xref: /linux/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c (revision 8f6571ad470feb242dcef36e53f7cf1bba03780f)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2023 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include <linux/firmware.h>
6 #include "mt7925.h"
7 #include "mcu.h"
8 #include "mac.h"
9 
10 #define MT_STA_BFER			BIT(0)
11 #define MT_STA_BFEE			BIT(1)
12 
13 static bool mt7925_disable_clc;
14 module_param_named(disable_clc, mt7925_disable_clc, bool, 0644);
15 MODULE_PARM_DESC(disable_clc, "disable CLC support");
16 
17 int mt7925_mcu_parse_response(struct mt76_dev *mdev, int cmd,
18 			      struct sk_buff *skb, int seq)
19 {
20 	int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
21 	struct mt7925_mcu_rxd *rxd;
22 	int ret = 0;
23 
24 	if (!skb) {
25 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n", cmd, seq);
26 		mt792x_reset(mdev);
27 
28 		return -ETIMEDOUT;
29 	}
30 
31 	rxd = (struct mt7925_mcu_rxd *)skb->data;
32 	if (seq != rxd->seq)
33 		return -EAGAIN;
34 
35 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL) ||
36 	    cmd == MCU_CMD(PATCH_FINISH_REQ)) {
37 		skb_pull(skb, sizeof(*rxd) - 4);
38 		ret = *skb->data;
39 	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
40 		   cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
41 		   cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
42 		   cmd == MCU_UNI_CMD(OFFLOAD) ||
43 		   cmd == MCU_UNI_CMD(SUSPEND)) {
44 		struct mt7925_mcu_uni_event *event;
45 
46 		skb_pull(skb, sizeof(*rxd));
47 		event = (struct mt7925_mcu_uni_event *)skb->data;
48 		ret = le32_to_cpu(event->status);
49 		/* skip invalid event */
50 		if (mcu_cmd != event->cid)
51 			ret = -EAGAIN;
52 	} else {
53 		skb_pull(skb, sizeof(*rxd));
54 	}
55 
56 	return ret;
57 }
58 EXPORT_SYMBOL_GPL(mt7925_mcu_parse_response);
59 
60 int mt7925_mcu_regval(struct mt792x_dev *dev, u32 regidx, u32 *val, bool set)
61 {
62 #define MT_RF_REG_HDR           GENMASK(31, 24)
63 #define MT_RF_REG_ANT           GENMASK(23, 16)
64 #define RF_REG_PREFIX           0x99
65 	struct {
66 		u8 __rsv[4];
67 		union {
68 			struct uni_cmd_access_reg_basic {
69 				__le16 tag;
70 				__le16 len;
71 				__le32 idx;
72 				__le32 data;
73 			} __packed reg;
74 			struct uni_cmd_access_rf_reg_basic {
75 				__le16 tag;
76 				__le16 len;
77 				__le16 ant;
78 				u8 __rsv[2];
79 				__le32 idx;
80 				__le32 data;
81 			} __packed rf_reg;
82 		};
83 	} __packed * res, req;
84 	struct sk_buff *skb;
85 	int ret;
86 
87 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX) {
88 		req.rf_reg.tag = cpu_to_le16(UNI_CMD_ACCESS_RF_REG_BASIC);
89 		req.rf_reg.len = cpu_to_le16(sizeof(req.rf_reg));
90 		req.rf_reg.ant = cpu_to_le16(u32_get_bits(regidx, MT_RF_REG_ANT));
91 		req.rf_reg.idx = cpu_to_le32(regidx);
92 		req.rf_reg.data = set ? cpu_to_le32(*val) : 0;
93 	} else {
94 		req.reg.tag = cpu_to_le16(UNI_CMD_ACCESS_REG_BASIC);
95 		req.reg.len = cpu_to_le16(sizeof(req.reg));
96 		req.reg.idx = cpu_to_le32(regidx);
97 		req.reg.data = set ? cpu_to_le32(*val) : 0;
98 	}
99 
100 	if (set)
101 		return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(REG_ACCESS),
102 					 &req, sizeof(req), true);
103 
104 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
105 					MCU_WM_UNI_CMD_QUERY(REG_ACCESS),
106 					&req, sizeof(req), true, &skb);
107 	if (ret)
108 		return ret;
109 
110 	res = (void *)skb->data;
111 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX)
112 		*val = le32_to_cpu(res->rf_reg.data);
113 	else
114 		*val = le32_to_cpu(res->reg.data);
115 
116 	dev_kfree_skb(skb);
117 
118 	return 0;
119 }
120 EXPORT_SYMBOL_GPL(mt7925_mcu_regval);
121 
122 int mt7925_mcu_update_arp_filter(struct mt76_dev *dev,
123 				 struct ieee80211_bss_conf *link_conf)
124 {
125 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
126 	struct ieee80211_vif *mvif = link_conf->vif;
127 	struct sk_buff *skb;
128 	int i, len = min_t(int, mvif->cfg.arp_addr_cnt,
129 			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
130 	struct {
131 		struct {
132 			u8 bss_idx;
133 			u8 pad[3];
134 		} __packed hdr;
135 		struct mt7925_arpns_tlv arp;
136 	} req = {
137 		.hdr = {
138 			.bss_idx = mconf->mt76.idx,
139 		},
140 		.arp = {
141 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
142 			.len = cpu_to_le16(sizeof(req) - 4 + len * 2 * sizeof(__be32)),
143 			.ips_num = len,
144 			.enable = true,
145 		},
146 	};
147 
148 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(req) + len * 2 * sizeof(__be32));
149 	if (!skb)
150 		return -ENOMEM;
151 
152 	skb_put_data(skb, &req, sizeof(req));
153 	for (i = 0; i < len; i++) {
154 		skb_put_data(skb, &mvif->cfg.arp_addr_list[i], sizeof(__be32));
155 		skb_put_zero(skb, sizeof(__be32));
156 	}
157 
158 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
159 }
160 
161 #ifdef CONFIG_PM
162 static int
163 mt7925_connac_mcu_set_wow_ctrl(struct mt76_phy *phy, struct ieee80211_vif *vif,
164 			       bool suspend, struct cfg80211_wowlan *wowlan)
165 {
166 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
167 	struct mt76_dev *dev = phy->dev;
168 	struct {
169 		struct {
170 			u8 bss_idx;
171 			u8 pad[3];
172 		} __packed hdr;
173 		struct mt76_connac_wow_ctrl_tlv wow_ctrl_tlv;
174 		struct mt76_connac_wow_gpio_param_tlv gpio_tlv;
175 	} req = {
176 		.hdr = {
177 			.bss_idx = mvif->idx,
178 		},
179 		.wow_ctrl_tlv = {
180 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
181 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_ctrl_tlv)),
182 			.cmd = suspend ? 1 : 2,
183 		},
184 		.gpio_tlv = {
185 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_GPIO_PARAM),
186 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_gpio_param_tlv)),
187 			.gpio_pin = 0xff, /* follow fw about GPIO pin */
188 		},
189 	};
190 
191 	if (wowlan->magic_pkt)
192 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_MAGIC;
193 	if (wowlan->disconnect)
194 		req.wow_ctrl_tlv.trigger |= (UNI_WOW_DETECT_TYPE_DISCONNECT |
195 					     UNI_WOW_DETECT_TYPE_BCN_LOST);
196 	if (wowlan->nd_config) {
197 		mt7925_mcu_sched_scan_req(phy, vif, wowlan->nd_config);
198 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_SCH_SCAN_HIT;
199 		mt7925_mcu_sched_scan_enable(phy, vif, suspend);
200 	}
201 	if (wowlan->n_patterns)
202 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_BITMAP;
203 
204 	if (mt76_is_mmio(dev))
205 		req.wow_ctrl_tlv.wakeup_hif = WOW_PCIE;
206 	else if (mt76_is_usb(dev))
207 		req.wow_ctrl_tlv.wakeup_hif = WOW_USB;
208 	else if (mt76_is_sdio(dev))
209 		req.wow_ctrl_tlv.wakeup_hif = WOW_GPIO;
210 
211 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(SUSPEND), &req,
212 				 sizeof(req), true);
213 }
214 
215 static int
216 mt7925_mcu_set_wow_pattern(struct mt76_dev *dev,
217 			   struct ieee80211_vif *vif,
218 			   u8 index, bool enable,
219 			   struct cfg80211_pkt_pattern *pattern)
220 {
221 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
222 	struct mt7925_wow_pattern_tlv *tlv;
223 	struct sk_buff *skb;
224 	struct {
225 		u8 bss_idx;
226 		u8 pad[3];
227 	} __packed hdr = {
228 		.bss_idx = mvif->idx,
229 	};
230 
231 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(hdr) + sizeof(*tlv));
232 	if (!skb)
233 		return -ENOMEM;
234 
235 	skb_put_data(skb, &hdr, sizeof(hdr));
236 	tlv = (struct mt7925_wow_pattern_tlv *)skb_put(skb, sizeof(*tlv));
237 	tlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
238 	tlv->len = cpu_to_le16(sizeof(*tlv));
239 	tlv->bss_idx = 0xF;
240 	tlv->data_len = pattern->pattern_len;
241 	tlv->enable = enable;
242 	tlv->index = index;
243 	tlv->offset = 0;
244 
245 	memcpy(tlv->pattern, pattern->pattern, pattern->pattern_len);
246 	memcpy(tlv->mask, pattern->mask, DIV_ROUND_UP(pattern->pattern_len, 8));
247 
248 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SUSPEND), true);
249 }
250 
251 void mt7925_mcu_set_suspend_iter(void *priv, u8 *mac,
252 				 struct ieee80211_vif *vif)
253 {
254 	struct mt76_phy *phy = priv;
255 	bool suspend = !test_bit(MT76_STATE_RUNNING, &phy->state);
256 	struct ieee80211_hw *hw = phy->hw;
257 	struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
258 	int i;
259 
260 	mt76_connac_mcu_set_gtk_rekey(phy->dev, vif, suspend);
261 
262 	mt76_connac_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
263 
264 	for (i = 0; i < wowlan->n_patterns; i++)
265 		mt7925_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
266 					   &wowlan->patterns[i]);
267 	mt7925_connac_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
268 }
269 
270 #endif /* CONFIG_PM */
271 
272 static void
273 mt7925_mcu_connection_loss_iter(void *priv, u8 *mac,
274 				struct ieee80211_vif *vif)
275 {
276 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
277 	struct mt7925_uni_beacon_loss_event *event = priv;
278 
279 	if (mvif->idx != event->hdr.bss_idx)
280 		return;
281 
282 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER) ||
283 	    vif->type != NL80211_IFTYPE_STATION)
284 		return;
285 
286 	ieee80211_connection_loss(vif);
287 }
288 
289 static void
290 mt7925_mcu_connection_loss_event(struct mt792x_dev *dev, struct sk_buff *skb)
291 {
292 	struct mt7925_uni_beacon_loss_event *event;
293 	struct mt76_phy *mphy = &dev->mt76.phy;
294 
295 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd));
296 	event = (struct mt7925_uni_beacon_loss_event *)skb->data;
297 
298 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
299 					IEEE80211_IFACE_ITER_RESUME_ALL,
300 					mt7925_mcu_connection_loss_iter, event);
301 }
302 
303 static void
304 mt7925_mcu_roc_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
305 {
306 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
307 	struct mt7925_roc_grant_tlv *grant = priv;
308 
309 	if (ieee80211_vif_is_mld(vif) && vif->type == NL80211_IFTYPE_STATION)
310 		return;
311 
312 	if (mvif->idx != grant->bss_idx)
313 		return;
314 
315 	mvif->band_idx = grant->dbdcband;
316 }
317 
318 static void mt7925_mcu_roc_handle_grant(struct mt792x_dev *dev,
319 					struct tlv *tlv)
320 {
321 	struct ieee80211_hw *hw = dev->mt76.hw;
322 	struct mt7925_roc_grant_tlv *grant;
323 	int duration;
324 
325 	grant = (struct mt7925_roc_grant_tlv *)tlv;
326 
327 	/* should never happen */
328 	WARN_ON_ONCE((le16_to_cpu(grant->tag) != UNI_EVENT_ROC_GRANT));
329 
330 	if (grant->reqtype == MT7925_ROC_REQ_ROC)
331 		ieee80211_ready_on_channel(hw);
332 	else if (grant->reqtype == MT7925_ROC_REQ_JOIN)
333 		ieee80211_iterate_active_interfaces_atomic(hw,
334 						IEEE80211_IFACE_ITER_RESUME_ALL,
335 						mt7925_mcu_roc_iter, grant);
336 	dev->phy.roc_grant = true;
337 	wake_up(&dev->phy.roc_wait);
338 	duration = le32_to_cpu(grant->max_interval);
339 	mod_timer(&dev->phy.roc_timer,
340 		  jiffies + msecs_to_jiffies(duration));
341 }
342 
343 static void
344 mt7925_mcu_handle_hif_ctrl_basic(struct mt792x_dev *dev, struct tlv *tlv)
345 {
346 	struct mt7925_mcu_hif_ctrl_basic_tlv *basic;
347 
348 	basic = (struct mt7925_mcu_hif_ctrl_basic_tlv *)tlv;
349 
350 	if (basic->hifsuspend) {
351 		if (basic->hif_tx_traffic_status == HIF_TRAFFIC_IDLE &&
352 		    basic->hif_rx_traffic_status == HIF_TRAFFIC_IDLE)
353 			/* success */
354 			dev->hif_idle = true;
355 		else
356 			/* busy */
357 			/* invalid */
358 			dev->hif_idle = false;
359 	} else {
360 		dev->hif_resumed = true;
361 	}
362 	wake_up(&dev->wait);
363 }
364 
365 static void
366 mt7925_mcu_uni_hif_ctrl_event(struct mt792x_dev *dev, struct sk_buff *skb)
367 {
368 	struct tlv *tlv;
369 	u32 tlv_len;
370 
371 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
372 	tlv = (struct tlv *)skb->data;
373 	tlv_len = skb->len;
374 
375 	while (tlv_len > 0 && le16_to_cpu(tlv->len) <= tlv_len) {
376 		switch (le16_to_cpu(tlv->tag)) {
377 		case UNI_EVENT_HIF_CTRL_BASIC:
378 			mt7925_mcu_handle_hif_ctrl_basic(dev, tlv);
379 			break;
380 		default:
381 			break;
382 		}
383 		tlv_len -= le16_to_cpu(tlv->len);
384 		tlv = (struct tlv *)((char *)(tlv) + le16_to_cpu(tlv->len));
385 	}
386 }
387 
388 static void
389 mt7925_mcu_uni_roc_event(struct mt792x_dev *dev, struct sk_buff *skb)
390 {
