xref: /linux/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c (revision 91a4855d6c03e770e42f17c798a36a3c46e63de2)
1 // SPDX-License-Identifier: BSD-3-Clause-Clear
2 /* Copyright (C) 2023 MediaTek Inc. */
3 
4 #include <linux/fs.h>
5 #include <linux/firmware.h>
6 #include "mt7925.h"
7 #include "regd.h"
8 #include "mcu.h"
9 #include "mac.h"
10 
11 #define MT_STA_BFER			BIT(0)
12 #define MT_STA_BFEE			BIT(1)
13 
14 int mt7925_mcu_parse_response(struct mt76_dev *mdev, int cmd,
15 			      struct sk_buff *skb, int seq)
16 {
17 	int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
18 	struct mt7925_mcu_rxd *rxd;
19 	int ret = 0;
20 
21 	if (!skb) {
22 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n", cmd, seq);
23 		mt792x_reset(mdev);
24 
25 		return -ETIMEDOUT;
26 	}
27 
28 	rxd = (struct mt7925_mcu_rxd *)skb->data;
29 	if (seq != rxd->seq)
30 		return -EAGAIN;
31 
32 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL) ||
33 	    cmd == MCU_CMD(PATCH_FINISH_REQ)) {
34 		skb_pull(skb, sizeof(*rxd) - 4);
35 		ret = *skb->data;
36 	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
37 		   cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
38 		   cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
39 		   cmd == MCU_UNI_CMD(OFFLOAD) ||
40 		   cmd == MCU_UNI_CMD(SUSPEND)) {
41 		struct mt7925_mcu_uni_event *event;
42 
43 		skb_pull(skb, sizeof(*rxd));
44 		event = (struct mt7925_mcu_uni_event *)skb->data;
45 		ret = le32_to_cpu(event->status);
46 		/* skip invalid event */
47 		if (mcu_cmd != event->cid)
48 			ret = -EAGAIN;
49 	} else {
50 		skb_pull(skb, sizeof(*rxd));
51 	}
52 
53 	return ret;
54 }
55 EXPORT_SYMBOL_GPL(mt7925_mcu_parse_response);
56 
57 int mt7925_mcu_regval(struct mt792x_dev *dev, u32 regidx, u32 *val, bool set)
58 {
59 #define MT_RF_REG_HDR           GENMASK(31, 24)
60 #define MT_RF_REG_ANT           GENMASK(23, 16)
61 #define RF_REG_PREFIX           0x99
62 	struct {
63 		u8 __rsv[4];
64 		union {
65 			struct uni_cmd_access_reg_basic {
66 				__le16 tag;
67 				__le16 len;
68 				__le32 idx;
69 				__le32 data;
70 			} __packed reg;
71 			struct uni_cmd_access_rf_reg_basic {
72 				__le16 tag;
73 				__le16 len;
74 				__le16 ant;
75 				u8 __rsv[2];
76 				__le32 idx;
77 				__le32 data;
78 			} __packed rf_reg;
79 		};
80 	} __packed * res, req;
81 	struct sk_buff *skb;
82 	int ret;
83 
84 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX) {
85 		req.rf_reg.tag = cpu_to_le16(UNI_CMD_ACCESS_RF_REG_BASIC);
86 		req.rf_reg.len = cpu_to_le16(sizeof(req.rf_reg));
87 		req.rf_reg.ant = cpu_to_le16(u32_get_bits(regidx, MT_RF_REG_ANT));
88 		req.rf_reg.idx = cpu_to_le32(regidx);
89 		req.rf_reg.data = set ? cpu_to_le32(*val) : 0;
90 	} else {
91 		req.reg.tag = cpu_to_le16(UNI_CMD_ACCESS_REG_BASIC);
92 		req.reg.len = cpu_to_le16(sizeof(req.reg));
93 		req.reg.idx = cpu_to_le32(regidx);
94 		req.reg.data = set ? cpu_to_le32(*val) : 0;
95 	}
96 
97 	if (set)
98 		return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(REG_ACCESS),
99 					 &req, sizeof(req), true);
100 
101 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
102 					MCU_WM_UNI_CMD_QUERY(REG_ACCESS),
103 					&req, sizeof(req), true, &skb);
104 	if (ret)
105 		return ret;
106 
107 	res = (void *)skb->data;
108 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX)
109 		*val = le32_to_cpu(res->rf_reg.data);
110 	else
111 		*val = le32_to_cpu(res->reg.data);
112 
113 	dev_kfree_skb(skb);
114 
115 	return 0;
116 }
117 EXPORT_SYMBOL_GPL(mt7925_mcu_regval);
118 
119 int mt7925_mcu_update_arp_filter(struct mt76_dev *dev,
120 				 struct ieee80211_bss_conf *link_conf)
121 {
122 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
123 	struct ieee80211_vif *mvif = link_conf->vif;
124 	struct sk_buff *skb;
125 	int i, len = min_t(int, mvif->cfg.arp_addr_cnt,
126 			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
127 	struct {
128 		struct {
129 			u8 bss_idx;
130 			u8 pad[3];
131 		} __packed hdr;
132 		struct mt7925_arpns_tlv arp;
133 	} req = {
134 		.hdr = {
135 			.bss_idx = mconf->mt76.idx,
136 		},
137 		.arp = {
138 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
139 			.len = cpu_to_le16(sizeof(req) - 4 + len * 2 * sizeof(__be32)),
140 			.ips_num = len,
141 			.enable = true,
142 		},
143 	};
144 
145 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(req) + len * 2 * sizeof(__be32));
146 	if (!skb)
147 		return -ENOMEM;
148 
149 	skb_put_data(skb, &req, sizeof(req));
150 	for (i = 0; i < len; i++) {
151 		skb_put_data(skb, &mvif->cfg.arp_addr_list[i], sizeof(__be32));
152 		skb_put_zero(skb, sizeof(__be32));
153 	}
154 
155 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
156 }
157 
158 #ifdef CONFIG_PM
159 static int
160 mt7925_connac_mcu_set_wow_ctrl(struct mt76_phy *phy, struct ieee80211_vif *vif,
161 			       bool suspend, struct cfg80211_wowlan *wowlan)
162 {
163 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
164 	struct ieee80211_scan_ies ies = {};
165 	struct mt76_dev *dev = phy->dev;
166 	struct {
167 		struct {
168 			u8 bss_idx;
169 			u8 pad[3];
170 		} __packed hdr;
171 		struct mt76_connac_wow_ctrl_tlv wow_ctrl_tlv;
172 		struct mt76_connac_wow_gpio_param_tlv gpio_tlv;
173 	} req = {
174 		.hdr = {
175 			.bss_idx = mvif->idx,
176 		},
177 		.wow_ctrl_tlv = {
178 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
179 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_ctrl_tlv)),
180 			.cmd = suspend ? 1 : 2,
181 		},
182 		.gpio_tlv = {
183 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_GPIO_PARAM),
184 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_gpio_param_tlv)),
185 			.gpio_pin = 0xff, /* follow fw about GPIO pin */
186 		},
187 	};
188 
189 	if (wowlan->magic_pkt)
190 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_MAGIC;
191 	if (wowlan->disconnect)
192 		req.wow_ctrl_tlv.trigger |= (UNI_WOW_DETECT_TYPE_DISCONNECT |
193 					     UNI_WOW_DETECT_TYPE_BCN_LOST);
194 	if (wowlan->nd_config) {
195 		mt7925_mcu_sched_scan_req(phy, vif, wowlan->nd_config, &ies);
196 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_SCH_SCAN_HIT;
197 		mt7925_mcu_sched_scan_enable(phy, vif, suspend);
198 	}
199 	if (wowlan->n_patterns)
200 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_BITMAP;
201 
202 	if (mt76_is_mmio(dev))
203 		req.wow_ctrl_tlv.wakeup_hif = WOW_PCIE;
204 	else if (mt76_is_usb(dev))
205 		req.wow_ctrl_tlv.wakeup_hif = WOW_USB;
206 	else if (mt76_is_sdio(dev))
207 		req.wow_ctrl_tlv.wakeup_hif = WOW_GPIO;
208 
209 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(SUSPEND), &req,
210 				 sizeof(req), true);
211 }
212 
213 static int
214 mt7925_mcu_set_wow_pattern(struct mt76_dev *dev,
215 			   struct ieee80211_vif *vif,
216 			   u8 index, bool enable,
217 			   struct cfg80211_pkt_pattern *pattern)
218 {
219 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
220 	struct mt7925_wow_pattern_tlv *tlv;
221 	struct sk_buff *skb;
222 	struct {
223 		u8 bss_idx;
224 		u8 pad[3];
225 	} __packed hdr = {
226 		.bss_idx = mvif->idx,
227 	};
228 
229 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(hdr) + sizeof(*tlv));
230 	if (!skb)
231 		return -ENOMEM;
232 
233 	skb_put_data(skb, &hdr, sizeof(hdr));
234 	tlv = (struct mt7925_wow_pattern_tlv *)skb_put(skb, sizeof(*tlv));
235 	tlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
236 	tlv->len = cpu_to_le16(sizeof(*tlv));
237 	tlv->bss_idx = 0xF;
238 	tlv->data_len = pattern->pattern_len;
239 	tlv->enable = enable;
240 	tlv->index = index;
241 	tlv->offset = 0;
242 
243 	memcpy(tlv->pattern, pattern->pattern, pattern->pattern_len);
244 	memcpy(tlv->mask, pattern->mask, DIV_ROUND_UP(pattern->pattern_len, 8));
245 
246 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SUSPEND), true);
247 }
248 
249 void mt7925_mcu_set_suspend_iter(void *priv, u8 *mac,
250 				 struct ieee80211_vif *vif)
251 {
252 	struct mt76_phy *phy = priv;
253 	bool suspend = !test_bit(MT76_STATE_RUNNING, &phy->state);
254 	struct ieee80211_hw *hw = phy->hw;
255 	struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
256 	int i;
257 
258 	mt76_connac_mcu_set_gtk_rekey(phy->dev, vif, suspend);
259 
260 	mt76_connac_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
261 
262 	for (i = 0; i < wowlan->n_patterns; i++)
263 		mt7925_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
264 					   &wowlan->patterns[i]);
265 	mt7925_connac_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
266 }
267 
268 #endif /* CONFIG_PM */
269 
270 static void
271 mt7925_mcu_connection_loss_iter(void *priv, u8 *mac,
272 				struct ieee80211_vif *vif)
273 {
274 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
275 	struct mt7925_uni_beacon_loss_event *event = priv;
276 
277 	if (mvif->idx != event->hdr.bss_idx)
278 		return;
279 
280 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER) ||
281 	    vif->type != NL80211_IFTYPE_STATION)
282 		return;
283 
284 	ieee80211_connection_loss(vif);
285 }
286 
287 static void
288 mt7925_mcu_connection_loss_event(struct mt792x_dev *dev, struct sk_buff *skb)
289 {
290 	struct mt7925_uni_beacon_loss_event *event;
291 	struct mt76_phy *mphy = &dev->mt76.phy;
292 
293 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd));
294 	event = (struct mt7925_uni_beacon_loss_event *)skb->data;
295 
296 	ieee80211_iterate_active_interfaces_atomic(mphy->hw,
297 					IEEE80211_IFACE_ITER_RESUME_ALL,
298 					mt7925_mcu_connection_loss_iter, event);
299 }
300 
301 static void
302 mt7925_mcu_roc_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
303 {
304 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
305 	struct mt7925_roc_grant_tlv *grant = priv;
306 
307 	if (ieee80211_vif_is_mld(vif) && vif->type == NL80211_IFTYPE_STATION)
308 		return;
309 
310 	if (mvif->idx != grant->bss_idx)
311 		return;
312 
313 	mvif->band_idx = grant->dbdcband;
314 }
315 
316 static void mt7925_mcu_roc_handle_grant(struct mt792x_dev *dev,
317 					struct tlv *tlv)
318 {
319 	struct ieee80211_hw *hw = dev->mt76.hw;
320 	struct mt7925_roc_grant_tlv *grant;
321 	int duration;
322 
323 	grant = (struct mt7925_roc_grant_tlv *)tlv;
324 
325 	/* should never happen */
326 	WARN_ON_ONCE((le16_to_cpu(grant->tag) != UNI_EVENT_ROC_GRANT));
327 
328 	if (grant->reqtype == MT7925_ROC_REQ_ROC)
329 		ieee80211_ready_on_channel(hw);
330 	else if (grant->reqtype == MT7925_ROC_REQ_JOIN)
331 		ieee80211_iterate_active_interfaces_atomic(hw,
332 						IEEE80211_IFACE_ITER_RESUME_ALL,
333 						mt7925_mcu_roc_iter, grant);
334 	dev->phy.roc_grant = true;
335 	wake_up(&dev->phy.roc_wait);
336 	duration = le32_to_cpu(grant->max_interval);
337 	mod_timer(&dev->phy.roc_timer,
338 		  jiffies + msecs_to_jiffies(duration));
339 }
340 
341 static void
342 mt7925_mcu_handle_hif_ctrl_basic(struct mt792x_dev *dev, struct tlv *tlv)
343 {
344 	struct mt7925_mcu_hif_ctrl_basic_tlv *basic;
345 
346 	basic = (struct mt7925_mcu_hif_ctrl_basic_tlv *)tlv;
347 
348 	if (basic->hifsuspend) {
349 		dev->hif_idle = true;
350 		if (!(basic->hif_tx_traffic_status == HIF_TRAFFIC_IDLE &&
351 		      basic->hif_rx_traffic_status == HIF_TRAFFIC_IDLE))
352 			dev_info(dev->mt76.dev, "Hif traffic not idle.\n");
353 	} else {
354 		dev->hif_resumed = true;
355 	}
356 	wake_up(&dev->wait);
357 }
358 
359 static void
360 mt7925_mcu_uni_hif_ctrl_event(struct mt792x_dev *dev, struct sk_buff *skb)
361 {
362 	struct tlv *tlv;
363 	u32 tlv_len;
364 
365 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
366 	tlv = (struct tlv *)skb->data;
367 	tlv_len = skb->len;
368 
369 	while (tlv_len > 0 && le16_to_cpu(tlv->len) <= tlv_len) {
370 		switch (le16_to_cpu(tlv->tag)) {
371 		case UNI_EVENT_HIF_CTRL_BASIC:
372 			mt7925_mcu_handle_hif_ctrl_basic(dev, tlv);
373 			break;
374 		default:
375 			break;
376 		}
377 		tlv_len -= le16_to_cpu(tlv->len);
378 		tlv = (struct tlv *)((char *)(tlv) + le16_to_cpu(tlv->len));
379 	}
380 }
381 
382 static void
383 mt7925_mcu_uni_roc_event(struct mt792x_dev *dev, struct sk_buff *skb)
384 {
385 	struct tlv *tlv;
386 	int i = 0;
387 
388 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
389 
390 	while (i < skb->len) {
391 		tlv = (struct tlv *)(skb->data + i);
392 
393 		switch (le16_to_cpu(tlv->tag)) {
394 		case UNI_EVENT_ROC_GRANT:
395 			mt7925_mcu_roc_handle_grant(dev, tlv);
396 			break;
397 		case UNI_EVENT_ROC_GRANT_SUB_LINK:
398 			break;
399 		}
400 
401 		i += le16_to_cpu(tlv->len);
402 	}
403 }
404 
405 static void
406 mt7925_mcu_scan_event(struct mt792x_dev *dev, struct sk_buff *skb)
407 {
408 	struct mt76_phy *mphy = &dev->mt76.phy;
409 	struct mt792x_phy *phy = mphy->priv;
410 
411 	spin_lock_bh(&dev->mt76.lock);
412 	__skb_queue_tail(&phy->scan_event_list, skb);
413 	spin_unlock_bh(&dev->mt76.lock);
414 
415 	ieee80211_queue_delayed_work(mphy->hw, &phy->scan_work,
416 				     MT792x_HW_SCAN_TIMEOUT);
417 }
418 
419 static void
420 mt7925_mcu_tx_done_event(struct mt792x_dev *dev, struct sk_buff *skb)
421 {
422 #define UNI_EVENT_TX_DONE_MSG 0
423 #define UNI_EVENT_TX_DONE_RAW 1
424 	struct mt7925_mcu_txs_event {
425 		u8 ver;
426 		u8 rsv[3];
427 		u8 data[];
428 	} __packed * txs;
429 	struct tlv *tlv;
430 	u32 tlv_len;
431 
432 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
433 	tlv = (struct tlv *)skb->data;
434 	tlv_len = skb->len;
435 
436 	while (tlv_len > 0 && le16_to_cpu(tlv->len) <= tlv_len) {
437 		switch (le16_to_cpu(tlv->tag)) {
438 		case UNI_EVENT_TX_DONE_RAW:
439 			txs = (struct mt7925_mcu_txs_event *)tlv->data;
440 			mt7925_mac_add_txs(dev, txs->data);
441 			break;
442 		default:
443 			break;
444 		}
445 		tlv_len -= le16_to_cpu(tlv->len);
446 		tlv = (struct tlv *)((char *)(tlv) + le16_to_cpu(tlv->len));
447 	}
448 }
449 
450 static void
451 mt7925_mcu_rssi_monitor_iter(void *priv, u8 *mac,
452 			     struct ieee80211_vif *vif)
453 {
454 	struct mt7925_uni_rssi_monitor_event *event = priv;
455 	enum nl80211_cqm_rssi_threshold_event nl_event;
456 	s32 rssi = le32_to_cpu(event->rssi);
457 
458 	if (vif->type != NL80211_IFTYPE_STATION)
459 		return;
460 
461 	if (!(vif->driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI))
462 		return;
463 
464 	if (rssi > vif->bss_conf.cqm_rssi_thold)
465 		nl_event = NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH;
466 	else
467 		nl_event = NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW;
468 
469 	ieee80211_cqm_rssi_notify(vif, nl_event, rssi, GFP_KERNEL);
470 }
471 
472 static void
473 mt7925_mcu_rssi_monitor_event(struct mt792x_dev *dev, struct sk_buff *skb)
474 {
475 	struct tlv *tlv;
476 	u32 tlv_len;
477 	struct mt7925_uni_rssi_monitor_event *event;
478 
479 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
480 	tlv = (struct tlv *)skb->data;
481 	tlv_len = skb->len;
482 
483 	while (tlv_len > 0 && le16_to_cpu(tlv->len) <= tlv_len) {
484 		switch (le16_to_cpu(tlv->tag)) {
485 		case UNI_EVENT_RSSI_MONITOR_INFO:
486 			event = (struct mt7925_uni_rssi_monitor_event *)skb->data;
487 			ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
488 								   IEEE80211_IFACE_ITER_RESUME_ALL,
489 								   mt7925_mcu_rssi_monitor_iter,
490 								   event);
491 			break;
492 		default:
493 			break;
494 		}
495 		tlv_len -= le16_to_cpu(tlv->len);
496 		tlv = (struct tlv *)((char *)(tlv) + le16_to_cpu(tlv->len));
497 	}
498 }
499 
500 static void
501 mt7925_mcu_uni_debug_msg_event(struct mt792x_dev *dev, struct sk_buff *skb)
502 {
503 	struct mt7925_uni_debug_msg {
504 		__le16 tag;
505 		__le16 len;
506 		u8 fmt;
507 		u8 rsv[3];
508 		u8 id;
509 		u8 type:3;
510 		u8 nr_args:5;
511 		union {
512 			struct idxlog {
513 				__le16 rsv;
514 				__le32 ts;
515 				__le32 idx;
516 				u8 data[];
517 			} __packed idx;
518 			struct txtlog {
519 				u8 len;
520 				u8 rsv;
521 				__le32 ts;
522 				u8 data[];
523 			} __packed txt;
524 		};
525 	} __packed * hdr;
526 
527 	skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
528 	hdr = (struct mt7925_uni_debug_msg *)skb->data;
529 
530 	if (hdr->id == 0x28) {
531 		skb_pull(skb, offsetof(struct mt7925_uni_debug_msg, id));
532 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", skb->len, skb->data);
533 		return;
534 	} else if (hdr->id != 0xa8) {
535 		return;
536 	}
537 
538 	if (hdr->type == 0) { /* idx log */
539 		int i, ret, len = PAGE_SIZE - 1, nr_val;
540 		struct page *page = dev_alloc_pages(get_order(len));
541 		__le32 *val;
542 		char *buf, *cur;
543 
544 		if (!page)
545 			return;
546 
547 		buf = page_address(page);
548 		cur = buf;
549 
550 		nr_val = (le16_to_cpu(hdr->len) - sizeof(*hdr)) / 4;
551 		val = (__le32 *)hdr->idx.data;
552 		for (i = 0; i < nr_val && len > 0; i++) {
553 			ret = snprintf(cur, len, "0x%x,", le32_to_cpu(val[i]));
554 			if (ret <= 0)
555 				break;
556 
557 			cur += ret;
558 			len -= ret;
559 		}
560 		if (cur > buf)
561 			wiphy_info(mt76_hw(dev)->wiphy, "idx: 0x%X,%d,%s",
