xref: /linux/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c (revision 96fcecd9ba81a66b2b061cdcc10da1cc1b2a9b90)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2023 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include <linux/firmware.h>
6 #include "mt7925.h"
7 #include "mcu.h"
8 #include "mac.h"
9 
10 #define MT_STA_BFER			BIT(0)
11 #define MT_STA_BFEE			BIT(1)
12 
13 static bool mt7925_disable_clc;
14 module_param_named(disable_clc, mt7925_disable_clc, bool, 0644);
15 MODULE_PARM_DESC(disable_clc, "disable CLC support");
16 
17 int mt7925_mcu_parse_response(struct mt76_dev *mdev, int cmd,
18 			      struct sk_buff *skb, int seq)
19 {
20 	int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
21 	struct mt7925_mcu_rxd *rxd;
22 	int ret = 0;
23 
24 	if (!skb) {
25 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n", cmd, seq);
26 		mt792x_reset(mdev);
27 
28 		return -ETIMEDOUT;
29 	}
30 
31 	rxd = (struct mt7925_mcu_rxd *)skb->data;
32 	if (seq != rxd->seq)
33 		return -EAGAIN;
34 
35 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL) ||
36 	    cmd == MCU_CMD(PATCH_FINISH_REQ)) {
37 		skb_pull(skb, sizeof(*rxd) - 4);
38 		ret = *skb->data;
39 	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
40 		   cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
41 		   cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
42 		   cmd == MCU_UNI_CMD(HIF_CTRL) ||
43 		   cmd == MCU_UNI_CMD(OFFLOAD) ||
44 		   cmd == MCU_UNI_CMD(SUSPEND)) {
45 		struct mt7925_mcu_uni_event *event;
46 
47 		skb_pull(skb, sizeof(*rxd));
48 		event = (struct mt7925_mcu_uni_event *)skb->data;
49 		ret = le32_to_cpu(event->status);
50 		/* skip invalid event */
51 		if (mcu_cmd != event->cid)
52 			ret = -EAGAIN;
53 	} else {
54 		skb_pull(skb, sizeof(*rxd));
55 	}
56 
57 	return ret;
58 }
59 EXPORT_SYMBOL_GPL(mt7925_mcu_parse_response);
60 
61 int mt7925_mcu_regval(struct mt792x_dev *dev, u32 regidx, u32 *val, bool set)
62 {
63 #define MT_RF_REG_HDR           GENMASK(31, 24)
64 #define MT_RF_REG_ANT           GENMASK(23, 16)
65 #define RF_REG_PREFIX           0x99
66 	struct {
67 		u8 __rsv[4];
68 		union {
69 			struct uni_cmd_access_reg_basic {
70 				__le16 tag;
71 				__le16 len;
72 				__le32 idx;
73 				__le32 data;
74 			} __packed reg;
75 			struct uni_cmd_access_rf_reg_basic {
76 				__le16 tag;
77 				__le16 len;
78 				__le16 ant;
79 				u8 __rsv[2];
80 				__le32 idx;
81 				__le32 data;
82 			} __packed rf_reg;
83 		};
84 	} __packed * res, req;
85 	struct sk_buff *skb;
86 	int ret;
87 
88 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX) {
89 		req.rf_reg.tag = cpu_to_le16(UNI_CMD_ACCESS_RF_REG_BASIC);
90 		req.rf_reg.len = cpu_to_le16(sizeof(req.rf_reg));
91 		req.rf_reg.ant = cpu_to_le16(u32_get_bits(regidx, MT_RF_REG_ANT));
92 		req.rf_reg.idx = cpu_to_le32(regidx);
93 		req.rf_reg.data = set ? cpu_to_le32(*val) : 0;
94 	} else {
95 		req.reg.tag = cpu_to_le16(UNI_CMD_ACCESS_REG_BASIC);
96 		req.reg.len = cpu_to_le16(sizeof(req.reg));
97 		req.reg.idx = cpu_to_le32(regidx);
98 		req.reg.data = set ? cpu_to_le32(*val) : 0;
99 	}
100 
101 	if (set)
102 		return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(REG_ACCESS),
103 					 &req, sizeof(req), true);
104 
105 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
106 					MCU_WM_UNI_CMD_QUERY(REG_ACCESS),
107 					&req, sizeof(req), true, &skb);
108 	if (ret)
109 		return ret;
110 
111 	res = (void *)skb->data;
112 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX)
113 		*val = le32_to_cpu(res->rf_reg.data);
114 	else
115 		*val = le32_to_cpu(res->reg.data);
116 
117 	dev_kfree_skb(skb);
118 
119 	return 0;
120 }
121 EXPORT_SYMBOL_GPL(mt7925_mcu_regval);
122 
123 int mt7925_mcu_update_arp_filter(struct mt76_dev *dev,
124 				 struct ieee80211_bss_conf *link_conf)
125 {
126 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
127 	struct ieee80211_vif *mvif = link_conf->vif;
128 	struct sk_buff *skb;
129 	int i, len = min_t(int, mvif->cfg.arp_addr_cnt,
130 			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
131 	struct {
132 		struct {
133 			u8 bss_idx;
134 			u8 pad[3];
135 		} __packed hdr;
136 		struct mt7925_arpns_tlv arp;
137 	} req = {
138 		.hdr = {
139 			.bss_idx = mconf->mt76.idx,
140 		},
141 		.arp = {
142 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
143 			.len = cpu_to_le16(sizeof(req) - 4 + len * 2 * sizeof(__be32)),
144 			.ips_num = len,
145 			.enable = true,
146 		},
147 	};
148 
149 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(req) + len * 2 * sizeof(__be32));
150 	if (!skb)
151 		return -ENOMEM;
152 
153 	skb_put_data(skb, &req, sizeof(req));
154 	for (i = 0; i < len; i++) {
155 		skb_put_data(skb, &mvif->cfg.arp_addr_list[i], sizeof(__be32));
156 		skb_put_zero(skb, sizeof(__be32));
157 	}
158 
159 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
160 }
161 
162 #ifdef CONFIG_PM
163 static int
164 mt7925_connac_mcu_set_wow_ctrl(struct mt76_phy *phy, struct ieee80211_vif *vif,
165 			       bool suspend, struct cfg80211_wowlan *wowlan)
166 {
167 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
168 	struct mt76_dev *dev = phy->dev;
169 	struct {
170 		struct {
171 			u8 bss_idx;
172 			u8 pad[3];
173 		} __packed hdr;
174 		struct mt76_connac_wow_ctrl_tlv wow_ctrl_tlv;
175 		struct mt76_connac_wow_gpio_param_tlv gpio_tlv;
176 	} req = {
177 		.hdr = {
178 			.bss_idx = mvif->idx,
179 		},
180 		.wow_ctrl_tlv = {
181 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
182 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_ctrl_tlv)),
183 			.cmd = suspend ? 1 : 2,
184 		},
185 		.gpio_tlv = {
186 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_GPIO_PARAM),
187 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_gpio_param_tlv)),
188 			.gpio_pin = 0xff, /* follow fw about GPIO pin */
189 		},
190 	};
191 
192 	if (wowlan->magic_pkt)
193 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_MAGIC;
194 	if (wowlan->disconnect)
195 		req.wow_ctrl_tlv.trigger |= (UNI_WOW_DETECT_TYPE_DISCONNECT |
196 					     UNI_WOW_DETECT_TYPE_BCN_LOST);
197 	if (wowlan->nd_config) {
198 		mt7925_mcu_sched_scan_req(phy, vif, wowlan->nd_config);
199 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_SCH_SCAN_HIT;
200 		mt7925_mcu_sched_scan_enable(phy, vif, suspend);
201 	}
202 	if (wowlan->n_patterns)
203 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_BITMAP;
204 
205 	if (mt76_is_mmio(dev))
206 		req.wow_ctrl_tlv.wakeup_hif = WOW_PCIE;
207 	else if (mt76_is_usb(dev))
208 		req.wow_ctrl_tlv.wakeup_hif = WOW_USB;
209 	else if (mt76_is_sdio(dev))
210 		req.wow_ctrl_tlv.wakeup_hif = WOW_GPIO;
211 
212 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(SUSPEND), &req,
213 				 sizeof(req), true);
214 }
215 
216 static int
217 mt7925_mcu_set_wow_pattern(struct mt76_dev *dev,
218 			   struct ieee80211_vif *vif,
219 			   u8 index, bool enable,
220 			   struct cfg80211_pkt_pattern *pattern)
221 {
222 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
223 	struct mt7925_wow_pattern_tlv *tlv;
224 	struct sk_buff *skb;
225 	struct {
226 		u8 bss_idx;
227 		u8 pad[3];
228 	} __packed hdr = {
229 		.bss_idx = mvif->idx,
230 	};
231 
232 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(hdr) + sizeof(*tlv));
233 	if (!skb)
234 		return -ENOMEM;
235 
236 	skb_put_data(skb, &hdr, sizeof(hdr));
237 	tlv = (struct mt7925_wow_pattern_tlv *)skb_put(skb, sizeof(*tlv));
238 	tlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
239 	tlv->len = cpu_to_le16(sizeof(*tlv));
240 	tlv->bss_idx = 0xF;
241 	tlv->data_len = pattern->pattern_len;
242 	tlv->enable = enable;
243 	tlv->index = index;
244 	tlv->offset = 0;
245 
246 	memcpy(tlv->pattern, pattern->pattern, pattern->pattern_len);
247 	memcpy(tlv->mask, pattern->mask, DIV_ROUND_UP(pattern->pattern_len, 8));
248 
249 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SUSPEND), true);
250 }
251 
252 void mt7925_mcu_set_suspend_iter(void *priv, u8 *mac,
253 				 struct ieee80211_vif *vif)
254 {
255 	struct mt76_phy *phy = priv;
256 	bool suspend = !test_bit(MT76_STATE_RUNNING, &phy->state);
257 	struct ieee80211_hw *hw = phy->hw;
258 	struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
259 	int i;
260 
261 	mt76_connac_mcu_set_gtk_rekey(phy->dev, vif, suspend);
262 
263 	mt76_connac_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
264 
265 	for (i = 0; i < wowlan->n_patterns; i++)
266 		mt7925_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
267 					   &wowlan->patterns[i]);
268 	mt7925_connac_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
269 }
270 
271 #endif /* CONFIG_PM */
272 
273 static void
274 mt7925_mcu_connection_loss_iter(void *priv, u8 *mac,
275 				struct ieee80211_vif *vif)
276 {
277 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
278 	struct mt7925_uni_beacon_loss_event *event = priv;
279 
280 	if (mvif->idx != event->hdr.bss_idx)
281 		return;
282 
283 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER) ||
284 	    vif->type != NL80211_IFTYPE_STATION)
285 		return;
286 
287 	ieee80211_connection_loss(vif);
288 }
289 
290 static void
291 mt7925_mcu_connection_loss_event(struct mt792x_dev *dev, struct sk_buff *skb)
292 {
293 	struct mt7925_uni_beacon_loss_event *event;
294 	struct mt76_phy *mphy = &dev->mt76.phy;
295 
296 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd));
297 	event = (struct mt7925_uni_beacon_loss_event *)skb->data;
298 
299 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
300 					IEEE80211_IFACE_ITER_RESUME_ALL,
301 					mt7925_mcu_connection_loss_iter, event);
302 }
303 
304 static void
305 mt7925_mcu_roc_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
306 {
307 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
308 	struct mt7925_roc_grant_tlv *grant = priv;
309 
310 	if (ieee80211_vif_is_mld(vif) && vif->type == NL80211_IFTYPE_STATION)
311 		return;
312 
313 	if (mvif->idx != grant->bss_idx)
314 		return;
315 
316 	mvif->band_idx = grant->dbdcband;
317 }
318 
319 static void mt7925_mcu_roc_handle_grant(struct mt792x_dev *dev,
320 					struct tlv *tlv)
321 {
322 	struct ieee80211_hw *hw = dev->mt76.hw;
323 	struct mt7925_roc_grant_tlv *grant;
324 	int duration;
325 
326 	grant = (struct mt7925_roc_grant_tlv *)tlv;
327 
328 	/* should never happen */
329 	WARN_ON_ONCE((le16_to_cpu(grant->tag) != UNI_EVENT_ROC_GRANT));
330 
331 	if (grant->reqtype == MT7925_ROC_REQ_ROC)
332 		ieee80211_ready_on_channel(hw);
333 	else if (grant->reqtype == MT7925_ROC_REQ_JOIN)
334 		ieee80211_iterate_active_interfaces_atomic(hw,
335 						IEEE80211_IFACE_ITER_RESUME_ALL,
336 						mt7925_mcu_roc_iter, grant);
337 	dev->phy.roc_grant = true;
338 	wake_up(&dev->phy.roc_wait);
339 	duration = le32_to_cpu(grant->max_interval);
340 	mod_timer(&dev->phy.roc_timer,
341 		  jiffies + msecs_to_jiffies(duration));
342 }
343 
344 static void
345 mt7925_mcu_uni_roc_event(struct mt792x_dev *dev, struct sk_buff *skb)
346 {
347 	struct tlv *tlv;
348 	int i = 0;
349 
350 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
351 
352 	while (i < skb->len) {
353 		tlv = (struct tlv *)(skb->data + i);
354 
355 		switch (le16_to_cpu(tlv->tag)) {
356 		case UNI_EVENT_ROC_GRANT:
357 			mt7925_mcu_roc_handle_grant(dev, tlv);
358 			break;
359 		case UNI_EVENT_ROC_GRANT_SUB_LINK:
360 			break;
361 		}
362 
363 		i += le16_to_cpu(tlv->len);
364 	}
365 }
366 
367 static void
368 mt7925_mcu_scan_event(struct mt792x_dev *dev, struct sk_buff *skb)
369 {
370 	struct mt76_phy *mphy = &dev->mt76.phy;
371 	struct mt792x_phy *phy = mphy->priv;
372 
373 	spin_lock_bh(&dev->mt76.lock);
374 	__skb_queue_tail(&phy->scan_event_list, skb);
375 	spin_unlock_bh(&dev->mt76.lock);
376 
377 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
378 				     MT792x_HW_SCAN_TIMEOUT);
379 }
380 
381 static void
382 mt7925_mcu_tx_done_event(struct mt792x_dev *dev, struct sk_buff *skb)
383 {
384 #define UNI_EVENT_TX_DONE_MSG 0
385 #define UNI_EVENT_TX_DONE_RAW 1
386 	struct mt7925_mcu_txs_event {
387 		u8 ver;
388 		u8 rsv[3];
389 		u8 data[];
390 	} __packed * txs;
391 	struct tlv *tlv;
392 	u32 tlv_len;
393 
394 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
395 	tlv = (struct tlv *)skb->data;
396 	tlv_len = skb->len;
397 
398 	while (tlv_len > 0 && le16_to_cpu(tlv->len) <= tlv_len) {
399 		switch (le16_to_cpu(tlv->tag)) {
400 		case UNI_EVENT_TX_DONE_RAW:
401 			txs = (struct mt7925_mcu_txs_event *)tlv->data;
402 			mt7925_mac_add_txs(dev, txs->data);
403 			break;
404 		default:
405 			break;
406 		}
407 		tlv_len -= le16_to_cpu(tlv->len);
408 		tlv = (struct tlv *)((char *)(tlv) + le16_to_cpu(tlv->len));
409 	}
410 }
411 
412 static void
413 mt7925_mcu_uni_debug_msg_event(struct mt792x_dev *dev, struct sk_buff *skb)
414 {
415 	struct mt7925_uni_debug_msg {
416 		__le16 tag;
417 		__le16 len;
418 		u8 fmt;
419 		u8 rsv[3];
420 		u8 id;
421 		u8 type:3;
422 		u8 nr_args:5;
423 		union {
424 			struct idxlog {
425 				__le16 rsv;
426 				__le32 ts;
427 				__le32 idx;
428 				u8 data[];
429 			} __packed idx;
430 			struct txtlog {
