xref: /linux/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c (revision 8dafab9c4116a6a4fd870be03a3d9b66771dc5a8)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2023 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include <linux/firmware.h>
6 #include "mt7925.h"
7 #include "mcu.h"
8 #include "mac.h"
9 
10 #define MT_STA_BFER			BIT(0)
11 #define MT_STA_BFEE			BIT(1)
12 
13 static bool mt7925_disable_clc;
14 module_param_named(disable_clc, mt7925_disable_clc, bool, 0644);
15 MODULE_PARM_DESC(disable_clc, "disable CLC support");
16 
17 int mt7925_mcu_parse_response(struct mt76_dev *mdev, int cmd,
18 			      struct sk_buff *skb, int seq)
19 {
20 	int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
21 	struct mt7925_mcu_rxd *rxd;
22 	int ret = 0;
23 
24 	if (!skb) {
25 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n", cmd, seq);
26 		mt792x_reset(mdev);
27 
28 		return -ETIMEDOUT;
29 	}
30 
31 	rxd = (struct mt7925_mcu_rxd *)skb->data;
32 	if (seq != rxd->seq)
33 		return -EAGAIN;
34 
35 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL) ||
36 	    cmd == MCU_CMD(PATCH_FINISH_REQ)) {
37 		skb_pull(skb, sizeof(*rxd) - 4);
38 		ret = *skb->data;
39 	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
40 		   cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
41 		   cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
42 		   cmd == MCU_UNI_CMD(HIF_CTRL) ||
43 		   cmd == MCU_UNI_CMD(OFFLOAD) ||
44 		   cmd == MCU_UNI_CMD(SUSPEND)) {
45 		struct mt7925_mcu_uni_event *event;
46 
47 		skb_pull(skb, sizeof(*rxd));
48 		event = (struct mt7925_mcu_uni_event *)skb->data;
49 		ret = le32_to_cpu(event->status);
50 		/* skip invalid event */
51 		if (mcu_cmd != event->cid)
52 			ret = -EAGAIN;
53 	} else {
54 		skb_pull(skb, sizeof(*rxd));
55 	}
56 
57 	return ret;
58 }
59 EXPORT_SYMBOL_GPL(mt7925_mcu_parse_response);
60 
61 int mt7925_mcu_regval(struct mt792x_dev *dev, u32 regidx, u32 *val, bool set)
62 {
63 #define MT_RF_REG_HDR           GENMASK(31, 24)
64 #define MT_RF_REG_ANT           GENMASK(23, 16)
65 #define RF_REG_PREFIX           0x99
66 	struct {
67 		u8 __rsv[4];
68 		union {
69 			struct uni_cmd_access_reg_basic {
70 				__le16 tag;
71 				__le16 len;
72 				__le32 idx;
73 				__le32 data;
74 			} __packed reg;
75 			struct uni_cmd_access_rf_reg_basic {
76 				__le16 tag;
77 				__le16 len;
78 				__le16 ant;
79 				u8 __rsv[2];
80 				__le32 idx;
81 				__le32 data;
82 			} __packed rf_reg;
83 		};
84 	} __packed * res, req;
85 	struct sk_buff *skb;
86 	int ret;
87 
88 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX) {
89 		req.rf_reg.tag = cpu_to_le16(UNI_CMD_ACCESS_RF_REG_BASIC);
90 		req.rf_reg.len = cpu_to_le16(sizeof(req.rf_reg));
91 		req.rf_reg.ant = cpu_to_le16(u32_get_bits(regidx, MT_RF_REG_ANT));
92 		req.rf_reg.idx = cpu_to_le32(regidx);
93 		req.rf_reg.data = set ? cpu_to_le32(*val) : 0;
94 	} else {
95 		req.reg.tag = cpu_to_le16(UNI_CMD_ACCESS_REG_BASIC);
96 		req.reg.len = cpu_to_le16(sizeof(req.reg));
97 		req.reg.idx = cpu_to_le32(regidx);
98 		req.reg.data = set ? cpu_to_le32(*val) : 0;
99 	}
100 
101 	if (set)
102 		return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(REG_ACCESS),
103 					 &req, sizeof(req), true);
104 
105 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
106 					MCU_WM_UNI_CMD_QUERY(REG_ACCESS),
107 					&req, sizeof(req), true, &skb);
108 	if (ret)
109 		return ret;
110 
111 	res = (void *)skb->data;
112 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX)
113 		*val = le32_to_cpu(res->rf_reg.data);
114 	else
115 		*val = le32_to_cpu(res->reg.data);
116 
117 	dev_kfree_skb(skb);
118 
119 	return 0;
120 }
121 EXPORT_SYMBOL_GPL(mt7925_mcu_regval);
122 
123 int mt7925_mcu_update_arp_filter(struct mt76_dev *dev,
124 				 struct ieee80211_bss_conf *link_conf)
125 {
126 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
127 	struct ieee80211_vif *mvif = link_conf->vif;
128 	struct sk_buff *skb;
129 	int i, len = min_t(int, mvif->cfg.arp_addr_cnt,
130 			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
131 	struct {
132 		struct {
133 			u8 bss_idx;
134 			u8 pad[3];
135 		} __packed hdr;
136 		struct mt7925_arpns_tlv arp;
137 	} req = {
138 		.hdr = {
139 			.bss_idx = mconf->mt76.idx,
140 		},
141 		.arp = {
142 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
143 			.len = cpu_to_le16(sizeof(req) - 4 + len * 2 * sizeof(__be32)),
144 			.ips_num = len,
145 			.enable = true,
146 		},
147 	};
148 
149 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(req) + len * 2 * sizeof(__be32));
150 	if (!skb)
151 		return -ENOMEM;
152 
153 	skb_put_data(skb, &req, sizeof(req));
154 	for (i = 0; i < len; i++) {
155 		skb_put_data(skb, &mvif->cfg.arp_addr_list[i], sizeof(__be32));
156 		skb_put_zero(skb, sizeof(__be32));
157 	}
158 
159 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
160 }
161 
162 #ifdef CONFIG_PM
163 static int
164 mt7925_connac_mcu_set_wow_ctrl(struct mt76_phy *phy, struct ieee80211_vif *vif,
165 			       bool suspend, struct cfg80211_wowlan *wowlan)
166 {
167 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
168 	struct mt76_dev *dev = phy->dev;
169 	struct {
170 		struct {
171 			u8 bss_idx;
172 			u8 pad[3];
173 		} __packed hdr;
174 		struct mt76_connac_wow_ctrl_tlv wow_ctrl_tlv;
175 		struct mt76_connac_wow_gpio_param_tlv gpio_tlv;
176 	} req = {
177 		.hdr = {
178 			.bss_idx = mvif->idx,
179 		},
180 		.wow_ctrl_tlv = {
181 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
182 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_ctrl_tlv)),
183 			.cmd = suspend ? 1 : 2,
184 		},
185 		.gpio_tlv = {
186 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_GPIO_PARAM),
187 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_gpio_param_tlv)),
188 			.gpio_pin = 0xff, /* follow fw about GPIO pin */
189 		},
190 	};
191 
192 	if (wowlan->magic_pkt)
193 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_MAGIC;
194 	if (wowlan->disconnect)
195 		req.wow_ctrl_tlv.trigger |= (UNI_WOW_DETECT_TYPE_DISCONNECT |
196 					     UNI_WOW_DETECT_TYPE_BCN_LOST);
197 	if (wowlan->nd_config) {
198 		mt7925_mcu_sched_scan_req(phy, vif, wowlan->nd_config);
199 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_SCH_SCAN_HIT;
200 		mt7925_mcu_sched_scan_enable(phy, vif, suspend);
201 	}
202 	if (wowlan->n_patterns)
203 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_BITMAP;
204 
205 	if (mt76_is_mmio(dev))
206 		req.wow_ctrl_tlv.wakeup_hif = WOW_PCIE;
207 	else if (mt76_is_usb(dev))
208 		req.wow_ctrl_tlv.wakeup_hif = WOW_USB;
209 	else if (mt76_is_sdio(dev))
210 		req.wow_ctrl_tlv.wakeup_hif = WOW_GPIO;
211 
212 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(SUSPEND), &req,
213 				 sizeof(req), true);
214 }
215 
216 static int
217 mt7925_mcu_set_wow_pattern(struct mt76_dev *dev,
218 			   struct ieee80211_vif *vif,
219 			   u8 index, bool enable,
220 			   struct cfg80211_pkt_pattern *pattern)
221 {
222 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
223 	struct mt7925_wow_pattern_tlv *tlv;
224 	struct sk_buff *skb;
225 	struct {
226 		u8 bss_idx;
227 		u8 pad[3];
228 	} __packed hdr = {
229 		.bss_idx = mvif->idx,
230 	};
231 
232 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(hdr) + sizeof(*tlv));
233 	if (!skb)
234 		return -ENOMEM;
235 
236 	skb_put_data(skb, &hdr, sizeof(hdr));
237 	tlv = (struct mt7925_wow_pattern_tlv *)skb_put(skb, sizeof(*tlv));
238 	tlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
239 	tlv->len = cpu_to_le16(sizeof(*tlv));
240 	tlv->bss_idx = 0xF;
241 	tlv->data_len = pattern->pattern_len;
242 	tlv->enable = enable;
243 	tlv->index = index;
244 	tlv->offset = 0;
245 
246 	memcpy(tlv->pattern, pattern->pattern, pattern->pattern_len);
247 	memcpy(tlv->mask, pattern->mask, DIV_ROUND_UP(pattern->pattern_len, 8));
248 
249 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SUSPEND), true);
250 }
251 
252 void mt7925_mcu_set_suspend_iter(void *priv, u8 *mac,
253 				 struct ieee80211_vif *vif)
254 {
255 	struct mt76_phy *phy = priv;
256 	bool suspend = !test_bit(MT76_STATE_RUNNING, &phy->state);
257 	struct ieee80211_hw *hw = phy->hw;
258 	struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
259 	int i;
260 
261 	mt76_connac_mcu_set_gtk_rekey(phy->dev, vif, suspend);
262 
263 	mt76_connac_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
264 
265 	for (i = 0; i < wowlan->n_patterns; i++)
266 		mt7925_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
267 					   &wowlan->patterns[i]);
268 	mt7925_connac_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
269 }
270 
271 #endif /* CONFIG_PM */
272 
273 static void
274 mt7925_mcu_connection_loss_iter(void *priv, u8 *mac,
275 				struct ieee80211_vif *vif)
276 {
277 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
278 	struct mt7925_uni_beacon_loss_event *event = priv;
279 
280 	if (mvif->idx != event->hdr.bss_idx)
281 		return;
282 
283 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER) ||
284 	    vif->type != NL80211_IFTYPE_STATION)
285 		return;
286 
287 	ieee80211_connection_loss(vif);
288 }
289 
290 static void
291 mt7925_mcu_connection_loss_event(struct mt792x_dev *dev, struct sk_buff *skb)
292 {
293 	struct mt7925_uni_beacon_loss_event *event;
294 	struct mt76_phy *mphy = &dev->mt76.phy;
295 
296 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd));
297 	event = (struct mt7925_uni_beacon_loss_event *)skb->data;
298 
299 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
300 					IEEE80211_IFACE_ITER_RESUME_ALL,
301 					mt7925_mcu_connection_loss_iter, event);
302 }
303 
304 static void
305 mt7925_mcu_roc_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
306 {
307 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
308 	struct mt7925_roc_grant_tlv *grant = priv;
309 
310 	if (ieee80211_vif_is_mld(vif) && vif->type == NL80211_IFTYPE_STATION)
311 		return;
312 
313 	if (mvif->idx != grant->bss_idx)
314 		return;
315 
316 	mvif->band_idx = grant->dbdcband;
317 }
318 
319 static void mt7925_mcu_roc_handle_grant(struct mt792x_dev *dev,
320 					struct tlv *tlv)
321 {
322 	struct ieee80211_hw *hw = dev->mt76.hw;
323 	struct mt7925_roc_grant_tlv *grant;
324 	int duration;
325 
326 	grant = (struct mt7925_roc_grant_tlv *)tlv;
327 
328 	/* should never happen */
329 	WARN_ON_ONCE((le16_to_cpu(grant->tag) != UNI_EVENT_ROC_GRANT));
330 
331 	if (grant->reqtype == MT7925_ROC_REQ_ROC)
332 		ieee80211_ready_on_channel(hw);
333 	else if (grant->reqtype == MT7925_ROC_REQ_JOIN)
334 		ieee80211_iterate_active_interfaces_atomic(hw,
335 						IEEE80211_IFACE_ITER_RESUME_ALL,
336 						mt7925_mcu_roc_iter, grant);
337 	dev->phy.roc_grant = true;
338 	wake_up(&dev->phy.roc_wait);
339 	duration = le32_to_cpu(grant->max_interval);
340 	mod_timer(&dev->phy.roc_timer,
341 		  jiffies + msecs_to_jiffies(duration));
342 }
343 
344 static void
345 mt7925_mcu_uni_roc_event(struct mt792x_dev *dev, struct sk_buff *skb)
346 {
347 	struct tlv *tlv;
348 	int i = 0;
349 
350 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
351 
352 	while (i < skb->len) {
353 		tlv = (struct tlv *)(skb->data + i);
354 
355 		switch (le16_to_cpu(tlv->tag)) {
356 		case UNI_EVENT_ROC_GRANT:
357 			mt7925_mcu_roc_handle_grant(dev, tlv);
358 			break;
359 		case UNI_EVENT_ROC_GRANT_SUB_LINK:
360 			break;
361 		}
362 
363 		i += le16_to_cpu(tlv->len);
364 	}
365 }
366 
367 static void
368 mt7925_mcu_scan_event(struct mt792x_dev *dev, struct sk_buff *skb)
369 {
370 	struct mt76_phy *mphy = &dev->mt76.phy;
371 	struct mt792x_phy *phy = mphy->priv;
372 
373 	spin_lock_bh(&dev->mt76.lock);
374 	__skb_queue_tail(&phy->scan_event_list, skb);
375 	spin_unlock_bh(&dev->mt76.lock);
376 
377 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
378 				     MT792x_HW_SCAN_TIMEOUT);
379 }
380 
381 static void
382 mt7925_mcu_tx_done_event(struct mt792x_dev *dev, struct sk_buff *skb)
383 {
384 #define UNI_EVENT_TX_DONE_MSG 0
385 #define UNI_EVENT_TX_DONE_RAW 1
386 	struct mt7925_mcu_txs_event {
387 		u8 ver;
388 		u8 rsv[3];
389 		u8 data[0];
390 	} __packed * txs;
391 	struct tlv *tlv;
392 	u32 tlv_len;
393 
394 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
395 	tlv = (struct tlv *)skb->data;
396 	tlv_len = skb->len;
397 
398 	while (tlv_len > 0 && le16_to_cpu(tlv->len) <= tlv_len) {
399 		switch (le16_to_cpu(tlv->tag)) {
400 		case UNI_EVENT_TX_DONE_RAW:
401 			txs = (struct mt7925_mcu_txs_event *)tlv->data;
402 			mt7925_mac_add_txs(dev, txs->data);
403 			break;
404 		default:
405 			break;
406 		}
407 		tlv_len -= le16_to_cpu(tlv->len);
408 		tlv = (struct tlv *)((char *)(tlv) + le16_to_cpu(tlv->len));
409 	}
410 }
411 
412 static void
413 mt7925_mcu_uni_debug_msg_event(struct mt792x_dev *dev, struct sk_buff *skb)
414 {
415 	struct mt7925_uni_debug_msg {
416 		__le16 tag;
417 		__le16 len;
418 		u8 fmt;
419 		u8 rsv[3];
420 		u8 id;
421 		u8 type:3;
422 		u8 nr_args:5;
423 		union {
424 			struct idxlog {
425 				__le16 rsv;
426 				__le32 ts;
427 				__le32 idx;
428 				u8 data[];
429 			} __packed idx;
430 			struct txtlog {
431 				u8 len;
432 				u8 rsv;
433 				__le32 ts;
434 				u8 data[];
435 			} __packed txt;
436 		};
437 	} __packed * hdr;
438 
439 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
440 	hdr = (struct mt7925_uni_debug_msg *)skb->data;
441 
442 	if (hdr->id == 0x28) {
443 		skb_pull(skb, offsetof(struct mt7925_uni_debug_msg, id));
444 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", skb->len, skb->data);
445 		return;
446 	} else if (hdr->id != 0xa8) {
447 		return;
448 	}
449 
450 	if (hdr->type == 0) { /* idx log */
451 		int i, ret, len = PAGE_SIZE - 1, nr_val;
452 		struct page *page = dev_alloc_pages(get_order(len));
453 		__le32 *val;
454 		char *buf, *cur;
455 
456 		if (!page)
457 			return;
458 
459 		buf = page_address(page);
460 		cur = buf;
461 
462 		nr_val = (le16_to_cpu(hdr->len) - sizeof(*hdr)) / 4;
463 		val = (__le32 *)hdr->idx.data;
464 		for (i = 0; i < nr_val && len > 0; i++) {
465 			ret = snprintf(cur, len, "0x%x,", le32_to_cpu(val[i]));
466 			if (ret <= 0)
467 				break;
468 
469 			cur += ret;
470 			len -= ret;
471 		}
472 		if (cur > buf)
473 			wiphy_info(mt76_hw(dev)->wiphy, "idx: 0x%X,%d,%s",
474 				   le32_to_cpu(hdr->idx.idx), nr_val, buf);
475 		put_page(page);
476 	} else if (hdr->type == 2) { /* str log */
477 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", hdr->txt.len, hdr->txt.data);
478 	}
479 }
480 
481 static void
482 mt7925_mcu_uni_rx_unsolicited_event(struct mt792x_dev *dev,
483 				    struct sk_buff *skb)
484 {
485 	struct mt7925_mcu_rxd *rxd;
486 
487 	rxd = (struct mt7925_mcu_rxd *)skb->data;
488 
489 	switch (rxd->eid) {
490 	case MCU_UNI_EVENT_FW_LOG_2_HOST:
