xref: /linux/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c (revision 8ad8b8c2dc87fc3d34921330827914c7f2d74466)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2023 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include <linux/firmware.h>
6 #include "mt7925.h"
7 #include "mcu.h"
8 #include "mac.h"
9 
10 #define MT_STA_BFER			BIT(0)
11 #define MT_STA_BFEE			BIT(1)
12 
13 static bool mt7925_disable_clc;
14 module_param_named(disable_clc, mt7925_disable_clc, bool, 0644);
15 MODULE_PARM_DESC(disable_clc, "disable CLC support");
16 
17 int mt7925_mcu_parse_response(struct mt76_dev *mdev, int cmd,
18 			      struct sk_buff *skb, int seq)
19 {
20 	int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
21 	struct mt7925_mcu_rxd *rxd;
22 	int ret = 0;
23 
24 	if (!skb) {
25 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n", cmd, seq);
26 		mt792x_reset(mdev);
27 
28 		return -ETIMEDOUT;
29 	}
30 
31 	rxd = (struct mt7925_mcu_rxd *)skb->data;
32 	if (seq != rxd->seq)
33 		return -EAGAIN;
34 
35 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL) ||
36 	    cmd == MCU_CMD(PATCH_FINISH_REQ)) {
37 		skb_pull(skb, sizeof(*rxd) - 4);
38 		ret = *skb->data;
39 	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
40 		   cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
41 		   cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
42 		   cmd == MCU_UNI_CMD(HIF_CTRL) ||
43 		   cmd == MCU_UNI_CMD(OFFLOAD) ||
44 		   cmd == MCU_UNI_CMD(SUSPEND)) {
45 		struct mt7925_mcu_uni_event *event;
46 
47 		skb_pull(skb, sizeof(*rxd));
48 		event = (struct mt7925_mcu_uni_event *)skb->data;
49 		ret = le32_to_cpu(event->status);
50 		/* skip invalid event */
51 		if (mcu_cmd != event->cid)
52 			ret = -EAGAIN;
53 	} else {
54 		skb_pull(skb, sizeof(*rxd));
55 	}
56 
57 	return ret;
58 }
59 EXPORT_SYMBOL_GPL(mt7925_mcu_parse_response);
60 
61 int mt7925_mcu_regval(struct mt792x_dev *dev, u32 regidx, u32 *val, bool set)
62 {
63 #define MT_RF_REG_HDR           GENMASK(31, 24)
64 #define MT_RF_REG_ANT           GENMASK(23, 16)
65 #define RF_REG_PREFIX           0x99
66 	struct {
67 		u8 __rsv[4];
68 		union {
69 			struct uni_cmd_access_reg_basic {
70 				__le16 tag;
71 				__le16 len;
72 				__le32 idx;
73 				__le32 data;
74 			} __packed reg;
75 			struct uni_cmd_access_rf_reg_basic {
76 				__le16 tag;
77 				__le16 len;
78 				__le16 ant;
79 				u8 __rsv[2];
80 				__le32 idx;
81 				__le32 data;
82 			} __packed rf_reg;
83 		};
84 	} __packed * res, req;
85 	struct sk_buff *skb;
86 	int ret;
87 
88 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX) {
89 		req.rf_reg.tag = cpu_to_le16(UNI_CMD_ACCESS_RF_REG_BASIC);
90 		req.rf_reg.len = cpu_to_le16(sizeof(req.rf_reg));
91 		req.rf_reg.ant = cpu_to_le16(u32_get_bits(regidx, MT_RF_REG_ANT));
92 		req.rf_reg.idx = cpu_to_le32(regidx);
93 		req.rf_reg.data = set ? cpu_to_le32(*val) : 0;
94 	} else {
95 		req.reg.tag = cpu_to_le16(UNI_CMD_ACCESS_REG_BASIC);
96 		req.reg.len = cpu_to_le16(sizeof(req.reg));
97 		req.reg.idx = cpu_to_le32(regidx);
98 		req.reg.data = set ? cpu_to_le32(*val) : 0;
99 	}
100 
101 	if (set)
102 		return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(REG_ACCESS),
103 					 &req, sizeof(req), true);
104 
105 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
106 					MCU_WM_UNI_CMD_QUERY(REG_ACCESS),
107 					&req, sizeof(req), true, &skb);
108 	if (ret)
109 		return ret;
110 
111 	res = (void *)skb->data;
112 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX)
113 		*val = le32_to_cpu(res->rf_reg.data);
114 	else
115 		*val = le32_to_cpu(res->reg.data);
116 
117 	dev_kfree_skb(skb);
118 
119 	return 0;
120 }
121 EXPORT_SYMBOL_GPL(mt7925_mcu_regval);
122 
123 int mt7925_mcu_update_arp_filter(struct mt76_dev *dev,
124 				 struct ieee80211_bss_conf *link_conf)
125 {
126 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
127 	struct ieee80211_vif *mvif = link_conf->vif;
128 	struct sk_buff *skb;
129 	int i, len = min_t(int, mvif->cfg.arp_addr_cnt,
130 			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
131 	struct {
132 		struct {
133 			u8 bss_idx;
134 			u8 pad[3];
135 		} __packed hdr;
136 		struct mt7925_arpns_tlv arp;
137 	} req = {
138 		.hdr = {
139 			.bss_idx = mconf->mt76.idx,
140 		},
141 		.arp = {
142 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
143 			.len = cpu_to_le16(sizeof(req) - 4 + len * 2 * sizeof(__be32)),
144 			.ips_num = len,
145 			.enable = true,
146 		},
147 	};
148 
149 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(req) + len * 2 * sizeof(__be32));
150 	if (!skb)
151 		return -ENOMEM;
152 
153 	skb_put_data(skb, &req, sizeof(req));
154 	for (i = 0; i < len; i++) {
155 		skb_put_data(skb, &mvif->cfg.arp_addr_list[i], sizeof(__be32));
156 		skb_put_zero(skb, sizeof(__be32));
157 	}
158 
159 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
160 }
161 
162 #ifdef CONFIG_PM
163 static int
164 mt7925_connac_mcu_set_wow_ctrl(struct mt76_phy *phy, struct ieee80211_vif *vif,
165 			       bool suspend, struct cfg80211_wowlan *wowlan)
166 {
167 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
168 	struct mt76_dev *dev = phy->dev;
169 	struct {
170 		struct {
171 			u8 bss_idx;
172 			u8 pad[3];
173 		} __packed hdr;
174 		struct mt76_connac_wow_ctrl_tlv wow_ctrl_tlv;
175 		struct mt76_connac_wow_gpio_param_tlv gpio_tlv;
176 	} req = {
177 		.hdr = {
178 			.bss_idx = mvif->idx,
179 		},
180 		.wow_ctrl_tlv = {
181 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
182 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_ctrl_tlv)),
183 			.cmd = suspend ? 1 : 2,
184 		},
185 		.gpio_tlv = {
186 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_GPIO_PARAM),
187 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_gpio_param_tlv)),
188 			.gpio_pin = 0xff, /* follow fw about GPIO pin */
189 		},
190 	};
191 
192 	if (wowlan->magic_pkt)
193 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_MAGIC;
194 	if (wowlan->disconnect)
195 		req.wow_ctrl_tlv.trigger |= (UNI_WOW_DETECT_TYPE_DISCONNECT |
196 					     UNI_WOW_DETECT_TYPE_BCN_LOST);
197 	if (wowlan->nd_config) {
198 		mt7925_mcu_sched_scan_req(phy, vif, wowlan->nd_config);
199 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_SCH_SCAN_HIT;
200 		mt7925_mcu_sched_scan_enable(phy, vif, suspend);
201 	}
202 	if (wowlan->n_patterns)
203 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_BITMAP;
204 
205 	if (mt76_is_mmio(dev))
206 		req.wow_ctrl_tlv.wakeup_hif = WOW_PCIE;
207 	else if (mt76_is_usb(dev))
208 		req.wow_ctrl_tlv.wakeup_hif = WOW_USB;
209 	else if (mt76_is_sdio(dev))
210 		req.wow_ctrl_tlv.wakeup_hif = WOW_GPIO;
211 
212 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(SUSPEND), &req,
213 				 sizeof(req), true);
214 }
215 
216 static int
217 mt7925_mcu_set_wow_pattern(struct mt76_dev *dev,
218 			   struct ieee80211_vif *vif,
219 			   u8 index, bool enable,
220 			   struct cfg80211_pkt_pattern *pattern)
221 {
222 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
223 	struct mt7925_wow_pattern_tlv *tlv;
224 	struct sk_buff *skb;
225 	struct {
226 		u8 bss_idx;
227 		u8 pad[3];
228 	} __packed hdr = {
229 		.bss_idx = mvif->idx,
230 	};
231 
232 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(hdr) + sizeof(*tlv));
233 	if (!skb)
234 		return -ENOMEM;
235 
236 	skb_put_data(skb, &hdr, sizeof(hdr));
237 	tlv = (struct mt7925_wow_pattern_tlv *)skb_put(skb, sizeof(*tlv));
238 	tlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
239 	tlv->len = cpu_to_le16(sizeof(*tlv));
240 	tlv->bss_idx = 0xF;
241 	tlv->data_len = pattern->pattern_len;
242 	tlv->enable = enable;
243 	tlv->index = index;
244 	tlv->offset = 0;
245 
246 	memcpy(tlv->pattern, pattern->pattern, pattern->pattern_len);
247 	memcpy(tlv->mask, pattern->mask, DIV_ROUND_UP(pattern->pattern_len, 8));
248 
249 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SUSPEND), true);
250 }
251 
252 void mt7925_mcu_set_suspend_iter(void *priv, u8 *mac,
253 				 struct ieee80211_vif *vif)
254 {
255 	struct mt76_phy *phy = priv;
256 	bool suspend = !test_bit(MT76_STATE_RUNNING, &phy->state);
257 	struct ieee80211_hw *hw = phy->hw;
258 	struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
259 	int i;
260 
261 	mt76_connac_mcu_set_gtk_rekey(phy->dev, vif, suspend);
262 
263 	mt76_connac_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
264 
265 	for (i = 0; i < wowlan->n_patterns; i++)
266 		mt7925_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
267 					   &wowlan->patterns[i]);
268 	mt7925_connac_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
269 }
270 
271 #endif /* CONFIG_PM */
272 
273 static void
274 mt7925_mcu_connection_loss_iter(void *priv, u8 *mac,
275 				struct ieee80211_vif *vif)
276 {
277 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
278 	struct mt7925_uni_beacon_loss_event *event = priv;
279 
280 	if (mvif->idx != event->hdr.bss_idx)
281 		return;
282 
283 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER) ||
284 	    vif->type != NL80211_IFTYPE_STATION)
285 		return;
286 
287 	ieee80211_connection_loss(vif);
288 }
289 
290 static void
291 mt7925_mcu_connection_loss_event(struct mt792x_dev *dev, struct sk_buff *skb)
292 {
293 	struct mt7925_uni_beacon_loss_event *event;
294 	struct mt76_phy *mphy = &dev->mt76.phy;
295 
296 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd));
297 	event = (struct mt7925_uni_beacon_loss_event *)skb->data;
298 
299 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
300 					IEEE80211_IFACE_ITER_RESUME_ALL,
301 					mt7925_mcu_connection_loss_iter, event);
302 }
303 
304 static void
305 mt7925_mcu_roc_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
306 {
307 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
308 	struct mt7925_roc_grant_tlv *grant = priv;
309 
310 	if (ieee80211_vif_is_mld(vif) && vif->type == NL80211_IFTYPE_STATION)
311 		return;
312 
313 	if (mvif->idx != grant->bss_idx)
314 		return;
315 
316 	mvif->band_idx = grant->dbdcband;
317 }
318 
319 static void mt7925_mcu_roc_handle_grant(struct mt792x_dev *dev,
320 					struct tlv *tlv)
321 {
322 	struct ieee80211_hw *hw = dev->mt76.hw;
323 	struct mt7925_roc_grant_tlv *grant;
324 	int duration;
325 
326 	grant = (struct mt7925_roc_grant_tlv *)tlv;
327 
328 	/* should never happen */
329 	WARN_ON_ONCE((le16_to_cpu(grant->tag) != UNI_EVENT_ROC_GRANT));
330 
331 	if (grant->reqtype == MT7925_ROC_REQ_ROC)
332 		ieee80211_ready_on_channel(hw);
333 	else if (grant->reqtype == MT7925_ROC_REQ_JOIN)
334 		ieee80211_iterate_active_interfaces_atomic(hw,
335 						IEEE80211_IFACE_ITER_RESUME_ALL,
336 						mt7925_mcu_roc_iter, grant);
337 	dev->phy.roc_grant = true;
338 	wake_up(&dev->phy.roc_wait);
339 	duration = le32_to_cpu(grant->max_interval);
340 	mod_timer(&dev->phy.roc_timer,
341 		  jiffies + msecs_to_jiffies(duration));
342 }
343 
344 static void
345 mt7925_mcu_uni_roc_event(struct mt792x_dev *dev, struct sk_buff *skb)
346 {
347 	struct tlv *tlv;
348 	int i = 0;
349 
350 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
351 
352 	while (i < skb->len) {
353 		tlv = (struct tlv *)(skb->data + i);
354 
355 		switch (le16_to_cpu(tlv->tag)) {
356 		case UNI_EVENT_ROC_GRANT:
357 			mt7925_mcu_roc_handle_grant(dev, tlv);
358 			break;
359 		case UNI_EVENT_ROC_GRANT_SUB_LINK:
360 			break;
361 		}
362 
363 		i += le16_to_cpu(tlv->len);
364 	}
365 }
366 
367 static void
368 mt7925_mcu_scan_event(struct mt792x_dev *dev, struct sk_buff *skb)
369 {
370 	struct mt76_phy *mphy = &dev->mt76.phy;
371 	struct mt792x_phy *phy = mphy->priv;
372 
373 	spin_lock_bh(&dev->mt76.lock);
374 	__skb_queue_tail(&phy->scan_event_list, skb);
375 	spin_unlock_bh(&dev->mt76.lock);
376 
377 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
378 				     MT792x_HW_SCAN_TIMEOUT);
379 }
380 
381 static void
382 mt7925_mcu_tx_done_event(struct mt792x_dev *dev, struct sk_buff *skb)
383 {
384 #define UNI_EVENT_TX_DONE_MSG 0
385 #define UNI_EVENT_TX_DONE_RAW 1
386 	struct mt7925_mcu_txs_event {
387 		u8 ver;
388 		u8 rsv[3];
389 		u8 data[];
390 	} __packed * txs;
391 	struct tlv *tlv;
392 	u32 tlv_len;
393 
394 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
395 	tlv = (struct tlv *)skb->data;
396 	tlv_len = skb->len;
397 
398 	while (tlv_len > 0 && le16_to_cpu(tlv->len) <= tlv_len) {
399 		switch (le16_to_cpu(tlv->tag)) {
400 		case UNI_EVENT_TX_DONE_RAW:
401 			txs = (struct mt7925_mcu_txs_event *)tlv->data;
402 			mt7925_mac_add_txs(dev, txs->data);
403 			break;
404 		default:
405 			break;
406 		}
407 		tlv_len -= le16_to_cpu(tlv->len);
408 		tlv = (struct tlv *)((char *)(tlv) + le16_to_cpu(tlv->len));
409 	}
410 }
411 
412 static void
413 mt7925_mcu_uni_debug_msg_event(struct mt792x_dev *dev, struct sk_buff *skb)
414 {
415 	struct mt7925_uni_debug_msg {
416 		__le16 tag;
417 		__le16 len;
418 		u8 fmt;
419 		u8 rsv[3];
420 		u8 id;
421 		u8 type:3;
422 		u8 nr_args:5;
423 		union {
424 			struct idxlog {
425 				__le16 rsv;
426 				__le32 ts;
427 				__le32 idx;
428 				u8 data[];
429 			} __packed idx;