431 				u8 len;
432 				u8 rsv;
433 				__le32 ts;
434 				u8 data[];
435 			} __packed txt;
436 		};
437 	} __packed * hdr;
438 
439 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
440 	hdr = (struct mt7925_uni_debug_msg *)skb->data;
441 
442 	if (hdr->id == 0x28) {
443 		skb_pull(skb, offsetof(struct mt7925_uni_debug_msg, id));
444 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", skb->len, skb->data);
445 		return;
446 	} else if (hdr->id != 0xa8) {
447 		return;
448 	}
449 
450 	if (hdr->type == 0) { /* idx log */
451 		int i, ret, len = PAGE_SIZE - 1, nr_val;
452 		struct page *page = dev_alloc_pages(get_order(len));
453 		__le32 *val;
454 		char *buf, *cur;
455 
456 		if (!page)
457 			return;
458 
459 		buf = page_address(page);
460 		cur = buf;
461 
462 		nr_val = (le16_to_cpu(hdr->len) - sizeof(*hdr)) / 4;
463 		val = (__le32 *)hdr->idx.data;
464 		for (i = 0; i < nr_val && len > 0; i++) {
465 			ret = snprintf(cur, len, "0x%x,", le32_to_cpu(val[i]));
466 			if (ret <= 0)
467 				break;
468 
469 			cur += ret;
470 			len -= ret;
471 		}
472 		if (cur > buf)
473 			wiphy_info(mt76_hw(dev)->wiphy, "idx: 0x%X,%d,%s",
474 				   le32_to_cpu(hdr->idx.idx), nr_val, buf);
475 		put_page(page);
476 	} else if (hdr->type == 2) { /* str log */
477 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", hdr->txt.len, hdr->txt.data);
478 	}
479 }
480 
481 static void
482 mt7925_mcu_uni_rx_unsolicited_event(struct mt792x_dev *dev,
483 				    struct sk_buff *skb)
484 {
485 	struct mt7925_mcu_rxd *rxd;
486 
487 	rxd = (struct mt7925_mcu_rxd *)skb->data;
488 
489 	switch (rxd->eid) {
490 	case MCU_UNI_EVENT_FW_LOG_2_HOST:
491 		mt7925_mcu_uni_debug_msg_event(dev, skb);
492 		break;
493 	case MCU_UNI_EVENT_ROC:
494 		mt7925_mcu_uni_roc_event(dev, skb);
495 		break;
496 	case MCU_UNI_EVENT_SCAN_DONE:
497 		mt7925_mcu_scan_event(dev, skb);
498 		return;
499 	case MCU_UNI_EVENT_TX_DONE:
500 		mt7925_mcu_tx_done_event(dev, skb);
501 		break;
502 	case MCU_UNI_EVENT_BSS_BEACON_LOSS:
503 		mt7925_mcu_connection_loss_event(dev, skb);
504 		break;
505 	case MCU_UNI_EVENT_COREDUMP:
506 		dev->fw_assert = true;
507 		mt76_connac_mcu_coredump_event(&dev->mt76, skb, &dev->coredump);
508 		return;
509 	default:
510 		break;
511 	}
512 	dev_kfree_skb(skb);
513 }
514 
515 void mt7925_mcu_rx_event(struct mt792x_dev *dev, struct sk_buff *skb)
516 {
517 	struct mt7925_mcu_rxd *rxd = (struct mt7925_mcu_rxd *)skb->data;
518 
519 	if (skb_linearize(skb))
520 		return;
521 
522 	if (rxd->option & MCU_UNI_CMD_UNSOLICITED_EVENT) {
523 		mt7925_mcu_uni_rx_unsolicited_event(dev, skb);
524 		return;
525 	}
526 
527 	mt76_mcu_rx_event(&dev->mt76, skb);
528 }
529 
530 static int
531 mt7925_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif_link *mvif,
532 		  struct mt76_wcid *wcid,
533 		  struct ieee80211_ampdu_params *params,
534 		  bool enable, bool tx)
535 {
536 	struct sta_rec_ba_uni *ba;
537 	struct sk_buff *skb;
538 	struct tlv *tlv;
539 	int len;
540 
541 	len = sizeof(struct sta_req_hdr) + sizeof(*ba);
542 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid,
543 					      len);
544 	if (IS_ERR(skb))
545 		return PTR_ERR(skb);
546 
547 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
548 
549 	ba = (struct sta_rec_ba_uni *)tlv;
550 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
551 	ba->winsize = cpu_to_le16(params->buf_size);
552 	ba->ssn = cpu_to_le16(params->ssn);
553 	ba->ba_en = enable << params->tid;
554 	ba->amsdu = params->amsdu;
555 	ba->tid = params->tid;
556 
557 	return mt76_mcu_skb_send_msg(dev, skb,
558 				     MCU_UNI_CMD(STA_REC_UPDATE), true);
559 }
560 
561 /** starec & wtbl **/
562 int mt7925_mcu_uni_tx_ba(struct mt792x_dev *dev,
563 			 struct ieee80211_vif *vif,
564 			 struct ieee80211_ampdu_params *params,
565 			 bool enable)
566 {
567 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
568 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
569 	struct mt792x_link_sta *mlink;
570 	struct mt792x_bss_conf *mconf;
571 	unsigned long usable_links = ieee80211_vif_usable_links(vif);
572 	struct mt76_wcid *wcid;
573 	u8 link_id, ret;
574 
575 	for_each_set_bit(link_id, &usable_links, IEEE80211_MLD_MAX_NUM_LINKS) {
576 		mconf = mt792x_vif_to_link(mvif, link_id);
577 		mlink = mt792x_sta_to_link(msta, link_id);
578 		wcid = &mlink->wcid;
579 
580 		if (enable && !params->amsdu)
581 			mlink->wcid.amsdu = false;
582 
583 		ret = mt7925_mcu_sta_ba(&dev->mt76, &mconf->mt76, wcid, params,
584 					enable, true);
585 		if (ret < 0)
586 			break;
587 	}
588 
589 	return ret;
590 }
591 
592 int mt7925_mcu_uni_rx_ba(struct mt792x_dev *dev,
593 			 struct ieee80211_vif *vif,
594 			 struct ieee80211_ampdu_params *params,
595 			 bool enable)
596 {
597 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
598 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
599 	struct mt792x_link_sta *mlink;
600 	struct mt792x_bss_conf *mconf;
601 	unsigned long usable_links = ieee80211_vif_usable_links(vif);
602 	struct mt76_wcid *wcid;
603 	u8 link_id, ret;
604 
605 	for_each_set_bit(link_id, &usable_links, IEEE80211_MLD_MAX_NUM_LINKS) {
606 		mconf = mt792x_vif_to_link(mvif, link_id);
607 		mlink = mt792x_sta_to_link(msta, link_id);
608 		wcid = &mlink->wcid;
609 
610 		ret = mt7925_mcu_sta_ba(&dev->mt76, &mconf->mt76, wcid, params,
611 					enable, false);
612 		if (ret < 0)
613 			break;
614 	}
615 
616 	return ret;
617 }
618 
619 static int mt7925_load_clc(struct mt792x_dev *dev, const char *fw_name)
620 {
621 	const struct mt76_connac2_fw_trailer *hdr;
622 	const struct mt76_connac2_fw_region *region;
623 	const struct mt7925_clc *clc;
624 	struct mt76_dev *mdev = &dev->mt76;
625 	struct mt792x_phy *phy = &dev->phy;
626 	const struct firmware *fw;
627 	int ret, i, len, offset = 0;
628 	u8 *clc_base = NULL;
629 
630 	if (mt7925_disable_clc ||
631 	    mt76_is_usb(&dev->mt76))
632 		return 0;
633 
634 	ret = request_firmware(&fw, fw_name, mdev->dev);
635 	if (ret)
636 		return ret;
637 
638 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
639 		dev_err(mdev->dev, "Invalid firmware\n");
640 		ret = -EINVAL;
641 		goto out;
642 	}
643 
644 	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
645 	for (i = 0; i < hdr->n_region; i++) {
646 		region = (const void *)((const u8 *)hdr -
647 					(hdr->n_region - i) * sizeof(*region));
648 		len = le32_to_cpu(region->len);
649 
650 		/* check if we have valid buffer size */
651 		if (offset + len > fw->size) {
652 			dev_err(mdev->dev, "Invalid firmware region\n");
653 			ret = -EINVAL;
654 			goto out;
655 		}
656 
657 		if ((region->feature_set & FW_FEATURE_NON_DL) &&
658 		    region->type == FW_TYPE_CLC) {
659 			clc_base = (u8 *)(fw->data + offset);
660 			break;
661 		}
662 		offset += len;
663 	}
664 
665 	if (!clc_base)
666 		goto out;
667 
668 	for (offset = 0; offset < len; offset += le32_to_cpu(clc->len)) {
669 		clc = (const struct mt7925_clc *)(clc_base + offset);
670 
671 		if (clc->idx >= ARRAY_SIZE(phy->clc))
672 			break;
673 
674 		/* do not init buf again if chip reset triggered */
675 		if (phy->clc[clc->idx])
676 			continue;
677 
678 		phy->clc[clc->idx] = devm_kmemdup(mdev->dev, clc,
679 						  le32_to_cpu(clc->len),
680 						  GFP_KERNEL);
681 
682 		if (!phy->clc[clc->idx]) {
683 			ret = -ENOMEM;
684 			goto out;
685 		}
686 	}
687 
688 	ret = mt7925_mcu_set_clc(dev, "00", ENVIRON_INDOOR);
689 out:
690 	release_firmware(fw);
691 
692 	return ret;
693 }
694 
695 int mt7925_mcu_fw_log_2_host(struct mt792x_dev *dev, u8 ctrl)
696 {
697 	struct {
698 		u8 _rsv[4];
699 
700 		__le16 tag;
701 		__le16 len;
702 		u8 ctrl;
703 		u8 interval;
704 		u8 _rsv2[2];
705 	} __packed req = {
706 		.tag = cpu_to_le16(UNI_WSYS_CONFIG_FW_LOG_CTRL),
707 		.len = cpu_to_le16(sizeof(req) - 4),
708 		.ctrl = ctrl,
709 	};
710 	int ret;
711 
712 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(WSYS_CONFIG),
713 					&req, sizeof(req), false, NULL);
714 	return ret;
715 }
716 
717 int mt7925_mcu_get_temperature(struct mt792x_phy *phy)
718 {
719 	struct {
720 		u8 _rsv[4];
721 
722 		__le16 tag;
723 		__le16 len;
724 		u8 _rsv2[4];
725 	} __packed req = {
726 		.tag = cpu_to_le16(0x0),
727 		.len = cpu_to_le16(sizeof(req) - 4),
728 	};
729 	struct mt7925_thermal_evt {
730 		u8 rsv[4];
731 		__le32 temperature;
732 	} __packed * evt;
733 	struct mt792x_dev *dev = phy->dev;
734 	int temperature, ret;
735 	struct sk_buff *skb;
736 
737 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
738 					MCU_WM_UNI_CMD_QUERY(THERMAL),
739 					&req, sizeof(req), true, &skb);
740 	if (ret)
741 		return ret;
742 
743 	skb_pull(skb, 4 + sizeof(struct tlv));
744 	evt = (struct mt7925_thermal_evt *)skb->data;
745 
746 	temperature = le32_to_cpu(evt->temperature);
747 
748 	dev_kfree_skb(skb);
749 
750 	return temperature;
751 }
752 
753 static void
754 mt7925_mcu_parse_phy_cap(struct mt792x_dev *dev, char *data)
755 {
756 	struct mt76_phy *mphy = &dev->mt76.phy;
757 	struct mt76_dev *mdev = mphy->dev;
758 	struct mt7925_mcu_phy_cap {
759 		u8 ht;
760 		u8 vht;
761 		u8 _5g;
762 		u8 max_bw;
763 		u8 nss;
764 		u8 dbdc;
765 		u8 tx_ldpc;
766 		u8 rx_ldpc;
767 		u8 tx_stbc;
768 		u8 rx_stbc;
769 		u8 hw_path;
770 		u8 he;
771 		u8 eht;
772 	} __packed * cap;
773 	enum {
774 		WF0_24G,
775 		WF0_5G
776 	};
777 
778 	cap = (struct mt7925_mcu_phy_cap *)data;
779 
780 	mdev->phy.antenna_mask = BIT(cap->nss) - 1;
781 	mdev->phy.chainmask = mdev->phy.antenna_mask;
782 	mdev->phy.cap.has_2ghz = cap->hw_path & BIT(WF0_24G);
783 	mdev->phy.cap.has_5ghz = cap->hw_path & BIT(WF0_5G);
784 	dev->has_eht = cap->eht;
785 }
786 
787 static void
788 mt7925_mcu_parse_eml_cap(struct mt792x_dev *dev, char *data)
789 {
790 	struct mt7925_mcu_eml_cap {
791 		u8 rsv[4];
792 		__le16 eml_cap;
793 		u8 rsv2[6];
794 	} __packed * cap;
795 
796 	cap = (struct mt7925_mcu_eml_cap *)data;
797 
798 	dev->phy.eml_cap = le16_to_cpu(cap->eml_cap);
799 }
800 
801 static int
802 mt7925_mcu_get_nic_capability(struct mt792x_dev *dev)
803 {
804 	struct mt76_phy *mphy = &dev->mt76.phy;
805 	struct {
806 		u8 _rsv[4];
807 
808 		__le16 tag;
809 		__le16 len;
810 	} __packed req = {
811 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_NIC_CAPA),
812 		.len = cpu_to_le16(sizeof(req) - 4),
813 	};
814 	struct mt76_connac_cap_hdr {
815 		__le16 n_element;
816 		u8 rsv[2];
817 	} __packed * hdr;
818 	struct sk_buff *skb;
819 	int ret, i;
820 
821 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
822 					&req, sizeof(req), true, &skb);
823 	if (ret)
824 		return ret;
825 
826 	hdr = (struct mt76_connac_cap_hdr *)skb->data;
827 	if (skb->len < sizeof(*hdr)) {
828 		ret = -EINVAL;
829 		goto out;
830 	}
831 
832 	skb_pull(skb, sizeof(*hdr));
833 
834 	for (i = 0; i < le16_to_cpu(hdr->n_element); i++) {
835 		struct tlv *tlv = (struct tlv *)skb->data;
836 		int len;
837 
838 		if (skb->len < sizeof(*tlv))
839 			break;
840 
841 		len = le16_to_cpu(tlv->len);
842 		if (skb->len < len)
843 			break;
844 
845 		switch (le16_to_cpu(tlv->tag)) {
846 		case MT_NIC_CAP_6G:
847 			mphy->cap.has_6ghz = !!tlv->data[0];
848 			break;
849 		case MT_NIC_CAP_MAC_ADDR:
850 			memcpy(mphy->macaddr, (void *)tlv->data, ETH_ALEN);
851 			break;
852 		case MT_NIC_CAP_PHY:
853 			mt7925_mcu_parse_phy_cap(dev, tlv->data);
854 			break;
855 		case MT_NIC_CAP_CHIP_CAP:
856 			dev->phy.chip_cap = le64_to_cpu(*(__le64 *)tlv->data);
857 			break;
858 		case MT_NIC_CAP_EML_CAP:
859 			mt7925_mcu_parse_eml_cap(dev, tlv->data);
860 			break;
861 		default:
862 			break;
863 		}
864 		skb_pull(skb, len);
865 	}
866 out:
867 	dev_kfree_skb(skb);
868 	return ret;
869 }
870 
871 int mt7925_mcu_chip_config(struct mt792x_dev *dev, const char *cmd)
872 {
873 	u16 len = strlen(cmd) + 1;
874 	struct {
875 		u8 _rsv[4];
876 		__le16 tag;
877 		__le16 len;
878 		struct mt76_connac_config config;
879 	} __packed req = {
880 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_CHIP_CFG),
881 		.len = cpu_to_le16(sizeof(req) - 4),
882 		.config = {
883 			.resp_type = 0,
884 			.type = 0,
885 			.data_size = cpu_to_le16(len),
886 		},
887 	};
888 
889 	memcpy(req.config.data, cmd, len);
890 
891 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
892 				 &req, sizeof(req), false);
893 }
894 
895 int mt7925_mcu_set_deep_sleep(struct mt792x_dev *dev, bool enable)
896 {
897 	char cmd[16];
898 
899 	snprintf(cmd, sizeof(cmd), "KeepFullPwr %d", !enable);
900 
901 	return mt7925_mcu_chip_config(dev, cmd);
902 }
903 EXPORT_SYMBOL_GPL(mt7925_mcu_set_deep_sleep);
904 
905 int mt7925_run_firmware(struct mt792x_dev *dev)
906 {
907 	int err;
908 
909 	err = mt792x_load_firmware(dev);
910 	if (err)
911 		return err;
912 
913 	err = mt7925_mcu_get_nic_capability(dev);
914 	if (err)
915 		return err;
916 
917 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
918 	err = mt7925_load_clc(dev, mt792x_ram_name(dev));
919 	if (err)
920 		return err;
921 
922 	return mt7925_mcu_fw_log_2_host(dev, 1);
923 }
924 EXPORT_SYMBOL_GPL(mt7925_run_firmware);
925 
926 static void
