xref: /linux/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c (revision 816161051a039eeb1226fc85e2b38389f508906c)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2023 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include <linux/firmware.h>
6 #include "mt7925.h"
7 #include "mcu.h"
8 #include "mac.h"
9 
10 #define MT_STA_BFER			BIT(0)
11 #define MT_STA_BFEE			BIT(1)
12 
13 static bool mt7925_disable_clc;
14 module_param_named(disable_clc, mt7925_disable_clc, bool, 0644);
15 MODULE_PARM_DESC(disable_clc, "disable CLC support");
16 
17 int mt7925_mcu_parse_response(struct mt76_dev *mdev, int cmd,
18 			      struct sk_buff *skb, int seq)
19 {
20 	int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
21 	struct mt7925_mcu_rxd *rxd;
22 	int ret = 0;
23 
24 	if (!skb) {
25 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n", cmd, seq);
26 		mt792x_reset(mdev);
27 
28 		return -ETIMEDOUT;
29 	}
30 
31 	rxd = (struct mt7925_mcu_rxd *)skb->data;
32 	if (seq != rxd->seq)
33 		return -EAGAIN;
34 
35 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL) ||
36 	    cmd == MCU_CMD(PATCH_FINISH_REQ)) {
37 		skb_pull(skb, sizeof(*rxd) - 4);
38 		ret = *skb->data;
39 	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
40 		   cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
41 		   cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
42 		   cmd == MCU_UNI_CMD(HIF_CTRL) ||
43 		   cmd == MCU_UNI_CMD(OFFLOAD) ||
44 		   cmd == MCU_UNI_CMD(SUSPEND)) {
45 		struct mt7925_mcu_uni_event *event;
46 
47 		skb_pull(skb, sizeof(*rxd));
48 		event = (struct mt7925_mcu_uni_event *)skb->data;
49 		ret = le32_to_cpu(event->status);
50 		/* skip invalid event */
51 		if (mcu_cmd != event->cid)
52 			ret = -EAGAIN;
53 	} else {
54 		skb_pull(skb, sizeof(*rxd));
55 	}
56 
57 	return ret;
58 }
59 EXPORT_SYMBOL_GPL(mt7925_mcu_parse_response);
60 
61 int mt7925_mcu_regval(struct mt792x_dev *dev, u32 regidx, u32 *val, bool set)
62 {
63 #define MT_RF_REG_HDR           GENMASK(31, 24)
64 #define MT_RF_REG_ANT           GENMASK(23, 16)
65 #define RF_REG_PREFIX           0x99
66 	struct {
67 		u8 __rsv[4];
68 		union {
69 			struct uni_cmd_access_reg_basic {
70 				__le16 tag;
71 				__le16 len;
72 				__le32 idx;
73 				__le32 data;
74 			} __packed reg;
75 			struct uni_cmd_access_rf_reg_basic {
76 				__le16 tag;
77 				__le16 len;
78 				__le16 ant;
79 				u8 __rsv[2];
80 				__le32 idx;
81 				__le32 data;
82 			} __packed rf_reg;
83 		};
84 	} __packed * res, req;
85 	struct sk_buff *skb;
86 	int ret;
87 
88 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX) {
89 		req.rf_reg.tag = cpu_to_le16(UNI_CMD_ACCESS_RF_REG_BASIC);
90 		req.rf_reg.len = cpu_to_le16(sizeof(req.rf_reg));
91 		req.rf_reg.ant = cpu_to_le16(u32_get_bits(regidx, MT_RF_REG_ANT));
92 		req.rf_reg.idx = cpu_to_le32(regidx);
93 		req.rf_reg.data = set ? cpu_to_le32(*val) : 0;
94 	} else {
95 		req.reg.tag = cpu_to_le16(UNI_CMD_ACCESS_REG_BASIC);
96 		req.reg.len = cpu_to_le16(sizeof(req.reg));
97 		req.reg.idx = cpu_to_le32(regidx);
98 		req.reg.data = set ? cpu_to_le32(*val) : 0;
99 	}
100 
101 	if (set)
102 		return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(REG_ACCESS),
103 					 &req, sizeof(req), true);
104 
105 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
106 					MCU_WM_UNI_CMD_QUERY(REG_ACCESS),
107 					&req, sizeof(req), true, &skb);
108 	if (ret)
109 		return ret;
110 
111 	res = (void *)skb->data;
112 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX)
113 		*val = le32_to_cpu(res->rf_reg.data);
114 	else
115 		*val = le32_to_cpu(res->reg.data);
116 
117 	dev_kfree_skb(skb);
118 
119 	return 0;
120 }
121 EXPORT_SYMBOL_GPL(mt7925_mcu_regval);
122 
123 int mt7925_mcu_update_arp_filter(struct mt76_dev *dev,
124 				 struct ieee80211_bss_conf *link_conf)
125 {
126 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
127 	struct ieee80211_vif *mvif = link_conf->vif;
128 	struct sk_buff *skb;
129 	int i, len = min_t(int, mvif->cfg.arp_addr_cnt,
130 			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
131 	struct {
132 		struct {
133 			u8 bss_idx;
134 			u8 pad[3];
135 		} __packed hdr;
136 		struct mt7925_arpns_tlv arp;
137 	} req = {
138 		.hdr = {
139 			.bss_idx = mconf->mt76.idx,
140 		},
141 		.arp = {
142 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
143 			.len = cpu_to_le16(sizeof(req) - 4 + len * 2 * sizeof(__be32)),
144 			.ips_num = len,
145 			.enable = true,
146 		},
147 	};
148 
149 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(req) + len * 2 * sizeof(__be32));
150 	if (!skb)
151 		return -ENOMEM;
152 
153 	skb_put_data(skb, &req, sizeof(req));
154 	for (i = 0; i < len; i++) {
155 		skb_put_data(skb, &mvif->cfg.arp_addr_list[i], sizeof(__be32));
156 		skb_put_zero(skb, sizeof(__be32));
157 	}
158 
159 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
160 }
161 
162 #ifdef CONFIG_PM
163 static int
164 mt7925_connac_mcu_set_wow_ctrl(struct mt76_phy *phy, struct ieee80211_vif *vif,
165 			       bool suspend, struct cfg80211_wowlan *wowlan)
166 {
167 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
168 	struct mt76_dev *dev = phy->dev;
169 	struct {
170 		struct {
171 			u8 bss_idx;
172 			u8 pad[3];
173 		} __packed hdr;
174 		struct mt76_connac_wow_ctrl_tlv wow_ctrl_tlv;
175 		struct mt76_connac_wow_gpio_param_tlv gpio_tlv;
176 	} req = {
177 		.hdr = {
178 			.bss_idx = mvif->idx,
179 		},
180 		.wow_ctrl_tlv = {
181 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
182 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_ctrl_tlv)),
183 			.cmd = suspend ? 1 : 2,
184 		},
185 		.gpio_tlv = {
186 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_GPIO_PARAM),
187 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_gpio_param_tlv)),
188 			.gpio_pin = 0xff, /* follow fw about GPIO pin */
189 		},
190 	};
191 
192 	if (wowlan->magic_pkt)
193 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_MAGIC;
194 	if (wowlan->disconnect)
195 		req.wow_ctrl_tlv.trigger |= (UNI_WOW_DETECT_TYPE_DISCONNECT |
196 					     UNI_WOW_DETECT_TYPE_BCN_LOST);
197 	if (wowlan->nd_config) {
198 		mt7925_mcu_sched_scan_req(phy, vif, wowlan->nd_config);
199 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_SCH_SCAN_HIT;
200 		mt7925_mcu_sched_scan_enable(phy, vif, suspend);
201 	}
202 	if (wowlan->n_patterns)
203 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_BITMAP;
204 
205 	if (mt76_is_mmio(dev))
206 		req.wow_ctrl_tlv.wakeup_hif = WOW_PCIE;
207 	else if (mt76_is_usb(dev))
208 		req.wow_ctrl_tlv.wakeup_hif = WOW_USB;
209 	else if (mt76_is_sdio(dev))
210 		req.wow_ctrl_tlv.wakeup_hif = WOW_GPIO;
211 
212 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(SUSPEND), &req,
213 				 sizeof(req), true);
214 }
215 
216 static int
217 mt7925_mcu_set_wow_pattern(struct mt76_dev *dev,
218 			   struct ieee80211_vif *vif,
219 			   u8 index, bool enable,
220 			   struct cfg80211_pkt_pattern *pattern)
221 {
222 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
223 	struct mt7925_wow_pattern_tlv *tlv;
224 	struct sk_buff *skb;
225 	struct {
226 		u8 bss_idx;
227 		u8 pad[3];
228 	} __packed hdr = {
229 		.bss_idx = mvif->idx,
230 	};
231 
232 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(hdr) + sizeof(*tlv));
233 	if (!skb)
234 		return -ENOMEM;
235 
236 	skb_put_data(skb, &hdr, sizeof(hdr));
237 	tlv = (struct mt7925_wow_pattern_tlv *)skb_put(skb, sizeof(*tlv));
238 	tlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
239 	tlv->len = cpu_to_le16(sizeof(*tlv));
240 	tlv->bss_idx = 0xF;
241 	tlv->data_len = pattern->pattern_len;
242 	tlv->enable = enable;
243 	tlv->index = index;
244 	tlv->offset = 0;
245 
246 	memcpy(tlv->pattern, pattern->pattern, pattern->pattern_len);
247 	memcpy(tlv->mask, pattern->mask, DIV_ROUND_UP(pattern->pattern_len, 8));
248 
249 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SUSPEND), true);
250 }
251 
252 void mt7925_mcu_set_suspend_iter(void *priv, u8 *mac,
253 				 struct ieee80211_vif *vif)
254 {
255 	struct mt76_phy *phy = priv;
256 	bool suspend = !test_bit(MT76_STATE_RUNNING, &phy->state);
257 	struct ieee80211_hw *hw = phy->hw;
258 	struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
259 	int i;
260 
261 	mt76_connac_mcu_set_gtk_rekey(phy->dev, vif, suspend);
262 
263 	mt76_connac_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
264 
265 	for (i = 0; i < wowlan->n_patterns; i++)
266 		mt7925_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
267 					   &wowlan->patterns[i]);
268 	mt7925_connac_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
269 }
270 
271 #endif /* CONFIG_PM */
272 
273 static void
274 mt7925_mcu_connection_loss_iter(void *priv, u8 *mac,
275 				struct ieee80211_vif *vif)
276 {
277 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
278 	struct mt7925_uni_beacon_loss_event *event = priv;
279 
280 	if (mvif->idx != event->hdr.bss_idx)
281 		return;
282 
283 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER) ||
284 	    vif->type != NL80211_IFTYPE_STATION)
285 		return;
286 
287 	ieee80211_connection_loss(vif);
288 }
289 
290 static void
291 mt7925_mcu_connection_loss_event(struct mt792x_dev *dev, struct sk_buff *skb)
292 {
293 	struct mt7925_uni_beacon_loss_event *event;
294 	struct mt76_phy *mphy = &dev->mt76.phy;
295 
296 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd));
297 	event = (struct mt7925_uni_beacon_loss_event *)skb->data;
298 
299 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
300 					IEEE80211_IFACE_ITER_RESUME_ALL,
301 					mt7925_mcu_connection_loss_iter, event);
302 }
303 
304 static void
305 mt7925_mcu_roc_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
306 {
307 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
308 	struct mt7925_roc_grant_tlv *grant = priv;
309 
310 	if (ieee80211_vif_is_mld(vif) && vif->type == NL80211_IFTYPE_STATION)
311 		return;
312 
313 	if (mvif->idx != grant->bss_idx)
314 		return;
315 
316 	mvif->band_idx = grant->dbdcband;
317 }
318 
319 static void mt7925_mcu_roc_handle_grant(struct mt792x_dev *dev,
320 					struct tlv *tlv)
321 {
322 	struct ieee80211_hw *hw = dev->mt76.hw;
323 	struct mt7925_roc_grant_tlv *grant;
324 	int duration;
325 
326 	grant = (struct mt7925_roc_grant_tlv *)tlv;
327 
328 	/* should never happen */
329 	WARN_ON_ONCE((le16_to_cpu(grant->tag) != UNI_EVENT_ROC_GRANT));
330 
331 	if (grant->reqtype == MT7925_ROC_REQ_ROC)
332 		ieee80211_ready_on_channel(hw);
333 	else if (grant->reqtype == MT7925_ROC_REQ_JOIN)
334 		ieee80211_iterate_active_interfaces_atomic(hw,
335 						IEEE80211_IFACE_ITER_RESUME_ALL,
336 						mt7925_mcu_roc_iter, grant);
337 	dev->phy.roc_grant = true;
338 	wake_up(&dev->phy.roc_wait);
339 	duration = le32_to_cpu(grant->max_interval);
340 	mod_timer(&dev->phy.roc_timer,
341 		  jiffies + msecs_to_jiffies(duration));
342 }
343 
344 static void
345 mt7925_mcu_uni_roc_event(struct mt792x_dev *dev, struct sk_buff *skb)
346 {
347 	struct tlv *tlv;
348 	int i = 0;
349 
350 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
351 
352 	while (i < skb->len) {
353 		tlv = (struct tlv *)(skb->data + i);
354 
355 		switch (le16_to_cpu(tlv->tag)) {
356 		case UNI_EVENT_ROC_GRANT:
357 			mt7925_mcu_roc_handle_grant(dev, tlv);
358 			break;
359 		case UNI_EVENT_ROC_GRANT_SUB_LINK:
360 			break;
361 		}
362 
363 		i += le16_to_cpu(tlv->len);
364 	}
365 }
366 
367 static void
368 mt7925_mcu_scan_event(struct mt792x_dev *dev, struct sk_buff *skb)
369 {
370 	struct mt76_phy *mphy = &dev->mt76.phy;
371 	struct mt792x_phy *phy = mphy->priv;
372 
373 	spin_lock_bh(&dev->mt76.lock);
374 	__skb_queue_tail(&phy->scan_event_list, skb);
375 	spin_unlock_bh(&dev->mt76.lock);
376 
377 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
378 				     MT792x_HW_SCAN_TIMEOUT);
379 }
380 
381 static void
382 mt7925_mcu_tx_done_event(struct mt792x_dev *dev, struct sk_buff *skb)
383 {
384 #define UNI_EVENT_TX_DONE_MSG 0
385 #define UNI_EVENT_TX_DONE_RAW 1
386 	struct mt7925_mcu_txs_event {
387 		u8 ver;
388 		u8 rsv[3];
389 		u8 data[0];
390 	} __packed * txs;
391 	struct tlv *tlv;
392 	u32 tlv_len;
393 
394 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
395 	tlv = (struct tlv *)skb->data;
396 	tlv_len = skb->len;
397 
398 	while (tlv_len > 0 && le16_to_cpu(tlv->len) <= tlv_len) {
399 		switch (le16_to_cpu(tlv->tag)) {
400 		case UNI_EVENT_TX_DONE_RAW:
401 			txs = (struct mt7925_mcu_txs_event *)tlv->data;
402 			mt7925_mac_add_txs(dev, txs->data);
403 			break;
404 		default:
405 			break;
406 		}
407 		tlv_len -= le16_to_cpu(tlv->len);
408 		tlv = (struct tlv *)((char *)(tlv) + le16_to_cpu(tlv->len));
409 	}
410 }
411 
412 static void
413 mt7925_mcu_uni_debug_msg_event(struct mt792x_dev *dev, struct sk_buff *skb)
414 {
415 	struct mt7925_uni_debug_msg {
416 		__le16 tag;
417 		__le16 len;
418 		u8 fmt;
419 		u8 rsv[3];
420 		u8 id;
421 		u8 type:3;
422 		u8 nr_args:5;
423 		union {
424 			struct idxlog {
425 				__le16 rsv;
426 				__le32 ts;
427 				__le32 idx;
428 				u8 data[];
429 			} __packed idx;
430 			struct txtlog {
431 				u8 len;
432 				u8 rsv;
433 				__le32 ts;
434 				u8 data[];
435 			} __packed txt;
436 		};
437 	} __packed * hdr;
438 
439 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
440 	hdr = (struct mt7925_uni_debug_msg *)skb->data;
441 
442 	if (hdr->id == 0x28) {
443 		skb_pull(skb, offsetof(struct mt7925_uni_debug_msg, id));
444 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", skb->len, skb->data);
445 		return;
446 	} else if (hdr->id != 0xa8) {
447 		return;
448 	}
449 
450 	if (hdr->type == 0) { /* idx log */
451 		int i, ret, len = PAGE_SIZE - 1, nr_val;
452 		struct page *page = dev_alloc_pages(get_order(len));
453 		__le32 *val;
454 		char *buf, *cur;
455 
456 		if (!page)
457 			return;
458 
459 		buf = page_address(page);
460 		cur = buf;
461 
462 		nr_val = (le16_to_cpu(hdr->len) - sizeof(*hdr)) / 4;
463 		val = (__le32 *)hdr->idx.data;
464 		for (i = 0; i < nr_val && len > 0; i++) {
465 			ret = snprintf(cur, len, "0x%x,", le32_to_cpu(val[i]));
466 			if (ret <= 0)
467 				break;
468 
469 			cur += ret;
470 			len -= ret;
471 		}
472 		if (cur > buf)
473 			wiphy_info(mt76_hw(dev)->wiphy, "idx: 0x%X,%d,%s",
474 				   le32_to_cpu(hdr->idx.idx), nr_val, buf);
475 		put_page(page);
476 	} else if (hdr->type == 2) { /* str log */
477 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", hdr->txt.len, hdr->txt.data);
478 	}
479 }
480 
481 static void
482 mt7925_mcu_uni_rx_unsolicited_event(struct mt792x_dev *dev,
483 				    struct sk_buff *skb)
484 {
485 	struct mt7925_mcu_rxd *rxd;
486 
487 	rxd = (struct mt7925_mcu_rxd *)skb->data;
488 
489 	switch (rxd->eid) {
490 	case MCU_UNI_EVENT_FW_LOG_2_HOST:
491 		mt7925_mcu_uni_debug_msg_event(dev, skb);
492 		break;
493 	case MCU_UNI_EVENT_ROC:
494 		mt7925_mcu_uni_roc_event(dev, skb);
495 		break;
496 	case MCU_UNI_EVENT_SCAN_DONE:
497 		mt7925_mcu_scan_event(dev, skb);
498 		return;
499 	case MCU_UNI_EVENT_TX_DONE:
500 		mt7925_mcu_tx_done_event(dev, skb);
501 		break;
502 	case MCU_UNI_EVENT_BSS_BEACON_LOSS:
503 		mt7925_mcu_connection_loss_event(dev, skb);
504 		break;
505 	case MCU_UNI_EVENT_COREDUMP:
506 		dev->fw_assert = true;