562 				   le32_to_cpu(hdr->idx.idx), nr_val, buf);
563 		put_page(page);
564 	} else if (hdr->type == 2) { /* str log */
565 		wiphy_info(mt76_hw(dev)->wiphy, "%.*s", hdr->txt.len, hdr->txt.data);
566 	}
567 }
568 
569 static void
570 mt7925_mcu_uni_rx_unsolicited_event(struct mt792x_dev *dev,
571 				    struct sk_buff *skb)
572 {
573 	struct mt7925_mcu_rxd *rxd;
574 
575 	rxd = (struct mt7925_mcu_rxd *)skb->data;
576 
577 	switch (rxd->eid) {
578 	case MCU_UNI_EVENT_HIF_CTRL:
579 		mt7925_mcu_uni_hif_ctrl_event(dev, skb);
580 		break;
581 	case MCU_UNI_EVENT_FW_LOG_2_HOST:
582 		mt7925_mcu_uni_debug_msg_event(dev, skb);
583 		break;
584 	case MCU_UNI_EVENT_ROC:
585 		mt7925_mcu_uni_roc_event(dev, skb);
586 		break;
587 	case MCU_UNI_EVENT_SCAN_DONE:
588 		mt7925_mcu_scan_event(dev, skb);
589 		return;
590 	case MCU_UNI_EVENT_TX_DONE:
591 		mt7925_mcu_tx_done_event(dev, skb);
592 		break;
593 	case MCU_UNI_EVENT_BSS_BEACON_LOSS:
594 		mt7925_mcu_connection_loss_event(dev, skb);
595 		break;
596 	case MCU_UNI_EVENT_RSSI_MONITOR:
597 		mt7925_mcu_rssi_monitor_event(dev, skb);
598 		break;
599 	case MCU_UNI_EVENT_COREDUMP:
600 		dev->fw_assert = true;
601 		mt76_connac_mcu_coredump_event(&dev->mt76, skb, &dev->coredump);
602 		return;
603 	default:
604 		break;
605 	}
606 	dev_kfree_skb(skb);
607 }
608 
609 void mt7925_mcu_rx_event(struct mt792x_dev *dev, struct sk_buff *skb)
610 {
611 	struct mt7925_mcu_rxd *rxd = (struct mt7925_mcu_rxd *)skb->data;
612 
613 	if (skb_linearize(skb))
614 		return;
615 
616 	if (rxd->option & MCU_UNI_CMD_UNSOLICITED_EVENT) {
617 		mt7925_mcu_uni_rx_unsolicited_event(dev, skb);
618 		return;
619 	}
620 
621 	mt76_mcu_rx_event(&dev->mt76, skb);
622 }
623 
624 static int
625 mt7925_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif_link *mvif,
626 		  struct ieee80211_ampdu_params *params,
627 		  bool enable, bool tx)
628 {
629 	struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv;
630 	struct sta_rec_ba_uni *ba;
631 	struct sk_buff *skb;
632 	struct tlv *tlv;
633 	int len;
634 
635 	len = sizeof(struct sta_req_hdr) + sizeof(*ba);
636 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid,
637 					      len);
638 	if (IS_ERR(skb))
639 		return PTR_ERR(skb);
640 
641 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
642 
643 	ba = (struct sta_rec_ba_uni *)tlv;
644 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
645 	ba->winsize = cpu_to_le16(params->buf_size);
646 	ba->ssn = cpu_to_le16(params->ssn);
647 	ba->ba_en = enable << params->tid;
648 	ba->amsdu = params->amsdu;
649 	ba->tid = params->tid;
650 
651 	return mt76_mcu_skb_send_msg(dev, skb,
652 				     MCU_UNI_CMD(STA_REC_UPDATE), true);
653 }
654 
655 /** starec & wtbl **/
656 int mt7925_mcu_uni_tx_ba(struct mt792x_dev *dev,
657 			 struct ieee80211_ampdu_params *params,
658 			 bool enable)
659 {
660 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
661 	struct mt792x_vif *mvif = msta->vif;
662 
663 	if (enable && !params->amsdu)
664 		msta->deflink.wcid.amsdu = false;
665 
666 	return mt7925_mcu_sta_ba(&dev->mt76, &mvif->bss_conf.mt76, params,
667 				 enable, true);
668 }
669 
670 int mt7925_mcu_uni_rx_ba(struct mt792x_dev *dev,
671 			 struct ieee80211_ampdu_params *params,
672 			 bool enable)
673 {
674 	struct mt792x_sta *msta = (struct mt792x_sta *)params->sta->drv_priv;
675 	struct mt792x_vif *mvif = msta->vif;
676 
677 	return mt7925_mcu_sta_ba(&dev->mt76, &mvif->bss_conf.mt76, params,
678 				 enable, false);
679 }
680 
681 static int mt7925_mcu_read_eeprom(struct mt792x_dev *dev, u32 offset, u8 *val)
682 {
683 	struct {
684 		u8 rsv[4];
685 
686 		__le16 tag;
687 		__le16 len;
688 
689 		__le32 addr;
690 		__le32 valid;
691 		u8 data[MT7925_EEPROM_BLOCK_SIZE];
692 	} __packed req = {
693 		.tag = cpu_to_le16(1),
694 		.len = cpu_to_le16(sizeof(req) - 4),
695 		.addr = cpu_to_le32(round_down(offset,
696 				    MT7925_EEPROM_BLOCK_SIZE)),
697 	};
698 	struct evt {
699 		u8 rsv[4];
700 
701 		__le16 tag;
702 		__le16 len;
703 
704 		__le32 ver;
705 		__le32 addr;
706 		__le32 valid;
707 		__le32 size;
708 		__le32 magic_num;
709 		__le32 type;
710 		__le32 rsv1[4];
711 		u8 data[32];
712 	} __packed *res;
713 	struct sk_buff *skb;
714 	int ret;
715 
716 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL),
717 					&req, sizeof(req), true, &skb);
718 	if (ret)
719 		return ret;
720 
721 	res = (struct evt *)skb->data;
722 	*val = res->data[offset % MT7925_EEPROM_BLOCK_SIZE];
723 
724 	dev_kfree_skb(skb);
725 
726 	return 0;
727 }
728 
729 static int mt7925_load_clc(struct mt792x_dev *dev, const char *fw_name)
730 {
731 	const struct mt76_connac2_fw_trailer *hdr;
732 	const struct mt76_connac2_fw_region *region;
733 	const struct mt7925_clc *clc;
734 	struct mt76_dev *mdev = &dev->mt76;
735 	struct mt792x_phy *phy = &dev->phy;
736 	const struct firmware *fw;
737 	u8 *clc_base = NULL, hw_encap = 0;
738 	int ret, i, len, offset = 0;
739 
740 	dev->phy.clc_chan_conf = 0xff;
741 	dev->regd_user = false;
742 	if (!mt7925_regd_clc_supported(dev))
743 		return 0;
744 
745 	if (mt76_is_mmio(&dev->mt76)) {
746 		ret = mt7925_mcu_read_eeprom(dev, MT_EE_HW_TYPE, &hw_encap);
747 		if (ret)
748 			return ret;
749 		hw_encap = u8_get_bits(hw_encap, MT_EE_HW_TYPE_ENCAP);
750 	}
751 
752 	ret = request_firmware(&fw, fw_name, mdev->dev);
753 	if (ret)
754 		return ret;
755 
756 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
757 		dev_err(mdev->dev, "Invalid firmware\n");
758 		ret = -EINVAL;
759 		goto out;
760 	}
761 
762 	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
763 	for (i = 0; i < hdr->n_region; i++) {
764 		region = (const void *)((const u8 *)hdr -
765 					(hdr->n_region - i) * sizeof(*region));
766 		len = le32_to_cpu(region->len);
767 
768 		/* check if we have valid buffer size */
769 		if (offset + len > fw->size) {
770 			dev_err(mdev->dev, "Invalid firmware region\n");
771 			ret = -EINVAL;
772 			goto out;
773 		}
774 
775 		if ((region->feature_set & FW_FEATURE_NON_DL) &&
776 		    region->type == FW_TYPE_CLC) {
777 			clc_base = (u8 *)(fw->data + offset);
778 			break;
779 		}
780 		offset += len;
781 	}
782 
783 	if (!clc_base)
784 		goto out;
785 
786 	for (offset = 0; offset < len; offset += le32_to_cpu(clc->len)) {
787 		clc = (const struct mt7925_clc *)(clc_base + offset);
788 
789 		if (clc->idx >= ARRAY_SIZE(phy->clc))
790 			break;
791 
792 		/* do not init buf again if chip reset triggered */
793 		if (phy->clc[clc->idx])
794 			continue;
795 
796 		/* header content sanity */
797 		if ((clc->idx == MT792x_CLC_BE_CTRL &&
798 		     u8_get_bits(clc->t2.type, MT_EE_HW_TYPE_ENCAP) != hw_encap) ||
799 		    u8_get_bits(clc->t0.type, MT_EE_HW_TYPE_ENCAP) != hw_encap)
800 			continue;
801 
802 		phy->clc[clc->idx] = devm_kmemdup(mdev->dev, clc,
803 						  le32_to_cpu(clc->len),
804 						  GFP_KERNEL);
805 
806 		if (!phy->clc[clc->idx]) {
807 			ret = -ENOMEM;
808 			goto out;
809 		}
810 	}
811 
812 	ret = mt7925_regd_init(phy);
813 out:
814 	release_firmware(fw);
815 
816 	return ret;
817 }
818 
819 int mt7925_mcu_fw_log_2_host(struct mt792x_dev *dev, u8 ctrl)
820 {
821 	struct {
822 		u8 _rsv[4];
823 
824 		__le16 tag;
825 		__le16 len;
826 		u8 ctrl;
827 		u8 interval;
828 		u8 _rsv2[2];
829 	} __packed req = {
830 		.tag = cpu_to_le16(UNI_WSYS_CONFIG_FW_LOG_CTRL),
831 		.len = cpu_to_le16(sizeof(req) - 4),
832 		.ctrl = ctrl,
833 	};
834 	int ret;
835 
836 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(WSYS_CONFIG),
837 					&req, sizeof(req), true, NULL);
838 	return ret;
839 }
840 
841 int mt7925_mcu_get_temperature(struct mt792x_phy *phy)
842 {
843 	struct {
844 		u8 _rsv[4];
845 
846 		__le16 tag;
847 		__le16 len;
848 		u8 _rsv2[4];
849 	} __packed req = {
850 		.tag = cpu_to_le16(0x0),
851 		.len = cpu_to_le16(sizeof(req) - 4),
852 	};
853 	struct mt7925_thermal_evt {
854 		u8 rsv[4];
855 		__le32 temperature;
856 	} __packed * evt;
857 	struct mt792x_dev *dev = phy->dev;
858 	int temperature, ret;
859 	struct sk_buff *skb;
860 
861 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
862 					MCU_WM_UNI_CMD_QUERY(THERMAL),
863 					&req, sizeof(req), true, &skb);
864 	if (ret)
865 		return ret;
866 
867 	skb_pull(skb, 4 + sizeof(struct tlv));
868 	evt = (struct mt7925_thermal_evt *)skb->data;
869 
870 	temperature = le32_to_cpu(evt->temperature);
871 
872 	dev_kfree_skb(skb);
873 
874 	return temperature;
875 }
876 
877 static void
878 mt7925_mcu_parse_phy_cap(struct mt792x_dev *dev, char *data)
879 {
880 	struct mt76_phy *mphy = &dev->mt76.phy;
881 	struct mt76_dev *mdev = mphy->dev;
882 	struct mt7925_mcu_phy_cap {
883 		u8 ht;
884 		u8 vht;
885 		u8 _5g;
886 		u8 max_bw;
887 		u8 nss;
888 		u8 dbdc;
889 		u8 tx_ldpc;
890 		u8 rx_ldpc;
891 		u8 tx_stbc;
892 		u8 rx_stbc;
893 		u8 hw_path;
894 		u8 he;
895 		u8 eht;
896 	} __packed * cap;
897 	enum {
898 		WF0_24G,
899 		WF0_5G
900 	};
901 
902 	cap = (struct mt7925_mcu_phy_cap *)data;
903 
904 	mdev->phy.antenna_mask = BIT(cap->nss) - 1;
905 	mdev->phy.chainmask = mdev->phy.antenna_mask;
906 	mdev->phy.cap.has_2ghz = cap->hw_path & BIT(WF0_24G);
907 	mdev->phy.cap.has_5ghz = cap->hw_path & BIT(WF0_5G);
908 }
909 
910 static void
911 mt7925_mcu_parse_eml_cap(struct mt792x_dev *dev, char *data)
912 {
913 	struct mt7925_mcu_eml_cap {
914 		u8 rsv[4];
915 		__le16 eml_cap;
916 		u8 rsv2[6];
917 	} __packed * cap;
918 
919 	cap = (struct mt7925_mcu_eml_cap *)data;
920 
921 	dev->phy.eml_cap = le16_to_cpu(cap->eml_cap);
922 }
923 
924 static int
925 mt7925_mcu_get_nic_capability(struct mt792x_dev *dev)
926 {
927 	struct mt76_phy *mphy = &dev->mt76.phy;
928 	struct {
929 		u8 _rsv[4];
930 
931 		__le16 tag;
932 		__le16 len;
933 	} __packed req = {
934 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_NIC_CAPA),
935 		.len = cpu_to_le16(sizeof(req) - 4),
936 	};
937 	struct mt76_connac_cap_hdr {
938 		__le16 n_element;
939 		u8 rsv[2];
940 	} __packed * hdr;
941 	struct sk_buff *skb;
942 	int ret, i;
943 
944 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
945 					&req, sizeof(req), true, &skb);
946 	if (ret)
947 		return ret;
948 
949 	hdr = (struct mt76_connac_cap_hdr *)skb->data;
950 	if (skb->len < sizeof(*hdr)) {
951 		ret = -EINVAL;
952 		goto out;
953 	}
954 
955 	skb_pull(skb, sizeof(*hdr));
956 
957 	for (i = 0; i < le16_to_cpu(hdr->n_element); i++) {
958 		struct tlv *tlv = (struct tlv *)skb->data;
959 		int len;
960 
961 		if (skb->len < sizeof(*tlv))
962 			break;
963 
964 		len = le16_to_cpu(tlv->len);
965 		if (skb->len < len)
966 			break;
967 
968 		switch (le16_to_cpu(tlv->tag)) {
969 		case MT_NIC_CAP_6G:
970 			mphy->cap.has_6ghz = !!tlv->data[0];
971 			break;
972 		case MT_NIC_CAP_MAC_ADDR:
973 			memcpy(mphy->macaddr, (void *)tlv->data, ETH_ALEN);
974 			break;
975 		case MT_NIC_CAP_PHY:
976 			mt7925_mcu_parse_phy_cap(dev, tlv->data);
977 			break;
978 		case MT_NIC_CAP_CHIP_CAP:
979 			dev->phy.chip_cap = le64_to_cpu(*(__le64 *)tlv->data);
980 			break;
981 		case MT_NIC_CAP_EML_CAP:
982 			mt7925_mcu_parse_eml_cap(dev, tlv->data);
983 			break;
984 		default:
985 			break;
986 		}
987 		skb_pull(skb, len);
988 	}
989 out:
990 	dev_kfree_skb(skb);
991 	return ret;
992 }
993 
994 int mt7925_mcu_chip_config(struct mt792x_dev *dev, const char *cmd)
995 {
996 	u16 len = strlen(cmd) + 1;
997 	struct {
998 		u8 _rsv[4];
999 		__le16 tag;
1000 		__le16 len;
1001 		struct mt76_connac_config config;
1002 	} __packed req = {
1003 		.tag = cpu_to_le16(UNI_CHIP_CONFIG_CHIP_CFG),
1004 		.len = cpu_to_le16(sizeof(req) - 4),
1005 		.config = {
1006 			.resp_type = 0,
1007 			.type = 0,
1008 			.data_size = cpu_to_le16(len),
1009 		},
1010 	};
1011 
1012 	memcpy(req.config.data, cmd, len);
1013 
1014 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
1015 				 &req, sizeof(req), false);
1016 }
1017 
1018 int mt7925_mcu_set_deep_sleep(struct mt792x_dev *dev, bool enable)
1019 {
1020 	char cmd[16];
1021 
1022 	snprintf(cmd, sizeof(cmd), "KeepFullPwr %d", !enable);
1023 
1024 	return mt7925_mcu_chip_config(dev, cmd);
1025 }
1026 EXPORT_SYMBOL_GPL(mt7925_mcu_set_deep_sleep);
1027 
1028 int mt7925_mcu_set_thermal_protect(struct mt792x_dev *dev)
1029 {
1030 	char cmd[64];
1031 	int ret = 0;
1032 
1033 	snprintf(cmd, sizeof(cmd), "ThermalProtGband %d %d %d %d %d %d %d %d %d %d",
1034 		 0, 100, 90, 80, 30, 1, 1, 115, 105, 5);
1035 	ret = mt7925_mcu_chip_config(dev, cmd);
1036 
1037 	snprintf(cmd, sizeof(cmd), "ThermalProtAband %d %d %d %d %d %d %d %d %d %d",
1038 		 1, 100, 90, 80, 30, 1, 1, 115, 105, 5);
1039 	ret |= mt7925_mcu_chip_config(dev, cmd);
1040 
1041 	return ret;
1042 }
1043 EXPORT_SYMBOL_GPL(mt7925_mcu_set_thermal_protect);
1044 
1045 int mt7925_run_firmware(struct mt792x_dev *dev)
1046 {
1047 	int err;
1048 
1049 	err = mt792x_load_firmware(dev);
1050 	if (err)
1051 		return err;
1052 
1053 	err = mt7925_mcu_get_nic_capability(dev);
1054 	if (err)
1055 		return err;
1056 
1057 	err = mt7925_load_clc(dev, mt792x_ram_name(dev));
1058 	if (err)
1059 		return err;
1060 	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
1061 
1062 	return mt7925_mcu_fw_log_2_host(dev, 1);
1063 }
1064 EXPORT_SYMBOL_GPL(mt7925_run_firmware);
1065 
1066 static void
1067 mt7925_mcu_sta_hdr_trans_tlv(struct sk_buff *skb,
1068 			     struct ieee80211_vif *vif,
1069 			     struct mt792x_link_sta *mlink)
1070 {
1071 	struct sta_rec_hdr_trans *hdr_trans;
1072 	struct mt76_wcid *wcid;
1073 	struct tlv *tlv;
1074 
1075 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HDR_TRANS, sizeof(*hdr_trans));
1076 	hdr_trans = (struct sta_rec_hdr_trans *)tlv;
1077 	hdr_trans->dis_rx_hdr_tran = true;
1078 
1079 	if (vif->type == NL80211_IFTYPE_STATION)
1080 		hdr_trans->to_ds = true;
1081 	else
1082 		hdr_trans->from_ds = true;
1083 
1084 	if (WARN_ON_ONCE(!mlink))
1085 		return;
1086 
1087 	wcid = &mlink->wcid;
1088 
1089 	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
1090 	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
1091 		hdr_trans->to_ds = true;
1092 		hdr_trans->from_ds = true;
1093 	}
1094 }
1095 
1096 int mt7925_mcu_wtbl_update_hdr_trans(struct mt792x_dev *dev,
1097 				     struct ieee80211_vif *vif,
1098 				     struct mt792x_bss_conf *mconf,
1099 				     struct mt792x_link_sta *mlink)
1100 {
1101 	struct sk_buff *skb;
1102 
1103 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
1104 					      &mlink->wcid,
1105 					      MT7925_STA_UPDATE_MAX_SIZE);
1106 	if (IS_ERR(skb))
1107 		return PTR_ERR(skb);
1108 
1109 	mt7925_mcu_sta_hdr_trans_tlv(skb, vif, mlink);
1110 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1111 				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
1112 }
1113 
1114 int mt7925_mcu_set_tx(struct mt792x_dev *dev,
1115 		      struct ieee80211_bss_conf *bss_conf)
1116 {
1117 #define MCU_EDCA_AC_PARAM	0
1118 #define WMM_AIFS_SET		BIT(0)
1119 #define WMM_CW_MIN_SET		BIT(1)
1120 #define WMM_CW_MAX_SET		BIT(2)
1121 #define WMM_TXOP_SET		BIT(3)
1122 #define WMM_PARAM_SET		(WMM_AIFS_SET | WMM_CW_MIN_SET | \
1123 				 WMM_CW_MAX_SET | WMM_TXOP_SET)
1124 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(bss_conf);
1125 	struct {
1126 		u8 bss_idx;
1127 		u8 __rsv[3];
1128 	} __packed hdr = {
1129 		.bss_idx = mconf->mt76.idx,
1130 	};
1131 	struct sk_buff *skb;
1132 	int len = sizeof(hdr) + IEEE80211_NUM_ACS * sizeof(struct edca);
1133 	int ac;
1134 
1135 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, len);
1136 	if (!skb)
1137 		return -ENOMEM;
1138 
1139 	skb_put_data(skb, &hdr, sizeof(hdr));
1140 
1141 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1142 		struct ieee80211_tx_queue_params *q = &mconf->queue_params[ac];
1143 		struct edca *e;
1144 		struct tlv *tlv;
1145 
1146 		tlv = mt76_connac_mcu_add_tlv(skb, MCU_EDCA_AC_PARAM, sizeof(*e));
1147 
1148 		e = (struct edca *)tlv;
1149 		e->set = WMM_PARAM_SET;
1150 		e->queue = ac;
1151 		e->aifs = q->aifs;
1152 		e->txop = cpu_to_le16(q->txop);
1153 
1154 		if (q->cw_min)
1155 			e->cw_min = fls(q->cw_min);
1156 		else
1157 			e->cw_min = 5;
1158 
1159 		if (q->cw_max)
1160 			e->cw_max = fls(q->cw_max);
1161 		else
1162 			e->cw_max = 10;
1163 	}
1164 
1165 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
1166 				     MCU_UNI_CMD(EDCA_UPDATE), true);
1167 }
1168 
1169 static int
1170 mt7925_mcu_sta_key_tlv(struct mt76_wcid *wcid,
1171 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1172 		       struct sk_buff *skb,
1173 		       struct ieee80211_key_conf *key,
1174 		       enum set_key_cmd cmd,
1175 		       struct mt792x_sta *msta)
1176 {
1177 	struct mt792x_vif *mvif = msta->vif;
1178 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1179 	struct sta_rec_sec_uni *sec;
1180 	struct ieee80211_sta *sta;
1181 	struct ieee80211_vif *vif;
1182 	struct tlv *tlv;
1183 
1184 	sta = msta == &mvif->sta ?