491 		mt7925_mcu_uni_debug_msg_event(dev, skb);
492 		break;
493 	case MCU_UNI_EVENT_ROC:
494 		mt7925_mcu_uni_roc_event(dev, skb);
495 		break;
496 	case MCU_UNI_EVENT_SCAN_DONE:
497 		mt7925_mcu_scan_event(dev, skb);
498 		return;
499 	case MCU_UNI_EVENT_TX_DONE:
500 		mt7925_mcu_tx_done_event(dev, skb);
501 		break;
502 	case MCU_UNI_EVENT_BSS_BEACON_LOSS:
503 		mt7925_mcu_connection_loss_event(dev, skb);
504 		break;
505 	case MCU_UNI_EVENT_COREDUMP:
506 		dev->fw_assert = true;
507 		mt76_connac_mcu_coredump_event(&dev->mt76, skb, &dev->coredump);
508 		return;
509 	default:
510 		break;
511 	}
512 	dev_kfree_skb(skb);
513 }
514 
515 void mt7925_mcu_rx_event(struct mt792x_dev *dev, struct sk_buff *skb)
516 {
517 	struct mt7925_mcu_rxd *rxd = (struct mt7925_mcu_rxd *)skb->data;
518 
519 	if (skb_linearize(skb))
520 		return;
521 
522 	if (rxd->option & MCU_UNI_CMD_UNSOLICITED_EVENT) {
523 		mt7925_mcu_uni_rx_unsolicited_event(dev, skb);
524 		return;
525 	}
526 
527 	mt76_mcu_rx_event(&dev->mt76, skb);
528 }
529 
530 static int
531 mt7925_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
532 		  struct ieee80211_ampdu_params *params,
533 		  bool enable, bool tx)
534 {
535 	struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv;
536 	struct sta_rec_ba_uni *ba;
537 	struct sk_buff *skb;
538 	struct tlv *tlv;
539 	int len;
540 
541 	len = sizeof(struct sta_req_hdr) + sizeof(*ba);
542 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid,
543 					      len);
544 	if (IS_ERR(skb))
545 		return PTR_ERR(skb);
546 
547 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
548 
549 	ba = (struct sta_rec_ba_uni *)tlv;
550 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
551 	ba->winsize = cpu_to_le16(params->buf_size);
552 	ba->ssn = cpu_to_le16(params->ssn);
553 	ba->ba_en = enable << params->tid;
554 	ba->amsdu = params->amsdu;
555 	ba->tid = params->tid;
556 
557 	return mt76_mcu_skb_send_msg(dev, skb,
558 				     MCU_UNI_CMD(STA_REC_UPDATE), true);
559 }
560 
561 /** starec & wtbl **/
562 int mt7925_mcu_uni_tx_ba(struct mt792x_dev *dev,
563 			 struct ieee80211_ampdu_params *params,
564 			 bool enable)
565 {
566 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
567 	struct mt792x_vif *mvif = msta->vif;
568 
569 	if (enable && !params->amsdu)
570 		msta->deflink.wcid.amsdu = false;
571 
572 	return mt7925_mcu_sta_ba(&dev->mt76, &mvif->bss_conf.mt76, params,
573 				 enable, true);
574 }
575 
576 int mt7925_mcu_uni_rx_ba(struct mt792x_dev *dev,
577 			 struct ieee80211_ampdu_params *params,
578 			 bool enable)
579 {
580 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
581 	struct mt792x_vif *mvif = msta->vif;
582 
583 	return mt7925_mcu_sta_ba(&dev->mt76, &mvif->bss_conf.mt76, params,
584 				 enable, false);
585 }
586 
587 static int mt7925_load_clc(struct mt792x_dev *dev, const char *fw_name)
588 {
589 	const struct mt76_connac2_fw_trailer *hdr;
590 	const struct mt76_connac2_fw_region *region;
591 	const struct mt7925_clc *clc;
592 	struct mt76_dev *mdev = &dev->mt76;
593 	struct mt792x_phy *phy = &dev->phy;
594 	const struct firmware *fw;
595 	int ret, i, len, offset = 0;
596 	u8 *clc_base = NULL;
597 
598 	if (mt7925_disable_clc ||
599 	    mt76_is_usb(&dev->mt76))
600 		return 0;
601 
602 	ret = request_firmware(&fw, fw_name, mdev->dev);
603 	if (ret)
604 		return ret;
605 
606 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
607 		dev_err(mdev->dev, "Invalid firmware\n");
608 		ret = -EINVAL;
609 		goto out;
610 	}
611 
612 	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
613 	for (i = 0; i < hdr->n_region; i++) {
614 		region = (const void *)((const u8 *)hdr -
615 					(hdr->n_region - i) * sizeof(*region));
616 		len = le32_to_cpu(region->len);
617 
618 		/* check if we have valid buffer size */
619 		if (offset + len > fw->size) {
620 			dev_err(mdev->dev, "Invalid firmware region\n");
621 			ret = -EINVAL;
622 			goto out;
623 		}
624 
625 		if ((region->feature_set & FW_FEATURE_NON_DL) &&
626 		    region->type == FW_TYPE_CLC) {
627 			clc_base = (u8 *)(fw->data + offset);
628 			break;
629 		}
630 		offset += len;
631 	}
632 
633 	if (!clc_base)
634 		goto out;
635 
636 	for (offset = 0; offset < len; offset += le32_to_cpu(clc->len)) {
637 		clc = (const struct mt7925_clc *)(clc_base + offset);
638 
639 		if (clc->idx >= ARRAY_SIZE(phy->clc))
640 			break;
641 
642 		/* do not init buf again if chip reset triggered */
643 		if (phy->clc[clc->idx])
644 			continue;
645 
646 		phy->clc[clc->idx] = devm_kmemdup(mdev->dev, clc,
647 						  le32_to_cpu(clc->len),
648 						  GFP_KERNEL);
649 
650 		if (!phy->clc[clc->idx]) {
651 			ret = -ENOMEM;
652 			goto out;
653 		}
654 	}
655 
656 	ret = mt7925_mcu_set_clc(dev, "00", ENVIRON_INDOOR);
657 out:
658 	release_firmware(fw);
659 
660 	return ret;
661 }
662 
663 int mt7925_mcu_fw_log_2_host(struct mt792x_dev *dev, u8 ctrl)
664 {
665 	struct {
666 		u8 _rsv[4];
667 
668 		__le16 tag;
669 		__le16 len;
670 		u8 ctrl;
671 		u8 interval;
672 		u8 _rsv2[2];
673 	} __packed req = {
674 		.tag = cpu_to_le16(UNI_WSYS_CONFIG_FW_LOG_CTRL),
675 		.len = cpu_to_le16(sizeof(req) - 4),
676 		.ctrl = ctrl,
677 	};
678 	int ret;
679 
680 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(WSYS_CONFIG),
681 					&req, sizeof(req), false, NULL);
682 	return ret;
683 }
684 
685 int mt7925_mcu_get_temperature(struct mt792x_phy *phy)
686 {
687 	struct {
688 		u8 _rsv[4];
689 
690 		__le16 tag;
691 		__le16 len;
692 		u8 _rsv2[4];
693 	} __packed req = {
694 		.tag = cpu_to_le16(0x0),
695 		.len = cpu_to_le16(sizeof(req) - 4),
696 	};
697 	struct mt7925_thermal_evt {
698 		u8 rsv[4];
699 		__le32 temperature;
700 	} __packed * evt;
701 	struct mt792x_dev *dev = phy->dev;
702 	int temperature, ret;
703 	struct sk_buff *skb;
704 
705 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
706 					MCU_WM_UNI_CMD_QUERY(THERMAL),
707 					&req, sizeof(req), true, &skb);
708 	if (ret)
709 		return ret;
710 
711 	skb_pull(skb, 4 + sizeof(struct tlv));
712 	evt = (struct mt7925_thermal_evt *)skb->data;
713 
714 	temperature = le32_to_cpu(evt->temperature);
715 
716 	dev_kfree_skb(skb);
717 
718 	return temperature;
719 }
720 
721 static void
722 mt7925_mcu_parse_phy_cap(struct mt792x_dev *dev, char *data)
723 {
724 	struct mt76_phy *mphy = &dev->mt76.phy;
725 	struct mt76_dev *mdev = mphy->dev;
726 	struct mt7925_mcu_phy_cap {
727 		u8 ht;
728 		u8 vht;
729 		u8 _5g;
730 		u8 max_bw;
731 		u8 nss;
732 		u8 dbdc;
733 		u8 tx_ldpc;
734 		u8 rx_ldpc;
735 		u8 tx_stbc;
736 		u8 rx_stbc;
737 		u8 hw_path;
738 		u8 he;
739 		u8 eht;
740 	} __packed * cap;
741 	enum {
742 		WF0_24G,
743 		WF0_5G
744 	};
745 
746 	cap = (struct mt7925_mcu_phy_cap *)data;
747 
748 	mdev->phy.antenna_mask = BIT(cap->nss) - 1;
749 	mdev->phy.chainmask = mdev->phy.antenna_mask;
750 	mdev->phy.cap.has_2ghz = cap->hw_path & BIT(WF0_24G);
751 	mdev->phy.cap.has_5ghz = cap->hw_path & BIT(WF0_5G);
752 	dev->has_eht = cap->eht;
753 }
754 
755 static void
756 mt7925_mcu_parse_eml_cap(struct mt792x_dev *dev, char *data)
757 {
758 	struct mt7925_mcu_eml_cap {
759 		u8 rsv[4];
760 		__le16 eml_cap;
761 		u8 rsv2[6];
762 	} __packed * cap;
763 
764 	cap = (struct mt7925_mcu_eml_cap *)data;
765 
766 	dev->phy.eml_cap = le16_to_cpu(cap->eml_cap);
767 }
768 
769 static int
770 mt7925_mcu_get_nic_capability(struct mt792x_dev *dev)
771 {
772 	struct mt76_phy *mphy = &dev->mt76.phy;
773 	struct {
774 		u8 _rsv[4];
775 
776 		__le16 tag;
777 		__le16 len;
778 	} __packed req = {
779 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_NIC_CAPA),
780 		.len = cpu_to_le16(sizeof(req) - 4),
781 	};
782 	struct mt76_connac_cap_hdr {
783 		__le16 n_element;
784 		u8 rsv[2];
785 	} __packed * hdr;
786 	struct sk_buff *skb;
787 	int ret, i;
788 
789 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
790 					&req, sizeof(req), true, &skb);
791 	if (ret)
792 		return ret;
793 
794 	hdr = (struct mt76_connac_cap_hdr *)skb->data;
795 	if (skb->len < sizeof(*hdr)) {
796 		ret = -EINVAL;
797 		goto out;
798 	}
799 
800 	skb_pull(skb, sizeof(*hdr));
801 
802 	for (i = 0; i < le16_to_cpu(hdr->n_element); i++) {
803 		struct tlv *tlv = (struct tlv *)skb->data;
804 		int len;
805 
806 		if (skb->len < sizeof(*tlv))
807 			break;
808 
809 		len = le16_to_cpu(tlv->len);
810 		if (skb->len < len)
811 			break;
812 
813 		switch (le16_to_cpu(tlv->tag)) {
814 		case MT_NIC_CAP_6G:
815 			mphy->cap.has_6ghz = !!tlv->data[0];
816 			break;
817 		case MT_NIC_CAP_MAC_ADDR:
818 			memcpy(mphy->macaddr, (void *)tlv->data, ETH_ALEN);
819 			break;
820 		case MT_NIC_CAP_PHY:
821 			mt7925_mcu_parse_phy_cap(dev, tlv->data);
822 			break;
823 		case MT_NIC_CAP_CHIP_CAP:
824 			dev->phy.chip_cap = le64_to_cpu(*(__le64 *)tlv->data);
825 			break;
826 		case MT_NIC_CAP_EML_CAP:
827 			mt7925_mcu_parse_eml_cap(dev, tlv->data);
828 			break;
829 		default:
830 			break;
831 		}
832 		skb_pull(skb, len);
833 	}
834 out:
835 	dev_kfree_skb(skb);
836 	return ret;
837 }
838 
839 int mt7925_mcu_chip_config(struct mt792x_dev *dev, const char *cmd)
840 {
841 	u16 len = strlen(cmd) + 1;
842 	struct {
843 		u8 _rsv[4];
844 		__le16 tag;
845 		__le16 len;
846 		struct mt76_connac_config config;
847 	} __packed req = {
848 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_CHIP_CFG),
849 		.len = cpu_to_le16(sizeof(req) - 4),
850 		.config = {
851 			.resp_type = 0,
852 			.type = 0,
853 			.data_size = cpu_to_le16(len),
854 		},
855 	};
856 
857 	memcpy(req.config.data, cmd, len);
858 
859 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
860 				 &req, sizeof(req), false);
861 }
862 
863 int mt7925_mcu_set_deep_sleep(struct mt792x_dev *dev, bool enable)
864 {
865 	char cmd[16];
866 
867 	snprintf(cmd, sizeof(cmd), "KeepFullPwr %d", !enable);
868 
869 	return mt7925_mcu_chip_config(dev, cmd);
870 }
871 EXPORT_SYMBOL_GPL(mt7925_mcu_set_deep_sleep);
872 
873 int mt7925_run_firmware(struct mt792x_dev *dev)
874 {
875 	int err;
876 
877 	err = mt792x_load_firmware(dev);
878 	if (err)
879 		return err;
880 
881 	err = mt7925_mcu_get_nic_capability(dev);
882 	if (err)
883 		return err;
884 
885 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
886 	err = mt7925_load_clc(dev, mt792x_ram_name(dev));
887 	if (err)
888 		return err;
889 
890 	return mt7925_mcu_fw_log_2_host(dev, 1);
891 }
892 EXPORT_SYMBOL_GPL(mt7925_run_firmware);
893 
894 static void
895 mt7925_mcu_sta_hdr_trans_tlv(struct sk_buff *skb,
896 			     struct ieee80211_vif *vif,
897 			     struct ieee80211_link_sta *link_sta)
898 {
899 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
900 	struct sta_rec_hdr_trans *hdr_trans;
901 	struct mt76_wcid *wcid;
902 	struct tlv *tlv;
903 
904 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HDR_TRANS, sizeof(*hdr_trans));
905 	hdr_trans = (struct sta_rec_hdr_trans *)tlv;
906 	hdr_trans->dis_rx_hdr_tran = true;
907 
908 	if (vif->type == NL80211_IFTYPE_STATION)
909 		hdr_trans->to_ds = true;
910 	else
911 		hdr_trans->from_ds = true;
912 
913 	if (link_sta) {
914 		struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
915 		struct mt792x_link_sta *mlink;
916 
917 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
918 		wcid = &mlink->wcid;
919 	} else {
920 		wcid = &mvif->sta.deflink.wcid;
921 	}
922 
923 	if (!wcid)
924 		return;
925 
926 	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
927 	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
928 		hdr_trans->to_ds = true;
929 		hdr_trans->from_ds = true;
930 	}
931 }
932 
933 int mt7925_mcu_wtbl_update_hdr_trans(struct mt792x_dev *dev,
934 				     struct ieee80211_vif *vif,
935 				     struct ieee80211_sta *sta,
936 				     int link_id)
937 {
938 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
939 	struct ieee80211_link_sta *link_sta = sta ? &sta->deflink : NULL;
940 	struct mt792x_link_sta *mlink;
941 	struct mt792x_bss_conf *mconf;
942 	struct mt792x_sta *msta;
943 	struct sk_buff *skb;
944 
945 	msta = sta ? (struct mt792x_sta *)sta->drv_priv : &mvif->sta;
946 
947 	mlink = mt792x_sta_to_link(msta, link_id);
948 	link_sta = mt792x_sta_to_link_sta(vif, sta, link_id);
949 	mconf = mt792x_vif_to_link(mvif, link_id);
950 
951 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
952 					      &mlink->wcid,
953 					      MT7925_STA_UPDATE_MAX_SIZE);
954 	if (IS_ERR(skb))
955 		return PTR_ERR(skb);
956 
957 	/* starec hdr trans */
958 	mt7925_mcu_sta_hdr_trans_tlv(skb, vif, link_sta);
959 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
960 				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
961 }
962 
963 int mt7925_mcu_set_tx(struct mt792x_dev *dev,
964 		      struct ieee80211_bss_conf *bss_conf)
965 {
966 #define MCU_EDCA_AC_PARAM	0
967 #define WMM_AIFS_SET		BIT(0)
968 #define WMM_CW_MIN_SET		BIT(1)
969 #define WMM_CW_MAX_SET		BIT(2)
970 #define WMM_TXOP_SET		BIT(3)
971 #define WMM_PARAM_SET		(WMM_AIFS_SET | WMM_CW_MIN_SET | \
972 				 WMM_CW_MAX_SET | WMM_TXOP_SET)
973 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(bss_conf);
974 	struct {
975 		u8 bss_idx;
976 		u8 __rsv[3];
977 	} __packed hdr = {
978 		.bss_idx = mconf->mt76.idx,
979 	};
980 	struct sk_buff *skb;
981 	int len = sizeof(hdr) + IEEE80211_NUM_ACS * sizeof(struct edca);
982 	int ac;
983 
984 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
985 	if (!skb)
986 		return -ENOMEM;
987 
988 	skb_put_data(skb, &hdr, sizeof(hdr));
989 
990 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
991 		struct ieee80211_tx_queue_params *q = &mconf->queue_params[ac];
992 		struct edca *e;
993 		struct tlv *tlv;
994 
995 		tlv = mt76_connac_mcu_add_tlv(skb, MCU_EDCA_AC_PARAM, sizeof(*e));
996 
997 		e = (struct edca *)tlv;
998 		e->set = WMM_PARAM_SET;
999 		e->queue = ac;
1000 		e->aifs = q->aifs;
1001 		e->txop = cpu_to_le16(q->txop);
1002 
1003 		if (q->cw_min)
1004 			e->cw_min = fls(q->cw_min);
1005 		else
1006 			e->cw_min = 5;
1007 
1008 		if (q->cw_max)
1009 			e->cw_max = fls(q->cw_max);
1010 		else
1011 			e->cw_max = 10;
1012 	}
1013 
1014 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1015 				     MCU_UNI_CMD(EDCA_UPDATE), true);
1016 }
1017 
1018 static int
1019 mt7925_mcu_sta_key_tlv(struct mt76_wcid *wcid,
1020 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1021 		       struct sk_buff *skb,
1022 		       struct ieee80211_key_conf *key,
1023 		       enum set_key_cmd cmd,
1024 		       struct mt792x_sta *msta)
1025 {
1026 	struct mt792x_vif *mvif = msta->vif;
1027 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1028 	struct sta_rec_sec_uni *sec;
1029 	struct ieee80211_sta *sta;
1030 	struct ieee80211_vif *vif;
1031 	struct tlv *tlv;
1032 
1033 	sta = msta == &mvif->sta ?
