1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/firmware.h>
5 #include "mt76_connac2_mac.h"
6 #include "mt76_connac_mcu.h"
7 
8 int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
9 {
10 	struct {
11 		__le32 option;
12 		__le32 addr;
13 	} req = {
14 		.option = cpu_to_le32(option),
15 		.addr = cpu_to_le32(addr),
16 	};
17 
18 	return mt76_mcu_send_msg(dev, MCU_CMD(FW_START_REQ), &req,
19 				 sizeof(req), true);
20 }
21 EXPORT_SYMBOL_GPL(mt76_connac_mcu_start_firmware);
22 
23 int mt76_connac_mcu_patch_sem_ctrl(struct mt76_dev *dev, bool get)
24 {
25 	u32 op = get ? PATCH_SEM_GET : PATCH_SEM_RELEASE;
26 	struct {
27 		__le32 op;
28 	} req = {
29 		.op = cpu_to_le32(op),
30 	};
31 
32 	return mt76_mcu_send_msg(dev, MCU_CMD(PATCH_SEM_CONTROL),
33 				 &req, sizeof(req), true);
34 }
35 EXPORT_SYMBOL_GPL(mt76_connac_mcu_patch_sem_ctrl);
36 
37 int mt76_connac_mcu_start_patch(struct mt76_dev *dev)
38 {
39 	struct {
40 		u8 check_crc;
41 		u8 reserved[3];
42 	} req = {
43 		.check_crc = 0,
44 	};
45 
46 	return mt76_mcu_send_msg(dev, MCU_CMD(PATCH_FINISH_REQ),
47 				 &req, sizeof(req), true);
48 }
49 EXPORT_SYMBOL_GPL(mt76_connac_mcu_start_patch);
50 
51 #define MCU_PATCH_ADDRESS	0x200000
52 
53 int mt76_connac_mcu_init_download(struct mt76_dev *dev, u32 addr, u32 len,
54 				  u32 mode)
55 {
56 	struct {
57 		__le32 addr;
58 		__le32 len;
59 		__le32 mode;
60 	} req = {
61 		.addr = cpu_to_le32(addr),
62 		.len = cpu_to_le32(len),
63 		.mode = cpu_to_le32(mode),
64 	};
65 	int cmd;
66 
67 	if ((!is_connac_v1(dev) && addr == MCU_PATCH_ADDRESS) ||
68 	    (is_mt7921(dev) && addr == 0x900000))
69 		cmd = MCU_CMD(PATCH_START_REQ);
70 	else
71 		cmd = MCU_CMD(TARGET_ADDRESS_LEN_REQ);
72 
73 	return mt76_mcu_send_msg(dev, cmd, &req, sizeof(req), true);
74 }
75 EXPORT_SYMBOL_GPL(mt76_connac_mcu_init_download);
76 
77 int mt76_connac_mcu_set_channel_domain(struct mt76_phy *phy)
78 {
79 	int len, i, n_max_channels, n_2ch = 0, n_5ch = 0, n_6ch = 0;
80 	struct mt76_connac_mcu_channel_domain {
81 		u8 alpha2[4]; /* regulatory_request.alpha2 */
82 		u8 bw_2g; /* BW_20_40M		0
83 			   * BW_20M		1
84 			   * BW_20_40_80M	2
85 			   * BW_20_40_80_160M	3
86 			   * BW_20_40_80_8080M	4
87 			   */
88 		u8 bw_5g;
89 		u8 bw_6g;
90 		u8 pad;
91 		u8 n_2ch;
92 		u8 n_5ch;
93 		u8 n_6ch;
94 		u8 pad2;
95 	} __packed hdr = {
96 		.bw_2g = 0,
97 		.bw_5g = 3, /* BW_20_40_80_160M */
98 		.bw_6g = 3,
99 	};
100 	struct mt76_connac_mcu_chan {
101 		__le16 hw_value;
102 		__le16 pad;
103 		__le32 flags;
104 	} __packed channel;
105 	struct mt76_dev *dev = phy->dev;
106 	struct ieee80211_channel *chan;
107 	struct sk_buff *skb;
108 
109 	n_max_channels = phy->sband_2g.sband.n_channels +
110 			 phy->sband_5g.sband.n_channels +
111 			 phy->sband_6g.sband.n_channels;
112 	len = sizeof(hdr) + n_max_channels * sizeof(channel);
113 
114 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
115 	if (!skb)
116 		return -ENOMEM;
117 
118 	skb_reserve(skb, sizeof(hdr));
119 
120 	for (i = 0; i < phy->sband_2g.sband.n_channels; i++) {
121 		chan = &phy->sband_2g.sband.channels[i];
122 		if (chan->flags & IEEE80211_CHAN_DISABLED)
123 			continue;
124 
125 		channel.hw_value = cpu_to_le16(chan->hw_value);
126 		channel.flags = cpu_to_le32(chan->flags);
127 		channel.pad = 0;
128 
129 		skb_put_data(skb, &channel, sizeof(channel));
130 		n_2ch++;
131 	}
132 	for (i = 0; i < phy->sband_5g.sband.n_channels; i++) {
133 		chan = &phy->sband_5g.sband.channels[i];
134 		if (chan->flags & IEEE80211_CHAN_DISABLED)
135 			continue;
136 
137 		channel.hw_value = cpu_to_le16(chan->hw_value);
138 		channel.flags = cpu_to_le32(chan->flags);
139 		channel.pad = 0;
140 
141 		skb_put_data(skb, &channel, sizeof(channel));
142 		n_5ch++;
143 	}
144 	for (i = 0; i < phy->sband_6g.sband.n_channels; i++) {
145 		chan = &phy->sband_6g.sband.channels[i];
146 		if (chan->flags & IEEE80211_CHAN_DISABLED)
147 			continue;
148 
149 		channel.hw_value = cpu_to_le16(chan->hw_value);
150 		channel.flags = cpu_to_le32(chan->flags);
151 		channel.pad = 0;
152 
153 		skb_put_data(skb, &channel, sizeof(channel));
154 		n_6ch++;
155 	}
156 
157 	BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(hdr.alpha2));
158 	memcpy(hdr.alpha2, dev->alpha2, sizeof(dev->alpha2));
159 	hdr.n_2ch = n_2ch;
160 	hdr.n_5ch = n_5ch;
161 	hdr.n_6ch = n_6ch;
162 
163 	memcpy(__skb_push(skb, sizeof(hdr)), &hdr, sizeof(hdr));
164 
165 	return mt76_mcu_skb_send_msg(dev, skb, MCU_CE_CMD(SET_CHAN_DOMAIN),
166 				     false);
167 }
168 EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_channel_domain);
169 
170 int mt76_connac_mcu_set_mac_enable(struct mt76_dev *dev, int band, bool enable,
171 				   bool hdr_trans)
172 {
173 	struct {
174 		u8 enable;
175 		u8 band;
176 		u8 rsv[2];
177 	} __packed req_mac = {
178 		.enable = enable,
179 		.band = band,
180 	};
181 
182 	return mt76_mcu_send_msg(dev, MCU_EXT_CMD(MAC_INIT_CTRL), &req_mac,
183 				 sizeof(req_mac), true);
184 }
185 EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_mac_enable);
186 
187 int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif)
188 {
189 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
190 	struct {
191 		u8 bss_idx;
192 		u8 ps_state; /* 0: device awake
193 			      * 1: static power save
194 			      * 2: dynamic power saving
195 			      */
196 	} req = {
197 		.bss_idx = mvif->idx,
198 		.ps_state = vif->cfg.ps ? 2 : 0,
199 	};
200 
201 	if (vif->type != NL80211_IFTYPE_STATION)
202 		return -EOPNOTSUPP;
203 
204 	return mt76_mcu_send_msg(dev, MCU_CE_CMD(SET_PS_PROFILE),
205 				 &req, sizeof(req), false);
206 }
207 EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_vif_ps);
208 
209 int mt76_connac_mcu_set_rts_thresh(struct mt76_dev *dev, u32 val, u8 band)
210 {
211 	struct {
212 		u8 prot_idx;
213 		u8 band;
214 		u8 rsv[2];
215 		__le32 len_thresh;
216 		__le32 pkt_thresh;
217 	} __packed req = {
218 		.prot_idx = 1,
219 		.band = band,
220 		.len_thresh = cpu_to_le32(val),
221 		.pkt_thresh = cpu_to_le32(0x2),
222 	};
223 
224 	return mt76_mcu_send_msg(dev, MCU_EXT_CMD(PROTECT_CTRL), &req,
225 				 sizeof(req), true);
226 }
227 EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_rts_thresh);
228 
229 void mt76_connac_mcu_beacon_loss_iter(void *priv, u8 *mac,
230 				      struct ieee80211_vif *vif)
231 {
232 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
233 	struct mt76_connac_beacon_loss_event *event = priv;
234 
235 	if (mvif->idx != event->bss_idx)
236 		return;
237 
238 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
239 		return;
240 
241 	ieee80211_beacon_loss(vif);
242 }
243 EXPORT_SYMBOL_GPL(mt76_connac_mcu_beacon_loss_iter);
244 
245 struct tlv *
246 mt76_connac_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
247 			       void *sta_ntlv, void *sta_wtbl)
248 {
249 	struct sta_ntlv_hdr *ntlv_hdr = sta_ntlv;
250 	struct tlv *sta_hdr = sta_wtbl;
251 	struct tlv *ptlv, tlv = {
252 		.tag = cpu_to_le16(tag),
253 		.len = cpu_to_le16(len),
254 	};
255 	u16 ntlv;
256 
257 	ptlv = skb_put(skb, len);
258 	memcpy(ptlv, &tlv, sizeof(tlv));
259 
260 	ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
261 	ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);
262 
263 	if (sta_hdr)
264 		le16_add_cpu(&sta_hdr->len, len);
265 
266 	return ptlv;
267 }
268 EXPORT_SYMBOL_GPL(mt76_connac_mcu_add_nested_tlv);
269 
270 struct sk_buff *
271 __mt76_connac_mcu_alloc_sta_req(struct mt76_dev *dev, struct mt76_vif *mvif,
272 				struct mt76_wcid *wcid, int len)
273 {
274 	struct sta_req_hdr hdr = {
275 		.bss_idx = mvif->idx,
276 		.muar_idx = wcid ? mvif->omac_idx : 0,
277 		.is_tlv_append = 1,
278 	};
279 	struct sk_buff *skb;
280 
281 	mt76_connac_mcu_get_wlan_idx(dev, wcid, &hdr.wlan_idx_lo,
282 				     &hdr.wlan_idx_hi);
283 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
284 	if (!skb)
285 		return ERR_PTR(-ENOMEM);
286 
287 	skb_put_data(skb, &hdr, sizeof(hdr));
288 
289 	return skb;
290 }
291 EXPORT_SYMBOL_GPL(__mt76_connac_mcu_alloc_sta_req);
292 
293 struct wtbl_req_hdr *
294 mt76_connac_mcu_alloc_wtbl_req(struct mt76_dev *dev, struct mt76_wcid *wcid,
295 			       int cmd, void *sta_wtbl, struct sk_buff **skb)
296 {
297 	struct tlv *sta_hdr = sta_wtbl;
298 	struct wtbl_req_hdr hdr = {
299 		.operation = cmd,
300 	};
301 	struct sk_buff *nskb = *skb;
302 
303 	mt76_connac_mcu_get_wlan_idx(dev, wcid, &hdr.wlan_idx_lo,
304 				     &hdr.wlan_idx_hi);
305 	if (!nskb) {
306 		nskb = mt76_mcu_msg_alloc(dev, NULL,
307 					  MT76_CONNAC_WTBL_UPDATE_MAX_SIZE);
308 		if (!nskb)
309 			return ERR_PTR(-ENOMEM);
310 
311 		*skb = nskb;
312 	}
313 
314 	if (sta_hdr)
315 		le16_add_cpu(&sta_hdr->len, sizeof(hdr));
316 
317 	return skb_put_data(nskb, &hdr, sizeof(hdr));
318 }
319 EXPORT_SYMBOL_GPL(mt76_connac_mcu_alloc_wtbl_req);
320 
321 void mt76_connac_mcu_bss_omac_tlv(struct sk_buff *skb,
322 				  struct ieee80211_vif *vif)
323 {
324 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
325 	u8 omac_idx = mvif->omac_idx;
326 	struct bss_info_omac *omac;
327 	struct tlv *tlv;
328 	u32 type = 0;
329 
330 	switch (vif->type) {
331 	case NL80211_IFTYPE_MONITOR:
332 	case NL80211_IFTYPE_MESH_POINT:
333 	case NL80211_IFTYPE_AP:
334 		if (vif->p2p)
335 			type = CONNECTION_P2P_GO;
336 		else
337 			type = CONNECTION_INFRA_AP;
338 		break;
339 	case NL80211_IFTYPE_STATION:
340 		if (vif->p2p)
341 			type = CONNECTION_P2P_GC;
342 		else
343 			type = CONNECTION_INFRA_STA;
344 		break;