1185 		      NULL :
1186 		      container_of((void *)msta, struct ieee80211_sta, drv_priv);
1187 	vif = container_of((void *)mvif, struct ieee80211_vif, drv_priv);
1188 
1189 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V3, sizeof(*sec));
1190 	sec = (struct sta_rec_sec_uni *)tlv;
1191 	sec->bss_idx = mconf->mt76.idx;
1192 	sec->is_authenticator = 0;
1193 	sec->mgmt_prot = 1; /* only used in MLO mode */
1194 	sec->wlan_idx = (u8)wcid->idx;
1195 
1196 	if (sta) {
1197 		struct ieee80211_link_sta *link_sta;
1198 
1199 		sec->tx_key = 1;
1200 		sec->key_type = 1;
1201 		link_sta = mt792x_sta_to_link_sta(vif, sta, wcid->link_id);
1202 
1203 		if (link_sta)
1204 			memcpy(sec->peer_addr, link_sta->addr, ETH_ALEN);
1205 	} else {
1206 		struct ieee80211_bss_conf *link_conf;
1207 
1208 		link_conf = mt792x_vif_to_bss_conf(vif, wcid->link_id);
1209 
1210 		if (link_conf)
1211 			memcpy(sec->peer_addr, link_conf->bssid, ETH_ALEN);
1212 	}
1213 
1214 	if (cmd == SET_KEY) {
1215 		u8 cipher;
1216 
1217 		sec->add = 1;
1218 		cipher = mt7925_mcu_get_cipher(key->cipher);
1219 		if (cipher == CONNAC3_CIPHER_NONE)
1220 			return -EOPNOTSUPP;
1221 
1222 		if (cipher == CONNAC3_CIPHER_BIP_CMAC_128) {
1223 			sec->cipher_id = CONNAC3_CIPHER_BIP_CMAC_128;
1224 			sec->key_id = sta_key_conf->keyidx;
1225 			sec->key_len = 32;
1226 			memcpy(sec->key, sta_key_conf->key, 16);
1227 			memcpy(sec->key + 16, key->key, 16);
1228 		} else {
1229 			sec->cipher_id = cipher;
1230 			sec->key_id = key->keyidx;
1231 			sec->key_len = key->keylen;
1232 			memcpy(sec->key, key->key, key->keylen);
1233 
1234 			if (cipher == CONNAC3_CIPHER_TKIP) {
1235 				/* Rx/Tx MIC keys are swapped */
1236 				memcpy(sec->key + 16, key->key + 24, 8);
1237 				memcpy(sec->key + 24, key->key + 16, 8);
1238 			}
1239 
1240 			/* store key_conf for BIP batch update */
1241 			if (cipher == CONNAC3_CIPHER_AES_CCMP) {
1242 				memcpy(sta_key_conf->key, key->key, key->keylen);
1243 				sta_key_conf->keyidx = key->keyidx;
1244 			}
1245 		}
1246 	} else {
1247 		sec->add = 0;
1248 	}
1249 
1250 	return 0;
1251 }
1252 
1253 int mt7925_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
1254 		       struct mt76_connac_sta_key_conf *sta_key_conf,
1255 		       struct ieee80211_key_conf *key, int mcu_cmd,
1256 		       struct mt76_wcid *wcid, enum set_key_cmd cmd,
1257 		       struct mt792x_sta *msta)
1258 {
1259 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1260 	struct mt792x_bss_conf *mconf = mt792x_vif_to_link(mvif, wcid->link_id);
1261 	struct sk_buff *skb;
1262 	int ret;
1263 
1264 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, wcid,
1265 					      MT7925_STA_UPDATE_MAX_SIZE);
1266 	if (IS_ERR(skb))
1267 		return PTR_ERR(skb);
1268 
1269 	ret = mt7925_mcu_sta_key_tlv(wcid, sta_key_conf, skb, key, cmd, msta);
1270 	if (ret) {
1271 		dev_kfree_skb(skb);
1272 		return ret;
1273 	}
1274 
1275 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
1276 }
1277 
1278 int mt7925_mcu_set_mlo_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1279 			   u16 sel_links, int duration, u8 token_id)
1280 {
1281 	struct mt792x_vif *mvif = mconf->vif;
1282 	struct ieee80211_vif *vif = container_of((void *)mvif,
1283 						 struct ieee80211_vif, drv_priv);
1284 	struct ieee80211_bss_conf *link_conf;
1285 	struct ieee80211_channel *chan;
1286 	const u8 ch_band[] = {
1287 		[NL80211_BAND_2GHZ] = 1,
1288 		[NL80211_BAND_5GHZ] = 2,
1289 		[NL80211_BAND_6GHZ] = 3,
1290 	};
1291 	enum mt7925_roc_req type;
1292 	int center_ch, i = 0;
1293 	bool is_AG_band = false;
1294 	struct {
1295 		u8 id;
1296 		u8 bss_idx;
1297 		u16 tag;
1298 		struct mt792x_bss_conf *mconf;
1299 		struct ieee80211_channel *chan;
1300 	} links[2];
1301 
1302 	struct {
1303 		struct {
1304 			u8 rsv[4];
1305 		} __packed hdr;
1306 		struct roc_acquire_tlv roc[2];
1307 	} __packed req = {
1308 			.roc[0].tag = cpu_to_le16(UNI_ROC_NUM),
1309 			.roc[0].len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1310 			.roc[1].tag = cpu_to_le16(UNI_ROC_NUM),
1311 			.roc[1].len = cpu_to_le16(sizeof(struct roc_acquire_tlv))
1312 	};
1313 
1314 	struct wiphy *wiphy = phy->mt76->hw->wiphy;
1315 
1316 	if (!mconf || hweight16(vif->valid_links) < 2 ||
1317 	    hweight16(sel_links) != 2)
1318 		return -EPERM;
1319 
1320 	for (i = 0; i < ARRAY_SIZE(links); i++) {
1321 		links[i].id = i ? __ffs(~BIT(mconf->link_id) & sel_links) :
1322 				 mconf->link_id;
1323 		link_conf = mt792x_vif_to_bss_conf(vif, links[i].id);
1324 		if (WARN_ON_ONCE(!link_conf))
1325 			return -EPERM;
1326 
1327 		links[i].chan = link_conf->chanreq.oper.chan;
1328 		if (WARN_ON_ONCE(!links[i].chan))
1329 			return -EPERM;
1330 
1331 		links[i].mconf = mt792x_vif_to_link(mvif, links[i].id);
1332 		links[i].tag = links[i].id == mconf->link_id ?
1333 			       UNI_ROC_ACQUIRE : UNI_ROC_SUB_LINK;
1334 
1335 		is_AG_band |= links[i].chan->band == NL80211_BAND_2GHZ;
1336 	}
1337 
1338 	if (!(wiphy->iftype_ext_capab[0].mld_capa_and_ops &
1339 	      IEEE80211_MLD_CAP_OP_MAX_SIMUL_LINKS))
1340 		type = is_AG_band ? MT7925_ROC_REQ_MLSR_AG :
1341 				    MT7925_ROC_REQ_MLSR_AA;
1342 	else
1343 		type = MT7925_ROC_REQ_JOIN;
1344 
1345 	for (i = 0; i < ARRAY_SIZE(links) && i < hweight16(vif->active_links); i++) {
1346 		if (WARN_ON_ONCE(!links[i].mconf || !links[i].chan))
1347 			continue;
1348 
1349 		chan = links[i].chan;
1350 		center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1351 		req.roc[i].len = cpu_to_le16(sizeof(struct roc_acquire_tlv));
1352 		req.roc[i].tag = cpu_to_le16(links[i].tag);
1353 		req.roc[i].tokenid = token_id;
1354 		req.roc[i].reqtype = type;
1355 		req.roc[i].maxinterval = cpu_to_le32(duration);
1356 		req.roc[i].bss_idx = links[i].mconf->mt76.idx;
1357 		req.roc[i].control_channel = chan->hw_value;
1358 		req.roc[i].bw = CMD_CBW_20MHZ;
1359 		req.roc[i].bw_from_ap = CMD_CBW_20MHZ;
1360 		req.roc[i].center_chan = center_ch;
1361 		req.roc[i].center_chan_from_ap = center_ch;
1362 		req.roc[i].center_chan2 = 0;
1363 		req.roc[i].center_chan2_from_ap = 0;
1364 
1365 		/* STR : 0xfe indicates BAND_ALL with enabling DBDC
1366 		 * EMLSR : 0xff indicates (BAND_AUTO) without DBDC
1367 		 */
1368 		req.roc[i].dbdcband = type == MT7925_ROC_REQ_JOIN ? 0xfe : 0xff;
1369 
1370 		if (chan->hw_value < center_ch)
1371 			req.roc[i].sco = 1; /* SCA */
1372 		else if (chan->hw_value > center_ch)
1373 			req.roc[i].sco = 3; /* SCB */
1374 
1375 		req.roc[i].band = ch_band[chan->band];
1376 	}
1377 
1378 	return mt76_mcu_send_msg(&mvif->phy->dev->mt76, MCU_UNI_CMD(ROC),
1379 				 &req, sizeof(req), true);
1380 }
1381 
1382 int mt7925_mcu_set_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1383 		       struct ieee80211_channel *chan, int duration,
1384 		       enum mt7925_roc_req type, u8 token_id)
1385 {
1386 	int center_ch = ieee80211_frequency_to_channel(chan->center_freq);
1387 	struct mt792x_dev *dev = phy->dev;
1388 	struct {
1389 		struct {
1390 			u8 rsv[4];
1391 		} __packed hdr;
1392 		struct roc_acquire_tlv roc;
1393 	} __packed req = {
1394 		.roc = {
1395 			.tag = cpu_to_le16(UNI_ROC_ACQUIRE),
1396 			.len = cpu_to_le16(sizeof(struct roc_acquire_tlv)),
1397 			.tokenid = token_id,
1398 			.reqtype = type,
1399 			.maxinterval = cpu_to_le32(duration),
1400 			.bss_idx = mconf->mt76.idx,
1401 			.control_channel = chan->hw_value,
1402 			.bw = CMD_CBW_20MHZ,
1403 			.bw_from_ap = CMD_CBW_20MHZ,
1404 			.center_chan = center_ch,
1405 			.center_chan_from_ap = center_ch,
1406 			.dbdcband = 0xff, /* auto */
1407 		},
1408 	};
1409 
1410 	if (chan->hw_value < center_ch)
1411 		req.roc.sco = 1; /* SCA */
1412 	else if (chan->hw_value > center_ch)
1413 		req.roc.sco = 3; /* SCB */
1414 
1415 	switch (chan->band) {
1416 	case NL80211_BAND_6GHZ:
1417 		req.roc.band = 3;
1418 		break;
1419 	case NL80211_BAND_5GHZ:
1420 		req.roc.band = 2;
1421 		break;
1422 	default:
1423 		req.roc.band = 1;
1424 		break;
1425 	}
1426 
1427 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1428 				 &req, sizeof(req), true);
1429 }
1430 
1431 int mt7925_mcu_abort_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf,
1432 			 u8 token_id)
1433 {
1434 	struct mt792x_dev *dev = phy->dev;
1435 	struct {
1436 		struct {
1437 			u8 rsv[4];
1438 		} __packed hdr;
1439 		struct roc_abort_tlv {
1440 			__le16 tag;
1441 			__le16 len;
1442 			u8 bss_idx;
1443 			u8 tokenid;
1444 			u8 dbdcband;
1445 			u8 rsv[5];
1446 		} __packed abort;
1447 	} __packed req = {
1448 		.abort = {
1449 			.tag = cpu_to_le16(UNI_ROC_ABORT),
1450 			.len = cpu_to_le16(sizeof(struct roc_abort_tlv)),
1451 			.tokenid = token_id,
1452 			.bss_idx = mconf->mt76.idx,
1453 			.dbdcband = 0xff, /* auto*/
1454 		},
1455 	};
1456 
1457 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(ROC),
1458 				 &req, sizeof(req), true);
1459 }
1460 
1461 int mt7925_mcu_set_eeprom(struct mt792x_dev *dev)
1462 {
1463 	struct {
1464 		u8 _rsv[4];
1465 
1466 		__le16 tag;
1467 		__le16 len;
1468 		u8 buffer_mode;
1469 		u8 format;
1470 		__le16 buf_len;
1471 	} __packed req = {
1472 		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
1473 		.len = cpu_to_le16(sizeof(req) - 4),
1474 		.buffer_mode = EE_MODE_EFUSE,
1475 		.format = EE_FORMAT_WHOLE
1476 	};
1477 
1478 	return mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(EFUSE_CTRL),
1479 					 &req, sizeof(req), true, NULL);
1480 }
1481 EXPORT_SYMBOL_GPL(mt7925_mcu_set_eeprom);
1482 
1483 int mt7925_mcu_uni_bss_ps(struct mt792x_dev *dev,
1484 			  struct ieee80211_bss_conf *link_conf)
1485 {
1486 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1487 	struct {
1488 		struct {
1489 			u8 bss_idx;
1490 			u8 pad[3];
1491 		} __packed hdr;
1492 		struct ps_tlv {
1493 			__le16 tag;
1494 			__le16 len;
1495 			u8 ps_state; /* 0: device awake
1496 				      * 1: static power save
1497 				      * 2: dynamic power saving
1498 				      * 3: enter TWT power saving
1499 				      * 4: leave TWT power saving
1500 				      */
1501 			u8 pad[3];
1502 		} __packed ps;
1503 	} __packed ps_req = {
1504 		.hdr = {
1505 			.bss_idx = mconf->mt76.idx,
1506 		},
1507 		.ps = {
1508 			.tag = cpu_to_le16(UNI_BSS_INFO_PS),
1509 			.len = cpu_to_le16(sizeof(struct ps_tlv)),
1510 			.ps_state = link_conf->vif->cfg.ps ? 2 : 0,
1511 		},
1512 	};
1513 
1514 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1515 		return -EOPNOTSUPP;
1516 
1517 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1518 				 &ps_req, sizeof(ps_req), true);
1519 }
1520 
1521 int
1522 mt7925_mcu_uni_bss_bcnft(struct mt792x_dev *dev,
1523 			 struct ieee80211_bss_conf *link_conf, bool enable)
1524 {
1525 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1526 	struct {
1527 		struct {
1528 			u8 bss_idx;
1529 			u8 pad[3];
1530 		} __packed hdr;
1531 		struct bcnft_tlv {
1532 			__le16 tag;
1533 			__le16 len;
1534 			__le16 bcn_interval;
1535 			u8 dtim_period;
1536 			u8 bmc_delivered_ac;
1537 			u8 bmc_triggered_ac;
1538 			u8 pad[3];
1539 		} __packed bcnft;
1540 	} __packed bcnft_req = {
1541 		.hdr = {
1542 			.bss_idx = mconf->mt76.idx,
1543 		},
1544 		.bcnft = {
1545 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1546 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1547 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1548 			.dtim_period = link_conf->dtim_period,
1549 		},
1550 	};
1551 
1552 	if (link_conf->vif->type != NL80211_IFTYPE_STATION)
1553 		return 0;
1554 