1034 		      NULL :
1035 		      container_of((void *)msta, struct ieee80211_sta, drv_priv);
1036 	vif = container_of((void *)mvif, struct ieee80211_vif, drv_priv);
1037 
1038 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V3, sizeof(*sec));
1039 	sec = (struct sta_rec_sec_uni *)tlv;
1040 	sec->bss_idx = mconf->mt76.idx;
1041 	sec->is_authenticator = 0;
1042 	sec->mgmt_prot = 1; /* only used in MLO mode */
1043 	sec->wlan_idx = (u8)wcid->idx;
1044 
1045 	if (sta) {
1046 		struct ieee80211_link_sta *link_sta;
1047 
1048 		sec->tx_key = 1;
1049 		sec->key_type = 1;
1050 		link_sta = mt792x_sta_to_link_sta(vif, sta, wcid->link_id);
1051 
1052 		if (link_sta)
1053 			memcpy(sec->peer_addr, link_sta->addr, ETH_ALEN);
1054 	} else {
1055 		struct ieee80211_bss_conf *link_conf;
1056 
1057 		link_conf = mt792x_vif_to_bss_conf(vif, wcid->link_id);
1058 
1059 		if (link_conf)
1060 			memcpy(sec->peer_addr, link_conf->bssid, ETH_ALEN);
1061 	}
1062 
1063 	if (cmd == SET_KEY) {
1064 		u8 cipher;
1065 
1066 		sec->add = 1;
1067 		cipher = mt7925_mcu_get_cipher(key->cipher);
1068 		if (cipher == CONNAC3_CIPHER_NONE)
1069 			return -EOPNOTSUPP;
1070 
1071 		if (cipher == CONNAC3_CIPHER_BIP_CMAC_128) {
1072 			sec->cipher_id = CONNAC3_CIPHER_BIP_CMAC_128;
1073 			sec->key_id = sta_key_conf->keyidx;
1074 			sec->key_len = 32;
1075 			memcpy(sec->key, sta_key_conf->key, 16);
1076 			memcpy(sec->key + 16, key->key, 16);
1077 		} else {
1078 			sec->cipher_id = cipher;
1079 			sec->key_id = key->keyidx;
1080 			sec->key_len = key->keylen;
1081 			memcpy(sec->key, key->key, key->keylen);
1082 
1083 			if (cipher == CONNAC3_CIPHER_TKIP) {
1084 				/* Rx/Tx MIC keys are swapped */
1085 				memcpy(sec->key + 16, key->key + 24, 8);
1086 				memcpy(sec->key + 24, key->key + 16, 8);
1087 			}
1088 
1089 			/* store key_conf for BIP batch update */
1090 			if (cipher == CONNAC3_CIPHER_AES_CCMP) {
1091 				memcpy(sta_key_conf->key, key->key, key->keylen);
1092 				sta_key_conf->keyidx = key->keyidx;
1093 			}
1094 		}
1095 	} else {
1096 		sec->add = 0;
1097 	}
1098 
1099 	return 0;
1100 }
1101 
1102 int mt7925_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
1103 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1104 		       struct ieee80211_key_conf *key, int mcu_cmd,
1105 		       struct mt76_wcid *wcid, enum set_key_cmd cmd,
1106 		       struct mt792x_sta *msta)
1107 {
1108 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1109 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1110 	struct sk_buff *skb;
1111 	int ret;
1112 
1113 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, wcid,
1114 					      MT7925_STA_UPDATE_MAX_SIZE);
1115 	if (IS_ERR(skb))
1116 		return PTR_ERR(skb);
1117 
1118 	ret = mt7925_mcu_sta_key_tlv(wcid, sta_key_conf, skb, key, cmd, msta);
1119 	if (ret)
1120 		return ret;
1121 
1122 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
1123 }
1124 
1125 int mt7925_mcu_set_mlo_roc(struct mt792x_bss_conf *mconf, u16 sel_links,
1126 			   int duration, u8 token_id)
1127 {
1128 	struct mt792x_vif *mvif = mconf->vif;
1129 	struct ieee80211_vif *vif = container_of((void *)mvif,
1130 						 struct ieee80211_vif, drv_priv);
1131 	struct ieee80211_bss_conf *link_conf;
1132 	struct ieee80211_channel *chan;
1133 	const u8 ch_band[] = {
1134 		[NL80211_BAND_2GHZ] = 1,
1135 		[NL80211_BAND_5GHZ] = 2,
1136 		[NL80211_BAND_6GHZ] = 3,
1137 	};
1138 	enum mt7925_roc_req type;
1139 	int center_ch, i = 0;
1140 	bool is_AG_band = false;
1141 	struct {
1142 		u8 id;
1143 		u8 bss_idx;
1144 		u16 tag;
1145 		struct mt792x_bss_conf *mconf;
1146 		struct ieee80211_channel *chan;
1147 	} links[2];
1148 
1149 	struct {
1150 		struct {
1151 			u8 rsv[4];
1152 		} __packed hdr;
1153 		struct roc_acquire_tlv roc[2];
1154 	} __packed req = {
1155 			.roc[0].tag = cpu_to_le16(UNI_ROC_NUM),
1156 			.roc[0].len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1157 			.roc[1].tag = cpu_to_le16(UNI_ROC_NUM),
1158 			.roc[1].len = cpu_to_le16(sizeof(struct roc_acquire_tlv))
1159 	};
1160 
1161 	if (!mconf || hweight16(vif->valid_links) < 2 ||
1162 	    hweight16(sel_links) != 2)
1163 		return -EPERM;
1164 
1165 	for (i = 0; i < ARRAY_SIZE(links); i++) {
1166 		links[i].id = i ? __ffs(~BIT(mconf->link_id) & sel_links) :
1167 				 mconf->link_id;
1168 		link_conf = mt792x_vif_to_bss_conf(vif, links[i].id);
1169 		if (WARN_ON_ONCE(!link_conf))
1170 			return -EPERM;
1171 
1172 		links[i].chan = link_conf->chanreq.oper.chan;
1173 		if (WARN_ON_ONCE(!links[i].chan))
1174 			return -EPERM;
1175 
1176 		links[i].mconf = mt792x_vif_to_link(mvif, links[i].id);
1177 		links[i].tag = links[i].id == mconf->link_id ?
1178 			       UNI_ROC_ACQUIRE : UNI_ROC_SUB_LINK;
1179 
1180 		is_AG_band |= links[i].chan->band == NL80211_BAND_2GHZ;
1181 	}
1182 
1183 	if (vif->cfg.eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP)
1184 		type = is_AG_band ? MT7925_ROC_REQ_MLSR_AG :
1185 				    MT7925_ROC_REQ_MLSR_AA;
1186 	else
1187 		type = MT7925_ROC_REQ_JOIN;
1188 
1189 	for (i = 0; i < ARRAY_SIZE(links) && i < hweight16(vif->active_links); i++) {
1190 		if (WARN_ON_ONCE(!links[i].mconf || !links[i].chan))
1191 			continue;
1192 
1193 		chan = links[i].chan;
1194 		center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1195 		req.roc[i].len = cpu_to_le16(sizeof(struct roc_acquire_tlv));
1196 		req.roc[i].tag = cpu_to_le16(links[i].tag);
1197 		req.roc[i].tokenid = token_id;
1198 		req.roc[i].reqtype = type;
1199 		req.roc[i].maxinterval = cpu_to_le32(duration);
1200 		req.roc[i].bss_idx = links[i].mconf->mt76.idx;
1201 		req.roc[i].control_channel = chan->hw_value;
1202 		req.roc[i].bw = CMD_CBW_20MHZ;
1203 		req.roc[i].bw_from_ap = CMD_CBW_20MHZ;
1204 		req.roc[i].center_chan = center_ch;
1205 		req.roc[i].center_chan_from_ap = center_ch;
1206 		req.roc[i].center_chan2 = 0;
1207 		req.roc[i].center_chan2_from_ap = 0;
1208 
1209 		/* STR : 0xfe indicates BAND_ALL with enabling DBDC
1210 		 * EMLSR : 0xff indicates (BAND_AUTO) without DBDC
1211 		 */
1212 		req.roc[i].dbdcband = type == MT7925_ROC_REQ_JOIN ? 0xfe : 0xff;
1213 
1214 		if (chan->hw_value < center_ch)
1215 			req.roc[i].sco = 1; /* SCA */
1216 		else if (chan->hw_value > center_ch)
1217 			req.roc[i].sco = 3; /* SCB */
1218 
1219 		req.roc[i].band = ch_band[chan->band];
1220 	}
1221 
1222 	return mt76_mcu_send_msg(&mvif->phy->dev->mt76, MCU_UNI_CMD(ROC),
1223 				 &req, sizeof(req), false);
1224 }
1225 
1226 int mt7925_mcu_set_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1227 		       struct ieee80211_channel *chan, int duration,
1228 		       enum mt7925_roc_req type, u8 token_id)
1229 {
1230 	int center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1231 	struct mt792x_dev *dev = phy->dev;
1232 	struct {
1233 		struct {
1234 			u8 rsv[4];
1235 		} __packed hdr;
1236 		struct roc_acquire_tlv roc;
1237 	} __packed req = {
1238 		.roc = {
1239 			.tag = cpu_to_le16(UNI_ROC_ACQUIRE),
1240 			.len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1241 			.tokenid = token_id,
1242 			.reqtype = type,
1243 			.maxinterval = cpu_to_le32(duration),
1244 			.bss_idx = mconf->mt76.idx,
1245 			.control_channel = chan->hw_value,
1246 			.bw = CMD_CBW_20MHZ,
1247 			.bw_from_ap = CMD_CBW_20MHZ,
1248 			.center_chan = center_ch,
1249 			.center_chan_from_ap = center_ch,
1250 			.dbdcband = 0xff, /* auto */
1251 		},
1252 	};
1253 
1254 	if (chan->hw_value < center_ch)
1255 		req.roc.sco = 1; /* SCA */
1256 	else if (chan->hw_value > center_ch)
1257 		req.roc.sco = 3; /* SCB */
1258 
1259 	switch (chan->band) {
1260 	case NL80211_BAND_6GHZ:
1261 		req.roc.band = 3;
1262 		break;
1263 	case NL80211_BAND_5GHZ:
1264 		req.roc.band = 2;
1265 		break;
1266 	default:
1267 		req.roc.band = 1;
1268 		break;
1269 	}
1270 
1271 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1272 				 &req, sizeof(req), false);
1273 }
1274 
1275 int mt7925_mcu_abort_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1276 			 u8 token_id)
1277 {
1278 	struct mt792x_dev *dev = phy->dev;
1279 	struct {
1280 		struct {
1281 			u8 rsv[4];
1282 		} __packed hdr;
1283 		struct roc_abort_tlv {
1284 			__le16 tag;
1285 			__le16 len;
1286 			u8 bss_idx;
1287 			u8 tokenid;
1288 			u8 dbdcband;
1289 			u8 rsv[5];
1290 		} __packed abort;
1291 	} __packed req = {
1292 		.abort = {
1293 			.tag = cpu_to_le16(UNI_ROC_ABORT),
1294 			.len = cpu_to_le16(sizeof(struct roc_abort_tlv)),
1295 			.tokenid = token_id,
1296 			.bss_idx = mconf->mt76.idx,
1297 			.dbdcband = 0xff, /* auto*/
1298 		},
1299 	};
1300 
1301 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1302 				 &req, sizeof(req), false);
1303 }
1304 
1305 int mt7925_mcu_set_eeprom(struct mt792x_dev *dev)
1306 {
1307 	struct {
1308 		u8 _rsv[4];
1309 
1310 		__le16 tag;
1311 		__le16 len;
1312 		u8 buffer_mode;
1313 		u8 format;
1314 		__le16 buf_len;
1315 	} __packed req = {
1316 		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
1317 		.len = cpu_to_le16(sizeof(req) - 4),
1318 		.buffer_mode = EE_MODE_EFUSE,
1319 		.format = EE_FORMAT_WHOLE
1320 	};
1321 
1322 	return mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(EFUSE_CTRL),
1323 					 &req, sizeof(req), false, NULL);
1324 }
1325 EXPORT_SYMBOL_GPL(mt7925_mcu_set_eeprom);
1326 
1327 int mt7925_mcu_uni_bss_ps(struct mt792x_dev *dev,
1328 			  struct ieee80211_bss_conf *link_conf)
1329 {
1330 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1331 	struct {
1332 		struct {
1333 			u8 bss_idx;
1334 			u8 pad[3];
1335 		} __packed hdr;
1336 		struct ps_tlv {
1337 			__le16 tag;
1338 			__le16 len;
1339 			u8 ps_state; /* 0: device awake
1340 				      * 1: static power save
1341 				      * 2: dynamic power saving
1342 				      * 3: enter TWT power saving
1343 				      * 4: leave TWT power saving
1344 				      */
1345 			u8 pad[3];
1346 		} __packed ps;
1347 	} __packed ps_req = {
1348 		.hdr = {
1349 			.bss_idx = mconf->mt76.idx,
1350 		},
1351 		.ps = {
1352 			.tag = cpu_to_le16(UNI_BSS_INFO_PS),
1353 			.len = cpu_to_le16(sizeof(struct ps_tlv)),
1354 			.ps_state = link_conf->vif->cfg.ps ? 2 : 0,
1355 		},
1356 	};
1357 
1358 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1359 		return -EOPNOTSUPP;
1360 
1361 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1362 				 &ps_req, sizeof(ps_req), true);
1363 }
1364 
1365 int
1366 mt7925_mcu_uni_bss_bcnft(struct mt792x_dev *dev,
1367 			 struct ieee80211_bss_conf *link_conf, bool enable)
1368 {
1369 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1370 	struct {
1371 		struct {
1372 			u8 bss_idx;
1373 			u8 pad[3];
1374 		} __packed hdr;
1375 		struct bcnft_tlv {
1376 			__le16 tag;
1377 			__le16 len;
1378 			__le16 bcn_interval;
1379 			u8 dtim_period;
1380 			u8 bmc_delivered_ac;
1381 			u8 bmc_triggered_ac;
1382 			u8 pad[3];
1383 		} __packed bcnft;
1384 	} __packed bcnft_req = {
1385 		.hdr = {
1386 			.bss_idx = mconf->mt76.idx,
1387 		},
1388 		.bcnft = {
1389 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1390 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1391 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1392 			.dtim_period = link_conf->dtim_period,
1393 		},
1394 	};
1395 
1396 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1397 		return 0;
1398 
1399 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1400 				 &bcnft_req, sizeof(bcnft_req), true);
1401 }
1402 
1403 int
1404 mt7925_mcu_set_bss_pm(struct mt792x_dev *dev,
1405 		      struct ieee80211_bss_conf *link_conf,
1406 		      bool enable)
1407 {
1408 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1409 	struct {
1410 		struct {
1411 			u8 bss_idx;
1412 			u8 pad[3];
1413 		} __packed hdr;
1414 		struct bcnft_tlv {
1415 			__le16 tag;
1416 			__le16 len;
1417 			__le16 bcn_interval;
1418 			u8 dtim_period;
1419 			u8 bmc_delivered_ac;
1420 			u8 bmc_triggered_ac;
1421 			u8 pad[3];
1422 		} __packed enable;
1423 	} req = {
1424 		.hdr = {
1425 			.bss_idx = mconf->mt76.idx,