430 			struct txtlog {
431 				u8 len;
432 				u8 rsv;
433 				__le32 ts;
434 				u8 data[];
435 			} __packed txt;
436 		};
437 	} __packed * hdr;
438 
439 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
440 	hdr = (struct mt7925_uni_debug_msg *)skb->data;
441 
442 	if (hdr->id == 0x28) {
443 		skb_pull(skb, offsetof(struct mt7925_uni_debug_msg, id));
444 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", skb->len, skb->data);
445 		return;
446 	} else if (hdr->id != 0xa8) {
447 		return;
448 	}
449 
450 	if (hdr->type == 0) { /* idx log */
451 		int i, ret, len = PAGE_SIZE - 1, nr_val;
452 		struct page *page = dev_alloc_pages(get_order(len));
453 		__le32 *val;
454 		char *buf, *cur;
455 
456 		if (!page)
457 			return;
458 
459 		buf = page_address(page);
460 		cur = buf;
461 
462 		nr_val = (le16_to_cpu(hdr->len) - sizeof(*hdr)) / 4;
463 		val = (__le32 *)hdr->idx.data;
464 		for (i = 0; i < nr_val && len > 0; i++) {
465 			ret = snprintf(cur, len, "0x%x,", le32_to_cpu(val[i]));
466 			if (ret <= 0)
467 				break;
468 
469 			cur += ret;
470 			len -= ret;
471 		}
472 		if (cur > buf)
473 			wiphy_info(mt76_hw(dev)->wiphy, "idx: 0x%X,%d,%s",
474 				   le32_to_cpu(hdr->idx.idx), nr_val, buf);
475 		put_page(page);
476 	} else if (hdr->type == 2) { /* str log */
477 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", hdr->txt.len, hdr->txt.data);
478 	}
479 }
480 
481 static void
482 mt7925_mcu_uni_rx_unsolicited_event(struct mt792x_dev *dev,
483 				    struct sk_buff *skb)
484 {
485 	struct mt7925_mcu_rxd *rxd;
486 
487 	rxd = (struct mt7925_mcu_rxd *)skb->data;
488 
489 	switch (rxd->eid) {
490 	case MCU_UNI_EVENT_FW_LOG_2_HOST:
491 		mt7925_mcu_uni_debug_msg_event(dev, skb);
492 		break;
493 	case MCU_UNI_EVENT_ROC:
494 		mt7925_mcu_uni_roc_event(dev, skb);
495 		break;
496 	case MCU_UNI_EVENT_SCAN_DONE:
497 		mt7925_mcu_scan_event(dev, skb);
498 		return;
499 	case MCU_UNI_EVENT_TX_DONE:
500 		mt7925_mcu_tx_done_event(dev, skb);
501 		break;
502 	case MCU_UNI_EVENT_BSS_BEACON_LOSS:
503 		mt7925_mcu_connection_loss_event(dev, skb);
504 		break;
505 	case MCU_UNI_EVENT_COREDUMP:
506 		dev->fw_assert = true;
507 		mt76_connac_mcu_coredump_event(&dev->mt76, skb, &dev->coredump);
508 		return;
509 	default:
510 		break;
511 	}
512 	dev_kfree_skb(skb);
513 }
514 
515 void mt7925_mcu_rx_event(struct mt792x_dev *dev, struct sk_buff *skb)
516 {
517 	struct mt7925_mcu_rxd *rxd = (struct mt7925_mcu_rxd *)skb->data;
518 
519 	if (skb_linearize(skb))
520 		return;
521 
522 	if (rxd->option & MCU_UNI_CMD_UNSOLICITED_EVENT) {
523 		mt7925_mcu_uni_rx_unsolicited_event(dev, skb);
524 		return;
525 	}
526 
527 	mt76_mcu_rx_event(&dev->mt76, skb);
528 }
529 
530 static int
531 mt7925_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
532 		  struct mt76_wcid *wcid,
533 		  struct ieee80211_ampdu_params *params,
534 		  bool enable, bool tx)
535 {
536 	struct sta_rec_ba_uni *ba;
537 	struct sk_buff *skb;
538 	struct tlv *tlv;
539 	int len;
540 
541 	len = sizeof(struct sta_req_hdr) + sizeof(*ba);
542 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid,
543 					      len);
544 	if (IS_ERR(skb))
545 		return PTR_ERR(skb);
546 
547 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
548 
549 	ba = (struct sta_rec_ba_uni *)tlv;
550 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
551 	ba->winsize = cpu_to_le16(params->buf_size);
552 	ba->ssn = cpu_to_le16(params->ssn);
553 	ba->ba_en = enable << params->tid;
554 	ba->amsdu = params->amsdu;
555 	ba->tid = params->tid;
556 
557 	return mt76_mcu_skb_send_msg(dev, skb,
558 				     MCU_UNI_CMD(STA_REC_UPDATE), true);
559 }
560 
561 /** starec & wtbl **/
562 int mt7925_mcu_uni_tx_ba(struct mt792x_dev *dev,
563 			 struct ieee80211_vif *vif,
564 			 struct ieee80211_ampdu_params *params,
565 			 bool enable)
566 {
567 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
568 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
569 	struct mt792x_link_sta *mlink;
570 	struct mt792x_bss_conf *mconf;
571 	unsigned long usable_links = ieee80211_vif_usable_links(vif);
572 	struct mt76_wcid *wcid;
573 	u8 link_id, ret;
574 
575 	for_each_set_bit(link_id, &usable_links, IEEE80211_MLD_MAX_NUM_LINKS) {
576 		mconf = mt792x_vif_to_link(mvif, link_id);
577 		mlink = mt792x_sta_to_link(msta, link_id);
578 		wcid = &mlink->wcid;
579 
580 		if (enable && !params->amsdu)
581 			mlink->wcid.amsdu = false;
582 
583 		ret = mt7925_mcu_sta_ba(&dev->mt76, &mconf->mt76, wcid, params,
584 					enable, true);
585 		if (ret < 0)
586 			break;
587 	}
588 
589 	return ret;
590 }
591 
592 int mt7925_mcu_uni_rx_ba(struct mt792x_dev *dev,
593 			 struct ieee80211_vif *vif,
594 			 struct ieee80211_ampdu_params *params,
595 			 bool enable)
596 {
597 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
598 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
599 	struct mt792x_link_sta *mlink;
600 	struct mt792x_bss_conf *mconf;
601 	unsigned long usable_links = ieee80211_vif_usable_links(vif);
602 	struct mt76_wcid *wcid;
603 	u8 link_id, ret;
604 
605 	for_each_set_bit(link_id, &usable_links, IEEE80211_MLD_MAX_NUM_LINKS) {
606 		mconf = mt792x_vif_to_link(mvif, link_id);
607 		mlink = mt792x_sta_to_link(msta, link_id);
608 		wcid = &mlink->wcid;
609 
610 		ret = mt7925_mcu_sta_ba(&dev->mt76, &mconf->mt76, wcid, params,
611 					enable, false);
612 		if (ret < 0)
613 			break;
614 	}
615 
616 	return ret;
617 }
618 
619 static int mt7925_load_clc(struct mt792x_dev *dev, const char *fw_name)
620 {
621 	const struct mt76_connac2_fw_trailer *hdr;
622 	const struct mt76_connac2_fw_region *region;
623 	const struct mt7925_clc *clc;
624 	struct mt76_dev *mdev = &dev->mt76;
625 	struct mt792x_phy *phy = &dev->phy;
626 	const struct firmware *fw;
627 	int ret, i, len, offset = 0;
628 	u8 *clc_base = NULL;
629 
630 	if (mt7925_disable_clc ||
631 	    mt76_is_usb(&dev->mt76))
632 		return 0;
633 
634 	ret = request_firmware(&fw, fw_name, mdev->dev);
635 	if (ret)
636 		return ret;
637 
638 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
639 		dev_err(mdev->dev, "Invalid firmware\n");
640 		ret = -EINVAL;
641 		goto out;
642 	}
643 
644 	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
645 	for (i = 0; i < hdr->n_region; i++) {
646 		region = (const void *)((const u8 *)hdr -
647 					(hdr->n_region - i) * sizeof(*region));
648 		len = le32_to_cpu(region->len);
649 
650 		/* check if we have valid buffer size */
651 		if (offset + len > fw->size) {
652 			dev_err(mdev->dev, "Invalid firmware region\n");
653 			ret = -EINVAL;
654 			goto out;
655 		}
656 
657 		if ((region->feature_set & FW_FEATURE_NON_DL) &&
658 		    region->type == FW_TYPE_CLC) {
659 			clc_base = (u8 *)(fw->data + offset);
660 			break;
661 		}
662 		offset += len;
663 	}
664 
665 	if (!clc_base)
666 		goto out;
667 
668 	for (offset = 0; offset < len; offset += le32_to_cpu(clc->len)) {
669 		clc = (const struct mt7925_clc *)(clc_base + offset);
670 
671 		if (clc->idx >= ARRAY_SIZE(phy->clc))
672 			break;
673 
674 		/* do not init buf again if chip reset triggered */
675 		if (phy->clc[clc->idx])
676 			continue;
677 
678 		phy->clc[clc->idx] = devm_kmemdup(mdev->dev, clc,
679 						  le32_to_cpu(clc->len),
680 						  GFP_KERNEL);
681 
682 		if (!phy->clc[clc->idx]) {
683 			ret = -ENOMEM;
684 			goto out;
685 		}
686 	}
687 
688 	ret = mt7925_mcu_set_clc(dev, "00", ENVIRON_INDOOR);
689 out:
690 	release_firmware(fw);
691 
692 	return ret;
693 }
694 
695 int mt7925_mcu_fw_log_2_host(struct mt792x_dev *dev, u8 ctrl)
696 {
697 	struct {
698 		u8 _rsv[4];
699 
700 		__le16 tag;
701 		__le16 len;
702 		u8 ctrl;
703 		u8 interval;
704 		u8 _rsv2[2];
705 	} __packed req = {
706 		.tag = cpu_to_le16(UNI_WSYS_CONFIG_FW_LOG_CTRL),
707 		.len = cpu_to_le16(sizeof(req) - 4),
708 		.ctrl = ctrl,
709 	};
710 	int ret;
711 
712 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(WSYS_CONFIG),
713 					&req, sizeof(req), false, NULL);
714 	return ret;
715 }
716 
717 int mt7925_mcu_get_temperature(struct mt792x_phy *phy)
718 {
719 	struct {
720 		u8 _rsv[4];
721 
722 		__le16 tag;
723 		__le16 len;
724 		u8 _rsv2[4];
725 	} __packed req = {
726 		.tag = cpu_to_le16(0x0),
727 		.len = cpu_to_le16(sizeof(req) - 4),
728 	};
729 	struct mt7925_thermal_evt {
730 		u8 rsv[4];
731 		__le32 temperature;
732 	} __packed * evt;
733 	struct mt792x_dev *dev = phy->dev;
734 	int temperature, ret;
735 	struct sk_buff *skb;
736 
737 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
738 					MCU_WM_UNI_CMD_QUERY(THERMAL),
739 					&req, sizeof(req), true, &skb);
740 	if (ret)
741 		return ret;
742 
743 	skb_pull(skb, 4 + sizeof(struct tlv));
744 	evt = (struct mt7925_thermal_evt *)skb->data;
745 
746 	temperature = le32_to_cpu(evt->temperature);
747 
748 	dev_kfree_skb(skb);
749 
750 	return temperature;
751 }
752 
753 static void
754 mt7925_mcu_parse_phy_cap(struct mt792x_dev *dev, char *data)
755 {
756 	struct mt76_phy *mphy = &dev->mt76.phy;
757 	struct mt76_dev *mdev = mphy->dev;
758 	struct mt7925_mcu_phy_cap {
759 		u8 ht;
760 		u8 vht;
761 		u8 _5g;
762 		u8 max_bw;
763 		u8 nss;
764 		u8 dbdc;
765 		u8 tx_ldpc;
766 		u8 rx_ldpc;
767 		u8 tx_stbc;
768 		u8 rx_stbc;
769 		u8 hw_path;
770 		u8 he;
771 		u8 eht;
772 	} __packed * cap;
773 	enum {
774 		WF0_24G,
775 		WF0_5G
776 	};
777 
778 	cap = (struct mt7925_mcu_phy_cap *)data;
779 
780 	mdev->phy.antenna_mask = BIT(cap->nss) - 1;
781 	mdev->phy.chainmask = mdev->phy.antenna_mask;
782 	mdev->phy.cap.has_2ghz = cap->hw_path & BIT(WF0_24G);
783 	mdev->phy.cap.has_5ghz = cap->hw_path & BIT(WF0_5G);
784 	dev->has_eht = cap->eht;
785 }
786 
787 static void
788 mt7925_mcu_parse_eml_cap(struct mt792x_dev *dev, char *data)
789 {
790 	struct mt7925_mcu_eml_cap {
791 		u8 rsv[4];
792 		__le16 eml_cap;
793 		u8 rsv2[6];
794 	} __packed * cap;
795 
796 	cap = (struct mt7925_mcu_eml_cap *)data;
797 
798 	dev->phy.eml_cap = le16_to_cpu(cap->eml_cap);
799 }
800 
801 static int
802 mt7925_mcu_get_nic_capability(struct mt792x_dev *dev)
803 {
804 	struct mt76_phy *mphy = &dev->mt76.phy;
805 	struct {
806 		u8 _rsv[4];
807 
808 		__le16 tag;
809 		__le16 len;
810 	} __packed req = {
811 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_NIC_CAPA),
812 		.len = cpu_to_le16(sizeof(req) - 4),
813 	};
814 	struct mt76_connac_cap_hdr {
815 		__le16 n_element;
816 		u8 rsv[2];
817 	} __packed * hdr;
818 	struct sk_buff *skb;
819 	int ret, i;
820 
821 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
822 					&req, sizeof(req), true, &skb);
823 	if (ret)
824 		return ret;
825 
826 	hdr = (struct mt76_connac_cap_hdr *)skb->data;
827 	if (skb->len < sizeof(*hdr)) {
828 		ret = -EINVAL;
829 		goto out;
830 	}
831 
832 	skb_pull(skb, sizeof(*hdr));
833 
834 	for (i = 0; i < le16_to_cpu(hdr->n_element); i++) {
835 		struct tlv *tlv = (struct tlv *)skb->data;
836 		int len;
837 
838 		if (skb->len < sizeof(*tlv))
839 			break;
840 
841 		len = le16_to_cpu(tlv->len);
842 		if (skb->len < len)
843 			break;
844 
845 		switch (le16_to_cpu(tlv->tag)) {
846 		case MT_NIC_CAP_6G:
847 			mphy->cap.has_6ghz = !!tlv->data[0];
848 			break;
849 		case MT_NIC_CAP_MAC_ADDR:
850 			memcpy(mphy->macaddr, (void *)tlv->data, ETH_ALEN);
851 			break;
852 		case MT_NIC_CAP_PHY:
853 			mt7925_mcu_parse_phy_cap(dev, tlv->data);
854 			break;
855 		case MT_NIC_CAP_CHIP_CAP:
856 			dev->phy.chip_cap = le64_to_cpu(*(__le64 *)tlv->data);
857 			break;
858 		case MT_NIC_CAP_EML_CAP:
859 			mt7925_mcu_parse_eml_cap(dev, tlv->data);
860 			break;
861 		default:
862 			break;
863 		}
864 		skb_pull(skb, len);
865 	}
866 out:
867 	dev_kfree_skb(skb);
868 	return ret;
869 }
870 
871 int mt7925_mcu_chip_config(struct mt792x_dev *dev, const char *cmd)
872 {
873 	u16 len = strlen(cmd) + 1;
874 	struct {
875 		u8 _rsv[4];
876 		__le16 tag;
877 		__le16 len;
878 		struct mt76_connac_config config;
879 	} __packed req = {
880 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_CHIP_CFG),
881 		.len = cpu_to_le16(sizeof(req) - 4),
882 		.config = {
883 			.resp_type = 0,
884 			.type = 0,
885 			.data_size = cpu_to_le16(len),
886 		},
887 	};
888 
889 	memcpy(req.config.data, cmd, len);
890 
891 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
892 				 &req, sizeof(req), false);
893 }
894 
895 int mt7925_mcu_set_deep_sleep(struct mt792x_dev *dev, bool enable)
896 {
897 	char cmd[16];
898 
899 	snprintf(cmd, sizeof(cmd), "KeepFullPwr %d", !enable);
900 
901 	return mt7925_mcu_chip_config(dev, cmd);
902 }
903 EXPORT_SYMBOL_GPL(mt7925_mcu_set_deep_sleep);
904 
905 int mt7925_run_firmware(struct mt792x_dev *dev)
906 {
907 	int err;
908 
909 	err = mt792x_load_firmware(dev);
910 	if (err)
911 		return err;
912 
913 	err = mt7925_mcu_get_nic_capability(dev);
914 	if (err)
915 		return err;
916 
917 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
918 	err = mt7925_load_clc(dev, mt792x_ram_name(dev));
919 	if (err)
920 		return err;
921 
922 	return mt7925_mcu_fw_log_2_host(dev, 1);
923 }
924 EXPORT_SYMBOL_GPL(mt7925_run_firmware);
925 
926 static void