391 	struct tlv *tlv;
392 	int i = 0;
393 
394 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
395 
396 	while (i < skb->len) {
397 		tlv = (struct tlv *)(skb->data + i);
398 
399 		switch (le16_to_cpu(tlv->tag)) {
400 		case UNI_EVENT_ROC_GRANT:
401 			mt7925_mcu_roc_handle_grant(dev, tlv);
402 			break;
403 		case UNI_EVENT_ROC_GRANT_SUB_LINK:
404 			break;
405 		}
406 
407 		i += le16_to_cpu(tlv->len);
408 	}
409 }
410 
411 static void
412 mt7925_mcu_scan_event(struct mt792x_dev *dev, struct sk_buff *skb)
413 {
414 	struct mt76_phy *mphy = &dev->mt76.phy;
415 	struct mt792x_phy *phy = mphy->priv;
416 
417 	spin_lock_bh(&dev->mt76.lock);
418 	__skb_queue_tail(&phy->scan_event_list, skb);
419 	spin_unlock_bh(&dev->mt76.lock);
420 
421 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
422 				     MT792x_HW_SCAN_TIMEOUT);
423 }
424 
425 static void
426 mt7925_mcu_tx_done_event(struct mt792x_dev *dev, struct sk_buff *skb)
427 {
428 #define UNI_EVENT_TX_DONE_MSG 0
429 #define UNI_EVENT_TX_DONE_RAW 1
430 	struct mt7925_mcu_txs_event {
431 		u8 ver;
432 		u8 rsv[3];
433 		u8 data[];
434 	} __packed * txs;
435 	struct tlv *tlv;
436 	u32 tlv_len;
437 
438 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
439 	tlv = (struct tlv *)skb->data;
440 	tlv_len = skb->len;
441 
442 	while (tlv_len > 0 && le16_to_cpu(tlv->len) <= tlv_len) {
443 		switch (le16_to_cpu(tlv->tag)) {
444 		case UNI_EVENT_TX_DONE_RAW:
445 			txs = (struct mt7925_mcu_txs_event *)tlv->data;
446 			mt7925_mac_add_txs(dev, txs->data);
447 			break;
448 		default:
449 			break;
450 		}
451 		tlv_len -= le16_to_cpu(tlv->len);
452 		tlv = (struct tlv *)((char *)(tlv) + le16_to_cpu(tlv->len));
453 	}
454 }
455 
456 static void
457 mt7925_mcu_uni_debug_msg_event(struct mt792x_dev *dev, struct sk_buff *skb)
458 {
459 	struct mt7925_uni_debug_msg {
460 		__le16 tag;
461 		__le16 len;
462 		u8 fmt;
463 		u8 rsv[3];
464 		u8 id;
465 		u8 type:3;
466 		u8 nr_args:5;
467 		union {
468 			struct idxlog {
469 				__le16 rsv;
470 				__le32 ts;
471 				__le32 idx;
472 				u8 data[];
473 			} __packed idx;
474 			struct txtlog {
475 				u8 len;
476 				u8 rsv;
477 				__le32 ts;
478 				u8 data[];
479 			} __packed txt;
480 		};
481 	} __packed * hdr;
482 
483 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
484 	hdr = (struct mt7925_uni_debug_msg *)skb->data;
485 
486 	if (hdr->id == 0x28) {
487 		skb_pull(skb, offsetof(struct mt7925_uni_debug_msg, id));
488 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", skb->len, skb->data);
489 		return;
490 	} else if (hdr->id != 0xa8) {
491 		return;
492 	}
493 
494 	if (hdr->type == 0) { /* idx log */
495 		int i, ret, len = PAGE_SIZE - 1, nr_val;
496 		struct page *page = dev_alloc_pages(get_order(len));
497 		__le32 *val;
498 		char *buf, *cur;
499 
500 		if (!page)
501 			return;
502 
503 		buf = page_address(page);
504 		cur = buf;
505 
506 		nr_val = (le16_to_cpu(hdr->len) - sizeof(*hdr)) / 4;
507 		val = (__le32 *)hdr->idx.data;
508 		for (i = 0; i < nr_val && len > 0; i++) {
509 			ret = snprintf(cur, len, "0x%x,", le32_to_cpu(val[i]));
510 			if (ret <= 0)
511 				break;
512 
513 			cur += ret;
514 			len -= ret;
515 		}
516 		if (cur > buf)
517 			wiphy_info(mt76_hw(dev)->wiphy, "idx: 0x%X,%d,%s",
518 				   le32_to_cpu(hdr->idx.idx), nr_val, buf);
519 		put_page(page);
520 	} else if (hdr->type == 2) { /* str log */
521 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", hdr->txt.len, hdr->txt.data);
522 	}
523 }
524 
525 static void
526 mt7925_mcu_uni_rx_unsolicited_event(struct mt792x_dev *dev,
527 				    struct sk_buff *skb)
528 {
529 	struct mt7925_mcu_rxd *rxd;
530 
531 	rxd = (struct mt7925_mcu_rxd *)skb->data;
532 
533 	switch (rxd->eid) {
534 	case MCU_UNI_EVENT_HIF_CTRL:
535 		mt7925_mcu_uni_hif_ctrl_event(dev, skb);
536 		break;
537 	case MCU_UNI_EVENT_FW_LOG_2_HOST:
538 		mt7925_mcu_uni_debug_msg_event(dev, skb);
539 		break;
540 	case MCU_UNI_EVENT_ROC:
541 		mt7925_mcu_uni_roc_event(dev, skb);
542 		break;
543 	case MCU_UNI_EVENT_SCAN_DONE:
544 		mt7925_mcu_scan_event(dev, skb);
545 		return;
546 	case MCU_UNI_EVENT_TX_DONE:
547 		mt7925_mcu_tx_done_event(dev, skb);
548 		break;
549 	case MCU_UNI_EVENT_BSS_BEACON_LOSS:
550 		mt7925_mcu_connection_loss_event(dev, skb);
551 		break;
552 	case MCU_UNI_EVENT_COREDUMP:
553 		dev->fw_assert = true;
554 		mt76_connac_mcu_coredump_event(&dev->mt76, skb, &dev->coredump);
555 		return;
556 	default:
557 		break;
558 	}
559 	dev_kfree_skb(skb);
560 }
561 
562 void mt7925_mcu_rx_event(struct mt792x_dev *dev, struct sk_buff *skb)
563 {
564 	struct mt7925_mcu_rxd *rxd = (struct mt7925_mcu_rxd *)skb->data;
565 
566 	if (skb_linearize(skb))
567 		return;
568 
569 	if (rxd->option & MCU_UNI_CMD_UNSOLICITED_EVENT) {
570 		mt7925_mcu_uni_rx_unsolicited_event(dev, skb);
571 		return;
572 	}
573 
574 	mt76_mcu_rx_event(&dev->mt76, skb);
575 }
576 
577 static int
578 mt7925_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif_link *mvif,
579 		  struct mt76_wcid *wcid,
580 		  struct ieee80211_ampdu_params *params,
581 		  bool enable, bool tx)
582 {
583 	struct sta_rec_ba_uni *ba;
584 	struct sk_buff *skb;
585 	struct tlv *tlv;
586 	int len;
587 
588 	len = sizeof(struct sta_req_hdr) + sizeof(*ba);
589 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid,
590 					      len);
591 	if (IS_ERR(skb))
592 		return PTR_ERR(skb);
593 
594 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
595 
596 	ba = (struct sta_rec_ba_uni *)tlv;
597 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
598 	ba->winsize = cpu_to_le16(params->buf_size);
599 	ba->ssn = cpu_to_le16(params->ssn);
600 	ba->ba_en = enable << params->tid;
601 	ba->amsdu = params->amsdu;
602 	ba->tid = params->tid;
603 
604 	return mt76_mcu_skb_send_msg(dev, skb,
605 				     MCU_UNI_CMD(STA_REC_UPDATE), true);
606 }
607 
608 /** starec & wtbl **/
609 int mt7925_mcu_uni_tx_ba(struct mt792x_dev *dev,
610 			 struct ieee80211_vif *vif,
611 			 struct ieee80211_ampdu_params *params,
612 			 bool enable)
613 {
614 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
615 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
616 	struct mt792x_link_sta *mlink;
617 	struct mt792x_bss_conf *mconf;
618 	unsigned long usable_links = ieee80211_vif_usable_links(vif);
619 	struct mt76_wcid *wcid;
620 	u8 link_id, ret;
621 
622 	for_each_set_bit(link_id, &usable_links, IEEE80211_MLD_MAX_NUM_LINKS) {
623 		mconf = mt792x_vif_to_link(mvif, link_id);
624 		mlink = mt792x_sta_to_link(msta, link_id);
625 		wcid = &mlink->wcid;
626 
627 		if (enable && !params->amsdu)
628 			mlink->wcid.amsdu = false;
629 
630 		ret = mt7925_mcu_sta_ba(&dev->mt76, &mconf->mt76, wcid, params,
631 					enable, true);
632 		if (ret < 0)
633 			break;
634 	}
635 
636 	return ret;
637 }
638 
639 int mt7925_mcu_uni_rx_ba(struct mt792x_dev *dev,
640 			 struct ieee80211_vif *vif,
641 			 struct ieee80211_ampdu_params *params,
642 			 bool enable)
643 {
644 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
645 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
646 	struct mt792x_link_sta *mlink;
647 	struct mt792x_bss_conf *mconf;
648 	unsigned long usable_links = ieee80211_vif_usable_links(vif);
649 	struct mt76_wcid *wcid;
650 	u8 link_id, ret;
651 
652 	for_each_set_bit(link_id, &usable_links, IEEE80211_MLD_MAX_NUM_LINKS) {
653 		mconf = mt792x_vif_to_link(mvif, link_id);
654 		mlink = mt792x_sta_to_link(msta, link_id);
655 		wcid = &mlink->wcid;
656 
657 		ret = mt7925_mcu_sta_ba(&dev->mt76, &mconf->mt76, wcid, params,
658 					enable, false);
659 		if (ret < 0)
660 			break;
661 	}
662 
663 	return ret;
664 }
665 
666 static int mt7925_load_clc(struct mt792x_dev *dev, const char *fw_name)
667 {
668 	const struct mt76_connac2_fw_trailer *hdr;
669 	const struct mt76_connac2_fw_region *region;
670 	const struct mt7925_clc *clc;
671 	struct mt76_dev *mdev = &dev->mt76;
672 	struct mt792x_phy *phy = &dev->phy;
673 	const struct firmware *fw;
674 	int ret, i, len, offset = 0;
675 	u8 *clc_base = NULL;
676 
677 	if (mt7925_disable_clc ||
678 	    mt76_is_usb(&dev->mt76))
679 		return 0;
680 
681 	ret = request_firmware(&fw, fw_name, mdev->dev);
682 	if (ret)
683 		return ret;
684 
685 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
686 		dev_err(mdev->dev, "Invalid firmware\n");
687 		ret = -EINVAL;
688 		goto out;
689 	}
690 
691 	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
692 	for (i = 0; i < hdr->n_region; i++) {
693 		region = (const void *)((const u8 *)hdr -
694 					(hdr->n_region - i) * sizeof(*region));
695 		len = le32_to_cpu(region->len);
696 
697 		/* check if we have valid buffer size */
698 		if (offset + len > fw->size) {
699 			dev_err(mdev->dev, "Invalid firmware region\n");
700 			ret = -EINVAL;
701 			goto out;
702 		}
703 
704 		if ((region->feature_set & FW_FEATURE_NON_DL) &&
705 		    region->type == FW_TYPE_CLC) {
706 			clc_base = (u8 *)(fw->data + offset);
707 			break;
708 		}
709 		offset += len;
710 	}
711 
712 	if (!clc_base)
713 		goto out;
714 
715 	for (offset = 0; offset < len; offset += le32_to_cpu(clc->len)) {
716 		clc = (const struct mt7925_clc *)(clc_base + offset);
717 
718 		if (clc->idx >= ARRAY_SIZE(phy->clc))
719 			break;
720 
721 		/* do not init buf again if chip reset triggered */
722 		if (phy->clc[clc->idx])
723 			continue;
724 
725 		phy->clc[clc->idx] = devm_kmemdup(mdev->dev, clc,
726 						  le32_to_cpu(clc->len),
727 						  GFP_KERNEL);
728 
729 		if (!phy->clc[clc->idx]) {
730 			ret = -ENOMEM;
731 			goto out;
732 		}
733 	}
734 
735 	ret = mt7925_mcu_set_clc(dev, "00", ENVIRON_INDOOR);
736 out:
737 	release_firmware(fw);
738 
739 	return ret;
740 }
741 
742 int mt7925_mcu_fw_log_2_host(struct mt792x_dev *dev, u8 ctrl)
743 {
744 	struct {
745 		u8 _rsv[4];
746 
747 		__le16 tag;
748 		__le16 len;
749 		u8 ctrl;
750 		u8 interval;
751 		u8 _rsv2[2];
752 	} __packed req = {
753 		.tag = cpu_to_le16(UNI_WSYS_CONFIG_FW_LOG_CTRL),
754 		.len = cpu_to_le16(sizeof(req) - 4),
755 		.ctrl = ctrl,
756 	};
757 	int ret;
758 
759 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(WSYS_CONFIG),
760 					&req, sizeof(req), false, NULL);
761 	return ret;
762 }
763 
764 int mt7925_mcu_get_temperature(struct mt792x_phy *phy)
765 {
766 	struct {
767 		u8 _rsv[4];
768 
769 		__le16 tag;
770 		__le16 len;
771 		u8 _rsv2[4];
772 	} __packed req = {
773 		.tag = cpu_to_le16(0x0),
774 		.len = cpu_to_le16(sizeof(req) - 4),
775 	};
776 	struct mt7925_thermal_evt {
777 		u8 rsv[4];
778 		__le32 temperature;
779 	} __packed * evt;
780 	struct mt792x_dev *dev = phy->dev;
781 	int temperature, ret;
782 	struct sk_buff *skb;
783 
784 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
785 					MCU_WM_UNI_CMD_QUERY(THERMAL),
786 					&req, sizeof(req), true, &skb);
787 	if (ret)
788 		return ret;
789 
790 	skb_pull(skb, 4 + sizeof(struct tlv));
791 	evt = (struct mt7925_thermal_evt *)skb->data;
792 
793 	temperature = le32_to_cpu(evt->temperature);
794 
795 	dev_kfree_skb(skb);
796 
797 	return temperature;
798 }
799 
800 static void
801 mt7925_mcu_parse_phy_cap(struct mt792x_dev *dev, char *data)
802 {
803 	struct mt76_phy *mphy = &dev->mt76.phy;
804 	struct mt76_dev *mdev = mphy->dev;
805 	struct mt7925_mcu_phy_cap {
806 		u8 ht;
807 		u8 vht;
808 		u8 _5g;
809 		u8 max_bw;
810 		u8 nss;
811 		u8 dbdc;
812 		u8 tx_ldpc;
813 		u8 rx_ldpc;
814 		u8 tx_stbc;
815 		u8 rx_stbc;
816 		u8 hw_path;
817 		u8 he;
818 		u8 eht;
819 	} __packed * cap;
820 	enum {
821 		WF0_24G,
822 		WF0_5G
823 	};
824 
825 	cap = (struct mt7925_mcu_phy_cap *)data;
826 
827 	mdev->phy.antenna_mask = BIT(cap->nss) - 1;
828 	mdev->phy.chainmask = mdev->phy.antenna_mask;
829 	mdev->phy.cap.has_2ghz = cap->hw_path & BIT(WF0_24G);
830 	mdev->phy.cap.has_5ghz = cap->hw_path & BIT(WF0_5G);
831 	dev->has_eht = cap->eht;
832 }
833 
834 static void
835 mt7925_mcu_parse_eml_cap(struct mt792x_dev *dev, char *data)
836 {
837 	struct mt7925_mcu_eml_cap {
838 		u8 rsv[4];
839 		__le16 eml_cap;
840 		u8 rsv2[6];
841 	} __packed * cap;
842 
843 	cap = (struct mt7925_mcu_eml_cap *)data;
844 
845 	dev->phy.eml_cap = le16_to_cpu(cap->eml_cap);
846 }
847 