1555 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1556 				 &bcnft_req, sizeof(bcnft_req), true);
1557 }
1558 
1559 int
1560 mt7925_mcu_set_bss_pm(struct mt792x_dev *dev,
1561 		      struct ieee80211_bss_conf *link_conf,
1562 		      bool enable)
1563 {
1564 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
1565 	struct {
1566 		struct {
1567 			u8 bss_idx;
1568 			u8 pad[3];
1569 		} __packed hdr;
1570 		struct bcnft_tlv {
1571 			__le16 tag;
1572 			__le16 len;
1573 			__le16 bcn_interval;
1574 			u8 dtim_period;
1575 			u8 bmc_delivered_ac;
1576 			u8 bmc_triggered_ac;
1577 			u8 pad[3];
1578 		} __packed enable;
1579 	} req = {
1580 		.hdr = {
1581 			.bss_idx = mconf->mt76.idx,
1582 		},
1583 		.enable = {
1584 			.tag = cpu_to_le16(UNI_BSS_INFO_BCNFT),
1585 			.len = cpu_to_le16(sizeof(struct bcnft_tlv)),
1586 			.dtim_period = link_conf->dtim_period,
1587 			.bcn_interval = cpu_to_le16(link_conf->beacon_int),
1588 		},
1589 	};
1590 	struct {
1591 		struct {
1592 			u8 bss_idx;
1593 			u8 pad[3];
1594 		} __packed hdr;
1595 		struct pm_disable {
1596 			__le16 tag;
1597 			__le16 len;
1598 		} __packed disable;
1599 	} req1 = {
1600 		.hdr = {
1601 			.bss_idx = mconf->mt76.idx,
1602 		},
1603 		.disable = {
1604 			.tag = cpu_to_le16(UNI_BSS_INFO_PM_DISABLE),
1605 			.len = cpu_to_le16(sizeof(struct pm_disable))
1606 		},
1607 	};
1608 	int err;
1609 
1610 	err = mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1611 				&req1, sizeof(req1), true);
1612 	if (err < 0 || !enable)
1613 		return err;
1614 
1615 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
1616 				 &req, sizeof(req), true);
1617 }
1618 
1619 static void
1620 mt7925_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1621 {
1622 	if (!link_sta->he_cap.has_he)
1623 		return;
1624 
1625 	mt76_connac_mcu_sta_he_tlv_v2(skb, link_sta->sta);
1626 }
1627 
1628 static void
1629 mt7925_mcu_sta_he_6g_tlv(struct sk_buff *skb,
1630 			 struct ieee80211_link_sta *link_sta)
1631 {
1632 	struct sta_rec_he_6g_capa *he_6g;
1633 	struct tlv *tlv;
1634 
1635 	if (!link_sta->he_6ghz_capa.capa)
1636 		return;
1637 
1638 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G, sizeof(*he_6g));
1639 
1640 	he_6g = (struct sta_rec_he_6g_capa *)tlv;
1641 	he_6g->capa = link_sta->he_6ghz_capa.capa;
1642 }
1643 
1644 static void
1645 mt7925_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1646 {
1647 	struct ieee80211_eht_mcs_nss_supp *mcs_map;
1648 	struct ieee80211_eht_cap_elem_fixed *elem;
1649 	struct sta_rec_eht *eht;
1650 	struct tlv *tlv;
1651 
1652 	if (!link_sta->eht_cap.has_eht)
1653 		return;
1654 
1655 	mcs_map = &link_sta->eht_cap.eht_mcs_nss_supp;
1656 	elem = &link_sta->eht_cap.eht_cap_elem;
1657 
1658 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT, sizeof(*eht));
1659 
1660 	eht = (struct sta_rec_eht *)tlv;
1661 	eht->tid_bitmap = 0xff;
1662 	eht->mac_cap = cpu_to_le16(*(u16 *)elem->mac_cap_info);
1663 	eht->phy_cap = cpu_to_le64(*(u64 *)elem->phy_cap_info);
1664 	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
1665 
1666 	if (link_sta->bandwidth == IEEE80211_STA_RX_BW_20)
1667 		memcpy(eht->mcs_map_bw20, &mcs_map->only_20mhz, sizeof(eht->mcs_map_bw20));
1668 	memcpy(eht->mcs_map_bw80, &mcs_map->bw._80, sizeof(eht->mcs_map_bw80));
1669 	memcpy(eht->mcs_map_bw160, &mcs_map->bw._160, sizeof(eht->mcs_map_bw160));
1670 }
1671 
1672 static void
1673 mt7925_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1674 {
1675 	struct sta_rec_ht *ht;
1676 	struct tlv *tlv;
1677 
1678 	if (!link_sta->ht_cap.ht_supported)
1679 		return;
1680 
1681 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
1682 
1683 	ht = (struct sta_rec_ht *)tlv;
1684 	ht->ht_cap = cpu_to_le16(link_sta->ht_cap.cap);
1685 }
1686 
1687 static void
1688 mt7925_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
1689 {
1690 	struct sta_rec_vht *vht;
1691 	struct tlv *tlv;
1692 
1693 	/* For 6G band, this tlv is necessary to let hw work normally */
1694 	if (!link_sta->he_6ghz_capa.capa && !link_sta->vht_cap.vht_supported)
1695 		return;
1696 
1697 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
1698 
1699 	vht = (struct sta_rec_vht *)tlv;
1700 	vht->vht_cap = cpu_to_le32(link_sta->vht_cap.cap);
1701 	vht->vht_rx_mcs_map = link_sta->vht_cap.vht_mcs.rx_mcs_map;
1702 	vht->vht_tx_mcs_map = link_sta->vht_cap.vht_mcs.tx_mcs_map;
1703 }
1704 
1705 static void
1706 mt7925_mcu_sta_amsdu_tlv(struct sk_buff *skb,
1707 			 struct ieee80211_vif *vif,
1708 			 struct ieee80211_link_sta *link_sta,
1709 			 struct mt792x_link_sta *mlink)
1710 {
1711 	struct sta_rec_amsdu *amsdu;
1712 	struct tlv *tlv;
1713 
1714 	if (vif->type != NL80211_IFTYPE_STATION &&
1715 	    vif->type != NL80211_IFTYPE_AP)
1716 		return;
1717 
1718 	if (!link_sta->agg.max_amsdu_len)
1719 		return;
1720 
1721 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
1722 	amsdu = (struct sta_rec_amsdu *)tlv;
1723 	amsdu->max_amsdu_num = 8;
1724 	amsdu->amsdu_en = true;
1725 
1726 	mlink->wcid.amsdu = true;
1727 
1728 	switch (link_sta->agg.max_amsdu_len) {
1729 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
1730 		amsdu->max_mpdu_size =
1731 			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
1732 		return;
1733 	case IEEE80211_MAX_MPDU_LEN_HT_7935:
1734 	case IEEE80211_MAX_MPDU_LEN_VHT_7991:
1735 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
1736 		return;
1737 	default:
1738 		amsdu->max_mpdu_size = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
1739 		return;
1740 	}
1741 }
1742 
1743 static void
1744 mt7925_mcu_sta_phy_tlv(struct sk_buff *skb,
1745 		       struct ieee80211_vif *vif,
1746 		       struct ieee80211_link_sta *link_sta)
1747 {
1748 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1749 	struct ieee80211_bss_conf *link_conf;
1750 	struct cfg80211_chan_def *chandef;
1751 	struct mt792x_bss_conf *mconf;
1752 	struct sta_rec_phy *phy;
1753 	struct tlv *tlv;
1754 	u8 af = 0, mm = 0;
1755 
1756 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1757 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1758 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1759 				    &link_conf->chanreq.oper;
1760 
1761 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PHY, sizeof(*phy));
1762 	phy = (struct sta_rec_phy *)tlv;
1763 	phy->phy_type = mt76_connac_get_phy_mode_v2(mvif->phy->mt76, vif,
1764 						    chandef->chan->band,
1765 						    link_sta);
1766 	phy->basic_rate = cpu_to_le16((u16)link_conf->basic_rates);
1767 	if (link_sta->ht_cap.ht_supported) {
1768 		af = link_sta->ht_cap.ampdu_factor;
1769 		mm = link_sta->ht_cap.ampdu_density;
1770 	}
1771 
1772 	if (link_sta->vht_cap.vht_supported) {
1773 		u8 vht_af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
1774 				      link_sta->vht_cap.cap);
1775 
1776 		af = max_t(u8, af, vht_af);
1777 	}
1778 
1779 	if (link_sta->he_6ghz_capa.capa) {
1780 		af = le16_get_bits(link_sta->he_6ghz_capa.capa,
1781 				   IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
1782 		mm = le16_get_bits(link_sta->he_6ghz_capa.capa,
1783 				   IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
1784 	}
1785 
1786 	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR, af) |
1787 		     FIELD_PREP(IEEE80211_HT_AMPDU_PARM_DENSITY, mm);
1788 	phy->max_ampdu_len = af;
1789 }
1790 
1791 static void
1792 mt7925_mcu_sta_state_v2_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
1793 			    struct ieee80211_link_sta *link_sta,
1794 			    struct ieee80211_vif *vif,
1795 			    u8 rcpi, u8 sta_state)
1796 {
1797 	struct sta_rec_state_v2 {
1798 		__le16 tag;
1799 		__le16 len;
1800 		u8 state;
1801 		u8 rsv[3];
1802 		__le32 flags;
1803 		u8 vht_opmode;
1804 		u8 action;
1805 		u8 rsv2[2];
1806 	} __packed * state;
1807 	struct tlv *tlv;
1808 
1809 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_STATE, sizeof(*state));
1810 	state = (struct sta_rec_state_v2 *)tlv;
1811 	state->state = sta_state;
1812 
1813 	if (link_sta->vht_cap.vht_supported) {
1814 		state->vht_opmode = link_sta->bandwidth;
1815 		state->vht_opmode |= link_sta->rx_nss <<
1816 			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
1817 	}
1818 }
1819 
1820 static void
1821 mt7925_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb,
1822 			     struct ieee80211_vif *vif,
1823 			     struct ieee80211_link_sta *link_sta)
1824 {
1825 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1826 	struct ieee80211_bss_conf *link_conf;
1827 	struct cfg80211_chan_def *chandef;
1828 	struct sta_rec_ra_info *ra_info;
1829 	struct mt792x_bss_conf *mconf;
1830 	enum nl80211_band band;
1831 	struct tlv *tlv;
1832 	u16 supp_rates;
1833 
1834 	link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id);
1835 	mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
1836 	chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
1837 				    &link_conf->chanreq.oper;
1838 	band = chandef->chan->band;
1839 
1840 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra_info));
1841 	ra_info = (struct sta_rec_ra_info *)tlv;
1842 
1843 	supp_rates = link_sta->supp_rates[band];
1844 	if (band == NL80211_BAND_2GHZ)
1845 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
1846 			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
1847 	else
1848 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates);
1849 
1850 	ra_info->legacy = cpu_to_le16(supp_rates);
1851 
1852 	if (link_sta->ht_cap.ht_supported)
1853 		memcpy(ra_info->rx_mcs_bitmask,
1854 		       link_sta->ht_cap.mcs.rx_mask,
1855 		       HT_MCS_MASK_NUM);
1856 }
1857 
1858 static void
1859 mt7925_mcu_sta_eht_mld_tlv(struct sk_buff *skb,
1860 			   struct ieee80211_vif *vif, struct ieee80211_sta *sta)
1861 {
1862 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1863 	struct wiphy *wiphy = mvif->phy->mt76->hw->wiphy;
1864 	const struct wiphy_iftype_ext_capab *ext_capa;
1865 	struct sta_rec_eht_mld *eht_mld;
1866 	struct tlv *tlv;
1867 	u16 eml_cap;
1868 
1869 	if (!ieee80211_vif_is_mld(vif))
1870 		return;
1871 
1872 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT_MLD, sizeof(*eht_mld));
1873 	eht_mld = (struct sta_rec_eht_mld *)tlv;
1874 	eht_mld->mld_type = 0xff;
1875 
1876 	ext_capa = cfg80211_get_iftype_ext_capa(wiphy,
1877 						ieee80211_vif_type_p2p(vif));
1878 	if (!ext_capa)
1879 		return;
1880 
1881 	eml_cap = (vif->cfg.eml_cap & (IEEE80211_EML_CAP_EMLSR_SUPP |
1882 				       IEEE80211_EML_CAP_TRANSITION_TIMEOUT)) |
1883 		  (ext_capa->eml_capabilities & (IEEE80211_EML_CAP_EMLSR_PADDING_DELAY |
1884 						IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY));
1885 
1886 	if (eml_cap & IEEE80211_EML_CAP_EMLSR_SUPP) {
1887 		eht_mld->eml_cap[0] = u16_get_bits(eml_cap, GENMASK(7, 0));
1888 		eht_mld->eml_cap[1] = u16_get_bits(eml_cap, GENMASK(15, 8));
1889 	} else {
1890 		eht_mld->str_cap[0] = BIT(1);
1891 	}
1892 }
1893 
1894 static void
1895 mt7925_mcu_sta_mld_tlv(struct sk_buff *skb,
1896 		       struct ieee80211_vif *vif,
1897 		       struct ieee80211_sta *sta,
1898 		       struct mt792x_bss_conf *mconf,
1899 		       struct mt792x_link_sta *mlink)
1900 {
1901 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
1902 	struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv;
1903 	struct mt792x_dev *dev = mvif->phy->dev;
1904 	struct mt792x_bss_conf *mconf_pri;
1905 	struct sta_rec_mld *mld;
1906 	struct tlv *tlv;
1907 	u8 cnt = 0;
1908 
1909 	/* Primary link always uses driver's deflink WCID. */
1910 	mconf_pri = (msta->deflink_id != IEEE80211_LINK_UNSPECIFIED) ?