507 		mt76_connac_mcu_coredump_event(&dev->mt76, skb, &dev->coredump);
508 		return;
509 	default:
510 		break;
511 	}
512 	dev_kfree_skb(skb);
513 }
514 
515 void mt7925_mcu_rx_event(struct mt792x_dev *dev, struct sk_buff *skb)
516 {
517 	struct mt7925_mcu_rxd *rxd = (struct mt7925_mcu_rxd *)skb->data;
518 
519 	if (skb_linearize(skb))
520 		return;
521 
522 	if (rxd->option & MCU_UNI_CMD_UNSOLICITED_EVENT) {
523 		mt7925_mcu_uni_rx_unsolicited_event(dev, skb);
524 		return;
525 	}
526 
527 	mt76_mcu_rx_event(&dev->mt76, skb);
528 }
529 
530 static int
531 mt7925_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
532 		  struct mt76_wcid *wcid,
533 		  struct ieee80211_ampdu_params *params,
534 		  bool enable, bool tx)
535 {
536 	struct sta_rec_ba_uni *ba;
537 	struct sk_buff *skb;
538 	struct tlv *tlv;
539 	int len;
540 
541 	len = sizeof(struct sta_req_hdr) + sizeof(*ba);
542 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid,
543 					      len);
544 	if (IS_ERR(skb))
545 		return PTR_ERR(skb);
546 
547 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
548 
549 	ba = (struct sta_rec_ba_uni *)tlv;
550 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
551 	ba->winsize = cpu_to_le16(params->buf_size);
552 	ba->ssn = cpu_to_le16(params->ssn);
553 	ba->ba_en = enable << params->tid;
554 	ba->amsdu = params->amsdu;
555 	ba->tid = params->tid;
556 
557 	return mt76_mcu_skb_send_msg(dev, skb,
558 				     MCU_UNI_CMD(STA_REC_UPDATE), true);
559 }
560 
561 /** starec & wtbl **/
562 int mt7925_mcu_uni_tx_ba(struct mt792x_dev *dev,
563 			 struct ieee80211_vif *vif,
564 			 struct ieee80211_ampdu_params *params,
565 			 bool enable)
566 {
567 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
568 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
569 	struct mt792x_link_sta *mlink;
570 	struct mt792x_bss_conf *mconf;
571 	unsigned long usable_links = ieee80211_vif_usable_links(vif);
572 	struct mt76_wcid *wcid;
573 	u8 link_id, ret;
574 
575 	for_each_set_bit(link_id, &usable_links, IEEE80211_MLD_MAX_NUM_LINKS) {
576 		mconf = mt792x_vif_to_link(mvif, link_id);
577 		mlink = mt792x_sta_to_link(msta, link_id);
578 		wcid = &mlink->wcid;
579 
580 		if (enable && !params->amsdu)
581 			mlink->wcid.amsdu = false;
582 
583 		ret = mt7925_mcu_sta_ba(&dev->mt76, &mconf->mt76, wcid, params,
584 					enable, true);
585 		if (ret < 0)
586 			break;
587 	}
588 
589 	return ret;
590 }
591 
592 int mt7925_mcu_uni_rx_ba(struct mt792x_dev *dev,
593 			 struct ieee80211_vif *vif,
594 			 struct ieee80211_ampdu_params *params,
595 			 bool enable)
596 {
597 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
598 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
599 	struct mt792x_link_sta *mlink;
600 	struct mt792x_bss_conf *mconf;
601 	unsigned long usable_links = ieee80211_vif_usable_links(vif);
602 	struct mt76_wcid *wcid;
603 	u8 link_id, ret;
604 
605 	for_each_set_bit(link_id, &usable_links, IEEE80211_MLD_MAX_NUM_LINKS) {
606 		mconf = mt792x_vif_to_link(mvif, link_id);
607 		mlink = mt792x_sta_to_link(msta, link_id);
608 		wcid = &mlink->wcid;
609 
610 		ret = mt7925_mcu_sta_ba(&dev->mt76, &mconf->mt76, wcid, params,
611 					enable, false);
612 		if (ret < 0)
613 			break;
614 	}
615 
616 	return ret;
617 }
618 
619 static int mt7925_load_clc(struct mt792x_dev *dev, const char *fw_name)
620 {
621 	const struct mt76_connac2_fw_trailer *hdr;
622 	const struct mt76_connac2_fw_region *region;
623 	const struct mt7925_clc *clc;
624 	struct mt76_dev *mdev = &dev->mt76;
625 	struct mt792x_phy *phy = &dev->phy;
626 	const struct firmware *fw;
627 	int ret, i, len, offset = 0;
628 	u8 *clc_base = NULL;
629 
630 	if (mt7925_disable_clc ||
631 	    mt76_is_usb(&dev->mt76))
632 		return 0;
633 
634 	ret = request_firmware(&fw, fw_name, mdev->dev);
635 	if (ret)
636 		return ret;
637 
638 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
639 		dev_err(mdev->dev, "Invalid firmware\n");
640 		ret = -EINVAL;
641 		goto out;
642 	}
643 
644 	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
645 	for (i = 0; i < hdr->n_region; i++) {
646 		region = (const void *)((const u8 *)hdr -
647 					(hdr->n_region - i) * sizeof(*region));
648 		len = le32_to_cpu(region->len);
649 
650 		/* check if we have valid buffer size */
651 		if (offset + len > fw->size) {
652 			dev_err(mdev->dev, "Invalid firmware region\n");
653 			ret = -EINVAL;
654 			goto out;
655 		}
656 
657 		if ((region->feature_set & FW_FEATURE_NON_DL) &&
658 		    region->type == FW_TYPE_CLC) {
659 			clc_base = (u8 *)(fw->data + offset);
660 			break;
661 		}
662 		offset += len;
663 	}
664 
665 	if (!clc_base)
666 		goto out;
667 
668 	for (offset = 0; offset < len; offset += le32_to_cpu(clc->len)) {
669 		clc = (const struct mt7925_clc *)(clc_base + offset);
670 
671 		if (clc->idx >= ARRAY_SIZE(phy->clc))
672 			break;
673 
674 		/* do not init buf again if chip reset triggered */
675 		if (phy->clc[clc->idx])
676 			continue;
677 
678 		phy->clc[clc->idx] = devm_kmemdup(mdev->dev, clc,
679 						  le32_to_cpu(clc->len),
680 						  GFP_KERNEL);
681 
682 		if (!phy->clc[clc->idx]) {
683 			ret = -ENOMEM;
684 			goto out;
685 		}
686 	}
687 
688 	ret = mt7925_mcu_set_clc(dev, "00", ENVIRON_INDOOR);
689 out:
690 	release_firmware(fw);
691 
692 	return ret;
693 }
694 
695 int mt7925_mcu_fw_log_2_host(struct mt792x_dev *dev, u8 ctrl)
696 {
697 	struct {
698 		u8 _rsv[4];
699 
700 		__le16 tag;
701 		__le16 len;
702 		u8 ctrl;
703 		u8 interval;
704 		u8 _rsv2[2];
705 	} __packed req = {
706 		.tag = cpu_to_le16(UNI_WSYS_CONFIG_FW_LOG_CTRL),
707 		.len = cpu_to_le16(sizeof(req) - 4),
708 		.ctrl = ctrl,
709 	};
710 	int ret;
711 
712 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(WSYS_CONFIG),
713 					&req, sizeof(req), false, NULL);
714 	return ret;
715 }
716 
717 int mt7925_mcu_get_temperature(struct mt792x_phy *phy)
718 {
719 	struct {
720 		u8 _rsv[4];
721 
722 		__le16 tag;
723 		__le16 len;
724 		u8 _rsv2[4];
725 	} __packed req = {
726 		.tag = cpu_to_le16(0x0),
727 		.len = cpu_to_le16(sizeof(req) - 4),
728 	};
729 	struct mt7925_thermal_evt {
730 		u8 rsv[4];
731 		__le32 temperature;
732 	} __packed * evt;
733 	struct mt792x_dev *dev = phy->dev;
734 	int temperature, ret;
735 	struct sk_buff *skb;
736 
737 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
738 					MCU_WM_UNI_CMD_QUERY(THERMAL),
739 					&req, sizeof(req), true, &skb);
740 	if (ret)
741 		return ret;
742 
743 	skb_pull(skb, 4 + sizeof(struct tlv));
744 	evt = (struct mt7925_thermal_evt *)skb->data;
745 
746 	temperature = le32_to_cpu(evt->temperature);
747 
748 	dev_kfree_skb(skb);
749 
750 	return temperature;
751 }
752 
753 static void
754 mt7925_mcu_parse_phy_cap(struct mt792x_dev *dev, char *data)
755 {
756 	struct mt76_phy *mphy = &dev->mt76.phy;
757 	struct mt76_dev *mdev = mphy->dev;
758 	struct mt7925_mcu_phy_cap {
759 		u8 ht;
760 		u8 vht;
761 		u8 _5g;
762 		u8 max_bw;
763 		u8 nss;
764 		u8 dbdc;
765 		u8 tx_ldpc;
766 		u8 rx_ldpc;
767 		u8 tx_stbc;
768 		u8 rx_stbc;
769 		u8 hw_path;
770 		u8 he;
771 		u8 eht;
772 	} __packed * cap;
773 	enum {
774 		WF0_24G,
775 		WF0_5G
776 	};
777 
778 	cap = (struct mt7925_mcu_phy_cap *)data;
779 
780 	mdev->phy.antenna_mask = BIT(cap->nss) - 1;
781 	mdev->phy.chainmask = mdev->phy.antenna_mask;
782 	mdev->phy.cap.has_2ghz = cap->hw_path & BIT(WF0_24G);
783 	mdev->phy.cap.has_5ghz = cap->hw_path & BIT(WF0_5G);
784 	dev->has_eht = cap->eht;
785 }
786 
787 static void
788 mt7925_mcu_parse_eml_cap(struct mt792x_dev *dev, char *data)
789 {
790 	struct mt7925_mcu_eml_cap {
791 		u8 rsv[4];
792 		__le16 eml_cap;
793 		u8 rsv2[6];
794 	} __packed * cap;
795 
796 	cap = (struct mt7925_mcu_eml_cap *)data;
797 
798 	dev->phy.eml_cap = le16_to_cpu(cap->eml_cap);
799 }
800 
801 static int
802 mt7925_mcu_get_nic_capability(struct mt792x_dev *dev)
803 {
804 	struct mt76_phy *mphy = &dev->mt76.phy;
805 	struct {
806 		u8 _rsv[4];
807 
808 		__le16 tag;
809 		__le16 len;
810 	} __packed req = {
811 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_NIC_CAPA),
812 		.len = cpu_to_le16(sizeof(req) - 4),
813 	};
814 	struct mt76_connac_cap_hdr {
815 		__le16 n_element;
816 		u8 rsv[2];
817 	} __packed * hdr;
818 	struct sk_buff *skb;
819 	int ret, i;
820 
821 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
822 					&req, sizeof(req), true, &skb);
823 	if (ret)
824 		return ret;
825 
826 	hdr = (struct mt76_connac_cap_hdr *)skb->data;
827 	if (skb->len < sizeof(*hdr)) {
828 		ret = -EINVAL;
829 		goto out;
830 	}
831 
832 	skb_pull(skb, sizeof(*hdr));
833 
834 	for (i = 0; i < le16_to_cpu(hdr->n_element); i++) {
835 		struct tlv *tlv = (struct tlv *)skb->data;
836 		int len;
837 
838 		if (skb->len < sizeof(*tlv))
839 			break;
840 
841 		len = le16_to_cpu(tlv->len);
842 		if (skb->len < len)
843 			break;
844 
845 		switch (le16_to_cpu(tlv->tag)) {
846 		case MT_NIC_CAP_6G:
847 			mphy->cap.has_6ghz = !!tlv->data[0];
848 			break;
849 		case MT_NIC_CAP_MAC_ADDR:
850 			memcpy(mphy->macaddr, (void *)tlv->data, ETH_ALEN);
851 			break;
852 		case MT_NIC_CAP_PHY:
853 			mt7925_mcu_parse_phy_cap(dev, tlv->data);
854 			break;
855 		case MT_NIC_CAP_CHIP_CAP:
856 			dev->phy.chip_cap = le64_to_cpu(*(__le64 *)tlv->data);
857 			break;
858 		case MT_NIC_CAP_EML_CAP:
859 			mt7925_mcu_parse_eml_cap(dev, tlv->data);
860 			break;
861 		default:
862 			break;
863 		}
864 		skb_pull(skb, len);
865 	}
866 out:
867 	dev_kfree_skb(skb);
868 	return ret;
869 }
870 
871 int mt7925_mcu_chip_config(struct mt792x_dev *dev, const char *cmd)
872 {
873 	u16 len = strlen(cmd) + 1;
874 	struct {
875 		u8 _rsv[4];
876 		__le16 tag;
877 		__le16 len;
878 		struct mt76_connac_config config;
879 	} __packed req = {
880 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_CHIP_CFG),
881 		.len = cpu_to_le16(sizeof(req) - 4),
882 		.config = {
883 			.resp_type = 0,
884 			.type = 0,
885 			.data_size = cpu_to_le16(len),
886 		},
887 	};
888 
889 	memcpy(req.config.data, cmd, len);
890 
891 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
892 				 &req, sizeof(req), false);
893 }
894 
895 int mt7925_mcu_set_deep_sleep(struct mt792x_dev *dev, bool enable)
896 {
897 	char cmd[16];
898 
899 	snprintf(cmd, sizeof(cmd), "KeepFullPwr %d", !enable);
900 
901 	return mt7925_mcu_chip_config(dev, cmd);
902 }
903 EXPORT_SYMBOL_GPL(mt7925_mcu_set_deep_sleep);
904 
905 int mt7925_run_firmware(struct mt792x_dev *dev)
906 {
907 	int err;
908 
909 	err = mt792x_load_firmware(dev);
910 	if (err)
911 		return err;
912 
913 	err = mt7925_mcu_get_nic_capability(dev);
914 	if (err)
915 		return err;
916 
917 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
918 	err = mt7925_load_clc(dev, mt792x_ram_name(dev));
919 	if (err)
920 		return err;
921 
922 	return mt7925_mcu_fw_log_2_host(dev, 1);
923 }
924 EXPORT_SYMBOL_GPL(mt7925_run_firmware);
925 
926 static void
927 mt7925_mcu_sta_hdr_trans_tlv(struct sk_buff *skb,
928 			     struct ieee80211_vif *vif,
929 			     struct ieee80211_link_sta *link_sta)
930 {
931 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
932 	struct sta_rec_hdr_trans *hdr_trans;
933 	struct mt76_wcid *wcid;
934 	struct tlv *tlv;
935 
936 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HDR_TRANS, sizeof(*hdr_trans));
937 	hdr_trans = (struct sta_rec_hdr_trans *)tlv;
938 	hdr_trans->dis_rx_hdr_tran = true;
939 
940 	if (vif->type == NL80211_IFTYPE_STATION)
941 		hdr_trans->to_ds = true;
942 	else
943 		hdr_trans->from_ds = true;
944 
945 	if (link_sta) {
946 		struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
947 		struct mt792x_link_sta *mlink;
948 
949 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
950 		wcid = &mlink->wcid;
951 	} else {
952 		wcid = &mvif->sta.deflink.wcid;
953 	}
954 
955 	if (!wcid)
956 		return;
957 
958 	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
959 	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
960 		hdr_trans->to_ds = true;
961 		hdr_trans->from_ds = true;
962 	}
963 }
964 
965 int mt7925_mcu_wtbl_update_hdr_trans(struct mt792x_dev *dev,
966 				     struct ieee80211_vif *vif,
967 				     struct ieee80211_sta *sta,
968 				     int link_id)
969 {
970 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
971 	struct ieee80211_link_sta *link_sta = sta ? &sta->deflink : NULL;
972 	struct mt792x_link_sta *mlink;
973 	struct mt792x_bss_conf *mconf;
974 	struct mt792x_sta *msta;
975 	struct sk_buff *skb;
976 
977 	msta = sta ? (struct mt792x_sta *)sta->drv_priv : &mvif->sta;
978 
979 	mlink = mt792x_sta_to_link(msta, link_id);
980 	link_sta = mt792x_sta_to_link_sta(vif, sta, link_id);
981 	mconf = mt792x_vif_to_link(mvif, link_id);
982 
983 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
984 					      &mlink->wcid,
985 					      MT7925_STA_UPDATE_MAX_SIZE);
986 	if (IS_ERR(skb))
987 		return PTR_ERR(skb);
988 
989 	/* starec hdr trans */
990 	mt7925_mcu_sta_hdr_trans_tlv(skb, vif, link_sta);
991 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
992 				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
993 }
994 
995 int mt7925_mcu_set_tx(struct mt792x_dev *dev,
996 		      struct ieee80211_bss_conf *bss_conf)
997 {
998 #define MCU_EDCA_AC_PARAM	0
999 #define WMM_AIFS_SET		BIT(0)
1000 #define WMM_CW_MIN_SET		BIT(1)
1001 #define WMM_CW_MAX_SET		BIT(2)
1002 #define WMM_TXOP_SET		BIT(3)
1003 #define WMM_PARAM_SET		(WMM_AIFS_SET | WMM_CW_MIN_SET | \
1004 				 WMM_CW_MAX_SET | WMM_TXOP_SET)
1005 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(bss_conf);
1006 	struct {
1007 		u8 bss_idx;
1008 		u8 __rsv[3];
1009 	} __packed hdr = {
1010 		.bss_idx = mconf->mt76.idx,
1011 	};
1012 	struct sk_buff *skb;
1013 	int len = sizeof(hdr) + IEEE80211_NUM_ACS * sizeof(struct edca);
1014 	int ac;
1015 
1016 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
1017 	if (!skb)
1018 		return -ENOMEM;
1019 
1020 	skb_put_data(skb, &hdr, sizeof(hdr));
1021 
1022 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1023 		struct ieee80211_tx_queue_params *q = &mconf->queue_params[ac];
1024 		struct edca *e;
1025 		struct tlv *tlv;
1026 
1027 		tlv = mt76_connac_mcu_add_tlv(skb, MCU_EDCA_AC_PARAM, sizeof(*e));
1028 
1029 		e = (struct edca *)tlv;
1030 		e->set = WMM_PARAM_SET;
1031 		e->queue = ac;
1032 		e->aifs = q->aifs;
1033 		e->txop = cpu_to_le16(q->txop);
1034 
1035 		if (q->cw_min)
1036 			e->cw_min = fls(q->cw_min);
1037 		else
1038 			e->cw_min = 5;
1039 
1040 		if (q->cw_max)
1041 			e->cw_max = fls(q->cw_max);
1042 		else
1043 			e->cw_max = 10;
1044 	}
1045 
1046 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1047 				     MCU_UNI_CMD(EDCA_UPDATE), true);
1048 }
1049 
1050 static int
1051 mt7925_mcu_sta_key_tlv(struct mt76_wcid *wcid,
1052 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1053 		       struct sk_buff *skb,
1054 		       struct ieee80211_key_conf *key,
1055 		       enum set_key_cmd cmd,
1056 		       struct mt792x_sta *msta)
1057 {
1058 	struct mt792x_vif *mvif = msta->vif;
1059 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1060 	struct sta_rec_sec_uni *sec;
1061 	struct ieee80211_sta *sta;
1062 	struct ieee80211_vif *vif;
1063 	struct tlv *tlv;
1064 
1065 	sta = msta == &mvif->sta ?