848 static int
849 mt7925_mcu_get_nic_capability(struct mt792x_dev *dev)
850 {
851 	struct mt76_phy *mphy = &dev->mt76.phy;
852 	struct {
853 		u8 _rsv[4];
854 
855 		__le16 tag;
856 		__le16 len;
857 	} __packed req = {
858 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_NIC_CAPA),
859 		.len = cpu_to_le16(sizeof(req) - 4),
860 	};
861 	struct mt76_connac_cap_hdr {
862 		__le16 n_element;
863 		u8 rsv[2];
864 	} __packed * hdr;
865 	struct sk_buff *skb;
866 	int ret, i;
867 
868 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
869 					&req, sizeof(req), true, &skb);
870 	if (ret)
871 		return ret;
872 
873 	hdr = (struct mt76_connac_cap_hdr *)skb->data;
874 	if (skb->len < sizeof(*hdr)) {
875 		ret = -EINVAL;
876 		goto out;
877 	}
878 
879 	skb_pull(skb, sizeof(*hdr));
880 
881 	for (i = 0; i < le16_to_cpu(hdr->n_element); i++) {
882 		struct tlv *tlv = (struct tlv *)skb->data;
883 		int len;
884 
885 		if (skb->len < sizeof(*tlv))
886 			break;
887 
888 		len = le16_to_cpu(tlv->len);
889 		if (skb->len < len)
890 			break;
891 
892 		switch (le16_to_cpu(tlv->tag)) {
893 		case MT_NIC_CAP_6G:
894 			mphy->cap.has_6ghz = !!tlv->data[0];
895 			break;
896 		case MT_NIC_CAP_MAC_ADDR:
897 			memcpy(mphy->macaddr, (void *)tlv->data, ETH_ALEN);
898 			break;
899 		case MT_NIC_CAP_PHY:
900 			mt7925_mcu_parse_phy_cap(dev, tlv->data);
901 			break;
902 		case MT_NIC_CAP_CHIP_CAP:
903 			dev->phy.chip_cap = le64_to_cpu(*(__le64 *)tlv->data);
904 			break;
905 		case MT_NIC_CAP_EML_CAP:
906 			mt7925_mcu_parse_eml_cap(dev, tlv->data);
907 			break;
908 		default:
909 			break;
910 		}
911 		skb_pull(skb, len);
912 	}
913 out:
914 	dev_kfree_skb(skb);
915 	return ret;
916 }
917 
918 int mt7925_mcu_chip_config(struct mt792x_dev *dev, const char *cmd)
919 {
920 	u16 len = strlen(cmd) + 1;
921 	struct {
922 		u8 _rsv[4];
923 		__le16 tag;
924 		__le16 len;
925 		struct mt76_connac_config config;
926 	} __packed req = {
927 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_CHIP_CFG),
928 		.len = cpu_to_le16(sizeof(req) - 4),
929 		.config = {
930 			.resp_type = 0,
931 			.type = 0,
932 			.data_size = cpu_to_le16(len),
933 		},
934 	};
935 
936 	memcpy(req.config.data, cmd, len);
937 
938 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
939 				 &req, sizeof(req), false);
940 }
941 
942 int mt7925_mcu_set_deep_sleep(struct mt792x_dev *dev, bool enable)
943 {
944 	char cmd[16];
945 
946 	snprintf(cmd, sizeof(cmd), "KeepFullPwr %d", !enable);
947 
948 	return mt7925_mcu_chip_config(dev, cmd);
949 }
950 EXPORT_SYMBOL_GPL(mt7925_mcu_set_deep_sleep);
951 
952 int mt7925_run_firmware(struct mt792x_dev *dev)
953 {
954 	int err;
955 
956 	err = mt792x_load_firmware(dev);
957 	if (err)
958 		return err;
959 
960 	err = mt7925_mcu_get_nic_capability(dev);
961 	if (err)
962 		return err;
963 
964 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
965 	err = mt7925_load_clc(dev, mt792x_ram_name(dev));
966 	if (err)
967 		return err;
968 
969 	return mt7925_mcu_fw_log_2_host(dev, 1);
970 }
971 EXPORT_SYMBOL_GPL(mt7925_run_firmware);
972 
973 static void
974 mt7925_mcu_sta_hdr_trans_tlv(struct sk_buff *skb,
975 			     struct ieee80211_vif *vif,
976 			     struct ieee80211_link_sta *link_sta)
977 {
978 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
979 	struct sta_rec_hdr_trans *hdr_trans;
980 	struct mt76_wcid *wcid;
981 	struct tlv *tlv;
982 
983 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HDR_TRANS, sizeof(*hdr_trans));
984 	hdr_trans = (struct sta_rec_hdr_trans *)tlv;
985 	hdr_trans->dis_rx_hdr_tran = true;
986 
987 	if (vif->type == NL80211_IFTYPE_STATION)
988 		hdr_trans->to_ds = true;
989 	else
990 		hdr_trans->from_ds = true;
991 
992 	if (link_sta) {
993 		struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
994 		struct mt792x_link_sta *mlink;
995 
996 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
997 		wcid = &mlink->wcid;
998 	} else {
999 		wcid = &mvif->sta.deflink.wcid;
1000 	}
1001 
1002 	if (!wcid)
1003 		return;
1004 
1005 	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
1006 	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
1007 		hdr_trans->to_ds = true;
1008 		hdr_trans->from_ds = true;
1009 	}
1010 }
1011 
1012 int mt7925_mcu_wtbl_update_hdr_trans(struct mt792x_dev *dev,
1013 				     struct ieee80211_vif *vif,
1014 				     struct ieee80211_sta *sta,
1015 				     int link_id)
1016 {
1017 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1018 	struct ieee80211_link_sta *link_sta = sta ? &sta->deflink : NULL;
1019 	struct mt792x_link_sta *mlink;
1020 	struct mt792x_bss_conf *mconf;
1021 	struct mt792x_sta *msta;
1022 	struct sk_buff *skb;
1023 
1024 	msta = sta ? (struct mt792x_sta *)sta->drv_priv : &mvif->sta;
1025 
1026 	mlink = mt792x_sta_to_link(msta, link_id);
1027 	link_sta = mt792x_sta_to_link_sta(vif, sta, link_id);
1028 	mconf = mt792x_vif_to_link(mvif, link_id);
1029 
1030 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
1031 					      &mlink->wcid,
1032 					      MT7925_STA_UPDATE_MAX_SIZE);
1033 	if (IS_ERR(skb))
1034 		return PTR_ERR(skb);
1035 
1036 	/* starec hdr trans */
1037 	mt7925_mcu_sta_hdr_trans_tlv(skb, vif, link_sta);
1038 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1039 				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
1040 }
1041 
1042 int mt7925_mcu_set_tx(struct mt792x_dev *dev,
1043 		      struct ieee80211_bss_conf *bss_conf)
1044 {
1045 #define MCU_EDCA_AC_PARAM	0
1046 #define WMM_AIFS_SET		BIT(0)
1047 #define WMM_CW_MIN_SET		BIT(1)
1048 #define WMM_CW_MAX_SET		BIT(2)
1049 #define WMM_TXOP_SET		BIT(3)
1050 #define WMM_PARAM_SET		(WMM_AIFS_SET | WMM_CW_MIN_SET | \
1051 				 WMM_CW_MAX_SET | WMM_TXOP_SET)
1052 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(bss_conf);
1053 	struct {
1054 		u8 bss_idx;
1055 		u8 __rsv[3];
1056 	} __packed hdr = {
1057 		.bss_idx = mconf->mt76.idx,
1058 	};
1059 	struct sk_buff *skb;
1060 	int len = sizeof(hdr) + IEEE80211_NUM_ACS * sizeof(struct edca);
1061 	int ac;
1062 
1063 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
1064 	if (!skb)
1065 		return -ENOMEM;
1066 
1067 	skb_put_data(skb, &hdr, sizeof(hdr));
1068 
1069 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1070 		struct ieee80211_tx_queue_params *q = &mconf->queue_params[ac];
1071 		struct edca *e;
1072 		struct tlv *tlv;
1073 
1074 		tlv = mt76_connac_mcu_add_tlv(skb, MCU_EDCA_AC_PARAM, sizeof(*e));
1075 
1076 		e = (struct edca *)tlv;
1077 		e->set = WMM_PARAM_SET;
1078 		e->queue = ac;
1079 		e->aifs = q->aifs;
1080 		e->txop = cpu_to_le16(q->txop);
1081 
1082 		if (q->cw_min)
1083 			e->cw_min = fls(q->cw_min);
1084 		else
1085 			e->cw_min = 5;
1086 
1087 		if (q->cw_max)
1088 			e->cw_max = fls(q->cw_max);
1089 		else
1090 			e->cw_max = 10;
1091 	}
1092 
1093 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1094 				     MCU_UNI_CMD(EDCA_UPDATE), true);
1095 }
1096 
1097 static int
1098 mt7925_mcu_sta_key_tlv(struct mt76_wcid *wcid,
1099 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1100 		       struct sk_buff *skb,
1101 		       struct ieee80211_key_conf *key,
1102 		       enum set_key_cmd cmd,
1103 		       struct mt792x_sta *msta)
1104 {
1105 	struct mt792x_vif *mvif = msta->vif;
1106 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1107 	struct sta_rec_sec_uni *sec;
1108 	struct ieee80211_sta *sta;
1109 	struct ieee80211_vif *vif;
1110 	struct tlv *tlv;
1111 
1112 	sta = msta == &mvif->sta ?
1113 		      NULL :
1114 		      container_of((void *)msta, struct ieee80211_sta, drv_priv);
1115 	vif = container_of((void *)mvif, struct ieee80211_vif, drv_priv);
1116 
1117 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V3, sizeof(*sec));
1118 	sec = (struct sta_rec_sec_uni *)tlv;
1119 	sec->bss_idx = mconf->mt76.idx;
1120 	sec->is_authenticator = 0;
1121 	sec->mgmt_prot = 1; /* only used in MLO mode */
1122 	sec->wlan_idx = (u8)wcid->idx;
1123 
1124 	if (sta) {
1125 		struct ieee80211_link_sta *link_sta;
1126 
1127 		sec->tx_key = 1;
1128 		sec->key_type = 1;
1129 		link_sta = mt792x_sta_to_link_sta(vif, sta, wcid->link_id);
1130 
1131 		if (link_sta)
1132 			memcpy(sec->peer_addr, link_sta->addr, ETH_ALEN);
1133 	} else {
1134 		struct ieee80211_bss_conf *link_conf;
1135 
1136 		link_conf = mt792x_vif_to_bss_conf(vif, wcid->link_id);
1137 
1138 		if (link_conf)
1139 			memcpy(sec->peer_addr, link_conf->bssid, ETH_ALEN);
1140 	}
1141 
1142 	if (cmd == SET_KEY) {
1143 		u8 cipher;
1144 
1145 		sec->add = 1;
1146 		cipher = mt7925_mcu_get_cipher(key->cipher);
1147 		if (cipher == CONNAC3_CIPHER_NONE)
1148 			return -EOPNOTSUPP;
1149 
1150 		if (cipher == CONNAC3_CIPHER_BIP_CMAC_128) {
1151 			sec->cipher_id = CONNAC3_CIPHER_BIP_CMAC_128;
1152 			sec->key_id = sta_key_conf->keyidx;
1153 			sec->key_len = 32;
1154 			memcpy(sec->key, sta_key_conf->key, 16);
1155 			memcpy(sec->key + 16, key->key, 16);
1156 		} else {
1157 			sec->cipher_id = cipher;
1158 			sec->key_id = key->keyidx;
1159 			sec->key_len = key->keylen;
1160 			memcpy(sec->key, key->key, key->keylen);
1161 
1162 			if (cipher == CONNAC3_CIPHER_TKIP) {
1163 				/* Rx/Tx MIC keys are swapped */
1164 				memcpy(sec->key + 16, key->key + 24, 8);
1165 				memcpy(sec->key + 24, key->key + 16, 8);
1166 			}
1167 
1168 			/* store key_conf for BIP batch update */
1169 			if (cipher == CONNAC3_CIPHER_AES_CCMP) {
1170 				memcpy(sta_key_conf->key, key->key, key->keylen);
1171 				sta_key_conf->keyidx = key->keyidx;
1172 			}
1173 		}
1174 	} else {
1175 		sec->add = 0;
1176 	}
1177 
1178 	return 0;
1179 }
1180 
1181 int mt7925_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
1182 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1183 		       struct ieee80211_key_conf *key, int mcu_cmd,
1184 		       struct mt76_wcid *wcid, enum set_key_cmd cmd,
1185 		       struct mt792x_sta *msta)
1186 {
1187 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1188 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1189 	struct sk_buff *skb;
1190 	int ret;
1191 
1192 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, wcid,
1193 					      MT7925_STA_UPDATE_MAX_SIZE);
1194 	if (IS_ERR(skb))
1195 		return PTR_ERR(skb);
1196 
1197 	ret = mt7925_mcu_sta_key_tlv(wcid, sta_key_conf, skb, key, cmd, msta);
1198 	if (ret)
1199 		return ret;
1200 
1201 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
1202 }
1203 
1204 int mt7925_mcu_set_mlo_roc(struct mt792x_bss_conf *mconf, u16 sel_links,
1205 			   int duration, u8 token_id)
1206 {
1207 	struct mt792x_vif *mvif = mconf->vif;
1208 	struct ieee80211_vif *vif = container_of((void *)mvif,
1209 						 struct ieee80211_vif, drv_priv);
1210 	struct ieee80211_bss_conf *link_conf;
1211 	struct ieee80211_channel *chan;
1212 	const u8 ch_band[] = {
1213 		[NL80211_BAND_2GHZ] = 1,
1214 		[NL80211_BAND_5GHZ] = 2,
1215 		[NL80211_BAND_6GHZ] = 3,
1216 	};
1217 	enum mt7925_roc_req type;
1218 	int center_ch, i = 0;
1219 	bool is_AG_band = false;
1220 	struct {
1221 		u8 id;
1222 		u8 bss_idx;
1223 		u16 tag;
1224 		struct mt792x_bss_conf *mconf;
1225 		struct ieee80211_channel *chan;
1226 	} links[2];
1227 
1228 	struct {
1229 		struct {
1230 			u8 rsv[4];
1231 		} __packed hdr;
1232 		struct roc_acquire_tlv roc[2];
1233 	} __packed req = {
1234 			.roc[0].tag = cpu_to_le16(UNI_ROC_NUM),
1235 			.roc[0].len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1236 			.roc[1].tag = cpu_to_le16(UNI_ROC_NUM),
1237 			.roc[1].len = cpu_to_le16(sizeof(struct roc_acquire_tlv))
1238 	};
1239 
1240 	if (!mconf || hweight16(vif->valid_links) < 2 ||
1241 	    hweight16(sel_links) != 2)
1242 		return -EPERM;
1243 
1244 	for (i = 0; i < ARRAY_SIZE(links); i++) {
1245 		links[i].id = i ? __ffs(~BIT(mconf->link_id) & sel_links) :
1246 				 mconf->link_id;
1247 		link_conf = mt792x_vif_to_bss_conf(vif, links[i].id);
1248 		if (WARN_ON_ONCE(!link_conf))
1249 			return -EPERM;
1250 
1251 		links[i].chan = link_conf->chanreq.oper.chan;
1252 		if (WARN_ON_ONCE(!links[i].chan))
1253 			return -EPERM;
1254 
1255 		links[i].mconf = mt792x_vif_to_link(mvif, links[i].id);
1256 		links[i].tag = links[i].id == mconf->link_id ?