1911 		    mt792x_vif_to_link(mvif, msta->deflink_id) : NULL;
1912 
1913 	/* If caller is operating on deflink, reuse its mconf as primary. */
1914 	if (!mconf_pri && mlink == &msta->deflink)
1915 		mconf_pri = mconf;
1916 
1917 	if (!mconf_pri) {
1918 		dev_warn_ratelimited(dev->mt76.dev,
1919 				     "mt7925: MLD_TLV_LINK skip (no primary mconf) sta=%pM\n",
1920 			sta->addr);
1921 		return;
1922 	}
1923 
1924 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MLD, sizeof(*mld));
1925 	mld = (struct sta_rec_mld *)tlv;
1926 	memcpy(mld->mac_addr, sta->addr, ETH_ALEN);
1927 
1928 	mld->primary_id = cpu_to_le16(msta->deflink.wcid.idx);
1929 	mld->wlan_id = cpu_to_le16(msta->deflink.wcid.idx);
1930 
1931 	/* Always encode primary link first. */
1932 	mld->link[cnt].wlan_id = cpu_to_le16(msta->deflink.wcid.idx);
1933 	mld->link[cnt++].bss_idx = mconf_pri->mt76.idx;
1934 
1935 	/* Optionally encode the currently-updated secondary link. */
1936 	if (mlink && mlink != &msta->deflink && mconf) {
1937 		mld->secondary_id = cpu_to_le16(mlink->wcid.idx);
1938 		mld->link[cnt].wlan_id = cpu_to_le16(mlink->wcid.idx);
1939 		mld->link[cnt++].bss_idx = mconf->mt76.idx;
1940 	}
1941 
1942 	mld->link_num = cnt;
1943 }
1944 
1945 static void
1946 mt7925_mcu_sta_remove_tlv(struct sk_buff *skb)
1947 {
1948 	struct sta_rec_remove *rem;
1949 	struct tlv *tlv;
1950 
1951 	tlv = mt76_connac_mcu_add_tlv(skb, 0x25, sizeof(*rem));
1952 	rem = (struct sta_rec_remove *)tlv;
1953 	rem->action = 0;
1954 }
1955 
1956 static int
1957 mt7925_mcu_sta_cmd(struct mt76_phy *phy,
1958 		   struct mt76_sta_cmd_info *info)
1959 {
1960 	struct mt792x_vif *mvif = (struct mt792x_vif *)info->vif->drv_priv;
1961 	struct mt76_dev *dev = phy->dev;
1962 	struct mt792x_bss_conf *mconf;
1963 	struct mt792x_link_sta *mlink;
1964 	struct sk_buff *skb;
1965 	int conn_state;
1966 
1967 	mconf = mt792x_vif_to_link(mvif, info->wcid->link_id);
1968 	mlink = container_of(info->wcid, struct mt792x_link_sta, wcid);
1969 
1970 	skb = __mt76_connac_mcu_alloc_sta_req(dev, &mconf->mt76, info->wcid,
1971 					      MT7925_STA_UPDATE_MAX_SIZE);
1972 	if (IS_ERR(skb))
1973 		return PTR_ERR(skb);
1974 
1975 	conn_state = info->enable ? CONN_STATE_PORT_SECURE :
1976 				    CONN_STATE_DISCONNECT;
1977 
1978 	if (info->enable && info->link_sta) {
1979 		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->link_conf,
1980 					      info->link_sta,
1981 					      conn_state, info->newly);
1982 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->link_sta);
1983 		mt7925_mcu_sta_ht_tlv(skb, info->link_sta);
1984 		mt7925_mcu_sta_vht_tlv(skb, info->link_sta);
1985 		mt76_connac_mcu_sta_uapsd(skb, info->vif, info->link_sta->sta);
1986 		mt7925_mcu_sta_amsdu_tlv(skb, info->vif, info->link_sta, mlink);
1987 		mt7925_mcu_sta_he_tlv(skb, info->link_sta);
1988 		mt7925_mcu_sta_he_6g_tlv(skb, info->link_sta);
1989 		mt7925_mcu_sta_eht_tlv(skb, info->link_sta);
1990 		mt7925_mcu_sta_rate_ctrl_tlv(skb, info->vif,
1991 					     info->link_sta);
1992 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->link_sta,
1993 					    info->vif, info->rcpi,
1994 					    info->state);
1995 
1996 		if (info->state != MT76_STA_INFO_STATE_NONE) {
1997 			mt7925_mcu_sta_mld_tlv(skb, info->vif,
1998 					       info->link_sta->sta,
1999 					       mconf, mlink);
2000 
2001 			mt7925_mcu_sta_eht_mld_tlv(skb, info->vif, info->link_sta->sta);
2002 		}
2003 	}
2004 
2005 	if (!info->enable) {
2006 		mt7925_mcu_sta_remove_tlv(skb);
2007 		mt76_connac_mcu_add_tlv(skb, STA_REC_MLD_OFF,
2008 					sizeof(struct tlv));
2009 	} else {
2010 		if (!info->link_sta)
2011 			mlink = &mvif->sta.deflink;
2012 
2013 		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, mlink);
2014 	}
2015 
2016 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
2017 }
2018 
2019 int mt7925_mcu_sta_update(struct mt792x_dev *dev,
2020 			  struct ieee80211_link_sta *link_sta,
2021 			  struct ieee80211_vif *vif,
2022 			  struct mt792x_link_sta *mlink,
2023 			  bool enable,
2024 			  enum mt76_sta_info_state state)
2025 {
2026 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
2027 	int rssi = -ewma_rssi_read(&mvif->bss_conf.rssi);
2028 	struct mt76_sta_cmd_info info = {
2029 		.link_sta = link_sta,
2030 		.vif = vif,
2031 		.link_conf = &vif->bss_conf,
2032 		.enable = enable,
2033 		.cmd = MCU_UNI_CMD(STA_REC_UPDATE),
2034 		.state = state,
2035 		.offload_fw = true,
2036 		.rcpi = to_rcpi(rssi),
2037 	};
2038 
2039 	info.wcid = &mlink->wcid;
2040 	info.newly = state != MT76_STA_INFO_STATE_ASSOC;
2041 
2042 	return mt7925_mcu_sta_cmd(&dev->mphy, &info);
2043 }
2044 
2045 int mt7925_mcu_set_beacon_filter(struct mt792x_dev *dev,
2046 				 struct ieee80211_vif *vif,
2047 				 bool enable)
2048 {
2049 #define MT7925_FIF_BIT_CLR		BIT(1)
2050 #define MT7925_FIF_BIT_SET		BIT(0)
2051 	int err = 0;
2052 
2053 	if (enable) {
2054 		err = mt7925_mcu_uni_bss_bcnft(dev, &vif->bss_conf, true);
2055 		if (err < 0)
2056 			return err;
2057 
2058 		return mt7925_mcu_set_rxfilter(dev, 0,
2059 					       MT7925_FIF_BIT_SET,
2060 					       MT_WF_RFCR_DROP_OTHER_BEACON);
2061 	}
2062 
2063 	err = mt7925_mcu_set_bss_pm(dev, &vif->bss_conf, false);
2064 	if (err < 0)
2065 		return err;
2066 
2067 	return mt7925_mcu_set_rxfilter(dev, 0,
2068 				       MT7925_FIF_BIT_CLR,
2069 				       MT_WF_RFCR_DROP_OTHER_BEACON);
2070 }
2071 
2072 int mt7925_get_txpwr_info(struct mt792x_dev *dev, u8 band_idx, struct mt7925_txpwr *txpwr)
2073 {
2074 #define TX_POWER_SHOW_INFO 0x7
2075 #define TXPOWER_ALL_RATE_POWER_INFO 0x2
2076 	struct mt7925_txpwr_event *event;
2077 	struct mt7925_txpwr_req req = {
2078 		.tag = cpu_to_le16(TX_POWER_SHOW_INFO),
2079 		.len = cpu_to_le16(sizeof(req) - 4),
2080 		.catg = TXPOWER_ALL_RATE_POWER_INFO,
2081 		.band_idx = band_idx,
2082 	};
2083 	struct sk_buff *skb;
2084 	int ret;
2085 
2086 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_CMD(TXPOWER),
2087 					&req, sizeof(req), true, &skb);
2088 	if (ret)
2089 		return ret;
2090 
2091 	event = (struct mt7925_txpwr_event *)skb->data;
2092 	memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
2093 
2094 	dev_kfree_skb(skb);
2095 
2096 	return 0;
2097 }
2098 
2099 int mt7925_mcu_set_sniffer(struct mt792x_dev *dev, struct ieee80211_vif *vif,
2100 			   bool enable)
2101 {
2102 	struct {
2103 		struct {
2104 			u8 band_idx;
2105 			u8 pad[3];
2106 		} __packed hdr;
2107 		struct sniffer_enable_tlv {
2108 			__le16 tag;
2109 			__le16 len;
2110 			u8 enable;
2111 			u8 pad[3];
2112 		} __packed enable;
2113 	} __packed req = {
2114 		.hdr = {
2115 			.band_idx = 0,
2116 		},
2117 		.enable = {
2118 			.tag = cpu_to_le16(UNI_SNIFFER_ENABLE),
2119 			.len = cpu_to_le16(sizeof(struct sniffer_enable_tlv)),
2120 			.enable = enable,
2121 		},
2122 	};
2123 
2124 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req),
2125 				 true);
2126 }
2127 
2128 int mt7925_mcu_config_sniffer(struct mt792x_vif *vif,
2129 			      struct ieee80211_chanctx_conf *ctx)
2130 {
2131 	struct mt76_phy *mphy = vif->phy->mt76;
2132 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def : &mphy->chandef;
2133 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2134 
2135 	static const u8 ch_band[] = {
2136 		[NL80211_BAND_2GHZ] = 1,
2137 		[NL80211_BAND_5GHZ] = 2,
2138 		[NL80211_BAND_6GHZ] = 3,
2139 	};
2140 	static const u8 ch_width[] = {
2141 		[NL80211_CHAN_WIDTH_20_NOHT] = 0,
2142 		[NL80211_CHAN_WIDTH_20] = 0,
2143 		[NL80211_CHAN_WIDTH_40] = 0,
2144 		[NL80211_CHAN_WIDTH_80] = 1,
2145 		[NL80211_CHAN_WIDTH_160] = 2,
2146 		[NL80211_CHAN_WIDTH_80P80] = 3,
2147 		[NL80211_CHAN_WIDTH_5] = 4,
2148 		[NL80211_CHAN_WIDTH_10] = 5,
2149 		[NL80211_CHAN_WIDTH_320] = 6,
2150 	};
2151 
2152 	struct {
2153 		struct {
2154 			u8 band_idx;
2155 			u8 pad[3];
2156 		} __packed hdr;
2157 		struct config_tlv {
2158 			__le16 tag;
2159 			__le16 len;
2160 			u16 aid;
2161 			u8 ch_band;
2162 			u8 bw;
2163 			u8 control_ch;
2164 			u8 sco;
2165 			u8 center_ch;
2166 			u8 center_ch2;
2167 			u8 drop_err;
2168 			u8 pad[3];
2169 		} __packed tlv;
2170 	} __packed req = {
2171 		.hdr = {
2172 			.band_idx = 0,
2173 		},
2174 		.tlv = {
2175 			.tag = cpu_to_le16(UNI_SNIFFER_CONFIG),
2176 			.len = cpu_to_le16(sizeof(req.tlv)),
2177 			.control_ch = chandef->chan->hw_value,
2178 			.center_ch = ieee80211_frequency_to_channel(freq1),
2179 			.drop_err = 1,
2180 		},
2181 	};
2182 
2183 	if (chandef->chan->band < ARRAY_SIZE(ch_band))
2184 		req.tlv.ch_band = ch_band[chandef->chan->band];
2185 	if (chandef->width < ARRAY_SIZE(ch_width))
2186 		req.tlv.bw = ch_width[chandef->width];
2187 
2188 	if (freq2)
2189 		req.tlv.center_ch2 = ieee80211_frequency_to_channel(freq2);
2190 
2191 	if (req.tlv.control_ch < req.tlv.center_ch)
2192 		req.tlv.sco = 1; /* SCA */
2193 	else if (req.tlv.control_ch > req.tlv.center_ch)
2194 		req.tlv.sco = 3; /* SCB */
2195 
2196 	return mt76_mcu_send_msg(mphy->dev, MCU_UNI_CMD(SNIFFER),
2197 				 &req, sizeof(req), true);
2198 }
2199 
2200 int
2201 mt7925_mcu_uni_add_beacon_offload(struct mt792x_dev *dev,
2202 				  struct ieee80211_hw *hw,
2203 				  struct ieee80211_vif *vif,
2204 				  bool enable)
2205 {
2206 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
2207 	struct ieee80211_mutable_offsets offs;
2208 	struct {
2209 		struct req_hdr {
2210 			u8 bss_idx;
2211 			u8 pad[3];
2212 		} __packed hdr;
2213 		struct bcn_content_tlv {
2214 			__le16 tag;
2215 			__le16 len;
2216 			__le16 tim_ie_pos;
2217 			__le16 csa_ie_pos;
2218 			__le16 bcc_ie_pos;
2219 			/* 0: disable beacon offload
2220 			 * 1: enable beacon offload
2221 			 * 2: update probe respond offload
2222 			 */
2223 			u8 enable;
2224 			/* 0: legacy format (TXD + payload)
2225 			 * 1: only cap field IE
2226 			 */
2227 			u8 type;
2228 			__le16 pkt_len;
2229 			u8 pkt[512];
2230 		} __packed beacon_tlv;
2231 	} req = {
2232 		.hdr = {
2233 			.bss_idx = mvif->bss_conf.mt76.idx,
2234 		},
2235 		.beacon_tlv = {
2236 			.tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
2237 			.len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
2238 			.enable = enable,
2239 			.type = 1,
2240 		},
2241 	};
2242 	struct sk_buff *skb;
2243 	u8 cap_offs;
2244 
2245 	/* support enable/update process only
2246 	 * disable flow would be handled in bss stop handler automatically
2247 	 */
2248 	if (!enable)
2249 		return -EOPNOTSUPP;
2250 
2251 	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs, 0);
2252 	if (!skb)
2253 		return -EINVAL;
2254 
2255 	cap_offs = offsetof(struct ieee80211_mgmt, u.beacon.capab_info);
2256 	if (!skb_pull(skb, cap_offs)) {
2257 		dev_err(dev->mt76.dev, "beacon format err\n");
2258 		dev_kfree_skb(skb);
2259 		return -EINVAL;
2260 	}
2261 
2262 	if (skb->len > 512) {
2263 		dev_err(dev->mt76.dev, "beacon size limit exceed\n");
2264 		dev_kfree_skb(skb);
2265 		return -EINVAL;
2266 	}
2267 
2268 	memcpy(req.beacon_tlv.pkt, skb->data, skb->len);
2269 	req.beacon_tlv.pkt_len = cpu_to_le16(skb->len);
2270 	offs.tim_offset -= cap_offs;
2271 	req.beacon_tlv.tim_ie_pos = cpu_to_le16(offs.tim_offset);
2272 
2273 	if (offs.cntdwn_counter_offs[0]) {
2274 		u16 csa_offs;
2275 
2276 		csa_offs = offs.cntdwn_counter_offs[0] - cap_offs - 4;
2277 		req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
2278 	}
2279 	dev_kfree_skb(skb);
2280 
2281 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
2282 				 &req, sizeof(req), true);
2283 }
2284 
2285 static
2286 void mt7925_mcu_bss_rlm_tlv(struct sk_buff *skb, struct mt76_phy *phy,
2287 			    struct ieee80211_bss_conf *link_conf,
2288 			    struct ieee80211_chanctx_conf *ctx)
2289 {
2290 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2291 						  &link_conf->chanreq.oper;
2292 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
2293 	enum nl80211_band band = chandef->chan->band;
2294 	struct bss_rlm_tlv *req;
2295 	struct tlv *tlv;
2296 
2297 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RLM, sizeof(*req));
2298 	req = (struct bss_rlm_tlv *)tlv;
2299 	req->control_channel = chandef->chan->hw_value;
2300 	req->center_chan = ieee80211_frequency_to_channel(freq1);
2301 	req->center_chan2 = 0;
2302 	req->tx_streams = hweight8(phy->antenna_mask);
2303 	req->ht_op_info = 4; /* set HT 40M allowed */
2304 	req->rx_streams = hweight8(phy->antenna_mask);
2305 	req->center_chan2 = 0;
2306 	req->sco = 0;
2307 	req->band = 1;
2308 
2309 	switch (band) {
2310 	case NL80211_BAND_2GHZ:
2311 		req->band = 1;
2312 		break;
2313 	case NL80211_BAND_5GHZ:
2314 		req->band = 2;
2315 		break;
2316 	case NL80211_BAND_6GHZ:
2317 		req->band = 3;
2318 		break;
2319 	default:
2320 		break;
2321 	}
2322 
2323 	switch (chandef->width) {
2324 	case NL80211_CHAN_WIDTH_40:
2325 		req->bw = CMD_CBW_40MHZ;
2326 		break;
2327 	case NL80211_CHAN_WIDTH_80:
2328 		req->bw = CMD_CBW_80MHZ;
2329 		break;
2330 	case NL80211_CHAN_WIDTH_80P80:
2331 		req->bw = CMD_CBW_8080MHZ;
2332 		req->center_chan2 = ieee80211_frequency_to_channel(freq2);
2333 		break;
2334 	case NL80211_CHAN_WIDTH_160:
2335 		req->bw = CMD_CBW_160MHZ;
2336 		break;
2337 	case NL80211_CHAN_WIDTH_5:
2338 		req->bw = CMD_CBW_5MHZ;
2339 		break;
2340 	case NL80211_CHAN_WIDTH_10:
2341 		req->bw = CMD_CBW_10MHZ;
2342 		break;
2343 	case NL80211_CHAN_WIDTH_20_NOHT:
2344 	case NL80211_CHAN_WIDTH_20:
2345 	default:
2346 		req->bw = CMD_CBW_20MHZ;
2347 		req->ht_op_info = 0;
2348 		break;
2349 	}
2350 
2351 	if (req->control_channel < req->center_chan)
2352 		req->sco = 1; /* SCA */
2353 	else if (req->control_channel > req->center_chan)
2354 		req->sco = 3; /* SCB */
2355 }
2356 
2357 static struct sk_buff *
2358 __mt7925_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif_link *mvif, int len)
2359 {
2360 	struct bss_req_hdr hdr = {
2361 		.bss_idx = mvif->idx,
2362 	};
2363 	struct sk_buff *skb;
2364 
2365 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
2366 	if (!skb)
2367 		return ERR_PTR(-ENOMEM);
2368 
2369 	skb_put_data(skb, &hdr, sizeof(hdr));
2370 
2371 	return skb;
2372 }
2373 
2374 static
2375 void mt7925_mcu_bss_eht_tlv(struct sk_buff *skb, struct mt76_phy *phy,
2376 			    struct ieee80211_bss_conf *link_conf,
2377 			    struct ieee80211_chanctx_conf *ctx)
2378 {
2379 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2380 						  &link_conf->chanreq.oper;
2381 
2382 	struct bss_eht_tlv *req;
2383 	struct tlv *tlv;
2384 
2385 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_EHT, sizeof(*req));
2386 	req = (struct bss_eht_tlv *)tlv;
2387 	req->is_eth_dscb_present = chandef->punctured ? 1 : 0;
2388 	req->eht_dis_sub_chan_bitmap = cpu_to_le16(chandef->punctured);
2389 }
2390 
2391 int mt7925_mcu_set_eht_pp(struct mt76_phy *phy, struct mt76_vif_link *mvif,
2392 			  struct ieee80211_bss_conf *link_conf,
2393 			  struct ieee80211_chanctx_conf *ctx)
2394 {
2395 	struct sk_buff *skb;
2396 
2397 	skb = __mt7925_mcu_alloc_bss_req(phy->dev, mvif,
2398 					 MT7925_BSS_UPDATE_MAX_SIZE);
2399 	if (IS_ERR(skb))
2400 		return PTR_ERR(skb);
2401 
2402 	mt7925_mcu_bss_eht_tlv(skb, phy, link_conf, ctx);
2403 
2404 	return mt76_mcu_skb_send_msg(phy->dev, skb,
2405 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2406 }
2407 
2408 int mt7925_mcu_set_chctx(struct mt76_phy *phy, struct mt76_vif_link *mvif,
2409 			 struct ieee80211_bss_conf *link_conf,
2410 			 struct ieee80211_chanctx_conf *ctx)
2411 {
2412 	struct sk_buff *skb;
2413 
2414 	skb = __mt7925_mcu_alloc_bss_req(phy->dev, mvif,
2415 					 MT7925_BSS_UPDATE_MAX_SIZE);
2416 	if (IS_ERR(skb))
2417 		return PTR_ERR(skb);
2418 
2419 	mt7925_mcu_bss_rlm_tlv(skb, phy, link_conf, ctx);
2420 
2421 	return mt76_mcu_skb_send_msg(phy->dev, skb,
2422 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2423 }
2424 
2425 static u8
2426 mt7925_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
2427 			enum nl80211_band band,
2428 			struct ieee80211_link_sta *link_sta)
2429 {
2430 	struct ieee80211_he_6ghz_capa *he_6ghz_capa;
2431 	const struct ieee80211_sta_eht_cap *eht_cap;
2432 	__le16 capa = 0;
2433 	u8 mode = 0;
2434 
2435 	if (link_sta) {
2436 		he_6ghz_capa = &link_sta->he_6ghz_capa;
2437 		eht_cap = &link_sta->eht_cap;
2438 	} else {
2439 		struct ieee80211_supported_band *sband;
2440 
2441 		sband = phy->hw->wiphy->bands[band];
2442 		capa = ieee80211_get_he_6ghz_capa(sband, vif->type);
2443 		he_6ghz_capa = (struct ieee80211_he_6ghz_capa *)&capa;
2444 
2445 		eht_cap = ieee80211_get_eht_iftype_cap(sband, vif->type);
2446 	}
2447 
2448 	switch (band) {
2449 	case NL80211_BAND_2GHZ:
2450 		if (eht_cap && eht_cap->has_eht)
2451 			mode |= PHY_MODE_BE_24G;
2452 		break;
2453 	case NL80211_BAND_5GHZ:
2454 		if (eht_cap && eht_cap->has_eht)
2455 			mode |= PHY_MODE_BE_5G;
2456 		break;
2457 	case NL80211_BAND_6GHZ:
2458 		if (he_6ghz_capa && he_6ghz_capa->capa)
2459 			mode |= PHY_MODE_AX_6G;
2460 
2461 		if (eht_cap && eht_cap->has_eht)
2462 			mode |= PHY_MODE_BE_6G;
2463 		break;
2464 	default:
2465 		break;
2466 	}
2467 
2468 	return mode;
2469 }
2470 
2471 static void
2472 mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
2473 			 struct ieee80211_bss_conf *link_conf,
2474 			 struct ieee80211_link_sta *link_sta,
2475 			 struct ieee80211_chanctx_conf *ctx,
2476 			 struct mt76_phy *phy,
2477 			 u16 bmc_tx_wlan_idx,
2478 			 u16 sta_wlan_idx,
2479 			 bool enable)
2480 {
2481 	struct ieee80211_vif *vif = link_conf->vif;
2482 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2483 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2484 						  &link_conf->chanreq.oper;
2485 	enum nl80211_band band = chandef->chan->band;
2486 	struct mt76_connac_bss_basic_tlv *basic_req;
2487 	struct tlv *tlv;
2488 	int conn_type;
2489 	u8 idx;
2490 
2491 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*basic_req));
2492 	basic_req = (struct mt76_connac_bss_basic_tlv *)tlv;
2493 
2494 	idx = mconf->mt76.omac_idx > EXT_BSSID_START ? HW_BSSID_0 :
2495 						      mconf->mt76.omac_idx;
2496 	basic_req->hw_bss_idx = idx;
2497 
2498 	basic_req->phymode_ext = mt7925_get_phy_mode_ext(phy, vif, band,
2499 							 link_sta);
2500 
2501 	if (band == NL80211_BAND_2GHZ)
2502 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_ERP_INDEX);
2503 	else
2504 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_OFDM_INDEX);
2505 
2506 	memcpy(basic_req->bssid, link_conf->bssid, ETH_ALEN);
2507 	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, link_sta);
2508 	basic_req->bcn_interval = cpu_to_le16(link_conf->beacon_int);
2509 	basic_req->dtim_period = link_conf->dtim_period;
2510 	basic_req->bmc_tx_wlan_idx = cpu_to_le16(bmc_tx_wlan_idx);
2511 	basic_req->link_idx = mconf->mt76.idx;
2512 	basic_req->sta_idx = cpu_to_le16(sta_wlan_idx);
2513 	basic_req->omac_idx = mconf->mt76.omac_idx;
2514 	basic_req->band_idx = mconf->mt76.band_idx;
2515 	basic_req->wmm_idx = mconf->mt76.wmm_idx;
2516 	basic_req->conn_state = !enable;
2517 
2518 	switch (vif->type) {
2519 	case NL80211_IFTYPE_MESH_POINT:
2520 	case NL80211_IFTYPE_AP:
2521 		if (vif->p2p)
2522 			conn_type = CONNECTION_P2P_GO;
2523 		else
2524 			conn_type = CONNECTION_INFRA_AP;
2525 		basic_req->conn_type = cpu_to_le32(conn_type);
2526 		basic_req->active = enable;
2527 		break;
2528 	case NL80211_IFTYPE_STATION:
2529 		if (vif->p2p)
2530 			conn_type = CONNECTION_P2P_GC;
2531 		else
2532 			conn_type = CONNECTION_INFRA_STA;
2533 		basic_req->conn_type = cpu_to_le32(conn_type);
2534 		basic_req->active = true;
2535 		break;
2536 	case NL80211_IFTYPE_ADHOC:
2537 		basic_req->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
2538 		basic_req->active = true;
2539 		break;
2540 	default:
2541 		WARN_ON(1);
2542 		break;
2543 	}
2544 }
2545 
2546 static void
2547 mt7925_mcu_bss_sec_tlv(struct sk_buff *skb,
2548 		       struct ieee80211_bss_conf *link_conf)
2549 {
2550 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2551 	struct mt76_vif_link *mvif = &mconf->mt76;
2552 	struct bss_sec_tlv {
2553 		__le16 tag;
2554 		__le16 len;
2555 		u8 mode;
2556 		u8 status;
2557 		u8 cipher;
2558 		u8 __rsv;
2559 	} __packed * sec;
2560 	struct tlv *tlv;
2561 
2562 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_SEC, sizeof(*sec));
2563 	sec = (struct bss_sec_tlv *)tlv;
2564 
2565 	switch (mvif->cipher) {
2566 	case CONNAC3_CIPHER_GCMP_256:
2567 	case CONNAC3_CIPHER_GCMP:
2568 		sec->mode = MODE_WPA3_SAE;
2569 		sec->status = 8;
2570 		break;
2571 	case CONNAC3_CIPHER_AES_CCMP:
2572 		sec->mode = MODE_WPA2_PSK;
2573 		sec->status = 6;
2574 		break;
2575 	case CONNAC3_CIPHER_TKIP:
2576 		sec->mode = MODE_WPA2_PSK;
2577 		sec->status = 4;
2578 		break;
2579 	case CONNAC3_CIPHER_WEP104:
2580 	case CONNAC3_CIPHER_WEP40:
2581 		sec->mode = MODE_SHARED;
2582 		sec->status = 0;
2583 		break;
2584 	default:
2585 		sec->mode = MODE_OPEN;
2586 		sec->status = 1;
2587 		break;
2588 	}
2589 
2590 	sec->cipher = mvif->cipher;
2591 }
2592 
2593 static void
2594 mt7925_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt792x_phy *phy,
2595 		       struct ieee80211_chanctx_conf *ctx,
2596 		       struct ieee80211_bss_conf *link_conf)
2597 {
2598 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
2599 						  &link_conf->chanreq.oper;
2600 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2601 	enum nl80211_band band = chandef->chan->band;
2602 	struct mt76_vif_link *mvif = &mconf->mt76;
2603 	struct bss_rate_tlv *bmc;
2604 	struct tlv *tlv;
2605 	u8 idx = mvif->mcast_rates_idx ?