927 mt7925_mcu_sta_hdr_trans_tlv(struct sk_buff *skb,
928 			     struct ieee80211_vif *vif,
929 			     struct ieee80211_link_sta *link_sta)
930 {
931 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
932 	struct sta_rec_hdr_trans *hdr_trans;
933 	struct mt76_wcid *wcid;
934 	struct tlv *tlv;
935 
936 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HDR_TRANS, sizeof(*hdr_trans));
937 	hdr_trans = (struct sta_rec_hdr_trans *)tlv;
938 	hdr_trans->dis_rx_hdr_tran = true;
939 
940 	if (vif->type == NL80211_IFTYPE_STATION)
941 		hdr_trans->to_ds = true;
942 	else
943 		hdr_trans->from_ds = true;
944 
945 	if (link_sta) {
946 		struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
947 		struct mt792x_link_sta *mlink;
948 
949 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
950 		wcid = &mlink->wcid;
951 	} else {
952 		wcid = &mvif->sta.deflink.wcid;
953 	}
954 
955 	if (!wcid)
956 		return;
957 
958 	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
959 	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
960 		hdr_trans->to_ds = true;
961 		hdr_trans->from_ds = true;
962 	}
963 }
964 
965 int mt7925_mcu_wtbl_update_hdr_trans(struct mt792x_dev *dev,
966 				     struct ieee80211_vif *vif,
967 				     struct ieee80211_sta *sta,
968 				     int link_id)
969 {
970 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
971 	struct ieee80211_link_sta *link_sta = sta ? &sta->deflink : NULL;
972 	struct mt792x_link_sta *mlink;
973 	struct mt792x_bss_conf *mconf;
974 	struct mt792x_sta *msta;
975 	struct sk_buff *skb;
976 
977 	msta = sta ? (struct mt792x_sta *)sta->drv_priv : &mvif->sta;
978 
979 	mlink = mt792x_sta_to_link(msta, link_id);
980 	link_sta = mt792x_sta_to_link_sta(vif, sta, link_id);
981 	mconf = mt792x_vif_to_link(mvif, link_id);
982 
983 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
984 					      &mlink->wcid,
985 					      MT7925_STA_UPDATE_MAX_SIZE);
986 	if (IS_ERR(skb))
987 		return PTR_ERR(skb);
988 
989 	/* starec hdr trans */
990 	mt7925_mcu_sta_hdr_trans_tlv(skb, vif, link_sta);
991 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
992 				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
993 }
994 
995 int mt7925_mcu_set_tx(struct mt792x_dev *dev,
996 		      struct ieee80211_bss_conf *bss_conf)
997 {
998 #define MCU_EDCA_AC_PARAM	0
999 #define WMM_AIFS_SET		BIT(0)
1000 #define WMM_CW_MIN_SET		BIT(1)
1001 #define WMM_CW_MAX_SET		BIT(2)
1002 #define WMM_TXOP_SET		BIT(3)
1003 #define WMM_PARAM_SET		(WMM_AIFS_SET | WMM_CW_MIN_SET | \
1004 				 WMM_CW_MAX_SET | WMM_TXOP_SET)
1005 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(bss_conf);
1006 	struct {
1007 		u8 bss_idx;
1008 		u8 __rsv[3];
1009 	} __packed hdr = {
1010 		.bss_idx = mconf->mt76.idx,
1011 	};
1012 	struct sk_buff *skb;
1013 	int len = sizeof(hdr) + IEEE80211_NUM_ACS * sizeof(struct edca);
1014 	int ac;
1015 
1016 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
1017 	if (!skb)
1018 		return -ENOMEM;
1019 
1020 	skb_put_data(skb, &hdr, sizeof(hdr));
1021 
1022 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1023 		struct ieee80211_tx_queue_params *q = &mconf->queue_params[ac];
1024 		struct edca *e;
1025 		struct tlv *tlv;
1026 
1027 		tlv = mt76_connac_mcu_add_tlv(skb, MCU_EDCA_AC_PARAM, sizeof(*e));
1028 
1029 		e = (struct edca *)tlv;
1030 		e->set = WMM_PARAM_SET;
1031 		e->queue = ac;
1032 		e->aifs = q->aifs;
1033 		e->txop = cpu_to_le16(q->txop);
1034 
1035 		if (q->cw_min)
1036 			e->cw_min = fls(q->cw_min);
1037 		else
1038 			e->cw_min = 5;
1039 
1040 		if (q->cw_max)
1041 			e->cw_max = fls(q->cw_max);
1042 		else
1043 			e->cw_max = 10;
1044 	}
1045 
1046 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1047 				     MCU_UNI_CMD(EDCA_UPDATE), true);
1048 }
1049 
1050 static int
1051 mt7925_mcu_sta_key_tlv(struct mt76_wcid *wcid,
1052 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1053 		       struct sk_buff *skb,
1054 		       struct ieee80211_key_conf *key,
1055 		       enum set_key_cmd cmd,
1056 		       struct mt792x_sta *msta)
1057 {
1058 	struct mt792x_vif *mvif = msta->vif;
1059 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1060 	struct sta_rec_sec_uni *sec;
1061 	struct ieee80211_sta *sta;
1062 	struct ieee80211_vif *vif;
1063 	struct tlv *tlv;
1064 
1065 	sta = msta == &mvif->sta ?
1066 		      NULL :
1067 		      container_of((void *)msta, struct ieee80211_sta, drv_priv);
1068 	vif = container_of((void *)mvif, struct ieee80211_vif, drv_priv);
1069 
1070 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V3, sizeof(*sec));
1071 	sec = (struct sta_rec_sec_uni *)tlv;
1072 	sec->bss_idx = mconf->mt76.idx;
1073 	sec->is_authenticator = 0;
1074 	sec->mgmt_prot = 1; /* only used in MLO mode */
1075 	sec->wlan_idx = (u8)wcid->idx;
1076 
1077 	if (sta) {
1078 		struct ieee80211_link_sta *link_sta;
1079 
1080 		sec->tx_key = 1;
1081 		sec->key_type = 1;
1082 		link_sta = mt792x_sta_to_link_sta(vif, sta, wcid->link_id);
1083 
1084 		if (link_sta)
1085 			memcpy(sec->peer_addr, link_sta->addr, ETH_ALEN);
1086 	} else {
1087 		struct ieee80211_bss_conf *link_conf;
1088 
1089 		link_conf = mt792x_vif_to_bss_conf(vif, wcid->link_id);
1090 
1091 		if (link_conf)
1092 			memcpy(sec->peer_addr, link_conf->bssid, ETH_ALEN);
1093 	}
1094 
1095 	if (cmd == SET_KEY) {
1096 		u8 cipher;
1097 
1098 		sec->add = 1;
1099 		cipher = mt7925_mcu_get_cipher(key->cipher);
1100 		if (cipher == CONNAC3_CIPHER_NONE)
1101 			return -EOPNOTSUPP;
1102 
1103 		if (cipher == CONNAC3_CIPHER_BIP_CMAC_128) {
1104 			sec->cipher_id = CONNAC3_CIPHER_BIP_CMAC_128;
1105 			sec->key_id = sta_key_conf->keyidx;
1106 			sec->key_len = 32;
1107 			memcpy(sec->key, sta_key_conf->key, 16);
1108 			memcpy(sec->key + 16, key->key, 16);
1109 		} else {
1110 			sec->cipher_id = cipher;
1111 			sec->key_id = key->keyidx;
1112 			sec->key_len = key->keylen;
1113 			memcpy(sec->key, key->key, key->keylen);
1114 
1115 			if (cipher == CONNAC3_CIPHER_TKIP) {
1116 				/* Rx/Tx MIC keys are swapped */
1117 				memcpy(sec->key + 16, key->key + 24, 8);
1118 				memcpy(sec->key + 24, key->key + 16, 8);
1119 			}
1120 
1121 			/* store key_conf for BIP batch update */
1122 			if (cipher == CONNAC3_CIPHER_AES_CCMP) {
1123 				memcpy(sta_key_conf->key, key->key, key->keylen);
1124 				sta_key_conf->keyidx = key->keyidx;
1125 			}
1126 		}
1127 	} else {
1128 		sec->add = 0;
1129 	}
1130 
1131 	return 0;
1132 }
1133 
1134 int mt7925_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
1135 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1136 		       struct ieee80211_key_conf *key, int mcu_cmd,
1137 		       struct mt76_wcid *wcid, enum set_key_cmd cmd,
1138 		       struct mt792x_sta *msta)
1139 {
1140 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1141 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1142 	struct sk_buff *skb;
1143 	int ret;
1144 
1145 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, wcid,
1146 					      MT7925_STA_UPDATE_MAX_SIZE);
1147 	if (IS_ERR(skb))
1148 		return PTR_ERR(skb);
1149 
1150 	ret = mt7925_mcu_sta_key_tlv(wcid, sta_key_conf, skb, key, cmd, msta);
1151 	if (ret)
1152 		return ret;
1153 
1154 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
1155 }
1156 
1157 int mt7925_mcu_set_mlo_roc(struct mt792x_bss_conf *mconf, u16 sel_links,
1158 			   int duration, u8 token_id)
1159 {
1160 	struct mt792x_vif *mvif = mconf->vif;
1161 	struct ieee80211_vif *vif = container_of((void *)mvif,
1162 						 struct ieee80211_vif, drv_priv);
1163 	struct ieee80211_bss_conf *link_conf;
1164 	struct ieee80211_channel *chan;
1165 	const u8 ch_band[] = {
1166 		[NL80211_BAND_2GHZ] = 1,
1167 		[NL80211_BAND_5GHZ] = 2,
1168 		[NL80211_BAND_6GHZ] = 3,
1169 	};
1170 	enum mt7925_roc_req type;
1171 	int center_ch, i = 0;
1172 	bool is_AG_band = false;
1173 	struct {
1174 		u8 id;
1175 		u8 bss_idx;
1176 		u16 tag;
1177 		struct mt792x_bss_conf *mconf;
1178 		struct ieee80211_channel *chan;
1179 	} links[2];
1180 
1181 	struct {
1182 		struct {
1183 			u8 rsv[4];
1184 		} __packed hdr;
1185 		struct roc_acquire_tlv roc[2];
1186 	} __packed req = {
1187 			.roc[0].tag = cpu_to_le16(UNI_ROC_NUM),
1188 			.roc[0].len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1189 			.roc[1].tag = cpu_to_le16(UNI_ROC_NUM),
1190 			.roc[1].len = cpu_to_le16(sizeof(struct roc_acquire_tlv))
1191 	};
1192 
1193 	if (!mconf || hweight16(vif->valid_links) < 2 ||
1194 	    hweight16(sel_links) != 2)
1195 		return -EPERM;
1196 
1197 	for (i = 0; i < ARRAY_SIZE(links); i++) {
1198 		links[i].id = i ? __ffs(~BIT(mconf->link_id) & sel_links) :
1199 				 mconf->link_id;
1200 		link_conf = mt792x_vif_to_bss_conf(vif, links[i].id);
1201 		if (WARN_ON_ONCE(!link_conf))
1202 			return -EPERM;
1203 
1204 		links[i].chan = link_conf->chanreq.oper.chan;
1205 		if (WARN_ON_ONCE(!links[i].chan))
1206 			return -EPERM;
1207 
1208 		links[i].mconf = mt792x_vif_to_link(mvif, links[i].id);
1209 		links[i].tag = links[i].id == mconf->link_id ?
1210 			       UNI_ROC_ACQUIRE : UNI_ROC_SUB_LINK;
1211 
1212 		is_AG_band |= links[i].chan->band == NL80211_BAND_2GHZ;
1213 	}
1214 
1215 	if (vif->cfg.eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP)
1216 		type = is_AG_band ? MT7925_ROC_REQ_MLSR_AG :
1217 				    MT7925_ROC_REQ_MLSR_AA;
1218 	else
1219 		type = MT7925_ROC_REQ_JOIN;
1220 
1221 	for (i = 0; i < ARRAY_SIZE(links) && i < hweight16(vif->active_links); i++) {
1222 		if (WARN_ON_ONCE(!links[i].mconf || !links[i].chan))
1223 			continue;
1224 
1225 		chan = links[i].chan;
1226 		center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1227 		req.roc[i].len = cpu_to_le16(sizeof(struct roc_acquire_tlv));
1228 		req.roc[i].tag = cpu_to_le16(links[i].tag);
1229 		req.roc[i].tokenid = token_id;
1230 		req.roc[i].reqtype = type;
1231 		req.roc[i].maxinterval = cpu_to_le32(duration);
1232 		req.roc[i].bss_idx = links[i].mconf->mt76.idx;
1233 		req.roc[i].control_channel = chan->hw_value;
1234 		req.roc[i].bw = CMD_CBW_20MHZ;
1235 		req.roc[i].bw_from_ap = CMD_CBW_20MHZ;
1236 		req.roc[i].center_chan = center_ch;
1237 		req.roc[i].center_chan_from_ap = center_ch;
1238 		req.roc[i].center_chan2 = 0;
1239 		req.roc[i].center_chan2_from_ap = 0;
1240 
1241 		/* STR : 0xfe indicates BAND_ALL with enabling DBDC
1242 		 * EMLSR : 0xff indicates (BAND_AUTO) without DBDC
1243 		 */
1244 		req.roc[i].dbdcband = type == MT7925_ROC_REQ_JOIN ? 0xfe : 0xff;
1245 
1246 		if (chan->hw_value < center_ch)
1247 			req.roc[i].sco = 1; /* SCA */
1248 		else if (chan->hw_value > center_ch)
1249 			req.roc[i].sco = 3; /* SCB */
1250 
1251 		req.roc[i].band = ch_band[chan->band];
1252 	}
1253 
1254 	return mt76_mcu_send_msg(&mvif->phy->dev->mt76, MCU_UNI_CMD(ROC),
1255 				 &req, sizeof(req), true);
1256 }
1257 
1258 int mt7925_mcu_set_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1259 		       struct ieee80211_channel *chan, int duration,
1260 		       enum mt7925_roc_req type, u8 token_id)
1261 {
1262 	int center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1263 	struct mt792x_dev *dev = phy->dev;
1264 	struct {
1265 		struct {
1266 			u8 rsv[4];
1267 		} __packed hdr;
1268 		struct roc_acquire_tlv roc;
1269 	} __packed req = {
1270 		.roc = {
1271 			.tag = cpu_to_le16(UNI_ROC_ACQUIRE),
1272 			.len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1273 			.tokenid = token_id,
1274 			.reqtype = type,
1275 			.maxinterval = cpu_to_le32(duration),
1276 			.bss_idx = mconf->mt76.idx,
1277 			.control_channel = chan->hw_value,
1278 			.bw = CMD_CBW_20MHZ,
1279 			.bw_from_ap = CMD_CBW_20MHZ,
1280 			.center_chan = center_ch,
1281 			.center_chan_from_ap = center_ch,
1282 			.dbdcband = 0xff, /* auto */
1283 		},
1284 	};
1285 
1286 	if (chan->hw_value < center_ch)
1287 		req.roc.sco = 1; /* SCA */
1288 	else if (chan->hw_value > center_ch)
1289 		req.roc.sco = 3; /* SCB */
1290 
1291 	switch (chan->band) {
1292 	case NL80211_BAND_6GHZ:
1293 		req.roc.band = 3;
1294 		break;
1295 	case NL80211_BAND_5GHZ:
1296 		req.roc.band = 2;
1297 		break;
1298 	default:
1299 		req.roc.band = 1;
1300 		break;
1301 	}
1302 
1303 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1304 				 &req, sizeof(req), true);
1305 }
1306 
1307 int mt7925_mcu_abort_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1308 			 u8 token_id)
1309 {
1310 	struct mt792x_dev *dev = phy->dev;
1311 	struct {
1312 		struct {
1313 			u8 rsv[4];
1314 		} __packed hdr;
1315 		struct roc_abort_tlv {
1316 			__le16 tag;
1317 			__le16 len;
1318 			u8 bss_idx;
1319 			u8 tokenid;
1320 			u8 dbdcband;
1321 			u8 rsv[5];
1322 		} __packed abort;
1323 	} __packed req = {
1324 		.abort = {
1325 			.tag = cpu_to_le16(UNI_ROC_ABORT),
1326 			.len = cpu_to_le16(sizeof(struct roc_abort_tlv)),
1327 			.tokenid = token_id,
1328 			.bss_idx = mconf->mt76.idx,
1329 			.dbdcband = 0xff, /* auto*/
1330 		},
1331 	};
1332 
1333 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1334 				 &req, sizeof(req), true);
1335 }
1336 
1337 int mt7925_mcu_set_eeprom(struct mt792x_dev *dev)
1338 {