927 mt7925_mcu_sta_hdr_trans_tlv(struct sk_buff *skb,
928 			     struct ieee80211_vif *vif,
929 			     struct ieee80211_link_sta *link_sta)
930 {
931 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
932 	struct sta_rec_hdr_trans *hdr_trans;
933 	struct mt76_wcid *wcid;
934 	struct tlv *tlv;
935 
936 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HDR_TRANS, sizeof(*hdr_trans));
937 	hdr_trans = (struct sta_rec_hdr_trans *)tlv;
938 	hdr_trans->dis_rx_hdr_tran = true;
939 
940 	if (vif->type == NL80211_IFTYPE_STATION)
941 		hdr_trans->to_ds = true;
942 	else
943 		hdr_trans->from_ds = true;
944 
945 	if (link_sta) {
946 		struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
947 		struct mt792x_link_sta *mlink;
948 
949 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
950 		wcid = &mlink->wcid;
951 	} else {
952 		wcid = &mvif->sta.deflink.wcid;
953 	}
954 
955 	if (!wcid)
956 		return;
957 
958 	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
959 	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
960 		hdr_trans->to_ds = true;
961 		hdr_trans->from_ds = true;
962 	}
963 }
964 
965 int mt7925_mcu_wtbl_update_hdr_trans(struct mt792x_dev *dev,
966 				     struct ieee80211_vif *vif,
967 				     struct ieee80211_sta *sta,
968 				     int link_id)
969 {
970 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
971 	struct ieee80211_link_sta *link_sta = sta ? &sta->deflink : NULL;
972 	struct mt792x_link_sta *mlink;
973 	struct mt792x_bss_conf *mconf;
974 	struct mt792x_sta *msta;
975 	struct sk_buff *skb;
976 
977 	msta = sta ? (struct mt792x_sta *)sta->drv_priv : &mvif->sta;
978 
979 	mlink = mt792x_sta_to_link(msta, link_id);
980 	link_sta = mt792x_sta_to_link_sta(vif, sta, link_id);
981 	mconf = mt792x_vif_to_link(mvif, link_id);
982 
983 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
984 					      &mlink->wcid,
985 					      MT7925_STA_UPDATE_MAX_SIZE);
986 	if (IS_ERR(skb))
987 		return PTR_ERR(skb);
988 
989 	/* starec hdr trans */
990 	mt7925_mcu_sta_hdr_trans_tlv(skb, vif, link_sta);
991 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
992 				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
993 }
994 
995 int mt7925_mcu_set_tx(struct mt792x_dev *dev,
996 		      struct ieee80211_bss_conf *bss_conf)
997 {
998 #define MCU_EDCA_AC_PARAM	0
999 #define WMM_AIFS_SET		BIT(0)
1000 #define WMM_CW_MIN_SET		BIT(1)
1001 #define WMM_CW_MAX_SET		BIT(2)
1002 #define WMM_TXOP_SET		BIT(3)
1003 #define WMM_PARAM_SET		(WMM_AIFS_SET | WMM_CW_MIN_SET | \
1004 				 WMM_CW_MAX_SET | WMM_TXOP_SET)
1005 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(bss_conf);
1006 	struct {
1007 		u8 bss_idx;
1008 		u8 __rsv[3];
1009 	} __packed hdr = {
1010 		.bss_idx = mconf->mt76.idx,
1011 	};
1012 	struct sk_buff *skb;
1013 	int len = sizeof(hdr) + IEEE80211_NUM_ACS * sizeof(struct edca);
1014 	int ac;
1015 
1016 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
1017 	if (!skb)
1018 		return -ENOMEM;
1019 
1020 	skb_put_data(skb, &hdr, sizeof(hdr));
1021 
1022 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1023 		struct ieee80211_tx_queue_params *q = &mconf->queue_params[ac];
1024 		struct edca *e;
1025 		struct tlv *tlv;
1026 
1027 		tlv = mt76_connac_mcu_add_tlv(skb, MCU_EDCA_AC_PARAM, sizeof(*e));
1028 
1029 		e = (struct edca *)tlv;
1030 		e->set = WMM_PARAM_SET;
1031 		e->queue = ac;
1032 		e->aifs = q->aifs;
1033 		e->txop = cpu_to_le16(q->txop);
1034 
1035 		if (q->cw_min)
1036 			e->cw_min = fls(q->cw_min);
1037 		else
1038 			e->cw_min = 5;
1039 
1040 		if (q->cw_max)
1041 			e->cw_max = fls(q->cw_max);
1042 		else
1043 			e->cw_max = 10;
1044 	}
1045 
1046 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1047 				     MCU_UNI_CMD(EDCA_UPDATE), true);
1048 }
1049 
1050 static int
1051 mt7925_mcu_sta_key_tlv(struct mt76_wcid *wcid,
1052 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1053 		       struct sk_buff *skb,
1054 		       struct ieee80211_key_conf *key,
1055 		       enum set_key_cmd cmd,
1056 		       struct mt792x_sta *msta)
1057 {
1058 	struct mt792x_vif *mvif = msta->vif;
1059 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1060 	struct sta_rec_sec_uni *sec;
1061 	struct ieee80211_sta *sta;
1062 	struct ieee80211_vif *vif;
1063 	struct tlv *tlv;
1064 
1065 	sta = msta == &mvif->sta ?
1066 		      NULL :
1067 		      container_of((void *)msta, struct ieee80211_sta, drv_priv);
1068 	vif = container_of((void *)mvif, struct ieee80211_vif, drv_priv);
1069 
1070 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V3, sizeof(*sec));
1071 	sec = (struct sta_rec_sec_uni *)tlv;
1072 	sec->bss_idx = mconf->mt76.idx;
1073 	sec->is_authenticator = 0;
1074 	sec->mgmt_prot = 1; /* only used in MLO mode */
1075 	sec->wlan_idx = (u8)wcid->idx;
1076 
1077 	if (sta) {
1078 		struct ieee80211_link_sta *link_sta;
1079 
1080 		sec->tx_key = 1;
1081 		sec->key_type = 1;
1082 		link_sta = mt792x_sta_to_link_sta(vif, sta, wcid->link_id);
1083 
1084 		if (link_sta)
1085 			memcpy(sec->peer_addr, link_sta->addr, ETH_ALEN);
1086 	} else {
1087 		struct ieee80211_bss_conf *link_conf;
1088 
1089 		link_conf = mt792x_vif_to_bss_conf(vif, wcid->link_id);
1090 
1091 		if (link_conf)
1092 			memcpy(sec->peer_addr, link_conf->bssid, ETH_ALEN);
1093 	}
1094 
1095 	if (cmd == SET_KEY) {
1096 		u8 cipher;
1097 
1098 		sec->add = 1;
1099 		cipher = mt7925_mcu_get_cipher(key->cipher);
1100 		if (cipher == CONNAC3_CIPHER_NONE)
1101 			return -EOPNOTSUPP;
1102 
1103 		if (cipher == CONNAC3_CIPHER_BIP_CMAC_128) {
1104 			sec->cipher_id = CONNAC3_CIPHER_BIP_CMAC_128;
1105 			sec->key_id = sta_key_conf->keyidx;
1106 			sec->key_len = 32;
1107 			memcpy(sec->key, sta_key_conf->key, 16);
1108 			memcpy(sec->key + 16, key->key, 16);
1109 		} else {
1110 			sec->cipher_id = cipher;
1111 			sec->key_id = key->keyidx;
1112 			sec->key_len = key->keylen;
1113 			memcpy(sec->key, key->key, key->keylen);
1114 
1115 			if (cipher == CONNAC3_CIPHER_TKIP) {
1116 				/* Rx/Tx MIC keys are swapped */
1117 				memcpy(sec->key + 16, key->key + 24, 8);
1118 				memcpy(sec->key + 24, key->key + 16, 8);
1119 			}
1120 
1121 			/* store key_conf for BIP batch update */
1122 			if (cipher == CONNAC3_CIPHER_AES_CCMP) {
1123 				memcpy(sta_key_conf->key, key->key, key->keylen);
1124 				sta_key_conf->keyidx = key->keyidx;
1125 			}
1126 		}
1127 	} else {
1128 		sec->add = 0;
1129 	}
1130 
1131 	return 0;
1132 }
1133 
1134 int mt7925_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
1135 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1136 		       struct ieee80211_key_conf *key, int mcu_cmd,
1137 		       struct mt76_wcid *wcid, enum set_key_cmd cmd,
1138 		       struct mt792x_sta *msta)
1139 {
1140 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1141 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1142 	struct sk_buff *skb;
1143 	int ret;
1144 
1145 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, wcid,
1146 					      MT7925_STA_UPDATE_MAX_SIZE);
1147 	if (IS_ERR(skb))
1148 		return PTR_ERR(skb);
1149 
1150 	ret = mt7925_mcu_sta_key_tlv(wcid, sta_key_conf, skb, key, cmd, msta);
1151 	if (ret)
1152 		return ret;
1153 
1154 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
1155 }
1156 
1157 int mt7925_mcu_set_mlo_roc(struct mt792x_bss_conf *mconf, u16 sel_links,
1158 			   int duration, u8 token_id)
1159 {
1160 	struct mt792x_vif *mvif = mconf->vif;
1161 	struct ieee80211_vif *vif = container_of((void *)mvif,
1162 						 struct ieee80211_vif, drv_priv);
1163 	struct ieee80211_bss_conf *link_conf;
1164 	struct ieee80211_channel *chan;
1165 	const u8 ch_band[] = {
1166 		[NL80211_BAND_2GHZ] = 1,
1167 		[NL80211_BAND_5GHZ] = 2,
1168 		[NL80211_BAND_6GHZ] = 3,
1169 	};
1170 	enum mt7925_roc_req type;
1171 	int center_ch, i = 0;
1172 	bool is_AG_band = false;
1173 	struct {
1174 		u8 id;
1175 		u8 bss_idx;
1176 		u16 tag;
1177 		struct mt792x_bss_conf *mconf;
1178 		struct ieee80211_channel *chan;
1179 	} links[2];
1180 
1181 	struct {
1182 		struct {
1183 			u8 rsv[4];
1184 		} __packed hdr;
1185 		struct roc_acquire_tlv roc[2];
1186 	} __packed req = {
1187 			.roc[0].tag = cpu_to_le16(UNI_ROC_NUM),
1188 			.roc[0].len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1189 			.roc[1].tag = cpu_to_le16(UNI_ROC_NUM),
1190 			.roc[1].len = cpu_to_le16(sizeof(struct roc_acquire_tlv))
1191 	};
1192 
1193 	if (!mconf || hweight16(vif->valid_links) < 2 ||
1194 	    hweight16(sel_links) != 2)
1195 		return -EPERM;
1196 
1197 	for (i = 0; i < ARRAY_SIZE(links); i++) {
1198 		links[i].id = i ? __ffs(~BIT(mconf->link_id) & sel_links) :
1199 				 mconf->link_id;
1200 		link_conf = mt792x_vif_to_bss_conf(vif, links[i].id);
1201 		if (WARN_ON_ONCE(!link_conf))
1202 			return -EPERM;
1203 
1204 		links[i].chan = link_conf->chanreq.oper.chan;
1205 		if (WARN_ON_ONCE(!links[i].chan))
1206 			return -EPERM;
1207 
1208 		links[i].mconf = mt792x_vif_to_link(mvif, links[i].id);
1209 		links[i].tag = links[i].id == mconf->link_id ?
1210 			       UNI_ROC_ACQUIRE : UNI_ROC_SUB_LINK;
1211 
1212 		is_AG_band |= links[i].chan->band == NL80211_BAND_2GHZ;
1213 	}
1214 
1215 	if (vif->cfg.eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP)
1216 		type = is_AG_band ? MT7925_ROC_REQ_MLSR_AG :
1217 				    MT7925_ROC_REQ_MLSR_AA;
1218 	else
1219 		type = MT7925_ROC_REQ_JOIN;
1220 
1221 	for (i = 0; i < ARRAY_SIZE(links) && i < hweight16(vif->active_links); i++) {
1222 		if (WARN_ON_ONCE(!links[i].mconf || !links[i].chan))
1223 			continue;
1224 
1225 		chan = links[i].chan;
1226 		center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1227 		req.roc[i].len = cpu_to_le16(sizeof(struct roc_acquire_tlv));
1228 		req.roc[i].tag = cpu_to_le16(links[i].tag);
1229 		req.roc[i].tokenid = token_id;
1230 		req.roc[i].reqtype = type;
1231 		req.roc[i].maxinterval = cpu_to_le32(duration);
1232 		req.roc[i].bss_idx = links[i].mconf->mt76.idx;
1233 		req.roc[i].control_channel = chan->hw_value;
1234 		req.roc[i].bw = CMD_CBW_20MHZ;
1235 		req.roc[i].bw_from_ap = CMD_CBW_20MHZ;
1236 		req.roc[i].center_chan = center_ch;
1237 		req.roc[i].center_chan_from_ap = center_ch;
1238 		req.roc[i].center_chan2 = 0;
1239 		req.roc[i].center_chan2_from_ap = 0;
1240 
1241 		/* STR : 0xfe indicates BAND_ALL with enabling DBDC
1242 		 * EMLSR : 0xff indicates (BAND_AUTO) without DBDC
1243 		 */
1244 		req.roc[i].dbdcband = type == MT7925_ROC_REQ_JOIN ? 0xfe : 0xff;
1245 
1246 		if (chan->hw_value < center_ch)
1247 			req.roc[i].sco = 1; /* SCA */
1248 		else if (chan->hw_value > center_ch)
1249 			req.roc[i].sco = 3; /* SCB */
1250 
1251 		req.roc[i].band = ch_band[chan->band];
1252 	}
1253 
1254 	return mt76_mcu_send_msg(&mvif->phy->dev->mt76, MCU_UNI_CMD(ROC),
1255 				 &req, sizeof(req), true);
1256 }
1257 
1258 int mt7925_mcu_set_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1259 		       struct ieee80211_channel *chan, int duration,
1260 		       enum mt7925_roc_req type, u8 token_id)
1261 {
1262 	int center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1263 	struct mt792x_dev *dev = phy->dev;
1264 	struct {
1265 		struct {
1266 			u8 rsv[4];
1267 		} __packed hdr;
1268 		struct roc_acquire_tlv roc;
1269 	} __packed req = {
1270 		.roc = {
1271 			.tag = cpu_to_le16(UNI_ROC_ACQUIRE),
1272 			.len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1273 			.tokenid = token_id,
1274 			.reqtype = type,
1275 			.maxinterval = cpu_to_le32(duration),
1276 			.bss_idx = mconf->mt76.idx,
1277 			.control_channel = chan->hw_value,
1278 			.bw = CMD_CBW_20MHZ,
1279 			.bw_from_ap = CMD_CBW_20MHZ,
1280 			.center_chan = center_ch,
1281 			.center_chan_from_ap = center_ch,
1282 			.dbdcband = 0xff, /* auto */
1283 		},
1284 	};
1285 
1286 	if (chan->hw_value < center_ch)
1287 		req.roc.sco = 1; /* SCA */
1288 	else if (chan->hw_value > center_ch)
1289 		req.roc.sco = 3; /* SCB */
1290 
1291 	switch (chan->band) {
1292 	case NL80211_BAND_6GHZ:
1293 		req.roc.band = 3;
1294 		break;
1295 	case NL80211_BAND_5GHZ:
1296 		req.roc.band = 2;
1297 		break;
1298 	default:
1299 		req.roc.band = 1;
1300 		break;
1301 	}
1302 
1303 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1304 				 &req, sizeof(req), true);
1305 }
1306 
1307 int mt7925_mcu_abort_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1308 			 u8 token_id)
1309 {
1310 	struct mt792x_dev *dev = phy->dev;
1311 	struct {
1312 		struct {
1313 			u8 rsv[4];
1314 		} __packed hdr;
1315 		struct roc_abort_tlv {
1316 			__le16 tag;
1317 			__le16 len;
1318 			u8 bss_idx;
1319 			u8 tokenid;
1320 			u8 dbdcband;
1321 			u8 rsv[5];
1322 		} __packed abort;
1323 	} __packed req = {
1324 		.abort = {
1325 			.tag = cpu_to_le16(UNI_ROC_ABORT),
1326 			.len = cpu_to_le16(sizeof(struct roc_abort_tlv)),
1327 			.tokenid = token_id,
1328 			.bss_idx = mconf->mt76.idx,
1329 			.dbdcband = 0xff, /* auto*/
1330 		},
1331 	};
1332 
1333 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1334 				 &req, sizeof(req), true);
1335 }
1336 
1337 int mt7925_mcu_set_eeprom(struct mt792x_dev *dev)
1338 {
1339 	struct {
1340 		u8 _rsv[4];
1341 