1257 			       UNI_ROC_ACQUIRE : UNI_ROC_SUB_LINK;
1258 
1259 		is_AG_band |= links[i].chan->band == NL80211_BAND_2GHZ;
1260 	}
1261 
1262 	if (vif->cfg.eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP)
1263 		type = is_AG_band ? MT7925_ROC_REQ_MLSR_AG :
1264 				    MT7925_ROC_REQ_MLSR_AA;
1265 	else
1266 		type = MT7925_ROC_REQ_JOIN;
1267 
1268 	for (i = 0; i < ARRAY_SIZE(links) && i < hweight16(vif->active_links); i++) {
1269 		if (WARN_ON_ONCE(!links[i].mconf || !links[i].chan))
1270 			continue;
1271 
1272 		chan = links[i].chan;
1273 		center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1274 		req.roc[i].len = cpu_to_le16(sizeof(struct roc_acquire_tlv));
1275 		req.roc[i].tag = cpu_to_le16(links[i].tag);
1276 		req.roc[i].tokenid = token_id;
1277 		req.roc[i].reqtype = type;
1278 		req.roc[i].maxinterval = cpu_to_le32(duration);
1279 		req.roc[i].bss_idx = links[i].mconf->mt76.idx;
1280 		req.roc[i].control_channel = chan->hw_value;
1281 		req.roc[i].bw = CMD_CBW_20MHZ;
1282 		req.roc[i].bw_from_ap = CMD_CBW_20MHZ;
1283 		req.roc[i].center_chan = center_ch;
1284 		req.roc[i].center_chan_from_ap = center_ch;
1285 		req.roc[i].center_chan2 = 0;
1286 		req.roc[i].center_chan2_from_ap = 0;
1287 
1288 		/* STR : 0xfe indicates BAND_ALL with enabling DBDC
1289 		 * EMLSR : 0xff indicates (BAND_AUTO) without DBDC
1290 		 */
1291 		req.roc[i].dbdcband = type == MT7925_ROC_REQ_JOIN ? 0xfe : 0xff;
1292 
1293 		if (chan->hw_value < center_ch)
1294 			req.roc[i].sco = 1; /* SCA */
1295 		else if (chan->hw_value > center_ch)
1296 			req.roc[i].sco = 3; /* SCB */
1297 
1298 		req.roc[i].band = ch_band[chan->band];
1299 	}
1300 
1301 	return mt76_mcu_send_msg(&mvif->phy->dev->mt76, MCU_UNI_CMD(ROC),
1302 				 &req, sizeof(req), true);
1303 }
1304 
1305 int mt7925_mcu_set_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1306 		       struct ieee80211_channel *chan, int duration,
1307 		       enum mt7925_roc_req type, u8 token_id)
1308 {
1309 	int center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1310 	struct mt792x_dev *dev = phy->dev;
1311 	struct {
1312 		struct {
1313 			u8 rsv[4];
1314 		} __packed hdr;
1315 		struct roc_acquire_tlv roc;
1316 	} __packed req = {
1317 		.roc = {
1318 			.tag = cpu_to_le16(UNI_ROC_ACQUIRE),
1319 			.len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1320 			.tokenid = token_id,
1321 			.reqtype = type,
1322 			.maxinterval = cpu_to_le32(duration),
1323 			.bss_idx = mconf->mt76.idx,
1324 			.control_channel = chan->hw_value,
1325 			.bw = CMD_CBW_20MHZ,
1326 			.bw_from_ap = CMD_CBW_20MHZ,
1327 			.center_chan = center_ch,
1328 			.center_chan_from_ap = center_ch,
1329 			.dbdcband = 0xff, /* auto */
1330 		},
1331 	};
1332 
1333 	if (chan->hw_value < center_ch)
1334 		req.roc.sco = 1; /* SCA */
1335 	else if (chan->hw_value > center_ch)
1336 		req.roc.sco = 3; /* SCB */
1337 
1338 	switch (chan->band) {
1339 	case NL80211_BAND_6GHZ:
1340 		req.roc.band = 3;
1341 		break;
1342 	case NL80211_BAND_5GHZ:
1343 		req.roc.band = 2;
1344 		break;
1345 	default:
1346 		req.roc.band = 1;
1347 		break;
1348 	}
1349 
1350 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1351 				 &req, sizeof(req), true);
1352 }
1353 
1354 int mt7925_mcu_abort_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1355 			 u8 token_id)
1356 {
1357 	struct mt792x_dev *dev = phy->dev;
1358 	struct {
1359 		struct {
1360 			u8 rsv[4];
1361 		} __packed hdr;
1362 		struct roc_abort_tlv {
1363 			__le16 tag;
1364 			__le16 len;
1365 			u8 bss_idx;
1366 			u8 tokenid;
1367 			u8 dbdcband;
1368 			u8 rsv[5];
1369 		} __packed abort;
1370 	} __packed req = {
1371 		.abort = {
1372 			.tag = cpu_to_le16(UNI_ROC_ABORT),
1373 			.len = cpu_to_le16(sizeof(struct roc_abort_tlv)),
1374 			.tokenid = token_id,
1375 			.bss_idx = mconf->mt76.idx,
1376 			.dbdcband = 0xff, /* auto*/
1377 		},
1378 	};
1379 
1380 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1381 				 &req, sizeof(req), true);
1382 }
1383 
1384 int mt7925_mcu_set_eeprom(struct mt792x_dev *dev)
1385 {
1386 	struct {
1387 		u8 _rsv[4];
1388 
1389 		__le16 tag;
1390 		__le16 len;
1391 		u8 buffer_mode;
1392 		u8 format;
1393 		__le16 buf_len;
1394 	} __packed req = {
1395 		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
1396 		.len = cpu_to_le16(sizeof(req) - 4),
1397 		.buffer_mode = EE_MODE_EFUSE,
1398 		.format = EE_FORMAT_WHOLE
1399 	};
1400 
1401 	return mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(EFUSE_CTRL),
1402 					 &req, sizeof(req), false, NULL);
1403 }
1404 EXPORT_SYMBOL_GPL(mt7925_mcu_set_eeprom);
1405 
1406 int mt7925_mcu_uni_bss_ps(struct mt792x_dev *dev,
1407 			  struct ieee80211_bss_conf *link_conf)
1408 {
1409 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1410 	struct {
1411 		struct {
1412 			u8 bss_idx;
1413 			u8 pad[3];
1414 		} __packed hdr;
1415 		struct ps_tlv {
1416 			__le16 tag;
1417 			__le16 len;
1418 			u8 ps_state; /* 0: device awake
1419 				      * 1: static power save
1420 				      * 2: dynamic power saving
1421 				      * 3: enter TWT power saving
1422 				      * 4: leave TWT power saving
1423 				      */
1424 			u8 pad[3];
1425 		} __packed ps;
1426 	} __packed ps_req = {
1427 		.hdr = {
1428 			.bss_idx = mconf->mt76.idx,
1429 		},
1430 		.ps = {
1431 			.tag = cpu_to_le16(UNI_BSS_INFO_PS),
1432 			.len = cpu_to_le16(sizeof(struct ps_tlv)),
1433 			.ps_state = link_conf->vif->cfg.ps ? 2 : 0,
1434 		},
1435 	};
1436 
1437 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1438 		return -EOPNOTSUPP;
1439 
1440 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1441 				 &ps_req, sizeof(ps_req), true);
1442 }
1443 
1444 int
1445 mt7925_mcu_uni_bss_bcnft(struct mt792x_dev *dev,
1446 			 struct ieee80211_bss_conf *link_conf, bool enable)
1447 {
1448 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1449 	struct {
1450 		struct {
1451 			u8 bss_idx;
1452 			u8 pad[3];
1453 		} __packed hdr;
1454 		struct bcnft_tlv {
1455 			__le16 tag;
1456 			__le16 len;
1457 			__le16 bcn_interval;
1458 			u8 dtim_period;
1459 			u8 bmc_delivered_ac;
1460 			u8 bmc_triggered_ac;
1461 			u8 pad[3];
1462 		} __packed bcnft;
1463 	} __packed bcnft_req = {
1464 		.hdr = {
1465 			.bss_idx = mconf->mt76.idx,
1466 		},
1467 		.bcnft = {
1468 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1469 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1470 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1471 			.dtim_period = link_conf->dtim_period,
1472 		},
1473 	};
1474 
1475 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1476 		return 0;
1477 
1478 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1479 				 &bcnft_req, sizeof(bcnft_req), true);
1480 }
1481 
1482 int
1483 mt7925_mcu_set_bss_pm(struct mt792x_dev *dev,
1484 		      struct ieee80211_bss_conf *link_conf,
1485 		      bool enable)
1486 {
1487 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1488 	struct {
1489 		struct {
1490 			u8 bss_idx;
1491 			u8 pad[3];
1492 		} __packed hdr;
1493 		struct bcnft_tlv {
1494 			__le16 tag;
1495 			__le16 len;
1496 			__le16 bcn_interval;
1497 			u8 dtim_period;
1498 			u8 bmc_delivered_ac;
1499 			u8 bmc_triggered_ac;
1500 			u8 pad[3];
1501 		} __packed enable;
1502 	} req = {
1503 		.hdr = {
1504 			.bss_idx = mconf->mt76.idx,
1505 		},
1506 		.enable = {
1507 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1508 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1509 			.dtim_period = link_conf->dtim_period,
1510 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1511 		},
1512 	};
1513 	struct {
1514 		struct {
1515 			u8 bss_idx;
1516 			u8 pad[3];
1517 		} __packed hdr;
1518 		struct pm_disable {
1519 			__le16 tag;
1520 			__le16 len;
1521 		} __packed disable;
1522 	} req1 = {
1523 		.hdr = {
1524 			.bss_idx = mconf->mt76.idx,
1525 		},
1526 		.disable = {
1527 			.tag = cpu_to_le16(UNI_BSS_INFO_PM_DISABLE),
1528 			.len = cpu_to_le16(sizeof(struct pm_disable))
1529 		},
1530 	};
1531 	int err;
1532 
1533 	err = mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1534 				&req1, sizeof(req1), true);
1535 	if (err < 0 || !enable)
1536 		return err;
1537 
1538 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1539 				 &req, sizeof(req), true);
1540 }
1541 
1542 static void
1543 mt7925_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1544 {
1545 	if (!link_sta->he_cap.has_he)
1546 		return;
1547 
1548 	mt76_connac_mcu_sta_he_tlv_v2(skb, link_sta->sta);
1549 }
1550 
1551 static void
1552 mt7925_mcu_sta_he_6g_tlv(struct sk_buff *skb,
1553 			 struct ieee80211_link_sta *link_sta)
1554 {
1555 	struct sta_rec_he_6g_capa *he_6g;
1556 	struct tlv *tlv;
1557 
1558 	if (!link_sta->he_6ghz_capa.capa)
1559 		return;
1560 
1561 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G, sizeof(*he_6g));
1562 
1563 	he_6g = (struct sta_rec_he_6g_capa *)tlv;
1564 	he_6g->capa = link_sta->he_6ghz_capa.capa;
1565 }
1566 
1567 static void
1568 mt7925_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1569 {
1570 	struct ieee80211_eht_mcs_nss_supp *mcs_map;
1571 	struct ieee80211_eht_cap_elem_fixed *elem;
1572 	struct sta_rec_eht *eht;
1573 	struct tlv *tlv;
1574 
1575 	if (!link_sta->eht_cap.has_eht)
1576 		return;
1577 
1578 	mcs_map = &link_sta->eht_cap.eht_mcs_nss_supp;
1579 	elem = &link_sta->eht_cap.eht_cap_elem;
1580 
1581 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT, sizeof(*eht));
1582 
1583 	eht = (struct sta_rec_eht *)tlv;
1584 	eht->tid_bitmap = 0xff;
1585 	eht->mac_cap = cpu_to_le16(*(u16 *)elem->mac_cap_info);
1586 	eht->phy_cap = cpu_to_le64(*(u64 *)elem->phy_cap_info);
1587 	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
1588 
1589 	if (link_sta->bandwidth == IEEE80211_STA_RX_BW_20)
1590 		memcpy(eht->mcs_map_bw20, &mcs_map->only_20mhz, sizeof(eht->mcs_map_bw20));
1591 	memcpy(eht->mcs_map_bw80, &mcs_map->bw._80, sizeof(eht->mcs_map_bw80));
1592 	memcpy(eht->mcs_map_bw160, &mcs_map->bw._160, sizeof(eht->mcs_map_bw160));
1593 }
1594 
1595 static void
1596 mt7925_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1597 {
1598 	struct sta_rec_ht *ht;
1599 	struct tlv *tlv;
1600 
1601 	if (!link_sta->ht_cap.ht_supported)
1602 		return;
1603 
1604 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1605 
1606 	ht = (struct sta_rec_ht *)tlv;
1607 	ht->ht_cap = cpu_to_le16(link_sta->ht_cap.cap);
1608 }
1609 
1610 static void
1611 mt7925_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1612 {
1613 	struct sta_rec_vht *vht;
1614 	struct tlv *tlv;
1615 
1616 	/* For 6G band, this tlv is necessary to let hw work normally */
1617 	if (!link_sta->he_6ghz_capa.capa && !link_sta->vht_cap.vht_supported)
1618 		return;
1619 
1620 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1621 
1622 	vht = (struct sta_rec_vht *)tlv;
1623 	vht->vht_cap = cpu_to_le32(link_sta->vht_cap.cap);
1624 	vht->vht_rx_mcs_map = link_sta->vht_cap.vht_mcs.rx_mcs_map;
1625 	vht->vht_tx_mcs_map = link_sta->vht_cap.vht_mcs.tx_mcs_map;
1626 }
1627 
1628 static void
1629 mt7925_mcu_sta_amsdu_tlv(struct sk_buff *skb,
1630 			 struct ieee80211_vif *vif,
1631 			 struct ieee80211_link_sta *link_sta)
1632 {
1633 	struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1634 	struct mt792x_link_sta *mlink;
1635 	struct sta_rec_amsdu *amsdu;
1636 	struct tlv *tlv;
1637 
1638 	if (vif->type != NL80211_IFTYPE_STATION &&
1639 	    vif->type != NL80211_IFTYPE_AP)
1640 		return;
1641 
1642 	if (!link_sta->agg.max_amsdu_len)
1643 		return;
1644 
1645 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1646 	amsdu = (struct sta_rec_amsdu *)tlv;
1647 	amsdu->max_amsdu_num = 8;
1648 	amsdu->amsdu_en = true;
1649 
1650 	mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1651 	mlink->wcid.amsdu = true;
1652 
1653 	switch (link_sta->agg.max_amsdu_len) {
1654 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1655 		amsdu->max_mpdu_size =
1656 			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1657 		return;
1658 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
1659 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1660 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1661 		return;
1662 	default:
1663 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1664 		return;
1665 	}
1666 }
1667 
1668 static void
1669 mt7925_mcu_sta_phy_tlv(struct sk_buff *skb,
1670 		       struct ieee80211_vif *vif,
1671 		       struct ieee80211_link_sta *link_sta)
1672 {
1673 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1674 	struct ieee80211_bss_conf *link_conf;
1675 	struct cfg80211_chan_def *chandef;
1676 	struct mt792x_bss_conf *mconf;
1677 	struct sta_rec_phy *phy;
1678 	struct tlv *tlv;
1679 	u8 af = 0, mm = 0;
1680 
1681 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1682 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1683 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1684 				    &link_conf->chanreq.oper;
1685 
1686 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PHY, sizeof(*phy));
1687 	phy = (struct sta_rec_phy *)tlv;
1688 	phy->phy_type = mt76_connac_get_phy_mode_v2(mvif->phy->mt76, vif,
1689 						    chandef->chan->band,
1690 						    link_sta);
1691 	phy->basic_rate = cpu_to_le16((u16)link_conf->basic_rates);
1692 	if (link_sta->ht_cap.ht_supported) {
1693 		af = link_sta->ht_cap.ampdu_factor;
1694 		mm = link_sta->ht_cap.ampdu_density;
1695 	}
1696 
1697 	if (link_sta->vht_cap.vht_supported) {
1698 		u8 vht_af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1699 				      link_sta->vht_cap.cap);
1700 
1701 		af = max_t(u8, af, vht_af);
1702 	}
1703 
1704 	if (link_sta->he_6ghz_capa.capa) {
1705 		af = le16_get_bits(link_sta->he_6ghz_capa.capa,
1706 				   IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1707 		mm = le16_get_bits(link_sta->he_6ghz_capa.capa,
1708 				   IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
1709 	}
1710 
1711 	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR, af) |
1712 		     FIELD_PREP(IEEE80211_HT_AMPDU_PARM_DENSITY, mm);
1713 	phy->max_ampdu_len = af;
1714 }
1715 
1716 static void
1717 mt7925_mcu_sta_state_v2_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
1718 			    struct ieee80211_link_sta *link_sta,
1719 			    struct ieee80211_vif *vif,
1720 			    u8 rcpi, u8 sta_state)
1721 {
1722 	struct sta_rec_state_v2 {
1723 		__le16 tag;
1724 		__le16 len;
1725 		u8 state;
1726 		u8 rsv[3];
1727 		__le32 flags;
1728 		u8 vht_opmode;
1729 		u8 action;