1339 	struct {
1340 		u8 _rsv[4];
1341 
1342 		__le16 tag;
1343 		__le16 len;
1344 		u8 buffer_mode;
1345 		u8 format;
1346 		__le16 buf_len;
1347 	} __packed req = {
1348 		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
1349 		.len = cpu_to_le16(sizeof(req) - 4),
1350 		.buffer_mode = EE_MODE_EFUSE,
1351 		.format = EE_FORMAT_WHOLE
1352 	};
1353 
1354 	return mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(EFUSE_CTRL),
1355 					 &req, sizeof(req), false, NULL);
1356 }
1357 EXPORT_SYMBOL_GPL(mt7925_mcu_set_eeprom);
1358 
1359 int mt7925_mcu_uni_bss_ps(struct mt792x_dev *dev,
1360 			  struct ieee80211_bss_conf *link_conf)
1361 {
1362 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1363 	struct {
1364 		struct {
1365 			u8 bss_idx;
1366 			u8 pad[3];
1367 		} __packed hdr;
1368 		struct ps_tlv {
1369 			__le16 tag;
1370 			__le16 len;
1371 			u8 ps_state; /* 0: device awake
1372 				      * 1: static power save
1373 				      * 2: dynamic power saving
1374 				      * 3: enter TWT power saving
1375 				      * 4: leave TWT power saving
1376 				      */
1377 			u8 pad[3];
1378 		} __packed ps;
1379 	} __packed ps_req = {
1380 		.hdr = {
1381 			.bss_idx = mconf->mt76.idx,
1382 		},
1383 		.ps = {
1384 			.tag = cpu_to_le16(UNI_BSS_INFO_PS),
1385 			.len = cpu_to_le16(sizeof(struct ps_tlv)),
1386 			.ps_state = link_conf->vif->cfg.ps ? 2 : 0,
1387 		},
1388 	};
1389 
1390 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1391 		return -EOPNOTSUPP;
1392 
1393 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1394 				 &ps_req, sizeof(ps_req), true);
1395 }
1396 
1397 int
1398 mt7925_mcu_uni_bss_bcnft(struct mt792x_dev *dev,
1399 			 struct ieee80211_bss_conf *link_conf, bool enable)
1400 {
1401 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1402 	struct {
1403 		struct {
1404 			u8 bss_idx;
1405 			u8 pad[3];
1406 		} __packed hdr;
1407 		struct bcnft_tlv {
1408 			__le16 tag;
1409 			__le16 len;
1410 			__le16 bcn_interval;
1411 			u8 dtim_period;
1412 			u8 bmc_delivered_ac;
1413 			u8 bmc_triggered_ac;
1414 			u8 pad[3];
1415 		} __packed bcnft;
1416 	} __packed bcnft_req = {
1417 		.hdr = {
1418 			.bss_idx = mconf->mt76.idx,
1419 		},
1420 		.bcnft = {
1421 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1422 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1423 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1424 			.dtim_period = link_conf->dtim_period,
1425 		},
1426 	};
1427 
1428 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1429 		return 0;
1430 
1431 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1432 				 &bcnft_req, sizeof(bcnft_req), true);
1433 }
1434 
1435 int
1436 mt7925_mcu_set_bss_pm(struct mt792x_dev *dev,
1437 		      struct ieee80211_bss_conf *link_conf,
1438 		      bool enable)
1439 {
1440 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1441 	struct {
1442 		struct {
1443 			u8 bss_idx;
1444 			u8 pad[3];
1445 		} __packed hdr;
1446 		struct bcnft_tlv {
1447 			__le16 tag;
1448 			__le16 len;
1449 			__le16 bcn_interval;
1450 			u8 dtim_period;
1451 			u8 bmc_delivered_ac;
1452 			u8 bmc_triggered_ac;
1453 			u8 pad[3];
1454 		} __packed enable;
1455 	} req = {
1456 		.hdr = {
1457 			.bss_idx = mconf->mt76.idx,
1458 		},
1459 		.enable = {
1460 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1461 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1462 			.dtim_period = link_conf->dtim_period,
1463 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1464 		},
1465 	};
1466 	struct {
1467 		struct {
1468 			u8 bss_idx;
1469 			u8 pad[3];
1470 		} __packed hdr;
1471 		struct pm_disable {
1472 			__le16 tag;
1473 			__le16 len;
1474 		} __packed disable;
1475 	} req1 = {
1476 		.hdr = {
1477 			.bss_idx = mconf->mt76.idx,
1478 		},
1479 		.disable = {
1480 			.tag = cpu_to_le16(UNI_BSS_INFO_PM_DISABLE),
1481 			.len = cpu_to_le16(sizeof(struct pm_disable))
1482 		},
1483 	};
1484 	int err;
1485 
1486 	err = mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1487 				&req1, sizeof(req1), true);
1488 	if (err < 0 || !enable)
1489 		return err;
1490 
1491 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1492 				 &req, sizeof(req), true);
1493 }
1494 
1495 static void
1496 mt7925_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1497 {
1498 	if (!link_sta->he_cap.has_he)
1499 		return;
1500 
1501 	mt76_connac_mcu_sta_he_tlv_v2(skb, link_sta->sta);
1502 }
1503 
1504 static void
1505 mt7925_mcu_sta_he_6g_tlv(struct sk_buff *skb,
1506 			 struct ieee80211_link_sta *link_sta)
1507 {
1508 	struct sta_rec_he_6g_capa *he_6g;
1509 	struct tlv *tlv;
1510 
1511 	if (!link_sta->he_6ghz_capa.capa)
1512 		return;
1513 
1514 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G, sizeof(*he_6g));
1515 
1516 	he_6g = (struct sta_rec_he_6g_capa *)tlv;
1517 	he_6g->capa = link_sta->he_6ghz_capa.capa;
1518 }
1519 
1520 static void
1521 mt7925_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1522 {
1523 	struct ieee80211_eht_mcs_nss_supp *mcs_map;
1524 	struct ieee80211_eht_cap_elem_fixed *elem;
1525 	struct sta_rec_eht *eht;
1526 	struct tlv *tlv;
1527 
1528 	if (!link_sta->eht_cap.has_eht)
1529 		return;
1530 
1531 	mcs_map = &link_sta->eht_cap.eht_mcs_nss_supp;
1532 	elem = &link_sta->eht_cap.eht_cap_elem;
1533 
1534 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT, sizeof(*eht));
1535 
1536 	eht = (struct sta_rec_eht *)tlv;
1537 	eht->tid_bitmap = 0xff;
1538 	eht->mac_cap = cpu_to_le16(*(u16 *)elem->mac_cap_info);
1539 	eht->phy_cap = cpu_to_le64(*(u64 *)elem->phy_cap_info);
1540 	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
1541 
1542 	if (link_sta->bandwidth == IEEE80211_STA_RX_BW_20)
1543 		memcpy(eht->mcs_map_bw20, &mcs_map->only_20mhz, sizeof(eht->mcs_map_bw20));
1544 	memcpy(eht->mcs_map_bw80, &mcs_map->bw._80, sizeof(eht->mcs_map_bw80));
1545 	memcpy(eht->mcs_map_bw160, &mcs_map->bw._160, sizeof(eht->mcs_map_bw160));
1546 }
1547 
1548 static void
1549 mt7925_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1550 {
1551 	struct sta_rec_ht *ht;
1552 	struct tlv *tlv;
1553 
1554 	if (!link_sta->ht_cap.ht_supported)
1555 		return;
1556 
1557 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1558 
1559 	ht = (struct sta_rec_ht *)tlv;
1560 	ht->ht_cap = cpu_to_le16(link_sta->ht_cap.cap);
1561 }
1562 
1563 static void
1564 mt7925_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1565 {
1566 	struct sta_rec_vht *vht;
1567 	struct tlv *tlv;
1568 
1569 	/* For 6G band, this tlv is necessary to let hw work normally */
1570 	if (!link_sta->he_6ghz_capa.capa && !link_sta->vht_cap.vht_supported)
1571 		return;
1572 
1573 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1574 
1575 	vht = (struct sta_rec_vht *)tlv;
1576 	vht->vht_cap = cpu_to_le32(link_sta->vht_cap.cap);
1577 	vht->vht_rx_mcs_map = link_sta->vht_cap.vht_mcs.rx_mcs_map;
1578 	vht->vht_tx_mcs_map = link_sta->vht_cap.vht_mcs.tx_mcs_map;
1579 }
1580 
1581 static void
1582 mt7925_mcu_sta_amsdu_tlv(struct sk_buff *skb,
1583 			 struct ieee80211_vif *vif,
1584 			 struct ieee80211_link_sta *link_sta)
1585 {
1586 	struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1587 	struct mt792x_link_sta *mlink;
1588 	struct sta_rec_amsdu *amsdu;
1589 	struct tlv *tlv;
1590 
1591 	if (vif->type != NL80211_IFTYPE_STATION &&
1592 	    vif->type != NL80211_IFTYPE_AP)
1593 		return;
1594 
1595 	if (!link_sta->agg.max_amsdu_len)
1596 		return;
1597 
1598 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1599 	amsdu = (struct sta_rec_amsdu *)tlv;
1600 	amsdu->max_amsdu_num = 8;
1601 	amsdu->amsdu_en = true;
1602 
1603 	mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1604 	mlink->wcid.amsdu = true;
1605 
1606 	switch (link_sta->agg.max_amsdu_len) {
1607 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1608 		amsdu->max_mpdu_size =
1609 			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1610 		return;
1611 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
1612 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1613 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1614 		return;
1615 	default:
1616 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1617 		return;
1618 	}
1619 }
1620 
1621 static void
1622 mt7925_mcu_sta_phy_tlv(struct sk_buff *skb,
1623 		       struct ieee80211_vif *vif,
1624 		       struct ieee80211_link_sta *link_sta)
1625 {
1626 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1627 	struct ieee80211_bss_conf *link_conf;
1628 	struct cfg80211_chan_def *chandef;
1629 	struct mt792x_bss_conf *mconf;
1630 	struct sta_rec_phy *phy;
1631 	struct tlv *tlv;
1632 	u8 af = 0, mm = 0;
1633 
1634 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1635 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1636 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1637 				    &link_conf->chanreq.oper;
1638 
1639 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PHY, sizeof(*phy));
1640 	phy = (struct sta_rec_phy *)tlv;
1641 	phy->phy_type = mt76_connac_get_phy_mode_v2(mvif->phy->mt76, vif,
1642 						    chandef->chan->band,
1643 						    link_sta);
1644 	phy->basic_rate = cpu_to_le16((u16)link_conf->basic_rates);
1645 	if (link_sta->ht_cap.ht_supported) {
1646 		af = link_sta->ht_cap.ampdu_factor;
1647 		mm = link_sta->ht_cap.ampdu_density;
1648 	}
1649 
1650 	if (link_sta->vht_cap.vht_supported) {
1651 		u8 vht_af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1652 				      link_sta->vht_cap.cap);
1653 
1654 		af = max_t(u8, af, vht_af);
1655 	}
1656 
1657 	if (link_sta->he_6ghz_capa.capa) {
1658 		af = le16_get_bits(link_sta->he_6ghz_capa.capa,
1659 				   IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1660 		mm = le16_get_bits(link_sta->he_6ghz_capa.capa,
1661 				   IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
1662 	}
1663 
1664 	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR, af) |
1665 		     FIELD_PREP(IEEE80211_HT_AMPDU_PARM_DENSITY, mm);
1666 	phy->max_ampdu_len = af;
1667 }
1668 
1669 static void
1670 mt7925_mcu_sta_state_v2_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
1671 			    struct ieee80211_link_sta *link_sta,
1672 			    struct ieee80211_vif *vif,
1673 			    u8 rcpi, u8 sta_state)
1674 {
1675 	struct sta_rec_state_v2 {
1676 		__le16 tag;
1677 		__le16 len;
1678 		u8 state;
1679 		u8 rsv[3];
1680 		__le32 flags;
1681 		u8 vht_opmode;
1682 		u8 action;
1683 		u8 rsv2[2];
1684 	} __packed * state;
1685 	struct tlv *tlv;
1686 
1687 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_STATE, sizeof(*state));
1688 	state = (struct sta_rec_state_v2 *)tlv;
1689 	state->state = sta_state;
1690 
1691 	if (link_sta->vht_cap.vht_supported) {
1692 		state->vht_opmode = link_sta->bandwidth;
1693 		state->vht_opmode |= link_sta->rx_nss <<
1694 			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
1695 	}
1696 }
1697 
1698 static void
1699 mt7925_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb,
1700 			     struct ieee80211_vif *vif,
1701 			     struct ieee80211_link_sta *link_sta)
1702 {
1703 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1704 	struct ieee80211_bss_conf *link_conf;
1705 	struct cfg80211_chan_def *chandef;
1706 	struct sta_rec_ra_info *ra_info;
1707 	struct mt792x_bss_conf *mconf;
1708 	enum nl80211_band band;
1709 	struct tlv *tlv;
1710 	u16 supp_rates;
1711 
1712 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1713 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1714 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1715 				    &link_conf->chanreq.oper;
1716 	band = chandef->chan->band;
1717 
1718 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra_info));
1719 	ra_info = (struct sta_rec_ra_info *)tlv;
1720 
1721 	supp_rates = link_sta->supp_rates[band];
1722 	if (band == NL80211_BAND_2GHZ)
1723 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
1724 			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
1725 	else
1726 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates);
1727 
1728 	ra_info->legacy = cpu_to_le16(supp_rates);
1729 
1730 	if (link_sta->ht_cap.ht_supported)
1731 		memcpy(ra_info->rx_mcs_bitmask,
1732 		       link_sta->ht_cap.mcs.rx_mask,
1733 		       HT_MCS_MASK_NUM);
1734 }
1735 
1736 static void
1737 mt7925_mcu_sta_eht_mld_tlv(struct sk_buff *skb,
1738 			   struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1739 {
1740 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1741 	struct wiphy *wiphy = mvif->phy->mt76->hw->wiphy;
1742 	const struct wiphy_iftype_ext_capab *ext_capa;
1743 	struct sta_rec_eht_mld *eht_mld;
1744 	struct tlv *tlv;
1745 	u16 eml_cap;
1746 
1747 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT_MLD, sizeof(*eht_mld));
1748 	eht_mld = (struct sta_rec_eht_mld *)tlv;
1749 	eht_mld->mld_type = 0xff;
1750 
1751 	if (!ieee80211_vif_is_mld(vif))
1752 		return;
1753 
1754 	ext_capa = cfg80211_get_iftype_ext_capa(wiphy,
1755 						ieee80211_vif_type_p2p(vif));
1756 	if (!ext_capa)
1757 		return;
1758 
1759 	eml_cap = (vif->cfg.eml_cap & (IEEE80211_EML_CAP_EMLSR_SUPP |