1066 		      NULL :
1067 		      container_of((void *)msta, struct ieee80211_sta, drv_priv);
1068 	vif = container_of((void *)mvif, struct ieee80211_vif, drv_priv);
1069 
1070 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V3, sizeof(*sec));
1071 	sec = (struct sta_rec_sec_uni *)tlv;
1072 	sec->bss_idx = mconf->mt76.idx;
1073 	sec->is_authenticator = 0;
1074 	sec->mgmt_prot = 1; /* only used in MLO mode */
1075 	sec->wlan_idx = (u8)wcid->idx;
1076 
1077 	if (sta) {
1078 		struct ieee80211_link_sta *link_sta;
1079 
1080 		sec->tx_key = 1;
1081 		sec->key_type = 1;
1082 		link_sta = mt792x_sta_to_link_sta(vif, sta, wcid->link_id);
1083 
1084 		if (link_sta)
1085 			memcpy(sec->peer_addr, link_sta->addr, ETH_ALEN);
1086 	} else {
1087 		struct ieee80211_bss_conf *link_conf;
1088 
1089 		link_conf = mt792x_vif_to_bss_conf(vif, wcid->link_id);
1090 
1091 		if (link_conf)
1092 			memcpy(sec->peer_addr, link_conf->bssid, ETH_ALEN);
1093 	}
1094 
1095 	if (cmd == SET_KEY) {
1096 		u8 cipher;
1097 
1098 		sec->add = 1;
1099 		cipher = mt7925_mcu_get_cipher(key->cipher);
1100 		if (cipher == CONNAC3_CIPHER_NONE)
1101 			return -EOPNOTSUPP;
1102 
1103 		if (cipher == CONNAC3_CIPHER_BIP_CMAC_128) {
1104 			sec->cipher_id = CONNAC3_CIPHER_BIP_CMAC_128;
1105 			sec->key_id = sta_key_conf->keyidx;
1106 			sec->key_len = 32;
1107 			memcpy(sec->key, sta_key_conf->key, 16);
1108 			memcpy(sec->key + 16, key->key, 16);
1109 		} else {
1110 			sec->cipher_id = cipher;
1111 			sec->key_id = key->keyidx;
1112 			sec->key_len = key->keylen;
1113 			memcpy(sec->key, key->key, key->keylen);
1114 
1115 			if (cipher == CONNAC3_CIPHER_TKIP) {
1116 				/* Rx/Tx MIC keys are swapped */
1117 				memcpy(sec->key + 16, key->key + 24, 8);
1118 				memcpy(sec->key + 24, key->key + 16, 8);
1119 			}
1120 
1121 			/* store key_conf for BIP batch update */
1122 			if (cipher == CONNAC3_CIPHER_AES_CCMP) {
1123 				memcpy(sta_key_conf->key, key->key, key->keylen);
1124 				sta_key_conf->keyidx = key->keyidx;
1125 			}
1126 		}
1127 	} else {
1128 		sec->add = 0;
1129 	}
1130 
1131 	return 0;
1132 }
1133 
1134 int mt7925_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
1135 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1136 		       struct ieee80211_key_conf *key, int mcu_cmd,
1137 		       struct mt76_wcid *wcid, enum set_key_cmd cmd,
1138 		       struct mt792x_sta *msta)
1139 {
1140 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1141 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1142 	struct sk_buff *skb;
1143 	int ret;
1144 
1145 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, wcid,
1146 					      MT7925_STA_UPDATE_MAX_SIZE);
1147 	if (IS_ERR(skb))
1148 		return PTR_ERR(skb);
1149 
1150 	ret = mt7925_mcu_sta_key_tlv(wcid, sta_key_conf, skb, key, cmd, msta);
1151 	if (ret)
1152 		return ret;
1153 
1154 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
1155 }
1156 
1157 int mt7925_mcu_set_mlo_roc(struct mt792x_bss_conf *mconf, u16 sel_links,
1158 			   int duration, u8 token_id)
1159 {
1160 	struct mt792x_vif *mvif = mconf->vif;
1161 	struct ieee80211_vif *vif = container_of((void *)mvif,
1162 						 struct ieee80211_vif, drv_priv);
1163 	struct ieee80211_bss_conf *link_conf;
1164 	struct ieee80211_channel *chan;
1165 	const u8 ch_band[] = {
1166 		[NL80211_BAND_2GHZ] = 1,
1167 		[NL80211_BAND_5GHZ] = 2,
1168 		[NL80211_BAND_6GHZ] = 3,
1169 	};
1170 	enum mt7925_roc_req type;
1171 	int center_ch, i = 0;
1172 	bool is_AG_band = false;
1173 	struct {
1174 		u8 id;
1175 		u8 bss_idx;
1176 		u16 tag;
1177 		struct mt792x_bss_conf *mconf;
1178 		struct ieee80211_channel *chan;
1179 	} links[2];
1180 
1181 	struct {
1182 		struct {
1183 			u8 rsv[4];
1184 		} __packed hdr;
1185 		struct roc_acquire_tlv roc[2];
1186 	} __packed req = {
1187 			.roc[0].tag = cpu_to_le16(UNI_ROC_NUM),
1188 			.roc[0].len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1189 			.roc[1].tag = cpu_to_le16(UNI_ROC_NUM),
1190 			.roc[1].len = cpu_to_le16(sizeof(struct roc_acquire_tlv))
1191 	};
1192 
1193 	if (!mconf || hweight16(vif->valid_links) < 2 ||
1194 	    hweight16(sel_links) != 2)
1195 		return -EPERM;
1196 
1197 	for (i = 0; i < ARRAY_SIZE(links); i++) {
1198 		links[i].id = i ? __ffs(~BIT(mconf->link_id) & sel_links) :
1199 				 mconf->link_id;
1200 		link_conf = mt792x_vif_to_bss_conf(vif, links[i].id);
1201 		if (WARN_ON_ONCE(!link_conf))
1202 			return -EPERM;
1203 
1204 		links[i].chan = link_conf->chanreq.oper.chan;
1205 		if (WARN_ON_ONCE(!links[i].chan))
1206 			return -EPERM;
1207 
1208 		links[i].mconf = mt792x_vif_to_link(mvif, links[i].id);
1209 		links[i].tag = links[i].id == mconf->link_id ?
1210 			       UNI_ROC_ACQUIRE : UNI_ROC_SUB_LINK;
1211 
1212 		is_AG_band |= links[i].chan->band == NL80211_BAND_2GHZ;
1213 	}
1214 
1215 	if (vif->cfg.eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP)
1216 		type = is_AG_band ? MT7925_ROC_REQ_MLSR_AG :
1217 				    MT7925_ROC_REQ_MLSR_AA;
1218 	else
1219 		type = MT7925_ROC_REQ_JOIN;
1220 
1221 	for (i = 0; i < ARRAY_SIZE(links) && i < hweight16(vif->active_links); i++) {
1222 		if (WARN_ON_ONCE(!links[i].mconf || !links[i].chan))
1223 			continue;
1224 
1225 		chan = links[i].chan;
1226 		center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1227 		req.roc[i].len = cpu_to_le16(sizeof(struct roc_acquire_tlv));
1228 		req.roc[i].tag = cpu_to_le16(links[i].tag);
1229 		req.roc[i].tokenid = token_id;
1230 		req.roc[i].reqtype = type;
1231 		req.roc[i].maxinterval = cpu_to_le32(duration);
1232 		req.roc[i].bss_idx = links[i].mconf->mt76.idx;
1233 		req.roc[i].control_channel = chan->hw_value;
1234 		req.roc[i].bw = CMD_CBW_20MHZ;
1235 		req.roc[i].bw_from_ap = CMD_CBW_20MHZ;
1236 		req.roc[i].center_chan = center_ch;
1237 		req.roc[i].center_chan_from_ap = center_ch;
1238 		req.roc[i].center_chan2 = 0;
1239 		req.roc[i].center_chan2_from_ap = 0;
1240 
1241 		/* STR : 0xfe indicates BAND_ALL with enabling DBDC
1242 		 * EMLSR : 0xff indicates (BAND_AUTO) without DBDC
1243 		 */
1244 		req.roc[i].dbdcband = type == MT7925_ROC_REQ_JOIN ? 0xfe : 0xff;
1245 
1246 		if (chan->hw_value < center_ch)
1247 			req.roc[i].sco = 1; /* SCA */
1248 		else if (chan->hw_value > center_ch)
1249 			req.roc[i].sco = 3; /* SCB */
1250 
1251 		req.roc[i].band = ch_band[chan->band];
1252 	}
1253 
1254 	return mt76_mcu_send_msg(&mvif->phy->dev->mt76, MCU_UNI_CMD(ROC),
1255 				 &req, sizeof(req), false);
1256 }
1257 
1258 int mt7925_mcu_set_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1259 		       struct ieee80211_channel *chan, int duration,
1260 		       enum mt7925_roc_req type, u8 token_id)
1261 {
1262 	int center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1263 	struct mt792x_dev *dev = phy->dev;
1264 	struct {
1265 		struct {
1266 			u8 rsv[4];
1267 		} __packed hdr;
1268 		struct roc_acquire_tlv roc;
1269 	} __packed req = {
1270 		.roc = {
1271 			.tag = cpu_to_le16(UNI_ROC_ACQUIRE),
1272 			.len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1273 			.tokenid = token_id,
1274 			.reqtype = type,
1275 			.maxinterval = cpu_to_le32(duration),
1276 			.bss_idx = mconf->mt76.idx,
1277 			.control_channel = chan->hw_value,
1278 			.bw = CMD_CBW_20MHZ,
1279 			.bw_from_ap = CMD_CBW_20MHZ,
1280 			.center_chan = center_ch,
1281 			.center_chan_from_ap = center_ch,
1282 			.dbdcband = 0xff, /* auto */
1283 		},
1284 	};
1285 
1286 	if (chan->hw_value < center_ch)
1287 		req.roc.sco = 1; /* SCA */
1288 	else if (chan->hw_value > center_ch)
1289 		req.roc.sco = 3; /* SCB */
1290 
1291 	switch (chan->band) {
1292 	case NL80211_BAND_6GHZ:
1293 		req.roc.band = 3;
1294 		break;
1295 	case NL80211_BAND_5GHZ:
1296 		req.roc.band = 2;
1297 		break;
1298 	default:
1299 		req.roc.band = 1;
1300 		break;
1301 	}
1302 
1303 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1304 				 &req, sizeof(req), false);
1305 }
1306 
1307 int mt7925_mcu_abort_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1308 			 u8 token_id)
1309 {
1310 	struct mt792x_dev *dev = phy->dev;
1311 	struct {
1312 		struct {
1313 			u8 rsv[4];
1314 		} __packed hdr;
1315 		struct roc_abort_tlv {
1316 			__le16 tag;
1317 			__le16 len;
1318 			u8 bss_idx;
1319 			u8 tokenid;
1320 			u8 dbdcband;
1321 			u8 rsv[5];
1322 		} __packed abort;
1323 	} __packed req = {
1324 		.abort = {
1325 			.tag = cpu_to_le16(UNI_ROC_ABORT),
1326 			.len = cpu_to_le16(sizeof(struct roc_abort_tlv)),
1327 			.tokenid = token_id,
1328 			.bss_idx = mconf->mt76.idx,
1329 			.dbdcband = 0xff, /* auto*/
1330 		},
1331 	};
1332 
1333 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1334 				 &req, sizeof(req), false);
1335 }
1336 
1337 int mt7925_mcu_set_eeprom(struct mt792x_dev *dev)
1338 {
1339 	struct {
1340 		u8 _rsv[4];
1341 
1342 		__le16 tag;
1343 		__le16 len;
1344 		u8 buffer_mode;
1345 		u8 format;
1346 		__le16 buf_len;
1347 	} __packed req = {
1348 		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
1349 		.len = cpu_to_le16(sizeof(req) - 4),
1350 		.buffer_mode = EE_MODE_EFUSE,
1351 		.format = EE_FORMAT_WHOLE
1352 	};
1353 
1354 	return mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(EFUSE_CTRL),
1355 					 &req, sizeof(req), false, NULL);
1356 }
1357 EXPORT_SYMBOL_GPL(mt7925_mcu_set_eeprom);
1358 
1359 int mt7925_mcu_uni_bss_ps(struct mt792x_dev *dev,
1360 			  struct ieee80211_bss_conf *link_conf)
1361 {
1362 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1363 	struct {
1364 		struct {
1365 			u8 bss_idx;
1366 			u8 pad[3];
1367 		} __packed hdr;
1368 		struct ps_tlv {
1369 			__le16 tag;
1370 			__le16 len;
1371 			u8 ps_state; /* 0: device awake
1372 				      * 1: static power save
1373 				      * 2: dynamic power saving
1374 				      * 3: enter TWT power saving
1375 				      * 4: leave TWT power saving
1376 				      */
1377 			u8 pad[3];
1378 		} __packed ps;
1379 	} __packed ps_req = {
1380 		.hdr = {
1381 			.bss_idx = mconf->mt76.idx,
1382 		},
1383 		.ps = {
1384 			.tag = cpu_to_le16(UNI_BSS_INFO_PS),
1385 			.len = cpu_to_le16(sizeof(struct ps_tlv)),
1386 			.ps_state = link_conf->vif->cfg.ps ? 2 : 0,
1387 		},
1388 	};
1389 
1390 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1391 		return -EOPNOTSUPP;
1392 
1393 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1394 				 &ps_req, sizeof(ps_req), true);
1395 }
1396 
1397 int
1398 mt7925_mcu_uni_bss_bcnft(struct mt792x_dev *dev,
1399 			 struct ieee80211_bss_conf *link_conf, bool enable)
1400 {
1401 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1402 	struct {
1403 		struct {
1404 			u8 bss_idx;
1405 			u8 pad[3];
1406 		} __packed hdr;
1407 		struct bcnft_tlv {
1408 			__le16 tag;
1409 			__le16 len;
1410 			__le16 bcn_interval;
1411 			u8 dtim_period;
1412 			u8 bmc_delivered_ac;
1413 			u8 bmc_triggered_ac;
1414 			u8 pad[3];
1415 		} __packed bcnft;
1416 	} __packed bcnft_req = {
1417 		.hdr = {
1418 			.bss_idx = mconf->mt76.idx,
1419 		},
1420 		.bcnft = {
1421 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1422 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1423 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1424 			.dtim_period = link_conf->dtim_period,
1425 		},
1426 	};
1427 
1428 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1429 		return 0;
1430 
1431 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1432 				 &bcnft_req, sizeof(bcnft_req), true);
1433 }
1434 
1435 int
1436 mt7925_mcu_set_bss_pm(struct mt792x_dev *dev,
1437 		      struct ieee80211_bss_conf *link_conf,
1438 		      bool enable)
1439 {
1440 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1441 	struct {
1442 		struct {
1443 			u8 bss_idx;
1444 			u8 pad[3];
1445 		} __packed hdr;
1446 		struct bcnft_tlv {
1447 			__le16 tag;
1448 			__le16 len;
1449 			__le16 bcn_interval;
1450 			u8 dtim_period;
1451 			u8 bmc_delivered_ac;
1452 			u8 bmc_triggered_ac;
1453 			u8 pad[3];
1454 		} __packed enable;
1455 	} req = {
1456 		.hdr = {
1457 			.bss_idx = mconf->mt76.idx,