1342 		__le16 tag;
1343 		__le16 len;
1344 		u8 buffer_mode;
1345 		u8 format;
1346 		__le16 buf_len;
1347 	} __packed req = {
1348 		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
1349 		.len = cpu_to_le16(sizeof(req) - 4),
1350 		.buffer_mode = EE_MODE_EFUSE,
1351 		.format = EE_FORMAT_WHOLE
1352 	};
1353 
1354 	return mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(EFUSE_CTRL),
1355 					 &req, sizeof(req), false, NULL);
1356 }
1357 EXPORT_SYMBOL_GPL(mt7925_mcu_set_eeprom);
1358 
1359 int mt7925_mcu_uni_bss_ps(struct mt792x_dev *dev,
1360 			  struct ieee80211_bss_conf *link_conf)
1361 {
1362 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1363 	struct {
1364 		struct {
1365 			u8 bss_idx;
1366 			u8 pad[3];
1367 		} __packed hdr;
1368 		struct ps_tlv {
1369 			__le16 tag;
1370 			__le16 len;
1371 			u8 ps_state; /* 0: device awake
1372 				      * 1: static power save
1373 				      * 2: dynamic power saving
1374 				      * 3: enter TWT power saving
1375 				      * 4: leave TWT power saving
1376 				      */
1377 			u8 pad[3];
1378 		} __packed ps;
1379 	} __packed ps_req = {
1380 		.hdr = {
1381 			.bss_idx = mconf->mt76.idx,
1382 		},
1383 		.ps = {
1384 			.tag = cpu_to_le16(UNI_BSS_INFO_PS),
1385 			.len = cpu_to_le16(sizeof(struct ps_tlv)),
1386 			.ps_state = link_conf->vif->cfg.ps ? 2 : 0,
1387 		},
1388 	};
1389 
1390 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1391 		return -EOPNOTSUPP;
1392 
1393 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1394 				 &ps_req, sizeof(ps_req), true);
1395 }
1396 
1397 int
1398 mt7925_mcu_uni_bss_bcnft(struct mt792x_dev *dev,
1399 			 struct ieee80211_bss_conf *link_conf, bool enable)
1400 {
1401 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1402 	struct {
1403 		struct {
1404 			u8 bss_idx;
1405 			u8 pad[3];
1406 		} __packed hdr;
1407 		struct bcnft_tlv {
1408 			__le16 tag;
1409 			__le16 len;
1410 			__le16 bcn_interval;
1411 			u8 dtim_period;
1412 			u8 bmc_delivered_ac;
1413 			u8 bmc_triggered_ac;
1414 			u8 pad[3];
1415 		} __packed bcnft;
1416 	} __packed bcnft_req = {
1417 		.hdr = {
1418 			.bss_idx = mconf->mt76.idx,
1419 		},
1420 		.bcnft = {
1421 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1422 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1423 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1424 			.dtim_period = link_conf->dtim_period,
1425 		},
1426 	};
1427 
1428 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1429 		return 0;
1430 
1431 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1432 				 &bcnft_req, sizeof(bcnft_req), true);
1433 }
1434 
1435 int
1436 mt7925_mcu_set_bss_pm(struct mt792x_dev *dev,
1437 		      struct ieee80211_bss_conf *link_conf,
1438 		      bool enable)
1439 {
1440 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1441 	struct {
1442 		struct {
1443 			u8 bss_idx;
1444 			u8 pad[3];
1445 		} __packed hdr;
1446 		struct bcnft_tlv {
1447 			__le16 tag;
1448 			__le16 len;
1449 			__le16 bcn_interval;
1450 			u8 dtim_period;
1451 			u8 bmc_delivered_ac;
1452 			u8 bmc_triggered_ac;
1453 			u8 pad[3];
1454 		} __packed enable;
1455 	} req = {
1456 		.hdr = {
1457 			.bss_idx = mconf->mt76.idx,
1458 		},
1459 		.enable = {
1460 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1461 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1462 			.dtim_period = link_conf->dtim_period,
1463 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1464 		},
1465 	};
1466 	struct {
1467 		struct {
1468 			u8 bss_idx;
1469 			u8 pad[3];
1470 		} __packed hdr;
1471 		struct pm_disable {
1472 			__le16 tag;
1473 			__le16 len;
1474 		} __packed disable;
1475 	} req1 = {
1476 		.hdr = {
1477 			.bss_idx = mconf->mt76.idx,
1478 		},
1479 		.disable = {
1480 			.tag = cpu_to_le16(UNI_BSS_INFO_PM_DISABLE),
1481 			.len = cpu_to_le16(sizeof(struct pm_disable))
1482 		},
1483 	};
1484 	int err;
1485 
1486 	err = mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1487 				&req1, sizeof(req1), true);
1488 	if (err < 0 || !enable)
1489 		return err;
1490 
1491 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1492 				 &req, sizeof(req), true);
1493 }
1494 
1495 static void
1496 mt7925_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1497 {
1498 	if (!link_sta->he_cap.has_he)
1499 		return;
1500 
1501 	mt76_connac_mcu_sta_he_tlv_v2(skb, link_sta->sta);
1502 }
1503 
1504 static void
1505 mt7925_mcu_sta_he_6g_tlv(struct sk_buff *skb,
1506 			 struct ieee80211_link_sta *link_sta)
1507 {
1508 	struct sta_rec_he_6g_capa *he_6g;
1509 	struct tlv *tlv;
1510 
1511 	if (!link_sta->he_6ghz_capa.capa)
1512 		return;
1513 
1514 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G, sizeof(*he_6g));
1515 
1516 	he_6g = (struct sta_rec_he_6g_capa *)tlv;
1517 	he_6g->capa = link_sta->he_6ghz_capa.capa;
1518 }
1519 
1520 static void
1521 mt7925_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1522 {
1523 	struct ieee80211_eht_mcs_nss_supp *mcs_map;
1524 	struct ieee80211_eht_cap_elem_fixed *elem;
1525 	struct sta_rec_eht *eht;
1526 	struct tlv *tlv;
1527 
1528 	if (!link_sta->eht_cap.has_eht)
1529 		return;
1530 
1531 	mcs_map = &link_sta->eht_cap.eht_mcs_nss_supp;
1532 	elem = &link_sta->eht_cap.eht_cap_elem;
1533 
1534 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT, sizeof(*eht));
1535 
1536 	eht = (struct sta_rec_eht *)tlv;
1537 	eht->tid_bitmap = 0xff;
1538 	eht->mac_cap = cpu_to_le16(*(u16 *)elem->mac_cap_info);
1539 	eht->phy_cap = cpu_to_le64(*(u64 *)elem->phy_cap_info);
1540 	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
1541 
1542 	if (link_sta->bandwidth == IEEE80211_STA_RX_BW_20)
1543 		memcpy(eht->mcs_map_bw20, &mcs_map->only_20mhz, sizeof(eht->mcs_map_bw20));
1544 	memcpy(eht->mcs_map_bw80, &mcs_map->bw._80, sizeof(eht->mcs_map_bw80));
1545 	memcpy(eht->mcs_map_bw160, &mcs_map->bw._160, sizeof(eht->mcs_map_bw160));
1546 }
1547 
1548 static void
1549 mt7925_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1550 {
1551 	struct sta_rec_ht *ht;
1552 	struct tlv *tlv;
1553 
1554 	if (!link_sta->ht_cap.ht_supported)
1555 		return;
1556 
1557 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1558 
1559 	ht = (struct sta_rec_ht *)tlv;
1560 	ht->ht_cap = cpu_to_le16(link_sta->ht_cap.cap);
1561 }
1562 
1563 static void
1564 mt7925_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1565 {
1566 	struct sta_rec_vht *vht;
1567 	struct tlv *tlv;
1568 
1569 	/* For 6G band, this tlv is necessary to let hw work normally */
1570 	if (!link_sta->he_6ghz_capa.capa && !link_sta->vht_cap.vht_supported)
1571 		return;
1572 
1573 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1574 
1575 	vht = (struct sta_rec_vht *)tlv;
1576 	vht->vht_cap = cpu_to_le32(link_sta->vht_cap.cap);
1577 	vht->vht_rx_mcs_map = link_sta->vht_cap.vht_mcs.rx_mcs_map;
1578 	vht->vht_tx_mcs_map = link_sta->vht_cap.vht_mcs.tx_mcs_map;
1579 }
1580 
1581 static void
1582 mt7925_mcu_sta_amsdu_tlv(struct sk_buff *skb,
1583 			 struct ieee80211_vif *vif,
1584 			 struct ieee80211_link_sta *link_sta)
1585 {
1586 	struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1587 	struct mt792x_link_sta *mlink;
1588 	struct sta_rec_amsdu *amsdu;
1589 	struct tlv *tlv;
1590 
1591 	if (vif->type != NL80211_IFTYPE_STATION &&
1592 	    vif->type != NL80211_IFTYPE_AP)
1593 		return;
1594 
1595 	if (!link_sta->agg.max_amsdu_len)
1596 		return;
1597 
1598 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1599 	amsdu = (struct sta_rec_amsdu *)tlv;
1600 	amsdu->max_amsdu_num = 8;
1601 	amsdu->amsdu_en = true;
1602 
1603 	mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1604 	mlink->wcid.amsdu = true;
1605 
1606 	switch (link_sta->agg.max_amsdu_len) {
1607 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1608 		amsdu->max_mpdu_size =
1609 			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1610 		return;
1611 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
1612 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1613 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1614 		return;
1615 	default:
1616 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1617 		return;
1618 	}
1619 }
1620 
1621 static void
1622 mt7925_mcu_sta_phy_tlv(struct sk_buff *skb,
1623 		       struct ieee80211_vif *vif,
1624 		       struct ieee80211_link_sta *link_sta)
1625 {
1626 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1627 	struct ieee80211_bss_conf *link_conf;
1628 	struct cfg80211_chan_def *chandef;
1629 	struct mt792x_bss_conf *mconf;
1630 	struct sta_rec_phy *phy;
1631 	struct tlv *tlv;
1632 	u8 af = 0, mm = 0;
1633 
1634 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1635 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1636 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1637 				    &link_conf->chanreq.oper;
1638 
1639 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PHY, sizeof(*phy));
1640 	phy = (struct sta_rec_phy *)tlv;
1641 	phy->phy_type = mt76_connac_get_phy_mode_v2(mvif->phy->mt76, vif,
1642 						    chandef->chan->band,
1643 						    link_sta);
1644 	phy->basic_rate = cpu_to_le16((u16)link_conf->basic_rates);
1645 	if (link_sta->ht_cap.ht_supported) {
1646 		af = link_sta->ht_cap.ampdu_factor;
1647 		mm = link_sta->ht_cap.ampdu_density;
1648 	}
1649 
1650 	if (link_sta->vht_cap.vht_supported) {
1651 		u8 vht_af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1652 				      link_sta->vht_cap.cap);
1653 
1654 		af = max_t(u8, af, vht_af);
1655 	}
1656 
1657 	if (link_sta->he_6ghz_capa.capa) {
1658 		af = le16_get_bits(link_sta->he_6ghz_capa.capa,
1659 				   IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1660 		mm = le16_get_bits(link_sta->he_6ghz_capa.capa,
1661 				   IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
1662 	}
1663 
1664 	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR, af) |
1665 		     FIELD_PREP(IEEE80211_HT_AMPDU_PARM_DENSITY, mm);
1666 	phy->max_ampdu_len = af;
1667 }
1668 
1669 static void
1670 mt7925_mcu_sta_state_v2_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
1671 			    struct ieee80211_link_sta *link_sta,
1672 			    struct ieee80211_vif *vif,
1673 			    u8 rcpi, u8 sta_state)
1674 {
1675 	struct sta_rec_state_v2 {
1676 		__le16 tag;
1677 		__le16 len;
1678 		u8 state;
1679 		u8 rsv[3];
1680 		__le32 flags;
1681 		u8 vht_opmode;
1682 		u8 action;
1683 		u8 rsv2[2];
1684 	} __packed * state;
1685 	struct tlv *tlv;
1686 
1687 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_STATE, sizeof(*state));
1688 	state = (struct sta_rec_state_v2 *)tlv;
1689 	state->state = sta_state;
1690 
1691 	if (link_sta->vht_cap.vht_supported) {
1692 		state->vht_opmode = link_sta->bandwidth;
1693 		state->vht_opmode |= link_sta->rx_nss <<
1694 			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
1695 	}
1696 }
1697 
1698 static void
1699 mt7925_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb,
1700 			     struct ieee80211_vif *vif,
1701 			     struct ieee80211_link_sta *link_sta)
1702 {
1703 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1704 	struct ieee80211_bss_conf *link_conf;
1705 	struct cfg80211_chan_def *chandef;
1706 	struct sta_rec_ra_info *ra_info;
1707 	struct mt792x_bss_conf *mconf;
1708 	enum nl80211_band band;
1709 	struct tlv *tlv;
1710 	u16 supp_rates;
1711 
1712 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1713 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1714 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1715 				    &link_conf->chanreq.oper;
1716 	band = chandef->chan->band;
1717 
1718 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra_info));
1719 	ra_info = (struct sta_rec_ra_info *)tlv;
1720 
1721 	supp_rates = link_sta->supp_rates[band];
1722 	if (band == NL80211_BAND_2GHZ)
1723 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
1724 			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
1725 	else
1726 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates);
1727 
1728 	ra_info->legacy = cpu_to_le16(supp_rates);
1729 
1730 	if (link_sta->ht_cap.ht_supported)
1731 		memcpy(ra_info->rx_mcs_bitmask,
1732 		       link_sta->ht_cap.mcs.rx_mask,
1733 		       HT_MCS_MASK_NUM);
1734 }
1735 
1736 static void
1737 mt7925_mcu_sta_eht_mld_tlv(struct sk_buff *skb,
1738 			   struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1739 {
1740 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1741 	struct wiphy *wiphy = mvif->phy->mt76->hw->wiphy;
1742 	const struct wiphy_iftype_ext_capab *ext_capa;
1743 	struct sta_rec_eht_mld *eht_mld;
1744 	struct tlv *tlv;
1745 	u16 eml_cap;
1746 
1747 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT_MLD, sizeof(*eht_mld));
1748 	eht_mld = (struct sta_rec_eht_mld *)tlv;
1749 	eht_mld->mld_type = 0xff;
1750 
1751 	if (!ieee80211_vif_is_mld(vif))
1752 		return;
1753 
1754 	ext_capa = cfg80211_get_iftype_ext_capa(wiphy,
1755 						ieee80211_vif_type_p2p(vif));
1756 	if (!ext_capa)
1757 		return;
1758 
1759 	eml_cap = (vif->cfg.eml_cap & (IEEE80211_EML_CAP_EMLSR_SUPP |
1760 				       IEEE80211_EML_CAP_TRANSITION_TIMEOUT)) |
