, 13, 14
3339 	};
3340 	static const u8 chan_list_5ghz[] = {
3341 		 36,  38,  40,  42,  44,  46,  48,
3342 		 50,  52,  54,  56,  58,  60,  62,
3343 		 64, 100, 102, 104, 106, 108, 110,
3344 		112, 114, 116, 118, 120, 122, 124,
3345 		126, 128, 132, 134, 136, 138, 140,
3346 		142, 144, 149, 151, 153, 155, 157,
3347 		159, 161, 165, 167
3348 	};
3349 	static const u8 chan_list_6ghz[] = {
3350 		  1,   3,   5,   7,   9,  11,  13,
3351 		 15,  17,  19,  21,  23,  25,  27,
3352 		 29,  33,  35,  37,  39,  41,  43,
3353 		 45,  47,  49,  51,  53,  55,  57,
3354 		 59,  61,  65,  67,  69,  71,  73,
3355 		 75,  77,  79,  81,  83,  85,  87,
3356 		 89,  91,  93,  97,  99, 101, 103,
3357 		105, 107, 109, 111, 113, 115, 117,
3358 		119, 121, 123, 125, 129, 131, 133,
3359 		135, 137, 139, 141, 143, 145, 147,
3360 		149, 151, 153, 155, 157, 161, 163,
3361 		165, 167, 169, 171, 173, 175, 177,
3362 		179, 181, 183, 185, 187, 189, 193,
3363 		195, 197, 199, 201, 203, 205, 207,
3364 		209, 211, 213, 215, 217, 219, 221,
3365 		225, 227, 229, 233
3366 	};
3367 	struct mt76_power_limits *limits;
3368 	struct mt7925_sku_tlv *sku_tlbv;
3369 	const u8 *ch_list;
3370 
3371 	sku_len = sizeof(*sku_tlbv);
3372 	tx_power = 2 * phy->hw->conf.power_level;
3373 	if (!tx_power)
3374 		tx_power = 127;
3375 
3376 	if (band == NL80211_BAND_2GHZ) {
3377 		n_chan = ARRAY_SIZE(chan_list_2ghz);
3378 		ch_list = chan_list_2ghz;
3379 		last_ch = chan_list_2ghz[ARRAY_SIZE(chan_list_2ghz) - 1];
3380 	} else if (band == NL80211_BAND_6GHZ) {
3381 		n_chan = ARRAY_SIZE(chan_list_6ghz);
3382 		ch_list = chan_list_6ghz;
3383 		last_ch = chan_list_6ghz[ARRAY_SIZE(chan_list_6ghz) - 1];
3384 	} else {
3385 		n_chan = ARRAY_SIZE(chan_list_5ghz);
3386 		ch_list = chan_list_5ghz;
3387 		last_ch = chan_list_5ghz[ARRAY_SIZE(chan_list_5ghz) - 1];
3388 	}
3389 	batch_size = DIV_ROUND_UP(n_chan, batch_len);
3390 
3391 	limits = devm_kmalloc(dev->dev, sizeof(*limits), GFP_KERNEL);
3392 	if (!limits)
3393 		return -ENOMEM;
3394 
3395 	sku_tlbv = devm_kmalloc(dev->dev, sku_len, GFP_KERNEL);
3396 	if (!sku_tlbv) {
3397 		devm_kfree(dev->dev, limits);
3398 		return -ENOMEM;
3399 	}
3400 
3401 	for (i = 0; i < batch_size; i++) {
3402 		struct mt7925_tx_power_limit_tlv *tx_power_tlv;
3403 		int j, msg_len, num_ch;
3404 		struct sk_buff *skb;
3405 
3406 		num_ch = i == batch_size - 1 ? n_chan % batch_len : batch_len;
3407 		msg_len = sizeof(*tx_power_tlv) + num_ch * sku_len;
3408 		skb = mt76_mcu_msg_alloc(dev, NULL, msg_len);
3409 		if (!skb) {
3410 			err = -ENOMEM;
3411 			goto out;
3412 		}
3413 
3414 		tx_power_tlv = (struct mt7925_tx_power_limit_tlv *)
3415 			       skb_put(skb, sizeof(*tx_power_tlv));
3416 
3417 		BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(tx_power_tlv->alpha2));
3418 		memcpy(tx_power_tlv->alpha2, dev->alpha2, sizeof(dev->alpha2));