1426 		},
1427 		.enable = {
1428 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1429 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1430 			.dtim_period = link_conf->dtim_period,
1431 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1432 		},
1433 	};
1434 	struct {
1435 		struct {
1436 			u8 bss_idx;
1437 			u8 pad[3];
1438 		} __packed hdr;
1439 		struct pm_disable {
1440 			__le16 tag;
1441 			__le16 len;
1442 		} __packed disable;
1443 	} req1 = {
1444 		.hdr = {
1445 			.bss_idx = mconf->mt76.idx,
1446 		},
1447 		.disable = {
1448 			.tag = cpu_to_le16(UNI_BSS_INFO_PM_DISABLE),
1449 			.len = cpu_to_le16(sizeof(struct pm_disable))
1450 		},
1451 	};
1452 	int err;
1453 
1454 	err = mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1455 				&req1, sizeof(req1), false);
1456 	if (err < 0 || !enable)
1457 		return err;
1458 
1459 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1460 				 &req, sizeof(req), false);
1461 }
1462 
1463 static void
1464 mt7925_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1465 {
1466 	if (!link_sta->he_cap.has_he)
1467 		return;
1468 
1469 	mt76_connac_mcu_sta_he_tlv_v2(skb, link_sta->sta);
1470 }
1471 
1472 static void
1473 mt7925_mcu_sta_he_6g_tlv(struct sk_buff *skb,
1474 			 struct ieee80211_link_sta *link_sta)
1475 {
1476 	struct sta_rec_he_6g_capa *he_6g;
1477 	struct tlv *tlv;
1478 
1479 	if (!link_sta->he_6ghz_capa.capa)
1480 		return;
1481 
1482 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G, sizeof(*he_6g));
1483 
1484 	he_6g = (struct sta_rec_he_6g_capa *)tlv;
1485 	he_6g->capa = link_sta->he_6ghz_capa.capa;
1486 }
1487 
1488 static void
1489 mt7925_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1490 {
1491 	struct ieee80211_eht_mcs_nss_supp *mcs_map;
1492 	struct ieee80211_eht_cap_elem_fixed *elem;
1493 	struct sta_rec_eht *eht;
1494 	struct tlv *tlv;
1495 
1496 	if (!link_sta->eht_cap.has_eht)
1497 		return;
1498 
1499 	mcs_map = &link_sta->eht_cap.eht_mcs_nss_supp;
1500 	elem = &link_sta->eht_cap.eht_cap_elem;
1501 
1502 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT, sizeof(*eht));
1503 
1504 	eht = (struct sta_rec_eht *)tlv;
1505 	eht->tid_bitmap = 0xff;
1506 	eht->mac_cap = cpu_to_le16(*(u16 *)elem->mac_cap_info);
1507 	eht->phy_cap = cpu_to_le64(*(u64 *)elem->phy_cap_info);
1508 	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
1509 
1510 	if (link_sta->bandwidth == IEEE80211_STA_RX_BW_20)
1511 		memcpy(eht->mcs_map_bw20, &mcs_map->only_20mhz, sizeof(eht->mcs_map_bw20));
1512 	memcpy(eht->mcs_map_bw80, &mcs_map->bw._80, sizeof(eht->mcs_map_bw80));
1513 	memcpy(eht->mcs_map_bw160, &mcs_map->bw._160, sizeof(eht->mcs_map_bw160));
1514 }
1515 
1516 static void
1517 mt7925_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1518 {
1519 	struct sta_rec_ht *ht;
1520 	struct tlv *tlv;
1521 
1522 	if (!link_sta->ht_cap.ht_supported)
1523 		return;
1524 
1525 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1526 
1527 	ht = (struct sta_rec_ht *)tlv;
1528 	ht->ht_cap = cpu_to_le16(link_sta->ht_cap.cap);
1529 }
1530 
1531 static void
1532 mt7925_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1533 {
1534 	struct sta_rec_vht *vht;
1535 	struct tlv *tlv;
1536 
1537 	/* For 6G band, this tlv is necessary to let hw work normally */
1538 	if (!link_sta->he_6ghz_capa.capa && !link_sta->vht_cap.vht_supported)
1539 		return;
1540 
1541 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1542 
1543 	vht = (struct sta_rec_vht *)tlv;
1544 	vht->vht_cap = cpu_to_le32(link_sta->vht_cap.cap);
1545 	vht->vht_rx_mcs_map = link_sta->vht_cap.vht_mcs.rx_mcs_map;
1546 	vht->vht_tx_mcs_map = link_sta->vht_cap.vht_mcs.tx_mcs_map;
1547 }
1548 
1549 static void
1550 mt7925_mcu_sta_amsdu_tlv(struct sk_buff *skb,
1551 			 struct ieee80211_vif *vif,
1552 			 struct ieee80211_link_sta *link_sta)
1553 {
1554 	struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1555 	struct mt792x_link_sta *mlink;
1556 	struct sta_rec_amsdu *amsdu;
1557 	struct tlv *tlv;
1558 
1559 	if (vif->type != NL80211_IFTYPE_STATION &&
1560 	    vif->type != NL80211_IFTYPE_AP)
1561 		return;
1562 
1563 	if (!link_sta->agg.max_amsdu_len)
1564 		return;
1565 
1566 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1567 	amsdu = (struct sta_rec_amsdu *)tlv;
1568 	amsdu->max_amsdu_num = 8;
1569 	amsdu->amsdu_en = true;
1570 
1571 	mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1572 	mlink->wcid.amsdu = true;
1573 
1574 	switch (link_sta->agg.max_amsdu_len) {
1575 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1576 		amsdu->max_mpdu_size =
1577 			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1578 		return;
1579 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
1580 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1581 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1582 		return;
1583 	default:
1584 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1585 		return;
1586 	}
1587 }
1588 
1589 static void
1590 mt7925_mcu_sta_phy_tlv(struct sk_buff *skb,
1591 		       struct ieee80211_vif *vif,
1592 		       struct ieee80211_link_sta *link_sta)
1593 {
1594 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1595 	struct ieee80211_bss_conf *link_conf;
1596 	struct cfg80211_chan_def *chandef;
1597 	struct mt792x_bss_conf *mconf;
1598 	struct sta_rec_phy *phy;
1599 	struct tlv *tlv;
1600 	u8 af = 0, mm = 0;
1601 
1602 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1603 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1604 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1605 				    &link_conf->chanreq.oper;
1606 
1607 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PHY, sizeof(*phy));
1608 	phy = (struct sta_rec_phy *)tlv;
1609 	phy->phy_type = mt76_connac_get_phy_mode_v2(mvif->phy->mt76, vif,
1610 						    chandef->chan->band,
1611 						    link_sta);
1612 	phy->basic_rate = cpu_to_le16((u16)link_conf->basic_rates);
1613 	if (link_sta->ht_cap.ht_supported) {
1614 		af = link_sta->ht_cap.ampdu_factor;
1615 		mm = link_sta->ht_cap.ampdu_density;
1616 	}
1617 
1618 	if (link_sta->vht_cap.vht_supported) {
1619 		u8 vht_af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1620 				      link_sta->vht_cap.cap);
1621 
1622 		af = max_t(u8, af, vht_af);
1623 	}
1624 
1625 	if (link_sta->he_6ghz_capa.capa) {
1626 		af = le16_get_bits(link_sta->he_6ghz_capa.capa,
1627 				   IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1628 		mm = le16_get_bits(link_sta->he_6ghz_capa.capa,
1629 				   IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
1630 	}
1631 
1632 	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR, af) |
1633 		     FIELD_PREP(IEEE80211_HT_AMPDU_PARM_DENSITY, mm);
1634 	phy->max_ampdu_len = af;
1635 }
1636 
1637 static void
1638 mt7925_mcu_sta_state_v2_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
1639 			    struct ieee80211_link_sta *link_sta,
1640 			    struct ieee80211_vif *vif,
1641 			    u8 rcpi, u8 sta_state)
1642 {
1643 	struct sta_rec_state_v2 {
1644 		__le16 tag;
1645 		__le16 len;
1646 		u8 state;
1647 		u8 rsv[3];
1648 		__le32 flags;
1649 		u8 vht_opmode;
1650 		u8 action;
1651 		u8 rsv2[2];
1652 	} __packed * state;
1653 	struct tlv *tlv;
1654 
1655 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_STATE, sizeof(*state));
1656 	state = (struct sta_rec_state_v2 *)tlv;
1657 	state->state = sta_state;
1658 
1659 	if (link_sta->vht_cap.vht_supported) {
1660 		state->vht_opmode = link_sta->bandwidth;
1661 		state->vht_opmode |= link_sta->rx_nss <<
1662 			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
1663 	}
1664 }
1665 
1666 static void
1667 mt7925_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb,
1668 			     struct ieee80211_vif *vif,
1669 			     struct ieee80211_link_sta *link_sta)
1670 {
1671 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1672 	struct ieee80211_bss_conf *link_conf;
1673 	struct cfg80211_chan_def *chandef;
1674 	struct sta_rec_ra_info *ra_info;
1675 	struct mt792x_bss_conf *mconf;
1676 	enum nl80211_band band;
1677 	struct tlv *tlv;
1678 	u16 supp_rates;
1679 
1680 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1681 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1682 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1683 				    &link_conf->chanreq.oper;
1684 	band = chandef->chan->band;
1685 
1686 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra_info));
1687 	ra_info = (struct sta_rec_ra_info *)tlv;
1688 
1689 	supp_rates = link_sta->supp_rates[band];
1690 	if (band == NL80211_BAND_2GHZ)
1691 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
1692 			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
1693 	else
1694 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates);
1695 
1696 	ra_info->legacy = cpu_to_le16(supp_rates);
1697 
1698 	if (link_sta->ht_cap.ht_supported)
1699 		memcpy(ra_info->rx_mcs_bitmask,
1700 		       link_sta->ht_cap.mcs.rx_mask,
1701 		       HT_MCS_MASK_NUM);
1702 }
1703 
1704 static void
1705 mt7925_mcu_sta_eht_mld_tlv(struct sk_buff *skb,
1706 			   struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1707 {
1708 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1709 	struct wiphy *wiphy = mvif->phy->mt76->hw->wiphy;
1710 	const struct wiphy_iftype_ext_capab *ext_capa;
1711 	struct sta_rec_eht_mld *eht_mld;
1712 	struct tlv *tlv;
1713 	u16 eml_cap;
1714 
1715 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT_MLD, sizeof(*eht_mld));
1716 	eht_mld = (struct sta_rec_eht_mld *)tlv;
1717 	eht_mld->mld_type = 0xff;
1718 
1719 	if (!ieee80211_vif_is_mld(vif))
1720 		return;
1721 
1722 	ext_capa = cfg80211_get_iftype_ext_capa(wiphy,
1723 						ieee80211_vif_type_p2p(vif));
1724 	if (!ext_capa)
1725 		return;
1726 
1727 	eml_cap = (vif->cfg.eml_cap & (IEEE80211_EML_CAP_EMLSR_SUPP |
1728 				       IEEE80211_EML_CAP_TRANSITION_TIMEOUT)) |
1729 		  (ext_capa->eml_capabilities & (IEEE80211_EML_CAP_EMLSR_PADDING_DELAY |
1730 						IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY));
1731 
1732 	if (eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP) {
1733 		eht_mld->eml_cap[0] = u16_get_bits(eml_cap, GENMASK(7, 0));
1734 		eht_mld->eml_cap[1] = u16_get_bits(eml_cap, GENMASK(15, 8));
1735 	} else {
1736 		eht_mld->str_cap[0] = BIT(1);
1737 	}
1738 }
1739 
1740 static void
1741 mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,
1742 		       struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1743 {
1744 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1745 	struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv;
1746 	unsigned long valid = mvif->valid_links;
1747 	struct mt792x_bss_conf *mconf;
1748 	struct mt792x_link_sta *mlink;
1749 	struct sta_rec_mld *mld;
1750 	struct tlv *tlv;
1751 	int i, cnt = 0;
1752 
1753 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MLD, sizeof(*mld));
1754 	mld = (struct sta_rec_mld *)tlv;
1755 	memcpy(mld->mac_addr, sta->addr, ETH_ALEN);
1756 	mld->primary_id = cpu_to_le16(msta->deflink.wcid.idx);
1757 	mld->wlan_id = cpu_to_le16(msta->deflink.wcid.idx);
1758 	mld->link_num = min_t(u8, hweight16(mvif->valid_links), 2);
1759 
1760 	for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
1761 		if (cnt == mld->link_num)
1762 			break;
1763 
1764 		mconf = mt792x_vif_to_link(mvif, i);
1765 		mlink = mt792x_sta_to_link(msta, i);
1766 		mld->link[cnt].wlan_id = cpu_to_le16(mlink->wcid.idx);
1767 		mld->link[cnt++].bss_idx = mconf->mt76.idx;
1768 
1769 		if (mlink != &msta->deflink)
1770 			mld->secondary_id = cpu_to_le16(mlink->wcid.idx);
1771 	}
1772 }
1773 
1774 static int
1775 mt7925_mcu_sta_cmd(struct mt76_phy *phy,
1776 		   struct mt76_sta_cmd_info *info)
1777 {
1778 	struct mt76_vif *mvif = (struct mt76_vif *)info->vif->drv_priv;
1779 	struct mt76_dev *dev = phy->dev;
1780 	struct sk_buff *skb;
1781 	int conn_state;
1782 
1783 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, info->wcid,
1784 					      MT7925_STA_UPDATE_MAX_SIZE);
1785 	if (IS_ERR(skb))
