xref: /linux/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c (revision d53b8e36925256097a08d7cb749198d85cbf9b2b)
1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2023 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include <linux/firmware.h>
6 #include "mt7925.h"
7 #include "mcu.h"
8 #include "mac.h"
9 
10 #define MT_STA_BFER			BIT(0)
11 #define MT_STA_BFEE			BIT(1)
12 
13 static bool mt7925_disable_clc;
14 module_param_named(disable_clc, mt7925_disable_clc, bool, 0644);
15 MODULE_PARM_DESC(disable_clc, "disable CLC support");
16 
17 int mt7925_mcu_parse_response(struct mt76_dev *mdev, int cmd,
18 			      struct sk_buff *skb, int seq)
19 {
20 	int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
21 	struct mt7925_mcu_rxd *rxd;
22 	int ret = 0;
23 
24 	if (!skb) {
25 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n", cmd, seq);
26 		mt792x_reset(mdev);
27 
28 		return -ETIMEDOUT;
29 	}
30 
31 	rxd = (struct mt7925_mcu_rxd *)skb->data;
32 	if (seq != rxd->seq)
33 		return -EAGAIN;
34 
35 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL) ||
36 	    cmd == MCU_CMD(PATCH_FINISH_REQ)) {
37 		skb_pull(skb, sizeof(*rxd) - 4);
38 		ret = *skb->data;
39 	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
40 		   cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
41 		   cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
42 		   cmd == MCU_UNI_CMD(HIF_CTRL) ||
43 		   cmd == MCU_UNI_CMD(OFFLOAD) ||
44 		   cmd == MCU_UNI_CMD(SUSPEND)) {
45 		struct mt7925_mcu_uni_event *event;
46 
47 		skb_pull(skb, sizeof(*rxd));
48 		event = (struct mt7925_mcu_uni_event *)skb->data;
49 		ret = le32_to_cpu(event->status);
50 		/* skip invalid event */
51 		if (mcu_cmd != event->cid)
52 			ret = -EAGAIN;
53 	} else {
54 		skb_pull(skb, sizeof(*rxd));
55 	}
56 
57 	return ret;
58 }
59 EXPORT_SYMBOL_GPL(mt7925_mcu_parse_response);
60 
61 int mt7925_mcu_regval(struct mt792x_dev *dev, u32 regidx, u32 *val, bool set)
62 {
63 #define MT_RF_REG_HDR           GENMASK(31, 24)
64 #define MT_RF_REG_ANT           GENMASK(23, 16)
65 #define RF_REG_PREFIX           0x99
66 	struct {
67 		u8 __rsv[4];
68 		union {
69 			struct uni_cmd_access_reg_basic {
70 				__le16 tag;
71 				__le16 len;
72 				__le32 idx;
73 				__le32 data;
74 			} __packed reg;
75 			struct uni_cmd_access_rf_reg_basic {
76 				__le16 tag;
77 				__le16 len;
78 				__le16 ant;
79 				u8 __rsv[2];
80 				__le32 idx;
81 				__le32 data;
82 			} __packed rf_reg;
83 		};
84 	} __packed * res, req;
85 	struct sk_buff *skb;
86 	int ret;
87 
88 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX) {
89 		req.rf_reg.tag = cpu_to_le16(UNI_CMD_ACCESS_RF_REG_BASIC);
90 		req.rf_reg.len = cpu_to_le16(sizeof(req.rf_reg));
91 		req.rf_reg.ant = cpu_to_le16(u32_get_bits(regidx, MT_RF_REG_ANT));
92 		req.rf_reg.idx = cpu_to_le32(regidx);
93 		req.rf_reg.data = set ? cpu_to_le32(*val) : 0;
94 	} else {
95 		req.reg.tag = cpu_to_le16(UNI_CMD_ACCESS_REG_BASIC);
96 		req.reg.len = cpu_to_le16(sizeof(req.reg));
97 		req.reg.idx = cpu_to_le32(regidx);
98 		req.reg.data = set ? cpu_to_le32(*val) : 0;
99 	}
100 
101 	if (set)
102 		return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(REG_ACCESS),
103 					 &req, sizeof(req), true);
104 
105 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
106 					MCU_WM_UNI_CMD_QUERY(REG_ACCESS),
107 					&req, sizeof(req), true, &skb);
108 	if (ret)
109 		return ret;
110 
111 	res = (void *)skb->data;
112 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX)
113 		*val = le32_to_cpu(res->rf_reg.data);
114 	else
115 		*val = le32_to_cpu(res->reg.data);
116 
117 	dev_kfree_skb(skb);
118 
119 	return 0;
120 }
121 EXPORT_SYMBOL_GPL(mt7925_mcu_regval);
122 
123 int mt7925_mcu_update_arp_filter(struct mt76_dev *dev,
124 				 struct ieee80211_bss_conf *link_conf)
125 {
126 	struct ieee80211_vif *mvif = container_of((void *)link_conf->vif,
127 						  struct ieee80211_vif,
128 						  drv_priv);
129 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
130 	struct sk_buff *skb;
131 	int i, len = min_t(int, mvif->cfg.arp_addr_cnt,
132 			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
133 	struct {
134 		struct {
135 			u8 bss_idx;
136 			u8 pad[3];
137 		} __packed hdr;
138 		struct mt7925_arpns_tlv arp;
139 	} req = {
140 		.hdr = {
141 			.bss_idx = mconf->mt76.idx,
142 		},
143 		.arp = {
144 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
145 			.len = cpu_to_le16(sizeof(req) - 4 + len * 2 * sizeof(__be32)),
146 			.ips_num = len,
147 			.enable = true,
148 		},
149 	};
150 
151 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(req) + len * 2 * sizeof(__be32));
152 	if (!skb)
153 		return -ENOMEM;
154 
155 	skb_put_data(skb, &req, sizeof(req));
156 	for (i = 0; i < len; i++) {
157 		skb_put_data(skb, &mvif->cfg.arp_addr_list[i], sizeof(__be32));
158 		skb_put_zero(skb, sizeof(__be32));
159 	}
160 
161 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
162 }
163 
164 #ifdef CONFIG_PM
165 static int
166 mt7925_connac_mcu_set_wow_ctrl(struct mt76_phy *phy, struct ieee80211_vif *vif,
167 			       bool suspend, struct cfg80211_wowlan *wowlan)
168 {
169 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
170 	struct mt76_dev *dev = phy->dev;
171 	struct {
172 		struct {
173 			u8 bss_idx;
174 			u8 pad[3];
175 		} __packed hdr;
176 		struct mt76_connac_wow_ctrl_tlv wow_ctrl_tlv;
177 		struct mt76_connac_wow_gpio_param_tlv gpio_tlv;
178 	} req = {
179 		.hdr = {
180 			.bss_idx = mvif->idx,
181 		},
182 		.wow_ctrl_tlv = {
183 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
184 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_ctrl_tlv)),
185 			.cmd = suspend ? 1 : 2,
186 		},
187 		.gpio_tlv = {
188 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_GPIO_PARAM),
189 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_gpio_param_tlv)),
190 			.gpio_pin = 0xff, /* follow fw about GPIO pin */
191 		},
192 	};
193 
194 	if (wowlan->magic_pkt)
195 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_MAGIC;
196 	if (wowlan->disconnect)
197 		req.wow_ctrl_tlv.trigger |= (UNI_WOW_DETECT_TYPE_DISCONNECT |
198 					     UNI_WOW_DETECT_TYPE_BCN_LOST);
199 	if (wowlan->nd_config) {
200 		mt7925_mcu_sched_scan_req(phy, vif, wowlan->nd_config);
201 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_SCH_SCAN_HIT;
202 		mt7925_mcu_sched_scan_enable(phy, vif, suspend);
203 	}
204 	if (wowlan->n_patterns)
205 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_BITMAP;
206 
207 	if (mt76_is_mmio(dev))
208 		req.wow_ctrl_tlv.wakeup_hif = WOW_PCIE;
209 	else if (mt76_is_usb(dev))
210 		req.wow_ctrl_tlv.wakeup_hif = WOW_USB;
211 	else if (mt76_is_sdio(dev))
212 		req.wow_ctrl_tlv.wakeup_hif = WOW_GPIO;
213 
214 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(SUSPEND), &req,
215 				 sizeof(req), true);
216 }
217 
218 static int
219 mt7925_mcu_set_wow_pattern(struct mt76_dev *dev,
220 			   struct ieee80211_vif *vif,
221 			   u8 index, bool enable,
222 			   struct cfg80211_pkt_pattern *pattern)
223 {
224 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
225 	struct mt7925_wow_pattern_tlv *tlv;
226 	struct sk_buff *skb;
227 	struct {
228 		u8 bss_idx;
229 		u8 pad[3];
230 	} __packed hdr = {
231 		.bss_idx = mvif->idx,
232 	};
233 
234 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(hdr) + sizeof(*tlv));
235 	if (!skb)
236 		return -ENOMEM;
237 
238 	skb_put_data(skb, &hdr, sizeof(hdr));
239 	tlv = (struct mt7925_wow_pattern_tlv *)skb_put(skb, sizeof(*tlv));
240 	tlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
241 	tlv->len = cpu_to_le16(sizeof(*tlv));
242 	tlv->bss_idx = 0xF;
243 	tlv->data_len = pattern->pattern_len;
244 	tlv->enable = enable;
245 	tlv->index = index;
246 	tlv->offset = 0;
247 
248 	memcpy(tlv->pattern, pattern->pattern, pattern->pattern_len);
249 	memcpy(tlv->mask, pattern->mask, DIV_ROUND_UP(pattern->pattern_len, 8));
250 
251 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SUSPEND), true);
252 }
253 
254 void mt7925_mcu_set_suspend_iter(void *priv, u8 *mac,
255 				 struct ieee80211_vif *vif)
256 {
257 	struct mt76_phy *phy = priv;
258 	bool suspend = !test_bit(MT76_STATE_RUNNING, &phy->state);
259 	struct ieee80211_hw *hw = phy->hw;
260 	struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
261 	int i;
262 
263 	mt76_connac_mcu_set_gtk_rekey(phy->dev, vif, suspend);
264 
265 	mt76_connac_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
266 
267 	for (i = 0; i < wowlan->n_patterns; i++)
268 		mt7925_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
269 					   &wowlan->patterns[i]);
270 	mt7925_connac_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
271 }
272 
273 #endif /* CONFIG_PM */
274 
275 static void
276 mt7925_mcu_connection_loss_iter(void *priv, u8 *mac,
277 				struct ieee80211_vif *vif)
278 {
279 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
280 	struct mt7925_uni_beacon_loss_event *event = priv;
281 
282 	if (mvif->idx != event->hdr.bss_idx)
283 		return;
284 
285 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER) ||
286 	    vif->type != NL80211_IFTYPE_STATION)
287 		return;
288 
289 	ieee80211_connection_loss(vif);
290 }
291 
292 static void
293 mt7925_mcu_connection_loss_event(struct mt792x_dev *dev, struct sk_buff *skb)
294 {
295 	struct mt7925_uni_beacon_loss_event *event;
296 	struct mt76_phy *mphy = &dev->mt76.phy;
297 
298 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd));
299 	event = (struct mt7925_uni_beacon_loss_event *)skb->data;
300 
301 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
302 					IEEE80211_IFACE_ITER_RESUME_ALL,
303 					mt7925_mcu_connection_loss_iter, event);
304 }
305 
306 static void
307 mt7925_mcu_roc_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
308 {
309 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
310 	struct mt7925_roc_grant_tlv *grant = priv;
311 
312 	if (ieee80211_vif_is_mld(vif) && vif->type == NL80211_IFTYPE_STATION)
313 		return;
314 
315 	if (mvif->idx != grant->bss_idx)
316 		return;
317 
318 	mvif->band_idx = grant->dbdcband;
319 }
320 
321 static void mt7925_mcu_roc_handle_grant(struct mt792x_dev *dev,
322 					struct tlv *tlv)
323 {
324 	struct ieee80211_hw *hw = dev->mt76.hw;
325 	struct mt7925_roc_grant_tlv *grant;
326 	int duration;
327 
328 	grant = (struct mt7925_roc_grant_tlv *)tlv;
329 
330 	/* should never happen */
331 	WARN_ON_ONCE((le16_to_cpu(grant->tag) != UNI_EVENT_ROC_GRANT));
332 
333 	if (grant->reqtype == MT7925_ROC_REQ_ROC)
334 		ieee80211_ready_on_channel(hw);
335 	else if (grant->reqtype == MT7925_ROC_REQ_JOIN)
336 		ieee80211_iterate_active_interfaces_atomic(hw,
337 						IEEE80211_IFACE_ITER_RESUME_ALL,
338 						mt7925_mcu_roc_iter, grant);
339 	dev->phy.roc_grant = true;
340 	wake_up(&dev->phy.roc_wait);
341 	duration = le32_to_cpu(grant->max_interval);
342 	mod_timer(&dev->phy.roc_timer,
343 		  jiffies + msecs_to_jiffies(duration));
344 }
345 
346 static void
347 mt7925_mcu_uni_roc_event(struct mt792x_dev *dev, struct sk_buff *skb)
348 {
349 	struct tlv *tlv;
350 	int i = 0;
351 
352 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
353 
354 	while (i < skb->len) {
355 		tlv = (struct tlv *)(skb->data + i);
356 
357 		switch (le16_to_cpu(tlv->tag)) {
358 		case UNI_EVENT_ROC_GRANT:
359 			mt7925_mcu_roc_handle_grant(dev, tlv);
360 			break;
361 		case UNI_EVENT_ROC_GRANT_SUB_LINK:
362 			break;
363 		}
364 
365 		i += le16_to_cpu(tlv->len);
366 	}
367 }
368 
369 static void
370 mt7925_mcu_scan_event(struct mt792x_dev *dev, struct sk_buff *skb)
371 {
372 	struct mt76_phy *mphy = &dev->mt76.phy;
373 	struct mt792x_phy *phy = mphy->priv;
374 
375 	spin_lock_bh(&dev->mt76.lock);
376 	__skb_queue_tail(&phy->scan_event_list, skb);
377 	spin_unlock_bh(&dev->mt76.lock);
378 
379 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
380 				     MT792x_HW_SCAN_TIMEOUT);
381 }
382 
383 static void
384 mt7925_mcu_tx_done_event(struct mt792x_dev *dev, struct sk_buff *skb)
385 {
386 #define UNI_EVENT_TX_DONE_MSG 0
387 #define UNI_EVENT_TX_DONE_RAW 1
388 	struct mt7925_mcu_txs_event {
389 		u8 ver;
390 		u8 rsv[3];
391 		u8 data[0];
392 	} __packed * txs;
393 	struct tlv *tlv;
394 	u32 tlv_len;
395 
396 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
397 	tlv = (struct tlv *)skb->data;
398 	tlv_len = skb->len;
399 
400 	while (tlv_len > 0 && le16_to_cpu(tlv->len) <= tlv_len) {
401 		switch (le16_to_cpu(tlv->tag)) {
402 		case UNI_EVENT_TX_DONE_RAW:
403 			txs = (struct mt7925_mcu_txs_event *)tlv->data;
404 			mt7925_mac_add_txs(dev, txs->data);
405 			break;
406 		default:
407 			break;
408 		}
409 		tlv_len -= le16_to_cpu(tlv->len);
410 		tlv = (struct tlv *)((char *)(tlv) + le16_to_cpu(tlv->len));
411 	}
412 }
413 
414 static void
415 mt7925_mcu_uni_debug_msg_event(struct mt792x_dev *dev, struct sk_buff *skb)
416 {
417 	struct mt7925_uni_debug_msg {
418 		__le16 tag;
419 		__le16 len;
420 		u8 fmt;
421 		u8 rsv[3];
422 		u8 id;
423 		u8 type:3;
424 		u8 nr_args:5;
425 		union {
426 			struct idxlog {
427 				__le16 rsv;
428 				__le32 ts;
429 				__le32 idx;
430 				u8 data[];
431 			} __packed idx;
432 			struct txtlog {
433 				u8 len;
434 				u8 rsv;
435 				__le32 ts;
436 				u8 data[];
437 			} __packed txt;
438 		};
439 	} __packed * hdr;
440 
441 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
442 	hdr = (struct mt7925_uni_debug_msg *)skb->data;
443 
444 	if (hdr->id == 0x28) {
445 		skb_pull(skb, offsetof(struct mt7925_uni_debug_msg, id));
446 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", skb->len, skb->data);
447 		return;
448 	} else if (hdr->id != 0xa8) {
449 		return;
450 	}
451 
452 	if (hdr->type == 0) { /* idx log */
453 		int i, ret, len = PAGE_SIZE - 1, nr_val;
454 		struct page *page = dev_alloc_pages(get_order(len));
455 		__le32 *val;
456 		char *buf, *cur;
457 
458 		if (!page)
459 			return;
460 
461 		buf = page_address(page);
462 		cur = buf;
463 
464 		nr_val = (le16_to_cpu(hdr->len) - sizeof(*hdr)) / 4;
465 		val = (__le32 *)hdr->idx.data;
466 		for (i = 0; i < nr_val && len > 0; i++) {
467 			ret = snprintf(cur, len, "0x%x,", le32_to_cpu(val[i]));
468 			if (ret <= 0)
469 				break;
470 
471 			cur += ret;
472 			len -= ret;
473 		}
474 		if (cur > buf)
475 			wiphy_info(mt76_hw(dev)->wiphy, "idx: 0x%X,%d,%s",
476 				   le32_to_cpu(hdr->idx.idx), nr_val, buf);
477 		put_page(page);
478 	} else if (hdr->type == 2) { /* str log */
479 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", hdr->txt.len, hdr->txt.data);
480 	}
481 }
482 
483 static void
484 mt7925_mcu_uni_rx_unsolicited_event(struct mt792x_dev *dev,
485 				    struct sk_buff *skb)
486 {
487 	struct mt7925_mcu_rxd *rxd;
488 
489 	rxd = (struct mt7925_mcu_rxd *)skb->data;