1760 				       IEEE80211_EML_CAP_TRANSITION_TIMEOUT)) |
1761 		  (ext_capa->eml_capabilities & (IEEE80211_EML_CAP_EMLSR_PADDING_DELAY |
1762 						IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY));
1763 
1764 	if (eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP) {
1765 		eht_mld->eml_cap[0] = u16_get_bits(eml_cap, GENMASK(7, 0));
1766 		eht_mld->eml_cap[1] = u16_get_bits(eml_cap, GENMASK(15, 8));
1767 	} else {
1768 		eht_mld->str_cap[0] = BIT(1);
1769 	}
1770 }
1771 
1772 static void
1773 mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,
1774 		       struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1775 {
1776 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1777 	struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv;
1778 	unsigned long valid = mvif->valid_links;
1779 	struct mt792x_bss_conf *mconf;
1780 	struct mt792x_link_sta *mlink;
1781 	struct sta_rec_mld *mld;
1782 	struct tlv *tlv;
1783 	int i, cnt = 0;
1784 
1785 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MLD, sizeof(*mld));
1786 	mld = (struct sta_rec_mld *)tlv;
1787 	memcpy(mld->mac_addr, sta->addr, ETH_ALEN);
1788 	mld->primary_id = cpu_to_le16(msta->deflink.wcid.idx);
1789 	mld->wlan_id = cpu_to_le16(msta->deflink.wcid.idx);
1790 	mld->link_num = min_t(u8, hweight16(mvif->valid_links), 2);
1791 
1792 	for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
1793 		if (cnt == mld->link_num)
1794 			break;
1795 
1796 		mconf = mt792x_vif_to_link(mvif, i);
1797 		mlink = mt792x_sta_to_link(msta, i);
1798 		mld->link[cnt].wlan_id = cpu_to_le16(mlink->wcid.idx);
1799 		mld->link[cnt++].bss_idx = mconf->mt76.idx;
1800 
1801 		if (mlink != &msta->deflink)
1802 			mld->secondary_id = cpu_to_le16(mlink->wcid.idx);
1803 	}
1804 }
1805 
1806 static int
1807 mt7925_mcu_sta_cmd(struct mt76_phy *phy,
1808 		   struct mt76_sta_cmd_info *info)
1809 {
1810 	struct mt76_vif *mvif = (struct mt76_vif *)info->vif->drv_priv;
1811 	struct mt76_dev *dev = phy->dev;
1812 	struct sk_buff *skb;
1813 	int conn_state;
1814 
1815 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, info->wcid,
1816 					      MT7925_STA_UPDATE_MAX_SIZE);
1817 	if (IS_ERR(skb))
1818 		return PTR_ERR(skb);
1819 
1820 	conn_state = info->enable ? CONN_STATE_PORT_SECURE :
1821 				    CONN_STATE_DISCONNECT;
1822 	if (info->link_sta)
1823 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif,
1824 					      info->link_sta,
1825 					      conn_state, info->newly);
1826 	if (info->link_sta && info->enable) {
1827 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1828 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1829 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1830 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1831 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1832 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1833 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1834 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1835 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1836 					     info->link_sta);
1837 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1838 					    info->vif, info->rcpi,
1839 					    info->state);
1840 		mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1841 	}
1842 
1843 	if (info->enable)
1844 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
1845 
1846 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1847 }
1848 
1849 static void
1850 mt7925_mcu_sta_remove_tlv(struct sk_buff *skb)
1851 {
1852 	struct sta_rec_remove *rem;
1853 	struct tlv *tlv;
1854 
1855 	tlv = mt76_connac_mcu_add_tlv(skb, 0x25, sizeof(*rem));
1856 	rem = (struct sta_rec_remove *)tlv;
1857 	rem->action = 0;
1858 }
1859 
1860 static int
1861 mt7925_mcu_mlo_sta_cmd(struct mt76_phy *phy,
1862 		       struct mt76_sta_cmd_info *info)
1863 {
1864 	struct mt792x_vif *mvif = (struct mt792x_vif *)info->vif->drv_priv;
1865 	struct mt76_dev *dev = phy->dev;
1866 	struct mt792x_bss_conf *mconf;
1867 	struct sk_buff *skb;
1868 
1869 	mconf = mt792x_vif_to_link(mvif, info->wcid->link_id);
1870 
1871 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, info->wcid,
1872 					      MT7925_STA_UPDATE_MAX_SIZE);
1873 	if (IS_ERR(skb))
1874 		return PTR_ERR(skb);
1875 
1876 	if (info->enable)
1877 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif,
1878 					      info->link_sta,
1879 					      info->enable, info->newly);
1880 
1881 	if (info->enable && info->link_sta) {
1882 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1883 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1884 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1885 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1886 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1887 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1888 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1889 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1890 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1891 					     info->link_sta);
1892 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1893 					    info->vif, info->rcpi,
1894 					    info->state);
1895 
1896 		if (info->state != MT76_STA_INFO_STATE_NONE) {
1897 			mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1898 			mt7925_mcu_sta_eht_mld_tlv(skb, info->vif, info->link_sta->sta);
1899 		}
1900 
1901 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
1902 	}
1903 
1904 	if (!info->enable) {
1905 		mt7925_mcu_sta_remove_tlv(skb);
1906 		mt76_connac_mcu_add_tlv(skb, STA_REC_MLD_OFF,
1907 					sizeof(struct tlv));
1908 	}
1909 
1910 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1911 }
1912 
1913 int mt7925_mcu_sta_update(struct mt792x_dev *dev,
1914 			  struct ieee80211_link_sta *link_sta,
1915 			  struct ieee80211_vif *vif, bool enable,
1916 			  enum mt76_sta_info_state state)
1917 {
1918 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1919 	int rssi = -ewma_rssi_read(&mvif->bss_conf.rssi);
1920 	struct mt76_sta_cmd_info info = {
1921 		.link_sta = link_sta,
1922 		.vif = vif,
1923 		.enable = enable,
1924 		.cmd = MCU_UNI_CMD(STA_REC_UPDATE),
1925 		.state = state,
1926 		.offload_fw = true,
1927 		.rcpi = to_rcpi(rssi),
1928 	};
1929 	struct mt792x_sta *msta;
1930 	struct mt792x_link_sta *mlink;
1931 	int err;
1932 
1933 	if (link_sta) {
1934 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1935 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1936 	}
1937 	info.wcid = link_sta ? &mlink->wcid : &mvif->sta.deflink.wcid;
1938 
1939 	if (link_sta)
1940 		info.newly = state != MT76_STA_INFO_STATE_ASSOC;
1941 	else
1942 		info.newly = state == MT76_STA_INFO_STATE_ASSOC ? false : true;
1943 
1944 	if (ieee80211_vif_is_mld(vif))
1945 		err = mt7925_mcu_mlo_sta_cmd(&dev->mphy, &info);
1946 	else
1947 		err = mt7925_mcu_sta_cmd(&dev->mphy, &info);
1948 
1949 	return err;
1950 }
1951 
1952 int mt7925_mcu_set_beacon_filter(struct mt792x_dev *dev,
1953 				 struct ieee80211_vif *vif,
1954 				 bool enable)
1955 {
1956 #define MT7925_FIF_BIT_CLR		BIT(1)
1957 #define MT7925_FIF_BIT_SET		BIT(0)
1958 	int err = 0;
1959 
1960 	if (enable) {
1961 		err = mt7925_mcu_uni_bss_bcnft(dev, &vif->bss_conf, true);
1962 		if (err < 0)
1963 			return err;
1964 
1965 		return mt7925_mcu_set_rxfilter(dev, 0,
1966 					       MT7925_FIF_BIT_SET,
1967 					       MT_WF_RFCR_DROP_OTHER_BEACON);
1968 	}
1969 
1970 	err = mt7925_mcu_set_bss_pm(dev, &vif->bss_conf, false);
1971 	if (err < 0)
1972 		return err;
1973 
1974 	return mt7925_mcu_set_rxfilter(dev, 0,
1975 				       MT7925_FIF_BIT_CLR,
1976 				       MT_WF_RFCR_DROP_OTHER_BEACON);
1977 }
1978 
1979 int mt7925_get_txpwr_info(struct mt792x_dev *dev, u8 band_idx, struct mt7925_txpwr *txpwr)
1980 {
1981 #define TX_POWER_SHOW_INFO 0x7
1982 #define TXPOWER_ALL_RATE_POWER_INFO 0x2
1983 	struct mt7925_txpwr_event *event;
1984 	struct mt7925_txpwr_req req = {
1985 		.tag = cpu_to_le16(TX_POWER_SHOW_INFO),
1986 		.len = cpu_to_le16(sizeof(req) - 4),
1987 		.catg = TXPOWER_ALL_RATE_POWER_INFO,
1988 		.band_idx = band_idx,
1989 	};
1990 	struct sk_buff *skb;
1991 	int ret;
1992 
1993 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(TXPOWER),
1994 					&req, sizeof(req), true, &skb);
1995 	if (ret)
1996 		return ret;
1997 
1998 	event = (struct mt7925_txpwr_event *)skb->data;
1999 	memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
2000 
2001 	dev_kfree_skb(skb);
2002 
2003 	return 0;
2004 }
2005 
2006 int mt7925_mcu_set_sniffer(struct mt792x_dev *dev, struct ieee80211_vif *vif,
2007 			   bool enable)
2008 {
2009 	struct {
2010 		struct {
2011 			u8 band_idx;
2012 			u8 pad[3];
2013 		} __packed hdr;
2014 		struct sniffer_enable_tlv {
2015 			__le16 tag;
2016 			__le16 len;
2017 			u8 enable;
2018 			u8 pad[3];
2019 		} __packed enable;
2020 	} __packed req = {
2021 		.hdr = {
2022 			.band_idx = 0,
2023 		},
2024 		.enable = {
2025 			.tag = cpu_to_le16(UNI_SNIFFER_ENABLE),
2026 			.len = cpu_to_le16(sizeof(struct sniffer_enable_tlv)),
2027 			.enable = enable,
2028 		},
2029 	};
2030 
2031 	mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req), true);
2032 
2033 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req),
2034 				 true);
2035 }
2036 
2037 int mt7925_mcu_config_sniffer(struct mt792x_vif *vif,
2038 			      struct ieee80211_chanctx_conf *ctx)
2039 {
2040 	struct mt76_phy *mphy = vif->phy->mt76;
2041 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def : &mphy->chandef;
2042 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2043 
2044 	static const u8 ch_band[] = {
2045 		[NL80211_BAND_2GHZ] = 1,
2046 		[NL80211_BAND_5GHZ] = 2,
2047 		[NL80211_BAND_6GHZ] = 3,
2048 	};
2049 	static const u8 ch_width[] = {
2050 		[NL80211_CHAN_WIDTH_20_NOHT] = 0,
2051 		[NL80211_CHAN_WIDTH_20] = 0,
2052 		[NL80211_CHAN_WIDTH_40] = 0,
2053 		[NL80211_CHAN_WIDTH_80] = 1,
2054 		[NL80211_CHAN_WIDTH_160] = 2,
2055 		[NL80211_CHAN_WIDTH_80P80] = 3,
2056 		[NL80211_CHAN_WIDTH_5] = 4,
2057 		[NL80211_CHAN_WIDTH_10] = 5,
2058 		[NL80211_CHAN_WIDTH_320] = 6,
2059 	};
2060 
2061 	struct {
2062 		struct {
2063 			u8 band_idx;
2064 			u8 pad[3];
2065 		} __packed hdr;
2066 		struct config_tlv {
2067 			__le16 tag;
2068 			__le16 len;
2069 			u16 aid;
2070 			u8 ch_band;
2071 			u8 bw;
2072 			u8 control_ch;
2073 			u8 sco;
2074 			u8 center_ch;
2075 			u8 center_ch2;
2076 			u8 drop_err;
2077 			u8 pad[3];
2078 		} __packed tlv;
2079 	} __packed req = {
2080 		.hdr = {
2081 			.band_idx = 0,
2082 		},
2083 		.tlv = {
2084 			.tag = cpu_to_le16(UNI_SNIFFER_CONFIG),
2085 			.len = cpu_to_le16(sizeof(req.tlv)),
2086 			.control_ch = chandef->chan->hw_value,
2087 			.center_ch = ieee80211_frequency_to_channel(freq1),
2088 			.drop_err = 1,
2089 		},
2090 	};
2091 
2092 	if (chandef->chan->band < ARRAY_SIZE(ch_band))
2093 		req.tlv.ch_band = ch_band[chandef->chan->band];
2094 	if (chandef->width < ARRAY_SIZE(ch_width))
2095 		req.tlv.bw = ch_width[chandef->width];
2096 
2097 	if (freq2)
2098 		req.tlv.center_ch2 = ieee80211_frequency_to_channel(freq2);
2099 
2100 	if (req.tlv.control_ch < req.tlv.center_ch)
2101 		req.tlv.sco = 1; /* SCA */
2102 	else if (req.tlv.control_ch > req.tlv.center_ch)
2103 		req.tlv.sco = 3; /* SCB */
2104 
2105 	return mt76_mcu_send_msg(mphy->dev, MCU_UNI_CMD(SNIFFER),
2106 				 &req, sizeof(req), true);
2107 }
2108 
2109 int
2110 mt7925_mcu_uni_add_beacon_offload(struct mt792x_dev *dev,
2111 				  struct ieee80211_hw *hw,
2112 				  struct ieee80211_vif *vif,
2113 				  bool enable)
2114 {
2115 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
2116 	struct ieee80211_mutable_offsets offs;
2117 	struct {
2118 		struct req_hdr {
2119 			u8 bss_idx;
2120 			u8 pad[3];
2121 		} __packed hdr;
2122 		struct bcn_content_tlv {
2123 			__le16 tag;
2124 			__le16 len;
2125 			__le16 tim_ie_pos;
2126 			__le16 csa_ie_pos;
2127 			__le16 bcc_ie_pos;
2128 			/* 0: disable beacon offload
2129 			 * 1: enable beacon offload
2130 			 * 2: update probe respond offload
2131 			 */
2132 			u8 enable;
2133 			/* 0: legacy format (TXD + payload)
2134 			 * 1: only cap field IE
2135 			 */
2136 			u8 type;
2137 			__le16 pkt_len;
2138 			u8 pkt[512];
2139 		} __packed beacon_tlv;
2140 	} req = {
2141 		.hdr = {
2142 			.bss_idx = mvif->bss_conf.mt76.idx,
2143 		},
2144 		.beacon_tlv = {
2145 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
2146 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
2147 			.enable = enable,
2148 			.type = 1,
2149 		},
2150 	};
2151 	struct sk_buff *skb;
2152 	u8 cap_offs;
2153 
2154 	/* support enable/update process only
2155 	 * disable flow would be handled in bss stop handler automatically
2156 	 */
2157 	if (!enable)
2158 		return -EOPNOTSUPP;
2159 
2160 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs, 0);
2161 	if (!skb)
2162 		return -EINVAL;
2163 
2164 	cap_offs = offsetof(struct ieee80211_mgmt, u.beacon.capab_info);
2165 	if (!skb_pull(skb, cap_offs)) {
2166 		dev_err(dev->mt76.dev, "beacon format err\n");
2167 		dev_kfree_skb(skb);
2168 		return -EINVAL;
2169 	}
2170 
2171 	if (skb->len > 512) {