1458 		},
1459 		.enable = {
1460 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1461 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1462 			.dtim_period = link_conf->dtim_period,
1463 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1464 		},
1465 	};
1466 	struct {
1467 		struct {
1468 			u8 bss_idx;
1469 			u8 pad[3];
1470 		} __packed hdr;
1471 		struct pm_disable {
1472 			__le16 tag;
1473 			__le16 len;
1474 		} __packed disable;
1475 	} req1 = {
1476 		.hdr = {
1477 			.bss_idx = mconf->mt76.idx,
1478 		},
1479 		.disable = {
1480 			.tag = cpu_to_le16(UNI_BSS_INFO_PM_DISABLE),
1481 			.len = cpu_to_le16(sizeof(struct pm_disable))
1482 		},
1483 	};
1484 	int err;
1485 
1486 	err = mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1487 				&req1, sizeof(req1), false);
1488 	if (err < 0 || !enable)
1489 		return err;
1490 
1491 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1492 				 &req, sizeof(req), false);
1493 }
1494 
1495 static void
1496 mt7925_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1497 {
1498 	if (!link_sta->he_cap.has_he)
1499 		return;
1500 
1501 	mt76_connac_mcu_sta_he_tlv_v2(skb, link_sta->sta);
1502 }
1503 
1504 static void
1505 mt7925_mcu_sta_he_6g_tlv(struct sk_buff *skb,
1506 			 struct ieee80211_link_sta *link_sta)
1507 {
1508 	struct sta_rec_he_6g_capa *he_6g;
1509 	struct tlv *tlv;
1510 
1511 	if (!link_sta->he_6ghz_capa.capa)
1512 		return;
1513 
1514 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G, sizeof(*he_6g));
1515 
1516 	he_6g = (struct sta_rec_he_6g_capa *)tlv;
1517 	he_6g->capa = link_sta->he_6ghz_capa.capa;
1518 }
1519 
1520 static void
1521 mt7925_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1522 {
1523 	struct ieee80211_eht_mcs_nss_supp *mcs_map;
1524 	struct ieee80211_eht_cap_elem_fixed *elem;
1525 	struct sta_rec_eht *eht;
1526 	struct tlv *tlv;
1527 
1528 	if (!link_sta->eht_cap.has_eht)
1529 		return;
1530 
1531 	mcs_map = &link_sta->eht_cap.eht_mcs_nss_supp;
1532 	elem = &link_sta->eht_cap.eht_cap_elem;
1533 
1534 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT, sizeof(*eht));
1535 
1536 	eht = (struct sta_rec_eht *)tlv;
1537 	eht->tid_bitmap = 0xff;
1538 	eht->mac_cap = cpu_to_le16(*(u16 *)elem->mac_cap_info);
1539 	eht->phy_cap = cpu_to_le64(*(u64 *)elem->phy_cap_info);
1540 	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
1541 
1542 	if (link_sta->bandwidth == IEEE80211_STA_RX_BW_20)
1543 		memcpy(eht->mcs_map_bw20, &mcs_map->only_20mhz, sizeof(eht->mcs_map_bw20));
1544 	memcpy(eht->mcs_map_bw80, &mcs_map->bw._80, sizeof(eht->mcs_map_bw80));
1545 	memcpy(eht->mcs_map_bw160, &mcs_map->bw._160, sizeof(eht->mcs_map_bw160));
1546 }
1547 
1548 static void
1549 mt7925_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1550 {
1551 	struct sta_rec_ht *ht;
1552 	struct tlv *tlv;
1553 
1554 	if (!link_sta->ht_cap.ht_supported)
1555 		return;
1556 
1557 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1558 
1559 	ht = (struct sta_rec_ht *)tlv;
1560 	ht->ht_cap = cpu_to_le16(link_sta->ht_cap.cap);
1561 }
1562 
1563 static void
1564 mt7925_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1565 {
1566 	struct sta_rec_vht *vht;
1567 	struct tlv *tlv;
1568 
1569 	/* For 6G band, this tlv is necessary to let hw work normally */
1570 	if (!link_sta->he_6ghz_capa.capa && !link_sta->vht_cap.vht_supported)
1571 		return;
1572 
1573 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1574 
1575 	vht = (struct sta_rec_vht *)tlv;
1576 	vht->vht_cap = cpu_to_le32(link_sta->vht_cap.cap);
1577 	vht->vht_rx_mcs_map = link_sta->vht_cap.vht_mcs.rx_mcs_map;
1578 	vht->vht_tx_mcs_map = link_sta->vht_cap.vht_mcs.tx_mcs_map;
1579 }
1580 
1581 static void
1582 mt7925_mcu_sta_amsdu_tlv(struct sk_buff *skb,
1583 			 struct ieee80211_vif *vif,
1584 			 struct ieee80211_link_sta *link_sta)
1585 {
1586 	struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1587 	struct mt792x_link_sta *mlink;
1588 	struct sta_rec_amsdu *amsdu;
1589 	struct tlv *tlv;
1590 
1591 	if (vif->type != NL80211_IFTYPE_STATION &&
1592 	    vif->type != NL80211_IFTYPE_AP)
1593 		return;
1594 
1595 	if (!link_sta->agg.max_amsdu_len)
1596 		return;
1597 
1598 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1599 	amsdu = (struct sta_rec_amsdu *)tlv;
1600 	amsdu->max_amsdu_num = 8;
1601 	amsdu->amsdu_en = true;
1602 
1603 	mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1604 	mlink->wcid.amsdu = true;
1605 
1606 	switch (link_sta->agg.max_amsdu_len) {
1607 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1608 		amsdu->max_mpdu_size =
1609 			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1610 		return;
1611 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
1612 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1613 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1614 		return;
1615 	default:
1616 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1617 		return;
1618 	}
1619 }
1620 
1621 static void
1622 mt7925_mcu_sta_phy_tlv(struct sk_buff *skb,
1623 		       struct ieee80211_vif *vif,
1624 		       struct ieee80211_link_sta *link_sta)
1625 {
1626 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1627 	struct ieee80211_bss_conf *link_conf;
1628 	struct cfg80211_chan_def *chandef;
1629 	struct mt792x_bss_conf *mconf;
1630 	struct sta_rec_phy *phy;
1631 	struct tlv *tlv;
1632 	u8 af = 0, mm = 0;
1633 
1634 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1635 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1636 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1637 				    &link_conf->chanreq.oper;
1638 
1639 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PHY, sizeof(*phy));
1640 	phy = (struct sta_rec_phy *)tlv;
1641 	phy->phy_type = mt76_connac_get_phy_mode_v2(mvif->phy->mt76, vif,
1642 						    chandef->chan->band,
1643 						    link_sta);
1644 	phy->basic_rate = cpu_to_le16((u16)link_conf->basic_rates);
1645 	if (link_sta->ht_cap.ht_supported) {
1646 		af = link_sta->ht_cap.ampdu_factor;
1647 		mm = link_sta->ht_cap.ampdu_density;
1648 	}
1649 
1650 	if (link_sta->vht_cap.vht_supported) {
1651 		u8 vht_af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1652 				      link_sta->vht_cap.cap);
1653 
1654 		af = max_t(u8, af, vht_af);
1655 	}
1656 
1657 	if (link_sta->he_6ghz_capa.capa) {
1658 		af = le16_get_bits(link_sta->he_6ghz_capa.capa,
1659 				   IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1660 		mm = le16_get_bits(link_sta->he_6ghz_capa.capa,
1661 				   IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
1662 	}
1663 
1664 	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR, af) |
1665 		     FIELD_PREP(IEEE80211_HT_AMPDU_PARM_DENSITY, mm);
1666 	phy->max_ampdu_len = af;
1667 }
1668 
1669 static void
1670 mt7925_mcu_sta_state_v2_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
1671 			    struct ieee80211_link_sta *link_sta,
1672 			    struct ieee80211_vif *vif,
1673 			    u8 rcpi, u8 sta_state)
1674 {
1675 	struct sta_rec_state_v2 {
1676 		__le16 tag;
1677 		__le16 len;
1678 		u8 state;
1679 		u8 rsv[3];
1680 		__le32 flags;
1681 		u8 vht_opmode;
1682 		u8 action;
1683 		u8 rsv2[2];
1684 	} __packed * state;
1685 	struct tlv *tlv;
1686 
1687 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_STATE, sizeof(*state));
1688 	state = (struct sta_rec_state_v2 *)tlv;
1689 	state->state = sta_state;
1690 
1691 	if (link_sta->vht_cap.vht_supported) {
1692 		state->vht_opmode = link_sta->bandwidth;
1693 		state->vht_opmode |= link_sta->rx_nss <<
1694 			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
1695 	}
1696 }
1697 
1698 static void
1699 mt7925_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb,
1700 			     struct ieee80211_vif *vif,
1701 			     struct ieee80211_link_sta *link_sta)
1702 {
1703 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1704 	struct ieee80211_bss_conf *link_conf;
1705 	struct cfg80211_chan_def *chandef;
1706 	struct sta_rec_ra_info *ra_info;
1707 	struct mt792x_bss_conf *mconf;
1708 	enum nl80211_band band;
1709 	struct tlv *tlv;
1710 	u16 supp_rates;
1711 
1712 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1713 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1714 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1715 				    &link_conf->chanreq.oper;
1716 	band = chandef->chan->band;
1717 
1718 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra_info));
1719 	ra_info = (struct sta_rec_ra_info *)tlv;
1720 
1721 	supp_rates = link_sta->supp_rates[band];
1722 	if (band == NL80211_BAND_2GHZ)
1723 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
1724 			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
1725 	else
1726 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates);
1727 
1728 	ra_info->legacy = cpu_to_le16(supp_rates);
1729 
1730 	if (link_sta->ht_cap.ht_supported)
1731 		memcpy(ra_info->rx_mcs_bitmask,
1732 		       link_sta->ht_cap.mcs.rx_mask,
1733 		       HT_MCS_MASK_NUM);
1734 }
1735 
1736 static void
1737 mt7925_mcu_sta_eht_mld_tlv(struct sk_buff *skb,
1738 			   struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1739 {
1740 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1741 	struct wiphy *wiphy = mvif->phy->mt76->hw->wiphy;
1742 	const struct wiphy_iftype_ext_capab *ext_capa;
1743 	struct sta_rec_eht_mld *eht_mld;
1744 	struct tlv *tlv;
1745 	u16 eml_cap;
1746 
1747 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT_MLD, sizeof(*eht_mld));
1748 	eht_mld = (struct sta_rec_eht_mld *)tlv;
1749 	eht_mld->mld_type = 0xff;
1750 
1751 	if (!ieee80211_vif_is_mld(vif))
1752 		return;
1753 
1754 	ext_capa = cfg80211_get_iftype_ext_capa(wiphy,
1755 						ieee80211_vif_type_p2p(vif));
1756 	if (!ext_capa)
1757 		return;
1758 
1759 	eml_cap = (vif->cfg.eml_cap & (IEEE80211_EML_CAP_EMLSR_SUPP |
1760 				       IEEE80211_EML_CAP_TRANSITION_TIMEOUT)) |
1761 		  (ext_capa->eml_capabilities & (IEEE80211_EML_CAP_EMLSR_PADDING_DELAY |
1762 						IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY));
1763 
1764 	if (eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP) {
1765 		eht_mld->eml_cap[0] = u16_get_bits(eml_cap, GENMASK(7, 0));
1766 		eht_mld->eml_cap[1] = u16_get_bits(eml_cap, GENMASK(15, 8));
1767 	} else {
1768 		eht_mld->str_cap[0] = BIT(1);
1769 	}
1770 }
1771 
1772 static void
1773 mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,
1774 		       struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1775 {
1776 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1777 	struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv;
1778 	unsigned long valid = mvif->valid_links;
1779 	struct mt792x_bss_conf *mconf;
1780 	struct mt792x_link_sta *mlink;
1781 	struct sta_rec_mld *mld;
1782 	struct tlv *tlv;
1783 	int i, cnt = 0;
1784 
1785 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MLD, sizeof(*mld));
1786 	mld = (struct sta_rec_mld *)tlv;
1787 	memcpy(mld->mac_addr, sta->addr, ETH_ALEN);
1788 	mld->primary_id = cpu_to_le16(msta->deflink.wcid.idx);
1789 	mld->wlan_id = cpu_to_le16(msta->deflink.wcid.idx);
1790 	mld->link_num = min_t(u8, hweight16(mvif->valid_links), 2);
1791 
1792 	for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
1793 		if (cnt == mld->link_num)
1794 			break;
1795 
1796 		mconf = mt792x_vif_to_link(mvif, i);
1797 		mlink = mt792x_sta_to_link(msta, i);
1798 		mld->link[cnt].wlan_id = cpu_to_le16(mlink->wcid.idx);
1799 		mld->link[cnt++].bss_idx = mconf->mt76.idx;
1800 
1801 		if (mlink != &msta->deflink)
1802 			mld->secondary_id = cpu_to_le16(mlink->wcid.idx);
1803 	}
1804 }
1805 
1806 static int
1807 mt7925_mcu_sta_cmd(struct mt76_phy *phy,
1808 		   struct mt76_sta_cmd_info *info)
1809 {
1810 	struct mt76_vif *mvif = (struct mt76_vif *)info->vif->drv_priv;
1811 	struct mt76_dev *dev = phy->dev;
1812 	struct sk_buff *skb;
1813 	int conn_state;
1814 
1815 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, info->wcid,
1816 					      MT7925_STA_UPDATE_MAX_SIZE);
1817 	if (IS_ERR(skb))