1761 		  (ext_capa->eml_capabilities & (IEEE80211_EML_CAP_EMLSR_PADDING_DELAY |
1762 						IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY));
1763 
1764 	if (eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP) {
1765 		eht_mld->eml_cap[0] = u16_get_bits(eml_cap, GENMASK(7, 0));
1766 		eht_mld->eml_cap[1] = u16_get_bits(eml_cap, GENMASK(15, 8));
1767 	} else {
1768 		eht_mld->str_cap[0] = BIT(1);
1769 	}
1770 }
1771 
1772 static void
1773 mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,
1774 		       struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1775 {
1776 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1777 	struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv;
1778 	unsigned long valid = mvif->valid_links;
1779 	struct mt792x_bss_conf *mconf;
1780 	struct mt792x_link_sta *mlink;
1781 	struct sta_rec_mld *mld;
1782 	struct tlv *tlv;
1783 	int i, cnt = 0;
1784 
1785 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MLD, sizeof(*mld));
1786 	mld = (struct sta_rec_mld *)tlv;
1787 	memcpy(mld->mac_addr, sta->addr, ETH_ALEN);
1788 	mld->primary_id = cpu_to_le16(msta->deflink.wcid.idx);
1789 	mld->wlan_id = cpu_to_le16(msta->deflink.wcid.idx);
1790 	mld->link_num = min_t(u8, hweight16(mvif->valid_links), 2);
1791 
1792 	for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
1793 		if (cnt == mld->link_num)
1794 			break;
1795 
1796 		mconf = mt792x_vif_to_link(mvif, i);
1797 		mlink = mt792x_sta_to_link(msta, i);
1798 		mld->link[cnt].wlan_id = cpu_to_le16(mlink->wcid.idx);
1799 		mld->link[cnt++].bss_idx = mconf->mt76.idx;
1800 
1801 		if (mlink != &msta->deflink)
1802 			mld->secondary_id = cpu_to_le16(mlink->wcid.idx);
1803 	}
1804 }
1805 
1806 static int
1807 mt7925_mcu_sta_cmd(struct mt76_phy *phy,
1808 		   struct mt76_sta_cmd_info *info)
1809 {
1810 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)info->vif->drv_priv;
1811 	struct mt76_dev *dev = phy->dev;
1812 	struct sk_buff *skb;
1813 	int conn_state;
1814 
1815 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, info->wcid,
1816 					      MT7925_STA_UPDATE_MAX_SIZE);
1817 	if (IS_ERR(skb))
1818 		return PTR_ERR(skb);
1819 
1820 	conn_state = info->enable ? CONN_STATE_PORT_SECURE :
1821 				    CONN_STATE_DISCONNECT;
1822 	if (info->link_sta)
1823 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->link_conf,
1824 					      info->link_sta,
1825 					      conn_state, info->newly);
1826 	if (info->link_sta && info->enable) {
1827 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1828 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1829 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1830 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1831 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1832 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1833 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1834 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1835 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1836 					     info->link_sta);
1837 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1838 					    info->vif, info->rcpi,
1839 					    info->state);
1840 		mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1841 	}
1842 
1843 	if (info->enable)
1844 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
1845 
1846 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1847 }
1848 
1849 static void
1850 mt7925_mcu_sta_remove_tlv(struct sk_buff *skb)
1851 {
1852 	struct sta_rec_remove *rem;
1853 	struct tlv *tlv;
1854 
1855 	tlv = mt76_connac_mcu_add_tlv(skb, 0x25, sizeof(*rem));
1856 	rem = (struct sta_rec_remove *)tlv;
1857 	rem->action = 0;
1858 }
1859 
1860 static int
1861 mt7925_mcu_mlo_sta_cmd(struct mt76_phy *phy,
1862 		       struct mt76_sta_cmd_info *info)
1863 {
1864 	struct mt792x_vif *mvif = (struct mt792x_vif *)info->vif->drv_priv;
1865 	struct mt76_dev *dev = phy->dev;
1866 	struct mt792x_bss_conf *mconf;
1867 	struct sk_buff *skb;
1868 
1869 	mconf = mt792x_vif_to_link(mvif, info->wcid->link_id);
1870 
1871 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, info->wcid,
1872 					      MT7925_STA_UPDATE_MAX_SIZE);
1873 	if (IS_ERR(skb))
1874 		return PTR_ERR(skb);
1875 
1876 	if (info->enable)
1877 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->link_conf,
1878 					      info->link_sta,
1879 					      info->enable, info->newly);
1880 
1881 	if (info->enable && info->link_sta) {
1882 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1883 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1884 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1885 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1886 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1887 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1888 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1889 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1890 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1891 					     info->link_sta);
1892 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1893 					    info->vif, info->rcpi,
1894 					    info->state);
1895 
1896 		if (info->state != MT76_STA_INFO_STATE_NONE) {
1897 			mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1898 			mt7925_mcu_sta_eht_mld_tlv(skb, info->vif, info->link_sta->sta);
1899 		}
1900 
1901 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
1902 	}
1903 
1904 	if (!info->enable) {
1905 		mt7925_mcu_sta_remove_tlv(skb);
1906 		mt76_connac_mcu_add_tlv(skb, STA_REC_MLD_OFF,
1907 					sizeof(struct tlv));
1908 	}
1909 
1910 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1911 }
1912 
1913 int mt7925_mcu_sta_update(struct mt792x_dev *dev,
1914 			  struct ieee80211_link_sta *link_sta,
1915 			  struct ieee80211_vif *vif, bool enable,
1916 			  enum mt76_sta_info_state state)
1917 {
1918 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1919 	int rssi = -ewma_rssi_read(&mvif->bss_conf.rssi);
1920 	struct mt76_sta_cmd_info info = {
1921 		.link_sta = link_sta,
1922 		.vif = vif,
1923 		.link_conf = &vif->bss_conf,
1924 		.enable = enable,
1925 		.cmd = MCU_UNI_CMD(STA_REC_UPDATE),
1926 		.state = state,
1927 		.offload_fw = true,
1928 		.rcpi = to_rcpi(rssi),
1929 	};
1930 	struct mt792x_sta *msta;
1931 	struct mt792x_link_sta *mlink;
1932 	int err;
1933 
1934 	if (link_sta) {
1935 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1936 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1937 	}
1938 	info.wcid = link_sta ? &mlink->wcid : &mvif->sta.deflink.wcid;
1939 
1940 	if (link_sta)
1941 		info.newly = state != MT76_STA_INFO_STATE_ASSOC;
1942 	else
1943 		info.newly = state == MT76_STA_INFO_STATE_ASSOC ? false : true;
1944 
1945 	if (ieee80211_vif_is_mld(vif))
1946 		err = mt7925_mcu_mlo_sta_cmd(&dev->mphy, &info);
1947 	else
1948 		err = mt7925_mcu_sta_cmd(&dev->mphy, &info);
1949 
1950 	return err;
1951 }
1952 
1953 int mt7925_mcu_set_beacon_filter(struct mt792x_dev *dev,
1954 				 struct ieee80211_vif *vif,
1955 				 bool enable)
1956 {
1957 #define MT7925_FIF_BIT_CLR		BIT(1)
1958 #define MT7925_FIF_BIT_SET		BIT(0)
1959 	int err = 0;
1960 
1961 	if (enable) {
1962 		err = mt7925_mcu_uni_bss_bcnft(dev, &vif->bss_conf, true);
1963 		if (err < 0)
1964 			return err;
1965 
1966 		return mt7925_mcu_set_rxfilter(dev, 0,
1967 					       MT7925_FIF_BIT_SET,
1968 					       MT_WF_RFCR_DROP_OTHER_BEACON);
1969 	}
1970 
1971 	err = mt7925_mcu_set_bss_pm(dev, &vif->bss_conf, false);
1972 	if (err < 0)
1973 		return err;
1974 
1975 	return mt7925_mcu_set_rxfilter(dev, 0,
1976 				       MT7925_FIF_BIT_CLR,
1977 				       MT_WF_RFCR_DROP_OTHER_BEACON);
1978 }
1979 
1980 int mt7925_get_txpwr_info(struct mt792x_dev *dev, u8 band_idx, struct mt7925_txpwr *txpwr)
1981 {
1982 #define TX_POWER_SHOW_INFO 0x7
1983 #define TXPOWER_ALL_RATE_POWER_INFO 0x2
1984 	struct mt7925_txpwr_event *event;
1985 	struct mt7925_txpwr_req req = {
1986 		.tag = cpu_to_le16(TX_POWER_SHOW_INFO),
1987 		.len = cpu_to_le16(sizeof(req) - 4),
1988 		.catg = TXPOWER_ALL_RATE_POWER_INFO,
1989 		.band_idx = band_idx,
1990 	};
1991 	struct sk_buff *skb;
1992 	int ret;
1993 
1994 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(TXPOWER),
1995 					&req, sizeof(req), true, &skb);
1996 	if (ret)
1997 		return ret;
1998 
1999 	event = (struct mt7925_txpwr_event *)skb->data;
2000 	memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
2001 
2002 	dev_kfree_skb(skb);
2003 
2004 	return 0;
2005 }
2006 
2007 int mt7925_mcu_set_sniffer(struct mt792x_dev *dev, struct ieee80211_vif *vif,
2008 			   bool enable)
2009 {
2010 	struct {
2011 		struct {
2012 			u8 band_idx;
2013 			u8 pad[3];
2014 		} __packed hdr;
2015 		struct sniffer_enable_tlv {
2016 			__le16 tag;
2017 			__le16 len;
2018 			u8 enable;
2019 			u8 pad[3];
2020 		} __packed enable;
2021 	} __packed req = {
2022 		.hdr = {
2023 			.band_idx = 0,
2024 		},
2025 		.enable = {
2026 			.tag = cpu_to_le16(UNI_SNIFFER_ENABLE),
2027 			.len = cpu_to_le16(sizeof(struct sniffer_enable_tlv)),
2028 			.enable = enable,
2029 		},
2030 	};
2031 
2032 	mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req), true);
2033 
2034 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req),
2035 				 true);
2036 }
2037 
2038 int mt7925_mcu_config_sniffer(struct mt792x_vif *vif,
2039 			      struct ieee80211_chanctx_conf *ctx)
2040 {
2041 	struct mt76_phy *mphy = vif->phy->mt76;
2042 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def : &mphy->chandef;
2043 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2044 
2045 	static const u8 ch_band[] = {
2046 		[NL80211_BAND_2GHZ] = 1,
2047 		[NL80211_BAND_5GHZ] = 2,
2048 		[NL80211_BAND_6GHZ] = 3,
2049 	};
2050 	static const u8 ch_width[] = {
2051 		[NL80211_CHAN_WIDTH_20_NOHT] = 0,
2052 		[NL80211_CHAN_WIDTH_20] = 0,
2053 		[NL80211_CHAN_WIDTH_40] = 0,
2054 		[NL80211_CHAN_WIDTH_80] = 1,
2055 		[NL80211_CHAN_WIDTH_160] = 2,
2056 		[NL80211_CHAN_WIDTH_80P80] = 3,
2057 		[NL80211_CHAN_WIDTH_5] = 4,
2058 		[NL80211_CHAN_WIDTH_10] = 5,
2059 		[NL80211_CHAN_WIDTH_320] = 6,
2060 	};
2061 
2062 	struct {
2063 		struct {
2064 			u8 band_idx;
2065 			u8 pad[3];
2066 		} __packed hdr;
2067 		struct config_tlv {
2068 			__le16 tag;
2069 			__le16 len;
2070 			u16 aid;
2071 			u8 ch_band;
2072 			u8 bw;
2073 			u8 control_ch;
2074 			u8 sco;
2075 			u8 center_ch;
2076 			u8 center_ch2;
2077 			u8 drop_err;
2078 			u8 pad[3];
2079 		} __packed tlv;
2080 	} __packed req = {
2081 		.hdr = {
2082 			.band_idx = 0,
2083 		},
2084 		.tlv = {
2085 			.tag = cpu_to_le16(UNI_SNIFFER_CONFIG),
2086 			.len = cpu_to_le16(sizeof(req.tlv)),
2087 			.control_ch = chandef->chan->hw_value,
2088 			.center_ch = ieee80211_frequency_to_channel(freq1),
2089 			.drop_err = 1,
2090 		},
2091 	};
2092 
2093 	if (chandef->chan->band < ARRAY_SIZE(ch_band))
2094 		req.tlv.ch_band = ch_band[chandef->chan->band];
2095 	if (chandef->width < ARRAY_SIZE(ch_width))
2096 		req.tlv.bw = ch_width[chandef->width];
2097 
2098 	if (freq2)
2099 		req.tlv.center_ch2 = ieee80211_frequency_to_channel(freq2);
2100 
2101 	if (req.tlv.control_ch < req.tlv.center_ch)
2102 		req.tlv.sco = 1; /* SCA */
2103 	else if (req.tlv.control_ch > req.tlv.center_ch)
2104 		req.tlv.sco = 3; /* SCB */
2105 
2106 	return mt76_mcu_send_msg(mphy->dev, MCU_UNI_CMD(SNIFFER),
2107 				 &req, sizeof(req), true);
2108 }
2109 
2110 int
2111 mt7925_mcu_uni_add_beacon_offload(struct mt792x_dev *dev,
2112 				  struct ieee80211_hw *hw,
2113 				  struct ieee80211_vif *vif,
2114 				  bool enable)
2115 {
2116 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
2117 	struct ieee80211_mutable_offsets offs;
2118 	struct {
2119 		struct req_hdr {
2120 			u8 bss_idx;
2121 			u8 pad[3];
2122 		} __packed hdr;
2123 		struct bcn_content_tlv {
2124 			__le16 tag;
2125 			__le16 len;
2126 			__le16 tim_ie_pos;
2127 			__le16 csa_ie_pos;
2128 			__le16 bcc_ie_pos;
2129 			/* 0: disable beacon offload
2130 			 * 1: enable beacon offload
2131 			 * 2: update probe respond offload
2132 			 */
2133 			u8 enable;
2134 			/* 0: legacy format (TXD + payload)
2135 			 * 1: only cap field IE
2136 			 */
2137 			u8 type;
2138 			__le16 pkt_len;
2139 			u8 pkt[512];
2140 		} __packed beacon_tlv;
2141 	} req = {
2142 		.hdr = {
2143 			.bss_idx = mvif->bss_conf.mt76.idx,
2144 		},
2145 		.beacon_tlv = {
2146 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
2147 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
2148 			.enable = enable,
2149 			.type = 1,
2150 		},
2151 	};
2152 	struct sk_buff *skb;
2153 	u8 cap_offs;
2154 
2155 	/* support enable/update process only
2156 	 * disable flow would be handled in bss stop handler automatically
2157 	 */
2158 	if (!enable)
2159 		return -EOPNOTSUPP;
2160 
2161 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs, 0);
2162 	if (!skb)
2163 		return -EINVAL;
2164 
2165 	cap_offs = offsetof(struct ieee80211_mgmt, u.beacon.capab_info);
2166 	if (!skb_pull(skb, cap_offs)) {
2167 		dev_err(dev->mt76.dev, "beacon format err\n");
2168 		dev_kfree_skb(skb);
2169 		return -EINVAL;
2170 	}
2171 
2172 	if (skb->len > 512) {