2172 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
2173 		dev_kfree_skb(skb);
2174 		return -EINVAL;
2175 	}
2176 
2177 	memcpy(req.beacon_tlv.pkt, skb->data, skb->len);
2178 	req.beacon_tlv.pkt_len = cpu_to_le16(skb->len);
2179 	offs.tim_offset -= cap_offs;
2180 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(offs.tim_offset);
2181 
2182 	if (offs.cntdwn_counter_offs[0]) {
2183 		u16 csa_offs;
2184 
2185 		csa_offs = offs.cntdwn_counter_offs[0] - cap_offs - 4;
2186 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
2187 	}
2188 	dev_kfree_skb(skb);
2189 
2190 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
2191 				 &req, sizeof(req), true);
2192 }
2193 
2194 static
2195 void mt7925_mcu_bss_rlm_tlv(struct sk_buff *skb, struct mt76_phy *phy,
2196 			    struct ieee80211_bss_conf *link_conf,
2197 			    struct ieee80211_chanctx_conf *ctx)
2198 {
2199 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2200 						  &link_conf->chanreq.oper;
2201 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2202 	enum nl80211_band band = chandef->chan->band;
2203 	struct bss_rlm_tlv *req;
2204 	struct tlv *tlv;
2205 
2206 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RLM, sizeof(*req));
2207 	req = (struct bss_rlm_tlv *)tlv;
2208 	req->control_channel = chandef->chan->hw_value;
2209 	req->center_chan = ieee80211_frequency_to_channel(freq1);
2210 	req->center_chan2 = 0;
2211 	req->tx_streams = hweight8(phy->antenna_mask);
2212 	req->ht_op_info = 4; /* set HT 40M allowed */
2213 	req->rx_streams = hweight8(phy->antenna_mask);
2214 	req->center_chan2 = 0;
2215 	req->sco = 0;
2216 	req->band = 1;
2217 
2218 	switch (band) {
2219 	case NL80211_BAND_2GHZ:
2220 		req->band = 1;
2221 		break;
2222 	case NL80211_BAND_5GHZ:
2223 		req->band = 2;
2224 		break;
2225 	case NL80211_BAND_6GHZ:
2226 		req->band = 3;
2227 		break;
2228 	default:
2229 		break;
2230 	}
2231 
2232 	switch (chandef->width) {
2233 	case NL80211_CHAN_WIDTH_40:
2234 		req->bw = CMD_CBW_40MHZ;
2235 		break;
2236 	case NL80211_CHAN_WIDTH_80:
2237 		req->bw = CMD_CBW_80MHZ;
2238 		break;
2239 	case NL80211_CHAN_WIDTH_80P80:
2240 		req->bw = CMD_CBW_8080MHZ;
2241 		req->center_chan2 = ieee80211_frequency_to_channel(freq2);
2242 		break;
2243 	case NL80211_CHAN_WIDTH_160:
2244 		req->bw = CMD_CBW_160MHZ;
2245 		break;
2246 	case NL80211_CHAN_WIDTH_5:
2247 		req->bw = CMD_CBW_5MHZ;
2248 		break;
2249 	case NL80211_CHAN_WIDTH_10:
2250 		req->bw = CMD_CBW_10MHZ;
2251 		break;
2252 	case NL80211_CHAN_WIDTH_20_NOHT:
2253 	case NL80211_CHAN_WIDTH_20:
2254 	default:
2255 		req->bw = CMD_CBW_20MHZ;
2256 		req->ht_op_info = 0;
2257 		break;
2258 	}
2259 
2260 	if (req->control_channel < req->center_chan)
2261 		req->sco = 1; /* SCA */
2262 	else if (req->control_channel > req->center_chan)
2263 		req->sco = 3; /* SCB */
2264 }
2265 
2266 static struct sk_buff *
2267 __mt7925_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
2268 {
2269 	struct bss_req_hdr hdr = {
2270 		.bss_idx = mvif->idx,
2271 	};
2272 	struct sk_buff *skb;
2273 
2274 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
2275 	if (!skb)
2276 		return ERR_PTR(-ENOMEM);
2277 
2278 	skb_put_data(skb, &hdr, sizeof(hdr));
2279 
2280 	return skb;
2281 }
2282 
2283 int mt7925_mcu_set_chctx(struct mt76_phy *phy, struct mt76_vif *mvif,
2284 			 struct ieee80211_bss_conf *link_conf,
2285 			 struct ieee80211_chanctx_conf *ctx)
2286 {
2287 	struct sk_buff *skb;
2288 
2289 	skb = __mt7925_mcu_alloc_bss_req(phy->dev, mvif,
2290 					 MT7925_BSS_UPDATE_MAX_SIZE);
2291 	if (IS_ERR(skb))
2292 		return PTR_ERR(skb);
2293 
2294 	mt7925_mcu_bss_rlm_tlv(skb, phy, link_conf, ctx);
2295 
2296 	return mt76_mcu_skb_send_msg(phy->dev, skb,
2297 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2298 }
2299 
2300 static u8
2301 mt7925_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
2302 			enum nl80211_band band,
2303 			struct ieee80211_link_sta *link_sta)
2304 {
2305 	struct ieee80211_he_6ghz_capa *he_6ghz_capa;
2306 	const struct ieee80211_sta_eht_cap *eht_cap;
2307 	__le16 capa = 0;
2308 	u8 mode = 0;
2309 
2310 	if (link_sta) {
2311 		he_6ghz_capa = &link_sta->he_6ghz_capa;
2312 		eht_cap = &link_sta->eht_cap;
2313 	} else {
2314 		struct ieee80211_supported_band *sband;
2315 
2316 		sband = phy->hw->wiphy->bands[band];
2317 		capa = ieee80211_get_he_6ghz_capa(sband, vif->type);
2318 		he_6ghz_capa = (struct ieee80211_he_6ghz_capa *)&capa;
2319 
2320 		eht_cap = ieee80211_get_eht_iftype_cap(sband, vif->type);
2321 	}
2322 
2323 	switch (band) {
2324 	case NL80211_BAND_2GHZ:
2325 		if (eht_cap && eht_cap->has_eht)
2326 			mode |= PHY_MODE_BE_24G;
2327 		break;
2328 	case NL80211_BAND_5GHZ:
2329 		if (eht_cap && eht_cap->has_eht)
2330 			mode |= PHY_MODE_BE_5G;
2331 		break;
2332 	case NL80211_BAND_6GHZ:
2333 		if (he_6ghz_capa && he_6ghz_capa->capa)
2334 			mode |= PHY_MODE_AX_6G;
2335 
2336 		if (eht_cap && eht_cap->has_eht)
2337 			mode |= PHY_MODE_BE_6G;
2338 		break;
2339 	default:
2340 		break;
2341 	}
2342 
2343 	return mode;
2344 }
2345 
2346 static void
2347 mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
2348 			 struct ieee80211_bss_conf *link_conf,
2349 			 struct ieee80211_link_sta *link_sta,
2350 			 struct ieee80211_chanctx_conf *ctx,
2351 			 struct mt76_phy *phy, u16 wlan_idx,
2352 			 bool enable)
2353 {
2354 	struct ieee80211_vif *vif = link_conf->vif;
2355 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2356 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2357 						  &link_conf->chanreq.oper;
2358 	enum nl80211_band band = chandef->chan->band;
2359 	struct mt76_connac_bss_basic_tlv *basic_req;
2360 	struct mt792x_link_sta *mlink;
2361 	struct tlv *tlv;
2362 	int conn_type;
2363 	u8 idx;
2364 
2365 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*basic_req));
2366 	basic_req = (struct mt76_connac_bss_basic_tlv *)tlv;
2367 
2368 	idx = mconf->mt76.omac_idx > EXT_BSSID_START ? HW_BSSID_0 :
2369 						      mconf->mt76.omac_idx;
2370 	basic_req->hw_bss_idx = idx;
2371 
2372 	basic_req->phymode_ext = mt7925_get_phy_mode_ext(phy, vif, band,
2373 							 link_sta);
2374 
2375 	if (band == NL80211_BAND_2GHZ)
2376 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_ERP_INDEX);
2377 	else
2378 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_OFDM_INDEX);
2379 
2380 	memcpy(basic_req->bssid, link_conf->bssid, ETH_ALEN);
2381 	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, link_sta);
2382 	basic_req->bcn_interval = cpu_to_le16(link_conf->beacon_int);
2383 	basic_req->dtim_period = link_conf->dtim_period;
2384 	basic_req->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
2385 	basic_req->link_idx = mconf->mt76.idx;
2386 
2387 	if (link_sta) {
2388 		struct mt792x_sta *msta;
2389 
2390 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
2391 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
2392 
2393 	} else {
2394 		mlink = &mconf->vif->sta.deflink;
2395 	}
2396 
2397 	basic_req->sta_idx = cpu_to_le16(mlink->wcid.idx);
2398 	basic_req->omac_idx = mconf->mt76.omac_idx;
2399 	basic_req->band_idx = mconf->mt76.band_idx;
2400 	basic_req->wmm_idx = mconf->mt76.wmm_idx;
2401 	basic_req->conn_state = !enable;
2402 
2403 	switch (vif->type) {
2404 	case NL80211_IFTYPE_MESH_POINT:
2405 	case NL80211_IFTYPE_AP:
2406 		if (vif->p2p)
2407 			conn_type = CONNECTION_P2P_GO;
2408 		else
2409 			conn_type = CONNECTION_INFRA_AP;
2410 		basic_req->conn_type = cpu_to_le32(conn_type);
2411 		basic_req->active = enable;
2412 		break;
2413 	case NL80211_IFTYPE_STATION:
2414 		if (vif->p2p)
2415 			conn_type = CONNECTION_P2P_GC;
2416 		else
2417 			conn_type = CONNECTION_INFRA_STA;
2418 		basic_req->conn_type = cpu_to_le32(conn_type);
2419 		basic_req->active = true;
2420 		break;
2421 	case NL80211_IFTYPE_ADHOC:
2422 		basic_req->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
2423 		basic_req->active = true;
2424 		break;
2425 	default:
2426 		WARN_ON(1);
2427 		break;
2428 	}
2429 }
2430 
2431 static void
2432 mt7925_mcu_bss_sec_tlv(struct sk_buff *skb,
2433 		       struct ieee80211_bss_conf *link_conf)
2434 {
2435 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2436 	struct mt76_vif *mvif = &mconf->mt76;
2437 	struct bss_sec_tlv {
2438 		__le16 tag;
2439 		__le16 len;
2440 		u8 mode;
2441 		u8 status;
2442 		u8 cipher;
2443 		u8 __rsv;
2444 	} __packed * sec;
2445 	struct tlv *tlv;
2446 
2447 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_SEC, sizeof(*sec));
2448 	sec = (struct bss_sec_tlv *)tlv;
2449 
2450 	switch (mvif->cipher) {
2451 	case CONNAC3_CIPHER_GCMP_256:
2452 	case CONNAC3_CIPHER_GCMP:
2453 		sec->mode = MODE_WPA3_SAE;
2454 		sec->status = 8;
2455 		break;
2456 	case CONNAC3_CIPHER_AES_CCMP:
2457 		sec->mode = MODE_WPA2_PSK;
2458 		sec->status = 6;
2459 		break;
2460 	case CONNAC3_CIPHER_TKIP:
2461 		sec->mode = MODE_WPA2_PSK;
2462 		sec->status = 4;
2463 		break;
2464 	case CONNAC3_CIPHER_WEP104:
2465 	case CONNAC3_CIPHER_WEP40:
2466 		sec->mode = MODE_SHARED;
2467 		sec->status = 0;
2468 		break;
2469 	default:
2470 		sec->mode = MODE_OPEN;
2471 		sec->status = 1;
2472 		break;
2473 	}
2474 
2475 	sec->cipher = mvif->cipher;
2476 }
2477 
2478 static void
2479 mt7925_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt792x_phy *phy,
2480 		       struct ieee80211_chanctx_conf *ctx,
2481 		       struct ieee80211_bss_conf *link_conf)
2482 {
2483 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2484 						  &link_conf->chanreq.oper;
2485 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2486 	enum nl80211_band band = chandef->chan->band;
2487 	struct mt76_vif *mvif = &mconf->mt76;
2488 	struct bss_rate_tlv *bmc;
2489 	struct tlv *tlv;
2490 	u8 idx = mvif->mcast_rates_idx ?
2491 		 mvif->mcast_rates_idx : mvif->basic_rates_idx;
2492 
2493 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RATE, sizeof(*bmc));
2494 
2495 	bmc = (struct bss_rate_tlv *)tlv;
2496 
2497 	if (band == NL80211_BAND_2GHZ)
2498 		bmc->basic_rate = cpu_to_le16(HR_DSSS_ERP_BASIC_RATE);
2499 	else
2500 		bmc->basic_rate = cpu_to_le16(OFDM_BASIC_RATE);
2501 
2502 	bmc->short_preamble = (band == NL80211_BAND_2GHZ);
2503 	bmc->bc_fixed_rate = idx;
2504 	bmc->mc_fixed_rate = idx;
2505 }
2506 
2507 static void
2508 mt7925_mcu_bss_mld_tlv(struct sk_buff *skb,
2509 		       struct ieee80211_bss_conf *link_conf)
2510 {
2511 	struct ieee80211_vif *vif = link_conf->vif;
2512 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2513 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2514 	struct bss_mld_tlv *mld;
2515 	struct tlv *tlv;
2516 	bool is_mld;
2517 
2518 	is_mld = ieee80211_vif_is_mld(link_conf->vif) ||
2519 		 (hweight16(mvif->valid_links) > 1);
2520 
2521 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_MLD, sizeof(*mld));
2522 	mld = (struct bss_mld_tlv *)tlv;
2523 
2524 	mld->link_id = is_mld ? link_conf->link_id : 0xff;
2525 	/* apply the index of the primary link */
2526 	mld->group_mld_id = is_mld ? mvif->bss_conf.mt76.idx : 0xff;
2527 	mld->own_mld_id = mconf->mt76.idx + 32;
2528 	mld->remap_idx = 0xff;
2529 	mld->eml_enable = !!(link_conf->vif->cfg.eml_cap &
2530 			     IEEE80211_EML_CAP_EMLSR_SUPP);
2531 
2532 	memcpy(mld->mac_addr, vif->addr, ETH_ALEN);
2533 }
2534 
2535 static void
2536 mt7925_mcu_bss_qos_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf)
2537 {
2538 	struct mt76_connac_bss_qos_tlv *qos;
2539 	struct tlv *tlv;
2540 
2541 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_QBSS, sizeof(*qos));
2542 	qos = (struct mt76_connac_bss_qos_tlv *)tlv;
2543 	qos->qos = link_conf->qos;
2544 }
2545 
2546 static void
2547 mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2548 		      struct mt792x_phy *phy)
2549 {
2550 #define DEFAULT_HE_PE_DURATION		4
2551 #define DEFAULT_HE_DURATION_RTS_THRES	1023
2552 	const struct ieee80211_sta_he_cap *cap;
2553 	struct bss_info_uni_he *he;
2554 	struct tlv *tlv;
2555 
2556 	cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
2557 
2558 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
2559 
2560 	he = (struct bss_info_uni_he *)tlv;
2561 	he->he_pe_duration = link_conf->htc_trig_based_pkt_ext;
2562 	if (!he->he_pe_duration)
2563 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
2564 
2565 	he->he_rts_thres = cpu_to_le16(link_conf->frame_time_rts_th);
2566 	if (!he->he_rts_thres)
2567 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
2568 
2569 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
2570 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
2571 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
2572 }
2573 
2574 static void
2575 mt7925_mcu_bss_color_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2576 			 bool enable)
2577 {
2578 	struct bss_info_uni_bss_color *color;
2579 	struct tlv *tlv;
2580 
2581 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BSS_COLOR, sizeof(*color));
2582 	color = (struct bss_info_uni_bss_color *)tlv;
2583 
2584 	color->enable = enable ?
2585 		link_conf->he_bss_color.enabled : 0;
2586 	color->bss_color = enable ?