490 
491 	switch (rxd->eid) {
492 	case MCU_UNI_EVENT_FW_LOG_2_HOST:
493 		mt7925_mcu_uni_debug_msg_event(dev, skb);
494 		break;
495 	case MCU_UNI_EVENT_ROC:
496 		mt7925_mcu_uni_roc_event(dev, skb);
497 		break;
498 	case MCU_UNI_EVENT_SCAN_DONE:
499 		mt7925_mcu_scan_event(dev, skb);
500 		return;
501 	case MCU_UNI_EVENT_TX_DONE:
502 		mt7925_mcu_tx_done_event(dev, skb);
503 		break;
504 	case MCU_UNI_EVENT_BSS_BEACON_LOSS:
505 		mt7925_mcu_connection_loss_event(dev, skb);
506 		break;
507 	case MCU_UNI_EVENT_COREDUMP:
508 		dev->fw_assert = true;
509 		mt76_connac_mcu_coredump_event(&dev->mt76, skb, &dev->coredump);
510 		return;
511 	default:
512 		break;
513 	}
514 	dev_kfree_skb(skb);
515 }
516 
517 void mt7925_mcu_rx_event(struct mt792x_dev *dev, struct sk_buff *skb)
518 {
519 	struct mt7925_mcu_rxd *rxd = (struct mt7925_mcu_rxd *)skb->data;
520 
521 	if (skb_linearize(skb))
522 		return;
523 
524 	if (rxd->option & MCU_UNI_CMD_UNSOLICITED_EVENT) {
525 		mt7925_mcu_uni_rx_unsolicited_event(dev, skb);
526 		return;
527 	}
528 
529 	mt76_mcu_rx_event(&dev->mt76, skb);
530 }
531 
532 static int
533 mt7925_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
534 		  struct ieee80211_ampdu_params *params,
535 		  bool enable, bool tx)
536 {
537 	struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv;
538 	struct sta_rec_ba_uni *ba;
539 	struct sk_buff *skb;
540 	struct tlv *tlv;
541 	int len;
542 
543 	len = sizeof(struct sta_req_hdr) + sizeof(*ba);
544 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid,
545 					      len);
546 	if (IS_ERR(skb))
547 		return PTR_ERR(skb);
548 
549 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
550 
551 	ba = (struct sta_rec_ba_uni *)tlv;
552 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
553 	ba->winsize = cpu_to_le16(params->buf_size);
554 	ba->ssn = cpu_to_le16(params->ssn);
555 	ba->ba_en = enable << params->tid;
556 	ba->amsdu = params->amsdu;
557 	ba->tid = params->tid;
558 
559 	return mt76_mcu_skb_send_msg(dev, skb,
560 				     MCU_UNI_CMD(STA_REC_UPDATE), true);
561 }
562 
563 /** starec & wtbl **/
564 int mt7925_mcu_uni_tx_ba(struct mt792x_dev *dev,
565 			 struct ieee80211_ampdu_params *params,
566 			 bool enable)
567 {
568 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
569 	struct mt792x_vif *mvif = msta->vif;
570 
571 	if (enable && !params->amsdu)
572 		msta->deflink.wcid.amsdu = false;
573 
574 	return mt7925_mcu_sta_ba(&dev->mt76, &mvif->bss_conf.mt76, params,
575 				 enable, true);
576 }
577 
578 int mt7925_mcu_uni_rx_ba(struct mt792x_dev *dev,
579 			 struct ieee80211_ampdu_params *params,
580 			 bool enable)
581 {
582 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
583 	struct mt792x_vif *mvif = msta->vif;
584 
585 	return mt7925_mcu_sta_ba(&dev->mt76, &mvif->bss_conf.mt76, params,
586 				 enable, false);
587 }
588 
589 static int mt7925_load_clc(struct mt792x_dev *dev, const char *fw_name)
590 {
591 	const struct mt76_connac2_fw_trailer *hdr;
592 	const struct mt76_connac2_fw_region *region;
593 	const struct mt7925_clc *clc;
594 	struct mt76_dev *mdev = &dev->mt76;
595 	struct mt792x_phy *phy = &dev->phy;
596 	const struct firmware *fw;
597 	int ret, i, len, offset = 0;
598 	u8 *clc_base = NULL;
599 
600 	if (mt7925_disable_clc ||
601 	    mt76_is_usb(&dev->mt76))
602 		return 0;
603 
604 	ret = request_firmware(&fw, fw_name, mdev->dev);
605 	if (ret)
606 		return ret;
607 
608 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
609 		dev_err(mdev->dev, "Invalid firmware\n");
610 		ret = -EINVAL;
611 		goto out;
612 	}
613 
614 	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
615 	for (i = 0; i < hdr->n_region; i++) {
616 		region = (const void *)((const u8 *)hdr -
617 					(hdr->n_region - i) * sizeof(*region));
618 		len = le32_to_cpu(region->len);
619 
620 		/* check if we have valid buffer size */
621 		if (offset + len > fw->size) {
622 			dev_err(mdev->dev, "Invalid firmware region\n");
623 			ret = -EINVAL;
624 			goto out;
625 		}
626 
627 		if ((region->feature_set & FW_FEATURE_NON_DL) &&
628 		    region->type == FW_TYPE_CLC) {
629 			clc_base = (u8 *)(fw->data + offset);
630 			break;
631 		}
632 		offset += len;
633 	}
634 
635 	if (!clc_base)
636 		goto out;
637 
638 	for (offset = 0; offset < len; offset += le32_to_cpu(clc->len)) {
639 		clc = (const struct mt7925_clc *)(clc_base + offset);
640 
641 		/* do not init buf again if chip reset triggered */
642 		if (phy->clc[clc->idx])
643 			continue;
644 
645 		phy->clc[clc->idx] = devm_kmemdup(mdev->dev, clc,
646 						  le32_to_cpu(clc->len),
647 						  GFP_KERNEL);
648 
649 		if (!phy->clc[clc->idx]) {
650 			ret = -ENOMEM;
651 			goto out;
652 		}
653 	}
654 
655 	ret = mt7925_mcu_set_clc(dev, "00", ENVIRON_INDOOR);
656 out:
657 	release_firmware(fw);
658 
659 	return ret;
660 }
661 
662 int mt7925_mcu_fw_log_2_host(struct mt792x_dev *dev, u8 ctrl)
663 {
664 	struct {
665 		u8 _rsv[4];
666 
667 		__le16 tag;
668 		__le16 len;
669 		u8 ctrl;
670 		u8 interval;
671 		u8 _rsv2[2];
672 	} __packed req = {
673 		.tag = cpu_to_le16(UNI_WSYS_CONFIG_FW_LOG_CTRL),
674 		.len = cpu_to_le16(sizeof(req) - 4),
675 		.ctrl = ctrl,
676 	};
677 	int ret;
678 
679 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(WSYS_CONFIG),
680 					&req, sizeof(req), false, NULL);
681 	return ret;
682 }
683 
684 int mt7925_mcu_get_temperature(struct mt792x_phy *phy)
685 {
686 	struct {
687 		u8 _rsv[4];
688 
689 		__le16 tag;
690 		__le16 len;
691 		u8 _rsv2[4];
692 	} __packed req = {
693 		.tag = cpu_to_le16(0x0),
694 		.len = cpu_to_le16(sizeof(req) - 4),
695 	};
696 	struct mt7925_thermal_evt {
697 		u8 rsv[4];
698 		__le32 temperature;
699 	} __packed * evt;
700 	struct mt792x_dev *dev = phy->dev;
701 	int temperature, ret;
702 	struct sk_buff *skb;
703 
704 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
705 					MCU_WM_UNI_CMD_QUERY(THERMAL),
706 					&req, sizeof(req), true, &skb);
707 	if (ret)
708 		return ret;
709 
710 	skb_pull(skb, 4 + sizeof(struct tlv));
711 	evt = (struct mt7925_thermal_evt *)skb->data;
712 
713 	temperature = le32_to_cpu(evt->temperature);
714 
715 	dev_kfree_skb(skb);
716 
717 	return temperature;
718 }
719 
720 static void
721 mt7925_mcu_parse_phy_cap(struct mt792x_dev *dev, char *data)
722 {
723 	struct mt76_phy *mphy = &dev->mt76.phy;
724 	struct mt76_dev *mdev = mphy->dev;
725 	struct mt7925_mcu_phy_cap {
726 		u8 ht;
727 		u8 vht;
728 		u8 _5g;
729 		u8 max_bw;
730 		u8 nss;
731 		u8 dbdc;
732 		u8 tx_ldpc;
733 		u8 rx_ldpc;
734 		u8 tx_stbc;
735 		u8 rx_stbc;
736 		u8 hw_path;
737 		u8 he;
738 		u8 eht;
739 	} __packed * cap;
740 	enum {
741 		WF0_24G,
742 		WF0_5G
743 	};
744 
745 	cap = (struct mt7925_mcu_phy_cap *)data;
746 
747 	mdev->phy.antenna_mask = BIT(cap->nss) - 1;
748 	mdev->phy.chainmask = mdev->phy.antenna_mask;
749 	mdev->phy.cap.has_2ghz = cap->hw_path & BIT(WF0_24G);
750 	mdev->phy.cap.has_5ghz = cap->hw_path & BIT(WF0_5G);
751 	dev->has_eht = cap->eht;
752 }
753 
754 static void
755 mt7925_mcu_parse_eml_cap(struct mt792x_dev *dev, char *data)
756 {
757 	struct mt7925_mcu_eml_cap {
758 		u8 rsv[4];
759 		__le16 eml_cap;
760 		u8 rsv2[6];
761 	} __packed * cap;
762 
763 	cap = (struct mt7925_mcu_eml_cap *)data;
764 
765 	dev->phy.eml_cap = le16_to_cpu(cap->eml_cap);
766 }
767 
768 static int
769 mt7925_mcu_get_nic_capability(struct mt792x_dev *dev)
770 {
771 	struct mt76_phy *mphy = &dev->mt76.phy;
772 	struct {
773 		u8 _rsv[4];
774 
775 		__le16 tag;
776 		__le16 len;
777 	} __packed req = {
778 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_NIC_CAPA),
779 		.len = cpu_to_le16(sizeof(req) - 4),
780 	};
781 	struct mt76_connac_cap_hdr {
782 		__le16 n_element;
783 		u8 rsv[2];
784 	} __packed * hdr;
785 	struct sk_buff *skb;
786 	int ret, i;
787 
788 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
789 					&req, sizeof(req), true, &skb);
790 	if (ret)
791 		return ret;
792 
793 	hdr = (struct mt76_connac_cap_hdr *)skb->data;
794 	if (skb->len < sizeof(*hdr)) {
795 		ret = -EINVAL;
796 		goto out;
797 	}
798 
799 	skb_pull(skb, sizeof(*hdr));
800 
801 	for (i = 0; i < le16_to_cpu(hdr->n_element); i++) {
802 		struct tlv *tlv = (struct tlv *)skb->data;
803 		int len;
804 
805 		if (skb->len < sizeof(*tlv))
806 			break;
807 
808 		len = le16_to_cpu(tlv->len);
809 		if (skb->len < len)
810 			break;
811 
812 		switch (le16_to_cpu(tlv->tag)) {
813 		case MT_NIC_CAP_6G:
814 			mphy->cap.has_6ghz = !!tlv->data[0];
815 			break;
816 		case MT_NIC_CAP_MAC_ADDR:
817 			memcpy(mphy->macaddr, (void *)tlv->data, ETH_ALEN);
818 			break;
819 		case MT_NIC_CAP_PHY:
820 			mt7925_mcu_parse_phy_cap(dev, tlv->data);
821 			break;
822 		case MT_NIC_CAP_CHIP_CAP:
823 			memcpy(&dev->phy.chip_cap, (void *)skb->data, sizeof(u64));
824 			break;
825 		case MT_NIC_CAP_EML_CAP:
826 			mt7925_mcu_parse_eml_cap(dev, tlv->data);
827 			break;
828 		default:
829 			break;
830 		}
831 		skb_pull(skb, len);
832 	}
833 out:
834 	dev_kfree_skb(skb);
835 	return ret;
836 }
837 
838 int mt7925_mcu_chip_config(struct mt792x_dev *dev, const char *cmd)
839 {
840 	u16 len = strlen(cmd) + 1;
841 	struct {
842 		u8 _rsv[4];
843 		__le16 tag;
844 		__le16 len;
845 		struct mt76_connac_config config;
846 	} __packed req = {
847 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_CHIP_CFG),
848 		.len = cpu_to_le16(sizeof(req) - 4),
849 		.config = {
850 			.resp_type = 0,
851 			.type = 0,
852 			.data_size = cpu_to_le16(len),
853 		},
854 	};
855 
856 	memcpy(req.config.data, cmd, len);
857 
858 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
859 				 &req, sizeof(req), false);
860 }
861 
862 int mt7925_mcu_set_deep_sleep(struct mt792x_dev *dev, bool enable)
863 {
864 	char cmd[16];
865 
866 	snprintf(cmd, sizeof(cmd), "KeepFullPwr %d", !enable);
867 
868 	return mt7925_mcu_chip_config(dev, cmd);
869 }
870 EXPORT_SYMBOL_GPL(mt7925_mcu_set_deep_sleep);
871 
872 int mt7925_run_firmware(struct mt792x_dev *dev)
873 {
874 	int err;
875 
876 	err = mt792x_load_firmware(dev);
877 	if (err)
878 		return err;
879 
880 	err = mt7925_mcu_get_nic_capability(dev);
881 	if (err)
882 		return err;
883 
884 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
885 	err = mt7925_load_clc(dev, mt792x_ram_name(dev));
886 	if (err)
887 		return err;
888 
889 	return mt7925_mcu_fw_log_2_host(dev, 1);
890 }
891 EXPORT_SYMBOL_GPL(mt7925_run_firmware);
892 
893 static void
894 mt7925_mcu_sta_hdr_trans_tlv(struct sk_buff *skb,
895 			     struct ieee80211_vif *vif,
896 			     struct ieee80211_link_sta *link_sta)
897 {
898 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
899 	struct sta_rec_hdr_trans *hdr_trans;
900 	struct mt76_wcid *wcid;
901 	struct tlv *tlv;
902 
903 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HDR_TRANS, sizeof(*hdr_trans));
904 	hdr_trans = (struct sta_rec_hdr_trans *)tlv;
905 	hdr_trans->dis_rx_hdr_tran = true;
906 
907 	if (vif->type == NL80211_IFTYPE_STATION)
908 		hdr_trans->to_ds = true;
909 	else
910 		hdr_trans->from_ds = true;
911 
912 	if (link_sta) {
913 		struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
914 		struct mt792x_link_sta *mlink;
915 
916 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
917 		wcid = &mlink->wcid;
918 	} else {
919 		wcid = &mvif->sta.deflink.wcid;
920 	}
921 
922 	if (!wcid)
923 		return;
924 
925 	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
926 	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
927 		hdr_trans->to_ds = true;
928 		hdr_trans->from_ds = true;
929 	}
930 }
931 
932 int mt7925_mcu_wtbl_update_hdr_trans(struct mt792x_dev *dev,
933 				     struct ieee80211_vif *vif,
934 				     struct ieee80211_sta *sta,
935 				     int link_id)
936 {
937 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
938 	struct ieee80211_link_sta *link_sta = sta ? &sta->deflink : NULL;
939 	struct mt792x_link_sta *mlink;
940 	struct mt792x_bss_conf *mconf;
941 	struct mt792x_sta *msta;
942 	struct sk_buff *skb;
943 
944 	msta = sta ? (struct mt792x_sta *)sta->drv_priv : &mvif->sta;
945 
946 	mlink = mt792x_sta_to_link(msta, link_id);
947 	link_sta = mt792x_sta_to_link_sta(vif, sta, link_id);
948 	mconf = mt792x_vif_to_link(mvif, link_id);
949 
950 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
951 					      &mlink->wcid,
952 					      MT7925_STA_UPDATE_MAX_SIZE);
953 	if (IS_ERR(skb))
954 		return PTR_ERR(skb);
955 
956 	/* starec hdr trans */
957 	mt7925_mcu_sta_hdr_trans_tlv(skb, vif, link_sta);
958 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
959 				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
960 }
961 
962 int mt7925_mcu_set_tx(struct mt792x_dev *dev,
963 		      struct ieee80211_bss_conf *bss_conf)
964 {
965 #define MCU_EDCA_AC_PARAM	0
966 #define WMM_AIFS_SET		BIT(0)
967 #define WMM_CW_MIN_SET		BIT(1)
968 #define WMM_CW_MAX_SET		BIT(2)
969 #define WMM_TXOP_SET		BIT(3)
970 #define WMM_PARAM_SET		(WMM_AIFS_SET | WMM_CW_MIN_SET | \
971 				 WMM_CW_MAX_SET | WMM_TXOP_SET)
972 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(bss_conf);
973 	struct {
974 		u8 bss_idx;
975 		u8 __rsv[3];
976 	} __packed hdr = {
977 		.bss_idx = mconf->mt76.idx,
978 	};
979 	struct sk_buff *skb;
980 	int len = sizeof(hdr) + IEEE80211_NUM_ACS * sizeof(struct edca);
981 	int ac;
982 
983 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
984 	if (!skb)
985 		return -ENOMEM;
986 
987 	skb_put_data(skb, &hdr, sizeof(hdr));
988 
989 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
990 		struct ieee80211_tx_queue_params *q = &mconf->queue_params[ac];
991 		struct edca *e;
992 		struct tlv *tlv;
993 
994 		tlv = mt76_connac_mcu_add_tlv(skb, MCU_EDCA_AC_PARAM, sizeof(*e));
995 
996 		e = (struct edca *)tlv;
997 		e->set = WMM_PARAM_SET;
998 		e->queue = ac;
999 		e->aifs = q->aifs;
1000 		e->txop = cpu_to_le16(q->txop);
1001 
1002 		if (q->cw_min)
1003 			e->cw_min = fls(q->cw_min);
1004 		else
1005 			e->cw_min = 5;
1006 
1007 		if (q->cw_max)
1008 			e->cw_max = fls(q->cw_max);
1009 		else
1010 			e->cw_max = 10;
1011 	}
1012 
1013 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1014 				     MCU_UNI_CMD(EDCA_UPDATE), true);
1015 }
1016 
1017 static int
1018 mt7925_mcu_sta_key_tlv(struct mt76_wcid *wcid,
1019 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1020 		       struct sk_buff *skb,
1021 		       struct ieee80211_key_conf *key,
1022 		       enum set_key_cmd cmd,
1023 		       struct mt792x_sta *msta)
1024 {
1025 	struct mt792x_vif *mvif = msta->vif;
1026 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1027 	struct sta_rec_sec_uni *sec;
1028 	struct ieee80211_sta *sta;
1029 	struct ieee80211_vif *vif;
1030 	struct tlv *tlv;
1031 
1032 	sta = msta == &mvif->sta ?