2606 		 mvif->mcast_rates_idx : mvif->basic_rates_idx;
2607 
2608 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RATE, sizeof(*bmc));
2609 
2610 	bmc = (struct bss_rate_tlv *)tlv;
2611 
2612 	if (band == NL80211_BAND_2GHZ)
2613 		bmc->basic_rate = cpu_to_le16(HR_DSSS_ERP_BASIC_RATE);
2614 	else
2615 		bmc->basic_rate = cpu_to_le16(OFDM_BASIC_RATE);
2616 
2617 	bmc->short_preamble = (band == NL80211_BAND_2GHZ);
2618 	bmc->bc_fixed_rate = idx;
2619 	bmc->mc_fixed_rate = idx;
2620 }
2621 
2622 static void
2623 mt7925_mcu_bss_mld_tlv(struct sk_buff *skb,
2624 		       struct ieee80211_bss_conf *link_conf)
2625 {
2626 	struct ieee80211_vif *vif = link_conf->vif;
2627 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2628 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2629 	struct mt792x_phy *phy = mvif->phy;
2630 	struct bss_mld_tlv *mld;
2631 	struct tlv *tlv;
2632 	bool is_mld;
2633 
2634 	is_mld = ieee80211_vif_is_mld(link_conf->vif) ||
2635 		 (hweight16(mvif->valid_links) > 1);
2636 
2637 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_MLD, sizeof(*mld));
2638 	mld = (struct bss_mld_tlv *)tlv;
2639 
2640 	mld->link_id = is_mld ? link_conf->link_id : 0xff;
2641 	/* apply the index of the primary link */
2642 	mld->group_mld_id = is_mld ? mvif->bss_conf.mt76.idx : 0xff;
2643 	mld->own_mld_id = mconf->mt76.idx + 32;
2644 	mld->remap_idx = 0xff;
2645 
2646 	if (phy->chip_cap & MT792x_CHIP_CAP_MLO_EML_EN) {
2647 		mld->eml_enable = !!(link_conf->vif->cfg.eml_cap &
2648 				     IEEE80211_EML_CAP_EMLSR_SUPP);
2649 	} else {
2650 		mld->eml_enable = 0;
2651 	}
2652 
2653 	memcpy(mld->mac_addr, vif->addr, ETH_ALEN);
2654 }
2655 
2656 static void
2657 mt7925_mcu_bss_qos_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf)
2658 {
2659 	struct mt76_connac_bss_qos_tlv *qos;
2660 	struct tlv *tlv;
2661 
2662 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_QBSS, sizeof(*qos));
2663 	qos = (struct mt76_connac_bss_qos_tlv *)tlv;
2664 	qos->qos = link_conf->qos;
2665 }
2666 
2667 static void
2668 mt7925_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2669 			  bool enable)
2670 {
2671 	struct bss_info_uni_mbssid *mbssid;
2672 	struct tlv *tlv;
2673 
2674 	if (!enable && !link_conf->bssid_indicator)
2675 		return;
2676 
2677 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_11V_MBSSID,
2678 				      sizeof(*mbssid));
2679 
2680 	mbssid = (struct bss_info_uni_mbssid *)tlv;
2681 	mbssid->max_indicator = link_conf->bssid_indicator;
2682 	mbssid->mbss_idx = link_conf->bssid_index;
2683 	mbssid->tx_bss_omac_idx = 0;
2684 }
2685 
2686 static void
2687 mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2688 		      struct mt792x_phy *phy)
2689 {
2690 #define DEFAULT_HE_PE_DURATION		4
2691 #define DEFAULT_HE_DURATION_RTS_THRES	1023
2692 	const struct ieee80211_sta_he_cap *cap;
2693 	struct bss_info_uni_he *he;
2694 	struct tlv *tlv;
2695 
2696 	cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
2697 
2698 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
2699 
2700 	he = (struct bss_info_uni_he *)tlv;
2701 	he->he_pe_duration = link_conf->htc_trig_based_pkt_ext;
2702 	if (!he->he_pe_duration)
2703 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
2704 
2705 	he->he_rts_thres = cpu_to_le16(link_conf->frame_time_rts_th);
2706 	if (!he->he_rts_thres)
2707 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
2708 
2709 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
2710 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
2711 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
2712 }
2713 
2714 static void
2715 mt7925_mcu_bss_color_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
2716 			 bool enable)
2717 {
2718 	struct bss_info_uni_bss_color *color;
2719 	struct tlv *tlv;
2720 
2721 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BSS_COLOR, sizeof(*color));
2722 	color = (struct bss_info_uni_bss_color *)tlv;
2723 
2724 	color->enable = enable ?
2725 		link_conf->he_bss_color.enabled : 0;
2726 	color->bss_color = enable ?
2727 		link_conf->he_bss_color.color : 0;
2728 }
2729 
2730 static void
2731 mt7925_mcu_bss_ifs_tlv(struct sk_buff *skb,
2732 		       struct ieee80211_bss_conf *link_conf)
2733 {
2734 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2735 	struct mt792x_phy *phy = mvif->phy;
2736 	struct bss_ifs_time_tlv *ifs_time;
2737 	struct tlv *tlv;
2738 
2739 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_IFS_TIME, sizeof(*ifs_time));
2740 	ifs_time = (struct bss_ifs_time_tlv *)tlv;
2741 	ifs_time->slot_valid = true;
2742 	ifs_time->slot_time = cpu_to_le16(phy->slottime);
2743 }
2744 
2745 int mt7925_mcu_set_timing(struct mt792x_phy *phy,
2746 			  struct ieee80211_bss_conf *link_conf)
2747 {
2748 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2749 	struct mt792x_dev *dev = phy->dev;
2750 	struct sk_buff *skb;
2751 
2752 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2753 					 MT7925_BSS_UPDATE_MAX_SIZE);
2754 	if (IS_ERR(skb))
2755 		return PTR_ERR(skb);
2756 
2757 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2758 
2759 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2760 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2761 }
2762 
2763 void mt7925_mcu_del_dev(struct mt76_dev *mdev,
2764 			struct ieee80211_vif *vif)
2765 {
2766 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
2767 	struct {
2768 		struct {
2769 			u8 omac_idx;
2770 			u8 band_idx;
2771 			__le16 pad;
2772 		} __packed hdr;
2773 		struct req_tlv {
2774 			__le16 tag;
2775 			__le16 len;
2776 			u8 active;
2777 			u8 link_idx; /* hw link idx */
2778 			u8 omac_addr[ETH_ALEN];
2779 		} __packed tlv;
2780 	} dev_req = {
2781 		.tlv = {
2782 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
2783 			.len = cpu_to_le16(sizeof(struct req_tlv)),
2784 			.active = true,
2785 		},
2786 	};
2787 	struct {
2788 		struct {
2789 			u8 bss_idx;
2790 			u8 pad[3];
2791 		} __packed hdr;
2792 		struct mt76_connac_bss_basic_tlv basic;
2793 	} basic_req = {
2794 		.basic = {
2795 			.tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
2796 			.len = cpu_to_le16(sizeof(struct mt76_connac_bss_basic_tlv)),
2797 			.active = true,
2798 			.conn_state = 1,
2799 		},
2800 	};
2801 
2802 	dev_req.hdr.omac_idx = mvif->omac_idx;
2803 	dev_req.hdr.band_idx = mvif->band_idx;
2804 
2805 	basic_req.hdr.bss_idx = mvif->idx;
2806 	basic_req.basic.omac_idx = mvif->omac_idx;
2807 	basic_req.basic.band_idx = mvif->band_idx;
2808 	basic_req.basic.link_idx = mvif->link_idx;
2809 
2810 	mt76_mcu_send_msg(mdev, MCU_UNI_CMD(BSS_INFO_UPDATE),
2811 			  &basic_req, sizeof(basic_req), true);
2812 
2813 	/* recovery omac address for the legacy interface */
2814 	memcpy(dev_req.tlv.omac_addr, vif->addr, ETH_ALEN);
2815 	mt76_mcu_send_msg(mdev, MCU_UNI_CMD(DEV_INFO_UPDATE),
2816 			  &dev_req, sizeof(dev_req), true);
2817 }
2818 
2819 int mt7925_mcu_add_bss_info_sta(struct mt792x_phy *phy,
2820 				struct ieee80211_chanctx_conf *ctx,
2821 				struct ieee80211_bss_conf *link_conf,
2822 				struct ieee80211_link_sta *link_sta,
2823 				u16 bmc_tx_wlan_idx,
2824 				u16 sta_wlan_idx,
2825 				int enable)
2826 {
2827 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2828 	struct mt792x_dev *dev = phy->dev;
2829 	struct sk_buff *skb;
2830 
2831 	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
2832 					 MT7925_BSS_UPDATE_MAX_SIZE);
2833 	if (IS_ERR(skb))
2834 		return PTR_ERR(skb);
2835 
2836 	/* bss_basic must be first */
2837 	mt7925_mcu_bss_basic_tlv(skb, link_conf, link_sta, ctx, phy->mt76,
2838 				 bmc_tx_wlan_idx, sta_wlan_idx, enable);
2839 	mt7925_mcu_bss_sec_tlv(skb, link_conf);
2840 	mt7925_mcu_bss_bmc_tlv(skb, phy, ctx, link_conf);
2841 	mt7925_mcu_bss_qos_tlv(skb, link_conf);
2842 	mt7925_mcu_bss_mld_tlv(skb, link_conf);
2843 	mt7925_mcu_bss_ifs_tlv(skb, link_conf);
2844 
2845 	if (link_conf->he_support) {
2846 		mt7925_mcu_bss_he_tlv(skb, link_conf, phy);
2847 		mt7925_mcu_bss_color_tlv(skb, link_conf, enable);
2848 	}
2849 
2850 	if (enable) {
2851 		mt7925_mcu_bss_rlm_tlv(skb, phy->mt76, link_conf, ctx);
2852 		mt7925_mcu_bss_mbssid_tlv(skb, link_conf, enable);
2853 	}
2854 
2855 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
2856 				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
2857 }
2858 
2859 int mt7925_mcu_add_bss_info(struct mt792x_phy *phy,
2860 			    struct ieee80211_chanctx_conf *ctx,
2861 			    struct ieee80211_bss_conf *link_conf,
2862 			    struct ieee80211_link_sta *link_sta,
2863 			    int enable)
2864 {
2865 	struct mt792x_vif *mvif = (struct mt792x_vif *)link_conf->vif->drv_priv;
2866 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
2867 	struct mt792x_link_sta *mlink_bc;
2868 	struct mt792x_link_sta *mlink;
2869 
2870 	mlink_bc = mt792x_sta_to_link(&mvif->sta, mconf->link_id);
2871 
2872 	if (link_sta) {
2873 		struct mt792x_sta *msta = (void *)link_sta->sta->drv_priv;
2874 
2875 		mlink = mt792x_sta_to_link(msta, link_sta->link_id);
2876 		if (WARN_ON(!mlink))
2877 			return -EINVAL;
2878 	} else {
2879 		mlink = &mconf->vif->sta.deflink;
2880 	}
2881 
2882 	return mt7925_mcu_add_bss_info_sta(phy, ctx, link_conf, link_sta,
2883 					   mlink_bc->wcid.idx, mlink->wcid.idx, enable);
2884 }
2885 
2886 int mt7925_mcu_set_dbdc(struct mt76_phy *phy, bool enable)
2887 {
2888 	struct mt76_dev *mdev = phy->dev;
2889 
2890 	struct mbmc_conf_tlv *conf;
2891 	struct mbmc_set_req *hdr;
2892 	struct sk_buff *skb;
2893 	struct tlv *tlv;
2894 	int max_len, err;
2895 
2896 	max_len = sizeof(*hdr) + sizeof(*conf);
2897 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2898 	if (!skb)
2899 		return -ENOMEM;
2900 
2901 	hdr = (struct mbmc_set_req *)skb_put(skb, sizeof(*hdr));
2902 
2903 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_MBMC_SETTING, sizeof(*conf));
2904 	conf = (struct mbmc_conf_tlv *)tlv;
2905 
2906 	conf->mbmc_en = enable;
2907 	conf->band = 0; /* unused */
2908 
2909 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SET_DBDC_PARMS),
2910 				    true);
2911 
2912 	return err;
2913 }
2914 
2915 static void
2916 mt7925_mcu_build_scan_ie_tlv(struct mt76_dev *mdev,
2917 			     struct sk_buff *skb,
2918 			     struct ieee80211_scan_ies *scan_ies)
2919 {
2920 	u32 max_len = sizeof(struct scan_ie_tlv) + MT76_CONNAC_SCAN_IE_LEN;
2921 	struct scan_ie_tlv *ie;
2922 	enum nl80211_band i;
2923 	struct tlv *tlv;
2924 	const u8 *ies;
2925 	u16 ies_len;
2926 
2927 	for (i = 0; i <= NL80211_BAND_6GHZ; i++) {
2928 		if (i == NL80211_BAND_60GHZ)
2929 			continue;
2930 
2931 		ies = scan_ies->ies[i];
2932 		ies_len = scan_ies->len[i];
2933 
2934 		if (!ies || !ies_len)
2935 			continue;
2936 
2937 		if (ies_len > max_len)
2938 			return;
2939 
2940 		tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE,
2941 					      sizeof(*ie) + ies_len);
2942 		ie = (struct scan_ie_tlv *)tlv;
2943 
2944 		memcpy(ie->ies, ies, ies_len);
2945 		ie->ies_len = cpu_to_le16(ies_len);
2946 
2947 		switch (i) {
2948 		case NL80211_BAND_2GHZ:
2949 			ie->band = 1;
2950 			break;
2951 		case NL80211_BAND_6GHZ:
2952 			ie->band = 3;
2953 			break;
2954 		default:
2955 			ie->band = 2;
2956 			break;
2957 		}
2958 
2959 		max_len -= (sizeof(*ie) + ies_len);
2960 	}
2961 }
2962 
2963 int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
2964 		       struct ieee80211_scan_request *scan_req)
2965 {
2966 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
2967 	struct cfg80211_scan_request *sreq = &scan_req->req;
2968 	int n_ssids = 0, err, i;
2969 	struct ieee80211_channel **scan_list = sreq->channels;
2970 	struct mt76_dev *mdev = phy->dev;
2971 	struct mt76_connac_mcu_scan_channel *chan;
2972 	struct sk_buff *skb;
2973 	struct scan_hdr_tlv *hdr;
2974 	struct scan_req_tlv *req;
2975 	struct scan_ssid_tlv *ssid;
2976 	struct scan_bssid_tlv *bssid;
2977 	struct scan_chan_info_tlv *chan_info;
2978 	struct scan_ie_tlv *ie;
2979 	struct scan_misc_tlv *misc;
2980 	struct tlv *tlv;
2981 	int max_len;
2982 
2983 	if (test_bit(MT76_HW_SCANNING, &phy->state))
2984 		return -EBUSY;
2985 
2986 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
2987 		  sizeof(*bssid) * MT7925_RNR_SCAN_MAX_BSSIDS +
2988 		  sizeof(*chan_info) + sizeof(*misc) + sizeof(*ie) +
2989 		  MT76_CONNAC_SCAN_IE_LEN;
2990 
2991 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
2992 	if (!skb)
2993 		return -ENOMEM;
2994 
2995 	set_bit(MT76_HW_SCANNING, &phy->state);
2996 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
2997 
2998 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
2999 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
3000 	hdr->bss_idx = mvif->idx;
3001 
3002 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_REQ, sizeof(*req));
3003 	req = (struct scan_req_tlv *)tlv;
3004 	req->scan_type = sreq->n_ssids ? 1 : 0;
3005 	req->probe_req_num = sreq->n_ssids ? 2 : 0;
3006 
3007 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
3008 	ssid = (struct scan_ssid_tlv *)tlv;
3009 	for (i = 0; i < sreq->n_ssids; i++) {
3010 		if (!sreq->ssids[i].ssid_len)
3011 			continue;
3012 		if (i >= MT7925_RNR_SCAN_MAX_BSSIDS)
3013 			break;
3014 
3015 		ssid->ssids[n_ssids].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
3016 		memcpy(ssid->ssids[n_ssids].ssid, sreq->ssids[i].ssid,
3017 		       sreq->ssids[i].ssid_len);
3018 		n_ssids++;
3019 	}
3020 	ssid->ssid_type = n_ssids ? BIT(2) : BIT(0);
3021 	ssid->ssids_num = n_ssids;
3022 
3023 	if (sreq->n_6ghz_params) {
3024 		u8 j;
3025 
3026 		mt76_connac_mcu_build_rnr_scan_param(mdev, sreq);
3027 