1818 		return PTR_ERR(skb);
1819 
1820 	conn_state = info->enable ? CONN_STATE_PORT_SECURE :
1821 				    CONN_STATE_DISCONNECT;
1822 	if (info->link_sta)
1823 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif,
1824 					      info->link_sta,
1825 					      conn_state, info->newly);
1826 	if (info->link_sta && info->enable) {
1827 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1828 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1829 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1830 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1831 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1832 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1833 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1834 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1835 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1836 					     info->link_sta);
1837 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1838 					    info->vif, info->rcpi,
1839 					    info->state);
1840 		mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1841 	}
1842 
1843 	if (info->enable)
1844 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
1845 
1846 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1847 }
1848 
1849 static void
1850 mt7925_mcu_sta_remove_tlv(struct sk_buff *skb)
1851 {
1852 	struct sta_rec_remove *rem;
1853 	struct tlv *tlv;
1854 
1855 	tlv = mt76_connac_mcu_add_tlv(skb, 0x25, sizeof(*rem));
1856 	rem = (struct sta_rec_remove *)tlv;
1857 	rem->action = 0;
1858 }
1859 
1860 static int
1861 mt7925_mcu_mlo_sta_cmd(struct mt76_phy *phy,
1862 		       struct mt76_sta_cmd_info *info)
1863 {
1864 	struct mt792x_vif *mvif = (struct mt792x_vif *)info->vif->drv_priv;
1865 	struct mt76_dev *dev = phy->dev;
1866 	struct mt792x_bss_conf *mconf;
1867 	struct sk_buff *skb;
1868 
1869 	mconf = mt792x_vif_to_link(mvif, info->wcid->link_id);
1870 
1871 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, info->wcid,
1872 					      MT7925_STA_UPDATE_MAX_SIZE);
1873 	if (IS_ERR(skb))
1874 		return PTR_ERR(skb);
1875 
1876 	if (info->enable)
1877 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif,
1878 					      info->link_sta,
1879 					      info->enable, info->newly);
1880 
1881 	if (info->enable && info->link_sta) {
1882 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1883 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1884 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1885 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1886 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1887 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1888 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1889 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1890 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1891 					     info->link_sta);
1892 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1893 					    info->vif, info->rcpi,
1894 					    info->state);
1895 
1896 		if (info->state != MT76_STA_INFO_STATE_NONE) {
1897 			mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1898 			mt7925_mcu_sta_eht_mld_tlv(skb, info->vif, info->link_sta->sta);
1899 		}
1900 
1901 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
1902 	}
1903 
1904 	if (!info->enable) {
1905 		mt7925_mcu_sta_remove_tlv(skb);
1906 		mt76_connac_mcu_add_tlv(skb, STA_REC_MLD_OFF,
1907 					sizeof(struct tlv));
1908 	}
1909 
1910 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1911 }
1912 
1913 int mt7925_mcu_sta_update(struct mt792x_dev *dev,
1914 			  struct ieee80211_link_sta *link_sta,
1915 			  struct ieee80211_vif *vif, bool enable,
1916 			  enum mt76_sta_info_state state)
1917 {
1918 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1919 	int rssi = -ewma_rssi_read(&mvif->bss_conf.rssi);
1920 	struct mt76_sta_cmd_info info = {
1921 		.link_sta = link_sta,
1922 		.vif = vif,
1923 		.enable = enable,
1924 		.cmd = MCU_UNI_CMD(STA_REC_UPDATE),
1925 		.state = state,
1926 		.offload_fw = true,
1927 		.rcpi = to_rcpi(rssi),
1928 	};
1929 	struct mt792x_sta *msta;
1930 	struct mt792x_link_sta *mlink;
1931 	int err;
1932 
1933 	if (link_sta) {
1934 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1935 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1936 	}
1937 	info.wcid = link_sta ? &mlink->wcid : &mvif->sta.deflink.wcid;
1938 
1939 	if (link_sta)
1940 		info.newly = state != MT76_STA_INFO_STATE_ASSOC;
1941 	else
1942 		info.newly = state == MT76_STA_INFO_STATE_ASSOC ? false : true;
1943 
1944 	if (ieee80211_vif_is_mld(vif))
1945 		err = mt7925_mcu_mlo_sta_cmd(&dev->mphy, &info);
1946 	else
1947 		err = mt7925_mcu_sta_cmd(&dev->mphy, &info);
1948 
1949 	return err;
1950 }
1951 
1952 int mt7925_mcu_set_beacon_filter(struct mt792x_dev *dev,
1953 				 struct ieee80211_vif *vif,
1954 				 bool enable)
1955 {
1956 #define MT7925_FIF_BIT_CLR		BIT(1)
1957 #define MT7925_FIF_BIT_SET		BIT(0)
1958 	int err = 0;
1959 
1960 	if (enable) {
1961 		err = mt7925_mcu_uni_bss_bcnft(dev, &vif->bss_conf, true);
1962 		if (err < 0)
1963 			return err;
1964 
1965 		return mt7925_mcu_set_rxfilter(dev, 0,
1966 					       MT7925_FIF_BIT_SET,
1967 					       MT_WF_RFCR_DROP_OTHER_BEACON);
1968 	}
1969 
1970 	err = mt7925_mcu_set_bss_pm(dev, &vif->bss_conf, false);
1971 	if (err < 0)
1972 		return err;
1973 
1974 	return mt7925_mcu_set_rxfilter(dev, 0,
1975 				       MT7925_FIF_BIT_CLR,
1976 				       MT_WF_RFCR_DROP_OTHER_BEACON);
1977 }
1978 
1979 int mt7925_get_txpwr_info(struct mt792x_dev *dev, u8 band_idx, struct mt7925_txpwr *txpwr)
1980 {
1981 #define TX_POWER_SHOW_INFO 0x7
1982 #define TXPOWER_ALL_RATE_POWER_INFO 0x2
1983 	struct mt7925_txpwr_event *event;
1984 	struct mt7925_txpwr_req req = {
1985 		.tag = cpu_to_le16(TX_POWER_SHOW_INFO),
1986 		.len = cpu_to_le16(sizeof(req) - 4),
1987 		.catg = TXPOWER_ALL_RATE_POWER_INFO,
1988 		.band_idx = band_idx,
1989 	};
1990 	struct sk_buff *skb;
1991 	int ret;
1992 
1993 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(TXPOWER),
1994 					&req, sizeof(req), true, &skb);
1995 	if (ret)
1996 		return ret;
1997 
1998 	event = (struct mt7925_txpwr_event *)skb->data;
1999 	memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
2000 
2001 	dev_kfree_skb(skb);
2002 
2003 	return 0;
2004 }
2005 
2006 int mt7925_mcu_set_sniffer(struct mt792x_dev *dev, struct ieee80211_vif *vif,
2007 			   bool enable)
2008 {
2009 	struct {
2010 		struct {
2011 			u8 band_idx;
2012 			u8 pad[3];
2013 		} __packed hdr;
2014 		struct sniffer_enable_tlv {
2015 			__le16 tag;
2016 			__le16 len;
2017 			u8 enable;
2018 			u8 pad[3];
2019 		} __packed enable;
2020 	} __packed req = {
2021 		.hdr = {
2022 			.band_idx = 0,
2023 		},
2024 		.enable = {
2025 			.tag = cpu_to_le16(UNI_SNIFFER_ENABLE),
2026 			.len = cpu_to_le16(sizeof(struct sniffer_enable_tlv)),
2027 			.enable = enable,
2028 		},
2029 	};
2030 
2031 	mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req), true);
2032 
2033 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req),
2034 				 true);
2035 }
2036 
2037 int mt7925_mcu_config_sniffer(struct mt792x_vif *vif,
2038 			      struct ieee80211_chanctx_conf *ctx)
2039 {
2040 	struct mt76_phy *mphy = vif->phy->mt76;
2041 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def : &mphy->chandef;
2042 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2043 
2044 	static const u8 ch_band[] = {
2045 		[NL80211_BAND_2GHZ] = 1,
2046 		[NL80211_BAND_5GHZ] = 2,
2047 		[NL80211_BAND_6GHZ] = 3,
2048 	};
2049 	static const u8 ch_width[] = {
2050 		[NL80211_CHAN_WIDTH_20_NOHT] = 0,
2051 		[NL80211_CHAN_WIDTH_20] = 0,
2052 		[NL80211_CHAN_WIDTH_40] = 0,
2053 		[NL80211_CHAN_WIDTH_80] = 1,
2054 		[NL80211_CHAN_WIDTH_160] = 2,
2055 		[NL80211_CHAN_WIDTH_80P80] = 3,
2056 		[NL80211_CHAN_WIDTH_5] = 4,
2057 		[NL80211_CHAN_WIDTH_10] = 5,
2058 		[NL80211_CHAN_WIDTH_320] = 6,
2059 	};
2060 
2061 	struct {
2062 		struct {
2063 			u8 band_idx;
2064 			u8 pad[3];
2065 		} __packed hdr;
2066 		struct config_tlv {
2067 			__le16 tag;
2068 			__le16 len;
2069 			u16 aid;
2070 			u8 ch_band;
2071 			u8 bw;
2072 			u8 control_ch;
2073 			u8 sco;
2074 			u8 center_ch;
2075 			u8 center_ch2;
2076 			u8 drop_err;
2077 			u8 pad[3];
2078 		} __packed tlv;
2079 	} __packed req = {
2080 		.hdr = {
2081 			.band_idx = 0,
2082 		},
2083 		.tlv = {
2084 			.tag = cpu_to_le16(UNI_SNIFFER_CONFIG),
2085 			.len = cpu_to_le16(sizeof(req.tlv)),
2086 			.control_ch = chandef->chan->hw_value,
2087 			.center_ch = ieee80211_frequency_to_channel(freq1),
2088 			.drop_err = 1,
2089 		},
2090 	};
2091 
2092 	if (chandef->chan->band < ARRAY_SIZE(ch_band))
2093 		req.tlv.ch_band = ch_band[chandef->chan->band];
2094 	if (chandef->width < ARRAY_SIZE(ch_width))
2095 		req.tlv.bw = ch_width[chandef->width];
2096 
2097 	if (freq2)
2098 		req.tlv.center_ch2 = ieee80211_frequency_to_channel(freq2);
2099 
2100 	if (req.tlv.control_ch < req.tlv.center_ch)
2101 		req.tlv.sco = 1; /* SCA */
2102 	else if (req.tlv.control_ch > req.tlv.center_ch)
2103 		req.tlv.sco = 3; /* SCB */
2104 
2105 	return mt76_mcu_send_msg(mphy->dev, MCU_UNI_CMD(SNIFFER),
2106 				 &req, sizeof(req), true);
2107 }
2108 
2109 int
2110 mt7925_mcu_uni_add_beacon_offload(struct mt792x_dev *dev,
2111 				  struct ieee80211_hw *hw,
2112 				  struct ieee80211_vif *vif,
2113 				  bool enable)
2114 {
2115 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
2116 	struct ieee80211_mutable_offsets offs;
2117 	struct {
2118 		struct req_hdr {
2119 			u8 bss_idx;
2120 			u8 pad[3];
2121 		} __packed hdr;
2122 		struct bcn_content_tlv {
2123 			__le16 tag;
2124 			__le16 len;
2125 			__le16 tim_ie_pos;
2126 			__le16 csa_ie_pos;
2127 			__le16 bcc_ie_pos;
2128 			/* 0: disable beacon offload
2129 			 * 1: enable beacon offload
2130 			 * 2: update probe respond offload
2131 			 */
2132 			u8 enable;
2133 			/* 0: legacy format (TXD + payload)
2134 			 * 1: only cap field IE
2135 			 */
2136 			u8 type;
2137 			__le16 pkt_len;
2138 			u8 pkt[512];
2139 		} __packed beacon_tlv;
2140 	} req = {
2141 		.hdr = {
2142 			.bss_idx = mvif->bss_conf.mt76.idx,
2143 		},
2144 		.beacon_tlv = {
2145 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
2146 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
2147 			.enable = enable,
2148 			.type = 1,
2149 		},
2150 	};
2151 	struct sk_buff *skb;
2152 	u8 cap_offs;
2153 
2154 	/* support enable/update process only
2155 	 * disable flow would be handled in bss stop handler automatically
2156 	 */
2157 	if (!enable)
2158 		return -EOPNOTSUPP;
2159 
2160 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs, 0);
2161 	if (!skb)
2162 		return -EINVAL;
2163 
2164 	cap_offs = offsetof(struct ieee80211_mgmt, u.beacon.capab_info);
2165 	if (!skb_pull(skb, cap_offs)) {
2166 		dev_err(dev->mt76.dev, "beacon format err\n");
2167 		dev_kfree_skb(skb);
2168 		return -EINVAL;
2169 	}
2170 
2171 	if (skb->len > 512) {
2172 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
2173 		dev_kfree_skb(skb);
2174 		return -EINVAL;
2175 	}
2176 
2177 	memcpy(req.beacon_tlv.pkt, skb->data, skb->len);
2178 	req.beacon_tlv.pkt_len = cpu_to_le16(skb->len);
2179 	offs.tim_offset -= cap_offs;
2180 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(offs.tim_offset);
2181 
2182 	if (offs.cntdwn_counter_offs[0]) {
2183 		u16 csa_offs;
2184 
2185 		csa_offs = offs.cntdwn_counter_offs[0] - cap_offs - 4;
2186 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
2187 	}
2188 	dev_kfree_skb(skb);
2189 
2190 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
2191 				 &req, sizeof(req), true);
2192 }
2193 
2194 static
2195 void mt7925_mcu_bss_rlm_tlv(struct sk_buff *skb, struct mt76_phy *phy,
2196 			    struct ieee80211_bss_conf *link_conf,
2197 			    struct ieee80211_chanctx_conf *ctx)
2198 {
2199 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2200 						  &link_conf->chanreq.oper;
2201 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2202 	enum nl80211_band band = chandef->chan->band;