345 	case NL80211_IFTYPE_ADHOC:
346 		type = CONNECTION_IBSS_ADHOC;
347 		break;
348 	default:
349 		WARN_ON(1);
350 		break;
351 	}
352 
353 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_OMAC, sizeof(*omac));
354 
355 	omac = (struct bss_info_omac *)tlv;
356 	omac->conn_type = cpu_to_le32(type);
357 	omac->omac_idx = mvif->omac_idx;
358 	omac->band_idx = mvif->band_idx;
359 	omac->hw_bss_idx = omac_idx > EXT_BSSID_START ? HW_BSSID_0 : omac_idx;
360 }
361 EXPORT_SYMBOL_GPL(mt76_connac_mcu_bss_omac_tlv);
362 
363 void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
364 				   struct ieee80211_vif *vif,
365 				   struct ieee80211_sta *sta,
366 				   bool enable, bool newly)
367 {
368 	struct sta_rec_basic *basic;
369 	struct tlv *tlv;
370 	int conn_type;
371 
372 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BASIC, sizeof(*basic));
373 
374 	basic = (struct sta_rec_basic *)tlv;
375 	basic->extra_info = cpu_to_le16(EXTRA_INFO_VER);
376 
377 	if (enable) {
378 		if (newly)
379 			basic->extra_info |= cpu_to_le16(EXTRA_INFO_NEW);
380 		basic->conn_state = CONN_STATE_PORT_SECURE;
381 	} else {
382 		basic->conn_state = CONN_STATE_DISCONNECT;
383 	}
384 
385 	if (!sta) {
386 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
387 		eth_broadcast_addr(basic->peer_addr);
388 		return;
389 	}
390 
391 	switch (vif->type) {
392 	case NL80211_IFTYPE_MESH_POINT:
393 	case NL80211_IFTYPE_AP:
394 		if (vif->p2p)
395 			conn_type = CONNECTION_P2P_GC;
396 		else
397 			conn_type = CONNECTION_INFRA_STA;
398 		basic->conn_type = cpu_to_le32(conn_type);
399 		basic->aid = cpu_to_le16(sta->aid);
400 		break;
401 	case NL80211_IFTYPE_STATION:
402 		if (vif->p2p)
403 			conn_type = CONNECTION_P2P_GO;
404 		else
405 			conn_type = CONNECTION_INFRA_AP;
406 		basic->conn_type = cpu_to_le32(conn_type);
407 		basic->aid = cpu_to_le16(vif->cfg.aid);
408 		break;
409 	case NL80211_IFTYPE_ADHOC:
410 		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
411 		basic->aid = cpu_to_le16(sta->aid);
412 		break;
413 	default:
414 		WARN_ON(1);
415 		break;
416 	}
417 
418 	memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
419 	basic->qos = sta->wme;
420 }
421 EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_basic_tlv);
422 
423 void mt76_connac_mcu_sta_uapsd(struct sk_buff *skb, struct ieee80211_vif *vif,
424 			       struct ieee80211_sta *sta)
425 {
426 	struct sta_rec_uapsd *uapsd;
427 	struct tlv *tlv;
428 
429 	if (vif->type != NL80211_IFTYPE_AP || !sta->wme)
430 		return;
431 
432 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_APPS, sizeof(*uapsd));
433 	uapsd = (struct sta_rec_uapsd *)tlv;
434 
435 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) {
436 		uapsd->dac_map |= BIT(3);
437 		uapsd->tac_map |= BIT(3);
438 	}
439 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI) {
440 		uapsd->dac_map |= BIT(2);
441 		uapsd->tac_map |= BIT(2);
442 	}
443 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE) {
444 		uapsd->dac_map |= BIT(1);
445 		uapsd->tac_map |= BIT(1);
446 	}
447 	if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK) {
448 		uapsd->dac_map |= BIT(0);
449 		uapsd->tac_map |= BIT(0);
450 	}
451 	uapsd->max_sp = sta->max_sp;
452 }
453 EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_uapsd);
454 
455 void mt76_connac_mcu_wtbl_hdr_trans_tlv(struct sk_buff *skb,
456 					struct ieee80211_vif *vif,
457 					struct mt76_wcid *wcid,
458 					void *sta_wtbl, void *wtbl_tlv)
459 {
460 	struct wtbl_hdr_trans *htr;
461 	struct tlv *tlv;
462 
463 	tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_HDR_TRANS,
464 					     sizeof(*htr),
465 					     wtbl_tlv, sta_wtbl);
466 	htr = (struct wtbl_hdr_trans *)tlv;
467 	htr->no_rx_trans = true;
468 
469 	if (vif->type == NL80211_IFTYPE_STATION)
470 		htr->to_ds = true;
471 	else
472 		htr->from_ds = true;
473 
474 	if (!wcid)
475 		return;
476 
477 	htr->no_rx_trans = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
478 	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
479 		htr->to_ds = true;
480 		htr->from_ds = true;
481 	}
482 }
483 EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_hdr_trans_tlv);
484 
485 int mt76_connac_mcu_sta_update_hdr_trans(struct mt76_dev *dev,
486 					 struct ieee80211_vif *vif,
487 					 struct mt76_wcid *wcid, int cmd)
488 {
489 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
490 	struct wtbl_req_hdr *wtbl_hdr;
491 	struct tlv *sta_wtbl;
492 	struct sk_buff *skb;
493 
494 	skb = mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid);
495 	if (IS_ERR(skb))
496 		return PTR_ERR(skb);
497 
498 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
499 					   sizeof(struct tlv));
500 
501 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(dev, wcid, WTBL_SET,
502 						  sta_wtbl, &skb);
503 	if (IS_ERR(wtbl_hdr))
504 		return PTR_ERR(wtbl_hdr);
505 
506 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, sta_wtbl, wtbl_hdr);
507 
508 	return mt76_mcu_skb_send_msg(dev, skb, cmd, true);
509 }
510 EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_update_hdr_trans);
511 
512 int mt76_connac_mcu_wtbl_update_hdr_trans(struct mt76_dev *dev,
513 					  struct ieee80211_vif *vif,
514 					  struct ieee80211_sta *sta)
515 {
516 	struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;
517 	struct wtbl_req_hdr *wtbl_hdr;
518 	struct sk_buff *skb = NULL;
519 
520 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(dev, wcid, WTBL_SET, NULL,
521 						  &skb);
522 	if (IS_ERR(wtbl_hdr))
523 		return PTR_ERR(wtbl_hdr);
524 
525 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, NULL, wtbl_hdr);
526 
527 	return mt76_mcu_skb_send_msg(dev, skb, MCU_EXT_CMD(WTBL_UPDATE), true);
528 }
529 EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_update_hdr_trans);
530 
531 void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
532 				      struct sk_buff *skb,
533 				      struct ieee80211_vif *vif,
534 				      struct ieee80211_sta *sta,
535 				      void *sta_wtbl, void *wtbl_tlv)
536 {
537 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
538 	struct wtbl_generic *generic;
539 	struct wtbl_rx *rx;
540 	struct wtbl_spe *spe;
541 	struct tlv *tlv;
542 
543 	tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_GENERIC,
544 					     sizeof(*generic),
545 					     wtbl_tlv, sta_wtbl);
546 
547 	generic = (struct wtbl_generic *)tlv;
548 
549 	if (sta) {
550 		if (vif->type == NL80211_IFTYPE_STATION)
551 			generic->partial_aid = cpu_to_le16(vif->cfg.aid);
552 		else
553 			generic->partial_aid = cpu_to_le16(sta->aid);
554 		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
555 		generic->muar_idx = mvif->omac_idx;
556 		generic->qos = sta->wme;
557 	} else {
558 		if (!is_connac_v1(dev) && vif->type == NL80211_IFTYPE_STATION)
559 			memcpy(generic->peer_addr, vif->bss_conf.bssid,
560 			       ETH_ALEN);
561 		else
562 			eth_broadcast_addr(generic->peer_addr);
563 
564 		generic->muar_idx = 0xe;
565 	}
566 
567 	tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_RX, sizeof(*rx),
568 					     wtbl_tlv, sta_wtbl);
569 
570 	rx = (struct wtbl_rx *)tlv;
571 	rx->rca1 = sta ? vif->type != NL80211_IFTYPE_AP : 1;
572 	rx->rca2 = 1;
573 	rx->rv = 1;
574 
575 	if (!is_connac_v1(dev))
576 		return;
577 
578 	tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_SPE, sizeof(*spe),
579 					     wtbl_tlv, sta_wtbl);
580 	spe = (struct wtbl_spe *)tlv;
581 	spe->spe_idx = 24;
582 }
583 EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_generic_tlv);
584 
585 static void
586 mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
587 			      struct ieee80211_vif *vif)
588 {
589 	struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;
590 	struct sta_rec_amsdu *amsdu;
591 	struct tlv *tlv;
592 
593 	if (vif->type != NL80211_IFTYPE_AP &&
594 	    vif->type != NL80211_IFTYPE_STATION)
595 		return;
596 
597 	if (!sta->max_amsdu_len)
598 		return;
599 
600 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
601 	amsdu = (struct sta_rec_amsdu *)tlv;
602 	amsdu->max_amsdu_num = 8;
603 	amsdu->amsdu_en = true;
604 	amsdu->max_mpdu_size = sta->max_amsdu_len >=
605 			       IEEE80211_MAX_MPDU_LEN_VHT_7991;
606 
607 	wcid->amsdu = true;
608 }
609 
610 #define HE_PHY(p, c)	u8_get_bits(c, IEEE80211_HE_PHY_##p)
611 #define HE_MAC(m, c)	u8_get_bits(c, IEEE80211_HE_MAC_##m)
612 static void
613 mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
614 {
615 	struct ieee80211_sta_he_cap *he_cap = &sta->deflink.he_cap;
616 	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
617 	struct sta_rec_he *he;
618 	struct tlv *tlv;
619 	u32 cap = 0;
620 
621 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
622 
623 	he = (struct sta_rec_he *)tlv;
624 
625 	if (elem->mac_cap_info[0] & IEEE80211_HE_MAC_CAP0_HTC_HE)
626 		cap |= STA_REC_HE_CAP_HTC;
627 
628 	if (elem->mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
629 		cap |= STA_REC_HE_CAP_BSR;
630 
631 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
632 		cap |= STA_REC_HE_CAP_OM;
633 
634 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
635 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
636 
637 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
638 		cap |= STA_REC_HE_CAP_BQR;
639 
640 	if (elem->phy_cap_info[0] &
641 	    (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G |
642 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
643 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