2173 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
2174 		dev_kfree_skb(skb);
2175 		return -EINVAL;
2176 	}
2177 
2178 	memcpy(req.beacon_tlv.pkt, skb->data, skb->len);
2179 	req.beacon_tlv.pkt_len = cpu_to_le16(skb->len);
2180 	offs.tim_offset -= cap_offs;
2181 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(offs.tim_offset);
2182 
2183 	if (offs.cntdwn_counter_offs[0]) {
2184 		u16 csa_offs;
2185 
2186 		csa_offs = offs.cntdwn_counter_offs[0] - cap_offs - 4;
2187 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
2188 	}
2189 	dev_kfree_skb(skb);
2190 
2191 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
2192 				 &req, sizeof(req), true);
2193 }
2194 
2195 static
2196 void mt7925_mcu_bss_rlm_tlv(struct sk_buff *skb, struct mt76_phy *phy,
2197 			    struct ieee80211_bss_conf *link_conf,
2198 			    struct ieee80211_chanctx_conf *ctx)
2199 {
2200 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2201 						  &link_conf->chanreq.oper;
2202 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2203 	enum nl80211_band band = chandef->chan->band;
2204 	struct bss_rlm_tlv *req;
2205 	struct tlv *tlv;
2206 
2207 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RLM, sizeof(*req));
2208 	req = (struct bss_rlm_tlv *)tlv;
2209 	req->control_channel = chandef->chan->hw_value;
2210 	req->center_chan = ieee80211_frequency_to_channel(freq1);
2211 	req->center_chan2 = 0;
2212 	req->tx_streams = hweight8(phy->antenna_mask);
2213 	req->ht_op_info = 4; /* set HT 40M allowed */
2214 	req->rx_streams = hweight8(phy->antenna_mask);
2215 	req->center_chan2 = 0;
2216 	req->sco = 0;
2217 	req->band = 1;
2218 
2219 	switch (band) {
2220 	case NL80211_BAND_2GHZ:
2221 		req->band = 1;
2222 		break;
2223 	case NL80211_BAND_5GHZ:
2224 		req->band = 2;
2225 		break;
2226 	case NL80211_BAND_6GHZ:
2227 		req->band = 3;
2228 		break;
2229 	default:
2230 		break;
2231 	}
2232 
2233 	switch (chandef->width) {
2234 	case NL80211_CHAN_WIDTH_40:
2235 		req->bw = CMD_CBW_40MHZ;
2236 		break;
2237 	case NL80211_CHAN_WIDTH_80:
2238 		req->bw = CMD_CBW_80MHZ;
2239 		break;
2240 	case NL80211_CHAN_WIDTH_80P80:
2241 		req->bw = CMD_CBW_8080MHZ;
2242 		req->center_chan2 = ieee80211_frequency_to_channel(freq2);
2243 		break;
2244 	case NL80211_CHAN_WIDTH_160:
2245 		req->bw = CMD_CBW_160MHZ;
2246 		break;
2247 	case NL80211_CHAN_WIDTH_5:
2248 		req->bw = CMD_CBW_5MHZ;
2249 		break;
2250 	case NL80211_CHAN_WIDTH_10:
2251 		req->bw = CMD_CBW_10MHZ;
2252 		break;
2253 	case NL80211_CHAN_WIDTH_20_NOHT:
2254 	case NL80211_CHAN_WIDTH_20:
2255 	default:
2256 		req->bw = CMD_CBW_20MHZ;
2257 		req->ht_op_info = 0;
2258 		break;
2259 	}
2260 
2261 	if (req->control_channel < req->center_chan)
2262 		req->sco = 1; /* SCA */
2263 	else if (req->control_channel > req->center_chan)
2264 		req->sco = 3; /* SCB */
2265 }
2266 
2267 static struct sk_buff *
2268 __mt7925_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif_link *mvif, int len)
2269 {
2270 	struct bss_req_hdr hdr = {
2271 		.bss_idx = mvif->idx,
2272 	};
2273 	struct sk_buff *skb;
2274 
2275 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
2276 	if (!skb)
2277 		return ERR_PTR(-ENOMEM);
2278 
2279 	skb_put_data(skb, &hdr, sizeof(hdr));
2280 
2281 	return skb;
2282 }
2283 
2284 int mt7925_mcu_set_chctx(struct mt76_phy *phy, struct mt76_vif_link *mvif,
2285 			 struct ieee80211_bss_conf *link_conf,
2286 			 struct ieee80211_chanctx_conf *ctx)
2287 {
2288 	struct sk_buff *skb;
2289 
2290 	skb = __mt7925_mcu_alloc_bss_req(phy->dev, mvif,
2291 					 MT7925_BSS_UPDATE_MAX_SIZE);
2292 	if (IS_ERR(skb))
2293 		return PTR_ERR(skb);
2294 
2295 	mt7925_mcu_bss_rlm_tlv(skb, phy, link_conf, ctx);
2296 
2297 	return mt76_mcu_skb_send_msg(phy->dev, skb,
2298 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2299 }
2300 
2301 static u8
2302 mt7925_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
2303 			enum nl80211_band band,
2304 			struct ieee80211_link_sta *link_sta)
2305 {
2306 	struct ieee80211_he_6ghz_capa *he_6ghz_capa;
2307 	const struct ieee80211_sta_eht_cap *eht_cap;
2308 	__le16 capa = 0;
2309 	u8 mode = 0;
2310 
2311 	if (link_sta) {
2312 		he_6ghz_capa = &link_sta->he_6ghz_capa;
2313 		eht_cap = &link_sta->eht_cap;
2314 	} else {
2315 		struct ieee80211_supported_band *sband;
2316 
2317 		sband = phy->hw->wiphy->bands[band];
2318 		capa = ieee80211_get_he_6ghz_capa(sband, vif->type);
2319 		he_6ghz_capa = (struct ieee80211_he_6ghz_capa *)&capa;
2320 
2321 		eht_cap = ieee80211_get_eht_iftype_cap(sband, vif->type);
2322 	}
2323 
2324 	switch (band) {
2325 	case NL80211_BAND_2GHZ:
2326 		if (eht_cap && eht_cap->has_eht)
2327 			mode |= PHY_MODE_BE_24G;
2328 		break;
2329 	case NL80211_BAND_5GHZ:
2330 		if (eht_cap && eht_cap->has_eht)
2331 			mode |= PHY_MODE_BE_5G;
2332 		break;
2333 	case NL80211_BAND_6GHZ:
2334 		if (he_6ghz_capa && he_6ghz_capa->capa)
2335 			mode |= PHY_MODE_AX_6G;
2336 
2337 		if (eht_cap && eht_cap->has_eht)
2338 			mode |= PHY_MODE_BE_6G;
2339 		break;
2340 	default:
2341 		break;
2342 	}
2343 
2344 	return mode;
2345 }
2346 
2347 static void
2348 mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
2349 			 struct ieee80211_bss_conf *link_conf,
2350 			 struct ieee80211_link_sta *link_sta,
2351 			 struct ieee80211_chanctx_conf *ctx,
2352 			 struct mt76_phy *phy, u16 wlan_idx,
2353 			 bool enable)
2354 {
2355 	struct ieee80211_vif *vif = link_conf->vif;
2356 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2357 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2358 						  &link_conf->chanreq.oper;
2359 	enum nl80211_band band = chandef->chan->band;
2360 	struct mt76_connac_bss_basic_tlv *basic_req;
2361 	struct mt792x_link_sta *mlink;
2362 	struct tlv *tlv;
2363 	int conn_type;
2364 	u8 idx;
2365 
2366 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*basic_req));
2367 	basic_req = (struct mt76_connac_bss_basic_tlv *)tlv;
2368 
2369 	idx = mconf->mt76.omac_idx > EXT_BSSID_START ? HW_BSSID_0 :
2370 						      mconf->mt76.omac_idx;
2371 	basic_req->hw_bss_idx = idx;
2372 
2373 	basic_req->phymode_ext = mt7925_get_phy_mode_ext(phy, vif, band,
2374 							 link_sta);
2375 
2376 	if (band == NL80211_BAND_2GHZ)
2377 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_ERP_INDEX);
2378 	else
2379 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_OFDM_INDEX);
2380 
2381 	memcpy(basic_req->bssid, link_conf->bssid, ETH_ALEN);
2382 	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, link_sta);
2383 	basic_req->bcn_interval = cpu_to_le16(link_conf->beacon_int);
2384 	basic_req->dtim_period = link_conf->dtim_period;
2385 	basic_req->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
2386 	basic_req->link_idx = mconf->mt76.idx;
2387 
2388 	if (link_sta) {
2389 		struct mt792x_sta *msta;
2390 
2391 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
2392 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
2393 
2394 	} else {
2395 		mlink = &mconf->vif->sta.deflink;
2396 	}
2397 
2398 	basic_req->sta_idx = cpu_to_le16(mlink->wcid.idx);
2399 	basic_req->omac_idx = mconf->mt76.omac_idx;
2400 	basic_req->band_idx = mconf->mt76.band_idx;
2401 	basic_req->wmm_idx = mconf->mt76.wmm_idx;
2402 	basic_req->conn_state = !enable;
2403 
2404 	switch (vif->type) {
2405 	case NL80211_IFTYPE_MESH_POINT:
2406 	case NL80211_IFTYPE_AP:
2407 		if (vif->p2p)
2408 			conn_type = CONNECTION_P2P_GO;
2409 		else
2410 			conn_type = CONNECTION_INFRA_AP;
2411 		basic_req->conn_type = cpu_to_le32(conn_type);
2412 		basic_req->active = enable;
2413 		break;
2414 	case NL80211_IFTYPE_STATION:
2415 		if (vif->p2p)
2416 			conn_type = CONNECTION_P2P_GC;
2417 		else
2418 			conn_type = CONNECTION_INFRA_STA;
2419 		basic_req->conn_type = cpu_to_le32(conn_type);
2420 		basic_req->active = true;
2421 		break;
2422 	case NL80211_IFTYPE_ADHOC:
2423 		basic_req->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
2424 		basic_req->active = true;
2425 		break;
2426 	default:
2427 		WARN_ON(1);
2428 		break;
2429 	}
2430 }
2431 
2432 static void
2433 mt7925_mcu_bss_sec_tlv(struct sk_buff *skb,
2434 		       struct ieee80211_bss_conf *link_conf)
2435 {
2436 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2437 	struct mt76_vif_link *mvif = &mconf->mt76;
2438 	struct bss_sec_tlv {
2439 		__le16 tag;
2440 		__le16 len;
2441 		u8 mode;
2442 		u8 status;
2443 		u8 cipher;
2444 		u8 __rsv;
2445 	} __packed * sec;
2446 	struct tlv *tlv;
2447 
2448 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_SEC, sizeof(*sec));
2449 	sec = (struct bss_sec_tlv *)tlv;
2450 
2451 	switch (mvif->cipher) {
2452 	case CONNAC3_CIPHER_GCMP_256:
2453 	case CONNAC3_CIPHER_GCMP:
2454 		sec->mode = MODE_WPA3_SAE;
2455 		sec->status = 8;
2456 		break;
2457 	case CONNAC3_CIPHER_AES_CCMP:
2458 		sec->mode = MODE_WPA2_PSK;
2459 		sec->status = 6;
2460 		break;
2461 	case CONNAC3_CIPHER_TKIP:
2462 		sec->mode = MODE_WPA2_PSK;
2463 		sec->status = 4;
2464 		break;
2465 	case CONNAC3_CIPHER_WEP104:
2466 	case CONNAC3_CIPHER_WEP40:
2467 		sec->mode = MODE_SHARED;
2468 		sec->status = 0;
2469 		break;
2470 	default:
2471 		sec->mode = MODE_OPEN;
2472 		sec->status = 1;
2473 		break;
2474 	}
2475 
2476 	sec->cipher = mvif->cipher;
2477 }
2478 
2479 static void
2480 mt7925_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt792x_phy *phy,
2481 		       struct ieee80211_chanctx_conf *ctx,
2482 		       struct ieee80211_bss_conf *link_conf)
2483 {
2484 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2485 						  &link_conf->chanreq.oper;
2486 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2487 	enum nl80211_band band = chandef->chan->band;
2488 	struct mt76_vif_link *mvif = &mconf->mt76;
2489 	struct bss_rate_tlv *bmc;
2490 	struct tlv *tlv;
2491 	u8 idx = mvif->mcast_rates_idx ?
2492 		 mvif->mcast_rates_idx : mvif->basic_rates_idx;
2493 
2494 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RATE, sizeof(*bmc));
2495 
2496 	bmc = (struct bss_rate_tlv *)tlv;
2497 
2498 	if (band == NL80211_BAND_2GHZ)
2499 		bmc->basic_rate = cpu_to_le16(HR_DSSS_ERP_BASIC_RATE);
2500 	else
2501 		bmc->basic_rate = cpu_to_le16(OFDM_BASIC_RATE);
2502 
2503 	bmc->short_preamble = (band == NL80211_BAND_2GHZ);
2504 	bmc->bc_fixed_rate = idx;
2505 	bmc->mc_fixed_rate = idx;
2506 }
2507 
2508 static void
2509 mt7925_mcu_bss_mld_tlv(struct sk_buff *skb,
2510 		       struct ieee80211_bss_conf *link_conf)
2511 {
2512 	struct ieee80211_vif *vif = link_conf->vif;
2513 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2514 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2515 	struct bss_mld_tlv *mld;
2516 	struct tlv *tlv;
2517 	bool is_mld;
2518 
2519 	is_mld = ieee80211_vif_is_mld(link_conf->vif) ||
2520 		 (hweight16(mvif->valid_links) > 1);
2521 
2522 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_MLD, sizeof(*mld));
2523 	mld = (struct bss_mld_tlv *)tlv;
2524 
2525 	mld->link_id = is_mld ? link_conf->link_id : 0xff;
2526 	/* apply the index of the primary link */
2527 	mld->group_mld_id = is_mld ? mvif->bss_conf.mt76.idx : 0xff;
2528 	mld->own_mld_id = mconf->mt76.idx + 32;
2529 	mld->remap_idx = 0xff;
2530 	mld->eml_enable = !!(link_conf->vif->cfg.eml_cap &
2531 			     IEEE80211_EML_CAP_EMLSR_SUPP);
2532 
2533 	memcpy(mld->mac_addr, vif->addr, ETH_ALEN);
2534 }
2535 
2536 static void
2537 mt7925_mcu_bss_qos_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf)
2538 {
2539 	struct mt76_connac_bss_qos_tlv *qos;
2540 	struct tlv *tlv;
2541 
2542 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_QBSS, sizeof(*qos));
2543 	qos = (struct mt76_connac_bss_qos_tlv *)tlv;
2544 	qos->qos = link_conf->qos;
2545 }
2546 
2547 static void
2548 mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2549 		      struct mt792x_phy *phy)
2550 {
2551 #define DEFAULT_HE_PE_DURATION		4
2552 #define DEFAULT_HE_DURATION_RTS_THRES	1023
2553 	const struct ieee80211_sta_he_cap *cap;
2554 	struct bss_info_uni_he *he;
2555 	struct tlv *tlv;
2556 
2557 	cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
2558 
2559 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
2560 
2561 	he = (struct bss_info_uni_he *)tlv;
2562 	he->he_pe_duration = link_conf->htc_trig_based_pkt_ext;
2563 	if (!he->he_pe_duration)
2564 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
2565 
2566 	he->he_rts_thres = cpu_to_le16(link_conf->frame_time_rts_th);
2567 	if (!he->he_rts_thres)
2568 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
2569 
2570 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
2571 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
2572 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
2573 }
2574 
2575 static void
2576 mt7925_mcu_bss_color_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2577 			 bool enable)
2578 {
2579 	struct bss_info_uni_bss_color *color;
2580 	struct tlv *tlv;
2581 
2582 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BSS_COLOR, sizeof(*color));
2583 	color = (struct bss_info_uni_bss_color *)tlv;
2584 
2585 	color->enable = enable ?
2586 		link_conf->he_bss_color.enabled : 0;
2587 	color->bss_color = enable ?