1786 		return PTR_ERR(skb);
1787 
1788 	conn_state = info->enable ? CONN_STATE_PORT_SECURE :
1789 				    CONN_STATE_DISCONNECT;
1790 	if (info->link_sta)
1791 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif,
1792 					      info->link_sta,
1793 					      conn_state, info->newly);
1794 	if (info->link_sta && info->enable) {
1795 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1796 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1797 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1798 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1799 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1800 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1801 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1802 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1803 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1804 					     info->link_sta);
1805 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1806 					    info->vif, info->rcpi,
1807 					    info->state);
1808 		mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1809 	}
1810 
1811 	if (info->enable)
1812 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
1813 
1814 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1815 }
1816 
1817 static void
1818 mt7925_mcu_sta_remove_tlv(struct sk_buff *skb)
1819 {
1820 	struct sta_rec_remove *rem;
1821 	struct tlv *tlv;
1822 
1823 	tlv = mt76_connac_mcu_add_tlv(skb, 0x25, sizeof(*rem));
1824 	rem = (struct sta_rec_remove *)tlv;
1825 	rem->action = 0;
1826 }
1827 
1828 static int
1829 mt7925_mcu_mlo_sta_cmd(struct mt76_phy *phy,
1830 		       struct mt76_sta_cmd_info *info)
1831 {
1832 	struct mt792x_vif *mvif = (struct mt792x_vif *)info->vif->drv_priv;
1833 	struct mt76_dev *dev = phy->dev;
1834 	struct mt792x_bss_conf *mconf;
1835 	struct sk_buff *skb;
1836 
1837 	mconf = mt792x_vif_to_link(mvif, info->wcid->link_id);
1838 
1839 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, info->wcid,
1840 					      MT7925_STA_UPDATE_MAX_SIZE);
1841 	if (IS_ERR(skb))
1842 		return PTR_ERR(skb);
1843 
1844 	if (info->enable)
1845 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif,
1846 					      info->link_sta,
1847 					      info->enable, info->newly);
1848 
1849 	if (info->enable && info->link_sta) {
1850 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1851 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1852 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1853 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1854 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1855 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1856 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1857 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1858 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1859 					     info->link_sta);
1860 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1861 					    info->vif, info->rcpi,
1862 					    info->state);
1863 
1864 		if (info->state != MT76_STA_INFO_STATE_NONE) {
1865 			mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1866 			mt7925_mcu_sta_eht_mld_tlv(skb, info->vif, info->link_sta->sta);
1867 		}
1868 
1869 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
1870 	}
1871 
1872 	if (!info->enable) {
1873 		mt7925_mcu_sta_remove_tlv(skb);
1874 		mt76_connac_mcu_add_tlv(skb, STA_REC_MLD_OFF,
1875 					sizeof(struct tlv));
1876 	}
1877 
1878 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1879 }
1880 
1881 int mt7925_mcu_sta_update(struct mt792x_dev *dev,
1882 			  struct ieee80211_link_sta *link_sta,
1883 			  struct ieee80211_vif *vif, bool enable,
1884 			  enum mt76_sta_info_state state)
1885 {
1886 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1887 	int rssi = -ewma_rssi_read(&mvif->bss_conf.rssi);
1888 	struct mt76_sta_cmd_info info = {
1889 		.link_sta = link_sta,
1890 		.vif = vif,
1891 		.enable = enable,
1892 		.cmd = MCU_UNI_CMD(STA_REC_UPDATE),
1893 		.state = state,
1894 		.offload_fw = true,
1895 		.rcpi = to_rcpi(rssi),
1896 	};
1897 	struct mt792x_sta *msta;
1898 	struct mt792x_link_sta *mlink;
1899 	int err;
1900 
1901 	if (link_sta) {
1902 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1903 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1904 	}
1905 	info.wcid = link_sta ? &mlink->wcid : &mvif->sta.deflink.wcid;
1906 
1907 	if (link_sta)
1908 		info.newly = state != MT76_STA_INFO_STATE_ASSOC;
1909 	else
1910 		info.newly = state == MT76_STA_INFO_STATE_ASSOC ? false : true;
1911 
1912 	if (ieee80211_vif_is_mld(vif))
1913 		err = mt7925_mcu_mlo_sta_cmd(&dev->mphy, &info);
1914 	else
1915 		err = mt7925_mcu_sta_cmd(&dev->mphy, &info);
1916 
1917 	return err;
1918 }
1919 
1920 int mt7925_mcu_set_beacon_filter(struct mt792x_dev *dev,
1921 				 struct ieee80211_vif *vif,
1922 				 bool enable)
1923 {
1924 #define MT7925_FIF_BIT_CLR		BIT(1)
1925 #define MT7925_FIF_BIT_SET		BIT(0)
1926 	int err = 0;
1927 
1928 	if (enable) {
1929 		err = mt7925_mcu_uni_bss_bcnft(dev, &vif->bss_conf, true);
1930 		if (err < 0)
1931 			return err;
1932 
1933 		return mt7925_mcu_set_rxfilter(dev, 0,
1934 					       MT7925_FIF_BIT_SET,
1935 					       MT_WF_RFCR_DROP_OTHER_BEACON);
1936 	}
1937 
1938 	err = mt7925_mcu_set_bss_pm(dev, &vif->bss_conf, false);
1939 	if (err < 0)
1940 		return err;
1941 
1942 	return mt7925_mcu_set_rxfilter(dev, 0,
1943 				       MT7925_FIF_BIT_CLR,
1944 				       MT_WF_RFCR_DROP_OTHER_BEACON);
1945 }
1946 
1947 int mt7925_get_txpwr_info(struct mt792x_dev *dev, u8 band_idx, struct mt7925_txpwr *txpwr)
1948 {
1949 #define TX_POWER_SHOW_INFO 0x7
1950 #define TXPOWER_ALL_RATE_POWER_INFO 0x2
1951 	struct mt7925_txpwr_event *event;
1952 	struct mt7925_txpwr_req req = {
1953 		.tag = cpu_to_le16(TX_POWER_SHOW_INFO),
1954 		.len = cpu_to_le16(sizeof(req) - 4),
1955 		.catg = TXPOWER_ALL_RATE_POWER_INFO,
1956 		.band_idx = band_idx,
1957 	};
1958 	struct sk_buff *skb;
1959 	int ret;
1960 
1961 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(TXPOWER),
1962 					&req, sizeof(req), true, &skb);
1963 	if (ret)
1964 		return ret;
1965 
1966 	event = (struct mt7925_txpwr_event *)skb->data;
1967 	memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
1968 
1969 	dev_kfree_skb(skb);
1970 
1971 	return 0;
1972 }
1973 
1974 int mt7925_mcu_set_sniffer(struct mt792x_dev *dev, struct ieee80211_vif *vif,
1975 			   bool enable)
1976 {
1977 	struct {
1978 		struct {
1979 			u8 band_idx;
1980 			u8 pad[3];
1981 		} __packed hdr;
1982 		struct sniffer_enable_tlv {
1983 			__le16 tag;
1984 			__le16 len;
1985 			u8 enable;
1986 			u8 pad[3];
1987 		} __packed enable;
1988 	} __packed req = {
1989 		.hdr = {
1990 			.band_idx = 0,
1991 		},
1992 		.enable = {
1993 			.tag = cpu_to_le16(UNI_SNIFFER_ENABLE),
1994 			.len = cpu_to_le16(sizeof(struct sniffer_enable_tlv)),
1995 			.enable = enable,
1996 		},
1997 	};
1998 
1999 	mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req), true);
2000 
2001 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req),
2002 				 true);
2003 }
2004 
2005 int mt7925_mcu_config_sniffer(struct mt792x_vif *vif,
2006 			      struct ieee80211_chanctx_conf *ctx)
2007 {
2008 	struct mt76_phy *mphy = vif->phy->mt76;
2009 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def : &mphy->chandef;
2010 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2011 
2012 	static const u8 ch_band[] = {
2013 		[NL80211_BAND_2GHZ] = 1,
2014 		[NL80211_BAND_5GHZ] = 2,
2015 		[NL80211_BAND_6GHZ] = 3,
2016 	};
2017 	static const u8 ch_width[] = {
2018 		[NL80211_CHAN_WIDTH_20_NOHT] = 0,
2019 		[NL80211_CHAN_WIDTH_20] = 0,
2020 		[NL80211_CHAN_WIDTH_40] = 0,
2021 		[NL80211_CHAN_WIDTH_80] = 1,
2022 		[NL80211_CHAN_WIDTH_160] = 2,
2023 		[NL80211_CHAN_WIDTH_80P80] = 3,
2024 		[NL80211_CHAN_WIDTH_5] = 4,
2025 		[NL80211_CHAN_WIDTH_10] = 5,
2026 		[NL80211_CHAN_WIDTH_320] = 6,
2027 	};
2028 
2029 	struct {
2030 		struct {
2031 			u8 band_idx;
2032 			u8 pad[3];
2033 		} __packed hdr;
2034 		struct config_tlv {
2035 			__le16 tag;
2036 			__le16 len;
2037 			u16 aid;
2038 			u8 ch_band;
2039 			u8 bw;
2040 			u8 control_ch;
2041 			u8 sco;
2042 			u8 center_ch;
2043 			u8 center_ch2;
2044 			u8 drop_err;
2045 			u8 pad[3];
2046 		} __packed tlv;
2047 	} __packed req = {
2048 		.hdr = {
2049 			.band_idx = 0,
2050 		},
2051 		.tlv = {
2052 			.tag = cpu_to_le16(UNI_SNIFFER_CONFIG),
2053 			.len = cpu_to_le16(sizeof(req.tlv)),
2054 			.control_ch = chandef->chan->hw_value,
2055 			.center_ch = ieee80211_frequency_to_channel(freq1),
2056 			.drop_err = 1,
2057 		},
2058 	};
2059 
2060 	if (chandef->chan->band < ARRAY_SIZE(ch_band))
2061 		req.tlv.ch_band = ch_band[chandef->chan->band];
2062 	if (chandef->width < ARRAY_SIZE(ch_width))
2063 		req.tlv.bw = ch_width[chandef->width];
2064 
2065 	if (freq2)
2066 		req.tlv.center_ch2 = ieee80211_frequency_to_channel(freq2);
2067 
2068 	if (req.tlv.control_ch < req.tlv.center_ch)
2069 		req.tlv.sco = 1; /* SCA */
2070 	else if (req.tlv.control_ch > req.tlv.center_ch)
2071 		req.tlv.sco = 3; /* SCB */
2072 
2073 	return mt76_mcu_send_msg(mphy->dev, MCU_UNI_CMD(SNIFFER),
2074 				 &req, sizeof(req), true);
2075 }
2076 
2077 int
2078 mt7925_mcu_uni_add_beacon_offload(struct mt792x_dev *dev,
2079 				  struct ieee80211_hw *hw,
2080 				  struct ieee80211_vif *vif,
2081 				  bool enable)
2082 {
2083 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
2084 	struct ieee80211_mutable_offsets offs;
2085 	struct {
2086 		struct req_hdr {
2087 			u8 bss_idx;
2088 			u8 pad[3];
2089 		} __packed hdr;
2090 		struct bcn_content_tlv {
2091 			__le16 tag;
2092 			__le16 len;
2093 			__le16 tim_ie_pos;
2094 			__le16 csa_ie_pos;
2095 			__le16 bcc_ie_pos;
2096 			/* 0: disable beacon offload
2097 			 * 1: enable beacon offload
2098 			 * 2: update probe respond offload
2099 			 */
2100 			u8 enable;
2101 			/* 0: legacy format (TXD + payload)
2102 			 * 1: only cap field IE
2103 			 */
2104 			u8 type;
2105 			__le16 pkt_len;
2106 			u8 pkt[512];
2107 		} __packed beacon_tlv;
2108 	} req = {
2109 		.hdr = {
2110 			.bss_idx = mvif->bss_conf.mt76.idx,
2111 		},
2112 		.beacon_tlv = {
2113 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
2114 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
2115 			.enable = enable,
2116 			.type = 1,
2117 		},
2118 	};
2119 	struct sk_buff *skb;
2120 	u8 cap_offs;
2121 
2122 	/* support enable/update process only
2123 	 * disable flow would be handled in bss stop handler automatically
2124 	 */
2125 	if (!enable)
2126 		return -EOPNOTSUPP;
2127 
2128 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs, 0);
2129 	if (!skb)
2130 		return -EINVAL;
2131 
2132 	cap_offs = offsetof(struct ieee80211_mgmt, u.beacon.capab_info);
2133 	if (!skb_pull(skb, cap_offs)) {
2134 		dev_err(dev->mt76.dev, "beacon format err\n");
2135 		dev_kfree_skb(skb);
2136 		return -EINVAL;
2137 	}
2138 
2139 	if (skb->len > 512) {
2140 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
2141 		dev_kfree_skb(skb);
2142 		return -EINVAL;
2143 	}
2144 
2145 	memcpy(req.beacon_tlv.pkt, skb->data, skb->len);
2146 	req.beacon_tlv.pkt_len = cpu_to_le16(skb->len);
2147 	offs.tim_offset -= cap_offs;
2148 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(offs.tim_offset);
2149 
2150 	if (offs.cntdwn_counter_offs[0]) {
2151 		u16 csa_offs;
2152 
2153 		csa_offs = offs.cntdwn_counter_offs[0] - cap_offs - 4;
2154 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
2155 	}
2156 	dev_kfree_skb(skb);
2157 
2158 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
2159 				 &req, sizeof(req), true);
2160 }
2161 
2162 static
2163 void mt7925_mcu_bss_rlm_tlv(struct sk_buff *skb, struct mt76_phy *phy,
2164 			    struct ieee80211_bss_conf *link_conf,
2165 			    struct ieee80211_chanctx_conf *ctx)
2166 {
2167 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2168 						  &link_conf->chanreq.oper;
2169 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2170 	enum nl80211_band band = chandef->chan->band;