644 
645 	if (elem->phy_cap_info[1] &
646 	    IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD)
647 		cap |= STA_REC_HE_CAP_LDPC;
648 
649 	if (elem->phy_cap_info[1] &
650 	    IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US)
651 		cap |= STA_REC_HE_CAP_SU_PPDU_1LTF_8US_GI;
652 
653 	if (elem->phy_cap_info[2] &
654 	    IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US)
655 		cap |= STA_REC_HE_CAP_NDP_4LTF_3DOT2MS_GI;
656 
657 	if (elem->phy_cap_info[2] &
658 	    IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ)
659 		cap |= STA_REC_HE_CAP_LE_EQ_80M_TX_STBC;
660 
661 	if (elem->phy_cap_info[2] &
662 	    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
663 		cap |= STA_REC_HE_CAP_LE_EQ_80M_RX_STBC;
664 
665 	if (elem->phy_cap_info[6] &
666 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE)
667 		cap |= STA_REC_HE_CAP_PARTIAL_BW_EXT_RANGE;
668 
669 	if (elem->phy_cap_info[7] &
670 	    IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI)
671 		cap |= STA_REC_HE_CAP_SU_MU_PPDU_4LTF_8US_GI;
672 
673 	if (elem->phy_cap_info[7] &
674 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ)
675 		cap |= STA_REC_HE_CAP_GT_80M_TX_STBC;
676 
677 	if (elem->phy_cap_info[7] &
678 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ)
679 		cap |= STA_REC_HE_CAP_GT_80M_RX_STBC;
680 
681 	if (elem->phy_cap_info[8] &
682 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI)
683 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_4LTF_8US_GI;
684 
685 	if (elem->phy_cap_info[8] &
686 	    IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI)
687 		cap |= STA_REC_HE_CAP_ER_SU_PPDU_1LTF_8US_GI;
688 
689 	if (elem->phy_cap_info[9] &
690 	    IEEE80211_HE_PHY_CAP9_NON_TRIGGERED_CQI_FEEDBACK)
691 		cap |= STA_REC_HE_CAP_TRIG_CQI_FK;
692 
693 	if (elem->phy_cap_info[9] &
694 	    IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU)
695 		cap |= STA_REC_HE_CAP_TX_1024QAM_UNDER_RU242;
696 
697 	if (elem->phy_cap_info[9] &
698 	    IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU)
699 		cap |= STA_REC_HE_CAP_RX_1024QAM_UNDER_RU242;
700 
701 	he->he_cap = cpu_to_le32(cap);
702 
703 	switch (sta->deflink.bandwidth) {
704 	case IEEE80211_STA_RX_BW_160:
705 		if (elem->phy_cap_info[0] &
706 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
707 			he->max_nss_mcs[CMD_HE_MCS_BW8080] =
708 				he_cap->he_mcs_nss_supp.rx_mcs_80p80;
709 
710 		he->max_nss_mcs[CMD_HE_MCS_BW160] =
711 				he_cap->he_mcs_nss_supp.rx_mcs_160;
712 		fallthrough;
713 	default:
714 		he->max_nss_mcs[CMD_HE_MCS_BW80] =
715 				he_cap->he_mcs_nss_supp.rx_mcs_80;
716 		break;
717 	}
718 
719 	he->t_frame_dur =
720 		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
721 	he->max_ampdu_exp =
722 		HE_MAC(CAP3_MAX_AMPDU_LEN_EXP_MASK, elem->mac_cap_info[3]);
723 
724 	he->bw_set =
725 		HE_PHY(CAP0_CHANNEL_WIDTH_SET_MASK, elem->phy_cap_info[0]);
726 	he->device_class =
727 		HE_PHY(CAP1_DEVICE_CLASS_A, elem->phy_cap_info[1]);
728 	he->punc_pream_rx =
729 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
730 
731 	he->dcm_tx_mode =
732 		HE_PHY(CAP3_DCM_MAX_CONST_TX_MASK, elem->phy_cap_info[3]);
733 	he->dcm_tx_max_nss =
734 		HE_PHY(CAP3_DCM_MAX_TX_NSS_2, elem->phy_cap_info[3]);
735 	he->dcm_rx_mode =
736 		HE_PHY(CAP3_DCM_MAX_CONST_RX_MASK, elem->phy_cap_info[3]);
737 	he->dcm_rx_max_nss =
738 		HE_PHY(CAP3_DCM_MAX_RX_NSS_2, elem->phy_cap_info[3]);
739 	he->dcm_rx_max_nss =
740 		HE_PHY(CAP8_DCM_MAX_RU_MASK, elem->phy_cap_info[8]);
741 
742 	he->pkt_ext = 2;
743 }
744 
745 static u8
746 mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
747 			    enum nl80211_band band, struct ieee80211_sta *sta)
748 {
749 	struct ieee80211_sta_ht_cap *ht_cap;
750 	struct ieee80211_sta_vht_cap *vht_cap;
751 	const struct ieee80211_sta_he_cap *he_cap;
752 	u8 mode = 0;
753 
754 	if (sta) {
755 		ht_cap = &sta->deflink.ht_cap;
756 		vht_cap = &sta->deflink.vht_cap;
757 		he_cap = &sta->deflink.he_cap;
758 	} else {
759 		struct ieee80211_supported_band *sband;
760 
761 		sband = mphy->hw->wiphy->bands[band];
762 		ht_cap = &sband->ht_cap;
763 		vht_cap = &sband->vht_cap;
764 		he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
765 	}
766 
767 	if (band == NL80211_BAND_2GHZ) {
768 		mode |= PHY_TYPE_BIT_HR_DSSS | PHY_TYPE_BIT_ERP;
769 
770 		if (ht_cap->ht_supported)
771 			mode |= PHY_TYPE_BIT_HT;
772 
773 		if (he_cap && he_cap->has_he)
774 			mode |= PHY_TYPE_BIT_HE;
775 	} else if (band == NL80211_BAND_5GHZ || band == NL80211_BAND_6GHZ) {
776 		mode |= PHY_TYPE_BIT_OFDM;
777 
778 		if (ht_cap->ht_supported)
779 			mode |= PHY_TYPE_BIT_HT;
780 
781 		if (vht_cap->vht_supported)
782 			mode |= PHY_TYPE_BIT_VHT;
783 
784 		if (he_cap && he_cap->has_he)
785 			mode |= PHY_TYPE_BIT_HE;
786 	}
787 
788 	return mode;
789 }
790 
791 void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
792 			     struct ieee80211_sta *sta,
793 			     struct ieee80211_vif *vif,
794 			     u8 rcpi, u8 sta_state)
795 {
796 	struct cfg80211_chan_def *chandef = &mphy->chandef;
797 	enum nl80211_band band = chandef->chan->band;
798 	struct mt76_dev *dev = mphy->dev;
799 	struct sta_rec_ra_info *ra_info;
800 	struct sta_rec_state *state;
801 	struct sta_rec_phy *phy;
802 	struct tlv *tlv;
803 	u16 supp_rates;
804 
805 	/* starec ht */
806 	if (sta->deflink.ht_cap.ht_supported) {
807 		struct sta_rec_ht *ht;
808 
809 		tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
810 		ht = (struct sta_rec_ht *)tlv;
811 		ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
812 	}
813 
814 	/* starec vht */
815 	if (sta->deflink.vht_cap.vht_supported) {
816 		struct sta_rec_vht *vht;
817 		int len;
818 
819 		len = is_mt7921(dev) ? sizeof(*vht) : sizeof(*vht) - 4;
820 		tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, len);
821 		vht = (struct sta_rec_vht *)tlv;
822 		vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
823 		vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
824 		vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
825 	}
826 
827 	/* starec uapsd */
828 	mt76_connac_mcu_sta_uapsd(skb, vif, sta);
829 
830 	if (!is_mt7921(dev))
831 		return;
832 
833 	if (sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he)
834 		mt76_connac_mcu_sta_amsdu_tlv(skb, sta, vif);
835 
836 	/* starec he */
837 	if (sta->deflink.he_cap.has_he) {
838 		mt76_connac_mcu_sta_he_tlv(skb, sta);
839 		if (band == NL80211_BAND_6GHZ &&
840 		    sta_state == MT76_STA_INFO_STATE_ASSOC) {
841 			struct sta_rec_he_6g_capa *he_6g_capa;
842 
843 			tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G,
844 						      sizeof(*he_6g_capa));
845 			he_6g_capa = (struct sta_rec_he_6g_capa *)tlv;
846 			he_6g_capa->capa = sta->deflink.he_6ghz_capa.capa;
847 		}
848 	}
849 
850 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PHY, sizeof(*phy));
851 	phy = (struct sta_rec_phy *)tlv;
852 	phy->phy_type = mt76_connac_get_phy_mode_v2(mphy, vif, band, sta);
853 	phy->basic_rate = cpu_to_le16((u16)vif->bss_conf.basic_rates);
854 	phy->rcpi = rcpi;
855 	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR,
856 				sta->deflink.ht_cap.ampdu_factor) |
857 		     FIELD_PREP(IEEE80211_HT_AMPDU_PARM_DENSITY,
858 				sta->deflink.ht_cap.ampdu_density);
859 
860 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra_info));
861 	ra_info = (struct sta_rec_ra_info *)tlv;
862 
863 	supp_rates = sta->deflink.supp_rates[band];
864 	if (band == NL80211_BAND_2GHZ)
865 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
866 			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
867 	else
868 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates);
869 
870 	ra_info->legacy = cpu_to_le16(supp_rates);
871 
872 	if (sta->deflink.ht_cap.ht_supported)
873 		memcpy(ra_info->rx_mcs_bitmask,
874 		       sta->deflink.ht_cap.mcs.rx_mask,
875 		       HT_MCS_MASK_NUM);
876 
877 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_STATE, sizeof(*state));
878 	state = (struct sta_rec_state *)tlv;
879 	state->state = sta_state;
880 
881 	if (sta->deflink.vht_cap.vht_supported) {
882 		state->vht_opmode = sta->deflink.bandwidth;
883 		state->vht_opmode |= (sta->deflink.rx_nss - 1) <<
884 			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
885 	}
886 }
887 EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_tlv);
888 
889 void mt76_connac_mcu_wtbl_smps_tlv(struct sk_buff *skb,
890 				   struct ieee80211_sta *sta,
891 				   void *sta_wtbl, void *wtbl_tlv)
892 {
893 	struct wtbl_smps *smps;
894 	struct tlv *tlv;
895 
896 	tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
897 					     wtbl_tlv, sta_wtbl);
898 	smps = (struct wtbl_smps *)tlv;
899 	smps->smps = (sta->smps_mode == IEEE80211_SMPS_DYNAMIC);
900 }
901 EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_smps_tlv);
902 
903 void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
904 				 struct ieee80211_sta *sta, void *sta_wtbl,
905 				 void *wtbl_tlv, bool ht_ldpc, bool vht_ldpc)
906 {
907 	struct wtbl_ht *ht = NULL;
908 	struct tlv *tlv;
909 	u32 flags = 0;
910 
911 	if (sta->deflink.ht_cap.ht_supported || sta->deflink.he_6ghz_capa.capa) {
912 		tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
913 						     wtbl_tlv, sta_wtbl);
914 		ht = (struct wtbl_ht *)tlv;
915 		ht->ldpc = ht_ldpc &&
916 			   !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
917 
918 		if (sta->deflink.ht_cap.ht_supported) {
919 			ht->af = sta->deflink.ht_cap.ampdu_factor;
920 			ht->mm = sta->deflink.ht_cap.ampdu_density;