1033 		      NULL :
1034 		      container_of((void *)msta, struct ieee80211_sta, drv_priv);
1035 	vif = container_of((void *)mvif, struct ieee80211_vif, drv_priv);
1036 
1037 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V3, sizeof(*sec));
1038 	sec = (struct sta_rec_sec_uni *)tlv;
1039 	sec->bss_idx = mconf->mt76.idx;
1040 	sec->is_authenticator = 0;
1041 	sec->mgmt_prot = 1; /* only used in MLO mode */
1042 	sec->wlan_idx = (u8)wcid->idx;
1043 
1044 	if (sta) {
1045 		struct ieee80211_link_sta *link_sta;
1046 
1047 		sec->tx_key = 1;
1048 		sec->key_type = 1;
1049 		link_sta = mt792x_sta_to_link_sta(vif, sta, wcid->link_id);
1050 
1051 		if (link_sta)
1052 			memcpy(sec->peer_addr, link_sta->addr, ETH_ALEN);
1053 	} else {
1054 		struct ieee80211_bss_conf *link_conf;
1055 
1056 		link_conf = mt792x_vif_to_bss_conf(vif, wcid->link_id);
1057 
1058 		if (link_conf)
1059 			memcpy(sec->peer_addr, link_conf->bssid, ETH_ALEN);
1060 	}
1061 
1062 	if (cmd == SET_KEY) {
1063 		u8 cipher;
1064 
1065 		sec->add = 1;
1066 		cipher = mt7925_mcu_get_cipher(key->cipher);
1067 		if (cipher == CONNAC3_CIPHER_NONE)
1068 			return -EOPNOTSUPP;
1069 
1070 		if (cipher == CONNAC3_CIPHER_BIP_CMAC_128) {
1071 			sec->cipher_id = CONNAC3_CIPHER_BIP_CMAC_128;
1072 			sec->key_id = sta_key_conf->keyidx;
1073 			sec->key_len = 32;
1074 			memcpy(sec->key, sta_key_conf->key, 16);
1075 			memcpy(sec->key + 16, key->key, 16);
1076 		} else {
1077 			sec->cipher_id = cipher;
1078 			sec->key_id = key->keyidx;
1079 			sec->key_len = key->keylen;
1080 			memcpy(sec->key, key->key, key->keylen);
1081 
1082 			if (cipher == CONNAC3_CIPHER_TKIP) {
1083 				/* Rx/Tx MIC keys are swapped */
1084 				memcpy(sec->key + 16, key->key + 24, 8);
1085 				memcpy(sec->key + 24, key->key + 16, 8);
1086 			}
1087 
1088 			/* store key_conf for BIP batch update */
1089 			if (cipher == CONNAC3_CIPHER_AES_CCMP) {
1090 				memcpy(sta_key_conf->key, key->key, key->keylen);
1091 				sta_key_conf->keyidx = key->keyidx;
1092 			}
1093 		}
1094 	} else {
1095 		sec->add = 0;
1096 	}
1097 
1098 	return 0;
1099 }
1100 
1101 int mt7925_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
1102 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1103 		       struct ieee80211_key_conf *key, int mcu_cmd,
1104 		       struct mt76_wcid *wcid, enum set_key_cmd cmd,
1105 		       struct mt792x_sta *msta)
1106 {
1107 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1108 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1109 	struct sk_buff *skb;
1110 	int ret;
1111 
1112 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, wcid,
1113 					      MT7925_STA_UPDATE_MAX_SIZE);
1114 	if (IS_ERR(skb))
1115 		return PTR_ERR(skb);
1116 
1117 	ret = mt7925_mcu_sta_key_tlv(wcid, sta_key_conf, skb, key, cmd, msta);
1118 	if (ret)
1119 		return ret;
1120 
1121 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
1122 }
1123 
1124 int mt7925_mcu_set_mlo_roc(struct mt792x_bss_conf *mconf, u16 sel_links,
1125 			   int duration, u8 token_id)
1126 {
1127 	struct mt792x_vif *mvif = mconf->vif;
1128 	struct ieee80211_vif *vif = container_of((void *)mvif,
1129 						 struct ieee80211_vif, drv_priv);
1130 	struct ieee80211_bss_conf *link_conf;
1131 	struct ieee80211_channel *chan;
1132 	const u8 ch_band[] = {
1133 		[NL80211_BAND_2GHZ] = 1,
1134 		[NL80211_BAND_5GHZ] = 2,
1135 		[NL80211_BAND_6GHZ] = 3,
1136 	};
1137 	enum mt7925_roc_req type;
1138 	int center_ch, i = 0;
1139 	bool is_AG_band = false;
1140 	struct {
1141 		u8 id;
1142 		u8 bss_idx;
1143 		u16 tag;
1144 		struct mt792x_bss_conf *mconf;
1145 		struct ieee80211_channel *chan;
1146 	} links[2];
1147 
1148 	struct {
1149 		struct {
1150 			u8 rsv[4];
1151 		} __packed hdr;
1152 		struct roc_acquire_tlv roc[2];
1153 	} __packed req;
1154 
1155 	if (!mconf || hweight16(vif->valid_links) < 2 ||
1156 	    hweight16(sel_links) != 2)
1157 		return -EPERM;
1158 
1159 	for (i = 0; i < ARRAY_SIZE(links); i++) {
1160 		links[i].id = i ? __ffs(~BIT(mconf->link_id) & sel_links) :
1161 				 mconf->link_id;
1162 		link_conf = mt792x_vif_to_bss_conf(vif, links[i].id);
1163 		if (WARN_ON_ONCE(!link_conf))
1164 			return -EPERM;
1165 
1166 		links[i].chan = link_conf->chanreq.oper.chan;
1167 		if (WARN_ON_ONCE(!links[i].chan))
1168 			return -EPERM;
1169 
1170 		links[i].mconf = mt792x_vif_to_link(mvif, links[i].id);
1171 		links[i].tag = links[i].id == mconf->link_id ?
1172 			       UNI_ROC_ACQUIRE : UNI_ROC_SUB_LINK;
1173 
1174 		is_AG_band |= links[i].chan->band == NL80211_BAND_2GHZ;
1175 	}
1176 
1177 	if (vif->cfg.eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP)
1178 		type = is_AG_band ? MT7925_ROC_REQ_MLSR_AG :
1179 				    MT7925_ROC_REQ_MLSR_AA;
1180 	else
1181 		type = MT7925_ROC_REQ_JOIN;
1182 
1183 	for (i = 0; i < ARRAY_SIZE(links) && i < hweight16(vif->active_links); i++) {
1184 		if (WARN_ON_ONCE(!links[i].mconf || !links[i].chan))
1185 			continue;
1186 
1187 		chan = links[i].chan;
1188 		center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1189 		req.roc[i].len = cpu_to_le16(sizeof(struct roc_acquire_tlv));
1190 		req.roc[i].tag = cpu_to_le16(links[i].tag);
1191 		req.roc[i].tokenid = token_id;
1192 		req.roc[i].reqtype = type;
1193 		req.roc[i].maxinterval = cpu_to_le32(duration);
1194 		req.roc[i].bss_idx = links[i].mconf->mt76.idx;
1195 		req.roc[i].control_channel = chan->hw_value;
1196 		req.roc[i].bw = CMD_CBW_20MHZ;
1197 		req.roc[i].bw_from_ap = CMD_CBW_20MHZ;
1198 		req.roc[i].center_chan = center_ch;
1199 		req.roc[i].center_chan_from_ap = center_ch;
1200 
1201 		/* STR : 0xfe indicates BAND_ALL with enabling DBDC
1202 		 * EMLSR : 0xff indicates (BAND_AUTO) without DBDC
1203 		 */
1204 		req.roc[i].dbdcband = type == MT7925_ROC_REQ_JOIN ? 0xfe : 0xff;
1205 
1206 		if (chan->hw_value < center_ch)
1207 			req.roc[i].sco = 1; /* SCA */
1208 		else if (chan->hw_value > center_ch)
1209 			req.roc[i].sco = 3; /* SCB */
1210 
1211 		req.roc[i].band = ch_band[chan->band];
1212 	}
1213 
1214 	return mt76_mcu_send_msg(&mvif->phy->dev->mt76, MCU_UNI_CMD(ROC),
1215 				 &req, sizeof(req), false);
1216 }
1217 
1218 int mt7925_mcu_set_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1219 		       struct ieee80211_channel *chan, int duration,
1220 		       enum mt7925_roc_req type, u8 token_id)
1221 {
1222 	int center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1223 	struct mt792x_dev *dev = phy->dev;
1224 	struct {
1225 		struct {
1226 			u8 rsv[4];
1227 		} __packed hdr;
1228 		struct roc_acquire_tlv roc;
1229 	} __packed req = {
1230 		.roc = {
1231 			.tag = cpu_to_le16(UNI_ROC_ACQUIRE),
1232 			.len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1233 			.tokenid = token_id,
1234 			.reqtype = type,
1235 			.maxinterval = cpu_to_le32(duration),
1236 			.bss_idx = mconf->mt76.idx,
1237 			.control_channel = chan->hw_value,
1238 			.bw = CMD_CBW_20MHZ,
1239 			.bw_from_ap = CMD_CBW_20MHZ,
1240 			.center_chan = center_ch,
1241 			.center_chan_from_ap = center_ch,
1242 			.dbdcband = 0xff, /* auto */
1243 		},
1244 	};
1245 
1246 	if (chan->hw_value < center_ch)
1247 		req.roc.sco = 1; /* SCA */
1248 	else if (chan->hw_value > center_ch)
1249 		req.roc.sco = 3; /* SCB */
1250 
1251 	switch (chan->band) {
1252 	case NL80211_BAND_6GHZ:
1253 		req.roc.band = 3;
1254 		break;
1255 	case NL80211_BAND_5GHZ:
1256 		req.roc.band = 2;
1257 		break;
1258 	default:
1259 		req.roc.band = 1;
1260 		break;
1261 	}
1262 
1263 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1264 				 &req, sizeof(req), false);
1265 }
1266 
1267 int mt7925_mcu_abort_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1268 			 u8 token_id)
1269 {
1270 	struct mt792x_dev *dev = phy->dev;
1271 	struct {
1272 		struct {
1273 			u8 rsv[4];
1274 		} __packed hdr;
1275 		struct roc_abort_tlv {
1276 			__le16 tag;
1277 			__le16 len;
1278 			u8 bss_idx;
1279 			u8 tokenid;
1280 			u8 dbdcband;
1281 			u8 rsv[5];
1282 		} __packed abort;
1283 	} __packed req = {
1284 		.abort = {
1285 			.tag = cpu_to_le16(UNI_ROC_ABORT),
1286 			.len = cpu_to_le16(sizeof(struct roc_abort_tlv)),
1287 			.tokenid = token_id,
1288 			.bss_idx = mconf->mt76.idx,
1289 			.dbdcband = 0xff, /* auto*/
1290 		},
1291 	};
1292 
1293 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1294 				 &req, sizeof(req), false);
1295 }
1296 
1297 int mt7925_mcu_set_eeprom(struct mt792x_dev *dev)
1298 {
1299 	struct {
1300 		u8 _rsv[4];
1301 
1302 		__le16 tag;
1303 		__le16 len;
1304 		u8 buffer_mode;
1305 		u8 format;
1306 		__le16 buf_len;
1307 	} __packed req = {
1308 		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
1309 		.len = cpu_to_le16(sizeof(req) - 4),
1310 		.buffer_mode = EE_MODE_EFUSE,
1311 		.format = EE_FORMAT_WHOLE
1312 	};
1313 
1314 	return mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(EFUSE_CTRL),
1315 					 &req, sizeof(req), false, NULL);
1316 }
1317 EXPORT_SYMBOL_GPL(mt7925_mcu_set_eeprom);
1318 
1319 int mt7925_mcu_uni_bss_ps(struct mt792x_dev *dev,
1320 			  struct ieee80211_bss_conf *link_conf)
1321 {
1322 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1323 	struct {
1324 		struct {
1325 			u8 bss_idx;
1326 			u8 pad[3];
1327 		} __packed hdr;
1328 		struct ps_tlv {
1329 			__le16 tag;
1330 			__le16 len;
1331 			u8 ps_state; /* 0: device awake
1332 				      * 1: static power save
1333 				      * 2: dynamic power saving
1334 				      * 3: enter TWT power saving
1335 				      * 4: leave TWT power saving
1336 				      */
1337 			u8 pad[3];
1338 		} __packed ps;
1339 	} __packed ps_req = {
1340 		.hdr = {
1341 			.bss_idx = mconf->mt76.idx,
1342 		},
1343 		.ps = {
1344 			.tag = cpu_to_le16(UNI_BSS_INFO_PS),
1345 			.len = cpu_to_le16(sizeof(struct ps_tlv)),
1346 			.ps_state = link_conf->vif->cfg.ps ? 2 : 0,
1347 		},
1348 	};
1349 
1350 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1351 		return -EOPNOTSUPP;
1352 
1353 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1354 				 &ps_req, sizeof(ps_req), true);
1355 }
1356 
1357 static int
1358 mt7925_mcu_uni_bss_bcnft(struct mt792x_dev *dev,
1359 			 struct ieee80211_bss_conf *link_conf, bool enable)
1360 {
1361 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1362 	struct {
1363 		struct {
1364 			u8 bss_idx;
1365 			u8 pad[3];
1366 		} __packed hdr;
1367 		struct bcnft_tlv {
1368 			__le16 tag;
1369 			__le16 len;
1370 			__le16 bcn_interval;
1371 			u8 dtim_period;
1372 			u8 bmc_delivered_ac;
1373 			u8 bmc_triggered_ac;
1374 			u8 pad[3];
1375 		} __packed bcnft;
1376 	} __packed bcnft_req = {
1377 		.hdr = {
1378 			.bss_idx = mconf->mt76.idx,
1379 		},
1380 		.bcnft = {
1381 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1382 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1383 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1384 			.dtim_period = link_conf->dtim_period,
1385 		},
1386 	};
1387 
1388 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1389 		return 0;
1390 
1391 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1392 				 &bcnft_req, sizeof(bcnft_req), true);
1393 }
1394 
1395 int
1396 mt7925_mcu_set_bss_pm(struct mt792x_dev *dev,
1397 		      struct ieee80211_bss_conf *link_conf,
1398 		      bool enable)
1399 {
1400 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1401 	struct {
1402 		struct {
1403 			u8 bss_idx;
1404 			u8 pad[3];
1405 		} __packed hdr;
1406 		struct bcnft_tlv {
1407 			__le16 tag;
1408 			__le16 len;
1409 			__le16 bcn_interval;
1410 			u8 dtim_period;
1411 			u8 bmc_delivered_ac;
1412 			u8 bmc_triggered_ac;
1413 			u8 pad[3];
1414 		} __packed enable;
1415 	} req = {
1416 		.hdr = {
1417 			.bss_idx = mconf->mt76.idx,
1418 		},
1419 		.enable = {
1420 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1421 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1422 			.dtim_period = link_conf->dtim_period,
1423 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1424 		},
1425 	};
1426 	struct {
1427 		struct {
1428 			u8 bss_idx;
1429 			u8 pad[3];
1430 		} __packed hdr;
1431 		struct pm_disable {
1432 			__le16 tag;
1433 			__le16 len;
1434 		} __packed disable;
1435 	} req1 = {
1436 		.hdr = {
1437 			.bss_idx = mconf->mt76.idx,
1438 		},
1439 		.disable = {
1440 			.tag = cpu_to_le16(UNI_BSS_INFO_PM_DISABLE),
1441 			.len = cpu_to_le16(sizeof(struct pm_disable))
1442 		},
1443 	};
1444 	int err;
1445 
1446 	err = mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1447 				&req1, sizeof(req1), false);
1448 	if (err < 0 || !enable)
1449 		return err;
1450 
1451 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1452 				 &req, sizeof(req), false);
1453 }
1454 
1455 static void
1456 mt7925_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1457 {
1458 	if (!link_sta->he_cap.has_he)
1459 		return;
1460 
1461 	mt76_connac_mcu_sta_he_tlv_v2(skb, link_sta->sta);
1462 }
1463 
1464 static void
1465 mt7925_mcu_sta_he_6g_tlv(struct sk_buff *skb,
1466 			 struct ieee80211_link_sta *link_sta)
1467 {
1468 	struct sta_rec_he_6g_capa *he_6g;
1469 	struct tlv *tlv;
1470 
1471 	if (!link_sta->he_6ghz_capa.capa)
1472 		return;
1473 
1474 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G, sizeof(*he_6g));
1475 
1476 	he_6g = (struct sta_rec_he_6g_capa *)tlv;
1477 	he_6g->capa = link_sta->he_6ghz_capa.capa;
1478 }
1479 
1480 static void
1481 mt7925_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1482 {
1483 	struct ieee80211_eht_mcs_nss_supp *mcs_map;
1484 	struct ieee80211_eht_cap_elem_fixed *elem;
1485 	struct sta_rec_eht *eht;
1486 	struct tlv *tlv;
1487 
1488 	if (!link_sta->eht_cap.has_eht)
1489 		return;
1490 
1491 	mcs_map = &link_sta->eht_cap.eht_mcs_nss_supp;
1492 	elem = &link_sta->eht_cap.eht_cap_elem;
1493 
1494 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT, sizeof(*eht));
1495 
1496 	eht = (struct sta_rec_eht *)tlv;
1497 	eht->tid_bitmap = 0xff;
1498 	eht->mac_cap = cpu_to_le16(*(u16 *)elem->mac_cap_info);
1499 	eht->phy_cap = cpu_to_le64(*(u64 *)elem->phy_cap_info);
1500 	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
1501 
1502 	if (link_sta->bandwidth == IEEE80211_STA_RX_BW_20)
1503 		memcpy(eht->mcs_map_bw20, &mcs_map->only_20mhz, sizeof(eht->mcs_map_bw20));
1504 	memcpy(eht->mcs_map_bw80, &mcs_map->bw._80, sizeof(eht->mcs_map_bw80));