1730 		u8 rsv2[2];
1731 	} __packed * state;
1732 	struct tlv *tlv;
1733 
1734 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_STATE, sizeof(*state));
1735 	state = (struct sta_rec_state_v2 *)tlv;
1736 	state->state = sta_state;
1737 
1738 	if (link_sta->vht_cap.vht_supported) {
1739 		state->vht_opmode = link_sta->bandwidth;
1740 		state->vht_opmode |= link_sta->rx_nss <<
1741 			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
1742 	}
1743 }
1744 
1745 static void
1746 mt7925_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb,
1747 			     struct ieee80211_vif *vif,
1748 			     struct ieee80211_link_sta *link_sta)
1749 {
1750 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1751 	struct ieee80211_bss_conf *link_conf;
1752 	struct cfg80211_chan_def *chandef;
1753 	struct sta_rec_ra_info *ra_info;
1754 	struct mt792x_bss_conf *mconf;
1755 	enum nl80211_band band;
1756 	struct tlv *tlv;
1757 	u16 supp_rates;
1758 
1759 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1760 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1761 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1762 				    &link_conf->chanreq.oper;
1763 	band = chandef->chan->band;
1764 
1765 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra_info));
1766 	ra_info = (struct sta_rec_ra_info *)tlv;
1767 
1768 	supp_rates = link_sta->supp_rates[band];
1769 	if (band == NL80211_BAND_2GHZ)
1770 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
1771 			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
1772 	else
1773 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates);
1774 
1775 	ra_info->legacy = cpu_to_le16(supp_rates);
1776 
1777 	if (link_sta->ht_cap.ht_supported)
1778 		memcpy(ra_info->rx_mcs_bitmask,
1779 		       link_sta->ht_cap.mcs.rx_mask,
1780 		       HT_MCS_MASK_NUM);
1781 }
1782 
1783 static void
1784 mt7925_mcu_sta_eht_mld_tlv(struct sk_buff *skb,
1785 			   struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1786 {
1787 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1788 	struct wiphy *wiphy = mvif->phy->mt76->hw->wiphy;
1789 	const struct wiphy_iftype_ext_capab *ext_capa;
1790 	struct sta_rec_eht_mld *eht_mld;
1791 	struct tlv *tlv;
1792 	u16 eml_cap;
1793 
1794 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT_MLD, sizeof(*eht_mld));
1795 	eht_mld = (struct sta_rec_eht_mld *)tlv;
1796 	eht_mld->mld_type = 0xff;
1797 
1798 	if (!ieee80211_vif_is_mld(vif))
1799 		return;
1800 
1801 	ext_capa = cfg80211_get_iftype_ext_capa(wiphy,
1802 						ieee80211_vif_type_p2p(vif));
1803 	if (!ext_capa)
1804 		return;
1805 
1806 	eml_cap = (vif->cfg.eml_cap & (IEEE80211_EML_CAP_EMLSR_SUPP |
1807 				       IEEE80211_EML_CAP_TRANSITION_TIMEOUT)) |
1808 		  (ext_capa->eml_capabilities & (IEEE80211_EML_CAP_EMLSR_PADDING_DELAY |
1809 						IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY));
1810 
1811 	if (eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP) {
1812 		eht_mld->eml_cap[0] = u16_get_bits(eml_cap, GENMASK(7, 0));
1813 		eht_mld->eml_cap[1] = u16_get_bits(eml_cap, GENMASK(15, 8));
1814 	} else {
1815 		eht_mld->str_cap[0] = BIT(1);
1816 	}
1817 }
1818 
1819 static void
1820 mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,
1821 		       struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1822 {
1823 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1824 	struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv;
1825 	unsigned long valid = mvif->valid_links;
1826 	struct mt792x_bss_conf *mconf;
1827 	struct mt792x_link_sta *mlink;
1828 	struct sta_rec_mld *mld;
1829 	struct tlv *tlv;
1830 	int i, cnt = 0;
1831 
1832 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MLD, sizeof(*mld));
1833 	mld = (struct sta_rec_mld *)tlv;
1834 	memcpy(mld->mac_addr, sta->addr, ETH_ALEN);
1835 	mld->primary_id = cpu_to_le16(msta->deflink.wcid.idx);
1836 	mld->wlan_id = cpu_to_le16(msta->deflink.wcid.idx);
1837 	mld->link_num = min_t(u8, hweight16(mvif->valid_links), 2);
1838 
1839 	for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
1840 		if (cnt == mld->link_num)
1841 			break;
1842 
1843 		mconf = mt792x_vif_to_link(mvif, i);
1844 		mlink = mt792x_sta_to_link(msta, i);
1845 		mld->link[cnt].wlan_id = cpu_to_le16(mlink->wcid.idx);
1846 		mld->link[cnt++].bss_idx = mconf->mt76.idx;
1847 
1848 		if (mlink != &msta->deflink)
1849 			mld->secondary_id = cpu_to_le16(mlink->wcid.idx);
1850 	}
1851 }
1852 
1853 static int
1854 mt7925_mcu_sta_cmd(struct mt76_phy *phy,
1855 		   struct mt76_sta_cmd_info *info)
1856 {
1857 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)info->vif->drv_priv;
1858 	struct mt76_dev *dev = phy->dev;
1859 	struct sk_buff *skb;
1860 	int conn_state;
1861 
1862 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, info->wcid,
1863 					      MT7925_STA_UPDATE_MAX_SIZE);
1864 	if (IS_ERR(skb))
1865 		return PTR_ERR(skb);
1866 
1867 	conn_state = info->enable ? CONN_STATE_PORT_SECURE :
1868 				    CONN_STATE_DISCONNECT;
1869 	if (info->link_sta)
1870 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->link_conf,
1871 					      info->link_sta,
1872 					      conn_state, info->newly);
1873 	if (info->link_sta && info->enable) {
1874 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1875 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1876 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1877 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1878 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1879 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1880 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1881 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1882 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1883 					     info->link_sta);
1884 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1885 					    info->vif, info->rcpi,
1886 					    info->state);
1887 		mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1888 	}
1889 
1890 	if (info->enable)
1891 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
1892 
1893 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1894 }
1895 
1896 static void
1897 mt7925_mcu_sta_remove_tlv(struct sk_buff *skb)
1898 {
1899 	struct sta_rec_remove *rem;
1900 	struct tlv *tlv;
1901 
1902 	tlv = mt76_connac_mcu_add_tlv(skb, 0x25, sizeof(*rem));
1903 	rem = (struct sta_rec_remove *)tlv;
1904 	rem->action = 0;
1905 }
1906 
1907 static int
1908 mt7925_mcu_mlo_sta_cmd(struct mt76_phy *phy,
1909 		       struct mt76_sta_cmd_info *info)
1910 {
1911 	struct mt792x_vif *mvif = (struct mt792x_vif *)info->vif->drv_priv;
1912 	struct mt76_dev *dev = phy->dev;
1913 	struct mt792x_bss_conf *mconf;
1914 	struct sk_buff *skb;
1915 
1916 	mconf = mt792x_vif_to_link(mvif, info->wcid->link_id);
1917 
1918 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, info->wcid,
1919 					      MT7925_STA_UPDATE_MAX_SIZE);
1920 	if (IS_ERR(skb))
1921 		return PTR_ERR(skb);
1922 
1923 	if (info->enable)
1924 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->link_conf,
1925 					      info->link_sta,
1926 					      info->enable, info->newly);
1927 
1928 	if (info->enable && info->link_sta) {
1929 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1930 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1931 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1932 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1933 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1934 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1935 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1936 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1937 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1938 					     info->link_sta);
1939 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1940 					    info->vif, info->rcpi,
1941 					    info->state);
1942 
1943 		if (info->state != MT76_STA_INFO_STATE_NONE) {
1944 			mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1945 			mt7925_mcu_sta_eht_mld_tlv(skb, info->vif, info->link_sta->sta);
1946 		}
1947 
1948 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
1949 	}
1950 
1951 	if (!info->enable) {
1952 		mt7925_mcu_sta_remove_tlv(skb);
1953 		mt76_connac_mcu_add_tlv(skb, STA_REC_MLD_OFF,
1954 					sizeof(struct tlv));
1955 	}
1956 
1957 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1958 }
1959 
1960 int mt7925_mcu_sta_update(struct mt792x_dev *dev,
1961 			  struct ieee80211_link_sta *link_sta,
1962 			  struct ieee80211_vif *vif, bool enable,
1963 			  enum mt76_sta_info_state state)
1964 {
1965 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1966 	int rssi = -ewma_rssi_read(&mvif->bss_conf.rssi);
1967 	struct mt76_sta_cmd_info info = {
1968 		.link_sta = link_sta,
1969 		.vif = vif,
1970 		.link_conf = &vif->bss_conf,
1971 		.enable = enable,
1972 		.cmd = MCU_UNI_CMD(STA_REC_UPDATE),
1973 		.state = state,
1974 		.offload_fw = true,
1975 		.rcpi = to_rcpi(rssi),
1976 	};
1977 	struct mt792x_sta *msta;
1978 	struct mt792x_link_sta *mlink;
1979 	int err;
1980 
1981 	if (link_sta) {
1982 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1983 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1984 	}
1985 	info.wcid = link_sta ? &mlink->wcid : &mvif->sta.deflink.wcid;
1986 
1987 	if (link_sta)
1988 		info.newly = state != MT76_STA_INFO_STATE_ASSOC;
1989 	else
1990 		info.newly = state == MT76_STA_INFO_STATE_ASSOC ? false : true;
1991 
1992 	if (ieee80211_vif_is_mld(vif))
1993 		err = mt7925_mcu_mlo_sta_cmd(&dev->mphy, &info);
1994 	else
1995 		err = mt7925_mcu_sta_cmd(&dev->mphy, &info);
1996 
1997 	return err;
1998 }
1999 
2000 int mt7925_mcu_set_beacon_filter(struct mt792x_dev *dev,
2001 				 struct ieee80211_vif *vif,
2002 				 bool enable)
2003 {
2004 #define MT7925_FIF_BIT_CLR		BIT(1)
2005 #define MT7925_FIF_BIT_SET		BIT(0)
2006 	int err = 0;
2007 
2008 	if (enable) {
2009 		err = mt7925_mcu_uni_bss_bcnft(dev, &vif->bss_conf, true);
2010 		if (err < 0)
2011 			return err;
2012 
2013 		return mt7925_mcu_set_rxfilter(dev, 0,
2014 					       MT7925_FIF_BIT_SET,
2015 					       MT_WF_RFCR_DROP_OTHER_BEACON);
2016 	}
2017 
2018 	err = mt7925_mcu_set_bss_pm(dev, &vif->bss_conf, false);
2019 	if (err < 0)
2020 		return err;
2021 
2022 	return mt7925_mcu_set_rxfilter(dev, 0,
2023 				       MT7925_FIF_BIT_CLR,
2024 				       MT_WF_RFCR_DROP_OTHER_BEACON);
2025 }
2026 
2027 int mt7925_get_txpwr_info(struct mt792x_dev *dev, u8 band_idx, struct mt7925_txpwr *txpwr)
2028 {
2029 #define TX_POWER_SHOW_INFO 0x7
2030 #define TXPOWER_ALL_RATE_POWER_INFO 0x2
2031 	struct mt7925_txpwr_event *event;
2032 	struct mt7925_txpwr_req req = {
2033 		.tag = cpu_to_le16(TX_POWER_SHOW_INFO),
2034 		.len = cpu_to_le16(sizeof(req) - 4),
2035 		.catg = TXPOWER_ALL_RATE_POWER_INFO,
2036 		.band_idx = band_idx,
2037 	};
2038 	struct sk_buff *skb;
2039 	int ret;
2040 
2041 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(TXPOWER),
2042 					&req, sizeof(req), true, &skb);
2043 	if (ret)
2044 		return ret;
2045 
2046 	event = (struct mt7925_txpwr_event *)skb->data;
2047 	memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
2048 
2049 	dev_kfree_skb(skb);
2050 
2051 	return 0;
2052 }
2053 
2054 int mt7925_mcu_set_sniffer(struct mt792x_dev *dev, struct ieee80211_vif *vif,
2055 			   bool enable)
2056 {
2057 	struct {
2058 		struct {
2059 			u8 band_idx;
2060 			u8 pad[3];
2061 		} __packed hdr;
2062 		struct sniffer_enable_tlv {
2063 			__le16 tag;
2064 			__le16 len;
2065 			u8 enable;
2066 			u8 pad[3];
2067 		} __packed enable;
2068 	} __packed req = {
2069 		.hdr = {
2070 			.band_idx = 0,
2071 		},
2072 		.enable = {
2073 			.tag = cpu_to_le16(UNI_SNIFFER_ENABLE),
2074 			.len = cpu_to_le16(sizeof(struct sniffer_enable_tlv)),
2075 			.enable = enable,
2076 		},
2077 	};
2078 
2079 	mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req), true);
2080 
2081 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req),
2082 				 true);
2083 }
2084 
2085 int mt7925_mcu_config_sniffer(struct mt792x_vif *vif,
2086 			      struct ieee80211_chanctx_conf *ctx)
2087 {
2088 	struct mt76_phy *mphy = vif->phy->mt76;
2089 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def : &mphy->chandef;
2090 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2091 
2092 	static const u8 ch_band[] = {
2093 		[NL80211_BAND_2GHZ] = 1,
2094 		[NL80211_BAND_5GHZ] = 2,
2095 		[NL80211_BAND_6GHZ] = 3,
2096 	};
2097 	static const u8 ch_width[] = {
2098 		[NL80211_CHAN_WIDTH_20_NOHT] = 0,
2099 		[NL80211_CHAN_WIDTH_20] = 0,
2100 		[NL80211_CHAN_WIDTH_40] = 0,
2101 		[NL80211_CHAN_WIDTH_80] = 1,
2102 		[NL80211_CHAN_WIDTH_160] = 2,
2103 		[NL80211_CHAN_WIDTH_80P80] = 3,
2104 		[NL80211_CHAN_WIDTH_5] = 4,
2105 		[NL80211_CHAN_WIDTH_10] = 5,
2106 		[NL80211_CHAN_WIDTH_320] = 6,
2107 	};
2108 
2109 	struct {
2110 		struct {
2111 			u8 band_idx;
2112 			u8 pad[3];
2113 		} __packed hdr;
2114 		struct config_tlv {
2115 			__le16 tag;
2116 			__le16 len;
2117 			u16 aid;
2118 			u8 ch_band;
2119 			u8 bw;
2120 			u8 control_ch;
2121 			u8 sco;
2122 			u8 center_ch;
2123 			u8 center_ch2;
2124 			u8 drop_err;
2125 			u8 pad[3];
2126 		} __packed tlv;
2127 	} __packed req = {
2128 		.hdr = {
2129 			.band_idx = 0,
2130 		},
2131 		.tlv = {
2132 			.tag = cpu_to_le16(UNI_SNIFFER_CONFIG),
2133 			.len = cpu_to_le16(sizeof(req.tlv)),
2134 			.control_ch = chandef->chan->hw_value,
2135 			.center_ch = ieee80211_frequency_to_channel(freq1),
2136 			.drop_err = 1,
2137 		},
2138 	};
2139 
2140 	if (chandef->chan->band < ARRAY_SIZE(ch_band))
2141 		req.tlv.ch_band = ch_band[chandef->chan->band];
2142 	if (chandef->width < ARRAY_SIZE(ch_width))
2143 		req.tlv.bw = ch_width[chandef->width];
2144 
2145 	if (freq2)
2146 		req.tlv.center_ch2 = ieee80211_frequency_to_channel(freq2);
2147 
2148 	if (req.tlv.control_ch < req.tlv.center_ch)
2149 		req.tlv.sco = 1; /* SCA */
2150 	else if (req.tlv.control_ch > req.tlv.center_ch)
2151 		req.tlv.sco = 3; /* SCB */
2152 
2153 	return mt76_mcu_send_msg(mphy->dev, MCU_UNI_CMD(SNIFFER),
2154 				 &req, sizeof(req), true);
2155 }
2156 
2157 int
2158 mt7925_mcu_uni_add_beacon_offload(struct mt792x_dev *dev,
2159 				  struct ieee80211_hw *hw,
2160 				  struct ieee80211_vif *vif,
2161 				  bool enable)
2162 {
2163 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
2164 	struct ieee80211_mutable_offsets offs;
2165 	struct {
2166 		struct req_hdr {
2167 			u8 bss_idx;
2168 			u8 pad[3];
2169 		} __packed hdr;