2587 		link_conf->he_bss_color.color : 0;
2588 }
2589 
2590 static void
2591 mt7925_mcu_bss_ifs_tlv(struct sk_buff *skb,
2592 		       struct ieee80211_bss_conf *link_conf)
2593 {
2594 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2595 	struct mt792x_phy *phy = mvif->phy;
2596 	struct bss_ifs_time_tlv *ifs_time;
2597 	struct tlv *tlv;
2598 
2599 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_IFS_TIME, sizeof(*ifs_time));
2600 	ifs_time = (struct bss_ifs_time_tlv *)tlv;
2601 	ifs_time->slot_valid = true;
2602 	ifs_time->slot_time = cpu_to_le16(phy->slottime);
2603 }
2604 
2605 int mt7925_mcu_set_timing(struct mt792x_phy *phy,
2606 			  struct ieee80211_bss_conf *link_conf)
2607 {
2608 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2609 	struct mt792x_dev *dev = phy->dev;
2610 	struct sk_buff *skb;
2611 
2612 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2613 					 MT7925_BSS_UPDATE_MAX_SIZE);
2614 	if (IS_ERR(skb))
2615 		return PTR_ERR(skb);
2616 
2617 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2618 
2619 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2620 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2621 }
2622 
2623 int mt7925_mcu_add_bss_info(struct mt792x_phy *phy,
2624 			    struct ieee80211_chanctx_conf *ctx,
2625 			    struct ieee80211_bss_conf *link_conf,
2626 			    struct ieee80211_link_sta *link_sta,
2627 			    int enable)
2628 {
2629 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2630 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2631 	struct mt792x_dev *dev = phy->dev;
2632 	struct mt792x_link_sta *mlink_bc;
2633 	struct sk_buff *skb;
2634 
2635 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2636 					 MT7925_BSS_UPDATE_MAX_SIZE);
2637 	if (IS_ERR(skb))
2638 		return PTR_ERR(skb);
2639 
2640 	mlink_bc = mt792x_sta_to_link(&mvif->sta, mconf->link_id);
2641 
2642 	/* bss_basic must be first */
2643 	mt7925_mcu_bss_basic_tlv(skb, link_conf, link_sta, ctx, phy->mt76,
2644 				 mlink_bc->wcid.idx, enable);
2645 	mt7925_mcu_bss_sec_tlv(skb, link_conf);
2646 	mt7925_mcu_bss_bmc_tlv(skb, phy, ctx, link_conf);
2647 	mt7925_mcu_bss_qos_tlv(skb, link_conf);
2648 	mt7925_mcu_bss_mld_tlv(skb, link_conf);
2649 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2650 
2651 	if (link_conf->he_support) {
2652 		mt7925_mcu_bss_he_tlv(skb, link_conf, phy);
2653 		mt7925_mcu_bss_color_tlv(skb, link_conf, enable);
2654 	}
2655 
2656 	if (enable)
2657 		mt7925_mcu_bss_rlm_tlv(skb, phy->mt76, link_conf, ctx);
2658 
2659 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2660 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2661 }
2662 
2663 int mt7925_mcu_set_dbdc(struct mt76_phy *phy, bool enable)
2664 {
2665 	struct mt76_dev *mdev = phy->dev;
2666 
2667 	struct mbmc_conf_tlv *conf;
2668 	struct mbmc_set_req *hdr;
2669 	struct sk_buff *skb;
2670 	struct tlv *tlv;
2671 	int max_len, err;
2672 
2673 	max_len = sizeof(*hdr) + sizeof(*conf);
2674 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2675 	if (!skb)
2676 		return -ENOMEM;
2677 
2678 	hdr = (struct mbmc_set_req *)skb_put(skb, sizeof(*hdr));
2679 
2680 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_MBMC_SETTING, sizeof(*conf));
2681 	conf = (struct mbmc_conf_tlv *)tlv;
2682 
2683 	conf->mbmc_en = enable;
2684 	conf->band = 0; /* unused */
2685 
2686 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SET_DBDC_PARMS),
2687 				    false);
2688 
2689 	return err;
2690 }
2691 
2692 int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
2693 		       struct ieee80211_scan_request *scan_req)
2694 {
2695 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2696 	struct cfg80211_scan_request *sreq = &scan_req->req;
2697 	int n_ssids = 0, err, i;
2698 	struct ieee80211_channel **scan_list = sreq->channels;
2699 	struct mt76_dev *mdev = phy->dev;
2700 	struct mt76_connac_mcu_scan_channel *chan;
2701 	struct sk_buff *skb;
2702 
2703 	struct scan_hdr_tlv *hdr;
2704 	struct scan_req_tlv *req;
2705 	struct scan_ssid_tlv *ssid;
2706 	struct scan_bssid_tlv *bssid;
2707 	struct scan_chan_info_tlv *chan_info;
2708 	struct scan_ie_tlv *ie;
2709 	struct scan_misc_tlv *misc;
2710 	struct tlv *tlv;
2711 	int max_len;
2712 
2713 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2714 				sizeof(*bssid) + sizeof(*chan_info) +
2715 				sizeof(*misc) + sizeof(*ie);
2716 
2717 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2718 	if (!skb)
2719 		return -ENOMEM;
2720 
2721 	set_bit(MT76_HW_SCANNING, &phy->state);
2722 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2723 
2724 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2725 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2726 	hdr->bss_idx = mvif->idx;
2727 
2728 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_REQ, sizeof(*req));
2729 	req = (struct scan_req_tlv *)tlv;
2730 	req->scan_type = sreq->n_ssids ? 1 : 0;
2731 	req->probe_req_num = sreq->n_ssids ? 2 : 0;
2732 
2733 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2734 	ssid = (struct scan_ssid_tlv *)tlv;
2735 	for (i = 0; i < sreq->n_ssids; i++) {
2736 		if (!sreq->ssids[i].ssid_len)
2737 			continue;
2738 
2739 		ssid->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
2740 		memcpy(ssid->ssids[i].ssid, sreq->ssids[i].ssid,
2741 		       sreq->ssids[i].ssid_len);
2742 		n_ssids++;
2743 	}
2744 	ssid->ssid_type = n_ssids ? BIT(2) : BIT(0);
2745 	ssid->ssids_num = n_ssids;
2746 
2747 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_BSSID, sizeof(*bssid));
2748 	bssid = (struct scan_bssid_tlv *)tlv;
2749 
2750 	memcpy(bssid->bssid, sreq->bssid, ETH_ALEN);
2751 
2752 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
2753 	chan_info = (struct scan_chan_info_tlv *)tlv;
2754 	chan_info->channels_num = min_t(u8, sreq->n_channels,
2755 					ARRAY_SIZE(chan_info->channels));
2756 	for (i = 0; i < chan_info->channels_num; i++) {
2757 		chan = &chan_info->channels[i];
2758 
2759 		switch (scan_list[i]->band) {
2760 		case NL80211_BAND_2GHZ:
2761 			chan->band = 1;
2762 			break;
2763 		case NL80211_BAND_6GHZ:
2764 			chan->band = 3;
2765 			break;
2766 		default:
2767 			chan->band = 2;
2768 			break;
2769 		}
2770 		chan->channel_num = scan_list[i]->hw_value;
2771 	}
2772 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
2773 
2774 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
2775 	ie = (struct scan_ie_tlv *)tlv;
2776 	if (sreq->ie_len > 0) {
2777 		memcpy(ie->ies, sreq->ie, sreq->ie_len);
2778 		ie->ies_len = cpu_to_le16(sreq->ie_len);
2779 	}
2780 
2781 	req->scan_func |= SCAN_FUNC_SPLIT_SCAN;
2782 
2783 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_MISC, sizeof(*misc));
2784 	misc = (struct scan_misc_tlv *)tlv;
2785 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
2786 		get_random_mask_addr(misc->random_mac, sreq->mac_addr,
2787 				     sreq->mac_addr_mask);
2788 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
2789 	}
2790 
2791 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2792 				    false);
2793 	if (err < 0)
2794 		clear_bit(MT76_HW_SCANNING, &phy->state);
2795 
2796 	return err;
2797 }
2798 EXPORT_SYMBOL_GPL(mt7925_mcu_hw_scan);
2799 
2800 int mt7925_mcu_sched_scan_req(struct mt76_phy *phy,
2801 			      struct ieee80211_vif *vif,
2802 			      struct cfg80211_sched_scan_request *sreq)
2803 {
2804 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2805 	struct ieee80211_channel **scan_list = sreq->channels;
2806 	struct mt76_connac_mcu_scan_channel *chan;
2807 	struct mt76_dev *mdev = phy->dev;
2808 	struct cfg80211_match_set *cfg_match;
2809 	struct cfg80211_ssid *cfg_ssid;
2810 
2811 	struct scan_hdr_tlv *hdr;
2812 	struct scan_sched_req *req;
2813 	struct scan_ssid_tlv *ssid;
2814 	struct scan_chan_info_tlv *chan_info;
2815 	struct scan_ie_tlv *ie;
2816 	struct scan_sched_ssid_match_sets *match;
2817 	struct sk_buff *skb;
2818 	struct tlv *tlv;
2819 	int i, max_len;
2820 
2821 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2822 		  sizeof(*chan_info) + sizeof(*ie) +
2823 		  sizeof(*match);
2824 
2825 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2826 	if (!skb)
2827 		return -ENOMEM;
2828 
2829 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2830 
2831 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2832 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2833 	hdr->bss_idx = mvif->idx;
2834 
2835 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_REQ, sizeof(*req));
2836 	req = (struct scan_sched_req *)tlv;
2837 	req->version = 1;
2838 
2839 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
2840 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
2841 
2842 	req->intervals_num = sreq->n_scan_plans;
2843 	for (i = 0; i < req->intervals_num; i++)
2844 		req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
2845 
2846 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2847 	ssid = (struct scan_ssid_tlv *)tlv;
2848 
2849 	ssid->ssids_num = sreq->n_ssids;
2850 	ssid->ssid_type = BIT(2);
2851 	for (i = 0; i < ssid->ssids_num; i++) {
2852 		cfg_ssid = &sreq->ssids[i];
2853 		memcpy(ssid->ssids[i].ssid, cfg_ssid->ssid, cfg_ssid->ssid_len);
2854 		ssid->ssids[i].ssid_len = cpu_to_le32(cfg_ssid->ssid_len);
2855 	}
2856 
2857 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID_MATCH_SETS, sizeof(*match));
2858 	match = (struct scan_sched_ssid_match_sets *)tlv;
2859 	match->match_num = sreq->n_match_sets;
2860 	for (i = 0; i < match->match_num; i++) {
2861 		cfg_match = &sreq->match_sets[i];
2862 		memcpy(match->match[i].ssid, cfg_match->ssid.ssid,
2863 		       cfg_match->ssid.ssid_len);
2864 		match->match[i].rssi_th = cpu_to_le32(cfg_match->rssi_thold);
2865 		match->match[i].ssid_len = cfg_match->ssid.ssid_len;
2866 	}
2867 
2868 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
2869 	chan_info = (struct scan_chan_info_tlv *)tlv;
2870 	chan_info->channels_num = min_t(u8, sreq->n_channels,
2871 					ARRAY_SIZE(chan_info->channels));
2872 	for (i = 0; i < chan_info->channels_num; i++) {
2873 		chan = &chan_info->channels[i];
2874 
2875 		switch (scan_list[i]->band) {
2876 		case NL80211_BAND_2GHZ:
2877 			chan->band = 1;
2878 			break;
2879 		case NL80211_BAND_6GHZ:
2880 			chan->band = 3;
2881 			break;
2882 		default:
2883 			chan->band = 2;
2884 			break;
2885 		}
2886 		chan->channel_num = scan_list[i]->hw_value;
2887 	}
2888 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
2889 
2890 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
2891 	ie = (struct scan_ie_tlv *)tlv;
2892 	if (sreq->ie_len > 0) {
2893 		memcpy(ie->ies, sreq->ie, sreq->ie_len);
2894 		ie->ies_len = cpu_to_le16(sreq->ie_len);
2895 	}
2896 
2897 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2898 				     false);
2899 }
2900 EXPORT_SYMBOL_GPL(mt7925_mcu_sched_scan_req);
2901 
2902 int
2903 mt7925_mcu_sched_scan_enable(struct mt76_phy *phy,
2904 			     struct ieee80211_vif *vif,
2905 			     bool enable)
2906 {
2907 	struct mt76_dev *mdev = phy->dev;
2908 	struct scan_sched_enable *req;
2909 	struct scan_hdr_tlv *hdr;
2910 	struct sk_buff *skb;
2911 	struct tlv *tlv;
2912 	int max_len;
2913 
2914 	max_len = sizeof(*hdr) + sizeof(*req);
2915 
2916 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2917 	if (!skb)
2918 		return -ENOMEM;
2919 
2920 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2921 	hdr->seq_num = 0;
2922 	hdr->bss_idx = 0;
2923 
2924 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_ENABLE, sizeof(*req));
2925 	req = (struct scan_sched_enable *)tlv;
2926 	req->active = !enable;
2927 
2928 	if (enable)
2929 		set_bit(MT76_HW_SCHED_SCANNING, &phy->state);
2930 	else
2931 		clear_bit(MT76_HW_SCHED_SCANNING, &phy->state);
2932 
2933 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2934 				     false);
2935 }
2936 
2937 int mt7925_mcu_cancel_hw_scan(struct mt76_phy *phy,
2938 			      struct ieee80211_vif *vif)
2939 {
2940 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2941 	struct {
2942 		struct scan_hdr {
2943 			u8 seq_num;
2944 			u8 bss_idx;
2945 			u8 pad[2];
2946 		} __packed hdr;
2947 		struct scan_cancel_tlv {
2948 			__le16 tag;
2949 			__le16 len;
2950 			u8 is_ext_channel;
2951 			u8 rsv[3];
2952 		} __packed cancel;
2953 	} req = {
2954 		.hdr = {
2955 			.seq_num = mvif->scan_seq_num,
2956 			.bss_idx = mvif->idx,
2957 		},
2958 		.cancel = {
2959 			.tag = cpu_to_le16(UNI_SCAN_CANCEL),
2960 			.len = cpu_to_le16(sizeof(struct scan_cancel_tlv)),
2961 		},
2962 	};
2963 
2964 	if (test_and_clear_bit(MT76_HW_SCANNING, &phy->state)) {
2965 		struct cfg80211_scan_info info = {
2966 			.aborted = true,
2967 		};
2968 
2969 		ieee80211_scan_completed(phy->hw, &info);
2970 	}
2971 
2972 	return mt76_mcu_send_msg(phy->dev, MCU_UNI_CMD(SCAN_REQ),
2973 				 &req, sizeof(req), false);
2974 }
2975 EXPORT_SYMBOL_GPL(mt7925_mcu_cancel_hw_scan);
2976 
2977 int mt7925_mcu_set_channel_domain(struct mt76_phy *phy)
2978 {
2979 	int len, i, n_max_channels, n_2ch = 0, n_5ch = 0, n_6ch = 0;
2980 	struct {
2981 		struct {
2982 			u8 alpha2[4]; /* regulatory_request.alpha2 */
2983 			u8 bw_2g; /* BW_20_40M		0
2984 				   * BW_20M		1
2985 				   * BW_20_40_80M	2
2986 				   * BW_20_40_80_160M	3
2987 				   * BW_20_40_80_8080M	4
2988 				   */
2989 			u8 bw_5g;
2990 			u8 bw_6g;
2991 			u8 pad;
2992 		} __packed hdr;
2993 		struct n_chan {
2994 			__le16 tag;
2995 			__le16 len;
2996 			u8 n_2ch;
2997 			u8 n_5ch;
2998 			u8 n_6ch;
2999 			u8 pad;
3000 		} __packed n_ch;
3001 	} req = {
3002 		.hdr = {
3003 			.bw_2g = 0,
3004 			.bw_5g = 3, /* BW_20_40_80_160M */
3005 			.bw_6g = 3,
3006 		},
3007 		.n_ch = {
3008 			.tag = cpu_to_le16(2),
3009 		},
3010 	};
3011 	struct mt76_connac_mcu_chan {
3012 		__le16 hw_value;
3013 		__le16 pad;
3014 		__le32 flags;
3015 	} __packed channel;
3016 	struct mt76_dev *dev = phy->dev;
3017 	struct ieee80211_channel *chan;
3018 	struct sk_buff *skb;
3019 
3020 	n_max_channels = phy->sband_2g.sband.n_channels +
3021 			 phy->sband_5g.sband.n_channels +
3022 			 phy->sband_6g.sband.n_channels;
3023 	len = sizeof(req) + n_max_channels * sizeof(channel);
3024 
3025 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
3026 	if (!skb)
3027 		return -ENOMEM;
3028 
3029 	skb_reserve(skb, sizeof(req));
3030 
3031 	for (i = 0; i < phy->sband_2g.sband.n_channels; i++) {
3032 		chan = &phy->sband_2g.sband.channels[i];
3033 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3034 			continue;
3035 
3036 		channel.hw_value = cpu_to_le16(chan->hw_value);
3037 		channel.flags = cpu_to_le32(chan->flags);
3038 		channel.pad = 0;
3039 
3040 		skb_put_data(skb, &channel, sizeof(channel));
3041 		n_2ch++;
3042 	}
3043 	for (i = 0; i < phy->sband_5g.sband.n_channels; i++) {
3044 		chan = &phy->sband_5g.sband.channels[i];