921 		} else {
922 			ht->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
923 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
924 			ht->mm = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
925 					       IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
926 		}
927 
928 		ht->ht = true;
929 	}
930 
931 	if (sta->deflink.vht_cap.vht_supported || sta->deflink.he_6ghz_capa.capa) {
932 		struct wtbl_vht *vht;
933 		u8 af;
934 
935 		tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_VHT,
936 						     sizeof(*vht), wtbl_tlv,
937 						     sta_wtbl);
938 		vht = (struct wtbl_vht *)tlv;
939 		vht->ldpc = vht_ldpc &&
940 			    !!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
941 		vht->vht = true;
942 
943 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
944 			       sta->deflink.vht_cap.cap);
945 		if (ht)
946 			ht->af = max(ht->af, af);
947 	}
948 
949 	mt76_connac_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_tlv);
950 
951 	if (is_connac_v1(dev) && sta->deflink.ht_cap.ht_supported) {
952 		/* sgi */
953 		u32 msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
954 			  MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
955 		struct wtbl_raw *raw;
956 
957 		tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_RAW_DATA,
958 						     sizeof(*raw), wtbl_tlv,
959 						     sta_wtbl);
960 
961 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
962 			flags |= MT_WTBL_W5_SHORT_GI_20;
963 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
964 			flags |= MT_WTBL_W5_SHORT_GI_40;
965 
966 		if (sta->deflink.vht_cap.vht_supported) {
967 			if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
968 				flags |= MT_WTBL_W5_SHORT_GI_80;
969 			if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
970 				flags |= MT_WTBL_W5_SHORT_GI_160;
971 		}
972 		raw = (struct wtbl_raw *)tlv;
973 		raw->val = cpu_to_le32(flags);
974 		raw->msk = cpu_to_le32(~msk);
975 		raw->wtbl_idx = 1;
976 		raw->dw = 5;
977 	}
978 }
979 EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_ht_tlv);
980 
981 int mt76_connac_mcu_sta_cmd(struct mt76_phy *phy,
982 			    struct mt76_sta_cmd_info *info)
983 {
984 	struct mt76_vif *mvif = (struct mt76_vif *)info->vif->drv_priv;
985 	struct mt76_dev *dev = phy->dev;
986 	struct wtbl_req_hdr *wtbl_hdr;
987 	struct tlv *sta_wtbl;
988 	struct sk_buff *skb;
989 
990 	skb = mt76_connac_mcu_alloc_sta_req(dev, mvif, info->wcid);
991 	if (IS_ERR(skb))
992 		return PTR_ERR(skb);
993 
994 	if (info->sta || !info->offload_fw)
995 		mt76_connac_mcu_sta_basic_tlv(skb, info->vif, info->sta,
996 					      info->enable, info->newly);
997 	if (info->sta && info->enable)
998 		mt76_connac_mcu_sta_tlv(phy, skb, info->sta,
999 					info->vif, info->rcpi,
1000 					info->state);
1001 
1002 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1003 					   sizeof(struct tlv));
1004 
1005 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(dev, info->wcid,
1006 						  WTBL_RESET_AND_SET,
1007 						  sta_wtbl, &skb);
1008 	if (IS_ERR(wtbl_hdr))
1009 		return PTR_ERR(wtbl_hdr);
1010 
1011 	if (info->enable) {
1012 		mt76_connac_mcu_wtbl_generic_tlv(dev, skb, info->vif,
1013 						 info->sta, sta_wtbl,
1014 						 wtbl_hdr);
1015 		mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, info->vif, info->wcid,
1016 						   sta_wtbl, wtbl_hdr);
1017 		if (info->sta)
1018 			mt76_connac_mcu_wtbl_ht_tlv(dev, skb, info->sta,
1019 						    sta_wtbl, wtbl_hdr,
1020 						    true, true);
1021 	}
1022 
1023 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
1024 }
1025 EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_cmd);
1026 
1027 void mt76_connac_mcu_wtbl_ba_tlv(struct mt76_dev *dev, struct sk_buff *skb,
1028 				 struct ieee80211_ampdu_params *params,
1029 				 bool enable, bool tx, void *sta_wtbl,
1030 				 void *wtbl_tlv)
1031 {
1032 	struct wtbl_ba *ba;
1033 	struct tlv *tlv;
1034 
1035 	tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_BA, sizeof(*ba),
1036 					     wtbl_tlv, sta_wtbl);
1037 
1038 	ba = (struct wtbl_ba *)tlv;
1039 	ba->tid = params->tid;
1040 
1041 	if (tx) {
1042 		ba->ba_type = MT_BA_TYPE_ORIGINATOR;
1043 		ba->sn = enable ? cpu_to_le16(params->ssn) : 0;
1044 		ba->ba_winsize = enable ? cpu_to_le16(params->buf_size) : 0;
1045 		ba->ba_en = enable;
1046 	} else {
1047 		memcpy(ba->peer_addr, params->sta->addr, ETH_ALEN);
1048 		ba->ba_type = MT_BA_TYPE_RECIPIENT;
1049 		ba->rst_ba_tid = params->tid;
1050 		ba->rst_ba_sel = RST_BA_MAC_TID_MATCH;
1051 		ba->rst_ba_sb = 1;
1052 	}
1053 
1054 	if (!is_connac_v1(dev)) {
1055 		ba->ba_winsize = enable ? cpu_to_le16(params->buf_size) : 0;
1056 		return;
1057 	}
1058 
1059 	if (enable && tx) {
1060 		static const u8 ba_range[] = { 4, 8, 12, 24, 36, 48, 54, 64 };
1061 		int i;
1062 
1063 		for (i = 7; i > 0; i--) {
1064 			if (params->buf_size >= ba_range[i])
1065 				break;
1066 		}
1067 		ba->ba_winsize_idx = i;
1068 	}
1069 }
1070 EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_ba_tlv);
1071 
1072 int mt76_connac_mcu_uni_add_dev(struct mt76_phy *phy,
1073 				struct ieee80211_vif *vif,
1074 				struct mt76_wcid *wcid,
1075 				bool enable)
1076 {
1077 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
1078 	struct mt76_dev *dev = phy->dev;
1079 	struct {
1080 		struct {
1081 			u8 omac_idx;
1082 			u8 band_idx;
1083 			__le16 pad;
1084 		} __packed hdr;
1085 		struct req_tlv {
1086 			__le16 tag;
1087 			__le16 len;
1088 			u8 active;
1089 			u8 pad;
1090 			u8 omac_addr[ETH_ALEN];
1091 		} __packed tlv;
1092 	} dev_req = {
1093 		.hdr = {
1094 			.omac_idx = mvif->omac_idx,
1095 			.band_idx = mvif->band_idx,
1096 		},
1097 		.tlv = {
1098 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
1099 			.len = cpu_to_le16(sizeof(struct req_tlv)),
1100 			.active = enable,
1101 		},
1102 	};
1103 	struct {
1104 		struct {
1105 			u8 bss_idx;
1106 			u8 pad[3];
1107 		} __packed hdr;
1108 		struct mt76_connac_bss_basic_tlv basic;
1109 	} basic_req = {
1110 		.hdr = {
1111 			.bss_idx = mvif->idx,
1112 		},
1113 		.basic = {
1114 			.tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
1115 			.len = cpu_to_le16(sizeof(struct mt76_connac_bss_basic_tlv)),
1116 			.omac_idx = mvif->omac_idx,
1117 			.band_idx = mvif->band_idx,
1118 			.wmm_idx = mvif->wmm_idx,
1119 			.active = enable,
1120 			.bmc_tx_wlan_idx = cpu_to_le16(wcid->idx),
1121 			.sta_idx = cpu_to_le16(wcid->idx),
1122 			.conn_state = 1,
1123 		},
1124 	};
1125 	int err, idx, cmd, len;
1126 	void *data;
1127 
1128 	switch (vif->type) {
1129 	case NL80211_IFTYPE_MESH_POINT:
1130 	case NL80211_IFTYPE_MONITOR:
1131 	case NL80211_IFTYPE_AP:
1132 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
1133 		break;
1134 	case NL80211_IFTYPE_STATION:
1135 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
1136 		break;
1137 	case NL80211_IFTYPE_ADHOC:
1138 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1139 		break;
1140 	default:
1141 		WARN_ON(1);
1142 		break;
1143 	}
1144 
1145 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1146 	basic_req.basic.hw_bss_idx = idx;
1147 
1148 	memcpy(dev_req.tlv.omac_addr, vif->addr, ETH_ALEN);
1149 
1150 	cmd = enable ? MCU_UNI_CMD(DEV_INFO_UPDATE) : MCU_UNI_CMD(BSS_INFO_UPDATE);
1151 	data = enable ? (void *)&dev_req : (void *)&basic_req;
1152 	len = enable ? sizeof(dev_req) : sizeof(basic_req);
1153 
1154 	err = mt76_mcu_send_msg(dev, cmd, data, len, true);
1155 	if (err < 0)
1156 		return err;
1157 
1158 	cmd = enable ? MCU_UNI_CMD(BSS_INFO_UPDATE) : MCU_UNI_CMD(DEV_INFO_UPDATE);
1159 	data = enable ? (void *)&basic_req : (void *)&dev_req;
1160 	len = enable ? sizeof(basic_req) : sizeof(dev_req);
1161 
1162 	return mt76_mcu_send_msg(dev, cmd, data, len, true);
1163 }
1164 EXPORT_SYMBOL_GPL(mt76_connac_mcu_uni_add_dev);
1165 
1166 void mt76_connac_mcu_sta_ba_tlv(struct sk_buff *skb,
1167 				struct ieee80211_ampdu_params *params,
1168 				bool enable, bool tx)
1169 {
1170 	struct sta_rec_ba *ba;
1171 	struct tlv *tlv;
1172 
1173 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BA, sizeof(*ba));
1174 
1175 	ba = (struct sta_rec_ba *)tlv;
1176 	ba->ba_type = tx ? MT_BA_TYPE_ORIGINATOR : MT_BA_TYPE_RECIPIENT;
1177 	ba->winsize = cpu_to_le16(params->buf_size);
1178 	ba->ssn = cpu_to_le16(params->ssn);
1179 	ba->ba_en = enable << params->tid;
1180 	ba->amsdu = params->amsdu;
1181 	ba->tid = params->tid;
1182 }
1183 EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_ba_tlv);
1184 
1185 int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
1186 			   struct ieee80211_ampdu_params *params,
1187 			   int cmd, bool enable, bool tx)
1188 {
1189 	struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv;
1190 	struct wtbl_req_hdr *wtbl_hdr;
1191 	struct tlv *sta_wtbl;
1192 	struct sk_buff *skb;
1193 	int ret;
1194 
1195 	skb = mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid);
1196 	if (IS_ERR(skb))
1197 		return PTR_ERR(skb);
1198 
1199 	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
1200 					   sizeof(struct tlv));
1201 
1202 	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(dev, wcid, WTBL_SET,
1203 						  sta_wtbl, &skb);
1204 	if (IS_ERR(wtbl_hdr))
1205 		return PTR_ERR(wtbl_hdr);
1206 
1207 	mt76_connac_mcu_wtbl_ba_tlv(dev, skb, params, enable, tx, sta_wtbl,
1208 				    wtbl_hdr);
1209 
1210 	ret = mt76_mcu_skb_send_msg(dev, skb, cmd, true);
1211 	if (ret)
1212 		return ret;
1213 