2171 	struct bss_rlm_tlv *req;
2172 	struct tlv *tlv;
2173 
2174 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RLM, sizeof(*req));
2175 	req = (struct bss_rlm_tlv *)tlv;
2176 	req->control_channel = chandef->chan->hw_value;
2177 	req->center_chan = ieee80211_frequency_to_channel(freq1);
2178 	req->center_chan2 = 0;
2179 	req->tx_streams = hweight8(phy->antenna_mask);
2180 	req->ht_op_info = 4; /* set HT 40M allowed */
2181 	req->rx_streams = hweight8(phy->antenna_mask);
2182 	req->center_chan2 = 0;
2183 	req->sco = 0;
2184 	req->band = 1;
2185 
2186 	switch (band) {
2187 	case NL80211_BAND_2GHZ:
2188 		req->band = 1;
2189 		break;
2190 	case NL80211_BAND_5GHZ:
2191 		req->band = 2;
2192 		break;
2193 	case NL80211_BAND_6GHZ:
2194 		req->band = 3;
2195 		break;
2196 	default:
2197 		break;
2198 	}
2199 
2200 	switch (chandef->width) {
2201 	case NL80211_CHAN_WIDTH_40:
2202 		req->bw = CMD_CBW_40MHZ;
2203 		break;
2204 	case NL80211_CHAN_WIDTH_80:
2205 		req->bw = CMD_CBW_80MHZ;
2206 		break;
2207 	case NL80211_CHAN_WIDTH_80P80:
2208 		req->bw = CMD_CBW_8080MHZ;
2209 		req->center_chan2 = ieee80211_frequency_to_channel(freq2);
2210 		break;
2211 	case NL80211_CHAN_WIDTH_160:
2212 		req->bw = CMD_CBW_160MHZ;
2213 		break;
2214 	case NL80211_CHAN_WIDTH_5:
2215 		req->bw = CMD_CBW_5MHZ;
2216 		break;
2217 	case NL80211_CHAN_WIDTH_10:
2218 		req->bw = CMD_CBW_10MHZ;
2219 		break;
2220 	case NL80211_CHAN_WIDTH_20_NOHT:
2221 	case NL80211_CHAN_WIDTH_20:
2222 	default:
2223 		req->bw = CMD_CBW_20MHZ;
2224 		req->ht_op_info = 0;
2225 		break;
2226 	}
2227 
2228 	if (req->control_channel < req->center_chan)
2229 		req->sco = 1; /* SCA */
2230 	else if (req->control_channel > req->center_chan)
2231 		req->sco = 3; /* SCB */
2232 }
2233 
2234 static struct sk_buff *
2235 __mt7925_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
2236 {
2237 	struct bss_req_hdr hdr = {
2238 		.bss_idx = mvif->idx,
2239 	};
2240 	struct sk_buff *skb;
2241 
2242 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
2243 	if (!skb)
2244 		return ERR_PTR(-ENOMEM);
2245 
2246 	skb_put_data(skb, &hdr, sizeof(hdr));
2247 
2248 	return skb;
2249 }
2250 
2251 int mt7925_mcu_set_chctx(struct mt76_phy *phy, struct mt76_vif *mvif,
2252 			 struct ieee80211_bss_conf *link_conf,
2253 			 struct ieee80211_chanctx_conf *ctx)
2254 {
2255 	struct sk_buff *skb;
2256 
2257 	skb = __mt7925_mcu_alloc_bss_req(phy->dev, mvif,
2258 					 MT7925_BSS_UPDATE_MAX_SIZE);
2259 	if (IS_ERR(skb))
2260 		return PTR_ERR(skb);
2261 
2262 	mt7925_mcu_bss_rlm_tlv(skb, phy, link_conf, ctx);
2263 
2264 	return mt76_mcu_skb_send_msg(phy->dev, skb,
2265 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2266 }
2267 
2268 static u8
2269 mt7925_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
2270 			enum nl80211_band band,
2271 			struct ieee80211_link_sta *link_sta)
2272 {
2273 	struct ieee80211_he_6ghz_capa *he_6ghz_capa;
2274 	const struct ieee80211_sta_eht_cap *eht_cap;
2275 	__le16 capa = 0;
2276 	u8 mode = 0;
2277 
2278 	if (link_sta) {
2279 		he_6ghz_capa = &link_sta->he_6ghz_capa;
2280 		eht_cap = &link_sta->eht_cap;
2281 	} else {
2282 		struct ieee80211_supported_band *sband;
2283 
2284 		sband = phy->hw->wiphy->bands[band];
2285 		capa = ieee80211_get_he_6ghz_capa(sband, vif->type);
2286 		he_6ghz_capa = (struct ieee80211_he_6ghz_capa *)&capa;
2287 
2288 		eht_cap = ieee80211_get_eht_iftype_cap(sband, vif->type);
2289 	}
2290 
2291 	switch (band) {
2292 	case NL80211_BAND_2GHZ:
2293 		if (eht_cap && eht_cap->has_eht)
2294 			mode |= PHY_MODE_BE_24G;
2295 		break;
2296 	case NL80211_BAND_5GHZ:
2297 		if (eht_cap && eht_cap->has_eht)
2298 			mode |= PHY_MODE_BE_5G;
2299 		break;
2300 	case NL80211_BAND_6GHZ:
2301 		if (he_6ghz_capa && he_6ghz_capa->capa)
2302 			mode |= PHY_MODE_AX_6G;
2303 
2304 		if (eht_cap && eht_cap->has_eht)
2305 			mode |= PHY_MODE_BE_6G;
2306 		break;
2307 	default:
2308 		break;
2309 	}
2310 
2311 	return mode;
2312 }
2313 
2314 static void
2315 mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
2316 			 struct ieee80211_bss_conf *link_conf,
2317 			 struct ieee80211_link_sta *link_sta,
2318 			 struct ieee80211_chanctx_conf *ctx,
2319 			 struct mt76_phy *phy, u16 wlan_idx,
2320 			 bool enable)
2321 {
2322 	struct ieee80211_vif *vif = link_conf->vif;
2323 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2324 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2325 						  &link_conf->chanreq.oper;
2326 	enum nl80211_band band = chandef->chan->band;
2327 	struct mt76_connac_bss_basic_tlv *basic_req;
2328 	struct mt792x_link_sta *mlink;
2329 	struct tlv *tlv;
2330 	int conn_type;
2331 	u8 idx;
2332 
2333 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*basic_req));
2334 	basic_req = (struct mt76_connac_bss_basic_tlv *)tlv;
2335 
2336 	idx = mconf->mt76.omac_idx > EXT_BSSID_START ? HW_BSSID_0 :
2337 						      mconf->mt76.omac_idx;
2338 	basic_req->hw_bss_idx = idx;
2339 
2340 	basic_req->phymode_ext = mt7925_get_phy_mode_ext(phy, vif, band,
2341 							 link_sta);
2342 
2343 	if (band == NL80211_BAND_2GHZ)
2344 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_ERP_INDEX);
2345 	else
2346 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_OFDM_INDEX);
2347 
2348 	memcpy(basic_req->bssid, link_conf->bssid, ETH_ALEN);
2349 	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, link_sta);
2350 	basic_req->bcn_interval = cpu_to_le16(link_conf->beacon_int);
2351 	basic_req->dtim_period = link_conf->dtim_period;
2352 	basic_req->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
2353 	basic_req->link_idx = mconf->mt76.idx;
2354 
2355 	if (link_sta) {
2356 		struct mt792x_sta *msta;
2357 
2358 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
2359 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
2360 
2361 	} else {
2362 		mlink = &mconf->vif->sta.deflink;
2363 	}
2364 
2365 	basic_req->sta_idx = cpu_to_le16(mlink->wcid.idx);
2366 	basic_req->omac_idx = mconf->mt76.omac_idx;
2367 	basic_req->band_idx = mconf->mt76.band_idx;
2368 	basic_req->wmm_idx = mconf->mt76.wmm_idx;
2369 	basic_req->conn_state = !enable;
2370 
2371 	switch (vif->type) {
2372 	case NL80211_IFTYPE_MESH_POINT:
2373 	case NL80211_IFTYPE_AP:
2374 		if (vif->p2p)
2375 			conn_type = CONNECTION_P2P_GO;
2376 		else
2377 			conn_type = CONNECTION_INFRA_AP;
2378 		basic_req->conn_type = cpu_to_le32(conn_type);
2379 		basic_req->active = enable;
2380 		break;
2381 	case NL80211_IFTYPE_STATION:
2382 		if (vif->p2p)
2383 			conn_type = CONNECTION_P2P_GC;
2384 		else
2385 			conn_type = CONNECTION_INFRA_STA;
2386 		basic_req->conn_type = cpu_to_le32(conn_type);
2387 		basic_req->active = true;
2388 		break;
2389 	case NL80211_IFTYPE_ADHOC:
2390 		basic_req->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
2391 		basic_req->active = true;
2392 		break;
2393 	default:
2394 		WARN_ON(1);
2395 		break;
2396 	}
2397 }
2398 
2399 static void
2400 mt7925_mcu_bss_sec_tlv(struct sk_buff *skb,
2401 		       struct ieee80211_bss_conf *link_conf)
2402 {
2403 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2404 	struct mt76_vif *mvif = &mconf->mt76;
2405 	struct bss_sec_tlv {
2406 		__le16 tag;
2407 		__le16 len;
2408 		u8 mode;
2409 		u8 status;
2410 		u8 cipher;
2411 		u8 __rsv;
2412 	} __packed * sec;
2413 	struct tlv *tlv;
2414 
2415 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_SEC, sizeof(*sec));
2416 	sec = (struct bss_sec_tlv *)tlv;
2417 
2418 	switch (mvif->cipher) {
2419 	case CONNAC3_CIPHER_GCMP_256:
2420 	case CONNAC3_CIPHER_GCMP:
2421 		sec->mode = MODE_WPA3_SAE;
2422 		sec->status = 8;
2423 		break;
2424 	case CONNAC3_CIPHER_AES_CCMP:
2425 		sec->mode = MODE_WPA2_PSK;
2426 		sec->status = 6;
2427 		break;
2428 	case CONNAC3_CIPHER_TKIP:
2429 		sec->mode = MODE_WPA2_PSK;
2430 		sec->status = 4;
2431 		break;
2432 	case CONNAC3_CIPHER_WEP104:
2433 	case CONNAC3_CIPHER_WEP40:
2434 		sec->mode = MODE_SHARED;
2435 		sec->status = 0;
2436 		break;
2437 	default:
2438 		sec->mode = MODE_OPEN;
2439 		sec->status = 1;
2440 		break;
2441 	}
2442 
2443 	sec->cipher = mvif->cipher;
2444 }
2445 
2446 static void
2447 mt7925_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt792x_phy *phy,
2448 		       struct ieee80211_chanctx_conf *ctx,
2449 		       struct ieee80211_bss_conf *link_conf)
2450 {
2451 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2452 						  &link_conf->chanreq.oper;
2453 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2454 	enum nl80211_band band = chandef->chan->band;
2455 	struct mt76_vif *mvif = &mconf->mt76;
2456 	struct bss_rate_tlv *bmc;
2457 	struct tlv *tlv;
2458 	u8 idx = mvif->mcast_rates_idx ?
2459 		 mvif->mcast_rates_idx : mvif->basic_rates_idx;
2460 
2461 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RATE, sizeof(*bmc));
2462 
2463 	bmc = (struct bss_rate_tlv *)tlv;
2464 
2465 	if (band == NL80211_BAND_2GHZ)
2466 		bmc->basic_rate = cpu_to_le16(HR_DSSS_ERP_BASIC_RATE);
2467 	else
2468 		bmc->basic_rate = cpu_to_le16(OFDM_BASIC_RATE);
2469 
2470 	bmc->short_preamble = (band == NL80211_BAND_2GHZ);
2471 	bmc->bc_fixed_rate = idx;
2472 	bmc->mc_fixed_rate = idx;
2473 }
2474 
2475 static void
2476 mt7925_mcu_bss_mld_tlv(struct sk_buff *skb,
2477 		       struct ieee80211_bss_conf *link_conf)
2478 {
2479 	struct ieee80211_vif *vif = link_conf->vif;
2480 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2481 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2482 	struct bss_mld_tlv *mld;
2483 	struct tlv *tlv;
2484 	bool is_mld;
2485 
2486 	is_mld = ieee80211_vif_is_mld(link_conf->vif) ||
2487 		 (hweight16(mvif->valid_links) > 1);
2488 
2489 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_MLD, sizeof(*mld));
2490 	mld = (struct bss_mld_tlv *)tlv;
2491 
2492 	mld->link_id = is_mld ? link_conf->link_id : 0xff;
2493 	/* apply the index of the primary link */
2494 	mld->group_mld_id = is_mld ? mvif->bss_conf.mt76.idx : 0xff;
2495 	mld->own_mld_id = mconf->mt76.idx + 32;
2496 	mld->remap_idx = 0xff;
2497 	mld->eml_enable = !!(link_conf->vif->cfg.eml_cap &
2498 			     IEEE80211_EML_CAP_EMLSR_SUPP);
2499 
2500 	memcpy(mld->mac_addr, vif->addr, ETH_ALEN);
2501 }
2502 
2503 static void
2504 mt7925_mcu_bss_qos_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf)
2505 {
2506 	struct mt76_connac_bss_qos_tlv *qos;
2507 	struct tlv *tlv;
2508 
2509 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_QBSS, sizeof(*qos));
2510 	qos = (struct mt76_connac_bss_qos_tlv *)tlv;
2511 	qos->qos = link_conf->qos;
2512 }
2513 
2514 static void
2515 mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2516 		      struct mt792x_phy *phy)
2517 {
2518 #define DEFAULT_HE_PE_DURATION		4
2519 #define DEFAULT_HE_DURATION_RTS_THRES	1023
2520 	const struct ieee80211_sta_he_cap *cap;
2521 	struct bss_info_uni_he *he;
2522 	struct tlv *tlv;
2523 
2524 	cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
2525 
2526 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
2527 
2528 	he = (struct bss_info_uni_he *)tlv;
2529 	he->he_pe_duration = link_conf->htc_trig_based_pkt_ext;
2530 	if (!he->he_pe_duration)
2531 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
2532 
2533 	he->he_rts_thres = cpu_to_le16(link_conf->frame_time_rts_th);
2534 	if (!he->he_rts_thres)
2535 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
2536 
2537 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
2538 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
2539 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
2540 }
2541 
2542 static void
2543 mt7925_mcu_bss_color_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2544 			 bool enable)
2545 {
2546 	struct bss_info_uni_bss_color *color;
2547 	struct tlv *tlv;
2548 
2549 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BSS_COLOR, sizeof(*color));
2550 	color = (struct bss_info_uni_bss_color *)tlv;
2551 
2552 	color->enable = enable ?
2553 		link_conf->he_bss_color.enabled : 0;
2554 	color->bss_color = enable ?