2170 		struct bcn_content_tlv {
2171 			__le16 tag;
2172 			__le16 len;
2173 			__le16 tim_ie_pos;
2174 			__le16 csa_ie_pos;
2175 			__le16 bcc_ie_pos;
2176 			/* 0: disable beacon offload
2177 			 * 1: enable beacon offload
2178 			 * 2: update probe respond offload
2179 			 */
2180 			u8 enable;
2181 			/* 0: legacy format (TXD + payload)
2182 			 * 1: only cap field IE
2183 			 */
2184 			u8 type;
2185 			__le16 pkt_len;
2186 			u8 pkt[512];
2187 		} __packed beacon_tlv;
2188 	} req = {
2189 		.hdr = {
2190 			.bss_idx = mvif->bss_conf.mt76.idx,
2191 		},
2192 		.beacon_tlv = {
2193 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
2194 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
2195 			.enable = enable,
2196 			.type = 1,
2197 		},
2198 	};
2199 	struct sk_buff *skb;
2200 	u8 cap_offs;
2201 
2202 	/* support enable/update process only
2203 	 * disable flow would be handled in bss stop handler automatically
2204 	 */
2205 	if (!enable)
2206 		return -EOPNOTSUPP;
2207 
2208 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs, 0);
2209 	if (!skb)
2210 		return -EINVAL;
2211 
2212 	cap_offs = offsetof(struct ieee80211_mgmt, u.beacon.capab_info);
2213 	if (!skb_pull(skb, cap_offs)) {
2214 		dev_err(dev->mt76.dev, "beacon format err\n");
2215 		dev_kfree_skb(skb);
2216 		return -EINVAL;
2217 	}
2218 
2219 	if (skb->len > 512) {
2220 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
2221 		dev_kfree_skb(skb);
2222 		return -EINVAL;
2223 	}
2224 
2225 	memcpy(req.beacon_tlv.pkt, skb->data, skb->len);
2226 	req.beacon_tlv.pkt_len = cpu_to_le16(skb->len);
2227 	offs.tim_offset -= cap_offs;
2228 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(offs.tim_offset);
2229 
2230 	if (offs.cntdwn_counter_offs[0]) {
2231 		u16 csa_offs;
2232 
2233 		csa_offs = offs.cntdwn_counter_offs[0] - cap_offs - 4;
2234 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
2235 	}
2236 	dev_kfree_skb(skb);
2237 
2238 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
2239 				 &req, sizeof(req), true);
2240 }
2241 
2242 static
2243 void mt7925_mcu_bss_rlm_tlv(struct sk_buff *skb, struct mt76_phy *phy,
2244 			    struct ieee80211_bss_conf *link_conf,
2245 			    struct ieee80211_chanctx_conf *ctx)
2246 {
2247 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2248 						  &link_conf->chanreq.oper;
2249 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2250 	enum nl80211_band band = chandef->chan->band;
2251 	struct bss_rlm_tlv *req;
2252 	struct tlv *tlv;
2253 
2254 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RLM, sizeof(*req));
2255 	req = (struct bss_rlm_tlv *)tlv;
2256 	req->control_channel = chandef->chan->hw_value;
2257 	req->center_chan = ieee80211_frequency_to_channel(freq1);
2258 	req->center_chan2 = 0;
2259 	req->tx_streams = hweight8(phy->antenna_mask);
2260 	req->ht_op_info = 4; /* set HT 40M allowed */
2261 	req->rx_streams = hweight8(phy->antenna_mask);
2262 	req->center_chan2 = 0;
2263 	req->sco = 0;
2264 	req->band = 1;
2265 
2266 	switch (band) {
2267 	case NL80211_BAND_2GHZ:
2268 		req->band = 1;
2269 		break;
2270 	case NL80211_BAND_5GHZ:
2271 		req->band = 2;
2272 		break;
2273 	case NL80211_BAND_6GHZ:
2274 		req->band = 3;
2275 		break;
2276 	default:
2277 		break;
2278 	}
2279 
2280 	switch (chandef->width) {
2281 	case NL80211_CHAN_WIDTH_40:
2282 		req->bw = CMD_CBW_40MHZ;
2283 		break;
2284 	case NL80211_CHAN_WIDTH_80:
2285 		req->bw = CMD_CBW_80MHZ;
2286 		break;
2287 	case NL80211_CHAN_WIDTH_80P80:
2288 		req->bw = CMD_CBW_8080MHZ;
2289 		req->center_chan2 = ieee80211_frequency_to_channel(freq2);
2290 		break;
2291 	case NL80211_CHAN_WIDTH_160:
2292 		req->bw = CMD_CBW_160MHZ;
2293 		break;
2294 	case NL80211_CHAN_WIDTH_5:
2295 		req->bw = CMD_CBW_5MHZ;
2296 		break;
2297 	case NL80211_CHAN_WIDTH_10:
2298 		req->bw = CMD_CBW_10MHZ;
2299 		break;
2300 	case NL80211_CHAN_WIDTH_20_NOHT:
2301 	case NL80211_CHAN_WIDTH_20:
2302 	default:
2303 		req->bw = CMD_CBW_20MHZ;
2304 		req->ht_op_info = 0;
2305 		break;
2306 	}
2307 
2308 	if (req->control_channel < req->center_chan)
2309 		req->sco = 1; /* SCA */
2310 	else if (req->control_channel > req->center_chan)
2311 		req->sco = 3; /* SCB */
2312 }
2313 
2314 static struct sk_buff *
2315 __mt7925_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif_link *mvif, int len)
2316 {
2317 	struct bss_req_hdr hdr = {
2318 		.bss_idx = mvif->idx,
2319 	};
2320 	struct sk_buff *skb;
2321 
2322 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
2323 	if (!skb)
2324 		return ERR_PTR(-ENOMEM);
2325 
2326 	skb_put_data(skb, &hdr, sizeof(hdr));
2327 
2328 	return skb;
2329 }
2330 
2331 int mt7925_mcu_set_chctx(struct mt76_phy *phy, struct mt76_vif_link *mvif,
2332 			 struct ieee80211_bss_conf *link_conf,
2333 			 struct ieee80211_chanctx_conf *ctx)
2334 {
2335 	struct sk_buff *skb;
2336 
2337 	skb = __mt7925_mcu_alloc_bss_req(phy->dev, mvif,
2338 					 MT7925_BSS_UPDATE_MAX_SIZE);
2339 	if (IS_ERR(skb))
2340 		return PTR_ERR(skb);
2341 
2342 	mt7925_mcu_bss_rlm_tlv(skb, phy, link_conf, ctx);
2343 
2344 	return mt76_mcu_skb_send_msg(phy->dev, skb,
2345 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2346 }
2347 
2348 static u8
2349 mt7925_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
2350 			enum nl80211_band band,
2351 			struct ieee80211_link_sta *link_sta)
2352 {
2353 	struct ieee80211_he_6ghz_capa *he_6ghz_capa;
2354 	const struct ieee80211_sta_eht_cap *eht_cap;
2355 	__le16 capa = 0;
2356 	u8 mode = 0;
2357 
2358 	if (link_sta) {
2359 		he_6ghz_capa = &link_sta->he_6ghz_capa;
2360 		eht_cap = &link_sta->eht_cap;
2361 	} else {
2362 		struct ieee80211_supported_band *sband;
2363 
2364 		sband = phy->hw->wiphy->bands[band];
2365 		capa = ieee80211_get_he_6ghz_capa(sband, vif->type);
2366 		he_6ghz_capa = (struct ieee80211_he_6ghz_capa *)&capa;
2367 
2368 		eht_cap = ieee80211_get_eht_iftype_cap(sband, vif->type);
2369 	}
2370 
2371 	switch (band) {
2372 	case NL80211_BAND_2GHZ:
2373 		if (eht_cap && eht_cap->has_eht)
2374 			mode |= PHY_MODE_BE_24G;
2375 		break;
2376 	case NL80211_BAND_5GHZ:
2377 		if (eht_cap && eht_cap->has_eht)
2378 			mode |= PHY_MODE_BE_5G;
2379 		break;
2380 	case NL80211_BAND_6GHZ:
2381 		if (he_6ghz_capa && he_6ghz_capa->capa)
2382 			mode |= PHY_MODE_AX_6G;
2383 
2384 		if (eht_cap && eht_cap->has_eht)
2385 			mode |= PHY_MODE_BE_6G;
2386 		break;
2387 	default:
2388 		break;
2389 	}
2390 
2391 	return mode;
2392 }
2393 
2394 static void
2395 mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
2396 			 struct ieee80211_bss_conf *link_conf,
2397 			 struct ieee80211_link_sta *link_sta,
2398 			 struct ieee80211_chanctx_conf *ctx,
2399 			 struct mt76_phy *phy, u16 wlan_idx,
2400 			 bool enable)
2401 {
2402 	struct ieee80211_vif *vif = link_conf->vif;
2403 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2404 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2405 						  &link_conf->chanreq.oper;
2406 	enum nl80211_band band = chandef->chan->band;
2407 	struct mt76_connac_bss_basic_tlv *basic_req;
2408 	struct mt792x_link_sta *mlink;
2409 	struct tlv *tlv;
2410 	int conn_type;
2411 	u8 idx;
2412 
2413 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*basic_req));
2414 	basic_req = (struct mt76_connac_bss_basic_tlv *)tlv;
2415 
2416 	idx = mconf->mt76.omac_idx > EXT_BSSID_START ? HW_BSSID_0 :
2417 						      mconf->mt76.omac_idx;
2418 	basic_req->hw_bss_idx = idx;
2419 
2420 	basic_req->phymode_ext = mt7925_get_phy_mode_ext(phy, vif, band,
2421 							 link_sta);
2422 
2423 	if (band == NL80211_BAND_2GHZ)
2424 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_ERP_INDEX);
2425 	else
2426 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_OFDM_INDEX);
2427 
2428 	memcpy(basic_req->bssid, link_conf->bssid, ETH_ALEN);
2429 	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, link_sta);
2430 	basic_req->bcn_interval = cpu_to_le16(link_conf->beacon_int);
2431 	basic_req->dtim_period = link_conf->dtim_period;
2432 	basic_req->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
2433 	basic_req->link_idx = mconf->mt76.idx;
2434 
2435 	if (link_sta) {
2436 		struct mt792x_sta *msta;
2437 
2438 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
2439 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
2440 
2441 	} else {
2442 		mlink = &mconf->vif->sta.deflink;
2443 	}
2444 
2445 	basic_req->sta_idx = cpu_to_le16(mlink->wcid.idx);
2446 	basic_req->omac_idx = mconf->mt76.omac_idx;
2447 	basic_req->band_idx = mconf->mt76.band_idx;
2448 	basic_req->wmm_idx = mconf->mt76.wmm_idx;
2449 	basic_req->conn_state = !enable;
2450 
2451 	switch (vif->type) {
2452 	case NL80211_IFTYPE_MESH_POINT:
2453 	case NL80211_IFTYPE_AP:
2454 		if (vif->p2p)
2455 			conn_type = CONNECTION_P2P_GO;
2456 		else
2457 			conn_type = CONNECTION_INFRA_AP;
2458 		basic_req->conn_type = cpu_to_le32(conn_type);
2459 		basic_req->active = enable;
2460 		break;
2461 	case NL80211_IFTYPE_STATION:
2462 		if (vif->p2p)
2463 			conn_type = CONNECTION_P2P_GC;
2464 		else
2465 			conn_type = CONNECTION_INFRA_STA;
2466 		basic_req->conn_type = cpu_to_le32(conn_type);
2467 		basic_req->active = true;
2468 		break;
2469 	case NL80211_IFTYPE_ADHOC:
2470 		basic_req->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
2471 		basic_req->active = true;
2472 		break;
2473 	default:
2474 		WARN_ON(1);
2475 		break;
2476 	}
2477 }
2478 
2479 static void
2480 mt7925_mcu_bss_sec_tlv(struct sk_buff *skb,
2481 		       struct ieee80211_bss_conf *link_conf)
2482 {
2483 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2484 	struct mt76_vif_link *mvif = &mconf->mt76;
2485 	struct bss_sec_tlv {
2486 		__le16 tag;
2487 		__le16 len;
2488 		u8 mode;
2489 		u8 status;
2490 		u8 cipher;
2491 		u8 __rsv;
2492 	} __packed * sec;
2493 	struct tlv *tlv;
2494 
2495 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_SEC, sizeof(*sec));
2496 	sec = (struct bss_sec_tlv *)tlv;
2497 
2498 	switch (mvif->cipher) {
2499 	case CONNAC3_CIPHER_GCMP_256:
2500 	case CONNAC3_CIPHER_GCMP:
2501 		sec->mode = MODE_WPA3_SAE;
2502 		sec->status = 8;
2503 		break;
2504 	case CONNAC3_CIPHER_AES_CCMP:
2505 		sec->mode = MODE_WPA2_PSK;
2506 		sec->status = 6;
2507 		break;
2508 	case CONNAC3_CIPHER_TKIP:
2509 		sec->mode = MODE_WPA2_PSK;
2510 		sec->status = 4;
2511 		break;
2512 	case CONNAC3_CIPHER_WEP104:
2513 	case CONNAC3_CIPHER_WEP40:
2514 		sec->mode = MODE_SHARED;
2515 		sec->status = 0;
2516 		break;
2517 	default:
2518 		sec->mode = MODE_OPEN;
2519 		sec->status = 1;
2520 		break;
2521 	}
2522 
2523 	sec->cipher = mvif->cipher;
2524 }
2525 
2526 static void
2527 mt7925_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt792x_phy *phy,
2528 		       struct ieee80211_chanctx_conf *ctx,
2529 		       struct ieee80211_bss_conf *link_conf)
2530 {
2531 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2532 						  &link_conf->chanreq.oper;
2533 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2534 	enum nl80211_band band = chandef->chan->band;
2535 	struct mt76_vif_link *mvif = &mconf->mt76;
2536 	struct bss_rate_tlv *bmc;
2537 	struct tlv *tlv;
2538 	u8 idx = mvif->mcast_rates_idx ?
2539 		 mvif->mcast_rates_idx : mvif->basic_rates_idx;
2540 
2541 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RATE, sizeof(*bmc));
2542 
2543 	bmc = (struct bss_rate_tlv *)tlv;
2544 
2545 	if (band == NL80211_BAND_2GHZ)
2546 		bmc->basic_rate = cpu_to_le16(HR_DSSS_ERP_BASIC_RATE);
2547 	else
2548 		bmc->basic_rate = cpu_to_le16(OFDM_BASIC_RATE);
2549 
2550 	bmc->short_preamble = (band == NL80211_BAND_2GHZ);
2551 	bmc->bc_fixed_rate = idx;
2552 	bmc->mc_fixed_rate = idx;
2553 }
2554 
2555 static void
2556 mt7925_mcu_bss_mld_tlv(struct sk_buff *skb,
2557 		       struct ieee80211_bss_conf *link_conf)
2558 {
2559 	struct ieee80211_vif *vif = link_conf->vif;
2560 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2561 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2562 	struct bss_mld_tlv *mld;
2563 	struct tlv *tlv;
2564 	bool is_mld;
2565 
2566 	is_mld = ieee80211_vif_is_mld(link_conf->vif) ||
2567 		 (hweight16(mvif->valid_links) > 1);
2568 
2569 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_MLD, sizeof(*mld));
2570 	mld = (struct bss_mld_tlv *)tlv;
2571 
2572 	mld->link_id = is_mld ? link_conf->link_id : 0xff;
2573 	/* apply the index of the primary link */
2574 	mld->group_mld_id = is_mld ? mvif->bss_conf.mt76.idx : 0xff;
2575 	mld->own_mld_id = mconf->mt76.idx + 32;
2576 	mld->remap_idx = 0xff;
2577 	mld->eml_enable = !!(link_conf->vif->cfg.eml_cap &
2578 			     IEEE80211_EML_CAP_EMLSR_SUPP);
2579 
2580 	memcpy(mld->mac_addr, vif->addr, ETH_ALEN);
2581 }
2582 
2583 static void
2584 mt7925_mcu_bss_qos_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf)
2585 {
2586 	struct mt76_connac_bss_qos_tlv *qos;
2587 	struct tlv *tlv;
2588 
2589 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_QBSS, sizeof(*qos));
2590 	qos = (struct mt76_connac_bss_qos_tlv *)tlv;
2591 	qos->qos = link_conf->qos;
2592 }
2593 
2594 static void
2595 mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2596 		      struct mt792x_phy *phy)
2597 {
2598 #define DEFAULT_HE_PE_DURATION		4
2599 #define DEFAULT_HE_DURATION_RTS_THRES	1023
2600 	const struct ieee80211_sta_he_cap *cap;
2601 	struct bss_info_uni_he *he;
2602 	struct tlv *tlv;
2603 
2604 	cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
2605 
2606 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
2607 
2608 	he = (struct bss_info_uni_he *)tlv;
2609 	he->he_pe_duration = link_conf->htc_trig_based_pkt_ext;
2610 	if (!he->he_pe_duration)
2611 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
2612 
2613 	he->he_rts_thres = cpu_to_le16(link_conf->frame_time_rts_th);
2614 	if (!he->he_rts_thres)
2615 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
2616 
2617 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
2618 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
2619 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
2620 }
2621 
2622 static void
2623 mt7925_mcu_bss_color_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2624 			 bool enable)
2625 {
2626 	struct bss_info_uni_bss_color *color;
2627 	struct tlv *tlv;
2628 
2629 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BSS_COLOR, sizeof(*color));
2630 	color = (struct bss_info_uni_bss_color *)tlv;
2631 
2632 	color->enable = enable ?
2633 		link_conf->he_bss_color.enabled : 0;
2634 	color->bss_color = enable ?