2203 	struct bss_rlm_tlv *req;
2204 	struct tlv *tlv;
2205 
2206 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RLM, sizeof(*req));
2207 	req = (struct bss_rlm_tlv *)tlv;
2208 	req->control_channel = chandef->chan->hw_value;
2209 	req->center_chan = ieee80211_frequency_to_channel(freq1);
2210 	req->center_chan2 = 0;
2211 	req->tx_streams = hweight8(phy->antenna_mask);
2212 	req->ht_op_info = 4; /* set HT 40M allowed */
2213 	req->rx_streams = hweight8(phy->antenna_mask);
2214 	req->center_chan2 = 0;
2215 	req->sco = 0;
2216 	req->band = 1;
2217 
2218 	switch (band) {
2219 	case NL80211_BAND_2GHZ:
2220 		req->band = 1;
2221 		break;
2222 	case NL80211_BAND_5GHZ:
2223 		req->band = 2;
2224 		break;
2225 	case NL80211_BAND_6GHZ:
2226 		req->band = 3;
2227 		break;
2228 	default:
2229 		break;
2230 	}
2231 
2232 	switch (chandef->width) {
2233 	case NL80211_CHAN_WIDTH_40:
2234 		req->bw = CMD_CBW_40MHZ;
2235 		break;
2236 	case NL80211_CHAN_WIDTH_80:
2237 		req->bw = CMD_CBW_80MHZ;
2238 		break;
2239 	case NL80211_CHAN_WIDTH_80P80:
2240 		req->bw = CMD_CBW_8080MHZ;
2241 		req->center_chan2 = ieee80211_frequency_to_channel(freq2);
2242 		break;
2243 	case NL80211_CHAN_WIDTH_160:
2244 		req->bw = CMD_CBW_160MHZ;
2245 		break;
2246 	case NL80211_CHAN_WIDTH_5:
2247 		req->bw = CMD_CBW_5MHZ;
2248 		break;
2249 	case NL80211_CHAN_WIDTH_10:
2250 		req->bw = CMD_CBW_10MHZ;
2251 		break;
2252 	case NL80211_CHAN_WIDTH_20_NOHT:
2253 	case NL80211_CHAN_WIDTH_20:
2254 	default:
2255 		req->bw = CMD_CBW_20MHZ;
2256 		req->ht_op_info = 0;
2257 		break;
2258 	}
2259 
2260 	if (req->control_channel < req->center_chan)
2261 		req->sco = 1; /* SCA */
2262 	else if (req->control_channel > req->center_chan)
2263 		req->sco = 3; /* SCB */
2264 }
2265 
2266 static struct sk_buff *
2267 __mt7925_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
2268 {
2269 	struct bss_req_hdr hdr = {
2270 		.bss_idx = mvif->idx,
2271 	};
2272 	struct sk_buff *skb;
2273 
2274 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
2275 	if (!skb)
2276 		return ERR_PTR(-ENOMEM);
2277 
2278 	skb_put_data(skb, &hdr, sizeof(hdr));
2279 
2280 	return skb;
2281 }
2282 
2283 int mt7925_mcu_set_chctx(struct mt76_phy *phy, struct mt76_vif *mvif,
2284 			 struct ieee80211_bss_conf *link_conf,
2285 			 struct ieee80211_chanctx_conf *ctx)
2286 {
2287 	struct sk_buff *skb;
2288 
2289 	skb = __mt7925_mcu_alloc_bss_req(phy->dev, mvif,
2290 					 MT7925_BSS_UPDATE_MAX_SIZE);
2291 	if (IS_ERR(skb))
2292 		return PTR_ERR(skb);
2293 
2294 	mt7925_mcu_bss_rlm_tlv(skb, phy, link_conf, ctx);
2295 
2296 	return mt76_mcu_skb_send_msg(phy->dev, skb,
2297 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2298 }
2299 
2300 static u8
2301 mt7925_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
2302 			enum nl80211_band band,
2303 			struct ieee80211_link_sta *link_sta)
2304 {
2305 	struct ieee80211_he_6ghz_capa *he_6ghz_capa;
2306 	const struct ieee80211_sta_eht_cap *eht_cap;
2307 	__le16 capa = 0;
2308 	u8 mode = 0;
2309 
2310 	if (link_sta) {
2311 		he_6ghz_capa = &link_sta->he_6ghz_capa;
2312 		eht_cap = &link_sta->eht_cap;
2313 	} else {
2314 		struct ieee80211_supported_band *sband;
2315 
2316 		sband = phy->hw->wiphy->bands[band];
2317 		capa = ieee80211_get_he_6ghz_capa(sband, vif->type);
2318 		he_6ghz_capa = (struct ieee80211_he_6ghz_capa *)&capa;
2319 
2320 		eht_cap = ieee80211_get_eht_iftype_cap(sband, vif->type);
2321 	}
2322 
2323 	switch (band) {
2324 	case NL80211_BAND_2GHZ:
2325 		if (eht_cap && eht_cap->has_eht)
2326 			mode |= PHY_MODE_BE_24G;
2327 		break;
2328 	case NL80211_BAND_5GHZ:
2329 		if (eht_cap && eht_cap->has_eht)
2330 			mode |= PHY_MODE_BE_5G;
2331 		break;
2332 	case NL80211_BAND_6GHZ:
2333 		if (he_6ghz_capa && he_6ghz_capa->capa)
2334 			mode |= PHY_MODE_AX_6G;
2335 
2336 		if (eht_cap && eht_cap->has_eht)
2337 			mode |= PHY_MODE_BE_6G;
2338 		break;
2339 	default:
2340 		break;
2341 	}
2342 
2343 	return mode;
2344 }
2345 
2346 static void
2347 mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
2348 			 struct ieee80211_bss_conf *link_conf,
2349 			 struct ieee80211_link_sta *link_sta,
2350 			 struct ieee80211_chanctx_conf *ctx,
2351 			 struct mt76_phy *phy, u16 wlan_idx,
2352 			 bool enable)
2353 {
2354 	struct ieee80211_vif *vif = link_conf->vif;
2355 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2356 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2357 						  &link_conf->chanreq.oper;
2358 	enum nl80211_band band = chandef->chan->band;
2359 	struct mt76_connac_bss_basic_tlv *basic_req;
2360 	struct mt792x_link_sta *mlink;
2361 	struct tlv *tlv;
2362 	int conn_type;
2363 	u8 idx;
2364 
2365 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*basic_req));
2366 	basic_req = (struct mt76_connac_bss_basic_tlv *)tlv;
2367 
2368 	idx = mconf->mt76.omac_idx > EXT_BSSID_START ? HW_BSSID_0 :
2369 						      mconf->mt76.omac_idx;
2370 	basic_req->hw_bss_idx = idx;
2371 
2372 	basic_req->phymode_ext = mt7925_get_phy_mode_ext(phy, vif, band,
2373 							 link_sta);
2374 
2375 	if (band == NL80211_BAND_2GHZ)
2376 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_ERP_INDEX);
2377 	else
2378 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_OFDM_INDEX);
2379 
2380 	memcpy(basic_req->bssid, link_conf->bssid, ETH_ALEN);
2381 	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, link_sta);
2382 	basic_req->bcn_interval = cpu_to_le16(link_conf->beacon_int);
2383 	basic_req->dtim_period = link_conf->dtim_period;
2384 	basic_req->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
2385 	basic_req->link_idx = mconf->mt76.idx;
2386 
2387 	if (link_sta) {
2388 		struct mt792x_sta *msta;
2389 
2390 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
2391 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
2392 
2393 	} else {
2394 		mlink = &mconf->vif->sta.deflink;
2395 	}
2396 
2397 	basic_req->sta_idx = cpu_to_le16(mlink->wcid.idx);
2398 	basic_req->omac_idx = mconf->mt76.omac_idx;
2399 	basic_req->band_idx = mconf->mt76.band_idx;
2400 	basic_req->wmm_idx = mconf->mt76.wmm_idx;
2401 	basic_req->conn_state = !enable;
2402 
2403 	switch (vif->type) {
2404 	case NL80211_IFTYPE_MESH_POINT:
2405 	case NL80211_IFTYPE_AP:
2406 		if (vif->p2p)
2407 			conn_type = CONNECTION_P2P_GO;
2408 		else
2409 			conn_type = CONNECTION_INFRA_AP;
2410 		basic_req->conn_type = cpu_to_le32(conn_type);
2411 		basic_req->active = enable;
2412 		break;
2413 	case NL80211_IFTYPE_STATION:
2414 		if (vif->p2p)
2415 			conn_type = CONNECTION_P2P_GC;
2416 		else
2417 			conn_type = CONNECTION_INFRA_STA;
2418 		basic_req->conn_type = cpu_to_le32(conn_type);
2419 		basic_req->active = true;
2420 		break;
2421 	case NL80211_IFTYPE_ADHOC:
2422 		basic_req->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
2423 		basic_req->active = true;
2424 		break;
2425 	default:
2426 		WARN_ON(1);
2427 		break;
2428 	}
2429 }
2430 
2431 static void
2432 mt7925_mcu_bss_sec_tlv(struct sk_buff *skb,
2433 		       struct ieee80211_bss_conf *link_conf)
2434 {
2435 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2436 	struct mt76_vif *mvif = &mconf->mt76;
2437 	struct bss_sec_tlv {
2438 		__le16 tag;
2439 		__le16 len;
2440 		u8 mode;
2441 		u8 status;
2442 		u8 cipher;
2443 		u8 __rsv;
2444 	} __packed * sec;
2445 	struct tlv *tlv;
2446 
2447 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_SEC, sizeof(*sec));
2448 	sec = (struct bss_sec_tlv *)tlv;
2449 
2450 	switch (mvif->cipher) {
2451 	case CONNAC3_CIPHER_GCMP_256:
2452 	case CONNAC3_CIPHER_GCMP:
2453 		sec->mode = MODE_WPA3_SAE;
2454 		sec->status = 8;
2455 		break;
2456 	case CONNAC3_CIPHER_AES_CCMP:
2457 		sec->mode = MODE_WPA2_PSK;
2458 		sec->status = 6;
2459 		break;
2460 	case CONNAC3_CIPHER_TKIP:
2461 		sec->mode = MODE_WPA2_PSK;
2462 		sec->status = 4;
2463 		break;
2464 	case CONNAC3_CIPHER_WEP104:
2465 	case CONNAC3_CIPHER_WEP40:
2466 		sec->mode = MODE_SHARED;
2467 		sec->status = 0;
2468 		break;
2469 	default:
2470 		sec->mode = MODE_OPEN;
2471 		sec->status = 1;
2472 		break;
2473 	}
2474 
2475 	sec->cipher = mvif->cipher;
2476 }
2477 
2478 static void
2479 mt7925_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt792x_phy *phy,
2480 		       struct ieee80211_chanctx_conf *ctx,
2481 		       struct ieee80211_bss_conf *link_conf)
2482 {
2483 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2484 						  &link_conf->chanreq.oper;
2485 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2486 	enum nl80211_band band = chandef->chan->band;
2487 	struct mt76_vif *mvif = &mconf->mt76;
2488 	struct bss_rate_tlv *bmc;
2489 	struct tlv *tlv;
2490 	u8 idx = mvif->mcast_rates_idx ?
2491 		 mvif->mcast_rates_idx : mvif->basic_rates_idx;
2492 
2493 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RATE, sizeof(*bmc));
2494 
2495 	bmc = (struct bss_rate_tlv *)tlv;
2496 
2497 	if (band == NL80211_BAND_2GHZ)
2498 		bmc->basic_rate = cpu_to_le16(HR_DSSS_ERP_BASIC_RATE);
2499 	else
2500 		bmc->basic_rate = cpu_to_le16(OFDM_BASIC_RATE);
2501 
2502 	bmc->short_preamble = (band == NL80211_BAND_2GHZ);
2503 	bmc->bc_fixed_rate = idx;
2504 	bmc->mc_fixed_rate = idx;
2505 }
2506 
2507 static void
2508 mt7925_mcu_bss_mld_tlv(struct sk_buff *skb,
2509 		       struct ieee80211_bss_conf *link_conf)
2510 {
2511 	struct ieee80211_vif *vif = link_conf->vif;
2512 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2513 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2514 	struct bss_mld_tlv *mld;
2515 	struct tlv *tlv;
2516 	bool is_mld;
2517 
2518 	is_mld = ieee80211_vif_is_mld(link_conf->vif) ||
2519 		 (hweight16(mvif->valid_links) > 1);
2520 
2521 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_MLD, sizeof(*mld));
2522 	mld = (struct bss_mld_tlv *)tlv;
2523 
2524 	mld->link_id = is_mld ? link_conf->link_id : 0xff;
2525 	/* apply the index of the primary link */
2526 	mld->group_mld_id = is_mld ? mvif->bss_conf.mt76.idx : 0xff;
2527 	mld->own_mld_id = mconf->mt76.idx + 32;
2528 	mld->remap_idx = 0xff;
2529 	mld->eml_enable = !!(link_conf->vif->cfg.eml_cap &
2530 			     IEEE80211_EML_CAP_EMLSR_SUPP);
2531 
2532 	memcpy(mld->mac_addr, vif->addr, ETH_ALEN);
2533 }
2534 
2535 static void
2536 mt7925_mcu_bss_qos_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf)
2537 {
2538 	struct mt76_connac_bss_qos_tlv *qos;
2539 	struct tlv *tlv;
2540 
2541 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_QBSS, sizeof(*qos));
2542 	qos = (struct mt76_connac_bss_qos_tlv *)tlv;
2543 	qos->qos = link_conf->qos;
2544 }
2545 
2546 static void
2547 mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2548 		      struct mt792x_phy *phy)
2549 {
2550 #define DEFAULT_HE_PE_DURATION		4
2551 #define DEFAULT_HE_DURATION_RTS_THRES	1023
2552 	const struct ieee80211_sta_he_cap *cap;
2553 	struct bss_info_uni_he *he;
2554 	struct tlv *tlv;
2555 
2556 	cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
2557 
2558 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
2559 
2560 	he = (struct bss_info_uni_he *)tlv;
2561 	he->he_pe_duration = link_conf->htc_trig_based_pkt_ext;
2562 	if (!he->he_pe_duration)
2563 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
2564 
2565 	he->he_rts_thres = cpu_to_le16(link_conf->frame_time_rts_th);
2566 	if (!he->he_rts_thres)
2567 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
2568 
2569 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
2570 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
2571 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
2572 }
2573 
2574 static void
2575 mt7925_mcu_bss_color_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2576 			 bool enable)
2577 {
2578 	struct bss_info_uni_bss_color *color;
2579 	struct tlv *tlv;
2580 
2581 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BSS_COLOR, sizeof(*color));
2582 	color = (struct bss_info_uni_bss_color *)tlv;
2583 
2584 	color->enable = enable ?
2585 		link_conf->he_bss_color.enabled : 0;
2586 	color->bss_color = enable ?