1505 	memcpy(eht->mcs_map_bw160, &mcs_map->bw._160, sizeof(eht->mcs_map_bw160));
1506 }
1507 
1508 static void
1509 mt7925_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1510 {
1511 	struct sta_rec_ht *ht;
1512 	struct tlv *tlv;
1513 
1514 	if (!link_sta->ht_cap.ht_supported)
1515 		return;
1516 
1517 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1518 
1519 	ht = (struct sta_rec_ht *)tlv;
1520 	ht->ht_cap = cpu_to_le16(link_sta->ht_cap.cap);
1521 }
1522 
1523 static void
1524 mt7925_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1525 {
1526 	struct sta_rec_vht *vht;
1527 	struct tlv *tlv;
1528 
1529 	/* For 6G band, this tlv is necessary to let hw work normally */
1530 	if (!link_sta->he_6ghz_capa.capa && !link_sta->vht_cap.vht_supported)
1531 		return;
1532 
1533 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1534 
1535 	vht = (struct sta_rec_vht *)tlv;
1536 	vht->vht_cap = cpu_to_le32(link_sta->vht_cap.cap);
1537 	vht->vht_rx_mcs_map = link_sta->vht_cap.vht_mcs.rx_mcs_map;
1538 	vht->vht_tx_mcs_map = link_sta->vht_cap.vht_mcs.tx_mcs_map;
1539 }
1540 
1541 static void
1542 mt7925_mcu_sta_amsdu_tlv(struct sk_buff *skb,
1543 			 struct ieee80211_vif *vif,
1544 			 struct ieee80211_link_sta *link_sta)
1545 {
1546 	struct mt792x_sta *msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1547 	struct mt792x_link_sta *mlink;
1548 	struct sta_rec_amsdu *amsdu;
1549 	struct tlv *tlv;
1550 
1551 	if (vif->type != NL80211_IFTYPE_STATION &&
1552 	    vif->type != NL80211_IFTYPE_AP)
1553 		return;
1554 
1555 	if (!link_sta->agg.max_amsdu_len)
1556 		return;
1557 
1558 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1559 	amsdu = (struct sta_rec_amsdu *)tlv;
1560 	amsdu->max_amsdu_num = 8;
1561 	amsdu->amsdu_en = true;
1562 
1563 	mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1564 	mlink->wcid.amsdu = true;
1565 
1566 	switch (link_sta->agg.max_amsdu_len) {
1567 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1568 		amsdu->max_mpdu_size =
1569 			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1570 		return;
1571 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
1572 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1573 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1574 		return;
1575 	default:
1576 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1577 		return;
1578 	}
1579 }
1580 
1581 static void
1582 mt7925_mcu_sta_phy_tlv(struct sk_buff *skb,
1583 		       struct ieee80211_vif *vif,
1584 		       struct ieee80211_link_sta *link_sta)
1585 {
1586 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1587 	struct ieee80211_bss_conf *link_conf;
1588 	struct cfg80211_chan_def *chandef;
1589 	struct mt792x_bss_conf *mconf;
1590 	struct sta_rec_phy *phy;
1591 	struct tlv *tlv;
1592 	u8 af = 0, mm = 0;
1593 
1594 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1595 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1596 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1597 				    &link_conf->chanreq.oper;
1598 
1599 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PHY, sizeof(*phy));
1600 	phy = (struct sta_rec_phy *)tlv;
1601 	phy->phy_type = mt76_connac_get_phy_mode_v2(mvif->phy->mt76, vif,
1602 						    chandef->chan->band,
1603 						    link_sta);
1604 	phy->basic_rate = cpu_to_le16((u16)link_conf->basic_rates);
1605 	if (link_sta->ht_cap.ht_supported) {
1606 		af = link_sta->ht_cap.ampdu_factor;
1607 		mm = link_sta->ht_cap.ampdu_density;
1608 	}
1609 
1610 	if (link_sta->vht_cap.vht_supported) {
1611 		u8 vht_af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1612 				      link_sta->vht_cap.cap);
1613 
1614 		af = max_t(u8, af, vht_af);
1615 	}
1616 
1617 	if (link_sta->he_6ghz_capa.capa) {
1618 		af = le16_get_bits(link_sta->he_6ghz_capa.capa,
1619 				   IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1620 		mm = le16_get_bits(link_sta->he_6ghz_capa.capa,
1621 				   IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
1622 	}
1623 
1624 	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR, af) |
1625 		     FIELD_PREP(IEEE80211_HT_AMPDU_PARM_DENSITY, mm);
1626 	phy->max_ampdu_len = af;
1627 }
1628 
1629 static void
1630 mt7925_mcu_sta_state_v2_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
1631 			    struct ieee80211_link_sta *link_sta,
1632 			    struct ieee80211_vif *vif,
1633 			    u8 rcpi, u8 sta_state)
1634 {
1635 	struct sta_rec_state_v2 {
1636 		__le16 tag;
1637 		__le16 len;
1638 		u8 state;
1639 		u8 rsv[3];
1640 		__le32 flags;
1641 		u8 vht_opmode;
1642 		u8 action;
1643 		u8 rsv2[2];
1644 	} __packed * state;
1645 	struct tlv *tlv;
1646 
1647 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_STATE, sizeof(*state));
1648 	state = (struct sta_rec_state_v2 *)tlv;
1649 	state->state = sta_state;
1650 
1651 	if (link_sta->vht_cap.vht_supported) {
1652 		state->vht_opmode = link_sta->bandwidth;
1653 		state->vht_opmode |= link_sta->rx_nss <<
1654 			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
1655 	}
1656 }
1657 
1658 static void
1659 mt7925_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb,
1660 			     struct ieee80211_vif *vif,
1661 			     struct ieee80211_link_sta *link_sta)
1662 {
1663 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1664 	struct ieee80211_bss_conf *link_conf;
1665 	struct cfg80211_chan_def *chandef;
1666 	struct sta_rec_ra_info *ra_info;
1667 	struct mt792x_bss_conf *mconf;
1668 	enum nl80211_band band;
1669 	struct tlv *tlv;
1670 	u16 supp_rates;
1671 
1672 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1673 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1674 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1675 				    &link_conf->chanreq.oper;
1676 	band = chandef->chan->band;
1677 
1678 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra_info));
1679 	ra_info = (struct sta_rec_ra_info *)tlv;
1680 
1681 	supp_rates = link_sta->supp_rates[band];
1682 	if (band == NL80211_BAND_2GHZ)
1683 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
1684 			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
1685 	else
1686 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates);
1687 
1688 	ra_info->legacy = cpu_to_le16(supp_rates);
1689 
1690 	if (link_sta->ht_cap.ht_supported)
1691 		memcpy(ra_info->rx_mcs_bitmask,
1692 		       link_sta->ht_cap.mcs.rx_mask,
1693 		       HT_MCS_MASK_NUM);
1694 }
1695 
1696 static void
1697 mt7925_mcu_sta_eht_mld_tlv(struct sk_buff *skb,
1698 			   struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1699 {
1700 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1701 	struct wiphy *wiphy = mvif->phy->mt76->hw->wiphy;
1702 	const struct wiphy_iftype_ext_capab *ext_capa;
1703 	struct sta_rec_eht_mld *eht_mld;
1704 	struct tlv *tlv;
1705 	u16 eml_cap;
1706 
1707 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT_MLD, sizeof(*eht_mld));
1708 	eht_mld = (struct sta_rec_eht_mld *)tlv;
1709 	eht_mld->mld_type = 0xff;
1710 
1711 	if (!ieee80211_vif_is_mld(vif))
1712 		return;
1713 
1714 	ext_capa = cfg80211_get_iftype_ext_capa(wiphy,
1715 						ieee80211_vif_type_p2p(vif));
1716 	if (!ext_capa)
1717 		return;
1718 
1719 	eml_cap = (vif->cfg.eml_cap & (IEEE80211_EML_CAP_EMLSR_SUPP |
1720 				       IEEE80211_EML_CAP_TRANSITION_TIMEOUT)) |
1721 		  (ext_capa->eml_capabilities & (IEEE80211_EML_CAP_EMLSR_PADDING_DELAY |
1722 						IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY));
1723 
1724 	if (eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP) {
1725 		eht_mld->eml_cap[0] = u16_get_bits(eml_cap, GENMASK(7, 0));
1726 		eht_mld->eml_cap[1] = u16_get_bits(eml_cap, GENMASK(15, 8));
1727 	} else {
1728 		eht_mld->str_cap[0] = BIT(1);
1729 	}
1730 }
1731 
1732 static void
1733 mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,
1734 		       struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1735 {
1736 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1737 	struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv;
1738 	unsigned long valid = mvif->valid_links;
1739 	struct mt792x_bss_conf *mconf;
1740 	struct mt792x_link_sta *mlink;
1741 	struct sta_rec_mld *mld;
1742 	struct tlv *tlv;
1743 	int i, cnt = 0;
1744 
1745 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MLD, sizeof(*mld));
1746 	mld = (struct sta_rec_mld *)tlv;
1747 	memcpy(mld->mac_addr, sta->addr, ETH_ALEN);
1748 	mld->primary_id = cpu_to_le16(msta->deflink.wcid.idx);
1749 	mld->wlan_id = cpu_to_le16(msta->deflink.wcid.idx);
1750 	mld->link_num = min_t(u8, hweight16(mvif->valid_links), 2);
1751 
1752 	for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
1753 		if (cnt == mld->link_num)
1754 			break;
1755 
1756 		mconf = mt792x_vif_to_link(mvif, i);
1757 		mlink = mt792x_sta_to_link(msta, i);
1758 		mld->link[cnt].wlan_id = cpu_to_le16(mlink->wcid.idx);
1759 		mld->link[cnt++].bss_idx = mconf->mt76.idx;
1760 
1761 		if (mlink != &msta->deflink)
1762 			mld->secondary_id = cpu_to_le16(mlink->wcid.idx);
1763 	}
1764 }
1765 
1766 static int
1767 mt7925_mcu_sta_cmd(struct mt76_phy *phy,
1768 		   struct mt76_sta_cmd_info *info)
1769 {
1770 	struct mt76_vif *mvif = (struct mt76_vif *)info->vif->drv_priv;
1771 	struct mt76_dev *dev = phy->dev;
1772 	struct sk_buff *skb;
1773 
1774 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, info->wcid,
1775 					      MT7925_STA_UPDATE_MAX_SIZE);
1776 	if (IS_ERR(skb))
1777 		return PTR_ERR(skb);
1778 
1779 	if (info->link_sta)
1780 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif,
1781 					      info->link_sta,
1782 					      info->enable, info->newly);
1783 	if (info->link_sta && info->enable) {
1784 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1785 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1786 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1787 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1788 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1789 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1790 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1791 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1792 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1793 					     info->link_sta);
1794 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1795 					    info->vif, info->rcpi,
1796 					    info->state);
1797 		mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1798 	}
1799 
1800 	if (info->enable)
1801 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
1802 
1803 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1804 }
1805 
1806 static void
1807 mt7925_mcu_sta_remove_tlv(struct sk_buff *skb)
1808 {
1809 	struct sta_rec_remove *rem;
1810 	struct tlv *tlv;
1811 
1812 	tlv = mt76_connac_mcu_add_tlv(skb, 0x25, sizeof(*rem));
1813 	rem = (struct sta_rec_remove *)tlv;
1814 	rem->action = 0;
1815 }
1816 
1817 static int
1818 mt7925_mcu_mlo_sta_cmd(struct mt76_phy *phy,
1819 		       struct mt76_sta_cmd_info *info)
1820 {
1821 	struct mt792x_vif *mvif = (struct mt792x_vif *)info->vif->drv_priv;
1822 	struct mt76_dev *dev = phy->dev;
1823 	struct mt792x_bss_conf *mconf;
1824 	struct sk_buff *skb;
1825 
1826 	mconf = mt792x_vif_to_link(mvif, info->wcid->link_id);
1827 
1828 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, info->wcid,
1829 					      MT7925_STA_UPDATE_MAX_SIZE);
1830 	if (IS_ERR(skb))
1831 		return PTR_ERR(skb);
1832 
1833 	if (info->enable)
1834 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif,
1835 					      info->link_sta,
1836 					      info->enable, info->newly);
1837 
1838 	if (info->enable && info->link_sta) {
1839 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1840 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1841 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1842 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1843 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta);
1844 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1845 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1846 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1847 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1848 					     info->link_sta);
1849 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1850 					    info->vif, info->rcpi,
1851 					    info->state);
1852 
1853 		if (info->state != MT76_STA_INFO_STATE_NONE) {
1854 			mt7925_mcu_sta_mld_tlv(skb, info->vif, info->link_sta->sta);
1855 			mt7925_mcu_sta_eht_mld_tlv(skb, info->vif, info->link_sta->sta);
1856 		}
1857 
1858 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->link_sta);
1859 	}
1860 
1861 	if (!info->enable) {
1862 		mt7925_mcu_sta_remove_tlv(skb);
1863 		mt76_connac_mcu_add_tlv(skb, STA_REC_MLD_OFF,
1864 					sizeof(struct tlv));
1865 	}
1866 
1867 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1868 }
1869 
1870 int mt7925_mcu_sta_update(struct mt792x_dev *dev,
1871 			  struct ieee80211_link_sta *link_sta,
1872 			  struct ieee80211_vif *vif, bool enable,
1873 			  enum mt76_sta_info_state state)
1874 {
1875 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1876 	int rssi = -ewma_rssi_read(&mvif->bss_conf.rssi);
1877 	struct mt76_sta_cmd_info info = {
1878 		.link_sta = link_sta,
1879 		.vif = vif,
1880 		.enable = enable,
1881 		.cmd = MCU_UNI_CMD(STA_REC_UPDATE),
1882 		.state = state,
1883 		.offload_fw = true,
1884 		.rcpi = to_rcpi(rssi),
1885 	};
1886 	struct mt792x_sta *msta;
1887 	struct mt792x_link_sta *mlink;
1888 	int err;
1889 
1890 	if (link_sta) {
1891 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
1892 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
1893 	}
1894 	info.wcid = link_sta ? &mlink->wcid : &mvif->sta.deflink.wcid;
1895 	info.newly = link_sta ? state != MT76_STA_INFO_STATE_ASSOC : true;
1896 
1897 	if (ieee80211_vif_is_mld(vif))
1898 		err = mt7925_mcu_mlo_sta_cmd(&dev->mphy, &info);
1899 	else
1900 		err = mt7925_mcu_sta_cmd(&dev->mphy, &info);
1901 
1902 	return err;
1903 }
1904 
1905 int mt7925_mcu_set_beacon_filter(struct mt792x_dev *dev,
1906 				 struct ieee80211_vif *vif,
1907 				 bool enable)
1908 {
1909 #define MT7925_FIF_BIT_CLR		BIT(1)
1910 #define MT7925_FIF_BIT_SET		BIT(0)
1911 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1912 	unsigned long valid = ieee80211_vif_is_mld(vif) ?