3028 		for (j = 0; j < mdev->rnr.bssid_num; j++) {
3029 			if (j >= MT7925_RNR_SCAN_MAX_BSSIDS)
3030 				break;
3031 
3032 			tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_BSSID,
3033 						      sizeof(*bssid));
3034 			bssid = (struct scan_bssid_tlv *)tlv;
3035 
3036 			ether_addr_copy(bssid->bssid, mdev->rnr.bssid[j]);
3037 			bssid->match_ch = mdev->rnr.channel[j];
3038 			bssid->match_ssid_ind = MT7925_RNR_SCAN_MAX_BSSIDS;
3039 			bssid->match_short_ssid_ind = MT7925_RNR_SCAN_MAX_BSSIDS;
3040 		}
3041 		req->scan_func |= SCAN_FUNC_RNR_SCAN;
3042 	} else {
3043 		tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_BSSID, sizeof(*bssid));
3044 		bssid = (struct scan_bssid_tlv *)tlv;
3045 
3046 		ether_addr_copy(bssid->bssid, sreq->bssid);
3047 	}
3048 
3049 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
3050 	chan_info = (struct scan_chan_info_tlv *)tlv;
3051 	chan_info->channels_num = min_t(u8, sreq->n_channels,
3052 					ARRAY_SIZE(chan_info->channels));
3053 	for (i = 0; i < chan_info->channels_num; i++) {
3054 		chan = &chan_info->channels[i];
3055 
3056 		switch (scan_list[i]->band) {
3057 		case NL80211_BAND_2GHZ:
3058 			chan->band = 1;
3059 			break;
3060 		case NL80211_BAND_6GHZ:
3061 			chan->band = 3;
3062 			break;
3063 		default:
3064 			chan->band = 2;
3065 			break;
3066 		}
3067 		chan->channel_num = scan_list[i]->hw_value;
3068 	}
3069 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
3070 
3071 	req->scan_func |= SCAN_FUNC_SPLIT_SCAN;
3072 
3073 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_MISC, sizeof(*misc));
3074 	misc = (struct scan_misc_tlv *)tlv;
3075 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
3076 		get_random_mask_addr(misc->random_mac, sreq->mac_addr,
3077 				     sreq->mac_addr_mask);
3078 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
3079 	}
3080 
3081 	/* Append scan probe IEs as the last tlv */
3082 	mt7925_mcu_build_scan_ie_tlv(mdev, skb, &scan_req->ies);
3083 
3084 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
3085 				    true);
3086 	if (err < 0)
3087 		clear_bit(MT76_HW_SCANNING, &phy->state);
3088 
3089 	return err;
3090 }
3091 EXPORT_SYMBOL_GPL(mt7925_mcu_hw_scan);
3092 
3093 int mt7925_mcu_sched_scan_req(struct mt76_phy *phy,
3094 			      struct ieee80211_vif *vif,
3095 			      struct cfg80211_sched_scan_request *sreq,
3096 			      struct ieee80211_scan_ies *ies)
3097 {
3098 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
3099 	struct ieee80211_channel **scan_list = sreq->channels;
3100 	struct mt76_connac_mcu_scan_channel *chan;
3101 	struct mt76_dev *mdev = phy->dev;
3102 	struct cfg80211_match_set *cfg_match;
3103 	struct cfg80211_ssid *cfg_ssid;
3104 
3105 	struct scan_hdr_tlv *hdr;
3106 	struct scan_sched_req *req;
3107 	struct scan_ssid_tlv *ssid;
3108 	struct scan_chan_info_tlv *chan_info;
3109 	struct scan_ie_tlv *ie;
3110 	struct scan_sched_ssid_match_sets *match;
3111 	struct sk_buff *skb;
3112 	struct tlv *tlv;
3113 	int i, max_len;
3114 
3115 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
3116 		  sizeof(*chan_info) + sizeof(*ie) +
3117 		  sizeof(*match);
3118 
3119 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
3120 	if (!skb)
3121 		return -ENOMEM;
3122 
3123 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
3124 
3125 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
3126 	hdr->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
3127 	hdr->bss_idx = mvif->idx;
3128 
3129 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_REQ, sizeof(*req));
3130 	req = (struct scan_sched_req *)tlv;
3131 	req->version = 1;
3132 
3133 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
3134 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
3135 
3136 	req->intervals_num = sreq->n_scan_plans;
3137 	for (i = 0; i < req->intervals_num; i++)
3138 		req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
3139 
3140 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID, sizeof(*ssid));
3141 	ssid = (struct scan_ssid_tlv *)tlv;
3142 
3143 	ssid->ssids_num = sreq->n_ssids;
3144 	ssid->ssid_type = BIT(2);
3145 	for (i = 0; i < ssid->ssids_num; i++) {
3146 		cfg_ssid = &sreq->ssids[i];
3147 		memcpy(ssid->ssids[i].ssid, cfg_ssid->ssid, cfg_ssid->ssid_len);
3148 		ssid->ssids[i].ssid_len = cpu_to_le32(cfg_ssid->ssid_len);
3149 	}
3150 
3151 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SSID_MATCH_SETS, sizeof(*match));
3152 	match = (struct scan_sched_ssid_match_sets *)tlv;
3153 	match->match_num = sreq->n_match_sets;
3154 	for (i = 0; i < match->match_num; i++) {
3155 		cfg_match = &sreq->match_sets[i];
3156 		memcpy(match->match[i].ssid, cfg_match->ssid.ssid,
3157 		       cfg_match->ssid.ssid_len);
3158 		match->match[i].rssi_th = cpu_to_le32(cfg_match->rssi_thold);
3159 		match->match[i].ssid_len = cfg_match->ssid.ssid_len;
3160 	}
3161 
3162 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_CHANNEL, sizeof(*chan_info));
3163 	chan_info = (struct scan_chan_info_tlv *)tlv;
3164 	chan_info->channels_num = min_t(u8, sreq->n_channels,
3165 					ARRAY_SIZE(chan_info->channels));
3166 	for (i = 0; i < chan_info->channels_num; i++) {
3167 		chan = &chan_info->channels[i];
3168 
3169 		switch (scan_list[i]->band) {
3170 		case NL80211_BAND_2GHZ:
3171 			chan->band = 1;
3172 			break;
3173 		case NL80211_BAND_6GHZ:
3174 			chan->band = 3;
3175 			break;
3176 		default:
3177 			chan->band = 2;
3178 			break;
3179 		}
3180 		chan->channel_num = scan_list[i]->hw_value;
3181 	}
3182 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
3183 
3184 	/* Append scan probe IEs as the last tlv */
3185 	mt7925_mcu_build_scan_ie_tlv(mdev, skb, ies);
3186 
3187 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
3188 				     true);
3189 }
3190 EXPORT_SYMBOL_GPL(mt7925_mcu_sched_scan_req);
3191 
3192 int
3193 mt7925_mcu_sched_scan_enable(struct mt76_phy *phy,
3194 			     struct ieee80211_vif *vif,
3195 			     bool enable)
3196 {
3197 	struct mt76_dev *mdev = phy->dev;
3198 	struct scan_sched_enable *req;
3199 	struct scan_hdr_tlv *hdr;
3200 	struct sk_buff *skb;
3201 	struct tlv *tlv;
3202 	int max_len;
3203 
3204 	max_len = sizeof(*hdr) + sizeof(*req);
3205 
3206 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
3207 	if (!skb)
3208 		return -ENOMEM;
3209 
3210 	hdr = (struct scan_hdr_tlv *)skb_put(skb, sizeof(*hdr));
3211 	hdr->seq_num = 0;
3212 	hdr->bss_idx = 0;
3213 
3214 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_SCHED_ENABLE, sizeof(*req));
3215 	req = (struct scan_sched_enable *)tlv;
3216 	req->active = !enable;
3217 
3218 	if (enable)
3219 		set_bit(MT76_HW_SCHED_SCANNING, &phy->state);
3220 	else
3221 		clear_bit(MT76_HW_SCHED_SCANNING, &phy->state);
3222 
3223 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
3224 				     true);
3225 }
3226 
3227 int mt7925_mcu_cancel_hw_scan(struct mt76_phy *phy,
3228 			      struct ieee80211_vif *vif)
3229 {
3230 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
3231 	struct {
3232 		struct scan_hdr {
3233 			u8 seq_num;
3234 			u8 bss_idx;
3235 			u8 pad[2];
3236 		} __packed hdr;
3237 		struct scan_cancel_tlv {
3238 			__le16 tag;
3239 			__le16 len;
3240 			u8 is_ext_channel;
3241 			u8 rsv[3];
3242 		} __packed cancel;
3243 	} req = {
3244 		.hdr = {
3245 			.seq_num = mvif->scan_seq_num,
3246 			.bss_idx = mvif->idx,
3247 		},
3248 		.cancel = {
3249 			.tag = cpu_to_le16(UNI_SCAN_CANCEL),
3250 			.len = cpu_to_le16(sizeof(struct scan_cancel_tlv)),
3251 		},
3252 	};
3253 
3254 	if (test_and_clear_bit(MT76_HW_SCANNING, &phy->state)) {
3255 		struct cfg80211_scan_info info = {
3256 			.aborted = true,
3257 		};
3258 
3259 		ieee80211_scan_completed(phy->hw, &info);
3260 	}
3261 
3262 	return mt76_mcu_send_msg(phy->dev, MCU_UNI_CMD(SCAN_REQ),
3263 				 &req, sizeof(req), true);
3264 }
3265 EXPORT_SYMBOL_GPL(mt7925_mcu_cancel_hw_scan);
3266 
3267 int mt7925_mcu_set_channel_domain(struct mt76_phy *phy)
3268 {
3269 	int len, i, n_max_channels, n_2ch = 0, n_5ch = 0, n_6ch = 0;
3270 	struct {
3271 		struct {
3272 			u8 alpha2[4]; /* regulatory_request.alpha2 */
3273 			u8 bw_2g; /* BW_20_40M		0
3274 				   * BW_20M		1
3275 				   * BW_20_40_80M	2
3276 				   * BW_20_40_80_160M	3
3277 				   * BW_20_40_80_8080M	4
3278 				   */
3279 			u8 bw_5g;
3280 			u8 bw_6g;
3281 			u8 pad;
3282 		} __packed hdr;
3283 		struct n_chan {
3284 			__le16 tag;
3285 			__le16 len;
3286 			u8 n_2ch;
3287 			u8 n_5ch;
3288 			u8 n_6ch;
3289 			u8 pad;
3290 		} __packed n_ch;
3291 	} req = {
3292 		.hdr = {
3293 			.bw_2g = 0,
3294 			.bw_5g = 3, /* BW_20_40_80_160M */
3295 			.bw_6g = 3,
3296 		},
3297 		.n_ch = {
3298 			.tag = cpu_to_le16(2),
3299 		},
3300 	};
3301 	struct mt76_connac_mcu_chan {
3302 		__le16 hw_value;
3303 		__le16 pad;
3304 		__le32 flags;
3305 	} __packed channel;
3306 	struct mt76_dev *dev = phy->dev;
3307 	struct ieee80211_channel *chan;
3308 	struct sk_buff *skb;
3309 
3310 	n_max_channels = phy->sband_2g.sband.n_channels +
3311 			 phy->sband_5g.sband.n_channels +
3312 			 phy->sband_6g.sband.n_channels;
3313 	len = sizeof(req) + n_max_channels * sizeof(channel);
3314 
3315 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
3316 	if (!skb)
3317 		return -ENOMEM;
3318 
3319 	skb_reserve(skb, sizeof(req));
3320 
3321 	for (i = 0; i < phy->sband_2g.sband.n_channels; i++) {
3322 		chan = &phy->sband_2g.sband.channels[i];
3323 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3324 			continue;
3325 
3326 		channel.hw_value = cpu_to_le16(chan->hw_value);
3327 		channel.flags = cpu_to_le32(chan->flags);
3328 		channel.pad = 0;
3329 
3330 		skb_put_data(skb, &channel, sizeof(channel));
3331 		n_2ch++;
3332 	}
3333 	for (i = 0; i < phy->sband_5g.sband.n_channels; i++) {
3334 		chan = &phy->sband_5g.sband.channels[i];
3335 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3336 			continue;
3337 
3338 		channel.hw_value = cpu_to_le16(chan->hw_value);
3339 		channel.flags = cpu_to_le32(chan->flags);
3340 		channel.pad = 0;
3341 
3342 		skb_put_data(skb, &channel, sizeof(channel));
3343 		n_5ch++;
3344 	}
3345 	for (i = 0; i < phy->sband_6g.sband.n_channels; i++) {
3346 		chan = &phy->sband_6g.sband.channels[i];
3347 		if (chan->flags & IEEE80211_CHAN_DISABLED)
3348 			continue;
3349 
3350 		channel.hw_value = cpu_to_le16(chan->hw_value);
3351 		channel.flags = cpu_to_le32(chan->flags);
3352 		channel.pad = 0;
3353 
3354 		skb_put_data(skb, &channel, sizeof(channel));
3355 		n_6ch++;
3356 	}
3357 
3358 	BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(req.hdr.alpha2));
3359 	memcpy(req.hdr.alpha2, dev->alpha2, sizeof(dev->alpha2));
3360 	req.n_ch.n_2ch = n_2ch;
3361 	req.n_ch.n_5ch = n_5ch;
3362 	req.n_ch.n_6ch = n_6ch;
3363 	len = sizeof(struct n_chan) + (n_2ch + n_5ch + n_6ch) * sizeof(channel);
3364 	req.n_ch.len = cpu_to_le16(len);
3365 	memcpy(__skb_push(skb, sizeof(req)), &req, sizeof(req));
3366 
3367 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SET_DOMAIN_INFO),
3368 				     true);
3369 }
3370 EXPORT_SYMBOL_GPL(mt7925_mcu_set_channel_domain);
3371 
3372 static int
3373 __mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3374 		     enum environment_cap env_cap,
3375 		     struct mt7925_clc *clc, u8 idx)
3376 {
3377 	struct mt7925_clc_segment *seg;
3378 	struct sk_buff *skb;
3379 	struct {
3380 		u8 rsv[4];
3381 		__le16 tag;
3382 		__le16 len;
3383 
3384 		u8 ver;
3385 		u8 pad0;
3386 		__le16 size;
3387 		u8 idx;
3388 		u8 env;
3389 		u8 acpi_conf;
3390 		u8 pad1;
3391 		u8 alpha2[2];
3392 		u8 type[2];
3393 		u8 rsvd[64];
3394 	} __packed req = {
3395 		.tag = cpu_to_le16(0x3),
3396 
3397 		.idx = idx,
3398 		.env = env_cap,
3399 	};
3400 	int ret, valid_cnt = 0;
3401 	u8 *pos, *last_pos;
3402 
3403 	if (!clc)
3404 		return 0;
3405 
3406 	req.ver = clc->ver;
3407 	pos = clc->data + sizeof(*seg) * clc->t0.nr_seg;
3408 	last_pos = clc->data + le32_to_cpu(*(__le32 *)(clc->data + 4));
3409 	while (pos < last_pos) {
3410 		struct mt7925_clc_rule *rule = (struct mt7925_clc_rule *)pos;
3411 
3412 		pos += sizeof(*rule);
3413 		if (rule->alpha2[0] != alpha2[0] ||
3414 		    rule->alpha2[1] != alpha2[1])
3415 			continue;
3416 
3417 		seg = (struct mt7925_clc_segment *)clc->data
3418 			  + rule->seg_idx - 1;
3419 
3420 		memcpy(req.alpha2, rule->alpha2, 2);
3421 		memcpy(req.type, rule->type, 2);
3422 
3423 		req.size = cpu_to_le16(seg->len);
3424 		req.len = cpu_to_le16(sizeof(req) + seg->len - 4);
3425 		dev->phy.clc_chan_conf = clc->ver == 1 ? 0xff : rule->flag;
3426 		skb = __mt76_mcu_msg_alloc(&dev->mt76, &req,
3427 					   le16_to_cpu(req.size) + sizeof(req),
3428 					   sizeof(req), GFP_KERNEL);
3429 		if (!skb)
3430 			return -ENOMEM;
3431 		skb_put_data(skb, clc->data + seg->offset, seg->len);
3432 
3433 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
3434 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3435 					    true);
3436 		if (ret < 0)
3437 			return ret;
3438 		valid_cnt++;
3439 	}
3440 
3441 	if (!valid_cnt) {
3442 		dev->phy.clc_chan_conf = 0xff;
3443 		return -ENOENT;
3444 	}
3445 
3446 	return 0;
3447 }
3448 
3449 int mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
3450 		       enum environment_cap env_cap)
3451 {
3452 	struct mt792x_phy *phy = (struct mt792x_phy *)&dev->phy;
3453 	int i, ret;
3454 
3455 	if (!ARRAY_SIZE(phy->clc))
3456 		return -ESRCH;
3457 
3458 	/* submit all clc config */
3459 	for (i = 0; i < ARRAY_SIZE(phy->clc); i++) {
3460 		if (i == MT792x_CLC_BE_CTRL)
3461 			continue;
3462 
3463 		ret = __mt7925_mcu_set_clc(dev, alpha2, env_cap,