3045 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3046 			continue;
3047 
3048 		channel.hw_value = cpu_to_le16(chan->hw_value);
3049 		channel.flags = cpu_to_le32(chan->flags);
3050 		channel.pad = 0;
3051 
3052 		skb_put_data(skb, &channel, sizeof(channel));
3053 		n_5ch++;
3054 	}
3055 	for (i = 0; i < phy->sband_6g.sband.n_channels; i++) {
3056 		chan = &phy->sband_6g.sband.channels[i];
3057 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3058 			continue;
3059 
3060 		channel.hw_value = cpu_to_le16(chan->hw_value);
3061 		channel.flags = cpu_to_le32(chan->flags);
3062 		channel.pad = 0;
3063 
3064 		skb_put_data(skb, &channel, sizeof(channel));
3065 		n_6ch++;
3066 	}
3067 
3068 	BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(req.hdr.alpha2));
3069 	memcpy(req.hdr.alpha2, dev->alpha2, sizeof(dev->alpha2));
3070 	req.n_ch.n_2ch = n_2ch;
3071 	req.n_ch.n_5ch = n_5ch;
3072 	req.n_ch.n_6ch = n_6ch;
3073 	len = sizeof(struct n_chan) + (n_2ch + n_5ch + n_6ch) * sizeof(channel);
3074 	req.n_ch.len = cpu_to_le16(len);
3075 	memcpy(__skb_push(skb, sizeof(req)), &req, sizeof(req));
3076 
3077 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SET_DOMAIN_INFO),
3078 				     false);
3079 }
3080 EXPORT_SYMBOL_GPL(mt7925_mcu_set_channel_domain);
3081 
3082 static int
3083 __mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3084 		     enum environment_cap env_cap,
3085 		     struct mt7925_clc *clc, u8 idx)
3086 {
3087 	struct mt7925_clc_segment *seg;
3088 	struct sk_buff *skb;
3089 	struct {
3090 		u8 rsv[4];
3091 		__le16 tag;
3092 		__le16 len;
3093 
3094 		u8 ver;
3095 		u8 pad0;
3096 		__le16 size;
3097 		u8 idx;
3098 		u8 env;
3099 		u8 acpi_conf;
3100 		u8 pad1;
3101 		u8 alpha2[2];
3102 		u8 type[2];
3103 		u8 rsvd[64];
3104 	} __packed req = {
3105 		.tag = cpu_to_le16(0x3),
3106 		.len = cpu_to_le16(sizeof(req) - 4),
3107 
3108 		.idx = idx,
3109 		.env = env_cap,
3110 		.acpi_conf = mt792x_acpi_get_flags(&dev->phy),
3111 	};
3112 	int ret, valid_cnt = 0;
3113 	u8 i, *pos;
3114 
3115 	if (!clc)
3116 		return 0;
3117 
3118 	pos = clc->data + sizeof(*seg) * clc->nr_seg;
3119 	for (i = 0; i < clc->nr_country; i++) {
3120 		struct mt7925_clc_rule *rule = (struct mt7925_clc_rule *)pos;
3121 
3122 		pos += sizeof(*rule);
3123 		if (rule->alpha2[0] != alpha2[0] ||
3124 		    rule->alpha2[1] != alpha2[1])
3125 			continue;
3126 
3127 		seg = (struct mt7925_clc_segment *)clc->data
3128 			  + rule->seg_idx - 1;
3129 
3130 		memcpy(req.alpha2, rule->alpha2, 2);
3131 		memcpy(req.type, rule->type, 2);
3132 
3133 		req.size = cpu_to_le16(seg->len);
3134 		skb = __mt76_mcu_msg_alloc(&dev->mt76, &req,
3135 					   le16_to_cpu(req.size) + sizeof(req),
3136 					   sizeof(req), GFP_KERNEL);
3137 		if (!skb)
3138 			return -ENOMEM;
3139 		skb_put_data(skb, clc->data + seg->offset, seg->len);
3140 
3141 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3142 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3143 					    true);
3144 		if (ret < 0)
3145 			return ret;
3146 		valid_cnt++;
3147 	}
3148 
3149 	if (!valid_cnt)
3150 		return -ENOENT;
3151 
3152 	return 0;
3153 }
3154 
3155 int mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3156 		       enum environment_cap env_cap)
3157 {
3158 	struct mt792x_phy *phy = (struct mt792x_phy *)&dev->phy;
3159 	int i, ret;
3160 
3161 	/* submit all clc config */
3162 	for (i = 0; i < ARRAY_SIZE(phy->clc); i++) {
3163 		ret = __mt7925_mcu_set_clc(dev, alpha2, env_cap,
3164 					   phy->clc[i], i);
3165 
3166 		/* If no country found, set "00" as default */
3167 		if (ret == -ENOENT)
3168 			ret = __mt7925_mcu_set_clc(dev, "00",
3169 						   ENVIRON_INDOOR,
3170 						   phy->clc[i], i);
3171 		if (ret < 0)
3172 			return ret;
3173 	}
3174 	return 0;
3175 }
3176 
3177 int mt7925_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb,
3178 			    int cmd, int *wait_seq)
3179 {
3180 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
3181 	struct mt76_connac2_mcu_uni_txd *uni_txd;
3182 	struct mt76_connac2_mcu_txd *mcu_txd;
3183 	__le32 *txd;
3184 	u32 val;
3185 	u8 seq;
3186 
3187 	/* TODO: make dynamic based on msg type */
3188 	mdev->mcu.timeout = 20 * HZ;
3189 
3190 	seq = ++mdev->mcu.msg_seq & 0xf;
3191 	if (!seq)
3192 		seq = ++mdev->mcu.msg_seq & 0xf;
3193 
3194 	if (cmd == MCU_CMD(FW_SCATTER))
3195 		goto exit;
3196 
3197 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
3198 	txd = (__le32 *)skb_push(skb, txd_len);
3199 
3200 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
3201 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
3202 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
3203 	txd[0] = cpu_to_le32(val);
3204 
3205 	val = FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
3206 	txd[1] = cpu_to_le32(val);
3207 
3208 	if (cmd & __MCU_CMD_FIELD_UNI) {
3209 		uni_txd = (struct mt76_connac2_mcu_uni_txd *)txd;
3210 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
3211 		uni_txd->cid = cpu_to_le16(mcu_cmd);
3212 		uni_txd->s2d_index = MCU_S2D_H2N;
3213 		uni_txd->pkt_type = MCU_PKT_ID;
3214 		uni_txd->seq = seq;
3215 
3216 		if (cmd & __MCU_CMD_FIELD_QUERY)
3217 			uni_txd->option = MCU_CMD_UNI_QUERY_ACK;
3218 		else
3219 			uni_txd->option = MCU_CMD_UNI_EXT_ACK;
3220 
3221 		goto exit;
3222 	}
3223 
3224 	mcu_txd = (struct mt76_connac2_mcu_txd *)txd;
3225 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
3226 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
3227 					       MT_TX_MCU_PORT_RX_Q0));
3228 	mcu_txd->pkt_type = MCU_PKT_ID;
3229 	mcu_txd->seq = seq;
3230 	mcu_txd->cid = mcu_cmd;
3231 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
3232 
3233 	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
3234 		if (cmd & __MCU_CMD_FIELD_QUERY)
3235 			mcu_txd->set_query = MCU_Q_QUERY;
3236 		else
3237 			mcu_txd->set_query = MCU_Q_SET;
3238 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
3239 	} else {
3240 		mcu_txd->set_query = MCU_Q_NA;
3241 	}
3242 
3243 	if (cmd & __MCU_CMD_FIELD_WA)
3244 		mcu_txd->s2d_index = MCU_S2D_H2C;
3245 	else
3246 		mcu_txd->s2d_index = MCU_S2D_H2N;
3247 
3248 exit:
3249 	if (wait_seq)
3250 		*wait_seq = seq;
3251 
3252 	return 0;
3253 }
3254 EXPORT_SYMBOL_GPL(mt7925_mcu_fill_message);
3255 
3256 int mt7925_mcu_set_rts_thresh(struct mt792x_phy *phy, u32 val)
3257 {
3258 	struct {
3259 		u8 band_idx;
3260 		u8 _rsv[3];
3261 
3262 		__le16 tag;
3263 		__le16 len;
3264 		__le32 len_thresh;
3265 		__le32 pkt_thresh;
3266 	} __packed req = {
3267 		.band_idx = phy->mt76->band_idx,
3268 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RTS_THRESHOLD),
3269 		.len = cpu_to_le16(sizeof(req) - 4),
3270 		.len_thresh = cpu_to_le32(val),
3271 		.pkt_thresh = cpu_to_le32(0x2),
3272 	};
3273 
3274 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3275 				 &req, sizeof(req), true);
3276 }
3277 
3278 int mt7925_mcu_set_radio_en(struct mt792x_phy *phy, bool enable)
3279 {
3280 	struct {
3281 		u8 band_idx;
3282 		u8 _rsv[3];
3283 
3284 		__le16 tag;
3285 		__le16 len;
3286 		u8 enable;
3287 		u8 _rsv2[3];
3288 	} __packed req = {
3289 		.band_idx = phy->mt76->band_idx,
3290 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RADIO_ENABLE),
3291 		.len = cpu_to_le16(sizeof(req) - 4),
3292 		.enable = enable,
3293 	};
3294 
3295 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3296 				 &req, sizeof(req), true);
3297 }
3298 
3299 static void
3300 mt7925_mcu_build_sku(struct mt76_dev *dev, s8 *sku,
3301 		     struct mt76_power_limits *limits,
3302 		     enum nl80211_band band)
3303 {
3304 	int i, offset = sizeof(limits->cck);
3305 
3306 	memset(sku, 127, MT_CONNAC3_SKU_POWER_LIMIT);
3307 
3308 	if (band == NL80211_BAND_2GHZ) {
3309 		/* cck */
3310 		memcpy(sku, limits->cck, sizeof(limits->cck));
3311 	}
3312 
3313 	/* ofdm */
3314 	memcpy(&sku[offset], limits->ofdm, sizeof(limits->ofdm));
3315 	offset += (sizeof(limits->ofdm) * 5);
3316 
3317 	/* ht */
3318 	for (i = 0; i < 2; i++) {
3319 		memcpy(&sku[offset], limits->mcs[i], 8);
3320 		offset += 8;
3321 	}
3322 	sku[offset++] = limits->mcs[0][0];
3323 
3324 	/* vht */
3325 	for (i = 0; i < ARRAY_SIZE(limits->mcs); i++) {
3326 		memcpy(&sku[offset], limits->mcs[i],
3327 		       ARRAY_SIZE(limits->mcs[i]));
3328 		offset += 12;
3329 	}
3330 
3331 	/* he */
3332 	for (i = 0; i < ARRAY_SIZE(limits->ru); i++) {
3333 		memcpy(&sku[offset], limits->ru[i], ARRAY_SIZE(limits->ru[i]));
3334 		offset += ARRAY_SIZE(limits->ru[i]);
3335 	}
3336 
3337 	/* eht */
3338 	for (i = 0; i < ARRAY_SIZE(limits->eht); i++) {
3339 		memcpy(&sku[offset], limits->eht[i], ARRAY_SIZE(limits->eht[i]));
3340 		offset += ARRAY_SIZE(limits->eht[i]);
3341 	}
3342 }
3343 
3344 static int
3345 mt7925_mcu_rate_txpower_band(struct mt76_phy *phy,
3346 			     enum nl80211_band band)
3347 {
3348 	int tx_power, n_chan, last_ch, err = 0, idx = 0;
3349 	int i, sku_len, batch_size, batch_len = 3;
3350 	struct mt76_dev *dev = phy->dev;
3351 	static const u8 chan_list_2ghz[] = {
3352 		1, 2,  3,  4,  5,  6,  7,
3353 		8, 9, 10, 11, 12, 13, 14
3354 	};
3355 	static const u8 chan_list_5ghz[] = {
3356 		 36,  38,  40,  42,  44,  46,  48,
3357 		 50,  52,  54,  56,  58,  60,  62,
3358 		 64, 100, 102, 104, 106, 108, 110,
3359 		112, 114, 116, 118, 120, 122, 124,
3360 		126, 128, 132, 134, 136, 138, 140,
3361 		142, 144, 149, 151, 153, 155, 157,
3362 		159, 161, 165, 167
3363 	};
3364 	static const u8 chan_list_6ghz[] = {
3365 		  1,   3,   5,   7,   9,  11,  13,
3366 		 15,  17,  19,  21,  23,  25,  27,
3367 		 29,  33,  35,  37,  39,  41,  43,
3368 		 45,  47,  49,  51,  53,  55,  57,
3369 		 59,  61,  65,  67,  69,  71,  73,
3370 		 75,  77,  79,  81,  83,  85,  87,
3371 		 89,  91,  93,  97,  99, 101, 103,
3372 		105, 107, 109, 111, 113, 115, 117,
3373 		119, 121, 123, 125, 129, 131, 133,
3374 		135, 137, 139, 141, 143, 145, 147,
3375 		149, 151, 153, 155, 157, 161, 163,
3376 		165, 167, 169, 171, 173, 175, 177,
3377 		179, 181, 183, 185, 187, 189, 193,
3378 		195, 197, 199, 201, 203, 205, 207,
3379 		209, 211, 213, 215, 217, 219, 221,
3380 		225, 227, 229, 233
3381 	};
3382 	struct mt76_power_limits *limits;
3383 	struct mt7925_sku_tlv *sku_tlbv;
3384 	const u8 *ch_list;
3385 
3386 	sku_len = sizeof(*sku_tlbv);
3387 	tx_power = 2 * phy->hw->conf.power_level;
3388 	if (!tx_power)
3389 		tx_power = 127;
3390 
3391 	if (band == NL80211_BAND_2GHZ) {
3392 		n_chan = ARRAY_SIZE(chan_list_2ghz);
3393 		ch_list = chan_list_2ghz;
3394 		last_ch = chan_list_2ghz[ARRAY_SIZE(chan_list_2ghz) - 1];
3395 	} else if (band == NL80211_BAND_6GHZ) {
3396 		n_chan = ARRAY_SIZE(chan_list_6ghz);
3397 		ch_list = chan_list_6ghz;
3398 		last_ch = chan_list_6ghz[ARRAY_SIZE(chan_list_6ghz) - 1];
3399 	} else {
3400 		n_chan = ARRAY_SIZE(chan_list_5ghz);
3401 		ch_list = chan_list_5ghz;
3402 		last_ch = chan_list_5ghz[ARRAY_SIZE(chan_list_5ghz) - 1];
3403 	}
3404 	batch_size = DIV_ROUND_UP(n_chan, batch_len);
3405 
3406 	limits = devm_kmalloc(dev->dev, sizeof(*limits), GFP_KERNEL);
3407 	if (!limits)
3408 		return -ENOMEM;
3409 
3410 	sku_tlbv = devm_kmalloc(dev->dev, sku_len, GFP_KERNEL);
3411 	if (!sku_tlbv) {
3412 		devm_kfree(dev->dev, limits);
3413 		return -ENOMEM;
3414 	}
3415 
3416 	for (i = 0; i < batch_size; i++) {
3417 		struct mt7925_tx_power_limit_tlv *tx_power_tlv;
3418 		int j, msg_len, num_ch;
3419 		struct sk_buff *skb;
3420 
3421 		num_ch = i == batch_size - 1 ? n_chan % batch_len : batch_len;
3422 		msg_len = sizeof(*tx_power_tlv) + num_ch * sku_len;
3423 		skb = mt76_mcu_msg_alloc(dev, NULL, msg_len);
3424 		if (!skb) {
3425 			err = -ENOMEM;
3426 			goto out;
3427 		}
3428 
3429 		tx_power_tlv = (struct mt7925_tx_power_limit_tlv *)
3430 			       skb_put(skb, sizeof(*tx_power_tlv));
3431 
3432 		BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(tx_power_tlv->alpha2));
3433 		memcpy(tx_power_tlv->alpha2, dev->alpha2, sizeof(dev->alpha2));
3434 		tx_power_tlv->n_chan = num_ch;
3435 		tx_power_tlv->tag = cpu_to_le16(0x1);
3436 		tx_power_tlv->len = cpu_to_le16(sizeof(*tx_power_tlv));
3437 
3438 		switch (band) {
3439 		case NL80211_BAND_2GHZ:
3440 			tx_power_tlv->band = 1;
3441 			break;
3442 		case NL80211_BAND_6GHZ:
3443 			tx_power_tlv->band = 3;
3444 			break;
3445 		default:
3446 			tx_power_tlv->band = 2;
3447 			break;
3448 		}
3449 
3450 		for (j = 0; j < num_ch; j++, idx++) {
3451 			struct ieee80211_channel chan = {
3452 				.hw_value = ch_list[idx],
3453 				.band = band,
3454 			};
3455 			s8 reg_power, sar_power;
3456 
3457 			reg_power = mt76_connac_get_ch_power(phy, &chan,
3458 							     tx_power);
3459 			sar_power = mt76_get_sar_power(phy, &chan, reg_power);
3460 
3461 			mt76_get_rate_power_limits(phy, &chan, limits,
3462 						   sar_power);
3463 
3464 			tx_power_tlv->last_msg = ch_list[idx] == last_ch;
3465 			sku_tlbv->channel = ch_list[idx];
3466 
3467 			mt7925_mcu_build_sku(dev, sku_tlbv->pwr_limit,
3468 					     limits, band);
3469 			skb_put_data(skb, sku_tlbv, sku_len);
3470 		}
3471 		err = mt76_mcu_skb_send_msg(dev, skb,
3472 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3473 					    true);
3474 		if (err < 0)
3475 			goto out;
3476 	}
3477 
3478 out:
3479 	devm_kfree(dev->dev, sku_tlbv);
3480 	devm_kfree(dev->dev, limits);
3481 	return err;
3482 }
3483 
3484 int mt7925_mcu_set_rate_txpower(struct mt76_phy *phy)
3485 {
3486 	int err;
3487 
3488 	if (phy->cap.has_2ghz) {
3489 		err = mt7925_mcu_rate_txpower_band(phy,
3490 						   NL80211_BAND_2GHZ);
3491 		if (err < 0)
3492 			return err;
3493 	}
3494 
3495 	if (phy->cap.has_5ghz) {
3496 		err = mt7925_mcu_rate_txpower_band(phy,
3497 						   NL80211_BAND_5GHZ);
3498 		if (err < 0)
3499 			return err;
3500 	}
3501 
3502 	if (phy->cap.has_6ghz) {
3503 		err = mt7925_mcu_rate_txpower_band(phy,
3504 						   NL80211_BAND_6GHZ);
3505 		if (err < 0)
3506 			return err;
3507 	}
3508 
3509 	return 0;
3510 }
3511 
3512 int mt7925_mcu_set_rxfilter(struct mt792x_dev *dev, u32 fif,
3513 			    u8 bit_op, u32 bit_map)
3514 {
3515 	struct mt792x_phy *phy = &dev->phy;
3516 	struct {
3517 		u8 band_idx;
3518 		u8 rsv1[3];
3519 
3520 		__le16 tag;
3521 		__le16 len;
3522 		u8 mode;
3523 		u8 rsv2[3];
3524 		__le32 fif;
3525 		__le32 bit_map; /* bit_* for bitmap update */
3526 		u8 bit_op;
3527 		u8 pad[51];
3528 	} __packed req = {
3529 		.band_idx = phy->mt76->band_idx,
3530 		.tag = cpu_to_le16(UNI_BAND_CONFIG_SET_MAC80211_RX_FILTER),
3531 		.len = cpu_to_le16(sizeof(req) - 4),
3532 
3533 		.mode = fif ? 0 : 1,
3534 		.fif = cpu_to_le32(fif),
3535 		.bit_map = cpu_to_le32(bit_map),
3536 		.bit_op = bit_op,
3537 	};
3538 
3539 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3540 				 &req, sizeof(req), true);
3541 }
3542