1913 				      mvif->valid_links : BIT(0);
1914 	struct ieee80211_bss_conf *bss_conf;
1915 	int err = 0;
1916 	int i;
1917 
1918 	if (enable) {
1919 		for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
1920 			bss_conf = mt792x_vif_to_bss_conf(vif, i);
1921 			err = mt7925_mcu_uni_bss_bcnft(dev, bss_conf, true);
1922 			if (err < 0)
1923 				return err;
1924 		}
1925 
1926 		return mt7925_mcu_set_rxfilter(dev, 0,
1927 					       MT7925_FIF_BIT_SET,
1928 					       MT_WF_RFCR_DROP_OTHER_BEACON);
1929 	}
1930 
1931 	for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
1932 		bss_conf = mt792x_vif_to_bss_conf(vif, i);
1933 		err = mt7925_mcu_set_bss_pm(dev, bss_conf, false);
1934 		if (err)
1935 			return err;
1936 	}
1937 
1938 	return mt7925_mcu_set_rxfilter(dev, 0,
1939 				       MT7925_FIF_BIT_CLR,
1940 				       MT_WF_RFCR_DROP_OTHER_BEACON);
1941 }
1942 
1943 int mt7925_get_txpwr_info(struct mt792x_dev *dev, u8 band_idx, struct mt7925_txpwr *txpwr)
1944 {
1945 #define TX_POWER_SHOW_INFO 0x7
1946 #define TXPOWER_ALL_RATE_POWER_INFO 0x2
1947 	struct mt7925_txpwr_event *event;
1948 	struct mt7925_txpwr_req req = {
1949 		.tag = cpu_to_le16(TX_POWER_SHOW_INFO),
1950 		.len = cpu_to_le16(sizeof(req) - 4),
1951 		.catg = TXPOWER_ALL_RATE_POWER_INFO,
1952 		.band_idx = band_idx,
1953 	};
1954 	struct sk_buff *skb;
1955 	int ret;
1956 
1957 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(TXPOWER),
1958 					&req, sizeof(req), true, &skb);
1959 	if (ret)
1960 		return ret;
1961 
1962 	event = (struct mt7925_txpwr_event *)skb->data;
1963 	memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
1964 
1965 	dev_kfree_skb(skb);
1966 
1967 	return 0;
1968 }
1969 
1970 int mt7925_mcu_set_sniffer(struct mt792x_dev *dev, struct ieee80211_vif *vif,
1971 			   bool enable)
1972 {
1973 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1974 
1975 	struct {
1976 		struct {
1977 			u8 band_idx;
1978 			u8 pad[3];
1979 		} __packed hdr;
1980 		struct sniffer_enable_tlv {
1981 			__le16 tag;
1982 			__le16 len;
1983 			u8 enable;
1984 			u8 pad[3];
1985 		} __packed enable;
1986 	} __packed req = {
1987 		.hdr = {
1988 			.band_idx = mvif->bss_conf.mt76.band_idx,
1989 		},
1990 		.enable = {
1991 			.tag = cpu_to_le16(UNI_SNIFFER_ENABLE),
1992 			.len = cpu_to_le16(sizeof(struct sniffer_enable_tlv)),
1993 			.enable = enable,
1994 		},
1995 	};
1996 
1997 	mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req), true);
1998 
1999 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req),
2000 				 true);
2001 }
2002 
2003 int mt7925_mcu_config_sniffer(struct mt792x_vif *vif,
2004 			      struct ieee80211_chanctx_conf *ctx)
2005 {
2006 	struct mt76_phy *mphy = vif->phy->mt76;
2007 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def : &mphy->chandef;
2008 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2009 
2010 	static const u8 ch_band[] = {
2011 		[NL80211_BAND_2GHZ] = 1,
2012 		[NL80211_BAND_5GHZ] = 2,
2013 		[NL80211_BAND_6GHZ] = 3,
2014 	};
2015 	static const u8 ch_width[] = {
2016 		[NL80211_CHAN_WIDTH_20_NOHT] = 0,
2017 		[NL80211_CHAN_WIDTH_20] = 0,
2018 		[NL80211_CHAN_WIDTH_40] = 0,
2019 		[NL80211_CHAN_WIDTH_80] = 1,
2020 		[NL80211_CHAN_WIDTH_160] = 2,
2021 		[NL80211_CHAN_WIDTH_80P80] = 3,
2022 		[NL80211_CHAN_WIDTH_5] = 4,
2023 		[NL80211_CHAN_WIDTH_10] = 5,
2024 		[NL80211_CHAN_WIDTH_320] = 6,
2025 	};
2026 
2027 	struct {
2028 		struct {
2029 			u8 band_idx;
2030 			u8 pad[3];
2031 		} __packed hdr;
2032 		struct config_tlv {
2033 			__le16 tag;
2034 			__le16 len;
2035 			u16 aid;
2036 			u8 ch_band;
2037 			u8 bw;
2038 			u8 control_ch;
2039 			u8 sco;
2040 			u8 center_ch;
2041 			u8 center_ch2;
2042 			u8 drop_err;
2043 			u8 pad[3];
2044 		} __packed tlv;
2045 	} __packed req = {
2046 		.hdr = {
2047 			.band_idx = vif->bss_conf.mt76.band_idx,
2048 		},
2049 		.tlv = {
2050 			.tag = cpu_to_le16(UNI_SNIFFER_CONFIG),
2051 			.len = cpu_to_le16(sizeof(req.tlv)),
2052 			.control_ch = chandef->chan->hw_value,
2053 			.center_ch = ieee80211_frequency_to_channel(freq1),
2054 			.drop_err = 1,
2055 		},
2056 	};
2057 
2058 	if (chandef->chan->band < ARRAY_SIZE(ch_band))
2059 		req.tlv.ch_band = ch_band[chandef->chan->band];
2060 	if (chandef->width < ARRAY_SIZE(ch_width))
2061 		req.tlv.bw = ch_width[chandef->width];
2062 
2063 	if (freq2)
2064 		req.tlv.center_ch2 = ieee80211_frequency_to_channel(freq2);
2065 
2066 	if (req.tlv.control_ch < req.tlv.center_ch)
2067 		req.tlv.sco = 1; /* SCA */
2068 	else if (req.tlv.control_ch > req.tlv.center_ch)
2069 		req.tlv.sco = 3; /* SCB */
2070 
2071 	return mt76_mcu_send_msg(mphy->dev, MCU_UNI_CMD(SNIFFER),
2072 				 &req, sizeof(req), true);
2073 }
2074 
2075 int
2076 mt7925_mcu_uni_add_beacon_offload(struct mt792x_dev *dev,
2077 				  struct ieee80211_hw *hw,
2078 				  struct ieee80211_vif *vif,
2079 				  bool enable)
2080 {
2081 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
2082 	struct ieee80211_mutable_offsets offs;
2083 	struct {
2084 		struct req_hdr {
2085 			u8 bss_idx;
2086 			u8 pad[3];
2087 		} __packed hdr;
2088 		struct bcn_content_tlv {
2089 			__le16 tag;
2090 			__le16 len;
2091 			__le16 tim_ie_pos;
2092 			__le16 csa_ie_pos;
2093 			__le16 bcc_ie_pos;
2094 			/* 0: disable beacon offload
2095 			 * 1: enable beacon offload
2096 			 * 2: update probe respond offload
2097 			 */
2098 			u8 enable;
2099 			/* 0: legacy format (TXD + payload)
2100 			 * 1: only cap field IE
2101 			 */
2102 			u8 type;
2103 			__le16 pkt_len;
2104 			u8 pkt[512];
2105 		} __packed beacon_tlv;
2106 	} req = {
2107 		.hdr = {
2108 			.bss_idx = mvif->bss_conf.mt76.idx,
2109 		},
2110 		.beacon_tlv = {
2111 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
2112 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
2113 			.enable = enable,
2114 			.type = 1,
2115 		},
2116 	};
2117 	struct sk_buff *skb;
2118 	u8 cap_offs;
2119 
2120 	/* support enable/update process only
2121 	 * disable flow would be handled in bss stop handler automatically
2122 	 */
2123 	if (!enable)
2124 		return -EOPNOTSUPP;
2125 
2126 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs, 0);
2127 	if (!skb)
2128 		return -EINVAL;
2129 
2130 	cap_offs = offsetof(struct ieee80211_mgmt, u.beacon.capab_info);
2131 	if (!skb_pull(skb, cap_offs)) {
2132 		dev_err(dev->mt76.dev, "beacon format err\n");
2133 		dev_kfree_skb(skb);
2134 		return -EINVAL;
2135 	}
2136 
2137 	if (skb->len > 512) {
2138 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
2139 		dev_kfree_skb(skb);
2140 		return -EINVAL;
2141 	}
2142 
2143 	memcpy(req.beacon_tlv.pkt, skb->data, skb->len);
2144 	req.beacon_tlv.pkt_len = cpu_to_le16(skb->len);
2145 	offs.tim_offset -= cap_offs;
2146 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(offs.tim_offset);
2147 
2148 	if (offs.cntdwn_counter_offs[0]) {
2149 		u16 csa_offs;
2150 
2151 		csa_offs = offs.cntdwn_counter_offs[0] - cap_offs - 4;
2152 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
2153 	}
2154 	dev_kfree_skb(skb);
2155 
2156 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
2157 				 &req, sizeof(req), true);
2158 }
2159 
2160 static
2161 void mt7925_mcu_bss_rlm_tlv(struct sk_buff *skb, struct mt76_phy *phy,
2162 			    struct ieee80211_bss_conf *link_conf,
2163 			    struct ieee80211_chanctx_conf *ctx)
2164 {
2165 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2166 						  &link_conf->chanreq.oper;
2167 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2168 	enum nl80211_band band = chandef->chan->band;
2169 	struct bss_rlm_tlv *req;
2170 	struct tlv *tlv;
2171 
2172 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RLM, sizeof(*req));
2173 	req = (struct bss_rlm_tlv *)tlv;
2174 	req->control_channel = chandef->chan->hw_value,
2175 	req->center_chan = ieee80211_frequency_to_channel(freq1),
2176 	req->center_chan2 = ieee80211_frequency_to_channel(freq2),
2177 	req->tx_streams = hweight8(phy->antenna_mask),
2178 	req->ht_op_info = 4, /* set HT 40M allowed */
2179 	req->rx_streams = hweight8(phy->antenna_mask),
2180 	req->band = band;
2181 
2182 	switch (chandef->width) {
2183 	case NL80211_CHAN_WIDTH_40:
2184 		req->bw = CMD_CBW_40MHZ;
2185 		break;
2186 	case NL80211_CHAN_WIDTH_80:
2187 		req->bw = CMD_CBW_80MHZ;
2188 		break;
2189 	case NL80211_CHAN_WIDTH_80P80:
2190 		req->bw = CMD_CBW_8080MHZ;
2191 		break;
2192 	case NL80211_CHAN_WIDTH_160:
2193 		req->bw = CMD_CBW_160MHZ;
2194 		break;
2195 	case NL80211_CHAN_WIDTH_5:
2196 		req->bw = CMD_CBW_5MHZ;
2197 		break;
2198 	case NL80211_CHAN_WIDTH_10:
2199 		req->bw = CMD_CBW_10MHZ;
2200 		break;
2201 	case NL80211_CHAN_WIDTH_20_NOHT:
2202 	case NL80211_CHAN_WIDTH_20:
2203 	default:
2204 		req->bw = CMD_CBW_20MHZ;
2205 		req->ht_op_info = 0;
2206 		break;
2207 	}
2208 
2209 	if (req->control_channel < req->center_chan)
2210 		req->sco = 1; /* SCA */
2211 	else if (req->control_channel > req->center_chan)
2212 		req->sco = 3; /* SCB */
2213 }
2214 
2215 static struct sk_buff *
2216 __mt7925_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
2217 {
2218 	struct bss_req_hdr hdr = {
2219 		.bss_idx = mvif->idx,
2220 	};
2221 	struct sk_buff *skb;
2222 
2223 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
2224 	if (!skb)
2225 		return ERR_PTR(-ENOMEM);
2226 
2227 	skb_put_data(skb, &hdr, sizeof(hdr));
2228 
2229 	return skb;
2230 }
2231 
2232 int mt7925_mcu_set_chctx(struct mt76_phy *phy, struct mt76_vif *mvif,
2233 			 struct ieee80211_bss_conf *link_conf,
2234 			 struct ieee80211_chanctx_conf *ctx)
2235 {
2236 	struct sk_buff *skb;
2237 
2238 	skb = __mt7925_mcu_alloc_bss_req(phy->dev, mvif,
2239 					 MT7925_BSS_UPDATE_MAX_SIZE);
2240 	if (IS_ERR(skb))
2241 		return PTR_ERR(skb);
2242 
2243 	mt7925_mcu_bss_rlm_tlv(skb, phy, link_conf, ctx);
2244 
2245 	return mt76_mcu_skb_send_msg(phy->dev, skb,
2246 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2247 }
2248 
2249 static u8
2250 mt7925_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
2251 			enum nl80211_band band,
2252 			struct ieee80211_link_sta *link_sta)
2253 {
2254 	struct ieee80211_he_6ghz_capa *he_6ghz_capa;
2255 	const struct ieee80211_sta_eht_cap *eht_cap;
2256 	__le16 capa = 0;
2257 	u8 mode = 0;
2258 
2259 	if (link_sta) {
2260 		he_6ghz_capa = &link_sta->he_6ghz_capa;
2261 		eht_cap = &link_sta->eht_cap;
2262 	} else {
2263 		struct ieee80211_supported_band *sband;
2264 
2265 		sband = phy->hw->wiphy->bands[band];
2266 		capa = ieee80211_get_he_6ghz_capa(sband, vif->type);
2267 		he_6ghz_capa = (struct ieee80211_he_6ghz_capa *)&capa;
2268 
2269 		eht_cap = ieee80211_get_eht_iftype_cap(sband, vif->type);
2270 	}
2271 
2272 	switch (band) {
2273 	case NL80211_BAND_2GHZ:
2274 		if (eht_cap && eht_cap->has_eht)
2275 			mode |= PHY_MODE_BE_24G;
2276 		break;
2277 	case NL80211_BAND_5GHZ:
2278 		if (eht_cap && eht_cap->has_eht)
2279 			mode |= PHY_MODE_BE_5G;
2280 		break;
2281 	case NL80211_BAND_6GHZ:
2282 		if (he_6ghz_capa && he_6ghz_capa->capa)
2283 			mode |= PHY_MODE_AX_6G;
2284 
2285 		if (eht_cap && eht_cap->has_eht)
2286 			mode |= PHY_MODE_BE_6G;
2287 		break;
2288 	default:
2289 		break;
2290 	}
2291 
2292 	return mode;
2293 }
2294 
2295 static void
2296 mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
2297 			 struct ieee80211_bss_conf *link_conf,
2298 			 struct ieee80211_link_sta *link_sta,
2299 			 struct ieee80211_chanctx_conf *ctx,
2300 			 struct mt76_phy *phy, u16 wlan_idx,
2301 			 bool enable)
2302 {
2303 	struct ieee80211_vif *vif = link_conf->vif;
2304 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2305 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2306 						  &link_conf->chanreq.oper;
2307 	enum nl80211_band band = chandef->chan->band;
2308 	struct mt76_connac_bss_basic_tlv *basic_req;
2309 	struct mt792x_link_sta *mlink;
2310 	struct tlv *tlv;
2311 	int conn_type;
2312 	u8 idx;
2313 
2314 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*basic_req));
2315 	basic_req = (struct mt76_connac_bss_basic_tlv *)tlv;
2316 
2317 	idx = mconf->mt76.omac_idx > EXT_BSSID_START ? HW_BSSID_0 :
2318 						      mconf->mt76.omac_idx;
2319 	basic_req->hw_bss_idx = idx;
2320 
2321 	basic_req->phymode_ext = mt7925_get_phy_mode_ext(phy, vif, band,
2322 							 link_sta);