3464 					   phy->clc[i], i);
3465 
3466 		/* If no country found, set "00" as default */
3467 		if (ret == -ENOENT)
3468 			ret = __mt7925_mcu_set_clc(dev, "00",
3469 						   ENVIRON_INDOOR,
3470 						   phy->clc[i], i);
3471 		if (ret < 0)
3472 			return ret;
3473 	}
3474 	return 0;
3475 }
3476 
3477 int mt7925_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb,
3478 			    int cmd, int *wait_seq)
3479 {
3480 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
3481 	struct mt76_connac2_mcu_uni_txd *uni_txd;
3482 	struct mt76_connac2_mcu_txd *mcu_txd;
3483 	__le32 *txd;
3484 	u32 val;
3485 	u8 seq;
3486 
3487 	/* TODO: make dynamic based on msg type */
3488 	mdev->mcu.timeout = 20 * HZ;
3489 
3490 	seq = ++mdev->mcu.msg_seq & 0xf;
3491 	if (!seq)
3492 		seq = ++mdev->mcu.msg_seq & 0xf;
3493 
3494 	if (cmd == MCU_CMD(FW_SCATTER))
3495 		goto exit;
3496 
3497 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
3498 	txd = (__le32 *)skb_push(skb, txd_len);
3499 
3500 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
3501 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
3502 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
3503 	txd[0] = cpu_to_le32(val);
3504 
3505 	val = FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
3506 	txd[1] = cpu_to_le32(val);
3507 
3508 	if (cmd & __MCU_CMD_FIELD_UNI) {
3509 		uni_txd = (struct mt76_connac2_mcu_uni_txd *)txd;
3510 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
3511 		uni_txd->cid = cpu_to_le16(mcu_cmd);
3512 		uni_txd->s2d_index = MCU_S2D_H2N;
3513 		uni_txd->pkt_type = MCU_PKT_ID;
3514 		uni_txd->seq = seq;
3515 
3516 		if (cmd & __MCU_CMD_FIELD_QUERY)
3517 			uni_txd->option = MCU_CMD_UNI_QUERY_ACK;
3518 		else
3519 			uni_txd->option = MCU_CMD_UNI_EXT_ACK;
3520 
3521 		if (cmd == MCU_UNI_CMD(HIF_CTRL) ||
3522 		    cmd == MCU_UNI_CMD(CHIP_CONFIG))
3523 			uni_txd->option &= ~MCU_CMD_ACK;
3524 
3525 		if (mcu_cmd == MCU_UNI_CMD_TESTMODE_CTRL ||
3526 		    mcu_cmd == MCU_UNI_CMD_TESTMODE_RX_STAT) {
3527 			if (cmd & __MCU_CMD_FIELD_QUERY)
3528 				uni_txd->option = 0x2;
3529 			else
3530 				uni_txd->option = 0x6;
3531 		}
3532 
3533 		goto exit;
3534 	}
3535 
3536 	mcu_txd = (struct mt76_connac2_mcu_txd *)txd;
3537 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
3538 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
3539 					       MT_TX_MCU_PORT_RX_Q0));
3540 	mcu_txd->pkt_type = MCU_PKT_ID;
3541 	mcu_txd->seq = seq;
3542 	mcu_txd->cid = mcu_cmd;
3543 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
3544 
3545 	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
3546 		if (cmd & __MCU_CMD_FIELD_QUERY)
3547 			mcu_txd->set_query = MCU_Q_QUERY;
3548 		else
3549 			mcu_txd->set_query = MCU_Q_SET;
3550 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
3551 	} else {
3552 		mcu_txd->set_query = MCU_Q_NA;
3553 	}
3554 
3555 	if (cmd & __MCU_CMD_FIELD_WA)
3556 		mcu_txd->s2d_index = MCU_S2D_H2C;
3557 	else
3558 		mcu_txd->s2d_index = MCU_S2D_H2N;
3559 
3560 exit:
3561 	if (wait_seq)
3562 		*wait_seq = seq;
3563 
3564 	return 0;
3565 }
3566 EXPORT_SYMBOL_GPL(mt7925_mcu_fill_message);
3567 
3568 int mt7925_mcu_set_rts_thresh(struct mt792x_phy *phy, u32 val)
3569 {
3570 	struct {
3571 		u8 band_idx;
3572 		u8 _rsv[3];
3573 
3574 		__le16 tag;
3575 		__le16 len;
3576 		__le32 len_thresh;
3577 		__le32 pkt_thresh;
3578 	} __packed req = {
3579 		.band_idx = phy->mt76->band_idx,
3580 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RTS_THRESHOLD),
3581 		.len = cpu_to_le16(sizeof(req) - 4),
3582 		.len_thresh = cpu_to_le32(val),
3583 		.pkt_thresh = cpu_to_le32(0x2),
3584 	};
3585 
3586 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3587 				 &req, sizeof(req), true);
3588 }
3589 
3590 int mt7925_mcu_set_radio_en(struct mt792x_phy *phy, bool enable)
3591 {
3592 	struct {
3593 		u8 band_idx;
3594 		u8 _rsv[3];
3595 
3596 		__le16 tag;
3597 		__le16 len;
3598 		u8 enable;
3599 		u8 _rsv2[3];
3600 	} __packed req = {
3601 		.band_idx = phy->mt76->band_idx,
3602 		.tag = cpu_to_le16(UNI_BAND_CONFIG_RADIO_ENABLE),
3603 		.len = cpu_to_le16(sizeof(req) - 4),
3604 		.enable = enable,
3605 	};
3606 
3607 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3608 				 &req, sizeof(req), true);
3609 }
3610 
3611 static void
3612 mt7925_mcu_build_sku(struct mt76_dev *dev, s8 *sku,
3613 		     struct mt76_power_limits *limits,
3614 		     enum nl80211_band band)
3615 {
3616 	int i, offset = sizeof(limits->cck);
3617 
3618 	memset(sku, 127, MT_CONNAC3_SKU_POWER_LIMIT);
3619 
3620 	if (band == NL80211_BAND_2GHZ) {
3621 		/* cck */
3622 		memcpy(sku, limits->cck, sizeof(limits->cck));
3623 	}
3624 
3625 	/* ofdm */
3626 	memcpy(&sku[offset], limits->ofdm, sizeof(limits->ofdm));
3627 	offset += (sizeof(limits->ofdm) * 5);
3628 
3629 	/* ht */
3630 	for (i = 0; i < 2; i++) {
3631 		memcpy(&sku[offset], limits->mcs[i], 8);
3632 		offset += 8;
3633 	}
3634 	sku[offset++] = limits->mcs[0][0];
3635 
3636 	/* vht */
3637 	for (i = 0; i < ARRAY_SIZE(limits->mcs); i++) {
3638 		memcpy(&sku[offset], limits->mcs[i],
3639 		       ARRAY_SIZE(limits->mcs[i]));
3640 		offset += 12;
3641 	}
3642 
3643 	/* he */
3644 	for (i = 0; i < ARRAY_SIZE(limits->ru); i++) {
3645 		memcpy(&sku[offset], limits->ru[i], ARRAY_SIZE(limits->ru[i]));
3646 		offset += ARRAY_SIZE(limits->ru[i]);
3647 	}
3648 
3649 	/* eht */
3650 	for (i = 0; i < ARRAY_SIZE(limits->eht); i++) {
3651 		memcpy(&sku[offset], limits->eht[i], ARRAY_SIZE(limits->eht[i]));
3652 		offset += ARRAY_SIZE(limits->eht[i]);
3653 	}
3654 }
3655 
3656 static int
3657 mt7925_mcu_rate_txpower_band(struct mt76_phy *phy,
3658 			     enum nl80211_band band)
3659 {
3660 	int tx_power, n_chan, last_ch, err = 0, idx = 0;
3661 	int i, sku_len, batch_size, batch_len = 3;
3662 	struct mt76_dev *dev = phy->dev;
3663 	static const u8 chan_list_2ghz[] = {
3664 		1, 2,  3,  4,  5,  6,  7,
3665 		8, 9, 10, 11, 12, 13, 14
3666 	};
3667 	static const u8 chan_list_5ghz[] = {
3668 		 36,  38,  40,  42,  44,  46,  48,
3669 		 50,  52,  54,  56,  58,  60,  62,
3670 		 64, 100, 102, 104, 106, 108, 110,
3671 		112, 114, 116, 118, 120, 122, 124,
3672 		126, 128, 132, 134, 136, 138, 140,
3673 		142, 144, 149, 151, 153, 155, 157,
3674 		159, 161, 165, 167
3675 	};
3676 	static const u8 chan_list_6ghz[] = {
3677 		  1,   3,   5,   7,   9,  11,  13,
3678 		 15,  17,  19,  21,  23,  25,  27,
3679 		 29,  33,  35,  37,  39,  41,  43,
3680 		 45,  47,  49,  51,  53,  55,  57,
3681 		 59,  61,  65,  67,  69,  71,  73,
3682 		 75,  77,  79,  81,  83,  85,  87,
3683 		 89,  91,  93,  97,  99, 101, 103,
3684 		105, 107, 109, 111, 113, 115, 117,
3685 		119, 121, 123, 125, 129, 131, 133,
3686 		135, 137, 139, 141, 143, 145, 147,
3687 		149, 151, 153, 155, 157, 161, 163,
3688 		165, 167, 169, 171, 173, 175, 177,
3689 		179, 181, 183, 185, 187, 189, 193,
3690 		195, 197, 199, 201, 203, 205, 207,
3691 		209, 211, 213, 215, 217, 219, 221,
3692 		225, 227, 229, 233
3693 	};
3694 	struct mt76_power_limits *limits;
3695 	struct mt7925_sku_tlv *sku_tlbv;
3696 	const u8 *ch_list;
3697 
3698 	sku_len = sizeof(*sku_tlbv);
3699 	tx_power = 2 * phy->hw->conf.power_level;
3700 	if (!tx_power)
3701 		tx_power = 127;
3702 
3703 	if (band == NL80211_BAND_2GHZ) {
3704 		n_chan = ARRAY_SIZE(chan_list_2ghz);
3705 		ch_list = chan_list_2ghz;
3706 		last_ch = chan_list_2ghz[ARRAY_SIZE(chan_list_2ghz) - 1];
3707 	} else if (band == NL80211_BAND_6GHZ) {
3708 		n_chan = ARRAY_SIZE(chan_list_6ghz);
3709 		ch_list = chan_list_6ghz;
3710 		last_ch = chan_list_6ghz[ARRAY_SIZE(chan_list_6ghz) - 1];
3711 	} else {
3712 		n_chan = ARRAY_SIZE(chan_list_5ghz);
3713 		ch_list = chan_list_5ghz;
3714 		last_ch = chan_list_5ghz[ARRAY_SIZE(chan_list_5ghz) - 1];
3715 	}
3716 	batch_size = DIV_ROUND_UP(n_chan, batch_len);
3717 
3718 	limits = devm_kmalloc(dev->dev, sizeof(*limits), GFP_KERNEL);
3719 	if (!limits)
3720 		return -ENOMEM;
3721 
3722 	sku_tlbv = devm_kmalloc(dev->dev, sku_len, GFP_KERNEL);
3723 	if (!sku_tlbv) {
3724 		devm_kfree(dev->dev, limits);
3725 		return -ENOMEM;
3726 	}
3727 
3728 	for (i = 0; i < batch_size; i++) {
3729 		struct mt7925_tx_power_limit_tlv *tx_power_tlv;
3730 		int j, msg_len, num_ch;
3731 		struct sk_buff *skb;
3732 
3733 		num_ch = i == batch_size - 1 ? n_chan % batch_len : batch_len;
3734 		msg_len = sizeof(*tx_power_tlv) + num_ch * sku_len;
3735 		skb = mt76_mcu_msg_alloc(dev, NULL, msg_len);
3736 		if (!skb) {
3737 			err = -ENOMEM;
3738 			goto out;
3739 		}
3740 
3741 		tx_power_tlv = (struct mt7925_tx_power_limit_tlv *)
3742 			       skb_put(skb, sizeof(*tx_power_tlv));
3743 
3744 		BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(tx_power_tlv->alpha2));
3745 		memcpy(tx_power_tlv->alpha2, dev->alpha2, sizeof(dev->alpha2));
3746 		tx_power_tlv->n_chan = num_ch;
3747 		tx_power_tlv->tag = cpu_to_le16(0x1);
3748 		tx_power_tlv->len = cpu_to_le16(msg_len);
3749 
3750 		switch (band) {
3751 		case NL80211_BAND_2GHZ:
3752 			tx_power_tlv->band = 1;
3753 			break;
3754 		case NL80211_BAND_6GHZ:
3755 			tx_power_tlv->band = 3;
3756 			break;
3757 		default:
3758 			tx_power_tlv->band = 2;
3759 			break;
3760 		}
3761 
3762 		for (j = 0; j < num_ch; j++, idx++) {
3763 			struct ieee80211_channel chan = {
3764 				.hw_value = ch_list[idx],
3765 				.band = band,
3766 			};
3767 			s8 reg_power, sar_power;
3768 
3769 			reg_power = mt76_connac_get_ch_power(phy, &chan,
3770 							     tx_power);
3771 			sar_power = mt76_get_sar_power(phy, &chan, reg_power);
3772 
3773 			mt76_get_rate_power_limits(phy, &chan, limits,
3774 						   sar_power);
3775 
3776 			tx_power_tlv->last_msg = ch_list[idx] == last_ch;
3777 			sku_tlbv->channel = ch_list[idx];
3778 
3779 			mt7925_mcu_build_sku(dev, sku_tlbv->pwr_limit,
3780 					     limits, band);
3781 			skb_put_data(skb, sku_tlbv, sku_len);
3782 		}
3783 		err = mt76_mcu_skb_send_msg(dev, skb,
3784 					    MCU_UNI_CMD(SET_POWER_LIMIT),
3785 					    true);
3786 		if (err < 0)
3787 			goto out;
3788 	}
3789 
3790 out:
3791 	devm_kfree(dev->dev, sku_tlbv);
3792 	devm_kfree(dev->dev, limits);
3793 	return err;
3794 }
3795 
3796 int mt7925_mcu_set_rate_txpower(struct mt76_phy *phy)
3797 {
3798 	struct mt76_dev *mdev = phy->dev;
3799 	struct mt792x_dev *dev = mt792x_hw_dev(mdev->hw);
3800 	int err;
3801 
3802 	if (phy->cap.has_2ghz) {
3803 		err = mt7925_mcu_rate_txpower_band(phy,
3804 						   NL80211_BAND_2GHZ);
3805 		if (err < 0)
3806 			return err;
3807 	}
3808 
3809 	if (phy->cap.has_5ghz) {
3810 		err = mt7925_mcu_rate_txpower_band(phy,
3811 						   NL80211_BAND_5GHZ);
3812 		if (err < 0)
3813 			return err;
3814 	}
3815 
3816 	if (phy->cap.has_6ghz && dev->phy.clc_chan_conf) {
3817 		err = mt7925_mcu_rate_txpower_band(phy,
3818 						   NL80211_BAND_6GHZ);
3819 		if (err < 0)
3820 			return err;
3821 	}
3822 
3823 	return 0;
3824 }
3825 
3826 int mt7925_mcu_wf_rf_pin_ctrl(struct mt792x_phy *phy)
3827 {
3828 #define UNI_CMD_RADIO_STATUS_GET	0
3829 	struct mt792x_dev *dev = phy->dev;
3830 	struct sk_buff *skb;
3831 	int ret;
3832 	struct {
3833 		__le16 tag;
3834 		__le16 len;
3835 		u8 rsv[4];
3836 	} __packed req = {
3837 		.tag = UNI_CMD_RADIO_STATUS_GET,
3838 		.len = cpu_to_le16(sizeof(req)),
3839 	};
3840 	struct mt7925_radio_status_event {
3841 		__le16 tag;
3842 		__le16 len;
3843 
3844 		u8 data;
3845 		u8 rsv[3];
3846 	} __packed *status;
3847 
3848 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
3849 					MCU_UNI_CMD(RADIO_STATUS),
3850 					&req, sizeof(req), true, &skb);
3851 	if (ret)
3852 		return ret;
3853 
3854 	skb_pull(skb, sizeof(struct tlv));
3855 	status = (struct mt7925_radio_status_event *)skb->data;
3856 	ret = status->data;
3857 
3858 	dev_kfree_skb(skb);
3859 
3860 	return ret;
3861 }
3862 
3863 int mt7925_mcu_set_rxfilter(struct mt792x_dev *dev, u32 fif,
3864 			    u8 bit_op, u32 bit_map)
3865 {
3866 	struct mt792x_phy *phy = &dev->phy;
3867 	struct {
3868 		u8 band_idx;
3869 		u8 rsv1[3];
3870 
3871 		__le16 tag;
3872 		__le16 len;
3873 		u8 mode;
3874 		u8 rsv2[3];
3875 		__le32 fif;
3876 		__le32 bit_map; /* bit_* for bitmap update */
3877 		u8 bit_op;
3878 		u8 pad[51];
3879 	} __packed req = {
3880 		.band_idx = phy->mt76->band_idx,
3881 		.tag = cpu_to_le16(UNI_BAND_CONFIG_SET_MAC80211_RX_FILTER),
3882 		.len = cpu_to_le16(sizeof(req) - 4),
3883 
3884 		.mode = fif ? 0 : 1,
3885 		.fif = cpu_to_le32(fif),
3886 		.bit_map = cpu_to_le32(bit_map),
3887 		.bit_op = bit_op,
3888 	};
3889 
3890 	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_UNI_CMD(BAND_CONFIG),
3891 				 &req, sizeof(req), true);
3892 }
3893 
3894 int mt7925_mcu_set_rssimonitor(struct mt792x_dev *dev, struct ieee80211_vif *vif)
3895 {
3896 	struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(&vif->bss_conf);
3897 	struct {
3898 		struct {
3899 			u8 bss_idx;
3900 			u8 pad[3];
3901 		} __packed hdr;
3902 		__le16 tag;
3903 		__le16 len;
3904 		u8 enable;
3905 		s8 cqm_rssi_high;
3906 		s8 cqm_rssi_low;
3907 		u8 rsv;
3908 	} req = {
3909 		.hdr = {
3910 			.bss_idx = mconf->mt76.idx,
3911 		},
3912 		.tag = cpu_to_le16(UNI_CMD_RSSI_MONITOR_SET),
3913 		.len = cpu_to_le16(sizeof(req) - 4),
3914 		.enable = vif->cfg.assoc,
3915 		.cqm_rssi_high = (s8)(vif->bss_conf.cqm_rssi_thold + vif->bss_conf.cqm_rssi_hyst),
3916 		.cqm_rssi_low = (s8)(vif->bss_conf.cqm_rssi_thold - vif->bss_conf.cqm_rssi_hyst),
3917 	};
3918 
3919 	return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(RSSI_MONITOR), &req,
3920 				 sizeof(req), false);
3921 }
3922