2555 		link_conf->he_bss_color.color : 0;
2556 }
2557 
2558 static void
2559 mt7925_mcu_bss_ifs_tlv(struct sk_buff *skb,
2560 		       struct ieee80211_bss_conf *link_conf)
2561 {
2562 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2563 	struct mt792x_phy *phy = mvif->phy;
2564 	struct bss_ifs_time_tlv *ifs_time;
2565 	struct tlv *tlv;
2566 
2567 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_IFS_TIME, sizeof(*ifs_time));
2568 	ifs_time = (struct bss_ifs_time_tlv *)tlv;
2569 	ifs_time->slot_valid = true;
2570 	ifs_time->slot_time = cpu_to_le16(phy->slottime);
2571 }
2572 
2573 int mt7925_mcu_set_timing(struct mt792x_phy *phy,
2574 			  struct ieee80211_bss_conf *link_conf)
2575 {
2576 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2577 	struct mt792x_dev *dev = phy->dev;
2578 	struct sk_buff *skb;
2579 
2580 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2581 					 MT7925_BSS_UPDATE_MAX_SIZE);
2582 	if (IS_ERR(skb))
2583 		return PTR_ERR(skb);
2584 
2585 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2586 
2587 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2588 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2589 }
2590 
2591 int mt7925_mcu_add_bss_info(struct mt792x_phy *phy,
2592 			    struct ieee80211_chanctx_conf *ctx,
2593 			    struct ieee80211_bss_conf *link_conf,
2594 			    struct ieee80211_link_sta *link_sta,
2595 			    int enable)
2596 {
2597 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2598 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2599 	struct mt792x_dev *dev = phy->dev;
2600 	struct mt792x_link_sta *mlink_bc;
2601 	struct sk_buff *skb;
2602 
2603 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2604 					 MT7925_BSS_UPDATE_MAX_SIZE);
2605 	if (IS_ERR(skb))
2606 		return PTR_ERR(skb);
2607 
2608 	mlink_bc = mt792x_sta_to_link(&mvif->sta, mconf->link_id);
2609 
2610 	/* bss_basic must be first */
2611 	mt7925_mcu_bss_basic_tlv(skb, link_conf, link_sta, ctx, phy->mt76,
2612 				 mlink_bc->wcid.idx, enable);
2613 	mt7925_mcu_bss_sec_tlv(skb, link_conf);
2614 	mt7925_mcu_bss_bmc_tlv(skb, phy, ctx, link_conf);
2615 	mt7925_mcu_bss_qos_tlv(skb, link_conf);
2616 	mt7925_mcu_bss_mld_tlv(skb, link_conf);
2617 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2618 
2619 	if (link_conf->he_support) {
2620 		mt7925_mcu_bss_he_tlv(skb, link_conf, phy);
2621 		mt7925_mcu_bss_color_tlv(skb, link_conf, enable);
2622 	}
2623 
2624 	if (enable)
2625 		mt7925_mcu_bss_rlm_tlv(skb, phy->mt76, link_conf, ctx);
2626 
2627 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2628 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2629 }
2630 
2631 int mt7925_mcu_set_dbdc(struct mt76_phy *phy)
2632 {
2633 	struct mt76_dev *mdev = phy->dev;
2634 
2635 	struct mbmc_conf_tlv *conf;
2636 	struct mbmc_set_req *hdr;
2637 	struct sk_buff *skb;
2638 	struct tlv *tlv;
2639 	int max_len, err;
2640 
2641 	max_len = sizeof(*hdr) + sizeof(*conf);
2642 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2643 	if (!skb)
2644 		return -ENOMEM;
2645 
2646 	hdr = (struct mbmc_set_req *)skb_put(skb, sizeof(*hdr));
2647 
2648 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_MBMC_SETTING, sizeof(*conf));
2649 	conf = (struct mbmc_conf_tlv *)tlv;
2650 
2651 	conf->mbmc_en = 1;
2652 	conf->band = 0; /* unused */
2653 
2654 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SET_DBDC_PARMS),
2655 				    false);
2656 
2657 	return err;
2658 }
2659 
2660 #define MT76_CONNAC_SCAN_CHANNEL_TIME		60
2661 
2662 int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
2663 		       struct ieee80211_scan_request *scan_req)
2664 {
2665 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2666 	struct cfg80211_scan_request *sreq = &scan_req->req;
2667 	int n_ssids = 0, err, i, duration;
2668 	struct ieee80211_channel **scan_list = sreq->channels;
2669 	struct mt76_dev *mdev = phy->dev;
2670 	struct mt76_connac_mcu_scan_channel *chan;
2671 	struct sk_buff *skb;
2672 
2673 	struct scan_hdr_tlv *hdr;
2674 	struct scan_req_tlv *req;
2675 	struct scan_ssid_tlv *ssid;
2676 	struct scan_bssid_tlv *bssid;
2677 	struct scan_chan_info_tlv *chan_info;
2678 	struct scan_ie_tlv *ie;
2679 	struct scan_misc_tlv *misc;
2680 	struct tlv *tlv;
2681 	int max_len;
2682 
2683 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2684 				sizeof(*bssid) + sizeof(*chan_info) +
2685 				sizeof(*misc) + sizeof(*ie);
2686 
2687 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2688 	if (!skb)
2689 		return -ENOMEM;
2690 
2691 	set_bit(MT76_HW_SCANNING, &phy->state);
2692 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2693 
2694 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2695 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2696 	hdr->bss_idx = mvif->idx;
2697 
2698 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_REQ, sizeof(*req));
2699 	req = (struct scan_req_tlv *)tlv;
2700 	req->scan_type = sreq->n_ssids ? 1 : 0;
2701 	req->probe_req_num = sreq->n_ssids ? 2 : 0;
2702 
2703 	duration = MT76_CONNAC_SCAN_CHANNEL_TIME;
2704 	/* increase channel time for passive scan */
2705 	if (!sreq->n_ssids)
2706 		duration *= 2;
2707 	req->timeout_value = cpu_to_le16(sreq->n_channels * duration);
2708 	req->channel_min_dwell_time = cpu_to_le16(duration);
2709 	req->channel_dwell_time = cpu_to_le16(duration);
2710 
2711 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2712 	ssid = (struct scan_ssid_tlv *)tlv;
2713 	for (i = 0; i < sreq->n_ssids; i++) {
2714 		if (!sreq->ssids[i].ssid_len)
2715 			continue;
2716 
2717 		ssid->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
2718 		memcpy(ssid->ssids[i].ssid, sreq->ssids[i].ssid,
2719 		       sreq->ssids[i].ssid_len);
2720 		n_ssids++;
2721 	}
2722 	ssid->ssid_type = n_ssids ? BIT(2) : BIT(0);
2723 	ssid->ssids_num = n_ssids;
2724 
2725 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_BSSID, sizeof(*bssid));
2726 	bssid = (struct scan_bssid_tlv *)tlv;
2727 
2728 	memcpy(bssid->bssid, sreq->bssid, ETH_ALEN);
2729 
2730 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
2731 	chan_info = (struct scan_chan_info_tlv *)tlv;
2732 	chan_info->channels_num = min_t(u8, sreq->n_channels,
2733 					ARRAY_SIZE(chan_info->channels));
2734 	for (i = 0; i < chan_info->channels_num; i++) {
2735 		chan = &chan_info->channels[i];
2736 
2737 		switch (scan_list[i]->band) {
2738 		case NL80211_BAND_2GHZ:
2739 			chan->band = 1;
2740 			break;
2741 		case NL80211_BAND_6GHZ:
2742 			chan->band = 3;
2743 			break;
2744 		default:
2745 			chan->band = 2;
2746 			break;
2747 		}
2748 		chan->channel_num = scan_list[i]->hw_value;
2749 	}
2750 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
2751 
2752 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
2753 	ie = (struct scan_ie_tlv *)tlv;
2754 	if (sreq->ie_len > 0) {
2755 		memcpy(ie->ies, sreq->ie, sreq->ie_len);
2756 		ie->ies_len = cpu_to_le16(sreq->ie_len);
2757 	}
2758 
2759 	req->scan_func |= SCAN_FUNC_SPLIT_SCAN;
2760 
2761 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_MISC, sizeof(*misc));
2762 	misc = (struct scan_misc_tlv *)tlv;
2763 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
2764 		get_random_mask_addr(misc->random_mac, sreq->mac_addr,
2765 				     sreq->mac_addr_mask);
2766 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
2767 	}
2768 
2769 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2770 				    false);
2771 	if (err < 0)
2772 		clear_bit(MT76_HW_SCANNING, &phy->state);
2773 
2774 	return err;
2775 }
2776 EXPORT_SYMBOL_GPL(mt7925_mcu_hw_scan);
2777 
2778 int mt7925_mcu_sched_scan_req(struct mt76_phy *phy,
2779 			      struct ieee80211_vif *vif,
2780 			      struct cfg80211_sched_scan_request *sreq)
2781 {
2782 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2783 	struct ieee80211_channel **scan_list = sreq->channels;
2784 	struct mt76_connac_mcu_scan_channel *chan;
2785 	struct mt76_dev *mdev = phy->dev;
2786 	struct cfg80211_match_set *cfg_match;
2787 	struct cfg80211_ssid *cfg_ssid;
2788 
2789 	struct scan_hdr_tlv *hdr;
2790 	struct scan_sched_req *req;
2791 	struct scan_ssid_tlv *ssid;
2792 	struct scan_chan_info_tlv *chan_info;
2793 	struct scan_ie_tlv *ie;
2794 	struct scan_sched_ssid_match_sets *match;
2795 	struct sk_buff *skb;
2796 	struct tlv *tlv;
2797 	int i, max_len;
2798 
2799 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2800 		  sizeof(*chan_info) + sizeof(*ie) +
2801 		  sizeof(*match);
2802 
2803 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2804 	if (!skb)
2805 		return -ENOMEM;
2806 
2807 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2808 
2809 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2810 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2811 	hdr->bss_idx = mvif->idx;
2812 
2813 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_REQ, sizeof(*req));
2814 	req = (struct scan_sched_req *)tlv;
2815 	req->version = 1;
2816 
2817 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
2818 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
2819 
2820 	req->intervals_num = sreq->n_scan_plans;
2821 	for (i = 0; i < req->intervals_num; i++)
2822 		req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
2823 
2824 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2825 	ssid = (struct scan_ssid_tlv *)tlv;
2826 
2827 	ssid->ssids_num = sreq->n_ssids;
2828 	ssid->ssid_type = BIT(2);
2829 	for (i = 0; i < ssid->ssids_num; i++) {
2830 		cfg_ssid = &sreq->ssids[i];
2831 		memcpy(ssid->ssids[i].ssid, cfg_ssid->ssid, cfg_ssid->ssid_len);
2832 		ssid->ssids[i].ssid_len = cpu_to_le32(cfg_ssid->ssid_len);
2833 	}
2834 
2835 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID_MATCH_SETS, sizeof(*match));
2836 	match = (struct scan_sched_ssid_match_sets *)tlv;
2837 	match->match_num = sreq->n_match_sets;
2838 	for (i = 0; i < match->match_num; i++) {
2839 		cfg_match = &sreq->match_sets[i];
2840 		memcpy(match->match[i].ssid, cfg_match->ssid.ssid,
2841 		       cfg_match->ssid.ssid_len);
2842 		match->match[i].rssi_th = cpu_to_le32(cfg_match->rssi_thold);
2843 		match->match[i].ssid_len = cfg_match->ssid.ssid_len;
2844 	}
2845 
2846 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
2847 	chan_info = (struct scan_chan_info_tlv *)tlv;
2848 	chan_info->channels_num = min_t(u8, sreq->n_channels,
2849 					ARRAY_SIZE(chan_info->channels));
2850 	for (i = 0; i < chan_info->channels_num; i++) {
2851 		chan = &chan_info->channels[i];
2852 
2853 		switch (scan_list[i]->band) {
2854 		case NL80211_BAND_2GHZ:
2855 			chan->band = 1;
2856 			break;
2857 		case NL80211_BAND_6GHZ:
2858 			chan->band = 3;
2859 			break;
2860 		default:
2861 			chan->band = 2;
2862 			break;
2863 		}
2864 		chan->channel_num = scan_list[i]->hw_value;
2865 	}
2866 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
2867 
2868 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
2869 	ie = (struct scan_ie_tlv *)tlv;
2870 	if (sreq->ie_len > 0) {
2871 		memcpy(ie->ies, sreq->ie, sreq->ie_len);
2872 		ie->ies_len = cpu_to_le16(sreq->ie_len);
2873 	}
2874 
2875 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2876 				     false);
2877 }
2878 EXPORT_SYMBOL_GPL(mt7925_mcu_sched_scan_req);
2879 
2880 int
2881 mt7925_mcu_sched_scan_enable(struct mt76_phy *phy,
2882 			     struct ieee80211_vif *vif,
2883 			     bool enable)
2884 {
2885 	struct mt76_dev *mdev = phy->dev;
2886 	struct scan_sched_enable *req;
2887 	struct scan_hdr_tlv *hdr;
2888 	struct sk_buff *skb;
2889 	struct tlv *tlv;
2890 	int max_len;
2891 
2892 	max_len = sizeof(*hdr) + sizeof(*req);
2893 
2894 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2895 	if (!skb)
2896 		return -ENOMEM;
2897 
2898 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2899 	hdr->seq_num = 0;
2900 	hdr->bss_idx = 0;
2901 
2902 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_ENABLE, sizeof(*req));
2903 	req = (struct scan_sched_enable *)tlv;
2904 	req->active = !enable;
2905 
2906 	if (enable)
2907 		set_bit(MT76_HW_SCHED_SCANNING, &phy->state);
2908 	else
2909 		clear_bit(MT76_HW_SCHED_SCANNING, &phy->state);
2910 
2911 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2912 				     false);
2913 }
2914 
2915 int mt7925_mcu_cancel_hw_scan(struct mt76_phy *phy,
2916 			      struct ieee80211_vif *vif)
2917 {
2918 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2919 	struct {
2920 		struct scan_hdr {
2921 			u8 seq_num;
2922 			u8 bss_idx;
2923 			u8 pad[2];
2924 		} __packed hdr;
2925 		struct scan_cancel_tlv {
2926 			__le16 tag;
2927 			__le16 len;
2928 			u8 is_ext_channel;
2929 			u8 rsv[3];
2930 		} __packed cancel;
2931 	} req = {
2932 		.hdr = {
2933 			.seq_num = mvif->scan_seq_num,
2934 			.bss_idx = mvif->idx,
2935 		},
2936 		.cancel = {
2937 			.tag = cpu_to_le16(UNI_SCAN_CANCEL),
2938 			.len = cpu_to_le16(sizeof(struct scan_cancel_tlv)),
2939 		},
2940 	};
2941 
2942 	if (test_and_clear_bit(MT76_HW_SCANNING, &phy->state)) {
2943 		struct cfg80211_scan_info info = {
2944 			.aborted = true,
2945 		};
2946 
2947 		ieee80211_scan_completed(phy->hw, &info);
2948 	}
2949 
2950 	return mt76_mcu_send_msg(phy->dev, MCU_UNI_CMD(SCAN_REQ),
2951 				 &req, sizeof(req), false);
2952 }
2953 EXPORT_SYMBOL_GPL(mt7925_mcu_cancel_hw_scan);
2954 
2955 int mt7925_mcu_set_channel_domain(struct mt76_phy *phy)
2956 {
2957 	int len, i, n_max_channels, n_2ch = 0, n_5ch = 0, n_6ch = 0;
2958 	struct {
2959 		struct {
2960 			u8 alpha2[4]; /* regulatory_request.alpha2 */
2961 			u8 bw_2g; /* BW_20_40M		0
2962 				   * BW_20M		1
2963 				   * BW_20_40_80M	2
2964 				   * BW_20_40_80_160M	3
2965 				   * BW_20_40_80_8080M	4
2966 				   */
2967 			u8 bw_5g;
2968 			u8 bw_6g;
2969 			u8 pad;
2970 		} __packed hdr;
2971 		struct n_chan {
2972 			__le16 tag;
2973 			__le16 len;
2974 			u8 n_2ch;
2975 			u8 n_5ch;
2976 			u8 n_6ch;
2977 			u8 pad;
2978 		} __packed n_ch;
2979 	} req = {
2980 		.hdr = {
2981 			.bw_2g = 0,
2982 			.bw_5g = 3, /* BW_20_40_80_160M */
2983 			.bw_6g = 3,
2984 		},
2985 		.n_ch = {
2986 			.tag = cpu_to_le16(2),
2987 		},
2988 	};
2989 	struct mt76_connac_mcu_chan {
2990 		__le16 hw_value;
2991 		__le16 pad;
2992 		__le32 flags;
2993 	} __packed channel;
2994 	struct mt76_dev *dev = phy->dev;
2995 	struct ieee80211_channel *chan;
2996 	struct sk_buff *skb;
2997 
2998 	n_max_channels = phy->sband_2g.sband.n_channels +
2999 			 phy->sband_5g.sband.n_channels +
3000 			 phy->sband_6g.sband.n_channels;
3001 	len = sizeof(req) + n_max_channels * sizeof(channel);
3002 
3003 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
3004 	if (!skb)
3005 		return -ENOMEM;
3006 
3007 	skb_reserve(skb, sizeof(req));
3008 
3009 	for (i = 0; i < phy->sband_2g.sband.n_channels; i++) {
3010 		chan = &phy->sband_2g.sband.channels[i];
3011 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3012 			continue;
3013 
3014 		channel.hw_value = cpu_to_le16(chan->hw_value);
3015 		channel.flags = cpu_to_le32(chan->flags);