1214 	skb = mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid);
1215 	if (IS_ERR(skb))
1216 		return PTR_ERR(skb);
1217 
1218 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
1219 
1220 	return mt76_mcu_skb_send_msg(dev, skb, cmd, true);
1221 }
1222 EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_ba);
1223 
1224 u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
1225 			    enum nl80211_band band, struct ieee80211_sta *sta)
1226 {
1227 	struct mt76_dev *dev = phy->dev;
1228 	const struct ieee80211_sta_he_cap *he_cap;
1229 	struct ieee80211_sta_vht_cap *vht_cap;
1230 	struct ieee80211_sta_ht_cap *ht_cap;
1231 	u8 mode = 0;
1232 
1233 	if (is_connac_v1(dev))
1234 		return 0x38;
1235 
1236 	if (sta) {
1237 		ht_cap = &sta->deflink.ht_cap;
1238 		vht_cap = &sta->deflink.vht_cap;
1239 		he_cap = &sta->deflink.he_cap;
1240 	} else {
1241 		struct ieee80211_supported_band *sband;
1242 
1243 		sband = phy->hw->wiphy->bands[band];
1244 		ht_cap = &sband->ht_cap;
1245 		vht_cap = &sband->vht_cap;
1246 		he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
1247 	}
1248 
1249 	if (band == NL80211_BAND_2GHZ) {
1250 		mode |= PHY_MODE_B | PHY_MODE_G;
1251 
1252 		if (ht_cap->ht_supported)
1253 			mode |= PHY_MODE_GN;
1254 
1255 		if (he_cap && he_cap->has_he)
1256 			mode |= PHY_MODE_AX_24G;
1257 	} else if (band == NL80211_BAND_5GHZ) {
1258 		mode |= PHY_MODE_A;
1259 
1260 		if (ht_cap->ht_supported)
1261 			mode |= PHY_MODE_AN;
1262 
1263 		if (vht_cap->vht_supported)
1264 			mode |= PHY_MODE_AC;
1265 
1266 		if (he_cap && he_cap->has_he)
1267 			mode |= PHY_MODE_AX_5G;
1268 	} else if (band == NL80211_BAND_6GHZ) {
1269 		mode |= PHY_MODE_A | PHY_MODE_AN |
1270 			PHY_MODE_AC | PHY_MODE_AX_5G;
1271 	}
1272 
1273 	return mode;
1274 }
1275 EXPORT_SYMBOL_GPL(mt76_connac_get_phy_mode);
1276 
1277 const struct ieee80211_sta_he_cap *
1278 mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif)
1279 {
1280 	enum nl80211_band band = phy->chandef.chan->band;
1281 	struct ieee80211_supported_band *sband;
1282 
1283 	sband = phy->hw->wiphy->bands[band];
1284 
1285 	return ieee80211_get_he_iftype_cap(sband, vif->type);
1286 }
1287 EXPORT_SYMBOL_GPL(mt76_connac_get_he_phy_cap);
1288 
1289 #define DEFAULT_HE_PE_DURATION		4
1290 #define DEFAULT_HE_DURATION_RTS_THRES	1023
1291 static void
1292 mt76_connac_mcu_uni_bss_he_tlv(struct mt76_phy *phy, struct ieee80211_vif *vif,
1293 			       struct tlv *tlv)
1294 {
1295 	const struct ieee80211_sta_he_cap *cap;
1296 	struct bss_info_uni_he *he;
1297 
1298 	cap = mt76_connac_get_he_phy_cap(phy, vif);
1299 
1300 	he = (struct bss_info_uni_he *)tlv;
1301 	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
1302 	if (!he->he_pe_duration)
1303 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
1304 
1305 	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
1306 	if (!he->he_rts_thres)
1307 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
1308 
1309 	he->max_nss_mcs[CMD_HE_MCS_BW80] = cap->he_mcs_nss_supp.tx_mcs_80;
1310 	he->max_nss_mcs[CMD_HE_MCS_BW160] = cap->he_mcs_nss_supp.tx_mcs_160;
1311 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
1312 }
1313 
1314 int mt76_connac_mcu_uni_add_bss(struct mt76_phy *phy,
1315 				struct ieee80211_vif *vif,
1316 				struct mt76_wcid *wcid,
1317 				bool enable)
1318 {
1319 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
1320 	struct cfg80211_chan_def *chandef = &phy->chandef;
1321 	int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
1322 	enum nl80211_band band = chandef->chan->band;
1323 	struct mt76_dev *mdev = phy->dev;
1324 	struct {
1325 		struct {
1326 			u8 bss_idx;
1327 			u8 pad[3];
1328 		} __packed hdr;
1329 		struct mt76_connac_bss_basic_tlv basic;
1330 		struct mt76_connac_bss_qos_tlv qos;
1331 	} basic_req = {
1332 		.hdr = {
1333 			.bss_idx = mvif->idx,
1334 		},
1335 		.basic = {
1336 			.tag = cpu_to_le16(UNI_BSS_INFO_BASIC),
1337 			.len = cpu_to_le16(sizeof(struct mt76_connac_bss_basic_tlv)),
1338 			.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
1339 			.dtim_period = vif->bss_conf.dtim_period,
1340 			.omac_idx = mvif->omac_idx,
1341 			.band_idx = mvif->band_idx,
1342 			.wmm_idx = mvif->wmm_idx,
1343 			.active = true, /* keep bss deactivated */
1344 			.phymode = mt76_connac_get_phy_mode(phy, vif, band, NULL),
1345 		},
1346 		.qos = {
1347 			.tag = cpu_to_le16(UNI_BSS_INFO_QBSS),
1348 			.len = cpu_to_le16(sizeof(struct mt76_connac_bss_qos_tlv)),
1349 			.qos = vif->bss_conf.qos,
1350 		},
1351 	};
1352 	struct {
1353 		struct {
1354 			u8 bss_idx;
1355 			u8 pad[3];
1356 		} __packed hdr;
1357 		struct rlm_tlv {
1358 			__le16 tag;
1359 			__le16 len;
1360 			u8 control_channel;
1361 			u8 center_chan;
1362 			u8 center_chan2;
1363 			u8 bw;
1364 			u8 tx_streams;
1365 			u8 rx_streams;
1366 			u8 short_st;
1367 			u8 ht_op_info;
1368 			u8 sco;
1369 			u8 band;
1370 			u8 pad[2];
1371 		} __packed rlm;
1372 	} __packed rlm_req = {
1373 		.hdr = {
1374 			.bss_idx = mvif->idx,
1375 		},
1376 		.rlm = {
1377 			.tag = cpu_to_le16(UNI_BSS_INFO_RLM),
1378 			.len = cpu_to_le16(sizeof(struct rlm_tlv)),
1379 			.control_channel = chandef->chan->hw_value,
1380 			.center_chan = ieee80211_frequency_to_channel(freq1),
1381 			.center_chan2 = ieee80211_frequency_to_channel(freq2),
1382 			.tx_streams = hweight8(phy->antenna_mask),
1383 			.ht_op_info = 4, /* set HT 40M allowed */
1384 			.rx_streams = phy->chainmask,
1385 			.short_st = true,
1386 			.band = band,
1387 		},
1388 	};
1389 	int err, conn_type;
1390 	u8 idx, basic_phy;
1391 
1392 	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
1393 	basic_req.basic.hw_bss_idx = idx;
1394 	if (band == NL80211_BAND_6GHZ)
1395 		basic_req.basic.phymode_ext = PHY_MODE_AX_6G;
1396 
1397 	basic_phy = mt76_connac_get_phy_mode_v2(phy, vif, band, NULL);
1398 	basic_req.basic.nonht_basic_phy = cpu_to_le16(basic_phy);
1399 
1400 	switch (vif->type) {
1401 	case NL80211_IFTYPE_MESH_POINT:
1402 	case NL80211_IFTYPE_AP:
1403 		if (vif->p2p)
1404 			conn_type = CONNECTION_P2P_GO;
1405 		else
1406 			conn_type = CONNECTION_INFRA_AP;
1407 		basic_req.basic.conn_type = cpu_to_le32(conn_type);
1408 		/* Fully active/deactivate BSS network in AP mode only */
1409 		basic_req.basic.active = enable;
1410 		break;
1411 	case NL80211_IFTYPE_STATION:
1412 		if (vif->p2p)
1413 			conn_type = CONNECTION_P2P_GC;
1414 		else
1415 			conn_type = CONNECTION_INFRA_STA;
1416 		basic_req.basic.conn_type = cpu_to_le32(conn_type);
1417 		break;
1418 	case NL80211_IFTYPE_ADHOC:
1419 		basic_req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
1420 		break;
1421 	default:
1422 		WARN_ON(1);
1423 		break;
1424 	}
1425 
1426 	memcpy(basic_req.basic.bssid, vif->bss_conf.bssid, ETH_ALEN);
1427 	basic_req.basic.bmc_tx_wlan_idx = cpu_to_le16(wcid->idx);
1428 	basic_req.basic.sta_idx = cpu_to_le16(wcid->idx);
1429 	basic_req.basic.conn_state = !enable;
1430 
1431 	err = mt76_mcu_send_msg(mdev, MCU_UNI_CMD(BSS_INFO_UPDATE), &basic_req,
1432 				sizeof(basic_req), true);
1433 	if (err < 0)
1434 		return err;
1435 
1436 	if (vif->bss_conf.he_support) {
1437 		struct {
1438 			struct {
1439 				u8 bss_idx;
1440 				u8 pad[3];
1441 			} __packed hdr;
1442 			struct bss_info_uni_he he;
1443 			struct bss_info_uni_bss_color bss_color;
1444 		} he_req = {
1445 			.hdr = {
1446 				.bss_idx = mvif->idx,
1447 			},
1448 			.he = {
1449 				.tag = cpu_to_le16(UNI_BSS_INFO_HE_BASIC),
1450 				.len = cpu_to_le16(sizeof(struct bss_info_uni_he)),
1451 			},
1452 			.bss_color = {
1453 				.tag = cpu_to_le16(UNI_BSS_INFO_BSS_COLOR),
1454 				.len = cpu_to_le16(sizeof(struct bss_info_uni_bss_color)),
1455 				.enable = 0,
1456 				.bss_color = 0,
1457 			},
1458 		};
1459 
1460 		if (enable) {
1461 			he_req.bss_color.enable =
1462 				vif->bss_conf.he_bss_color.enabled;
1463 			he_req.bss_color.bss_color =
1464 				vif->bss_conf.he_bss_color.color;
1465 		}
1466 
1467 		mt76_connac_mcu_uni_bss_he_tlv(phy, vif,
1468 					       (struct tlv *)&he_req.he);
1469 		err = mt76_mcu_send_msg(mdev, MCU_UNI_CMD(BSS_INFO_UPDATE),
1470 					&he_req, sizeof(he_req), true);
1471 		if (err < 0)
1472 			return err;
1473 	}
1474 
1475 	switch (chandef->width) {
1476 	case NL80211_CHAN_WIDTH_40:
1477 		rlm_req.rlm.bw = CMD_CBW_40MHZ;
1478 		break;
1479 	case NL80211_CHAN_WIDTH_80:
1480 		rlm_req.rlm.bw = CMD_CBW_80MHZ;
1481 		break;
1482 	case NL80211_CHAN_WIDTH_80P80:
1483 		rlm_req.rlm.bw = CMD_CBW_8080MHZ;
1484 		break;
1485 	case NL80211_CHAN_WIDTH_160:
1486 		rlm_req.rlm.bw = CMD_CBW_160MHZ;
1487 		break;
1488 	case NL80211_CHAN_WIDTH_5:
1489 		rlm_req.rlm.bw = CMD_CBW_5MHZ;
1490 		break;
1491 	case NL80211_CHAN_WIDTH_10:
1492 		rlm_req.rlm.bw = CMD_CBW_10MHZ;
1493 		break;
1494 	case NL80211_CHAN_WIDTH_20_NOHT:
1495 	case NL80211_CHAN_WIDTH_20:
1496 	default:
1497 		rlm_req.rlm.bw = CMD_CBW_20MHZ;
1498 		rlm_req.rlm.ht_op_info = 0;
1499 		break;
1500 	}
1501 
1502 	if (rlm_req.rlm.control_channel < rlm_req.rlm.center_chan)
1503 		rlm_req.rlm.sco = 1; /* SCA */
1504 	else if (rlm_req.rlm.control_channel > rlm_req.rlm.center_chan)
1505 		rlm_req.rlm.sco = 3; /* SCB */
1506 
1507 	return mt76_mcu_send_msg(mdev, MCU_UNI_CMD(BSS_INFO_UPDATE), &rlm_req,
1508 				 sizeof(rlm_req), true);
1509 }
1510 EXPORT_SYMBOL_GPL(mt76_connac_mcu_uni_add_bss);
1511 
1512 #define MT76_CONNAC_SCAN_CHANNEL_TIME		60
1513 int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
1514 			    struct ieee80211_scan_request *scan_req)
1515 {