2635 		link_conf->he_bss_color.color : 0;
2636 }
2637 
2638 static void
2639 mt7925_mcu_bss_ifs_tlv(struct sk_buff *skb,
2640 		       struct ieee80211_bss_conf *link_conf)
2641 {
2642 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2643 	struct mt792x_phy *phy = mvif->phy;
2644 	struct bss_ifs_time_tlv *ifs_time;
2645 	struct tlv *tlv;
2646 
2647 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_IFS_TIME, sizeof(*ifs_time));
2648 	ifs_time = (struct bss_ifs_time_tlv *)tlv;
2649 	ifs_time->slot_valid = true;
2650 	ifs_time->slot_time = cpu_to_le16(phy->slottime);
2651 }
2652 
2653 int mt7925_mcu_set_timing(struct mt792x_phy *phy,
2654 			  struct ieee80211_bss_conf *link_conf)
2655 {
2656 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2657 	struct mt792x_dev *dev = phy->dev;
2658 	struct sk_buff *skb;
2659 
2660 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2661 					 MT7925_BSS_UPDATE_MAX_SIZE);
2662 	if (IS_ERR(skb))
2663 		return PTR_ERR(skb);
2664 
2665 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2666 
2667 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2668 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2669 }
2670 
2671 int mt7925_mcu_add_bss_info(struct mt792x_phy *phy,
2672 			    struct ieee80211_chanctx_conf *ctx,
2673 			    struct ieee80211_bss_conf *link_conf,
2674 			    struct ieee80211_link_sta *link_sta,
2675 			    int enable)
2676 {
2677 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2678 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2679 	struct mt792x_dev *dev = phy->dev;
2680 	struct mt792x_link_sta *mlink_bc;
2681 	struct sk_buff *skb;
2682 
2683 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2684 					 MT7925_BSS_UPDATE_MAX_SIZE);
2685 	if (IS_ERR(skb))
2686 		return PTR_ERR(skb);
2687 
2688 	mlink_bc = mt792x_sta_to_link(&mvif->sta, mconf->link_id);
2689 
2690 	/* bss_basic must be first */
2691 	mt7925_mcu_bss_basic_tlv(skb, link_conf, link_sta, ctx, phy->mt76,
2692 				 mlink_bc->wcid.idx, enable);
2693 	mt7925_mcu_bss_sec_tlv(skb, link_conf);
2694 	mt7925_mcu_bss_bmc_tlv(skb, phy, ctx, link_conf);
2695 	mt7925_mcu_bss_qos_tlv(skb, link_conf);
2696 	mt7925_mcu_bss_mld_tlv(skb, link_conf);
2697 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2698 
2699 	if (link_conf->he_support) {
2700 		mt7925_mcu_bss_he_tlv(skb, link_conf, phy);
2701 		mt7925_mcu_bss_color_tlv(skb, link_conf, enable);
2702 	}
2703 
2704 	if (enable)
2705 		mt7925_mcu_bss_rlm_tlv(skb, phy->mt76, link_conf, ctx);
2706 
2707 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2708 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2709 }
2710 
2711 int mt7925_mcu_set_dbdc(struct mt76_phy *phy, bool enable)
2712 {
2713 	struct mt76_dev *mdev = phy->dev;
2714 
2715 	struct mbmc_conf_tlv *conf;
2716 	struct mbmc_set_req *hdr;
2717 	struct sk_buff *skb;
2718 	struct tlv *tlv;
2719 	int max_len, err;
2720 
2721 	max_len = sizeof(*hdr) + sizeof(*conf);
2722 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2723 	if (!skb)
2724 		return -ENOMEM;
2725 
2726 	hdr = (struct mbmc_set_req *)skb_put(skb, sizeof(*hdr));
2727 
2728 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_MBMC_SETTING, sizeof(*conf));
2729 	conf = (struct mbmc_conf_tlv *)tlv;
2730 
2731 	conf->mbmc_en = enable;
2732 	conf->band = 0; /* unused */
2733 
2734 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SET_DBDC_PARMS),
2735 				    false);
2736 
2737 	return err;
2738 }
2739 
2740 int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
2741 		       struct ieee80211_scan_request *scan_req)
2742 {
2743 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
2744 	struct cfg80211_scan_request *sreq = &scan_req->req;
2745 	int n_ssids = 0, err, i;
2746 	struct ieee80211_channel **scan_list = sreq->channels;
2747 	struct mt76_dev *mdev = phy->dev;
2748 	struct mt76_connac_mcu_scan_channel *chan;
2749 	struct sk_buff *skb;
2750 
2751 	struct scan_hdr_tlv *hdr;
2752 	struct scan_req_tlv *req;
2753 	struct scan_ssid_tlv *ssid;
2754 	struct scan_bssid_tlv *bssid;
2755 	struct scan_chan_info_tlv *chan_info;
2756 	struct scan_ie_tlv *ie;
2757 	struct scan_misc_tlv *misc;
2758 	struct tlv *tlv;
2759 	int max_len;
2760 
2761 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2762 				sizeof(*bssid) + sizeof(*chan_info) +
2763 				sizeof(*misc) + sizeof(*ie);
2764 
2765 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2766 	if (!skb)
2767 		return -ENOMEM;
2768 
2769 	set_bit(MT76_HW_SCANNING, &phy->state);
2770 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2771 
2772 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2773 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2774 	hdr->bss_idx = mvif->idx;
2775 
2776 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_REQ, sizeof(*req));
2777 	req = (struct scan_req_tlv *)tlv;
2778 	req->scan_type = sreq->n_ssids ? 1 : 0;
2779 	req->probe_req_num = sreq->n_ssids ? 2 : 0;
2780 
2781 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2782 	ssid = (struct scan_ssid_tlv *)tlv;
2783 	for (i = 0; i < sreq->n_ssids; i++) {
2784 		if (!sreq->ssids[i].ssid_len)
2785 			continue;
2786 
2787 		ssid->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
2788 		memcpy(ssid->ssids[i].ssid, sreq->ssids[i].ssid,
2789 		       sreq->ssids[i].ssid_len);
2790 		n_ssids++;
2791 	}
2792 	ssid->ssid_type = n_ssids ? BIT(2) : BIT(0);
2793 	ssid->ssids_num = n_ssids;
2794 
2795 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_BSSID, sizeof(*bssid));
2796 	bssid = (struct scan_bssid_tlv *)tlv;
2797 
2798 	memcpy(bssid->bssid, sreq->bssid, ETH_ALEN);
2799 
2800 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
2801 	chan_info = (struct scan_chan_info_tlv *)tlv;
2802 	chan_info->channels_num = min_t(u8, sreq->n_channels,
2803 					ARRAY_SIZE(chan_info->channels));
2804 	for (i = 0; i < chan_info->channels_num; i++) {
2805 		chan = &chan_info->channels[i];
2806 
2807 		switch (scan_list[i]->band) {
2808 		case NL80211_BAND_2GHZ:
2809 			chan->band = 1;
2810 			break;
2811 		case NL80211_BAND_6GHZ:
2812 			chan->band = 3;
2813 			break;
2814 		default:
2815 			chan->band = 2;
2816 			break;
2817 		}
2818 		chan->channel_num = scan_list[i]->hw_value;
2819 	}
2820 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
2821 
2822 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
2823 	ie = (struct scan_ie_tlv *)tlv;
2824 	if (sreq->ie_len > 0) {
2825 		memcpy(ie->ies, sreq->ie, sreq->ie_len);
2826 		ie->ies_len = cpu_to_le16(sreq->ie_len);
2827 	}
2828 
2829 	req->scan_func |= SCAN_FUNC_SPLIT_SCAN;
2830 
2831 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_MISC, sizeof(*misc));
2832 	misc = (struct scan_misc_tlv *)tlv;
2833 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
2834 		get_random_mask_addr(misc->random_mac, sreq->mac_addr,
2835 				     sreq->mac_addr_mask);
2836 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
2837 	}
2838 
2839 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2840 				    false);
2841 	if (err < 0)
2842 		clear_bit(MT76_HW_SCANNING, &phy->state);
2843 
2844 	return err;
2845 }
2846 EXPORT_SYMBOL_GPL(mt7925_mcu_hw_scan);
2847 
2848 int mt7925_mcu_sched_scan_req(struct mt76_phy *phy,
2849 			      struct ieee80211_vif *vif,
2850 			      struct cfg80211_sched_scan_request *sreq)
2851 {
2852 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
2853 	struct ieee80211_channel **scan_list = sreq->channels;
2854 	struct mt76_connac_mcu_scan_channel *chan;
2855 	struct mt76_dev *mdev = phy->dev;
2856 	struct cfg80211_match_set *cfg_match;
2857 	struct cfg80211_ssid *cfg_ssid;
2858 
2859 	struct scan_hdr_tlv *hdr;
2860 	struct scan_sched_req *req;
2861 	struct scan_ssid_tlv *ssid;
2862 	struct scan_chan_info_tlv *chan_info;
2863 	struct scan_ie_tlv *ie;
2864 	struct scan_sched_ssid_match_sets *match;
2865 	struct sk_buff *skb;
2866 	struct tlv *tlv;
2867 	int i, max_len;
2868 
2869 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2870 		  sizeof(*chan_info) + sizeof(*ie) +
2871 		  sizeof(*match);
2872 
2873 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2874 	if (!skb)
2875 		return -ENOMEM;
2876 
2877 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2878 
2879 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2880 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2881 	hdr->bss_idx = mvif->idx;
2882 
2883 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_REQ, sizeof(*req));
2884 	req = (struct scan_sched_req *)tlv;
2885 	req->version = 1;
2886 
2887 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
2888 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
2889 
2890 	req->intervals_num = sreq->n_scan_plans;
2891 	for (i = 0; i < req->intervals_num; i++)
2892 		req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
2893 
2894 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2895 	ssid = (struct scan_ssid_tlv *)tlv;
2896 
2897 	ssid->ssids_num = sreq->n_ssids;
2898 	ssid->ssid_type = BIT(2);
2899 	for (i = 0; i < ssid->ssids_num; i++) {
2900 		cfg_ssid = &sreq->ssids[i];
2901 		memcpy(ssid->ssids[i].ssid, cfg_ssid->ssid, cfg_ssid->ssid_len);
2902 		ssid->ssids[i].ssid_len = cpu_to_le32(cfg_ssid->ssid_len);
2903 	}
2904 
2905 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID_MATCH_SETS, sizeof(*match));
2906 	match = (struct scan_sched_ssid_match_sets *)tlv;
2907 	match->match_num = sreq->n_match_sets;
2908 	for (i = 0; i < match->match_num; i++) {
2909 		cfg_match = &sreq->match_sets[i];
2910 		memcpy(match->match[i].ssid, cfg_match->ssid.ssid,
2911 		       cfg_match->ssid.ssid_len);
2912 		match->match[i].rssi_th = cpu_to_le32(cfg_match->rssi_thold);
2913 		match->match[i].ssid_len = cfg_match->ssid.ssid_len;
2914 	}
2915 
2916 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
2917 	chan_info = (struct scan_chan_info_tlv *)tlv;
2918 	chan_info->channels_num = min_t(u8, sreq->n_channels,
2919 					ARRAY_SIZE(chan_info->channels));
2920 	for (i = 0; i < chan_info->channels_num; i++) {
2921 		chan = &chan_info->channels[i];
2922 
2923 		switch (scan_list[i]->band) {
2924 		case NL80211_BAND_2GHZ:
2925 			chan->band = 1;
2926 			break;
2927 		case NL80211_BAND_6GHZ:
2928 			chan->band = 3;
2929 			break;
2930 		default:
2931 			chan->band = 2;
2932 			break;
2933 		}
2934 		chan->channel_num = scan_list[i]->hw_value;
2935 	}
2936 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
2937 
2938 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
2939 	ie = (struct scan_ie_tlv *)tlv;
2940 	if (sreq->ie_len > 0) {
2941 		memcpy(ie->ies, sreq->ie, sreq->ie_len);
2942 		ie->ies_len = cpu_to_le16(sreq->ie_len);
2943 	}
2944 
2945 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2946 				     false);
2947 }
2948 EXPORT_SYMBOL_GPL(mt7925_mcu_sched_scan_req);
2949 
2950 int
2951 mt7925_mcu_sched_scan_enable(struct mt76_phy *phy,
2952 			     struct ieee80211_vif *vif,
2953 			     bool enable)
2954 {
2955 	struct mt76_dev *mdev = phy->dev;
2956 	struct scan_sched_enable *req;
2957 	struct scan_hdr_tlv *hdr;
2958 	struct sk_buff *skb;
2959 	struct tlv *tlv;
2960 	int max_len;
2961 
2962 	max_len = sizeof(*hdr) + sizeof(*req);
2963 
2964 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2965 	if (!skb)
2966 		return -ENOMEM;
2967 
2968 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2969 	hdr->seq_num = 0;
2970 	hdr->bss_idx = 0;
2971 
2972 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_ENABLE, sizeof(*req));
2973 	req = (struct scan_sched_enable *)tlv;
2974 	req->active = !enable;
2975 
2976 	if (enable)
2977 		set_bit(MT76_HW_SCHED_SCANNING, &phy->state);
2978 	else
2979 		clear_bit(MT76_HW_SCHED_SCANNING, &phy->state);
2980 
2981 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2982 				     false);
2983 }
2984 
2985 int mt7925_mcu_cancel_hw_scan(struct mt76_phy *phy,
2986 			      struct ieee80211_vif *vif)
2987 {
2988 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
2989 	struct {
2990 		struct scan_hdr {
2991 			u8 seq_num;
2992 			u8 bss_idx;
2993 			u8 pad[2];
2994 		} __packed hdr;
2995 		struct scan_cancel_tlv {
2996 			__le16 tag;
2997 			__le16 len;
2998 			u8 is_ext_channel;
2999 			u8 rsv[3];
3000 		} __packed cancel;
3001 	} req = {
3002 		.hdr = {
3003 			.seq_num = mvif->scan_seq_num,
3004 			.bss_idx = mvif->idx,
3005 		},
3006 		.cancel = {
3007 			.tag = cpu_to_le16(UNI_SCAN_CANCEL),
3008 			.len = cpu_to_le16(sizeof(struct scan_cancel_tlv)),
3009 		},
3010 	};
3011 
3012 	if (test_and_clear_bit(MT76_HW_SCANNING, &phy->state)) {
3013 		struct cfg80211_scan_info info = {
3014 			.aborted = true,
3015 		};
3016 
3017 		ieee80211_scan_completed(phy->hw, &info);
3018 	}
3019 
3020 	return mt76_mcu_send_msg(phy->dev, MCU_UNI_CMD(SCAN_REQ),
3021 				 &req, sizeof(req), false);
3022 }
3023 EXPORT_SYMBOL_GPL(mt7925_mcu_cancel_hw_scan);
3024 
3025 int mt7925_mcu_set_channel_domain(struct mt76_phy *phy)
3026 {
3027 	int len, i, n_max_channels, n_2ch = 0, n_5ch = 0, n_6ch = 0;
3028 	struct {
3029 		struct {
3030 			u8 alpha2[4]; /* regulatory_request.alpha2 */
3031 			u8 bw_2g; /* BW_20_40M		0
3032 				   * BW_20M		1
3033 				   * BW_20_40_80M	2
3034 				   * BW_20_40_80_160M	3
3035 				   * BW_20_40_80_8080M	4
3036 				   */
3037 			u8 bw_5g;
3038 			u8 bw_6g;
3039 			u8 pad;
3040 		} __packed hdr;
3041 		struct n_chan {
3042 			__le16 tag;
3043 			__le16 len;
3044 			u8 n_2ch;
3045 			u8 n_5ch;
3046 			u8 n_6ch;
3047 			u8 pad;
3048 		} __packed n_ch;
3049 	} req = {
3050 		.hdr = {
3051 			.bw_2g = 0,
3052 			.bw_5g = 3, /* BW_20_40_80_160M */
3053 			.bw_6g = 3,
3054 		},
3055 		.n_ch = {
3056 			.tag = cpu_to_le16(2),
3057 		},
3058 	};
3059 	struct mt76_connac_mcu_chan {
3060 		__le16 hw_value;
3061 		__le16 pad;
3062 		__le32 flags;
3063 	} __packed channel;
3064 	struct mt76_dev *dev = phy->dev;
3065 	struct ieee80211_channel *chan;
3066 	struct sk_buff *skb;
3067 
3068 	n_max_channels = phy->sband_2g.sband.n_channels +
3069 			 phy->sband_5g.sband.n_channels +
3070 			 phy->sband_6g.sband.n_channels;
3071 	len = sizeof(req) + n_max_channels * sizeof(channel);
3072 
3073 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
3074 	if (!skb)
3075 		return -ENOMEM;
3076 
3077 	skb_reserve(skb, sizeof(req));
3078 
3079 	for (i = 0; i < phy->sband_2g.sband.n_channels; i++) {
3080 		chan = &phy->sband_2g.sband.channels[i];
3081 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3082 			continue;
3083 
3084 		channel.hw_value = cpu_to_le16(chan->hw_value);
3085 		channel.flags = cpu_to_le32(chan->flags);
3086 		channel.pad = 0;
3087 
3088 		skb_put_data(skb, &channel, sizeof(channel));
3089 		n_2ch++;
3090 	}
3091 	for (i = 0; i < phy->sband_5g.sband.n_channels; i++) {
3092 		chan = &phy->sband_5g.sband.channels[i];