2588 		link_conf->he_bss_color.color : 0;
2589 }
2590 
2591 static void
2592 mt7925_mcu_bss_ifs_tlv(struct sk_buff *skb,
2593 		       struct ieee80211_bss_conf *link_conf)
2594 {
2595 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2596 	struct mt792x_phy *phy = mvif->phy;
2597 	struct bss_ifs_time_tlv *ifs_time;
2598 	struct tlv *tlv;
2599 
2600 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_IFS_TIME, sizeof(*ifs_time));
2601 	ifs_time = (struct bss_ifs_time_tlv *)tlv;
2602 	ifs_time->slot_valid = true;
2603 	ifs_time->slot_time = cpu_to_le16(phy->slottime);
2604 }
2605 
2606 int mt7925_mcu_set_timing(struct mt792x_phy *phy,
2607 			  struct ieee80211_bss_conf *link_conf)
2608 {
2609 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2610 	struct mt792x_dev *dev = phy->dev;
2611 	struct sk_buff *skb;
2612 
2613 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2614 					 MT7925_BSS_UPDATE_MAX_SIZE);
2615 	if (IS_ERR(skb))
2616 		return PTR_ERR(skb);
2617 
2618 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2619 
2620 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2621 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2622 }
2623 
2624 int mt7925_mcu_add_bss_info(struct mt792x_phy *phy,
2625 			    struct ieee80211_chanctx_conf *ctx,
2626 			    struct ieee80211_bss_conf *link_conf,
2627 			    struct ieee80211_link_sta *link_sta,
2628 			    int enable)
2629 {
2630 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2631 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2632 	struct mt792x_dev *dev = phy->dev;
2633 	struct mt792x_link_sta *mlink_bc;
2634 	struct sk_buff *skb;
2635 
2636 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2637 					 MT7925_BSS_UPDATE_MAX_SIZE);
2638 	if (IS_ERR(skb))
2639 		return PTR_ERR(skb);
2640 
2641 	mlink_bc = mt792x_sta_to_link(&mvif->sta, mconf->link_id);
2642 
2643 	/* bss_basic must be first */
2644 	mt7925_mcu_bss_basic_tlv(skb, link_conf, link_sta, ctx, phy->mt76,
2645 				 mlink_bc->wcid.idx, enable);
2646 	mt7925_mcu_bss_sec_tlv(skb, link_conf);
2647 	mt7925_mcu_bss_bmc_tlv(skb, phy, ctx, link_conf);
2648 	mt7925_mcu_bss_qos_tlv(skb, link_conf);
2649 	mt7925_mcu_bss_mld_tlv(skb, link_conf);
2650 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2651 
2652 	if (link_conf->he_support) {
2653 		mt7925_mcu_bss_he_tlv(skb, link_conf, phy);
2654 		mt7925_mcu_bss_color_tlv(skb, link_conf, enable);
2655 	}
2656 
2657 	if (enable)
2658 		mt7925_mcu_bss_rlm_tlv(skb, phy->mt76, link_conf, ctx);
2659 
2660 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2661 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2662 }
2663 
2664 int mt7925_mcu_set_dbdc(struct mt76_phy *phy, bool enable)
2665 {
2666 	struct mt76_dev *mdev = phy->dev;
2667 
2668 	struct mbmc_conf_tlv *conf;
2669 	struct mbmc_set_req *hdr;
2670 	struct sk_buff *skb;
2671 	struct tlv *tlv;
2672 	int max_len, err;
2673 
2674 	max_len = sizeof(*hdr) + sizeof(*conf);
2675 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2676 	if (!skb)
2677 		return -ENOMEM;
2678 
2679 	hdr = (struct mbmc_set_req *)skb_put(skb, sizeof(*hdr));
2680 
2681 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_MBMC_SETTING, sizeof(*conf));
2682 	conf = (struct mbmc_conf_tlv *)tlv;
2683 
2684 	conf->mbmc_en = enable;
2685 	conf->band = 0; /* unused */
2686 
2687 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SET_DBDC_PARMS),
2688 				    false);
2689 
2690 	return err;
2691 }
2692 
2693 int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
2694 		       struct ieee80211_scan_request *scan_req)
2695 {
2696 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
2697 	struct cfg80211_scan_request *sreq = &scan_req->req;
2698 	int n_ssids = 0, err, i;
2699 	struct ieee80211_channel **scan_list = sreq->channels;
2700 	struct mt76_dev *mdev = phy->dev;
2701 	struct mt76_connac_mcu_scan_channel *chan;
2702 	struct sk_buff *skb;
2703 
2704 	struct scan_hdr_tlv *hdr;
2705 	struct scan_req_tlv *req;
2706 	struct scan_ssid_tlv *ssid;
2707 	struct scan_bssid_tlv *bssid;
2708 	struct scan_chan_info_tlv *chan_info;
2709 	struct scan_ie_tlv *ie;
2710 	struct scan_misc_tlv *misc;
2711 	struct tlv *tlv;
2712 	int max_len;
2713 
2714 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2715 				sizeof(*bssid) + sizeof(*chan_info) +
2716 				sizeof(*misc) + sizeof(*ie);
2717 
2718 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2719 	if (!skb)
2720 		return -ENOMEM;
2721 
2722 	set_bit(MT76_HW_SCANNING, &phy->state);
2723 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2724 
2725 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2726 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2727 	hdr->bss_idx = mvif->idx;
2728 
2729 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_REQ, sizeof(*req));
2730 	req = (struct scan_req_tlv *)tlv;
2731 	req->scan_type = sreq->n_ssids ? 1 : 0;
2732 	req->probe_req_num = sreq->n_ssids ? 2 : 0;
2733 
2734 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2735 	ssid = (struct scan_ssid_tlv *)tlv;
2736 	for (i = 0; i < sreq->n_ssids; i++) {
2737 		if (!sreq->ssids[i].ssid_len)
2738 			continue;
2739 
2740 		ssid->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
2741 		memcpy(ssid->ssids[i].ssid, sreq->ssids[i].ssid,
2742 		       sreq->ssids[i].ssid_len);
2743 		n_ssids++;
2744 	}
2745 	ssid->ssid_type = n_ssids ? BIT(2) : BIT(0);
2746 	ssid->ssids_num = n_ssids;
2747 
2748 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_BSSID, sizeof(*bssid));
2749 	bssid = (struct scan_bssid_tlv *)tlv;
2750 
2751 	memcpy(bssid->bssid, sreq->bssid, ETH_ALEN);
2752 
2753 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
2754 	chan_info = (struct scan_chan_info_tlv *)tlv;
2755 	chan_info->channels_num = min_t(u8, sreq->n_channels,
2756 					ARRAY_SIZE(chan_info->channels));
2757 	for (i = 0; i < chan_info->channels_num; i++) {
2758 		chan = &chan_info->channels[i];
2759 
2760 		switch (scan_list[i]->band) {
2761 		case NL80211_BAND_2GHZ:
2762 			chan->band = 1;
2763 			break;
2764 		case NL80211_BAND_6GHZ:
2765 			chan->band = 3;
2766 			break;
2767 		default:
2768 			chan->band = 2;
2769 			break;
2770 		}
2771 		chan->channel_num = scan_list[i]->hw_value;
2772 	}
2773 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
2774 
2775 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
2776 	ie = (struct scan_ie_tlv *)tlv;
2777 	if (sreq->ie_len > 0) {
2778 		memcpy(ie->ies, sreq->ie, sreq->ie_len);
2779 		ie->ies_len = cpu_to_le16(sreq->ie_len);
2780 	}
2781 
2782 	req->scan_func |= SCAN_FUNC_SPLIT_SCAN;
2783 
2784 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_MISC, sizeof(*misc));
2785 	misc = (struct scan_misc_tlv *)tlv;
2786 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
2787 		get_random_mask_addr(misc->random_mac, sreq->mac_addr,
2788 				     sreq->mac_addr_mask);
2789 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
2790 	}
2791 
2792 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2793 				    false);
2794 	if (err < 0)
2795 		clear_bit(MT76_HW_SCANNING, &phy->state);
2796 
2797 	return err;
2798 }
2799 EXPORT_SYMBOL_GPL(mt7925_mcu_hw_scan);
2800 
2801 int mt7925_mcu_sched_scan_req(struct mt76_phy *phy,
2802 			      struct ieee80211_vif *vif,
2803 			      struct cfg80211_sched_scan_request *sreq)
2804 {
2805 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
2806 	struct ieee80211_channel **scan_list = sreq->channels;
2807 	struct mt76_connac_mcu_scan_channel *chan;
2808 	struct mt76_dev *mdev = phy->dev;
2809 	struct cfg80211_match_set *cfg_match;
2810 	struct cfg80211_ssid *cfg_ssid;
2811 
2812 	struct scan_hdr_tlv *hdr;
2813 	struct scan_sched_req *req;
2814 	struct scan_ssid_tlv *ssid;
2815 	struct scan_chan_info_tlv *chan_info;
2816 	struct scan_ie_tlv *ie;
2817 	struct scan_sched_ssid_match_sets *match;
2818 	struct sk_buff *skb;
2819 	struct tlv *tlv;
2820 	int i, max_len;
2821 
2822 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2823 		  sizeof(*chan_info) + sizeof(*ie) +
2824 		  sizeof(*match);
2825 
2826 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2827 	if (!skb)
2828 		return -ENOMEM;
2829 
2830 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2831 
2832 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2833 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2834 	hdr->bss_idx = mvif->idx;
2835 
2836 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_REQ, sizeof(*req));
2837 	req = (struct scan_sched_req *)tlv;
2838 	req->version = 1;
2839 
2840 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
2841 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
2842 
2843 	req->intervals_num = sreq->n_scan_plans;
2844 	for (i = 0; i < req->intervals_num; i++)
2845 		req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
2846 
2847 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2848 	ssid = (struct scan_ssid_tlv *)tlv;
2849 
2850 	ssid->ssids_num = sreq->n_ssids;
2851 	ssid->ssid_type = BIT(2);
2852 	for (i = 0; i < ssid->ssids_num; i++) {
2853 		cfg_ssid = &sreq->ssids[i];
2854 		memcpy(ssid->ssids[i].ssid, cfg_ssid->ssid, cfg_ssid->ssid_len);
2855 		ssid->ssids[i].ssid_len = cpu_to_le32(cfg_ssid->ssid_len);
2856 	}
2857 
2858 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID_MATCH_SETS, sizeof(*match));
2859 	match = (struct scan_sched_ssid_match_sets *)tlv;
2860 	match->match_num = sreq->n_match_sets;
2861 	for (i = 0; i < match->match_num; i++) {
2862 		cfg_match = &sreq->match_sets[i];
2863 		memcpy(match->match[i].ssid, cfg_match->ssid.ssid,
2864 		       cfg_match->ssid.ssid_len);
2865 		match->match[i].rssi_th = cpu_to_le32(cfg_match->rssi_thold);
2866 		match->match[i].ssid_len = cfg_match->ssid.ssid_len;
2867 	}
2868 
2869 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
2870 	chan_info = (struct scan_chan_info_tlv *)tlv;
2871 	chan_info->channels_num = min_t(u8, sreq->n_channels,
2872 					ARRAY_SIZE(chan_info->channels));
2873 	for (i = 0; i < chan_info->channels_num; i++) {
2874 		chan = &chan_info->channels[i];
2875 
2876 		switch (scan_list[i]->band) {
2877 		case NL80211_BAND_2GHZ:
2878 			chan->band = 1;
2879 			break;
2880 		case NL80211_BAND_6GHZ:
2881 			chan->band = 3;
2882 			break;
2883 		default:
2884 			chan->band = 2;
2885 			break;
2886 		}
2887 		chan->channel_num = scan_list[i]->hw_value;
2888 	}
2889 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
2890 
2891 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
2892 	ie = (struct scan_ie_tlv *)tlv;
2893 	if (sreq->ie_len > 0) {
2894 		memcpy(ie->ies, sreq->ie, sreq->ie_len);
2895 		ie->ies_len = cpu_to_le16(sreq->ie_len);
2896 	}
2897 
2898 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2899 				     false);
2900 }
2901 EXPORT_SYMBOL_GPL(mt7925_mcu_sched_scan_req);
2902 
2903 int
2904 mt7925_mcu_sched_scan_enable(struct mt76_phy *phy,
2905 			     struct ieee80211_vif *vif,
2906 			     bool enable)
2907 {
2908 	struct mt76_dev *mdev = phy->dev;
2909 	struct scan_sched_enable *req;
2910 	struct scan_hdr_tlv *hdr;
2911 	struct sk_buff *skb;
2912 	struct tlv *tlv;
2913 	int max_len;
2914 
2915 	max_len = sizeof(*hdr) + sizeof(*req);
2916 
2917 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2918 	if (!skb)
2919 		return -ENOMEM;
2920 
2921 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2922 	hdr->seq_num = 0;
2923 	hdr->bss_idx = 0;
2924 
2925 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_ENABLE, sizeof(*req));
2926 	req = (struct scan_sched_enable *)tlv;
2927 	req->active = !enable;
2928 
2929 	if (enable)
2930 		set_bit(MT76_HW_SCHED_SCANNING, &phy->state);
2931 	else
2932 		clear_bit(MT76_HW_SCHED_SCANNING, &phy->state);
2933 
2934 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2935 				     false);
2936 }
2937 
2938 int mt7925_mcu_cancel_hw_scan(struct mt76_phy *phy,
2939 			      struct ieee80211_vif *vif)
2940 {
2941 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
2942 	struct {
2943 		struct scan_hdr {
2944 			u8 seq_num;
2945 			u8 bss_idx;
2946 			u8 pad[2];
2947 		} __packed hdr;
2948 		struct scan_cancel_tlv {
2949 			__le16 tag;
2950 			__le16 len;
2951 			u8 is_ext_channel;
2952 			u8 rsv[3];
2953 		} __packed cancel;
2954 	} req = {
2955 		.hdr = {
2956 			.seq_num = mvif->scan_seq_num,
2957 			.bss_idx = mvif->idx,
2958 		},
2959 		.cancel = {
2960 			.tag = cpu_to_le16(UNI_SCAN_CANCEL),
2961 			.len = cpu_to_le16(sizeof(struct scan_cancel_tlv)),
2962 		},
2963 	};
2964 
2965 	if (test_and_clear_bit(MT76_HW_SCANNING, &phy->state)) {
2966 		struct cfg80211_scan_info info = {
2967 			.aborted = true,
2968 		};
2969 
2970 		ieee80211_scan_completed(phy->hw, &info);
2971 	}
2972 
2973 	return mt76_mcu_send_msg(phy->dev, MCU_UNI_CMD(SCAN_REQ),
2974 				 &req, sizeof(req), false);
2975 }
2976 EXPORT_SYMBOL_GPL(mt7925_mcu_cancel_hw_scan);
2977 
2978 int mt7925_mcu_set_channel_domain(struct mt76_phy *phy)
2979 {
2980 	int len, i, n_max_channels, n_2ch = 0, n_5ch = 0, n_6ch = 0;
2981 	struct {
2982 		struct {
2983 			u8 alpha2[4]; /* regulatory_request.alpha2 */
2984 			u8 bw_2g; /* BW_20_40M		0
2985 				   * BW_20M		1
2986 				   * BW_20_40_80M	2
2987 				   * BW_20_40_80_160M	3
2988 				   * BW_20_40_80_8080M	4
2989 				   */
2990 			u8 bw_5g;
2991 			u8 bw_6g;
2992 			u8 pad;
2993 		} __packed hdr;
2994 		struct n_chan {
2995 			__le16 tag;
2996 			__le16 len;
2997 			u8 n_2ch;
2998 			u8 n_5ch;
2999 			u8 n_6ch;
3000 			u8 pad;
3001 		} __packed n_ch;
3002 	} req = {
3003 		.hdr = {
3004 			.bw_2g = 0,
3005 			.bw_5g = 3, /* BW_20_40_80_160M */
3006 			.bw_6g = 3,
3007 		},
3008 		.n_ch = {
3009 			.tag = cpu_to_le16(2),
3010 		},
3011 	};
3012 	struct mt76_connac_mcu_chan {
3013 		__le16 hw_value;
3014 		__le16 pad;
3015 		__le32 flags;
3016 	} __packed channel;
3017 	struct mt76_dev *dev = phy->dev;
3018 	struct ieee80211_channel *chan;
3019 	struct sk_buff *skb;
3020 
3021 	n_max_channels = phy->sband_2g.sband.n_channels +
3022 			 phy->sband_5g.sband.n_channels +
3023 			 phy->sband_6g.sband.n_channels;
3024 	len = sizeof(req) + n_max_channels * sizeof(channel);
3025 
3026 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
3027 	if (!skb)
3028 		return -ENOMEM;
3029 
3030 	skb_reserve(skb, sizeof(req));
3031 
3032 	for (i = 0; i < phy->sband_2g.sband.n_channels; i++) {
3033 		chan = &phy->sband_2g.sband.channels[i];
3034 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3035 			continue;
3036 
3037 		channel.hw_value = cpu_to_le16(chan->hw_value);
3038 		channel.flags = cpu_to_le32(chan->flags);
3039 		channel.pad = 0;
3040 
3041 		skb_put_data(skb, &channel, sizeof(channel));
3042 		n_2ch++;
3043 	}
3044 	for (i = 0; i < phy->sband_5g.sband.n_channels; i++) {
3045 		chan = &phy->sband_5g.sband.channels[i];