2323 
2324 	if (band == NL80211_BAND_2GHZ)
2325 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_ERP_INDEX);
2326 	else
2327 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_OFDM_INDEX);
2328 
2329 	memcpy(basic_req->bssid, link_conf->bssid, ETH_ALEN);
2330 	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, link_sta);
2331 	basic_req->bcn_interval = cpu_to_le16(link_conf->beacon_int);
2332 	basic_req->dtim_period = link_conf->dtim_period;
2333 	basic_req->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
2334 	basic_req->link_idx = mconf->mt76.idx;
2335 
2336 	if (link_sta) {
2337 		struct mt792x_sta *msta;
2338 
2339 		msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
2340 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
2341 
2342 	} else {
2343 		mlink = &mconf->vif->sta.deflink;
2344 	}
2345 
2346 	basic_req->sta_idx = cpu_to_le16(mlink->wcid.idx);
2347 	basic_req->omac_idx = mconf->mt76.omac_idx;
2348 	basic_req->band_idx = mconf->mt76.band_idx;
2349 	basic_req->wmm_idx = mconf->mt76.wmm_idx;
2350 	basic_req->conn_state = !enable;
2351 
2352 	switch (vif->type) {
2353 	case NL80211_IFTYPE_MESH_POINT:
2354 	case NL80211_IFTYPE_AP:
2355 		if (vif->p2p)
2356 			conn_type = CONNECTION_P2P_GO;
2357 		else
2358 			conn_type = CONNECTION_INFRA_AP;
2359 		basic_req->conn_type = cpu_to_le32(conn_type);
2360 		basic_req->active = enable;
2361 		break;
2362 	case NL80211_IFTYPE_STATION:
2363 		if (vif->p2p)
2364 			conn_type = CONNECTION_P2P_GC;
2365 		else
2366 			conn_type = CONNECTION_INFRA_STA;
2367 		basic_req->conn_type = cpu_to_le32(conn_type);
2368 		basic_req->active = true;
2369 		break;
2370 	case NL80211_IFTYPE_ADHOC:
2371 		basic_req->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
2372 		basic_req->active = true;
2373 		break;
2374 	default:
2375 		WARN_ON(1);
2376 		break;
2377 	}
2378 }
2379 
2380 static void
2381 mt7925_mcu_bss_sec_tlv(struct sk_buff *skb,
2382 		       struct ieee80211_bss_conf *link_conf)
2383 {
2384 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2385 	struct mt76_vif *mvif = &mconf->mt76;
2386 	struct bss_sec_tlv {
2387 		__le16 tag;
2388 		__le16 len;
2389 		u8 mode;
2390 		u8 status;
2391 		u8 cipher;
2392 		u8 __rsv;
2393 	} __packed * sec;
2394 	struct tlv *tlv;
2395 
2396 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_SEC, sizeof(*sec));
2397 	sec = (struct bss_sec_tlv *)tlv;
2398 
2399 	switch (mvif->cipher) {
2400 	case CONNAC3_CIPHER_GCMP_256:
2401 	case CONNAC3_CIPHER_GCMP:
2402 		sec->mode = MODE_WPA3_SAE;
2403 		sec->status = 8;
2404 		break;
2405 	case CONNAC3_CIPHER_AES_CCMP:
2406 		sec->mode = MODE_WPA2_PSK;
2407 		sec->status = 6;
2408 		break;
2409 	case CONNAC3_CIPHER_TKIP:
2410 		sec->mode = MODE_WPA2_PSK;
2411 		sec->status = 4;
2412 		break;
2413 	case CONNAC3_CIPHER_WEP104:
2414 	case CONNAC3_CIPHER_WEP40:
2415 		sec->mode = MODE_SHARED;
2416 		sec->status = 0;
2417 		break;
2418 	default:
2419 		sec->mode = MODE_OPEN;
2420 		sec->status = 1;
2421 		break;
2422 	}
2423 
2424 	sec->cipher = mvif->cipher;
2425 }
2426 
2427 static void
2428 mt7925_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt792x_phy *phy,
2429 		       struct ieee80211_chanctx_conf *ctx,
2430 		       struct ieee80211_bss_conf *link_conf)
2431 {
2432 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2433 						  &link_conf->chanreq.oper;
2434 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2435 	enum nl80211_band band = chandef->chan->band;
2436 	struct mt76_vif *mvif = &mconf->mt76;
2437 	struct bss_rate_tlv *bmc;
2438 	struct tlv *tlv;
2439 	u8 idx = mvif->mcast_rates_idx ?
2440 		 mvif->mcast_rates_idx : mvif->basic_rates_idx;
2441 
2442 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RATE, sizeof(*bmc));
2443 
2444 	bmc = (struct bss_rate_tlv *)tlv;
2445 
2446 	if (band == NL80211_BAND_2GHZ)
2447 		bmc->basic_rate = cpu_to_le16(HR_DSSS_ERP_BASIC_RATE);
2448 	else
2449 		bmc->basic_rate = cpu_to_le16(OFDM_BASIC_RATE);
2450 
2451 	bmc->short_preamble = (band == NL80211_BAND_2GHZ);
2452 	bmc->bc_fixed_rate = idx;
2453 	bmc->mc_fixed_rate = idx;
2454 }
2455 
2456 static void
2457 mt7925_mcu_bss_mld_tlv(struct sk_buff *skb,
2458 		       struct ieee80211_bss_conf *link_conf)
2459 {
2460 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2461 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2462 	struct bss_mld_tlv *mld;
2463 	struct tlv *tlv;
2464 	bool is_mld;
2465 
2466 	is_mld = ieee80211_vif_is_mld(link_conf->vif) ||
2467 		 (hweight16(mvif->valid_links) > 1);
2468 
2469 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_MLD, sizeof(*mld));
2470 	mld = (struct bss_mld_tlv *)tlv;
2471 
2472 	mld->link_id = is_mld ? link_conf->link_id : 0xff;
2473 	/* apply the index of the primary link */
2474 	mld->group_mld_id = is_mld ? mvif->bss_conf.mt76.idx : 0xff;
2475 	mld->own_mld_id = mconf->mt76.idx + 32;
2476 	mld->remap_idx = 0xff;
2477 	mld->eml_enable = !!(link_conf->vif->cfg.eml_cap &
2478 			     IEEE80211_EML_CAP_EMLSR_SUPP);
2479 
2480 	memcpy(mld->mac_addr, link_conf->addr, ETH_ALEN);
2481 }
2482 
2483 static void
2484 mt7925_mcu_bss_qos_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf)
2485 {
2486 	struct mt76_connac_bss_qos_tlv *qos;
2487 	struct tlv *tlv;
2488 
2489 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_QBSS, sizeof(*qos));
2490 	qos = (struct mt76_connac_bss_qos_tlv *)tlv;
2491 	qos->qos = link_conf->qos;
2492 }
2493 
2494 static void
2495 mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2496 		      struct mt792x_phy *phy)
2497 {
2498 #define DEFAULT_HE_PE_DURATION		4
2499 #define DEFAULT_HE_DURATION_RTS_THRES	1023
2500 	const struct ieee80211_sta_he_cap *cap;
2501 	struct bss_info_uni_he *he;
2502 	struct tlv *tlv;
2503 
2504 	cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
2505 
2506 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
2507 
2508 	he = (struct bss_info_uni_he *)tlv;
2509 	he->he_pe_duration = link_conf->htc_trig_based_pkt_ext;
2510 	if (!he->he_pe_duration)
2511 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
2512 
2513 	he->he_rts_thres = cpu_to_le16(link_conf->frame_time_rts_th);
2514 	if (!he->he_rts_thres)
2515 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
2516 
2517 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
2518 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
2519 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
2520 }
2521 
2522 static void
2523 mt7925_mcu_bss_color_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2524 			 bool enable)
2525 {
2526 	struct bss_info_uni_bss_color *color;
2527 	struct tlv *tlv;
2528 
2529 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BSS_COLOR, sizeof(*color));
2530 	color = (struct bss_info_uni_bss_color *)tlv;
2531 
2532 	color->enable = enable ?
2533 		link_conf->he_bss_color.enabled : 0;
2534 	color->bss_color = enable ?
2535 		link_conf->he_bss_color.color : 0;
2536 }
2537 
2538 static void
2539 mt7925_mcu_bss_ifs_tlv(struct sk_buff *skb,
2540 		       struct ieee80211_bss_conf *link_conf)
2541 {
2542 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2543 	struct mt792x_phy *phy = mvif->phy;
2544 	struct bss_ifs_time_tlv *ifs_time;
2545 	struct tlv *tlv;
2546 
2547 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_IFS_TIME, sizeof(*ifs_time));
2548 	ifs_time = (struct bss_ifs_time_tlv *)tlv;
2549 	ifs_time->slot_valid = true;
2550 	ifs_time->slot_time = cpu_to_le16(phy->slottime);
2551 }
2552 
2553 int mt7925_mcu_set_timing(struct mt792x_phy *phy,
2554 			  struct ieee80211_bss_conf *link_conf)
2555 {
2556 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2557 	struct mt792x_dev *dev = phy->dev;
2558 	struct sk_buff *skb;
2559 
2560 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2561 					 MT7925_BSS_UPDATE_MAX_SIZE);
2562 	if (IS_ERR(skb))
2563 		return PTR_ERR(skb);
2564 
2565 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2566 
2567 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2568 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2569 }
2570 
2571 int mt7925_mcu_add_bss_info(struct mt792x_phy *phy,
2572 			    struct ieee80211_chanctx_conf *ctx,
2573 			    struct ieee80211_bss_conf *link_conf,
2574 			    struct ieee80211_link_sta *link_sta,
2575 			    int enable)
2576 {
2577 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2578 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2579 	struct mt792x_dev *dev = phy->dev;
2580 	struct mt792x_link_sta *mlink_bc;
2581 	struct sk_buff *skb;
2582 
2583 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2584 					 MT7925_BSS_UPDATE_MAX_SIZE);
2585 	if (IS_ERR(skb))
2586 		return PTR_ERR(skb);
2587 
2588 	mlink_bc = mt792x_sta_to_link(&mvif->sta, mconf->link_id);
2589 
2590 	/* bss_basic must be first */
2591 	mt7925_mcu_bss_basic_tlv(skb, link_conf, link_sta, ctx, phy->mt76,
2592 				 mlink_bc->wcid.idx, enable);
2593 	mt7925_mcu_bss_sec_tlv(skb, link_conf);
2594 	mt7925_mcu_bss_bmc_tlv(skb, phy, ctx, link_conf);
2595 	mt7925_mcu_bss_qos_tlv(skb, link_conf);
2596 	mt7925_mcu_bss_mld_tlv(skb, link_conf);
2597 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2598 
2599 	if (link_conf->he_support) {
2600 		mt7925_mcu_bss_he_tlv(skb, link_conf, phy);
2601 		mt7925_mcu_bss_color_tlv(skb, link_conf, enable);
2602 	}
2603 
2604 	if (enable)
2605 		mt7925_mcu_bss_rlm_tlv(skb, phy->mt76, link_conf, ctx);
2606 
2607 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2608 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2609 }
2610 
2611 int mt7925_mcu_set_dbdc(struct mt76_phy *phy)
2612 {
2613 	struct mt76_dev *mdev = phy->dev;
2614 
2615 	struct mbmc_conf_tlv *conf;
2616 	struct mbmc_set_req *hdr;
2617 	struct sk_buff *skb;
2618 	struct tlv *tlv;
2619 	int max_len, err;
2620 
2621 	max_len = sizeof(*hdr) + sizeof(*conf);
2622 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2623 	if (!skb)
2624 		return -ENOMEM;
2625 
2626 	hdr = (struct mbmc_set_req *)skb_put(skb, sizeof(*hdr));
2627 
2628 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_MBMC_SETTING, sizeof(*conf));
2629 	conf = (struct mbmc_conf_tlv *)tlv;
2630 
2631 	conf->mbmc_en = 1;
2632 	conf->band = 0; /* unused */
2633 
2634 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SET_DBDC_PARMS),
2635 				    false);
2636 
2637 	return err;
2638 }
2639 
2640 #define MT76_CONNAC_SCAN_CHANNEL_TIME		60
2641 
2642 int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
2643 		       struct ieee80211_scan_request *scan_req)
2644 {
2645 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2646 	struct cfg80211_scan_request *sreq = &scan_req->req;
2647 	int n_ssids = 0, err, i, duration;
2648 	struct ieee80211_channel **scan_list = sreq->channels;
2649 	struct mt76_dev *mdev = phy->dev;
2650 	struct mt76_connac_mcu_scan_channel *chan;
2651 	struct sk_buff *skb;
2652 
2653 	struct scan_hdr_tlv *hdr;
2654 	struct scan_req_tlv *req;
2655 	struct scan_ssid_tlv *ssid;
2656 	struct scan_bssid_tlv *bssid;
2657 	struct scan_chan_info_tlv *chan_info;
2658 	struct scan_ie_tlv *ie;
2659 	struct scan_misc_tlv *misc;
2660 	struct tlv *tlv;
2661 	int max_len;
2662 
2663 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2664 				sizeof(*bssid) + sizeof(*chan_info) +
2665 				sizeof(*misc) + sizeof(*ie);
2666 
2667 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2668 	if (!skb)
2669 		return -ENOMEM;
2670 
2671 	set_bit(MT76_HW_SCANNING, &phy->state);
2672 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2673 
2674 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2675 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2676 	hdr->bss_idx = mvif->idx;
2677 
2678 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_REQ, sizeof(*req));
2679 	req = (struct scan_req_tlv *)tlv;
2680 	req->scan_type = sreq->n_ssids ? 1 : 0;
2681 	req->probe_req_num = sreq->n_ssids ? 2 : 0;
2682 
2683 	duration = MT76_CONNAC_SCAN_CHANNEL_TIME;
2684 	/* increase channel time for passive scan */
2685 	if (!sreq->n_ssids)
2686 		duration *= 2;
2687 	req->timeout_value = cpu_to_le16(sreq->n_channels * duration);
2688 	req->channel_min_dwell_time = cpu_to_le16(duration);
2689 	req->channel_dwell_time = cpu_to_le16(duration);
2690 