3419 		tx_power_tlv->n_chan = num_ch;
3420 		tx_power_tlv->tag = cpu_to_le16(0x1);
3421 		tx_power_tlv->len = cpu_to_le16(sizeof(*tx_power_tlv));
3422 
3423 		switch (band) {
3424 		case NL80211_BAND_2GHZ:
3425 			tx_power_tlv->band = 1;
3426 			break;
3427 		case NL80211_BAND_6GHZ:
3428 			tx_power_tlv->band = 3;
3429 			break;
3430 		default:
3431 			tx_power_tlv->band = 2;
3432 			break;
3433 		}
3434 
3435 		for (j = 0; j < num_ch; j++, idx++) {
3436 			struct ieee80211_channel chan = {
3437 				.hw_value = ch_list[idx],
3438 				.band = band,
3439 			};
3440 			s8 reg_power, sar_power;
3441 
3442 			reg_power = mt76_connac_get_ch_power(phy, &chan,
3443 							     tx_power);
3444 			sar_power = mt76_get_sar_power(phy, &chan, reg_power);
3445 
3446 			mt76_get_rate_power_limits(phy, &chan, limits,
3447 						   sar_power);
3448 
3449 			tx_power_tlv->last_msg = ch_list[idx] == last_ch;
3450 			sku_tlbv->channel = ch_list[idx];
3451 
3452 			mt7925_mcu_build_sku(dev, sku_tlbv->pwr_limit,
3453 					     limits, band);
3454 			skb_put_data(skb, sku_tlbv, sku_len);
3455 		}
3456 		err = mt76_mcu_skb_send_msg(dev, skb,
3457 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3458 					    true);
3459 		if (err < 0)
3460 			goto out;
3461 	}
3462 
3463 out:
3464 	devm_kfree(dev->dev, sku_tlbv);
3465 	devm_kfree(dev->dev, limits);
3466 	return err;
3467 }
3468 
3469 int mt7925_mcu_set_rate_txpower(struct mt76_phy *phy)
3470 {
3471 	int err;
3472 
3473 	if (phy->cap.has_2ghz) {
3474 		err = mt7925_mcu_rate_txpower_band(phy,
3475 						   NL80211_BAND_2GHZ);
3476 		if (err < 0)
3477 			return err;
3478 	}
3479 
3480 	if (phy->cap.has_5ghz) {
3481 		err = mt7925_mcu_rate_txpower_band(phy,
3482 						   NL80211_BAND_5GHZ);
3483 		if (err < 0)
3484 			return err;
3485 	}
3486 
3487 	if (phy->cap.has_6ghz) {
3488 		err = mt7925_mcu_rate_txpower_band(phy,
3489 						   NL80211_BAND_6GHZ);
3490 		if (err < 0)
3491 			return err;
3492 	}
3493 
3494 	return 0;
3495 }
3496 
3497 int mt7925_mcu_set_rxfilter(struct mt792x_dev *dev, u32 fif,
3498 			    u8 bit_op, u32 bit_map)
3499 {
3500 	struct mt792x_phy *phy = &dev->phy;
3501 	struct {
3502 		u8 band_idx;
3503 		u8 rsv1[3];
3504 
3505 		__le16 tag;
3506 		__le16 len;
3507 		u8 mode;
3508 		u8 rsv2[3];
3509 		__le32 fif;
3510 		__le32 bit_map; /* bit_* for bitmap update */
3511 		u8 bit_op;
3512 		u8 pad[51];
3513 	} __packed req = {
3514 		.band_idx = phy->mt76->band_idx,
3515 		.tag = cpu_to_le16(UNI_BAND_CONFIG_SET_MAC80211_RX_FILTER),
3516 		.len = cpu_to_le16(sizeof(req) - 4),
3517 
3518 		.mode = fif ? 0 : 1,
3519 		.fif = cpu_to_le32(fif),
3520 		.bit_map = cpu_to_le32(bit_map),
3521 		.bit_op = bit_op,
3522 	};
3523 
3524 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3525 				 &req, sizeof(req), true);
3526 }
3527