1516 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
1517 	struct cfg80211_scan_request *sreq = &scan_req->req;
1518 	int n_ssids = 0, err, i, duration;
1519 	int ext_channels_num = max_t(int, sreq->n_channels - 32, 0);
1520 	struct ieee80211_channel **scan_list = sreq->channels;
1521 	struct mt76_dev *mdev = phy->dev;
1522 	struct mt76_connac_mcu_scan_channel *chan;
1523 	struct mt76_connac_hw_scan_req *req;
1524 	struct sk_buff *skb;
1525 
1526 	skb = mt76_mcu_msg_alloc(mdev, NULL, sizeof(*req));
1527 	if (!skb)
1528 		return -ENOMEM;
1529 
1530 	set_bit(MT76_HW_SCANNING, &phy->state);
1531 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
1532 
1533 	req = (struct mt76_connac_hw_scan_req *)skb_put(skb, sizeof(*req));
1534 
1535 	req->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
1536 	req->bss_idx = mvif->idx;
1537 	req->scan_type = sreq->n_ssids ? 1 : 0;
1538 	req->probe_req_num = sreq->n_ssids ? 2 : 0;
1539 	req->version = 1;
1540 
1541 	for (i = 0; i < sreq->n_ssids; i++) {
1542 		if (!sreq->ssids[i].ssid_len)
1543 			continue;
1544 
1545 		req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
1546 		memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
1547 		       sreq->ssids[i].ssid_len);
1548 		n_ssids++;
1549 	}
1550 	req->ssid_type = n_ssids ? BIT(2) : BIT(0);
1551 	req->ssid_type_ext = n_ssids ? BIT(0) : 0;
1552 	req->ssids_num = n_ssids;
1553 
1554 	duration = is_mt7921(phy->dev) ? 0 : MT76_CONNAC_SCAN_CHANNEL_TIME;
1555 	/* increase channel time for passive scan */
1556 	if (!sreq->n_ssids)
1557 		duration *= 2;
1558 	req->timeout_value = cpu_to_le16(sreq->n_channels * duration);
1559 	req->channel_min_dwell_time = cpu_to_le16(duration);
1560 	req->channel_dwell_time = cpu_to_le16(duration);
1561 
1562 	req->channels_num = min_t(u8, sreq->n_channels, 32);
1563 	req->ext_channels_num = min_t(u8, ext_channels_num, 32);
1564 	for (i = 0; i < req->channels_num + req->ext_channels_num; i++) {
1565 		if (i >= 32)
1566 			chan = &req->ext_channels[i - 32];
1567 		else
1568 			chan = &req->channels[i];
1569 
1570 		switch (scan_list[i]->band) {
1571 		case NL80211_BAND_2GHZ:
1572 			chan->band = 1;
1573 			break;
1574 		case NL80211_BAND_6GHZ:
1575 			chan->band = 3;
1576 			break;
1577 		default:
1578 			chan->band = 2;
1579 			break;
1580 		}
1581 		chan->channel_num = scan_list[i]->hw_value;
1582 	}
1583 	req->channel_type = sreq->n_channels ? 4 : 0;
1584 
1585 	if (sreq->ie_len > 0) {
1586 		memcpy(req->ies, sreq->ie, sreq->ie_len);
1587 		req->ies_len = cpu_to_le16(sreq->ie_len);
1588 	}
1589 
1590 	if (is_mt7921(phy->dev))
1591 		req->scan_func |= SCAN_FUNC_SPLIT_SCAN;
1592 
1593 	memcpy(req->bssid, sreq->bssid, ETH_ALEN);
1594 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
1595 		get_random_mask_addr(req->random_mac, sreq->mac_addr,
1596 				     sreq->mac_addr_mask);
1597 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
1598 	}
1599 
1600 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_CE_CMD(START_HW_SCAN),
1601 				    false);
1602 	if (err < 0)
1603 		clear_bit(MT76_HW_SCANNING, &phy->state);
1604 
1605 	return err;
1606 }
1607 EXPORT_SYMBOL_GPL(mt76_connac_mcu_hw_scan);
1608 
1609 int mt76_connac_mcu_cancel_hw_scan(struct mt76_phy *phy,
1610 				   struct ieee80211_vif *vif)
1611 {
1612 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
1613 	struct {
1614 		u8 seq_num;
1615 		u8 is_ext_channel;
1616 		u8 rsv[2];
1617 	} __packed req = {
1618 		.seq_num = mvif->scan_seq_num,
1619 	};
1620 
1621 	if (test_and_clear_bit(MT76_HW_SCANNING, &phy->state)) {
1622 		struct cfg80211_scan_info info = {
1623 			.aborted = true,
1624 		};
1625 
1626 		ieee80211_scan_completed(phy->hw, &info);
1627 	}
1628 
1629 	return mt76_mcu_send_msg(phy->dev, MCU_CE_CMD(CANCEL_HW_SCAN),
1630 				 &req, sizeof(req), false);
1631 }
1632 EXPORT_SYMBOL_GPL(mt76_connac_mcu_cancel_hw_scan);
1633 
1634 int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
1635 				   struct ieee80211_vif *vif,
1636 				   struct cfg80211_sched_scan_request *sreq)
1637 {
1638 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
1639 	struct ieee80211_channel **scan_list = sreq->channels;
1640 	struct mt76_connac_mcu_scan_channel *chan;
1641 	struct mt76_connac_sched_scan_req *req;
1642 	struct mt76_dev *mdev = phy->dev;
1643 	struct cfg80211_match_set *match;
1644 	struct cfg80211_ssid *ssid;
1645 	struct sk_buff *skb;
1646 	int i;
1647 
1648 	skb = mt76_mcu_msg_alloc(mdev, NULL, sizeof(*req) + sreq->ie_len);
1649 	if (!skb)
1650 		return -ENOMEM;
1651 
1652 	mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
1653 
1654 	req = (struct mt76_connac_sched_scan_req *)skb_put(skb, sizeof(*req));
1655 	req->version = 1;
1656 	req->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
1657 
1658 	if (sreq->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
1659 		u8 *addr = is_mt7663(phy->dev) ? req->mt7663.random_mac
1660 					       : req->mt7921.random_mac;
1661 
1662 		req->scan_func = 1;
1663 		get_random_mask_addr(addr, sreq->mac_addr,
1664 				     sreq->mac_addr_mask);
1665 	}
1666 	if (is_mt7921(phy->dev)) {
1667 		req->mt7921.bss_idx = mvif->idx;
1668 		req->mt7921.delay = cpu_to_le32(sreq->delay);
1669 	}
1670 
1671 	req->ssids_num = sreq->n_ssids;
1672 	for (i = 0; i < req->ssids_num; i++) {
1673 		ssid = &sreq->ssids[i];
1674 		memcpy(req->ssids[i].ssid, ssid->ssid, ssid->ssid_len);
1675 		req->ssids[i].ssid_len = cpu_to_le32(ssid->ssid_len);
1676 	}
1677 
1678 	req->match_num = sreq->n_match_sets;
1679 	for (i = 0; i < req->match_num; i++) {
1680 		match = &sreq->match_sets[i];
1681 		memcpy(req->match[i].ssid, match->ssid.ssid,
1682 		       match->ssid.ssid_len);
1683 		req->match[i].rssi_th = cpu_to_le32(match->rssi_thold);
1684 		req->match[i].ssid_len = match->ssid.ssid_len;
1685 	}
1686 
1687 	req->channel_type = sreq->n_channels ? 4 : 0;
1688 	req->channels_num = min_t(u8, sreq->n_channels, 64);
1689 	for (i = 0; i < req->channels_num; i++) {
1690 		chan = &req->channels[i];
1691 
1692 		switch (scan_list[i]->band) {
1693 		case NL80211_BAND_2GHZ:
1694 			chan->band = 1;
1695 			break;
1696 		case NL80211_BAND_6GHZ:
1697 			chan->band = 3;
1698 			break;
1699 		default:
1700 			chan->band = 2;
1701 			break;
1702 		}
1703 		chan->channel_num = scan_list[i]->hw_value;
1704 	}
1705 
1706 	req->intervals_num = sreq->n_scan_plans;
1707 	for (i = 0; i < req->intervals_num; i++)
1708 		req->intervals[i] = cpu_to_le16(sreq->scan_plans[i].interval);
1709 
1710 	if (sreq->ie_len > 0) {
1711 		req->ie_len = cpu_to_le16(sreq->ie_len);
1712 		memcpy(skb_put(skb, sreq->ie_len), sreq->ie, sreq->ie_len);
1713 	}
1714 
1715 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_CE_CMD(SCHED_SCAN_REQ),
1716 				     false);
1717 }
1718 EXPORT_SYMBOL_GPL(mt76_connac_mcu_sched_scan_req);
1719 
1720 int mt76_connac_mcu_sched_scan_enable(struct mt76_phy *phy,
1721 				      struct ieee80211_vif *vif,
1722 				      bool enable)
1723 {
1724 	struct {
1725 		u8 active; /* 0: enabled 1: disabled */
1726 		u8 rsv[3];
1727 	} __packed req = {
1728 		.active = !enable,
1729 	};
1730 
1731 	if (enable)
1732 		set_bit(MT76_HW_SCHED_SCANNING, &phy->state);
1733 	else
1734 		clear_bit(MT76_HW_SCHED_SCANNING, &phy->state);
1735 
1736 	return mt76_mcu_send_msg(phy->dev, MCU_CE_CMD(SCHED_SCAN_ENABLE),
1737 				 &req, sizeof(req), false);
1738 }
1739 EXPORT_SYMBOL_GPL(mt76_connac_mcu_sched_scan_enable);
1740 
1741 int mt76_connac_mcu_chip_config(struct mt76_dev *dev)
1742 {
1743 	struct mt76_connac_config req = {
1744 		.resp_type = 0,
1745 	};
1746 
1747 	memcpy(req.data, "assert", 7);
1748 
1749 	return mt76_mcu_send_msg(dev, MCU_CE_CMD(CHIP_CONFIG),
1750 				 &req, sizeof(req), false);
1751 }
1752 EXPORT_SYMBOL_GPL(mt76_connac_mcu_chip_config);
1753 
1754 int mt76_connac_mcu_set_deep_sleep(struct mt76_dev *dev, bool enable)
1755 {
1756 	struct mt76_connac_config req = {
1757 		.resp_type = 0,
1758 	};
1759 
1760 	snprintf(req.data, sizeof(req.data), "KeepFullPwr %d", !enable);
1761 
1762 	return mt76_mcu_send_msg(dev, MCU_CE_CMD(CHIP_CONFIG),
1763 				 &req, sizeof(req), false);
1764 }
1765 EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_deep_sleep);
1766 
1767 int mt76_connac_sta_state_dp(struct mt76_dev *dev,
1768 			     enum ieee80211_sta_state old_state,
1769 			     enum ieee80211_sta_state new_state)
1770 {
1771 	if ((old_state == IEEE80211_STA_ASSOC &&
1772 	     new_state == IEEE80211_STA_AUTHORIZED) ||
1773 	    (old_state == IEEE80211_STA_NONE &&
1774 	     new_state == IEEE80211_STA_NOTEXIST))
1775 		mt76_connac_mcu_set_deep_sleep(dev, true);
1776 
1777 	if ((old_state == IEEE80211_STA_NOTEXIST &&
1778 	     new_state == IEEE80211_STA_NONE) ||
1779 	    (old_state == IEEE80211_STA_AUTHORIZED &&
1780 	     new_state == IEEE80211_STA_ASSOC))
1781 		mt76_connac_mcu_set_deep_sleep(dev, false);
1782 
1783 	return 0;
1784 }
1785 EXPORT_SYMBOL_GPL(mt76_connac_sta_state_dp);
1786 
1787 void mt76_connac_mcu_coredump_event(struct mt76_dev *dev, struct sk_buff *skb,
1788 				    struct mt76_connac_coredump *coredump)
1789 {
1790 	spin_lock_bh(&dev->lock);
1791 	__skb_queue_tail(&coredump->msg_list, skb);
1792 	spin_unlock_bh(&dev->lock);
1793 
1794 	coredump->last_activity = jiffies;
1795 
1796 	queue_delayed_work(dev->wq, &coredump->work,
1797 			   MT76_CONNAC_COREDUMP_TIMEOUT);
1798 }
1799 EXPORT_SYMBOL_GPL(mt76_connac_mcu_coredump_event);
1800 
1801 static void mt76_connac_mcu_parse_tx_resource(struct mt76_dev *dev,