2691 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2692 	ssid = (struct scan_ssid_tlv *)tlv;
2693 	for (i = 0; i < sreq->n_ssids; i++) {
2694 		if (!sreq->ssids[i].ssid_len)
2695 			continue;
2696 
2697 		ssid->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
2698 		memcpy(ssid->ssids[i].ssid, sreq->ssids[i].ssid,
2699 		       sreq->ssids[i].ssid_len);
2700 		n_ssids++;
2701 	}
2702 	ssid->ssid_type = n_ssids ? BIT(2) : BIT(0);
2703 	ssid->ssids_num = n_ssids;
2704 
2705 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_BSSID, sizeof(*bssid));
2706 	bssid = (struct scan_bssid_tlv *)tlv;
2707 
2708 	memcpy(bssid->bssid, sreq->bssid, ETH_ALEN);
2709 
2710 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
2711 	chan_info = (struct scan_chan_info_tlv *)tlv;
2712 	chan_info->channels_num = min_t(u8, sreq->n_channels,
2713 					ARRAY_SIZE(chan_info->channels));
2714 	for (i = 0; i < chan_info->channels_num; i++) {
2715 		chan = &chan_info->channels[i];
2716 
2717 		switch (scan_list[i]->band) {
2718 		case NL80211_BAND_2GHZ:
2719 			chan->band = 1;
2720 			break;
2721 		case NL80211_BAND_6GHZ:
2722 			chan->band = 3;
2723 			break;
2724 		default:
2725 			chan->band = 2;
2726 			break;
2727 		}
2728 		chan->channel_num = scan_list[i]->hw_value;
2729 	}
2730 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
2731 
2732 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
2733 	ie = (struct scan_ie_tlv *)tlv;
2734 	if (sreq->ie_len > 0) {
2735 		memcpy(ie->ies, sreq->ie, sreq->ie_len);
2736 		ie->ies_len = cpu_to_le16(sreq->ie_len);
2737 	}
2738 
2739 	req->scan_func |= SCAN_FUNC_SPLIT_SCAN;
2740 
2741 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_MISC, sizeof(*misc));
2742 	misc = (struct scan_misc_tlv *)tlv;
2743 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
2744 		get_random_mask_addr(misc->random_mac, sreq->mac_addr,
2745 				     sreq->mac_addr_mask);
2746 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
2747 	}
2748 
2749 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2750 				    false);
2751 	if (err < 0)
2752 		clear_bit(MT76_HW_SCANNING, &phy->state);
2753 
2754 	return err;
2755 }
2756 EXPORT_SYMBOL_GPL(mt7925_mcu_hw_scan);
2757 
2758 int mt7925_mcu_sched_scan_req(struct mt76_phy *phy,
2759 			      struct ieee80211_vif *vif,
2760 			      struct cfg80211_sched_scan_request *sreq)
2761 {
2762 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2763 	struct ieee80211_channel **scan_list = sreq->channels;
2764 	struct mt76_connac_mcu_scan_channel *chan;
2765 	struct mt76_dev *mdev = phy->dev;
2766 	struct cfg80211_match_set *cfg_match;
2767 	struct cfg80211_ssid *cfg_ssid;
2768 
2769 	struct scan_hdr_tlv *hdr;
2770 	struct scan_sched_req *req;
2771 	struct scan_ssid_tlv *ssid;
2772 	struct scan_chan_info_tlv *chan_info;
2773 	struct scan_ie_tlv *ie;
2774 	struct scan_sched_ssid_match_sets *match;
2775 	struct sk_buff *skb;
2776 	struct tlv *tlv;
2777 	int i, max_len;
2778 
2779 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2780 		  sizeof(*chan_info) + sizeof(*ie) +
2781 		  sizeof(*match);
2782 
2783 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2784 	if (!skb)
2785 		return -ENOMEM;
2786 
2787 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2788 
2789 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2790 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
2791 	hdr->bss_idx = mvif->idx;
2792 
2793 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_REQ, sizeof(*req));
2794 	req = (struct scan_sched_req *)tlv;
2795 	req->version = 1;
2796 
2797 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
2798 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
2799 
2800 	req->intervals_num = sreq->n_scan_plans;
2801 	for (i = 0; i < req->intervals_num; i++)
2802 		req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
2803 
2804 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
2805 	ssid = (struct scan_ssid_tlv *)tlv;
2806 
2807 	ssid->ssids_num = sreq->n_ssids;
2808 	ssid->ssid_type = BIT(2);
2809 	for (i = 0; i < ssid->ssids_num; i++) {
2810 		cfg_ssid = &sreq->ssids[i];
2811 		memcpy(ssid->ssids[i].ssid, cfg_ssid->ssid, cfg_ssid->ssid_len);
2812 		ssid->ssids[i].ssid_len = cpu_to_le32(cfg_ssid->ssid_len);
2813 	}
2814 
2815 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID_MATCH_SETS, sizeof(*match));
2816 	match = (struct scan_sched_ssid_match_sets *)tlv;
2817 	match->match_num = sreq->n_match_sets;
2818 	for (i = 0; i < match->match_num; i++) {
2819 		cfg_match = &sreq->match_sets[i];
2820 		memcpy(match->match[i].ssid, cfg_match->ssid.ssid,
2821 		       cfg_match->ssid.ssid_len);
2822 		match->match[i].rssi_th = cpu_to_le32(cfg_match->rssi_thold);
2823 		match->match[i].ssid_len = cfg_match->ssid.ssid_len;
2824 	}
2825 
2826 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
2827 	chan_info = (struct scan_chan_info_tlv *)tlv;
2828 	chan_info->channels_num = min_t(u8, sreq->n_channels,
2829 					ARRAY_SIZE(chan_info->channels));
2830 	for (i = 0; i < chan_info->channels_num; i++) {
2831 		chan = &chan_info->channels[i];
2832 
2833 		switch (scan_list[i]->band) {
2834 		case NL80211_BAND_2GHZ:
2835 			chan->band = 1;
2836 			break;
2837 		case NL80211_BAND_6GHZ:
2838 			chan->band = 3;
2839 			break;
2840 		default:
2841 			chan->band = 2;
2842 			break;
2843 		}
2844 		chan->channel_num = scan_list[i]->hw_value;
2845 	}
2846 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
2847 
2848 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
2849 	ie = (struct scan_ie_tlv *)tlv;
2850 	if (sreq->ie_len > 0) {
2851 		memcpy(ie->ies, sreq->ie, sreq->ie_len);
2852 		ie->ies_len = cpu_to_le16(sreq->ie_len);
2853 	}
2854 
2855 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2856 				     false);
2857 }
2858 EXPORT_SYMBOL_GPL(mt7925_mcu_sched_scan_req);
2859 
2860 int
2861 mt7925_mcu_sched_scan_enable(struct mt76_phy *phy,
2862 			     struct ieee80211_vif *vif,
2863 			     bool enable)
2864 {
2865 	struct mt76_dev *mdev = phy->dev;
2866 	struct scan_sched_enable *req;
2867 	struct scan_hdr_tlv *hdr;
2868 	struct sk_buff *skb;
2869 	struct tlv *tlv;
2870 	int max_len;
2871 
2872 	max_len = sizeof(*hdr) + sizeof(*req);
2873 
2874 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2875 	if (!skb)
2876 		return -ENOMEM;
2877 
2878 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2879 	hdr->seq_num = 0;
2880 	hdr->bss_idx = 0;
2881 
2882 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_ENABLE, sizeof(*req));
2883 	req = (struct scan_sched_enable *)tlv;
2884 	req->active = !enable;
2885 
2886 	if (enable)
2887 		set_bit(MT76_HW_SCHED_SCANNING, &phy->state);
2888 	else
2889 		clear_bit(MT76_HW_SCHED_SCANNING, &phy->state);
2890 
2891 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
2892 				     false);
2893 }
2894 
2895 int mt7925_mcu_cancel_hw_scan(struct mt76_phy *phy,
2896 			      struct ieee80211_vif *vif)
2897 {
2898 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2899 	struct {
2900 		struct scan_hdr {
2901 			u8 seq_num;
2902 			u8 bss_idx;
2903 			u8 pad[2];
2904 		} __packed hdr;
2905 		struct scan_cancel_tlv {
2906 			__le16 tag;
2907 			__le16 len;
2908 			u8 is_ext_channel;
2909 			u8 rsv[3];
2910 		} __packed cancel;
2911 	} req = {
2912 		.hdr = {
2913 			.seq_num = mvif->scan_seq_num,
2914 			.bss_idx = mvif->idx,
2915 		},
2916 		.cancel = {
2917 			.tag = cpu_to_le16(UNI_SCAN_CANCEL),
2918 			.len = cpu_to_le16(sizeof(struct scan_cancel_tlv)),
2919 		},
2920 	};
2921 
2922 	if (test_and_clear_bit(MT76_HW_SCANNING, &phy->state)) {
2923 		struct cfg80211_scan_info info = {
2924 			.aborted = true,
2925 		};
2926 
2927 		ieee80211_scan_completed(phy->hw, &info);
2928 	}
2929 
2930 	return mt76_mcu_send_msg(phy->dev, MCU_UNI_CMD(SCAN_REQ),
2931 				 &req, sizeof(req), false);
2932 }
2933 EXPORT_SYMBOL_GPL(mt7925_mcu_cancel_hw_scan);
2934 
2935 int mt7925_mcu_set_channel_domain(struct mt76_phy *phy)
2936 {
2937 	int len, i, n_max_channels, n_2ch = 0, n_5ch = 0, n_6ch = 0;
2938 	struct {
2939 		struct {
2940 			u8 alpha2[4]; /* regulatory_request.alpha2 */
2941 			u8 bw_2g; /* BW_20_40M		0
2942 				   * BW_20M		1
2943 				   * BW_20_40_80M	2
2944 				   * BW_20_40_80_160M	3
2945 				   * BW_20_40_80_8080M	4
2946 				   */
2947 			u8 bw_5g;
2948 			u8 bw_6g;
2949 			u8 pad;
2950 		} __packed hdr;
2951 		struct n_chan {
2952 			__le16 tag;
2953 			__le16 len;
2954 			u8 n_2ch;
2955 			u8 n_5ch;
2956 			u8 n_6ch;
2957 			u8 pad;
2958 		} __packed n_ch;
2959 	} req = {
2960 		.hdr = {
2961 			.bw_2g = 0,
2962 			.bw_5g = 3, /* BW_20_40_80_160M */
2963 			.bw_6g = 3,
2964 		},
2965 		.n_ch = {
2966 			.tag = cpu_to_le16(2),
2967 		},
2968 	};
2969 	struct mt76_connac_mcu_chan {
2970 		__le16 hw_value;
2971 		__le16 pad;
2972 		__le32 flags;
2973 	} __packed channel;
2974 	struct mt76_dev *dev = phy->dev;
2975 	struct ieee80211_channel *chan;
2976 	struct sk_buff *skb;
2977 
2978 	n_max_channels = phy->sband_2g.sband.n_channels +
2979 			 phy->sband_5g.sband.n_channels +
2980 			 phy->sband_6g.sband.n_channels;
2981 	len = sizeof(req) + n_max_channels * sizeof(channel);
2982 
2983 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
2984 	if (!skb)
2985 		return -ENOMEM;
2986 
2987 	skb_reserve(skb, sizeof(req));
2988 
2989 	for (i = 0; i < phy->sband_2g.sband.n_channels; i++) {
2990 		chan = &phy->sband_2g.sband.channels[i];
2991 		if (chan->flags & IEEE80211_CHAN_DISABLED)
2992 			continue;
2993 
2994 		channel.hw_value = cpu_to_le16(chan->hw_value);
2995 		channel.flags = cpu_to_le32(chan->flags);
2996 		channel.pad = 0;
2997 
2998 		skb_put_data(skb, &channel, sizeof(channel));
2999 		n_2ch++;
3000 	}
3001 	for (i = 0; i < phy->sband_5g.sband.n_channels; i++) {
3002 		chan = &phy->sband_5g.sband.channels[i];
3003 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3004 			continue;
3005 
3006 		channel.hw_value = cpu_to_le16(chan->hw_value);
3007 		channel.flags = cpu_to_le32(chan->flags);
3008 		channel.pad = 0;
3009 
3010 		skb_put_data(skb, &channel, sizeof(channel));
3011 		n_5ch++;
3012 	}
3013 	for (i = 0; i < phy->sband_6g.sband.n_channels; i++) {
3014 		chan = &phy->sband_6g.sband.channels[i];
3015 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3016 			continue;
3017 
3018 		channel.hw_value = cpu_to_le16(chan->hw_value);
3019 		channel.flags = cpu_to_le32(chan->flags);
3020 		channel.pad = 0;
3021 
3022 		skb_put_data(skb, &channel, sizeof(channel));
3023 		n_6ch++;
3024 	}
3025 
3026 	BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(req.hdr.alpha2));
3027 	memcpy(req.hdr.alpha2, dev->alpha2, sizeof(dev->alpha2));
3028 	req.n_ch.n_2ch = n_2ch;
3029 	req.n_ch.n_5ch = n_5ch;
3030 	req.n_ch.n_6ch = n_6ch;
3031 	len = sizeof(struct n_chan) + (n_2ch + n_5ch + n_6ch) * sizeof(channel);
3032 	req.n_ch.len = cpu_to_le16(len);
3033 	memcpy(__skb_push(skb, sizeof(req)), &req, sizeof(req));
3034 
3035 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SET_DOMAIN_INFO),
3036 				     false);
3037 }
3038 EXPORT_SYMBOL_GPL(mt7925_mcu_set_channel_domain);
3039 
3040 static int
3041 __mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3042 		     enum environment_cap env_cap,
3043 		     struct mt7925_clc *clc, u8 idx)
3044 {
3045 	struct mt7925_clc_segment *seg;
3046 	struct sk_buff *skb;
3047 	struct {
3048 		u8 rsv[4];
3049 		__le16 tag;
3050 		__le16 len;
3051 
3052 		u8 ver;
3053 		u8 pad0;
3054 		__le16 size;
3055 		u8 idx;
3056 		u8 env;
3057 		u8 acpi_conf;
3058 		u8 pad1;
3059 		u8 alpha2[2];
3060 		u8 type[2];
3061 		u8 rsvd[64];
3062 	} __packed req = {
3063 		.tag = cpu_to_le16(0x3),
3064 		.len = cpu_to_le16(sizeof(req) - 4),
3065 
3066 		.idx = idx,
3067 		.env = env_cap,
3068 		.acpi_conf = mt792x_acpi_get_flags(&dev->phy),
3069 	};
3070 	int ret, valid_cnt = 0;
3071 	u8 i, *pos;
3072 
3073 	if (!clc)
3074 		return 0;
3075 
3076 	pos = clc->data + sizeof(*seg) * clc->nr_seg;
3077 	for (i = 0; i < clc->nr_country; i++) {
3078 		struct mt7925_clc_rule *rule = (struct mt7925_clc_rule *)pos;
3079 
3080 		pos += sizeof(*rule);
3081 		if (rule->alpha2[0] != alpha2[0] ||
3082 		    rule->alpha2[1] != alpha2[1])
3083 			continue;
3084 
3085 		seg = (struct mt7925_clc_segment *)clc->data
3086 			  + rule->seg_idx - 1;