2587 		link_conf->he_bss_color.color : 0;
2588 }
2589 
2590 static void
2591 mt7925_mcu_bss_ifs_tlv(struct sk_buff *skb,
2592 		       struct ieee80211_bss_conf *link_conf)
2593 {
2594 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2595 	struct mt792x_phy *phy = mvif->phy;
2596 	struct bss_ifs_time_tlv *ifs_time;
2597 	struct tlv *tlv;
2598 
2599 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_IFS_TIME, sizeof(*ifs_time));
2600 	ifs_time = (struct bss_ifs_time_tlv *)tlv;
2601 	ifs_time->slot_valid = true;
2602 	ifs_time->slot_time = cpu_to_le16(phy->slottime);
2603 }
2604 
2605 int mt7925_mcu_set_timing(struct mt792x_phy *phy,
2606 			  struct ieee80211_bss_conf *link_conf)
2607 {
2608 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2609 	struct mt792x_dev *dev = phy->dev;
2610 	struct sk_buff *skb;
2611 
2612 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2613 					 MT7925_BSS_UPDATE_MAX_SIZE);
2614 	if (IS_ERR(skb))
2615 		return PTR_ERR(skb);
2616 
2617 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2618 
2619 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2620 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2621 }
2622 
2623 int mt7925_mcu_add_bss_info(struct mt792x_phy *phy,
2624 			    struct ieee80211_chanctx_conf *ctx,
2625 			    struct ieee80211_bss_conf *link_conf,
2626 			    struct ieee80211_link_sta *link_sta,
2627 			    int enable)
2628 {
2629 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2630 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2631 	struct mt792x_dev *dev = phy->dev;
2632 	struct mt792x_link_sta *mlink_bc;
2633 	struct sk_buff *skb;
2634 
2635 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2636 					 MT7925_BSS_UPDATE_MAX_SIZE);
2637 	if (IS_ERR(skb))
2638 		return PTR_ERR(skb);
2639 
2640 	mlink_bc = mt792x_sta_to_link(&mvif->sta, mconf->link_id);
2641 
2642 	/* bss_basic must be first */
2643 	mt7925_mcu_bss_basic_tlv(skb, link_conf, link_sta, ctx, phy->mt76,
2644 				 mlink_bc->wcid.idx, enable);
2645 	mt7925_mcu_bss_sec_tlv(skb, link_conf);
2646 	mt7925_mcu_bss_bmc_tlv(skb, phy, ctx, link_conf);
2647 	mt7925_mcu_bss_qos_tlv(skb, link_conf);
2648 	mt7925_mcu_bss_mld_tlv(skb, link_conf);
2649 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2650 
2651 	if (link_conf->he_support) {
2652 		mt7925_mcu_bss_he_tlv(skb, link_conf, phy);
2653 		mt7925_mcu_bss_color_tlv(skb, link_conf, enable);
2654 	}
2655 
2656 	if (enable)
2657 		mt7925_mcu_bss_rlm_tlv(skb, phy->mt76, link_conf, ctx);
2658 
2659 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2660 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2661 }
2662 
2663 int mt7925_mcu_set_dbdc(struct mt76_phy *phy, bool enable)
2664 {
2665 	struct mt76_dev *mdev = phy->dev;
2666 
2667 	struct mbmc_conf_tlv *conf;
2668 	struct mbmc_set_req *hdr;
2669 	struct sk_buff *skb;
2670 	struct tlv *tlv;
2671 	int max_len, err;
2672 
2673 	max_len = sizeof(*hdr) + sizeof(*conf);
2674 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2675 	if (!skb)
2676 		return -ENOMEM;
2677 
2678 	hdr = (struct mbmc_set_req *)skb_put(skb, sizeof(*hdr));
2679 
2680 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_MBMC_SETTING, sizeof(*conf));
2681 	conf = (struct mbmc_conf_tlv *)tlv;
2682 
2683 	conf->mbmc_en = enable;
2684 	conf->band = 0; /* unused */
2685 
2686 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SET_DBDC_PARMS),
2687 				    false);
2688 
2689 	return err;
2690 }
2691 
2692 #define MT76_CONNAC_SCAN_CHANNEL_TIME		60
2693 
2694 int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
2695 		       struct ieee80211_scan_request *scan_req)
2696 {
2697 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2698 	struct cfg80211_scan_request *sreq = &scan_req->req;
2699 	int n_ssids = 0, err, i, duration;
2700 	struct ieee80211_channel **scan_list = sreq->channels;
2701 	struct mt76_dev *mdev = phy->dev;
2702 	struct mt76_connac_mcu_scan_channel *chan;
2703 	struct sk_buff *skb;
2704 
2705 	struct scan_hdr_tlv *hdr;
2706 	struct scan_req_tlv *req;
2707 	struct scan_ssid_tlv *ssid;
2708 	struct scan_bssid_tlv *bssid;
2709 	struct scan_chan_info_tlv *chan_info;
2710 	struct scan_ie_tlv *ie;
2711 	struct scan_misc_tlv *misc;
2712 	struct tlv *tlv;
2713 	int max_len;
2714 
2715 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2716 				sizeof(*bssid) + sizeof(*chan_info) +
2717 				sizeof(*misc) + sizeof(*ie);
2718 
2719 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2720 	if (!skb)
2721 		return -ENOMEM;
2722 
2723 	set_bit(MT76_HW_SCANNING, &phy->state);
2724 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2725 
2726 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2727 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2728 	hdr->bss_idx = mvif->idx;
2729 
2730 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_REQ, sizeof(*req));
2731 	req = (struct scan_req_tlv *)tlv;
2732 	req->scan_type = sreq->n_ssids ? 1 : 0;
2733 	req->probe_req_num = sreq->n_ssids ? 2 : 0;
2734 
2735 	duration = MT76_CONNAC_SCAN_CHANNEL_TIME;
2736 	/* increase channel time for passive scan */
2737 	if (!sreq->n_ssids)
2738 		duration *= 2;
2739 	req->timeout_value = cpu_to_le16(sreq->n_channels * duration);
2740 	req->channel_min_dwell_time = cpu_to_le16(duration);
2741 	req->channel_dwell_time = cpu_to_le16(duration);
2742 
2743 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2744 	ssid = (struct scan_ssid_tlv *)tlv;
2745 	for (i = 0; i < sreq->n_ssids; i++) {
2746 		if (!sreq->ssids[i].ssid_len)
2747 			continue;
2748 
2749 		ssid->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
2750 		memcpy(ssid->ssids[i].ssid, sreq->ssids[i].ssid,
2751 		       sreq->ssids[i].ssid_len);
2752 		n_ssids++;
2753 	}
2754 	ssid->ssid_type = n_ssids ? BIT(2) : BIT(0);
2755 	ssid->ssids_num = n_ssids;
2756 
2757 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_BSSID, sizeof(*bssid));
2758 	bssid = (struct scan_bssid_tlv *)tlv;
2759 
2760 	memcpy(bssid->bssid, sreq->bssid, ETH_ALEN);
2761 
2762 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
2763 	chan_info = (struct scan_chan_info_tlv *)tlv;
2764 	chan_info->channels_num = min_t(u8, sreq->n_channels,
2765 					ARRAY_SIZE(chan_info->channels));
2766 	for (i = 0; i < chan_info->channels_num; i++) {
2767 		chan = &chan_info->channels[i];
2768 
2769 		switch (scan_list[i]->band) {
2770 		case NL80211_BAND_2GHZ:
2771 			chan->band = 1;
2772 			break;
2773 		case NL80211_BAND_6GHZ:
2774 			chan->band = 3;
2775 			break;
2776 		default:
2777 			chan->band = 2;
2778 			break;
2779 		}
2780 		chan->channel_num = scan_list[i]->hw_value;
2781 	}
2782 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
2783 
2784 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
2785 	ie = (struct scan_ie_tlv *)tlv;
2786 	if (sreq->ie_len > 0) {
2787 		memcpy(ie->ies, sreq->ie, sreq->ie_len);
2788 		ie->ies_len = cpu_to_le16(sreq->ie_len);
2789 	}
2790 
2791 	req->scan_func |= SCAN_FUNC_SPLIT_SCAN;
2792 
2793 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_MISC, sizeof(*misc));
2794 	misc = (struct scan_misc_tlv *)tlv;
2795 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
2796 		get_random_mask_addr(misc->random_mac, sreq->mac_addr,
2797 				     sreq->mac_addr_mask);
2798 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
2799 	}
2800 
2801 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2802 				    false);
2803 	if (err < 0)
2804 		clear_bit(MT76_HW_SCANNING, &phy->state);
2805 
2806 	return err;
2807 }
2808 EXPORT_SYMBOL_GPL(mt7925_mcu_hw_scan);
2809 
2810 int mt7925_mcu_sched_scan_req(struct mt76_phy *phy,
2811 			      struct ieee80211_vif *vif,
2812 			      struct cfg80211_sched_scan_request *sreq)
2813 {
2814 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2815 	struct ieee80211_channel **scan_list = sreq->channels;
2816 	struct mt76_connac_mcu_scan_channel *chan;
2817 	struct mt76_dev *mdev = phy->dev;
2818 	struct cfg80211_match_set *cfg_match;
2819 	struct cfg80211_ssid *cfg_ssid;
2820 
2821 	struct scan_hdr_tlv *hdr;
2822 	struct scan_sched_req *req;
2823 	struct scan_ssid_tlv *ssid;
2824 	struct scan_chan_info_tlv *chan_info;
2825 	struct scan_ie_tlv *ie;
2826 	struct scan_sched_ssid_match_sets *match;
2827 	struct sk_buff *skb;
2828 	struct tlv *tlv;
2829 	int i, max_len;
2830 
2831 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2832 		  sizeof(*chan_info) + sizeof(*ie) +
2833 		  sizeof(*match);
2834 
2835 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2836 	if (!skb)
2837 		return -ENOMEM;
2838 
2839 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2840 
2841 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2842 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2843 	hdr->bss_idx = mvif->idx;
2844 
2845 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_REQ, sizeof(*req));
2846 	req = (struct scan_sched_req *)tlv;
2847 	req->version = 1;
2848 
2849 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
2850 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
2851 
2852 	req->intervals_num = sreq->n_scan_plans;
2853 	for (i = 0; i < req->intervals_num; i++)
2854 		req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
2855 
2856 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2857 	ssid = (struct scan_ssid_tlv *)tlv;
2858 
2859 	ssid->ssids_num = sreq->n_ssids;
2860 	ssid->ssid_type = BIT(2);
2861 	for (i = 0; i < ssid->ssids_num; i++) {
2862 		cfg_ssid = &sreq->ssids[i];
2863 		memcpy(ssid->ssids[i].ssid, cfg_ssid->ssid, cfg_ssid->ssid_len);
2864 		ssid->ssids[i].ssid_len = cpu_to_le32(cfg_ssid->ssid_len);
2865 	}
2866 
2867 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID_MATCH_SETS, sizeof(*match));
2868 	match = (struct scan_sched_ssid_match_sets *)tlv;
2869 	match->match_num = sreq->n_match_sets;
2870 	for (i = 0; i < match->match_num; i++) {
2871 		cfg_match = &sreq->match_sets[i];
2872 		memcpy(match->match[i].ssid, cfg_match->ssid.ssid,
2873 		       cfg_match->ssid.ssid_len);
2874 		match->match[i].rssi_th = cpu_to_le32(cfg_match->rssi_thold);
2875 		match->match[i].ssid_len = cfg_match->ssid.ssid_len;
2876 	}
2877 
2878 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
2879 	chan_info = (struct scan_chan_info_tlv *)tlv;
2880 	chan_info->channels_num = min_t(u8, sreq->n_channels,
2881 					ARRAY_SIZE(chan_info->channels));
2882 	for (i = 0; i < chan_info->channels_num; i++) {
2883 		chan = &chan_info->channels[i];
2884 
2885 		switch (scan_list[i]->band) {
2886 		case NL80211_BAND_2GHZ:
2887 			chan->band = 1;
2888 			break;
2889 		case NL80211_BAND_6GHZ:
2890 			chan->band = 3;
2891 			break;
2892 		default:
2893 			chan->band = 2;
2894 			break;
2895 		}
2896 		chan->channel_num = scan_list[i]->hw_value;
2897 	}
2898 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
2899 
2900 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
2901 	ie = (struct scan_ie_tlv *)tlv;
2902 	if (sreq->ie_len > 0) {
2903 		memcpy(ie->ies, sreq->ie, sreq->ie_len);
2904 		ie->ies_len = cpu_to_le16(sreq->ie_len);
2905 	}
2906 
2907 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2908 				     false);
2909 }
2910 EXPORT_SYMBOL_GPL(mt7925_mcu_sched_scan_req);
2911 
2912 int
2913 mt7925_mcu_sched_scan_enable(struct mt76_phy *phy,
2914 			     struct ieee80211_vif *vif,
2915 			     bool enable)
2916 {
2917 	struct mt76_dev *mdev = phy->dev;
2918 	struct scan_sched_enable *req;
2919 	struct scan_hdr_tlv *hdr;
2920 	struct sk_buff *skb;
2921 	struct tlv *tlv;
2922 	int max_len;
2923 
2924 	max_len = sizeof(*hdr) + sizeof(*req);
2925 
2926 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2927 	if (!skb)
2928 		return -ENOMEM;
2929 
2930 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2931 	hdr->seq_num = 0;
2932 	hdr->bss_idx = 0;
2933 
2934 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_ENABLE, sizeof(*req));
2935 	req = (struct scan_sched_enable *)tlv;
2936 	req->active = !enable;
2937 
2938 	if (enable)
2939 		set_bit(MT76_HW_SCHED_SCANNING, &phy->state);
2940 	else
2941 		clear_bit(MT76_HW_SCHED_SCANNING, &phy->state);
2942 
2943 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2944 				     false);
2945 }
2946 
2947 int mt7925_mcu_cancel_hw_scan(struct mt76_phy *phy,
2948 			      struct ieee80211_vif *vif)
2949 {
2950 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2951 	struct {
2952 		struct scan_hdr {
2953 			u8 seq_num;
2954 			u8 bss_idx;
2955 			u8 pad[2];
2956 		} __packed hdr;
2957 		struct scan_cancel_tlv {
2958 			__le16 tag;
2959 			__le16 len;
2960 			u8 is_ext_channel;
2961 			u8 rsv[3];
2962 		} __packed cancel;
2963 	} req = {
2964 		.hdr = {
2965 			.seq_num = mvif->scan_seq_num,
2966 			.bss_idx = mvif->idx,
2967 		},
2968 		.cancel = {
2969 			.tag = cpu_to_le16(UNI_SCAN_CANCEL),
2970 			.len = cpu_to_le16(sizeof(struct scan_cancel_tlv)),
2971 		},
2972 	};
2973 
2974 	if (test_and_clear_bit(MT76_HW_SCANNING, &phy->state)) {
2975 		struct cfg80211_scan_info info = {
2976 			.aborted = true,
2977 		};
2978 
2979 		ieee80211_scan_completed(phy->hw, &info);
2980 	}
2981 
2982 	return mt76_mcu_send_msg(phy->dev, MCU_UNI_CMD(SCAN_REQ),
2983 				 &req, sizeof(req), false);
2984 }
2985 EXPORT_SYMBOL_GPL(mt7925_mcu_cancel_hw_scan);
2986 
2987 int mt7925_mcu_set_channel_domain(struct mt76_phy *phy)
2988 {
2989 	int len, i, n_max_channels, n_2ch = 0, n_5ch = 0, n_6ch = 0;
2990 	struct {
2991 		struct {
2992 			u8 alpha2[4]; /* regulatory_request.alpha2 */
2993 			u8 bw_2g; /* BW_20_40M		0
2994 				   * BW_20M		1
2995 				   * BW_20_40_80M	2
2996 				   * BW_20_40_80_160M	3
2997 				   * BW_20_40_80_8080M	4
2998 				   */
2999 			u8 bw_5g;
3000 			u8 bw_6g;
3001 			u8 pad;
3002 		} __packed hdr;
3003 		struct n_chan {
3004 			__le16 tag;
3005 			__le16 len;
3006 			u8 n_2ch;
3007 			u8 n_5ch;
3008 			u8 n_6ch;
3009 			u8 pad;
3010 		} __packed n_ch;
3011 	} req = {
3012 		.hdr = {
3013 			.bw_2g = 0,
3014 			.bw_5g = 3, /* BW_20_40_80_160M */
3015 			.bw_6g = 3,
3016 		},
3017 		.n_ch = {
3018 			.tag = cpu_to_le16(2),
3019 		},
3020 	};
3021 	struct mt76_connac_mcu_chan {
3022 		__le16 hw_value;
3023 		__le16 pad;
3024 		__le32 flags;
3025 	} __packed channel;
3026 	struct mt76_dev *dev = phy->dev;
3027 	struct ieee80211_channel *chan;
3028 	struct sk_buff *skb;
3029 
3030 	n_max_channels = phy->sband_2g.sband.n_channels +
3031 			 phy->sband_5g.sband.n_channels +
3032 			 phy->sband_6g.sband.n_channels;
3033 	len = sizeof(req) + n_max_channels * sizeof(channel);
3034 
3035 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
3036 	if (!skb)
3037 		return -ENOMEM;
3038 
3039 	skb_reserve(skb, sizeof(req));
3040 
3041 	for (i = 0; i < phy->sband_2g.sband.n_channels; i++) {
3042 		chan = &phy->sband_2g.sband.channels[i];
3043 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3044 			continue;
3045 
3046 		channel.hw_value = cpu_to_le16(chan->hw_value);
3047 		channel.flags = cpu_to_le32(chan->flags);