1802 					      struct sk_buff *skb)
1803 {
1804 	struct mt76_sdio *sdio = &dev->sdio;
1805 	struct mt76_connac_tx_resource {
1806 		__le32 version;
1807 		__le32 pse_data_quota;
1808 		__le32 pse_mcu_quota;
1809 		__le32 ple_data_quota;
1810 		__le32 ple_mcu_quota;
1811 		__le16 pse_page_size;
1812 		__le16 ple_page_size;
1813 		u8 pp_padding;
1814 		u8 pad[3];
1815 	} __packed * tx_res;
1816 
1817 	tx_res = (struct mt76_connac_tx_resource *)skb->data;
1818 	sdio->sched.pse_data_quota = le32_to_cpu(tx_res->pse_data_quota);
1819 	sdio->sched.pse_mcu_quota = le32_to_cpu(tx_res->pse_mcu_quota);
1820 	sdio->sched.ple_data_quota = le32_to_cpu(tx_res->ple_data_quota);
1821 	sdio->sched.pse_page_size = le16_to_cpu(tx_res->pse_page_size);
1822 	sdio->sched.deficit = tx_res->pp_padding;
1823 }
1824 
1825 static void mt76_connac_mcu_parse_phy_cap(struct mt76_dev *dev,
1826 					  struct sk_buff *skb)
1827 {
1828 	struct mt76_connac_phy_cap {
1829 		u8 ht;
1830 		u8 vht;
1831 		u8 _5g;
1832 		u8 max_bw;
1833 		u8 nss;
1834 		u8 dbdc;
1835 		u8 tx_ldpc;
1836 		u8 rx_ldpc;
1837 		u8 tx_stbc;
1838 		u8 rx_stbc;
1839 		u8 hw_path;
1840 		u8 he;
1841 	} __packed * cap;
1842 
1843 	enum {
1844 		WF0_24G,
1845 		WF0_5G
1846 	};
1847 
1848 	cap = (struct mt76_connac_phy_cap *)skb->data;
1849 
1850 	dev->phy.antenna_mask = BIT(cap->nss) - 1;
1851 	dev->phy.chainmask = dev->phy.antenna_mask;
1852 	dev->phy.cap.has_2ghz = cap->hw_path & BIT(WF0_24G);
1853 	dev->phy.cap.has_5ghz = cap->hw_path & BIT(WF0_5G);
1854 }
1855 
1856 int mt76_connac_mcu_get_nic_capability(struct mt76_phy *phy)
1857 {
1858 	struct mt76_connac_cap_hdr {
1859 		__le16 n_element;
1860 		u8 rsv[2];
1861 	} __packed * hdr;
1862 	struct sk_buff *skb;
1863 	int ret, i;
1864 
1865 	ret = mt76_mcu_send_and_get_msg(phy->dev, MCU_CE_CMD(GET_NIC_CAPAB),
1866 					NULL, 0, true, &skb);
1867 	if (ret)
1868 		return ret;
1869 
1870 	hdr = (struct mt76_connac_cap_hdr *)skb->data;
1871 	if (skb->len < sizeof(*hdr)) {
1872 		ret = -EINVAL;
1873 		goto out;
1874 	}
1875 
1876 	skb_pull(skb, sizeof(*hdr));
1877 
1878 	for (i = 0; i < le16_to_cpu(hdr->n_element); i++) {
1879 		struct tlv_hdr {
1880 			__le32 type;
1881 			__le32 len;
1882 		} __packed * tlv = (struct tlv_hdr *)skb->data;
1883 		int len;
1884 
1885 		if (skb->len < sizeof(*tlv))
1886 			break;
1887 
1888 		skb_pull(skb, sizeof(*tlv));
1889 
1890 		len = le32_to_cpu(tlv->len);
1891 		if (skb->len < len)
1892 			break;
1893 
1894 		switch (le32_to_cpu(tlv->type)) {
1895 		case MT_NIC_CAP_6G:
1896 			phy->cap.has_6ghz = skb->data[0];
1897 			break;
1898 		case MT_NIC_CAP_MAC_ADDR:
1899 			memcpy(phy->macaddr, (void *)skb->data, ETH_ALEN);
1900 			break;
1901 		case MT_NIC_CAP_PHY:
1902 			mt76_connac_mcu_parse_phy_cap(phy->dev, skb);
1903 			break;
1904 		case MT_NIC_CAP_TX_RESOURCE:
1905 			if (mt76_is_sdio(phy->dev))
1906 				mt76_connac_mcu_parse_tx_resource(phy->dev,
1907 								  skb);
1908 			break;
1909 		default:
1910 			break;
1911 		}
1912 		skb_pull(skb, len);
1913 	}
1914 out:
1915 	dev_kfree_skb(skb);
1916 
1917 	return ret;
1918 }
1919 EXPORT_SYMBOL_GPL(mt76_connac_mcu_get_nic_capability);
1920 
1921 static void
1922 mt76_connac_mcu_build_sku(struct mt76_dev *dev, s8 *sku,
1923 			  struct mt76_power_limits *limits,
1924 			  enum nl80211_band band)
1925 {
1926 	int max_power = is_mt7921(dev) ? 127 : 63;
1927 	int i, offset = sizeof(limits->cck);
1928 
1929 	memset(sku, max_power, MT_SKU_POWER_LIMIT);
1930 
1931 	if (band == NL80211_BAND_2GHZ) {
1932 		/* cck */
1933 		memcpy(sku, limits->cck, sizeof(limits->cck));
1934 	}
1935 
1936 	/* ofdm */
1937 	memcpy(&sku[offset], limits->ofdm, sizeof(limits->ofdm));
1938 	offset += sizeof(limits->ofdm);
1939 
1940 	/* ht */
1941 	for (i = 0; i < 2; i++) {
1942 		memcpy(&sku[offset], limits->mcs[i], 8);
1943 		offset += 8;
1944 	}
1945 	sku[offset++] = limits->mcs[0][0];
1946 
1947 	/* vht */
1948 	for (i = 0; i < ARRAY_SIZE(limits->mcs); i++) {
1949 		memcpy(&sku[offset], limits->mcs[i],
1950 		       ARRAY_SIZE(limits->mcs[i]));
1951 		offset += 12;
1952 	}
1953 
1954 	if (!is_mt7921(dev))
1955 		return;
1956 
1957 	/* he */
1958 	for (i = 0; i < ARRAY_SIZE(limits->ru); i++) {
1959 		memcpy(&sku[offset], limits->ru[i], ARRAY_SIZE(limits->ru[i]));
1960 		offset += ARRAY_SIZE(limits->ru[i]);
1961 	}
1962 }
1963 
1964 static s8 mt76_connac_get_ch_power(struct mt76_phy *phy,
1965 				   struct ieee80211_channel *chan,
1966 				   s8 target_power)
1967 {
1968 	struct mt76_dev *dev = phy->dev;
1969 	struct ieee80211_supported_band *sband;
1970 	int i;
1971 
1972 	switch (chan->band) {
1973 	case NL80211_BAND_2GHZ:
1974 		sband = &phy->sband_2g.sband;
1975 		break;
1976 	case NL80211_BAND_5GHZ:
1977 		sband = &phy->sband_5g.sband;
1978 		break;
1979 	case NL80211_BAND_6GHZ:
1980 		sband = &phy->sband_6g.sband;
1981 		break;
1982 	default:
1983 		return target_power;
1984 	}
1985 
1986 	for (i = 0; i < sband->n_channels; i++) {
1987 		struct ieee80211_channel *ch = &sband->channels[i];
1988 
1989 		if (ch->hw_value == chan->hw_value) {
1990 			if (!(ch->flags & IEEE80211_CHAN_DISABLED)) {
1991 				int power = 2 * ch->max_reg_power;
1992 
1993 				if (is_mt7663(dev) && (power > 63 || power < -64))
1994 					power = 63;
1995 				target_power = min_t(s8, power, target_power);
1996 			}
1997 			break;
1998 		}
1999 	}
2000 
2001 	return target_power;
2002 }
2003 
2004 static int
2005 mt76_connac_mcu_rate_txpower_band(struct mt76_phy *phy,
2006 				  enum nl80211_band band)
2007 {
2008 	struct mt76_dev *dev = phy->dev;
2009 	int sku_len, batch_len = is_mt7921(dev) ? 8 : 16;
2010 	static const u8 chan_list_2ghz[] = {
2011 		1, 2,  3,  4,  5,  6,  7,
2012 		8, 9, 10, 11, 12, 13, 14
2013 	};
2014 	static const u8 chan_list_5ghz[] = {
2015 		 36,  38,  40,  42,  44,  46,  48,
2016 		 50,  52,  54,  56,  58,  60,  62,
2017 		 64, 100, 102, 104, 106, 108, 110,
2018 		112, 114, 116, 118, 120, 122, 124,
2019 		126, 128, 132, 134, 136, 138, 140,
2020 		142, 144, 149, 151, 153, 155, 157,
2021 		159, 161, 165
2022 	};
2023 	static const u8 chan_list_6ghz[] = {
2024 		  1,   3,   5,   7,   9,  11,  13,
2025 		 15,  17,  19,  21,  23,  25,  27,
2026 		 29,  33,  35,  37,  39,  41,  43,
2027 		 45,  47,  49,  51,  53,  55,  57,
2028 		 59,  61,  65,  67,  69,  71,  73,
2029 		 75,  77,  79,  81,  83,  85,  87,
2030 		 89,  91,  93,  97,  99, 101, 103,
2031 		105, 107, 109, 111, 113, 115, 117,
2032 		119, 121, 123, 125, 129, 131, 133,
2033 		135, 137, 139, 141, 143, 145, 147,
2034 		149, 151, 153, 155, 157, 161, 163,
2035 		165, 167, 169, 171, 173, 175, 177,
2036 		179, 181, 183, 185, 187, 189, 193,
2037 		195, 197, 199, 201, 203, 205, 207,
2038 		209, 211, 213, 215, 217, 219, 221,
2039 		225, 227, 229, 233
2040 	};
2041 	int i, n_chan, batch_size, idx = 0, tx_power, last_ch;
2042 	struct mt76_connac_sku_tlv sku_tlbv;
2043 	struct mt76_power_limits limits;
2044 	const u8 *ch_list;
2045 
2046 	sku_len = is_mt7921(dev) ? sizeof(sku_tlbv) : sizeof(sku_tlbv) - 92;
2047 	tx_power = 2 * phy->hw->conf.power_level;
2048 	if (!tx_power)
2049 		tx_power = 127;
2050 
2051 	if (band == NL80211_BAND_2GHZ) {
2052 		n_chan = ARRAY_SIZE(chan_list_2ghz);
2053 		ch_list = chan_list_2ghz;
2054 	} else if (band == NL80211_BAND_6GHZ) {
2055 		n_chan = ARRAY_SIZE(chan_list_6ghz);
2056 		ch_list = chan_list_6ghz;
2057 	} else {
2058 		n_chan = ARRAY_SIZE(chan_list_5ghz);
2059 		ch_list = chan_list_5ghz;
2060 	}
2061 	batch_size = DIV_ROUND_UP(n_chan, batch_len);
2062 
2063 	if (phy->cap.has_6ghz)
2064 		last_ch = chan_list_6ghz[ARRAY_SIZE(chan_list_6ghz) - 1];
2065 	else if (phy->cap.has_5ghz)
2066 		last_ch = chan_list_5ghz[ARRAY_SIZE(chan_list_5ghz) - 1];
2067 	else
2068 		last_ch = chan_list_2ghz[ARRAY_SIZE(chan_list_2ghz) - 1];
2069 
2070 	for (i = 0; i < batch_size; i++) {
2071 		struct mt76_connac_tx_power_limit_tlv tx_power_tlv = {};
2072 		int j, err, msg_len, num_ch;
2073 		struct sk_buff *skb;
2074 
2075 		num_ch = i == batch_size - 1 ? n_chan % batch_len : batch_len;
2076 		msg_len = sizeof(tx_power_tlv) + num_ch * sizeof(sku_tlbv);
2077 		skb = mt76_mcu_msg_alloc(dev, NULL, msg_len);
2078 		if (!skb)
2079 			return -ENOMEM;
2080 
2081 		skb_reserve(skb, sizeof(tx_power_tlv));
2082 
2083 		BUILD_BUG_ON(sizeof(dev->alpha2) > sizeof(tx_power_tlv.alpha2));
2084 		memcpy(tx_power_tlv.alpha2, dev->alpha2, sizeof(dev->alpha2));
2085 		tx_power_tlv.n_chan = num_ch;
2086 
2087 		switch (band) {
2088 		case NL80211_BAND_2GHZ:
2089 			tx_power_tlv.band = 1;
2090 			break;
2091 		case NL80211_BAND_6GHZ:
2092 			tx_power_tlv.band = 3;
2093 			break;
2094 		default:
2095 			tx_power_tlv.band = 2;
2096 			break;
2097 		}
2098 
2099 		for (j = 0; j < num_ch; j++, idx++) {
2100 			struct ieee80211_channel chan = {
2101 				.hw_value = ch_list[idx],
2102 				.band = band,
2103 			};
2104 			s8 reg_power, sar_power;
2105 
2106 			reg_power = mt76_connac_get_ch_power(phy, &chan,
2107 							     tx_power);
2108 			sar_power = mt76_get_sar_power(phy, &chan, reg_power);
2109 
2110 			mt76_get_rate_power_limits(phy, &chan, &limits,
2111 						   sar_power);
2112 
2113 			tx_power_tlv.last_msg = ch_list[idx] == last_ch;
2114 			sku_tlbv.channel = ch_list[idx];
2115 
2116 			mt76_connac_mcu_build_sku(dev, sku_tlbv.pwr_limit,
2117 						  &limits, band);
2118 			skb_put_data(skb, &sku_tlbv, sku_len);
2119 		}
2120 		__skb_push(skb, sizeof(tx_power_tlv));
2121 		memcpy(skb->data, &tx_power_tlv, sizeof(tx_power_tlv));