3087 
3088 		memcpy(req.alpha2, rule->alpha2, 2);
3089 		memcpy(req.type, rule->type, 2);
3090 
3091 		req.size = cpu_to_le16(seg->len);
3092 		skb = __mt76_mcu_msg_alloc(&dev->mt76, &req,
3093 					   le16_to_cpu(req.size) + sizeof(req),
3094 					   sizeof(req), GFP_KERNEL);
3095 		if (!skb)
3096 			return -ENOMEM;
3097 		skb_put_data(skb, clc->data + seg->offset, seg->len);
3098 
3099 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3100 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3101 					    true);
3102 		if (ret < 0)
3103 			return ret;
3104 		valid_cnt++;
3105 	}
3106 
3107 	if (!valid_cnt)
3108 		return -ENOENT;
3109 
3110 	return 0;
3111 }
3112 
3113 int mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3114 		       enum environment_cap env_cap)
3115 {
3116 	struct mt792x_phy *phy = (struct mt792x_phy *)&dev->phy;
3117 	int i, ret;
3118 
3119 	/* submit all clc config */
3120 	for (i = 0; i < ARRAY_SIZE(phy->clc); i++) {
3121 		ret = __mt7925_mcu_set_clc(dev, alpha2, env_cap,
3122 					   phy->clc[i], i);
3123 
3124 		/* If no country found, set "00" as default */
3125 		if (ret == -ENOENT)
3126 			ret = __mt7925_mcu_set_clc(dev, "00",
3127 						   ENVIRON_INDOOR,
3128 						   phy->clc[i], i);
3129 		if (ret < 0)
3130 			return ret;
3131 	}
3132 	return 0;
3133 }
3134 
3135 int mt7925_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb,
3136 			    int cmd, int *wait_seq)
3137 {
3138 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
3139 	struct mt76_connac2_mcu_uni_txd *uni_txd;
3140 	struct mt76_connac2_mcu_txd *mcu_txd;
3141 	__le32 *txd;
3142 	u32 val;
3143 	u8 seq;
3144 
3145 	/* TODO: make dynamic based on msg type */
3146 	mdev->mcu.timeout = 20 * HZ;
3147 
3148 	seq = ++mdev->mcu.msg_seq & 0xf;
3149 	if (!seq)
3150 		seq = ++mdev->mcu.msg_seq & 0xf;
3151 
3152 	if (cmd == MCU_CMD(FW_SCATTER))
3153 		goto exit;
3154 
3155 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
3156 	txd = (__le32 *)skb_push(skb, txd_len);
3157 
3158 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
3159 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
3160 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
3161 	txd[0] = cpu_to_le32(val);
3162 
3163 	val = FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
3164 	txd[1] = cpu_to_le32(val);
3165 
3166 	if (cmd & __MCU_CMD_FIELD_UNI) {
3167 		uni_txd = (struct mt76_connac2_mcu_uni_txd *)txd;
3168 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
3169 		uni_txd->cid = cpu_to_le16(mcu_cmd);
3170 		uni_txd->s2d_index = MCU_S2D_H2N;
3171 		uni_txd->pkt_type = MCU_PKT_ID;
3172 		uni_txd->seq = seq;
3173 
3174 		if (cmd & __MCU_CMD_FIELD_QUERY)
3175 			uni_txd->option = MCU_CMD_UNI_QUERY_ACK;
3176 		else
3177 			uni_txd->option = MCU_CMD_UNI_EXT_ACK;
3178 
3179 		goto exit;
3180 	}
3181 
3182 	mcu_txd = (struct mt76_connac2_mcu_txd *)txd;
3183 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
3184 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
3185 					       MT_TX_MCU_PORT_RX_Q0));
3186 	mcu_txd->pkt_type = MCU_PKT_ID;
3187 	mcu_txd->seq = seq;
3188 	mcu_txd->cid = mcu_cmd;
3189 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
3190 
3191 	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
3192 		if (cmd & __MCU_CMD_FIELD_QUERY)
3193 			mcu_txd->set_query = MCU_Q_QUERY;
3194 		else
3195 			mcu_txd->set_query = MCU_Q_SET;
3196 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
3197 	} else {
3198 		mcu_txd->set_query = MCU_Q_NA;
3199 	}
3200 
3201 	if (cmd & __MCU_CMD_FIELD_WA)
3202 		mcu_txd->s2d_index = MCU_S2D_H2C;
3203 	else
3204 		mcu_txd->s2d_index = MCU_S2D_H2N;
3205 
3206 exit:
3207 	if (wait_seq)
3208 		*wait_seq = seq;
3209 
3210 	return 0;
3211 }
3212 EXPORT_SYMBOL_GPL(mt7925_mcu_fill_message);
3213 
3214 int mt7925_mcu_set_rts_thresh(struct mt792x_phy *phy, u32 val)
3215 {
3216 	struct {
3217 		u8 band_idx;
3218 		u8 _rsv[3];
3219 
3220 		__le16 tag;
3221 		__le16 len;
3222 		__le32 len_thresh;
3223 		__le32 pkt_thresh;
3224 	} __packed req = {
3225 		.band_idx = phy->mt76->band_idx,
3226 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RTS_THRESHOLD),
3227 		.len = cpu_to_le16(sizeof(req) - 4),
3228 		.len_thresh = cpu_to_le32(val),
3229 		.pkt_thresh = cpu_to_le32(0x2),
3230 	};
3231 
3232 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3233 				 &req, sizeof(req), true);
3234 }
3235 
3236 int mt7925_mcu_set_radio_en(struct mt792x_phy *phy, bool enable)
3237 {
3238 	struct {
3239 		u8 band_idx;
3240 		u8 _rsv[3];
3241 
3242 		__le16 tag;
3243 		__le16 len;
3244 		u8 enable;
3245 		u8 _rsv2[3];
3246 	} __packed req = {
3247 		.band_idx = phy->mt76->band_idx,
3248 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RADIO_ENABLE),
3249 		.len = cpu_to_le16(sizeof(req) - 4),
3250 		.enable = enable,
3251 	};
3252 
3253 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3254 				 &req, sizeof(req), true);
3255 }
3256 
3257 static void
3258 mt7925_mcu_build_sku(struct mt76_dev *dev, s8 *sku,
3259 		     struct mt76_power_limits *limits,
3260 		     enum nl80211_band band)
3261 {
3262 	int i, offset = sizeof(limits->cck);
3263 
3264 	memset(sku, 127, MT_CONNAC3_SKU_POWER_LIMIT);
3265 
3266 	if (band == NL80211_BAND_2GHZ) {
3267 		/* cck */
3268 		memcpy(sku, limits->cck, sizeof(limits->cck));
3269 	}
3270 
3271 	/* ofdm */
3272 	memcpy(&sku[offset], limits->ofdm, sizeof(limits->ofdm));
3273 	offset += (sizeof(limits->ofdm) * 5);
3274 
3275 	/* ht */
3276 	for (i = 0; i < 2; i++) {
3277 		memcpy(&sku[offset], limits->mcs[i], 8);
3278 		offset += 8;
3279 	}
3280 	sku[offset++] = limits->mcs[0][0];
3281 
3282 	/* vht */
3283 	for (i = 0; i < ARRAY_SIZE(limits->mcs); i++) {
3284 		memcpy(&sku[offset], limits->mcs[i],
3285 		       ARRAY_SIZE(limits->mcs[i]));
3286 		offset += 12;
3287 	}
3288 
3289 	/* he */
3290 	for (i = 0; i < ARRAY_SIZE(limits->ru); i++) {
3291 		memcpy(&sku[offset], limits->ru[i], ARRAY_SIZE(limits->ru[i]));
3292 		offset += ARRAY_SIZE(limits->ru[i]);
3293 	}
3294 
3295 	/* eht */
3296 	for (i = 0; i < ARRAY_SIZE(limits->eht); i++) {
3297 		memcpy(&sku[offset], limits->eht[i], ARRAY_SIZE(limits->eht[i]));
3298 		offset += ARRAY_SIZE(limits->eht[i]);
3299 	}
3300 }
3301 
3302 static int
3303 mt7925_mcu_rate_txpower_band(struct mt76_phy *phy,
3304 			     enum nl80211_band band)
3305 {
3306 	int tx_power, n_chan, last_ch, err = 0, idx = 0;
3307 	int i, sku_len, batch_size, batch_len = 3;
3308 	struct mt76_dev *dev = phy->dev;
3309 	static const u8 chan_list_2ghz[] = {
3310 		1, 2,  3,  4,  5,  6,  7,
3311 		8, 9, 10, 11, 12, 13, 14
3312 	};
3313 	static const u8 chan_list_5ghz[] = {
3314 		 36,  38,  40,  42,  44,  46,  48,
3315 		 50,  52,  54,  56,  58,  60,  62,
3316 		 64, 100, 102, 104, 106, 108, 110,
3317 		112, 114, 116, 118, 120, 122, 124,
3318 		126, 128, 132, 134, 136, 138, 140,
3319 		142, 144, 149, 151, 153, 155, 157,
3320 		159, 161, 165, 167
3321 	};
3322 	static const u8 chan_list_6ghz[] = {
3323 		  1,   3,   5,   7,   9,  11,  13,
3324 		 15,  17,  19,  21,  23,  25,  27,
3325 		 29,  33,  35,  37,  39,  41,  43,
3326 		 45,  47,  49,  51,  53,  55,  57,
3327 		 59,  61,  65,  67,  69,  71,  73,
3328 		 75,  77,  79,  81,  83,  85,  87,
3329 		 89,  91,  93,  97,  99, 101, 103,
3330 		105, 107, 109, 111, 113, 115, 117,
3331 		119, 121, 123, 125, 129, 131, 133,
3332 		135, 137, 139, 141, 143, 145, 147,
3333 		149, 151, 153, 155, 157, 161, 163,
3334 		165, 167, 169, 171, 173, 175, 177,
3335 		179, 181, 183, 185, 187, 189, 193,
3336 		195, 197, 199, 201, 203, 205, 207,
3337 		209, 211, 213, 215, 217, 219, 221,
3338 		225, 227, 229, 233
3339 	};
3340 	struct mt76_power_limits *limits;
3341 	struct mt7925_sku_tlv *sku_tlbv;
3342 	const u8 *ch_list;
3343 
3344 	sku_len = sizeof(*sku_tlbv);
3345 	tx_power = 2 * phy->hw->conf.power_level;
3346 	if (!tx_power)
3347 		tx_power = 127;
3348 
3349 	if (band == NL80211_BAND_2GHZ) {
3350 		n_chan = ARRAY_SIZE(chan_list_2ghz);
3351 		ch_list = chan_list_2ghz;
3352 		last_ch = chan_list_2ghz[ARRAY_SIZE(chan_list_2ghz) - 1];
3353 	} else if (band == NL80211_BAND_6GHZ) {
3354 		n_chan = ARRAY_SIZE(chan_list_6ghz);
3355 		ch_list = chan_list_6ghz;
3356 		last_ch = chan_list_6ghz[ARRAY_SIZE(chan_list_6ghz) - 1];
3357 	} else {
3358 		n_chan = ARRAY_SIZE(chan_list_5ghz);
3359 		ch_list = chan_list_5ghz;
3360 		last_ch = chan_list_5ghz[ARRAY_SIZE(chan_list_5ghz) - 1];
3361 	}
3362 	batch_size = DIV_ROUND_UP(n_chan, batch_len);
3363 
3364 	limits = devm_kmalloc(dev->dev, sizeof(*limits), GFP_KERNEL);
3365 	if (!limits)
3366 		return -ENOMEM;
3367 
3368 	sku_tlbv = devm_kmalloc(dev->dev, sku_len, GFP_KERNEL);
3369 	if (!sku_tlbv) {
3370 		devm_kfree(dev->dev, limits);
3371 		return -ENOMEM;
3372 	}
3373 
3374 	for (i = 0; i < batch_size; i++) {
3375 		struct mt7925_tx_power_limit_tlv *tx_power_tlv;
3376 		int j, msg_len, num_ch;
3377 		struct sk_buff *skb;
3378 
3379 		num_ch = i == batch_size - 1 ? n_chan % batch_len : batch_len;
3380 		msg_len = sizeof(*tx_power_tlv) + num_ch * sku_len;
3381 		skb = mt76_mcu_msg_alloc(dev, NULL, msg_len);
3382 		if (!skb) {
3383 			err = -ENOMEM;
3384 			goto out;
3385 		}
3386 
3387 		tx_power_tlv = (struct mt7925_tx_power_limit_tlv *)
3388 			       skb_put(skb, sizeof(*tx_power_tlv));
3389 
3390 		BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(tx_power_tlv->alpha2));
3391 		memcpy(tx_power_tlv->alpha2, dev->alpha2, sizeof(dev->alpha2));
3392 		tx_power_tlv->n_chan = num_ch;
3393 		tx_power_tlv->tag = cpu_to_le16(0x1);
3394 		tx_power_tlv->len = cpu_to_le16(sizeof(*tx_power_tlv));
3395 
3396 		switch (band) {
3397 		case NL80211_BAND_2GHZ:
3398 			tx_power_tlv->band = 1;
3399 			break;
3400 		case NL80211_BAND_6GHZ:
3401 			tx_power_tlv->band = 3;
3402 			break;
3403 		default:
3404 			tx_power_tlv->band = 2;
3405 			break;
3406 		}
3407 
3408 		for (j = 0; j < num_ch; j++, idx++) {
3409 			struct ieee80211_channel chan = {
3410 				.hw_value = ch_list[idx],
3411 				.band = band,
3412 			};
3413 			s8 reg_power, sar_power;
3414 
3415 			reg_power = mt76_connac_get_ch_power(phy, &chan,
3416 							     tx_power);
3417 			sar_power = mt76_get_sar_power(phy, &chan, reg_power);
3418 
3419 			mt76_get_rate_power_limits(phy, &chan, limits,
3420 						   sar_power);
3421 
3422 			tx_power_tlv->last_msg = ch_list[idx] == last_ch;
3423 			sku_tlbv->channel = ch_list[idx];
3424 
3425 			mt7925_mcu_build_sku(dev, sku_tlbv->pwr_limit,
3426 					     limits, band);
3427 			skb_put_data(skb, sku_tlbv, sku_len);
3428 		}
3429 		err = mt76_mcu_skb_send_msg(dev, skb,
3430 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3431 					    true);
3432 		if (err < 0)
3433 			goto out;
3434 	}
3435 
3436 out:
3437 	devm_kfree(dev->dev, sku_tlbv);
3438 	devm_kfree(dev->dev, limits);
3439 	return err;
3440 }
3441 
3442 int mt7925_mcu_set_rate_txpower(struct mt76_phy *phy)
3443 {
3444 	int err;
3445 
3446 	if (phy->cap.has_2ghz) {
3447 		err = mt7925_mcu_rate_txpower_band(phy,
3448 						   NL80211_BAND_2GHZ);
3449 		if (err < 0)
3450 			return err;
3451 	}
3452 
3453 	if (phy->cap.has_5ghz) {
3454 		err = mt7925_mcu_rate_txpower_band(phy,
3455 						   NL80211_BAND_5GHZ);
3456 		if (err < 0)
3457 			return err;
3458 	}
3459 
3460 	if (phy->cap.has_6ghz) {
3461 		err = mt7925_mcu_rate_txpower_band(phy,
3462 						   NL80211_BAND_6GHZ);
3463 		if (err < 0)
3464 			return err;
3465 	}
3466 
3467 	return 0;
3468 }
3469 
3470 int mt7925_mcu_set_rxfilter(struct mt792x_dev *dev, u32 fif,
3471 			    u8 bit_op, u32 bit_map)
3472 {
3473 	struct mt792x_phy *phy = &dev->phy;
3474 	struct {
3475 		u8 band_idx;
3476 		u8 rsv1[3];
3477 
3478 		__le16 tag;
3479 		__le16 len;
3480 		u8 mode;
3481 		u8 rsv2[3];
3482 		__le32 fif;
3483 		__le32 bit_map; /* bit_* for bitmap update */
3484 		u8 bit_op;
3485 		u8 pad[51];
3486 	} __packed req = {
3487 		.band_idx = phy->mt76->band_idx,
3488 		.tag = cpu_to_le16(UNI_BAND_CONFIG_SET_MAC80211_RX_FILTER),
3489 		.len = cpu_to_le16(sizeof(req) - 4),
3490 
3491 		.mode = fif ? 0 : 1,
3492 		.fif = cpu_to_le32(fif),
3493 		.bit_map = cpu_to_le32(bit_map),
3494 		.bit_op = bit_op,
3495 	};
3496 
3497 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3498 				 &req, sizeof(req), true);
3499 }
3500