3093 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3094 			continue;
3095 
3096 		channel.hw_value = cpu_to_le16(chan->hw_value);
3097 		channel.flags = cpu_to_le32(chan->flags);
3098 		channel.pad = 0;
3099 
3100 		skb_put_data(skb, &channel, sizeof(channel));
3101 		n_5ch++;
3102 	}
3103 	for (i = 0; i < phy->sband_6g.sband.n_channels; i++) {
3104 		chan = &phy->sband_6g.sband.channels[i];
3105 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3106 			continue;
3107 
3108 		channel.hw_value = cpu_to_le16(chan->hw_value);
3109 		channel.flags = cpu_to_le32(chan->flags);
3110 		channel.pad = 0;
3111 
3112 		skb_put_data(skb, &channel, sizeof(channel));
3113 		n_6ch++;
3114 	}
3115 
3116 	BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(req.hdr.alpha2));
3117 	memcpy(req.hdr.alpha2, dev->alpha2, sizeof(dev->alpha2));
3118 	req.n_ch.n_2ch = n_2ch;
3119 	req.n_ch.n_5ch = n_5ch;
3120 	req.n_ch.n_6ch = n_6ch;
3121 	len = sizeof(struct n_chan) + (n_2ch + n_5ch + n_6ch) * sizeof(channel);
3122 	req.n_ch.len = cpu_to_le16(len);
3123 	memcpy(__skb_push(skb, sizeof(req)), &req, sizeof(req));
3124 
3125 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SET_DOMAIN_INFO),
3126 				     false);
3127 }
3128 EXPORT_SYMBOL_GPL(mt7925_mcu_set_channel_domain);
3129 
3130 static int
3131 __mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3132 		     enum environment_cap env_cap,
3133 		     struct mt7925_clc *clc, u8 idx)
3134 {
3135 	struct mt7925_clc_segment *seg;
3136 	struct sk_buff *skb;
3137 	struct {
3138 		u8 rsv[4];
3139 		__le16 tag;
3140 		__le16 len;
3141 
3142 		u8 ver;
3143 		u8 pad0;
3144 		__le16 size;
3145 		u8 idx;
3146 		u8 env;
3147 		u8 acpi_conf;
3148 		u8 pad1;
3149 		u8 alpha2[2];
3150 		u8 type[2];
3151 		u8 rsvd[64];
3152 	} __packed req = {
3153 		.tag = cpu_to_le16(0x3),
3154 		.len = cpu_to_le16(sizeof(req) - 4),
3155 
3156 		.idx = idx,
3157 		.env = env_cap,
3158 		.acpi_conf = mt792x_acpi_get_flags(&dev->phy),
3159 	};
3160 	int ret, valid_cnt = 0;
3161 	u8 i, *pos;
3162 
3163 	if (!clc)
3164 		return 0;
3165 
3166 	pos = clc->data + sizeof(*seg) * clc->nr_seg;
3167 	for (i = 0; i < clc->nr_country; i++) {
3168 		struct mt7925_clc_rule *rule = (struct mt7925_clc_rule *)pos;
3169 
3170 		pos += sizeof(*rule);
3171 		if (rule->alpha2[0] != alpha2[0] ||
3172 		    rule->alpha2[1] != alpha2[1])
3173 			continue;
3174 
3175 		seg = (struct mt7925_clc_segment *)clc->data
3176 			  + rule->seg_idx - 1;
3177 
3178 		memcpy(req.alpha2, rule->alpha2, 2);
3179 		memcpy(req.type, rule->type, 2);
3180 
3181 		req.size = cpu_to_le16(seg->len);
3182 		skb = __mt76_mcu_msg_alloc(&dev->mt76, &req,
3183 					   le16_to_cpu(req.size) + sizeof(req),
3184 					   sizeof(req), GFP_KERNEL);
3185 		if (!skb)
3186 			return -ENOMEM;
3187 		skb_put_data(skb, clc->data + seg->offset, seg->len);
3188 
3189 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3190 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3191 					    true);
3192 		if (ret < 0)
3193 			return ret;
3194 		valid_cnt++;
3195 	}
3196 
3197 	if (!valid_cnt)
3198 		return -ENOENT;
3199 
3200 	return 0;
3201 }
3202 
3203 int mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3204 		       enum environment_cap env_cap)
3205 {
3206 	struct mt792x_phy *phy = (struct mt792x_phy *)&dev->phy;
3207 	int i, ret;
3208 
3209 	/* submit all clc config */
3210 	for (i = 0; i < ARRAY_SIZE(phy->clc); i++) {
3211 		ret = __mt7925_mcu_set_clc(dev, alpha2, env_cap,
3212 					   phy->clc[i], i);
3213 
3214 		/* If no country found, set "00" as default */
3215 		if (ret == -ENOENT)
3216 			ret = __mt7925_mcu_set_clc(dev, "00",
3217 						   ENVIRON_INDOOR,
3218 						   phy->clc[i], i);
3219 		if (ret < 0)
3220 			return ret;
3221 	}
3222 	return 0;
3223 }
3224 
3225 int mt7925_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb,
3226 			    int cmd, int *wait_seq)
3227 {
3228 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
3229 	struct mt76_connac2_mcu_uni_txd *uni_txd;
3230 	struct mt76_connac2_mcu_txd *mcu_txd;
3231 	__le32 *txd;
3232 	u32 val;
3233 	u8 seq;
3234 
3235 	/* TODO: make dynamic based on msg type */
3236 	mdev->mcu.timeout = 20 * HZ;
3237 
3238 	seq = ++mdev->mcu.msg_seq & 0xf;
3239 	if (!seq)
3240 		seq = ++mdev->mcu.msg_seq & 0xf;
3241 
3242 	if (cmd == MCU_CMD(FW_SCATTER))
3243 		goto exit;
3244 
3245 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
3246 	txd = (__le32 *)skb_push(skb, txd_len);
3247 
3248 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
3249 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
3250 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
3251 	txd[0] = cpu_to_le32(val);
3252 
3253 	val = FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
3254 	txd[1] = cpu_to_le32(val);
3255 
3256 	if (cmd & __MCU_CMD_FIELD_UNI) {
3257 		uni_txd = (struct mt76_connac2_mcu_uni_txd *)txd;
3258 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
3259 		uni_txd->cid = cpu_to_le16(mcu_cmd);
3260 		uni_txd->s2d_index = MCU_S2D_H2N;
3261 		uni_txd->pkt_type = MCU_PKT_ID;
3262 		uni_txd->seq = seq;
3263 
3264 		if (cmd & __MCU_CMD_FIELD_QUERY)
3265 			uni_txd->option = MCU_CMD_UNI_QUERY_ACK;
3266 		else
3267 			uni_txd->option = MCU_CMD_UNI_EXT_ACK;
3268 
3269 		goto exit;
3270 	}
3271 
3272 	mcu_txd = (struct mt76_connac2_mcu_txd *)txd;
3273 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
3274 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
3275 					       MT_TX_MCU_PORT_RX_Q0));
3276 	mcu_txd->pkt_type = MCU_PKT_ID;
3277 	mcu_txd->seq = seq;
3278 	mcu_txd->cid = mcu_cmd;
3279 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
3280 
3281 	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
3282 		if (cmd & __MCU_CMD_FIELD_QUERY)
3283 			mcu_txd->set_query = MCU_Q_QUERY;
3284 		else
3285 			mcu_txd->set_query = MCU_Q_SET;
3286 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
3287 	} else {
3288 		mcu_txd->set_query = MCU_Q_NA;
3289 	}
3290 
3291 	if (cmd & __MCU_CMD_FIELD_WA)
3292 		mcu_txd->s2d_index = MCU_S2D_H2C;
3293 	else
3294 		mcu_txd->s2d_index = MCU_S2D_H2N;
3295 
3296 exit:
3297 	if (wait_seq)
3298 		*wait_seq = seq;
3299 
3300 	return 0;
3301 }
3302 EXPORT_SYMBOL_GPL(mt7925_mcu_fill_message);
3303 
3304 int mt7925_mcu_set_rts_thresh(struct mt792x_phy *phy, u32 val)
3305 {
3306 	struct {
3307 		u8 band_idx;
3308 		u8 _rsv[3];
3309 
3310 		__le16 tag;
3311 		__le16 len;
3312 		__le32 len_thresh;
3313 		__le32 pkt_thresh;
3314 	} __packed req = {
3315 		.band_idx = phy->mt76->band_idx,
3316 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RTS_THRESHOLD),
3317 		.len = cpu_to_le16(sizeof(req) - 4),
3318 		.len_thresh = cpu_to_le32(val),
3319 		.pkt_thresh = cpu_to_le32(0x2),
3320 	};
3321 
3322 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3323 				 &req, sizeof(req), true);
3324 }
3325 
3326 int mt7925_mcu_set_radio_en(struct mt792x_phy *phy, bool enable)
3327 {
3328 	struct {
3329 		u8 band_idx;
3330 		u8 _rsv[3];
3331 
3332 		__le16 tag;
3333 		__le16 len;
3334 		u8 enable;
3335 		u8 _rsv2[3];
3336 	} __packed req = {
3337 		.band_idx = phy->mt76->band_idx,
3338 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RADIO_ENABLE),
3339 		.len = cpu_to_le16(sizeof(req) - 4),
3340 		.enable = enable,
3341 	};
3342 
3343 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3344 				 &req, sizeof(req), true);
3345 }
3346 
3347 static void
3348 mt7925_mcu_build_sku(struct mt76_dev *dev, s8 *sku,
3349 		     struct mt76_power_limits *limits,
3350 		     enum nl80211_band band)
3351 {
3352 	int i, offset = sizeof(limits->cck);
3353 
3354 	memset(sku, 127, MT_CONNAC3_SKU_POWER_LIMIT);
3355 
3356 	if (band == NL80211_BAND_2GHZ) {
3357 		/* cck */
3358 		memcpy(sku, limits->cck, sizeof(limits->cck));
3359 	}
3360 
3361 	/* ofdm */
3362 	memcpy(&sku[offset], limits->ofdm, sizeof(limits->ofdm));
3363 	offset += (sizeof(limits->ofdm) * 5);
3364 
3365 	/* ht */
3366 	for (i = 0; i < 2; i++) {
3367 		memcpy(&sku[offset], limits->mcs[i], 8);
3368 		offset += 8;
3369 	}
3370 	sku[offset++] = limits->mcs[0][0];
3371 
3372 	/* vht */
3373 	for (i = 0; i < ARRAY_SIZE(limits->mcs); i++) {
3374 		memcpy(&sku[offset], limits->mcs[i],
3375 		       ARRAY_SIZE(limits->mcs[i]));
3376 		offset += 12;
3377 	}
3378 
3379 	/* he */
3380 	for (i = 0; i < ARRAY_SIZE(limits->ru); i++) {
3381 		memcpy(&sku[offset], limits->ru[i], ARRAY_SIZE(limits->ru[i]));
3382 		offset += ARRAY_SIZE(limits->ru[i]);
3383 	}
3384 
3385 	/* eht */
3386 	for (i = 0; i < ARRAY_SIZE(limits->eht); i++) {
3387 		memcpy(&sku[offset], limits->eht[i], ARRAY_SIZE(limits->eht[i]));
3388 		offset += ARRAY_SIZE(limits->eht[i]);
3389 	}
3390 }
3391 
3392 static int
3393 mt7925_mcu_rate_txpower_band(struct mt76_phy *phy,
3394 			     enum nl80211_band band)
3395 {
3396 	int tx_power, n_chan, last_ch, err = 0, idx = 0;
3397 	int i, sku_len, batch_size, batch_len = 3;
3398 	struct mt76_dev *dev = phy->dev;
3399 	static const u8 chan_list_2ghz[] = {
3400 		1, 2,  3,  4,  5,  6,  7,
3401 		8, 9, 10, 11, 12, 13, 14
3402 	};
3403 	static const u8 chan_list_5ghz[] = {
3404 		 36,  38,  40,  42,  44,  46,  48,
3405 		 50,  52,  54,  56,  58,  60,  62,
3406 		 64, 100, 102, 104, 106, 108, 110,
3407 		112, 114, 116, 118, 120, 122, 124,
3408 		126, 128, 132, 134, 136, 138, 140,
3409 		142, 144, 149, 151, 153, 155, 157,
3410 		159, 161, 165, 167
3411 	};
3412 	static const u8 chan_list_6ghz[] = {
3413 		  1,   3,   5,   7,   9,  11,  13,
3414 		 15,  17,  19,  21,  23,  25,  27,
3415 		 29,  33,  35,  37,  39,  41,  43,
3416 		 45,  47,  49,  51,  53,  55,  57,
3417 		 59,  61,  65,  67,  69,  71,  73,
3418 		 75,  77,  79,  81,  83,  85,  87,
3419 		 89,  91,  93,  97,  99, 101, 103,
3420 		105, 107, 109, 111, 113, 115, 117,
3421 		119, 121, 123, 125, 129, 131, 133,
3422 		135, 137, 139, 141, 143, 145, 147,
3423 		149, 151, 153, 155, 157, 161, 163,
3424 		165, 167, 169, 171, 173, 175, 177,
3425 		179, 181, 183, 185, 187, 189, 193,
3426 		195, 197, 199, 201, 203, 205, 207,
3427 		209, 211, 213, 215, 217, 219, 221,
3428 		225, 227, 229, 233
3429 	};
3430 	struct mt76_power_limits *limits;
3431 	struct mt7925_sku_tlv *sku_tlbv;
3432 	const u8 *ch_list;
3433 
3434 	sku_len = sizeof(*sku_tlbv);
3435 	tx_power = 2 * phy->hw->conf.power_level;
3436 	if (!tx_power)
3437 		tx_power = 127;
3438 
3439 	if (band == NL80211_BAND_2GHZ) {
3440 		n_chan = ARRAY_SIZE(chan_list_2ghz);
3441 		ch_list = chan_list_2ghz;
3442 		last_ch = chan_list_2ghz[ARRAY_SIZE(chan_list_2ghz) - 1];
3443 	} else if (band == NL80211_BAND_6GHZ) {
3444 		n_chan = ARRAY_SIZE(chan_list_6ghz);
3445 		ch_list = chan_list_6ghz;
3446 		last_ch = chan_list_6ghz[ARRAY_SIZE(chan_list_6ghz) - 1];
3447 	} else {
3448 		n_chan = ARRAY_SIZE(chan_list_5ghz);
3449 		ch_list = chan_list_5ghz;
3450 		last_ch = chan_list_5ghz[ARRAY_SIZE(chan_list_5ghz) - 1];
3451 	}
3452 	batch_size = DIV_ROUND_UP(n_chan, batch_len);
3453 
3454 	limits = devm_kmalloc(dev->dev, sizeof(*limits), GFP_KERNEL);
3455 	if (!limits)
3456 		return -ENOMEM;
3457 
3458 	sku_tlbv = devm_kmalloc(dev->dev, sku_len, GFP_KERNEL);
3459 	if (!sku_tlbv) {
3460 		devm_kfree(dev->dev, limits);
3461 		return -ENOMEM;
3462 	}
3463 
3464 	for (i = 0; i < batch_size; i++) {
3465 		struct mt7925_tx_power_limit_tlv *tx_power_tlv;
3466 		int j, msg_len, num_ch;
3467 		struct sk_buff *skb;
3468 
3469 		num_ch = i == batch_size - 1 ? n_chan % batch_len : batch_len;
3470 		msg_len = sizeof(*tx_power_tlv) + num_ch * sku_len;
3471 		skb = mt76_mcu_msg_alloc(dev, NULL, msg_len);
3472 		if (!skb) {
3473 			err = -ENOMEM;
3474 			goto out;
3475 		}
3476 
3477 		tx_power_tlv = (struct mt7925_tx_power_limit_tlv *)
3478 			       skb_put(skb, sizeof(*tx_power_tlv));
3479 
3480 		BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(tx_power_tlv->alpha2));
3481 		memcpy(tx_power_tlv->alpha2, dev->alpha2, sizeof(dev->alpha2));
3482 		tx_power_tlv->n_chan = num_ch;
3483 		tx_power_tlv->tag = cpu_to_le16(0x1);
3484 		tx_power_tlv->len = cpu_to_le16(sizeof(*tx_power_tlv));
3485 
3486 		switch (band) {
3487 		case NL80211_BAND_2GHZ:
3488 			tx_power_tlv->band = 1;
3489 			break;
3490 		case NL80211_BAND_6GHZ:
3491 			tx_power_tlv->band = 3;
3492 			break;
3493 		default:
3494 			tx_power_tlv->band = 2;
3495 			break;
3496 		}
3497 
3498 		for (j = 0; j < num_ch; j++, idx++) {
3499 			struct ieee80211_channel chan = {
3500 				.hw_value = ch_list[idx],
3501 				.band = band,
3502 			};
3503 			s8 reg_power, sar_power;
3504 
3505 			reg_power = mt76_connac_get_ch_power(phy, &chan,
3506 							     tx_power);
3507 			sar_power = mt76_get_sar_power(phy, &chan, reg_power);
3508 
3509 			mt76_get_rate_power_limits(phy, &chan, limits,
3510 						   sar_power);
3511 
3512 			tx_power_tlv->last_msg = ch_list[idx] == last_ch;
3513 			sku_tlbv->channel = ch_list[idx];
3514 
3515 			mt7925_mcu_build_sku(dev, sku_tlbv->pwr_limit,
3516 					     limits, band);
3517 			skb_put_data(skb, sku_tlbv, sku_len);
3518 		}
3519 		err = mt76_mcu_skb_send_msg(dev, skb,
3520 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3521 					    true);
3522 		if (err < 0)
3523 			goto out;
3524 	}
3525 
3526 out:
3527 	devm_kfree(dev->dev, sku_tlbv);
3528 	devm_kfree(dev->dev, limits);
3529 	return err;
3530 }
3531 
3532 int mt7925_mcu_set_rate_txpower(struct mt76_phy *phy)
3533 {
3534 	int err;
3535 
3536 	if (phy->cap.has_2ghz) {
3537 		err = mt7925_mcu_rate_txpower_band(phy,
3538 						   NL80211_BAND_2GHZ);
3539 		if (err < 0)
3540 			return err;
3541 	}
3542 
3543 	if (phy->cap.has_5ghz) {
3544 		err = mt7925_mcu_rate_txpower_band(phy,
3545 						   NL80211_BAND_5GHZ);
3546 		if (err < 0)
3547 			return err;
3548 	}
3549 
3550 	if (phy->cap.has_6ghz) {
3551 		err = mt7925_mcu_rate_txpower_band(phy,
3552 						   NL80211_BAND_6GHZ);
3553 		if (err < 0)
3554 			return err;
3555 	}
3556 
3557 	return 0;
3558 }
3559 
3560 int mt7925_mcu_set_rxfilter(struct mt792x_dev *dev, u32 fif,
3561 			    u8 bit_op, u32 bit_map)
3562 {
3563 	struct mt792x_phy *phy = &dev->phy;
3564 	struct {
3565 		u8 band_idx;
3566 		u8 rsv1[3];
3567 
3568 		__le16 tag;
3569 		__le16 len;
3570 		u8 mode;
3571 		u8 rsv2[3];
3572 		__le32 fif;
3573 		__le32 bit_map; /* bit_* for bitmap update */
3574 		u8 bit_op;
3575 		u8 pad[51];
3576 	} __packed req = {
3577 		.band_idx = phy->mt76->band_idx,
3578 		.tag = cpu_to_le16(UNI_BAND_CONFIG_SET_MAC80211_RX_FILTER),
3579 		.len = cpu_to_le16(sizeof(req) - 4),
3580 
3581 		.mode = fif ? 0 : 1,
3582 		.fif = cpu_to_le32(fif),
3583 		.bit_map = cpu_to_le32(bit_map),
3584 		.bit_op = bit_op,
3585 	};
3586 
3587 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3588 				 &req, sizeof(req), true);
3589 }
3590