3048 		channel.pad = 0;
3049 
3050 		skb_put_data(skb, &channel, sizeof(channel));
3051 		n_2ch++;
3052 	}
3053 	for (i = 0; i < phy->sband_5g.sband.n_channels; i++) {
3054 		chan = &phy->sband_5g.sband.channels[i];
3055 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3056 			continue;
3057 
3058 		channel.hw_value = cpu_to_le16(chan->hw_value);
3059 		channel.flags = cpu_to_le32(chan->flags);
3060 		channel.pad = 0;
3061 
3062 		skb_put_data(skb, &channel, sizeof(channel));
3063 		n_5ch++;
3064 	}
3065 	for (i = 0; i < phy->sband_6g.sband.n_channels; i++) {
3066 		chan = &phy->sband_6g.sband.channels[i];
3067 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3068 			continue;
3069 
3070 		channel.hw_value = cpu_to_le16(chan->hw_value);
3071 		channel.flags = cpu_to_le32(chan->flags);
3072 		channel.pad = 0;
3073 
3074 		skb_put_data(skb, &channel, sizeof(channel));
3075 		n_6ch++;
3076 	}
3077 
3078 	BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(req.hdr.alpha2));
3079 	memcpy(req.hdr.alpha2, dev->alpha2, sizeof(dev->alpha2));
3080 	req.n_ch.n_2ch = n_2ch;
3081 	req.n_ch.n_5ch = n_5ch;
3082 	req.n_ch.n_6ch = n_6ch;
3083 	len = sizeof(struct n_chan) + (n_2ch + n_5ch + n_6ch) * sizeof(channel);
3084 	req.n_ch.len = cpu_to_le16(len);
3085 	memcpy(__skb_push(skb, sizeof(req)), &req, sizeof(req));
3086 
3087 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SET_DOMAIN_INFO),
3088 				     false);
3089 }
3090 EXPORT_SYMBOL_GPL(mt7925_mcu_set_channel_domain);
3091 
3092 static int
3093 __mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3094 		     enum environment_cap env_cap,
3095 		     struct mt7925_clc *clc, u8 idx)
3096 {
3097 	struct mt7925_clc_segment *seg;
3098 	struct sk_buff *skb;
3099 	struct {
3100 		u8 rsv[4];
3101 		__le16 tag;
3102 		__le16 len;
3103 
3104 		u8 ver;
3105 		u8 pad0;
3106 		__le16 size;
3107 		u8 idx;
3108 		u8 env;
3109 		u8 acpi_conf;
3110 		u8 pad1;
3111 		u8 alpha2[2];
3112 		u8 type[2];
3113 		u8 rsvd[64];
3114 	} __packed req = {
3115 		.tag = cpu_to_le16(0x3),
3116 		.len = cpu_to_le16(sizeof(req) - 4),
3117 
3118 		.idx = idx,
3119 		.env = env_cap,
3120 		.acpi_conf = mt792x_acpi_get_flags(&dev->phy),
3121 	};
3122 	int ret, valid_cnt = 0;
3123 	u8 i, *pos;
3124 
3125 	if (!clc)
3126 		return 0;
3127 
3128 	pos = clc->data + sizeof(*seg) * clc->nr_seg;
3129 	for (i = 0; i < clc->nr_country; i++) {
3130 		struct mt7925_clc_rule *rule = (struct mt7925_clc_rule *)pos;
3131 
3132 		pos += sizeof(*rule);
3133 		if (rule->alpha2[0] != alpha2[0] ||
3134 		    rule->alpha2[1] != alpha2[1])
3135 			continue;
3136 
3137 		seg = (struct mt7925_clc_segment *)clc->data
3138 			  + rule->seg_idx - 1;
3139 
3140 		memcpy(req.alpha2, rule->alpha2, 2);
3141 		memcpy(req.type, rule->type, 2);
3142 
3143 		req.size = cpu_to_le16(seg->len);
3144 		skb = __mt76_mcu_msg_alloc(&dev->mt76, &req,
3145 					   le16_to_cpu(req.size) + sizeof(req),
3146 					   sizeof(req), GFP_KERNEL);
3147 		if (!skb)
3148 			return -ENOMEM;
3149 		skb_put_data(skb, clc->data + seg->offset, seg->len);
3150 
3151 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3152 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3153 					    true);
3154 		if (ret < 0)
3155 			return ret;
3156 		valid_cnt++;
3157 	}
3158 
3159 	if (!valid_cnt)
3160 		return -ENOENT;
3161 
3162 	return 0;
3163 }
3164 
3165 int mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3166 		       enum environment_cap env_cap)
3167 {
3168 	struct mt792x_phy *phy = (struct mt792x_phy *)&dev->phy;
3169 	int i, ret;
3170 
3171 	/* submit all clc config */
3172 	for (i = 0; i < ARRAY_SIZE(phy->clc); i++) {
3173 		ret = __mt7925_mcu_set_clc(dev, alpha2, env_cap,
3174 					   phy->clc[i], i);
3175 
3176 		/* If no country found, set "00" as default */
3177 		if (ret == -ENOENT)
3178 			ret = __mt7925_mcu_set_clc(dev, "00",
3179 						   ENVIRON_INDOOR,
3180 						   phy->clc[i], i);
3181 		if (ret < 0)
3182 			return ret;
3183 	}
3184 	return 0;
3185 }
3186 
3187 int mt7925_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb,
3188 			    int cmd, int *wait_seq)
3189 {
3190 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
3191 	struct mt76_connac2_mcu_uni_txd *uni_txd;
3192 	struct mt76_connac2_mcu_txd *mcu_txd;
3193 	__le32 *txd;
3194 	u32 val;
3195 	u8 seq;
3196 
3197 	/* TODO: make dynamic based on msg type */
3198 	mdev->mcu.timeout = 20 * HZ;
3199 
3200 	seq = ++mdev->mcu.msg_seq & 0xf;
3201 	if (!seq)
3202 		seq = ++mdev->mcu.msg_seq & 0xf;
3203 
3204 	if (cmd == MCU_CMD(FW_SCATTER))
3205 		goto exit;
3206 
3207 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
3208 	txd = (__le32 *)skb_push(skb, txd_len);
3209 
3210 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
3211 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
3212 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
3213 	txd[0] = cpu_to_le32(val);
3214 
3215 	val = FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
3216 	txd[1] = cpu_to_le32(val);
3217 
3218 	if (cmd & __MCU_CMD_FIELD_UNI) {
3219 		uni_txd = (struct mt76_connac2_mcu_uni_txd *)txd;
3220 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
3221 		uni_txd->cid = cpu_to_le16(mcu_cmd);
3222 		uni_txd->s2d_index = MCU_S2D_H2N;
3223 		uni_txd->pkt_type = MCU_PKT_ID;
3224 		uni_txd->seq = seq;
3225 
3226 		if (cmd & __MCU_CMD_FIELD_QUERY)
3227 			uni_txd->option = MCU_CMD_UNI_QUERY_ACK;
3228 		else
3229 			uni_txd->option = MCU_CMD_UNI_EXT_ACK;
3230 
3231 		goto exit;
3232 	}
3233 
3234 	mcu_txd = (struct mt76_connac2_mcu_txd *)txd;
3235 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
3236 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
3237 					       MT_TX_MCU_PORT_RX_Q0));
3238 	mcu_txd->pkt_type = MCU_PKT_ID;
3239 	mcu_txd->seq = seq;
3240 	mcu_txd->cid = mcu_cmd;
3241 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
3242 
3243 	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
3244 		if (cmd & __MCU_CMD_FIELD_QUERY)
3245 			mcu_txd->set_query = MCU_Q_QUERY;
3246 		else
3247 			mcu_txd->set_query = MCU_Q_SET;
3248 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
3249 	} else {
3250 		mcu_txd->set_query = MCU_Q_NA;
3251 	}
3252 
3253 	if (cmd & __MCU_CMD_FIELD_WA)
3254 		mcu_txd->s2d_index = MCU_S2D_H2C;
3255 	else
3256 		mcu_txd->s2d_index = MCU_S2D_H2N;
3257 
3258 exit:
3259 	if (wait_seq)
3260 		*wait_seq = seq;
3261 
3262 	return 0;
3263 }
3264 EXPORT_SYMBOL_GPL(mt7925_mcu_fill_message);
3265 
3266 int mt7925_mcu_set_rts_thresh(struct mt792x_phy *phy, u32 val)
3267 {
3268 	struct {
3269 		u8 band_idx;
3270 		u8 _rsv[3];
3271 
3272 		__le16 tag;
3273 		__le16 len;
3274 		__le32 len_thresh;
3275 		__le32 pkt_thresh;
3276 	} __packed req = {
3277 		.band_idx = phy->mt76->band_idx,
3278 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RTS_THRESHOLD),
3279 		.len = cpu_to_le16(sizeof(req) - 4),
3280 		.len_thresh = cpu_to_le32(val),
3281 		.pkt_thresh = cpu_to_le32(0x2),
3282 	};
3283 
3284 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3285 				 &req, sizeof(req), true);
3286 }
3287 
3288 int mt7925_mcu_set_radio_en(struct mt792x_phy *phy, bool enable)
3289 {
3290 	struct {
3291 		u8 band_idx;
3292 		u8 _rsv[3];
3293 
3294 		__le16 tag;
3295 		__le16 len;
3296 		u8 enable;
3297 		u8 _rsv2[3];
3298 	} __packed req = {
3299 		.band_idx = phy->mt76->band_idx,
3300 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RADIO_ENABLE),
3301 		.len = cpu_to_le16(sizeof(req) - 4),
3302 		.enable = enable,
3303 	};
3304 
3305 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3306 				 &req, sizeof(req), true);
3307 }
3308 
3309 static void
3310 mt7925_mcu_build_sku(struct mt76_dev *dev, s8 *sku,
3311 		     struct mt76_power_limits *limits,
3312 		     enum nl80211_band band)
3313 {
3314 	int i, offset = sizeof(limits->cck);
3315 
3316 	memset(sku, 127, MT_CONNAC3_SKU_POWER_LIMIT);
3317 
3318 	if (band == NL80211_BAND_2GHZ) {
3319 		/* cck */
3320 		memcpy(sku, limits->cck, sizeof(limits->cck));
3321 	}
3322 
3323 	/* ofdm */
3324 	memcpy(&sku[offset], limits->ofdm, sizeof(limits->ofdm));
3325 	offset += (sizeof(limits->ofdm) * 5);
3326 
3327 	/* ht */
3328 	for (i = 0; i < 2; i++) {
3329 		memcpy(&sku[offset], limits->mcs[i], 8);
3330 		offset += 8;
3331 	}
3332 	sku[offset++] = limits->mcs[0][0];
3333 
3334 	/* vht */
3335 	for (i = 0; i < ARRAY_SIZE(limits->mcs); i++) {
3336 		memcpy(&sku[offset], limits->mcs[i],
3337 		       ARRAY_SIZE(limits->mcs[i]));
3338 		offset += 12;
3339 	}
3340 
3341 	/* he */
3342 	for (i = 0; i < ARRAY_SIZE(limits->ru); i++) {
3343 		memcpy(&sku[offset], limits->ru[i], ARRAY_SIZE(limits->ru[i]));
3344 		offset += ARRAY_SIZE(limits->ru[i]);
3345 	}
3346 
3347 	/* eht */
3348 	for (i = 0; i < ARRAY_SIZE(limits->eht); i++) {
3349 		memcpy(&sku[offset], limits->eht[i], ARRAY_SIZE(limits->eht[i]));
3350 		offset += ARRAY_SIZE(limits->eht[i]);
3351 	}
3352 }
3353 
3354 static int
3355 mt7925_mcu_rate_txpower_band(struct mt76_phy *phy,
3356 			     enum nl80211_band band)
3357 {
3358 	int tx_power, n_chan, last_ch, err = 0, idx = 0;
3359 	int i, sku_len, batch_size, batch_len = 3;
3360 	struct mt76_dev *dev = phy->dev;
3361 	static const u8 chan_list_2ghz[] = {
3362 		1, 2,  3,  4,  5,  6,  7,
3363 		8, 9, 10, 11, 12, 13, 14
3364 	};
3365 	static const u8 chan_list_5ghz[] = {
3366 		 36,  38,  40,  42,  44,  46,  48,
3367 		 50,  52,  54,  56,  58,  60,  62,
3368 		 64, 100, 102, 104, 106, 108, 110,
3369 		112, 114, 116, 118, 120, 122, 124,
3370 		126, 128, 132, 134, 136, 138, 140,
3371 		142, 144, 149, 151, 153, 155, 157,
3372 		159, 161, 165, 167
3373 	};
3374 	static const u8 chan_list_6ghz[] = {
3375 		  1,   3,   5,   7,   9,  11,  13,
3376 		 15,  17,  19,  21,  23,  25,  27,
3377 		 29,  33,  35,  37,  39,  41,  43,
3378 		 45,  47,  49,  51,  53,  55,  57,
3379 		 59,  61,  65,  67,  69,  71,  73,
3380 		 75,  77,  79,  81,  83,  85,  87,
3381 		 89,  91,  93,  97,  99, 101, 103,
3382 		105, 107, 109, 111, 113, 115, 117,
3383 		119, 121, 123, 125, 129, 131, 133,
3384 		135, 137, 139, 141, 143, 145, 147,
3385 		149, 151, 153, 155, 157, 161, 163,
3386 		165, 167, 169, 171, 173, 175, 177,
3387 		179, 181, 183, 185, 187, 189, 193,
3388 		195, 197, 199, 201, 203, 205, 207,
3389 		209, 211, 213, 215, 217, 219, 221,
3390 		225, 227, 229, 233
3391 	};
3392 	struct mt76_power_limits *limits;
3393 	struct mt7925_sku_tlv *sku_tlbv;
3394 	const u8 *ch_list;
3395 
3396 	sku_len = sizeof(*sku_tlbv);
3397 	tx_power = 2 * phy->hw->conf.power_level;
3398 	if (!tx_power)
3399 		tx_power = 127;
3400 
3401 	if (band == NL80211_BAND_2GHZ) {
3402 		n_chan = ARRAY_SIZE(chan_list_2ghz);
3403 		ch_list = chan_list_2ghz;
3404 		last_ch = chan_list_2ghz[ARRAY_SIZE(chan_list_2ghz) - 1];
3405 	} else if (band == NL80211_BAND_6GHZ) {
3406 		n_chan = ARRAY_SIZE(chan_list_6ghz);
3407 		ch_list = chan_list_6ghz;
3408 		last_ch = chan_list_6ghz[ARRAY_SIZE(chan_list_6ghz) - 1];
3409 	} else {
3410 		n_chan = ARRAY_SIZE(chan_list_5ghz);
3411 		ch_list = chan_list_5ghz;
3412 		last_ch = chan_list_5ghz[ARRAY_SIZE(chan_list_5ghz) - 1];
3413 	}
3414 	batch_size = DIV_ROUND_UP(n_chan, batch_len);
3415 
3416 	limits = devm_kmalloc(dev->dev, sizeof(*limits), GFP_KERNEL);
3417 	if (!limits)
3418 		return -ENOMEM;
3419 
3420 	sku_tlbv = devm_kmalloc(dev->dev, sku_len, GFP_KERNEL);
3421 	if (!sku_tlbv) {
3422 		devm_kfree(dev->dev, limits);
3423 		return -ENOMEM;
3424 	}
3425 
3426 	for (i = 0; i < batch_size; i++) {
3427 		struct mt7925_tx_power_limit_tlv *tx_power_tlv;
3428 		int j, msg_len, num_ch;
3429 		struct sk_buff *skb;
3430 
3431 		num_ch = i == batch_size - 1 ? n_chan % batch_len : batch_len;
3432 		msg_len = sizeof(*tx_power_tlv) + num_ch * sku_len;
3433 		skb = mt76_mcu_msg_alloc(dev, NULL, msg_len);
3434 		if (!skb) {
3435 			err = -ENOMEM;
3436 			goto out;
3437 		}
3438 
3439 		tx_power_tlv = (struct mt7925_tx_power_limit_tlv *)
3440 			       skb_put(skb, sizeof(*tx_power_tlv));
3441 
3442 		BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(tx_power_tlv->alpha2));
3443 		memcpy(tx_power_tlv->alpha2, dev->alpha2, sizeof(dev->alpha2));
3444 		tx_power_tlv->n_chan = num_ch;
3445 		tx_power_tlv->tag = cpu_to_le16(0x1);
3446 		tx_power_tlv->len = cpu_to_le16(sizeof(*tx_power_tlv));
3447 
3448 		switch (band) {
3449 		case NL80211_BAND_2GHZ:
3450 			tx_power_tlv->band = 1;
3451 			break;
3452 		case NL80211_BAND_6GHZ:
3453 			tx_power_tlv->band = 3;
3454 			break;
3455 		default:
3456 			tx_power_tlv->band = 2;
3457 			break;
3458 		}
3459 
3460 		for (j = 0; j < num_ch; j++, idx++) {
3461 			struct ieee80211_channel chan = {
3462 				.hw_value = ch_list[idx],
3463 				.band = band,
3464 			};
3465 			s8 reg_power, sar_power;
3466 
3467 			reg_power = mt76_connac_get_ch_power(phy, &chan,
3468 							     tx_power);
3469 			sar_power = mt76_get_sar_power(phy, &chan, reg_power);
3470 
3471 			mt76_get_rate_power_limits(phy, &chan, limits,
3472 						   sar_power);
3473 
3474 			tx_power_tlv->last_msg = ch_list[idx] == last_ch;
3475 			sku_tlbv->channel = ch_list[idx];
3476 
3477 			mt7925_mcu_build_sku(dev, sku_tlbv->pwr_limit,
3478 					     limits, band);
3479 			skb_put_data(skb, sku_tlbv, sku_len);
3480 		}
3481 		err = mt76_mcu_skb_send_msg(dev, skb,
3482 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3483 					    true);
3484 		if (err < 0)
3485 			goto out;
3486 	}
3487 
3488 out:
3489 	devm_kfree(dev->dev, sku_tlbv);
3490 	devm_kfree(dev->dev, limits);
3491 	return err;
3492 }
3493 
3494 int mt7925_mcu_set_rate_txpower(struct mt76_phy *phy)
3495 {
3496 	int err;
3497 
3498 	if (phy->cap.has_2ghz) {
3499 		err = mt7925_mcu_rate_txpower_band(phy,
3500 						   NL80211_BAND_2GHZ);
3501 		if (err < 0)
3502 			return err;
3503 	}
3504 
3505 	if (phy->cap.has_5ghz) {
3506 		err = mt7925_mcu_rate_txpower_band(phy,
3507 						   NL80211_BAND_5GHZ);
3508 		if (err < 0)
3509 			return err;
3510 	}
3511 
3512 	if (phy->cap.has_6ghz) {
3513 		err = mt7925_mcu_rate_txpower_band(phy,
3514 						   NL80211_BAND_6GHZ);
3515 		if (err < 0)
3516 			return err;
3517 	}
3518 
3519 	return 0;
3520 }
3521 
3522 int mt7925_mcu_set_rxfilter(struct mt792x_dev *dev, u32 fif,
3523 			    u8 bit_op, u32 bit_map)
3524 {
3525 	struct mt792x_phy *phy = &dev->phy;
3526 	struct {
3527 		u8 band_idx;
3528 		u8 rsv1[3];
3529 
3530 		__le16 tag;
3531 		__le16 len;
3532 		u8 mode;
3533 		u8 rsv2[3];
3534 		__le32 fif;
3535 		__le32 bit_map; /* bit_* for bitmap update */
3536 		u8 bit_op;
3537 		u8 pad[51];
3538 	} __packed req = {
3539 		.band_idx = phy->mt76->band_idx,
3540 		.tag = cpu_to_le16(UNI_BAND_CONFIG_SET_MAC80211_RX_FILTER),
3541 		.len = cpu_to_le16(sizeof(req) - 4),
3542 
3543 		.mode = fif ? 0 : 1,
3544 		.fif = cpu_to_le32(fif),
3545 		.bit_map = cpu_to_le32(bit_map),
3546 		.bit_op = bit_op,
3547 	};
3548 
3549 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3550 				 &req, sizeof(req), true);
3551 }
3552