3046 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3047 			continue;
3048 
3049 		channel.hw_value = cpu_to_le16(chan->hw_value);
3050 		channel.flags = cpu_to_le32(chan->flags);
3051 		channel.pad = 0;
3052 
3053 		skb_put_data(skb, &channel, sizeof(channel));
3054 		n_5ch++;
3055 	}
3056 	for (i = 0; i < phy->sband_6g.sband.n_channels; i++) {
3057 		chan = &phy->sband_6g.sband.channels[i];
3058 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3059 			continue;
3060 
3061 		channel.hw_value = cpu_to_le16(chan->hw_value);
3062 		channel.flags = cpu_to_le32(chan->flags);
3063 		channel.pad = 0;
3064 
3065 		skb_put_data(skb, &channel, sizeof(channel));
3066 		n_6ch++;
3067 	}
3068 
3069 	BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(req.hdr.alpha2));
3070 	memcpy(req.hdr.alpha2, dev->alpha2, sizeof(dev->alpha2));
3071 	req.n_ch.n_2ch = n_2ch;
3072 	req.n_ch.n_5ch = n_5ch;
3073 	req.n_ch.n_6ch = n_6ch;
3074 	len = sizeof(struct n_chan) + (n_2ch + n_5ch + n_6ch) * sizeof(channel);
3075 	req.n_ch.len = cpu_to_le16(len);
3076 	memcpy(__skb_push(skb, sizeof(req)), &req, sizeof(req));
3077 
3078 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SET_DOMAIN_INFO),
3079 				     false);
3080 }
3081 EXPORT_SYMBOL_GPL(mt7925_mcu_set_channel_domain);
3082 
3083 static int
3084 __mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3085 		     enum environment_cap env_cap,
3086 		     struct mt7925_clc *clc, u8 idx)
3087 {
3088 	struct mt7925_clc_segment *seg;
3089 	struct sk_buff *skb;
3090 	struct {
3091 		u8 rsv[4];
3092 		__le16 tag;
3093 		__le16 len;
3094 
3095 		u8 ver;
3096 		u8 pad0;
3097 		__le16 size;
3098 		u8 idx;
3099 		u8 env;
3100 		u8 acpi_conf;
3101 		u8 pad1;
3102 		u8 alpha2[2];
3103 		u8 type[2];
3104 		u8 rsvd[64];
3105 	} __packed req = {
3106 		.tag = cpu_to_le16(0x3),
3107 		.len = cpu_to_le16(sizeof(req) - 4),
3108 
3109 		.idx = idx,
3110 		.env = env_cap,
3111 		.acpi_conf = mt792x_acpi_get_flags(&dev->phy),
3112 	};
3113 	int ret, valid_cnt = 0;
3114 	u8 i, *pos;
3115 
3116 	if (!clc)
3117 		return 0;
3118 
3119 	pos = clc->data + sizeof(*seg) * clc->nr_seg;
3120 	for (i = 0; i < clc->nr_country; i++) {
3121 		struct mt7925_clc_rule *rule = (struct mt7925_clc_rule *)pos;
3122 
3123 		pos += sizeof(*rule);
3124 		if (rule->alpha2[0] != alpha2[0] ||
3125 		    rule->alpha2[1] != alpha2[1])
3126 			continue;
3127 
3128 		seg = (struct mt7925_clc_segment *)clc->data
3129 			  + rule->seg_idx - 1;
3130 
3131 		memcpy(req.alpha2, rule->alpha2, 2);
3132 		memcpy(req.type, rule->type, 2);
3133 
3134 		req.size = cpu_to_le16(seg->len);
3135 		skb = __mt76_mcu_msg_alloc(&dev->mt76, &req,
3136 					   le16_to_cpu(req.size) + sizeof(req),
3137 					   sizeof(req), GFP_KERNEL);
3138 		if (!skb)
3139 			return -ENOMEM;
3140 		skb_put_data(skb, clc->data + seg->offset, seg->len);
3141 
3142 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3143 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3144 					    true);
3145 		if (ret < 0)
3146 			return ret;
3147 		valid_cnt++;
3148 	}
3149 
3150 	if (!valid_cnt)
3151 		return -ENOENT;
3152 
3153 	return 0;
3154 }
3155 
3156 int mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3157 		       enum environment_cap env_cap)
3158 {
3159 	struct mt792x_phy *phy = (struct mt792x_phy *)&dev->phy;
3160 	int i, ret;
3161 
3162 	/* submit all clc config */
3163 	for (i = 0; i < ARRAY_SIZE(phy->clc); i++) {
3164 		ret = __mt7925_mcu_set_clc(dev, alpha2, env_cap,
3165 					   phy->clc[i], i);
3166 
3167 		/* If no country found, set "00" as default */
3168 		if (ret == -ENOENT)
3169 			ret = __mt7925_mcu_set_clc(dev, "00",
3170 						   ENVIRON_INDOOR,
3171 						   phy->clc[i], i);
3172 		if (ret < 0)
3173 			return ret;
3174 	}
3175 	return 0;
3176 }
3177 
3178 int mt7925_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb,
3179 			    int cmd, int *wait_seq)
3180 {
3181 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
3182 	struct mt76_connac2_mcu_uni_txd *uni_txd;
3183 	struct mt76_connac2_mcu_txd *mcu_txd;
3184 	__le32 *txd;
3185 	u32 val;
3186 	u8 seq;
3187 
3188 	/* TODO: make dynamic based on msg type */
3189 	mdev->mcu.timeout = 20 * HZ;
3190 
3191 	seq = ++mdev->mcu.msg_seq & 0xf;
3192 	if (!seq)
3193 		seq = ++mdev->mcu.msg_seq & 0xf;
3194 
3195 	if (cmd == MCU_CMD(FW_SCATTER))
3196 		goto exit;
3197 
3198 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
3199 	txd = (__le32 *)skb_push(skb, txd_len);
3200 
3201 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
3202 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
3203 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
3204 	txd[0] = cpu_to_le32(val);
3205 
3206 	val = FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
3207 	txd[1] = cpu_to_le32(val);
3208 
3209 	if (cmd & __MCU_CMD_FIELD_UNI) {
3210 		uni_txd = (struct mt76_connac2_mcu_uni_txd *)txd;
3211 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
3212 		uni_txd->cid = cpu_to_le16(mcu_cmd);
3213 		uni_txd->s2d_index = MCU_S2D_H2N;
3214 		uni_txd->pkt_type = MCU_PKT_ID;
3215 		uni_txd->seq = seq;
3216 
3217 		if (cmd & __MCU_CMD_FIELD_QUERY)
3218 			uni_txd->option = MCU_CMD_UNI_QUERY_ACK;
3219 		else
3220 			uni_txd->option = MCU_CMD_UNI_EXT_ACK;
3221 
3222 		goto exit;
3223 	}
3224 
3225 	mcu_txd = (struct mt76_connac2_mcu_txd *)txd;
3226 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
3227 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
3228 					       MT_TX_MCU_PORT_RX_Q0));
3229 	mcu_txd->pkt_type = MCU_PKT_ID;
3230 	mcu_txd->seq = seq;
3231 	mcu_txd->cid = mcu_cmd;
3232 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
3233 
3234 	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
3235 		if (cmd & __MCU_CMD_FIELD_QUERY)
3236 			mcu_txd->set_query = MCU_Q_QUERY;
3237 		else
3238 			mcu_txd->set_query = MCU_Q_SET;
3239 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
3240 	} else {
3241 		mcu_txd->set_query = MCU_Q_NA;
3242 	}
3243 
3244 	if (cmd & __MCU_CMD_FIELD_WA)
3245 		mcu_txd->s2d_index = MCU_S2D_H2C;
3246 	else
3247 		mcu_txd->s2d_index = MCU_S2D_H2N;
3248 
3249 exit:
3250 	if (wait_seq)
3251 		*wait_seq = seq;
3252 
3253 	return 0;
3254 }
3255 EXPORT_SYMBOL_GPL(mt7925_mcu_fill_message);
3256 
3257 int mt7925_mcu_set_rts_thresh(struct mt792x_phy *phy, u32 val)
3258 {
3259 	struct {
3260 		u8 band_idx;
3261 		u8 _rsv[3];
3262 
3263 		__le16 tag;
3264 		__le16 len;
3265 		__le32 len_thresh;
3266 		__le32 pkt_thresh;
3267 	} __packed req = {
3268 		.band_idx = phy->mt76->band_idx,
3269 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RTS_THRESHOLD),
3270 		.len = cpu_to_le16(sizeof(req) - 4),
3271 		.len_thresh = cpu_to_le32(val),
3272 		.pkt_thresh = cpu_to_le32(0x2),
3273 	};
3274 
3275 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3276 				 &req, sizeof(req), true);
3277 }
3278 
3279 int mt7925_mcu_set_radio_en(struct mt792x_phy *phy, bool enable)
3280 {
3281 	struct {
3282 		u8 band_idx;
3283 		u8 _rsv[3];
3284 
3285 		__le16 tag;
3286 		__le16 len;
3287 		u8 enable;
3288 		u8 _rsv2[3];
3289 	} __packed req = {
3290 		.band_idx = phy->mt76->band_idx,
3291 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RADIO_ENABLE),
3292 		.len = cpu_to_le16(sizeof(req) - 4),
3293 		.enable = enable,
3294 	};
3295 
3296 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3297 				 &req, sizeof(req), true);
3298 }
3299 
3300 static void
3301 mt7925_mcu_build_sku(struct mt76_dev *dev, s8 *sku,
3302 		     struct mt76_power_limits *limits,
3303 		     enum nl80211_band band)
3304 {
3305 	int i, offset = sizeof(limits->cck);
3306 
3307 	memset(sku, 127, MT_CONNAC3_SKU_POWER_LIMIT);
3308 
3309 	if (band == NL80211_BAND_2GHZ) {
3310 		/* cck */
3311 		memcpy(sku, limits->cck, sizeof(limits->cck));
3312 	}
3313 
3314 	/* ofdm */
3315 	memcpy(&sku[offset], limits->ofdm, sizeof(limits->ofdm));
3316 	offset += (sizeof(limits->ofdm) * 5);
3317 
3318 	/* ht */
3319 	for (i = 0; i < 2; i++) {
3320 		memcpy(&sku[offset], limits->mcs[i], 8);
3321 		offset += 8;
3322 	}
3323 	sku[offset++] = limits->mcs[0][0];
3324 
3325 	/* vht */
3326 	for (i = 0; i < ARRAY_SIZE(limits->mcs); i++) {
3327 		memcpy(&sku[offset], limits->mcs[i],
3328 		       ARRAY_SIZE(limits->mcs[i]));
3329 		offset += 12;
3330 	}
3331 
3332 	/* he */
3333 	for (i = 0; i < ARRAY_SIZE(limits->ru); i++) {
3334 		memcpy(&sku[offset], limits->ru[i], ARRAY_SIZE(limits->ru[i]));
3335 		offset += ARRAY_SIZE(limits->ru[i]);
3336 	}
3337 
3338 	/* eht */
3339 	for (i = 0; i < ARRAY_SIZE(limits->eht); i++) {
3340 		memcpy(&sku[offset], limits->eht[i], ARRAY_SIZE(limits->eht[i]));
3341 		offset += ARRAY_SIZE(limits->eht[i]);
3342 	}
3343 }
3344 
3345 static int
3346 mt7925_mcu_rate_txpower_band(struct mt76_phy *phy,
3347 			     enum nl80211_band band)
3348 {
3349 	int tx_power, n_chan, last_ch, err = 0, idx = 0;
3350 	int i, sku_len, batch_size, batch_len = 3;
3351 	struct mt76_dev *dev = phy->dev;
3352 	static const u8 chan_list_2ghz[] = {
3353 		1, 2,  3,  4,  5,  6,  7,
3354 		8, 9, 10, 11, 12, 13, 14
3355 	};
3356 	static const u8 chan_list_5ghz[] = {
3357 		 36,  38,  40,  42,  44,  46,  48,
3358 		 50,  52,  54,  56,  58,  60,  62,
3359 		 64, 100, 102, 104, 106, 108, 110,
3360 		112, 114, 116, 118, 120, 122, 124,
3361 		126, 128, 132, 134, 136, 138, 140,
3362 		142, 144, 149, 151, 153, 155, 157,
3363 		159, 161, 165, 167
3364 	};
3365 	static const u8 chan_list_6ghz[] = {
3366 		  1,   3,   5,   7,   9,  11,  13,
3367 		 15,  17,  19,  21,  23,  25,  27,
3368 		 29,  33,  35,  37,  39,  41,  43,
3369 		 45,  47,  49,  51,  53,  55,  57,
3370 		 59,  61,  65,  67,  69,  71,  73,
3371 		 75,  77,  79,  81,  83,  85,  87,
3372 		 89,  91,  93,  97,  99, 101, 103,
3373 		105, 107, 109, 111, 113, 115, 117,
3374 		119, 121, 123, 125, 129, 131, 133,
3375 		135, 137, 139, 141, 143, 145, 147,
3376 		149, 151, 153, 155, 157, 161, 163,
3377 		165, 167, 169, 171, 173, 175, 177,
3378 		179, 181, 183, 185, 187, 189, 193,
3379 		195, 197, 199, 201, 203, 205, 207,
3380 		209, 211, 213, 215, 217, 219, 221,
3381 		225, 227, 229, 233
3382 	};
3383 	struct mt76_power_limits *limits;
3384 	struct mt7925_sku_tlv *sku_tlbv;
3385 	const u8 *ch_list;
3386 
3387 	sku_len = sizeof(*sku_tlbv);
3388 	tx_power = 2 * phy->hw->conf.power_level;
3389 	if (!tx_power)
3390 		tx_power = 127;
3391 
3392 	if (band == NL80211_BAND_2GHZ) {
3393 		n_chan = ARRAY_SIZE(chan_list_2ghz);
3394 		ch_list = chan_list_2ghz;
3395 		last_ch = chan_list_2ghz[ARRAY_SIZE(chan_list_2ghz) - 1];
3396 	} else if (band == NL80211_BAND_6GHZ) {
3397 		n_chan = ARRAY_SIZE(chan_list_6ghz);
3398 		ch_list = chan_list_6ghz;
3399 		last_ch = chan_list_6ghz[ARRAY_SIZE(chan_list_6ghz) - 1];
3400 	} else {
3401 		n_chan = ARRAY_SIZE(chan_list_5ghz);
3402 		ch_list = chan_list_5ghz;
3403 		last_ch = chan_list_5ghz[ARRAY_SIZE(chan_list_5ghz) - 1];
3404 	}
3405 	batch_size = DIV_ROUND_UP(n_chan, batch_len);
3406 
3407 	limits = devm_kmalloc(dev->dev, sizeof(*limits), GFP_KERNEL);
3408 	if (!limits)
3409 		return -ENOMEM;
3410 
3411 	sku_tlbv = devm_kmalloc(dev->dev, sku_len, GFP_KERNEL);
3412 	if (!sku_tlbv) {
3413 		devm_kfree(dev->dev, limits);
3414 		return -ENOMEM;
3415 	}
3416 
3417 	for (i = 0; i < batch_size; i++) {
3418 		struct mt7925_tx_power_limit_tlv *tx_power_tlv;
3419 		int j, msg_len, num_ch;
3420 		struct sk_buff *skb;
3421 
3422 		num_ch = i == batch_size - 1 ? n_chan % batch_len : batch_len;
3423 		msg_len = sizeof(*tx_power_tlv) + num_ch * sku_len;
3424 		skb = mt76_mcu_msg_alloc(dev, NULL, msg_len);
3425 		if (!skb) {
3426 			err = -ENOMEM;
3427 			goto out;
3428 		}
3429 
3430 		tx_power_tlv = (struct mt7925_tx_power_limit_tlv *)
3431 			       skb_put(skb, sizeof(*tx_power_tlv));
3432 
3433 		BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(tx_power_tlv->alpha2));
3434 		memcpy(tx_power_tlv->alpha2, dev->alpha2, sizeof(dev->alpha2));
3435 		tx_power_tlv->n_chan = num_ch;
3436 		tx_power_tlv->tag = cpu_to_le16(0x1);
3437 		tx_power_tlv->len = cpu_to_le16(sizeof(*tx_power_tlv));
3438 
3439 		switch (band) {
3440 		case NL80211_BAND_2GHZ:
3441 			tx_power_tlv->band = 1;
3442 			break;
3443 		case NL80211_BAND_6GHZ:
3444 			tx_power_tlv->band = 3;
3445 			break;
3446 		default:
3447 			tx_power_tlv->band = 2;
3448 			break;
3449 		}
3450 
3451 		for (j = 0; j < num_ch; j++, idx++) {
3452 			struct ieee80211_channel chan = {
3453 				.hw_value = ch_list[idx],
3454 				.band = band,
3455 			};
3456 			s8 reg_power, sar_power;
3457 
3458 			reg_power = mt76_connac_get_ch_power(phy, &chan,
3459 							     tx_power);
3460 			sar_power = mt76_get_sar_power(phy, &chan, reg_power);
3461 
3462 			mt76_get_rate_power_limits(phy, &chan, limits,
3463 						   sar_power);
3464 
3465 			tx_power_tlv->last_msg = ch_list[idx] == last_ch;
3466 			sku_tlbv->channel = ch_list[idx];
3467 
3468 			mt7925_mcu_build_sku(dev, sku_tlbv->pwr_limit,
3469 					     limits, band);
3470 			skb_put_data(skb, sku_tlbv, sku_len);
3471 		}
3472 		err = mt76_mcu_skb_send_msg(dev, skb,
3473 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3474 					    true);
3475 		if (err < 0)
3476 			goto out;
3477 	}
3478 
3479 out:
3480 	devm_kfree(dev->dev, sku_tlbv);
3481 	devm_kfree(dev->dev, limits);
3482 	return err;
3483 }
3484 
3485 int mt7925_mcu_set_rate_txpower(struct mt76_phy *phy)
3486 {
3487 	int err;
3488 
3489 	if (phy->cap.has_2ghz) {
3490 		err = mt7925_mcu_rate_txpower_band(phy,
3491 						   NL80211_BAND_2GHZ);
3492 		if (err < 0)
3493 			return err;
3494 	}
3495 
3496 	if (phy->cap.has_5ghz) {
3497 		err = mt7925_mcu_rate_txpower_band(phy,
3498 						   NL80211_BAND_5GHZ);
3499 		if (err < 0)
3500 			return err;
3501 	}
3502 
3503 	if (phy->cap.has_6ghz) {
3504 		err = mt7925_mcu_rate_txpower_band(phy,
3505 						   NL80211_BAND_6GHZ);
3506 		if (err < 0)
3507 			return err;
3508 	}
3509 
3510 	return 0;
3511 }
3512 
3513 int mt7925_mcu_set_rxfilter(struct mt792x_dev *dev, u32 fif,
3514 			    u8 bit_op, u32 bit_map)
3515 {
3516 	struct mt792x_phy *phy = &dev->phy;
3517 	struct {
3518 		u8 band_idx;
3519 		u8 rsv1[3];
3520 
3521 		__le16 tag;
3522 		__le16 len;
3523 		u8 mode;
3524 		u8 rsv2[3];
3525 		__le32 fif;
3526 		__le32 bit_map; /* bit_* for bitmap update */
3527 		u8 bit_op;
3528 		u8 pad[51];
3529 	} __packed req = {
3530 		.band_idx = phy->mt76->band_idx,
3531 		.tag = cpu_to_le16(UNI_BAND_CONFIG_SET_MAC80211_RX_FILTER),
3532 		.len = cpu_to_le16(sizeof(req) - 4),
3533 
3534 		.mode = fif ? 0 : 1,
3535 		.fif = cpu_to_le32(fif),
3536 		.bit_map = cpu_to_le32(bit_map),
3537 		.bit_op = bit_op,
3538 	};
3539 
3540 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3541 				 &req, sizeof(req), true);
3542 }
3543