3016 		channel.pad = 0;
3017 
3018 		skb_put_data(skb, &channel, sizeof(channel));
3019 		n_2ch++;
3020 	}
3021 	for (i = 0; i < phy->sband_5g.sband.n_channels; i++) {
3022 		chan = &phy->sband_5g.sband.channels[i];
3023 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3024 			continue;
3025 
3026 		channel.hw_value = cpu_to_le16(chan->hw_value);
3027 		channel.flags = cpu_to_le32(chan->flags);
3028 		channel.pad = 0;
3029 
3030 		skb_put_data(skb, &channel, sizeof(channel));
3031 		n_5ch++;
3032 	}
3033 	for (i = 0; i < phy->sband_6g.sband.n_channels; i++) {
3034 		chan = &phy->sband_6g.sband.channels[i];
3035 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3036 			continue;
3037 
3038 		channel.hw_value = cpu_to_le16(chan->hw_value);
3039 		channel.flags = cpu_to_le32(chan->flags);
3040 		channel.pad = 0;
3041 
3042 		skb_put_data(skb, &channel, sizeof(channel));
3043 		n_6ch++;
3044 	}
3045 
3046 	BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(req.hdr.alpha2));
3047 	memcpy(req.hdr.alpha2, dev->alpha2, sizeof(dev->alpha2));
3048 	req.n_ch.n_2ch = n_2ch;
3049 	req.n_ch.n_5ch = n_5ch;
3050 	req.n_ch.n_6ch = n_6ch;
3051 	len = sizeof(struct n_chan) + (n_2ch + n_5ch + n_6ch) * sizeof(channel);
3052 	req.n_ch.len = cpu_to_le16(len);
3053 	memcpy(__skb_push(skb, sizeof(req)), &req, sizeof(req));
3054 
3055 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SET_DOMAIN_INFO),
3056 				     false);
3057 }
3058 EXPORT_SYMBOL_GPL(mt7925_mcu_set_channel_domain);
3059 
3060 static int
3061 __mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3062 		     enum environment_cap env_cap,
3063 		     struct mt7925_clc *clc, u8 idx)
3064 {
3065 	struct mt7925_clc_segment *seg;
3066 	struct sk_buff *skb;
3067 	struct {
3068 		u8 rsv[4];
3069 		__le16 tag;
3070 		__le16 len;
3071 
3072 		u8 ver;
3073 		u8 pad0;
3074 		__le16 size;
3075 		u8 idx;
3076 		u8 env;
3077 		u8 acpi_conf;
3078 		u8 pad1;
3079 		u8 alpha2[2];
3080 		u8 type[2];
3081 		u8 rsvd[64];
3082 	} __packed req = {
3083 		.tag = cpu_to_le16(0x3),
3084 		.len = cpu_to_le16(sizeof(req) - 4),
3085 
3086 		.idx = idx,
3087 		.env = env_cap,
3088 		.acpi_conf = mt792x_acpi_get_flags(&dev->phy),
3089 	};
3090 	int ret, valid_cnt = 0;
3091 	u8 i, *pos;
3092 
3093 	if (!clc)
3094 		return 0;
3095 
3096 	pos = clc->data + sizeof(*seg) * clc->nr_seg;
3097 	for (i = 0; i < clc->nr_country; i++) {
3098 		struct mt7925_clc_rule *rule = (struct mt7925_clc_rule *)pos;
3099 
3100 		pos += sizeof(*rule);
3101 		if (rule->alpha2[0] != alpha2[0] ||
3102 		    rule->alpha2[1] != alpha2[1])
3103 			continue;
3104 
3105 		seg = (struct mt7925_clc_segment *)clc->data
3106 			  + rule->seg_idx - 1;
3107 
3108 		memcpy(req.alpha2, rule->alpha2, 2);
3109 		memcpy(req.type, rule->type, 2);
3110 
3111 		req.size = cpu_to_le16(seg->len);
3112 		skb = __mt76_mcu_msg_alloc(&dev->mt76, &req,
3113 					   le16_to_cpu(req.size) + sizeof(req),
3114 					   sizeof(req), GFP_KERNEL);
3115 		if (!skb)
3116 			return -ENOMEM;
3117 		skb_put_data(skb, clc->data + seg->offset, seg->len);
3118 
3119 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3120 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3121 					    true);
3122 		if (ret < 0)
3123 			return ret;
3124 		valid_cnt++;
3125 	}
3126 
3127 	if (!valid_cnt)
3128 		return -ENOENT;
3129 
3130 	return 0;
3131 }
3132 
3133 int mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3134 		       enum environment_cap env_cap)
3135 {
3136 	struct mt792x_phy *phy = (struct mt792x_phy *)&dev->phy;
3137 	int i, ret;
3138 
3139 	/* submit all clc config */
3140 	for (i = 0; i < ARRAY_SIZE(phy->clc); i++) {
3141 		ret = __mt7925_mcu_set_clc(dev, alpha2, env_cap,
3142 					   phy->clc[i], i);
3143 
3144 		/* If no country found, set "00" as default */
3145 		if (ret == -ENOENT)
3146 			ret = __mt7925_mcu_set_clc(dev, "00",
3147 						   ENVIRON_INDOOR,
3148 						   phy->clc[i], i);
3149 		if (ret < 0)
3150 			return ret;
3151 	}
3152 	return 0;
3153 }
3154 
3155 int mt7925_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb,
3156 			    int cmd, int *wait_seq)
3157 {
3158 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
3159 	struct mt76_connac2_mcu_uni_txd *uni_txd;
3160 	struct mt76_connac2_mcu_txd *mcu_txd;
3161 	__le32 *txd;
3162 	u32 val;
3163 	u8 seq;
3164 
3165 	/* TODO: make dynamic based on msg type */
3166 	mdev->mcu.timeout = 20 * HZ;
3167 
3168 	seq = ++mdev->mcu.msg_seq & 0xf;
3169 	if (!seq)
3170 		seq = ++mdev->mcu.msg_seq & 0xf;
3171 
3172 	if (cmd == MCU_CMD(FW_SCATTER))
3173 		goto exit;
3174 
3175 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
3176 	txd = (__le32 *)skb_push(skb, txd_len);
3177 
3178 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
3179 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
3180 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
3181 	txd[0] = cpu_to_le32(val);
3182 
3183 	val = FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
3184 	txd[1] = cpu_to_le32(val);
3185 
3186 	if (cmd & __MCU_CMD_FIELD_UNI) {
3187 		uni_txd = (struct mt76_connac2_mcu_uni_txd *)txd;
3188 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
3189 		uni_txd->cid = cpu_to_le16(mcu_cmd);
3190 		uni_txd->s2d_index = MCU_S2D_H2N;
3191 		uni_txd->pkt_type = MCU_PKT_ID;
3192 		uni_txd->seq = seq;
3193 
3194 		if (cmd & __MCU_CMD_FIELD_QUERY)
3195 			uni_txd->option = MCU_CMD_UNI_QUERY_ACK;
3196 		else
3197 			uni_txd->option = MCU_CMD_UNI_EXT_ACK;
3198 
3199 		goto exit;
3200 	}
3201 
3202 	mcu_txd = (struct mt76_connac2_mcu_txd *)txd;
3203 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
3204 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
3205 					       MT_TX_MCU_PORT_RX_Q0));
3206 	mcu_txd->pkt_type = MCU_PKT_ID;
3207 	mcu_txd->seq = seq;
3208 	mcu_txd->cid = mcu_cmd;
3209 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
3210 
3211 	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
3212 		if (cmd & __MCU_CMD_FIELD_QUERY)
3213 			mcu_txd->set_query = MCU_Q_QUERY;
3214 		else
3215 			mcu_txd->set_query = MCU_Q_SET;
3216 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
3217 	} else {
3218 		mcu_txd->set_query = MCU_Q_NA;
3219 	}
3220 
3221 	if (cmd & __MCU_CMD_FIELD_WA)
3222 		mcu_txd->s2d_index = MCU_S2D_H2C;
3223 	else
3224 		mcu_txd->s2d_index = MCU_S2D_H2N;
3225 
3226 exit:
3227 	if (wait_seq)
3228 		*wait_seq = seq;
3229 
3230 	return 0;
3231 }
3232 EXPORT_SYMBOL_GPL(mt7925_mcu_fill_message);
3233 
3234 int mt7925_mcu_set_rts_thresh(struct mt792x_phy *phy, u32 val)
3235 {
3236 	struct {
3237 		u8 band_idx;
3238 		u8 _rsv[3];
3239 
3240 		__le16 tag;
3241 		__le16 len;
3242 		__le32 len_thresh;
3243 		__le32 pkt_thresh;
3244 	} __packed req = {
3245 		.band_idx = phy->mt76->band_idx,
3246 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RTS_THRESHOLD),
3247 		.len = cpu_to_le16(sizeof(req) - 4),
3248 		.len_thresh = cpu_to_le32(val),
3249 		.pkt_thresh = cpu_to_le32(0x2),
3250 	};
3251 
3252 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3253 				 &req, sizeof(req), true);
3254 }
3255 
3256 int mt7925_mcu_set_radio_en(struct mt792x_phy *phy, bool enable)
3257 {
3258 	struct {
3259 		u8 band_idx;
3260 		u8 _rsv[3];
3261 
3262 		__le16 tag;
3263 		__le16 len;
3264 		u8 enable;
3265 		u8 _rsv2[3];
3266 	} __packed req = {
3267 		.band_idx = phy->mt76->band_idx,
3268 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RADIO_ENABLE),
3269 		.len = cpu_to_le16(sizeof(req) - 4),
3270 		.enable = enable,
3271 	};
3272 
3273 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3274 				 &req, sizeof(req), true);
3275 }
3276 
3277 static void
3278 mt7925_mcu_build_sku(struct mt76_dev *dev, s8 *sku,
3279 		     struct mt76_power_limits *limits,
3280 		     enum nl80211_band band)
3281 {
3282 	int i, offset = sizeof(limits->cck);
3283 
3284 	memset(sku, 127, MT_CONNAC3_SKU_POWER_LIMIT);
3285 
3286 	if (band == NL80211_BAND_2GHZ) {
3287 		/* cck */
3288 		memcpy(sku, limits->cck, sizeof(limits->cck));
3289 	}
3290 
3291 	/* ofdm */
3292 	memcpy(&sku[offset], limits->ofdm, sizeof(limits->ofdm));
3293 	offset += (sizeof(limits->ofdm) * 5);
3294 
3295 	/* ht */
3296 	for (i = 0; i < 2; i++) {
3297 		memcpy(&sku[offset], limits->mcs[i], 8);
3298 		offset += 8;
3299 	}
3300 	sku[offset++] = limits->mcs[0][0];
3301 
3302 	/* vht */
3303 	for (i = 0; i < ARRAY_SIZE(limits->mcs); i++) {
3304 		memcpy(&sku[offset], limits->mcs[i],
3305 		       ARRAY_SIZE(limits->mcs[i]));
3306 		offset += 12;
3307 	}
3308 
3309 	/* he */
3310 	for (i = 0; i < ARRAY_SIZE(limits->ru); i++) {
3311 		memcpy(&sku[offset], limits->ru[i], ARRAY_SIZE(limits->ru[i]));
3312 		offset += ARRAY_SIZE(limits->ru[i]);
3313 	}
3314 
3315 	/* eht */
3316 	for (i = 0; i < ARRAY_SIZE(limits->eht); i++) {
3317 		memcpy(&sku[offset], limits->eht[i], ARRAY_SIZE(limits->eht[i]));
3318 		offset += ARRAY_SIZE(limits->eht[i]);
3319 	}
3320 }
3321 
3322 static int
3323 mt7925_mcu_rate_txpower_band(struct mt76_phy *phy,
3324 			     enum nl80211_band band)
3325 {
3326 	int tx_power, n_chan, last_ch, err = 0, idx = 0;
3327 	int i, sku_len, batch_size, batch_len = 3;
3328 	struct mt76_dev *dev = phy->dev;
3329 	static const u8 chan_list_2ghz[] = {
3330 		1, 2,  3,  4,  5,  6,  7,
3331 		8, 9, 10, 11, 12, 13, 14
3332 	};
3333 	static const u8 chan_list_5ghz[] = {
3334 		 36,  38,  40,  42,  44,  46,  48,
3335 		 50,  52,  54,  56,  58,  60,  62,
3336 		 64, 100, 102, 104, 106, 108, 110,
3337 		112, 114, 116, 118, 120, 122, 124,
3338 		126, 128, 132, 134, 136, 138, 140,
3339 		142, 144, 149, 151, 153, 155, 157,
3340 		159, 161, 165, 167
3341 	};
3342 	static const u8 chan_list_6ghz[] = {
3343 		  1,   3,   5,   7,   9,  11,  13,
3344 		 15,  17,  19,  21,  23,  25,  27,
3345 		 29,  33,  35,  37,  39,  41,  43,
3346 		 45,  47,  49,  51,  53,  55,  57,
3347 		 59,  61,  65,  67,  69,  71,  73,
3348 		 75,  77,  79,  81,  83,  85,  87,
3349 		 89,  91,  93,  97,  99, 101, 103,
3350 		105, 107, 109, 111, 113, 115, 117,
3351 		119, 121, 123, 125, 129, 131, 133,
3352 		135, 137, 139, 141, 143, 145, 147,
3353 		149, 151, 153, 155, 157, 161, 163,
3354 		165, 167, 169, 171, 173, 175, 177,
3355 		179, 181, 183, 185, 187, 189, 193,
3356 		195, 197, 199, 201, 203, 205, 207,
3357 		209, 211, 213, 215, 217, 219, 221,
3358 		225, 227, 229, 233
3359 	};
3360 	struct mt76_power_limits *limits;
3361 	struct mt7925_sku_tlv *sku_tlbv;
3362 	const u8 *ch_list;
3363 
3364 	sku_len = sizeof(*sku_tlbv);
3365 	tx_power = 2 * phy->hw->conf.power_level;
3366 	if (!tx_power)
3367 		tx_power = 127;
3368 
3369 	if (band == NL80211_BAND_2GHZ) {
3370 		n_chan = ARRAY_SIZE(chan_list_2ghz);
3371 		ch_list = chan_list_2ghz;
3372 		last_ch = chan_list_2ghz[ARRAY_SIZE(chan_list_2ghz) - 1];
3373 	} else if (band == NL80211_BAND_6GHZ) {
3374 		n_chan = ARRAY_SIZE(chan_list_6ghz);
3375 		ch_list = chan_list_6ghz;
3376 		last_ch = chan_list_6ghz[ARRAY_SIZE(chan_list_6ghz) - 1];
3377 	} else {
3378 		n_chan = ARRAY_SIZE(chan_list_5ghz);
3379 		ch_list = chan_list_5ghz;
3380 		last_ch = chan_list_5ghz[ARRAY_SIZE(chan_list_5ghz) - 1];
3381 	}
3382 	batch_size = DIV_ROUND_UP(n_chan, batch_len);
3383 
3384 	limits = devm_kmalloc(dev->dev, sizeof(*limits), GFP_KERNEL);
3385 	if (!limits)
3386 		return -ENOMEM;
3387 
3388 	sku_tlbv = devm_kmalloc(dev->dev, sku_len, GFP_KERNEL);
3389 	if (!sku_tlbv) {
3390 		devm_kfree(dev->dev, limits);
3391 		return -ENOMEM;
3392 	}
3393 
3394 	for (i = 0; i < batch_size; i++) {
3395 		struct mt7925_tx_power_limit_tlv *tx_power_tlv;
3396 		int j, msg_len, num_ch;
3397 		struct sk_buff *skb;
3398 
3399 		num_ch = i == batch_size - 1 ? n_chan % batch_len : batch_len;
3400 		msg_len = sizeof(*tx_power_tlv) + num_ch * sku_len;
3401 		skb = mt76_mcu_msg_alloc(dev, NULL, msg_len);
3402 		if (!skb) {
3403 			err = -ENOMEM;
3404 			goto out;
3405 		}
3406 
3407 		tx_power_tlv = (struct mt7925_tx_power_limit_tlv *)
3408 			       skb_put(skb, sizeof(*tx_power_tlv));
3409 
3410 		BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(tx_power_tlv->alpha2));
3411 		memcpy(tx_power_tlv->alpha2, dev->alpha2, sizeof(dev->alpha2));
3412 		tx_power_tlv->n_chan = num_ch;
3413 		tx_power_tlv->tag = cpu_to_le16(0x1);
3414 		tx_power_tlv->len = cpu_to_le16(sizeof(*tx_power_tlv));
3415 
3416 		switch (band) {
3417 		case NL80211_BAND_2GHZ:
3418 			tx_power_tlv->band = 1;
3419 			break;
3420 		case NL80211_BAND_6GHZ:
3421 			tx_power_tlv->band = 3;
3422 			break;
3423 		default:
3424 			tx_power_tlv->band = 2;
3425 			break;
3426 		}
3427 
3428 		for (j = 0; j < num_ch; j++, idx++) {
3429 			struct ieee80211_channel chan = {
3430 				.hw_value = ch_list[idx],
3431 				.band = band,
3432 			};
3433 			s8 reg_power, sar_power;
3434 
3435 			reg_power = mt76_connac_get_ch_power(phy, &chan,
3436 							     tx_power);
3437 			sar_power = mt76_get_sar_power(phy, &chan, reg_power);
3438 
3439 			mt76_get_rate_power_limits(phy, &chan, limits,
3440 						   sar_power);
3441 
3442 			tx_power_tlv->last_msg = ch_list[idx] == last_ch;
3443 			sku_tlbv->channel = ch_list[idx];
3444 
3445 			mt7925_mcu_build_sku(dev, sku_tlbv->pwr_limit,
3446 					     limits, band);
3447 			skb_put_data(skb, sku_tlbv, sku_len);
3448 		}
3449 		err = mt76_mcu_skb_send_msg(dev, skb,
3450 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3451 					    true);
3452 		if (err < 0)
3453 			goto out;
3454 	}
3455 
3456 out:
3457 	devm_kfree(dev->dev, sku_tlbv);
3458 	devm_kfree(dev->dev, limits);
3459 	return err;
3460 }
3461 
3462 int mt7925_mcu_set_rate_txpower(struct mt76_phy *phy)
3463 {
3464 	int err;
3465 
3466 	if (phy->cap.has_2ghz) {
3467 		err = mt7925_mcu_rate_txpower_band(phy,
3468 						   NL80211_BAND_2GHZ);
3469 		if (err < 0)
3470 			return err;
3471 	}
3472 
3473 	if (phy->cap.has_5ghz) {
3474 		err = mt7925_mcu_rate_txpower_band(phy,
3475 						   NL80211_BAND_5GHZ);
3476 		if (err < 0)
3477 			return err;
3478 	}
3479 
3480 	if (phy->cap.has_6ghz) {
3481 		err = mt7925_mcu_rate_txpower_band(phy,
3482 						   NL80211_BAND_6GHZ);
3483 		if (err < 0)
3484 			return err;
3485 	}
3486 
3487 	return 0;
3488 }
3489 
3490 int mt7925_mcu_set_rxfilter(struct mt792x_dev *dev, u32 fif,
3491 			    u8 bit_op, u32 bit_map)
3492 {
3493 	struct mt792x_phy *phy = &dev->phy;
3494 	struct {
3495 		u8 band_idx;
3496 		u8 rsv1[3];
3497 
3498 		__le16 tag;
3499 		__le16 len;
3500 		u8 mode;
3501 		u8 rsv2[3];
3502 		__le32 fif;
3503 		__le32 bit_map; /* bit_* for bitmap update */
3504 		u8 bit_op;
3505 		u8 pad[51];
3506 	} __packed req = {
3507 		.band_idx = phy->mt76->band_idx,
3508 		.tag = cpu_to_le16(UNI_BAND_CONFIG_SET_MAC80211_RX_FILTER),
3509 		.len = cpu_to_le16(sizeof(req) - 4),
3510 
3511 		.mode = fif ? 0 : 1,
3512 		.fif = cpu_to_le32(fif),
3513 		.bit_map = cpu_to_le32(bit_map),
3514 		.bit_op = bit_op,
3515 	};
3516 
3517 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3518 				 &req, sizeof(req), true);
3519 }
3520