2122 
2123 		err = mt76_mcu_skb_send_msg(dev, skb,
2124 					    MCU_CE_CMD(SET_RATE_TX_POWER),
2125 					    false);
2126 		if (err < 0)
2127 			return err;
2128 	}
2129 
2130 	return 0;
2131 }
2132 
2133 int mt76_connac_mcu_set_rate_txpower(struct mt76_phy *phy)
2134 {
2135 	int err;
2136 
2137 	if (phy->cap.has_2ghz) {
2138 		err = mt76_connac_mcu_rate_txpower_band(phy,
2139 							NL80211_BAND_2GHZ);
2140 		if (err < 0)
2141 			return err;
2142 	}
2143 	if (phy->cap.has_5ghz) {
2144 		err = mt76_connac_mcu_rate_txpower_band(phy,
2145 							NL80211_BAND_5GHZ);
2146 		if (err < 0)
2147 			return err;
2148 	}
2149 	if (phy->cap.has_6ghz) {
2150 		err = mt76_connac_mcu_rate_txpower_band(phy,
2151 							NL80211_BAND_6GHZ);
2152 		if (err < 0)
2153 			return err;
2154 	}
2155 
2156 	return 0;
2157 }
2158 EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_rate_txpower);
2159 
2160 int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
2161 				      struct mt76_vif *vif,
2162 				      struct ieee80211_bss_conf *info)
2163 {
2164 	struct ieee80211_vif *mvif = container_of(info, struct ieee80211_vif,
2165 						  bss_conf);
2166 	struct sk_buff *skb;
2167 	int i, len = min_t(int, mvif->cfg.arp_addr_cnt,
2168 			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
2169 	struct {
2170 		struct {
2171 			u8 bss_idx;
2172 			u8 pad[3];
2173 		} __packed hdr;
2174 		struct mt76_connac_arpns_tlv arp;
2175 	} req_hdr = {
2176 		.hdr = {
2177 			.bss_idx = vif->idx,
2178 		},
2179 		.arp = {
2180 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
2181 			.len = cpu_to_le16(sizeof(struct mt76_connac_arpns_tlv)),
2182 			.ips_num = len,
2183 			.mode = 2,  /* update */
2184 			.option = 1,
2185 		},
2186 	};
2187 
2188 	skb = mt76_mcu_msg_alloc(dev, NULL,
2189 				 sizeof(req_hdr) + len * sizeof(__be32));
2190 	if (!skb)
2191 		return -ENOMEM;
2192 
2193 	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
2194 	for (i = 0; i < len; i++)
2195 		skb_put_data(skb, &mvif->cfg.arp_addr_list[i], sizeof(__be32));
2196 
2197 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
2198 }
2199 EXPORT_SYMBOL_GPL(mt76_connac_mcu_update_arp_filter);
2200 
2201 int mt76_connac_mcu_set_p2p_oppps(struct ieee80211_hw *hw,
2202 				  struct ieee80211_vif *vif)
2203 {
2204 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2205 	int ct_window = vif->bss_conf.p2p_noa_attr.oppps_ctwindow;
2206 	struct mt76_phy *phy = hw->priv;
2207 	struct {
2208 		__le32 ct_win;
2209 		u8 bss_idx;
2210 		u8 rsv[3];
2211 	} __packed req = {
2212 		.ct_win = cpu_to_le32(ct_window),
2213 		.bss_idx = mvif->idx,
2214 	};
2215 
2216 	return mt76_mcu_send_msg(phy->dev, MCU_CE_CMD(SET_P2P_OPPPS),
2217 				 &req, sizeof(req), false);
2218 }
2219 EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_p2p_oppps);
2220 
2221 #ifdef CONFIG_PM
2222 
2223 const struct wiphy_wowlan_support mt76_connac_wowlan_support = {
2224 	.flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT |
2225 		 WIPHY_WOWLAN_SUPPORTS_GTK_REKEY | WIPHY_WOWLAN_NET_DETECT,
2226 	.n_patterns = 1,
2227 	.pattern_min_len = 1,
2228 	.pattern_max_len = MT76_CONNAC_WOW_PATTEN_MAX_LEN,
2229 	.max_nd_match_sets = 10,
2230 };
2231 EXPORT_SYMBOL_GPL(mt76_connac_wowlan_support);
2232 
2233 static void
2234 mt76_connac_mcu_key_iter(struct ieee80211_hw *hw,
2235 			 struct ieee80211_vif *vif,
2236 			 struct ieee80211_sta *sta,
2237 			 struct ieee80211_key_conf *key,
2238 			 void *data)
2239 {
2240 	struct mt76_connac_gtk_rekey_tlv *gtk_tlv = data;
2241 	u32 cipher;
2242 
2243 	if (key->cipher != WLAN_CIPHER_SUITE_AES_CMAC &&
2244 	    key->cipher != WLAN_CIPHER_SUITE_CCMP &&
2245 	    key->cipher != WLAN_CIPHER_SUITE_TKIP)
2246 		return;
2247 
2248 	if (key->cipher == WLAN_CIPHER_SUITE_TKIP)
2249 		cipher = BIT(3);
2250 	else
2251 		cipher = BIT(4);
2252 
2253 	/* we are assuming here to have a single pairwise key */
2254 	if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
2255 		if (key->cipher == WLAN_CIPHER_SUITE_TKIP)
2256 			gtk_tlv->proto = cpu_to_le32(NL80211_WPA_VERSION_1);
2257 		else
2258 			gtk_tlv->proto = cpu_to_le32(NL80211_WPA_VERSION_2);
2259 
2260 		gtk_tlv->pairwise_cipher = cpu_to_le32(cipher);
2261 		gtk_tlv->keyid = key->keyidx;
2262 	} else {
2263 		gtk_tlv->group_cipher = cpu_to_le32(cipher);
2264 	}
2265 }
2266 
2267 int mt76_connac_mcu_update_gtk_rekey(struct ieee80211_hw *hw,
2268 				     struct ieee80211_vif *vif,
2269 				     struct cfg80211_gtk_rekey_data *key)
2270 {
2271 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2272 	struct mt76_connac_gtk_rekey_tlv *gtk_tlv;
2273 	struct mt76_phy *phy = hw->priv;
2274 	struct sk_buff *skb;
2275 	struct {
2276 		u8 bss_idx;
2277 		u8 pad[3];
2278 	} __packed hdr = {
2279 		.bss_idx = mvif->idx,
2280 	};
2281 
2282 	skb = mt76_mcu_msg_alloc(phy->dev, NULL,
2283 				 sizeof(hdr) + sizeof(*gtk_tlv));
2284 	if (!skb)
2285 		return -ENOMEM;
2286 
2287 	skb_put_data(skb, &hdr, sizeof(hdr));
2288 	gtk_tlv = (struct mt76_connac_gtk_rekey_tlv *)skb_put(skb,
2289 							 sizeof(*gtk_tlv));
2290 	gtk_tlv->tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY);
2291 	gtk_tlv->len = cpu_to_le16(sizeof(*gtk_tlv));
2292 	gtk_tlv->rekey_mode = 2;
2293 	gtk_tlv->option = 1;
2294 
2295 	rcu_read_lock();
2296 	ieee80211_iter_keys_rcu(hw, vif, mt76_connac_mcu_key_iter, gtk_tlv);
2297 	rcu_read_unlock();
2298 
2299 	memcpy(gtk_tlv->kek, key->kek, NL80211_KEK_LEN);
2300 	memcpy(gtk_tlv->kck, key->kck, NL80211_KCK_LEN);
2301 	memcpy(gtk_tlv->replay_ctr, key->replay_ctr, NL80211_REPLAY_CTR_LEN);
2302 
2303 	return mt76_mcu_skb_send_msg(phy->dev, skb,
2304 				     MCU_UNI_CMD(OFFLOAD), true);
2305 }
2306 EXPORT_SYMBOL_GPL(mt76_connac_mcu_update_gtk_rekey);
2307 
2308 static int
2309 mt76_connac_mcu_set_arp_filter(struct mt76_dev *dev, struct ieee80211_vif *vif,
2310 			       bool suspend)
2311 {
2312 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2313 	struct {
2314 		struct {
2315 			u8 bss_idx;
2316 			u8 pad[3];
2317 		} __packed hdr;
2318 		struct mt76_connac_arpns_tlv arpns;
2319 	} req = {
2320 		.hdr = {
2321 			.bss_idx = mvif->idx,
2322 		},
2323 		.arpns = {
2324 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_ARP),
2325 			.len = cpu_to_le16(sizeof(struct mt76_connac_arpns_tlv)),
2326 			.mode = suspend,
2327 		},
2328 	};
2329 
2330 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(OFFLOAD), &req,
2331 				 sizeof(req), true);
2332 }
2333 
2334 static int
2335 mt76_connac_mcu_set_gtk_rekey(struct mt76_dev *dev, struct ieee80211_vif *vif,
2336 			      bool suspend)
2337 {
2338 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2339 	struct {
2340 		struct {
2341 			u8 bss_idx;
2342 			u8 pad[3];
2343 		} __packed hdr;
2344 		struct mt76_connac_gtk_rekey_tlv gtk_tlv;
2345 	} __packed req = {
2346 		.hdr = {
2347 			.bss_idx = mvif->idx,
2348 		},
2349 		.gtk_tlv = {
2350 			.tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY),
2351 			.len = cpu_to_le16(sizeof(struct mt76_connac_gtk_rekey_tlv)),
2352 			.rekey_mode = !suspend,
2353 		},
2354 	};
2355 
2356 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(OFFLOAD), &req,
2357 				 sizeof(req), true);
2358 }
2359 
2360 static int
2361 mt76_connac_mcu_set_suspend_mode(struct mt76_dev *dev,
2362 				 struct ieee80211_vif *vif,
2363 				 bool enable, u8 mdtim,
2364 				 bool wow_suspend)
2365 {
2366 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2367 	struct {
2368 		struct {
2369 			u8 bss_idx;
2370 			u8 pad[3];
2371 		} __packed hdr;
2372 		struct mt76_connac_suspend_tlv suspend_tlv;
2373 	} req = {
2374 		.hdr = {
2375 			.bss_idx = mvif->idx,
2376 		},
2377 		.suspend_tlv = {
2378 			.tag = cpu_to_le16(UNI_SUSPEND_MODE_SETTING),
2379 			.len = cpu_to_le16(sizeof(struct mt76_connac_suspend_tlv)),
2380 			.enable = enable,
2381 			.mdtim = mdtim,
2382 			.wow_suspend = wow_suspend,
2383 		},
2384 	};
2385 
2386 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(SUSPEND), &req,
2387 				 sizeof(req), true);
2388 }
2389 
2390 static int
2391 mt76_connac_mcu_set_wow_pattern(struct mt76_dev *dev,
2392 				struct ieee80211_vif *vif,
2393 				u8 index, bool enable,
2394 				struct cfg80211_pkt_pattern *pattern)
2395 {
2396 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2397 	struct mt76_connac_wow_pattern_tlv *ptlv;
2398 	struct sk_buff *skb;
2399 	struct req_hdr {
2400 		u8 bss_idx;
2401 		u8 pad[3];
2402 	} __packed hdr = {
2403 		.bss_idx = mvif->idx,
2404 	};
2405 
2406 	skb = mt76_mcu_msg_alloc(dev, NULL, sizeof(hdr) + sizeof(*ptlv));
2407 	if (!skb)
2408 		return -ENOMEM;
2409 
2410 	skb_put_data(skb, &hdr, sizeof(hdr));
2411 	ptlv = (struct mt76_connac_wow_pattern_tlv *)skb_put(skb, sizeof(*ptlv));
2412 	ptlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
2413 	ptlv->len = cpu_to_le16(sizeof(*ptlv));
2414 	ptlv->data_len = pattern->pattern_len;
2415 	ptlv->enable = enable;
2416 	ptlv->index = index;
2417 
2418 	memcpy(ptlv->pattern, pattern->pattern, pattern->pattern_len);
2419 	memcpy(ptlv->mask, pattern->mask, DIV_ROUND_UP(pattern->pattern_len, 8));
2420 
2421 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(SUSPEND), true);
2422 }
2423 
2424 static int
2425 mt76_connac_mcu_set_wow_ctrl(struct mt76_phy *phy, struct ieee80211_vif *vif,
2426 			     bool suspend, struct cfg80211_wowlan *wowlan)
2427 {
2428 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2429 	struct mt76_dev *dev = phy->dev;
2430 	struct {
2431 		struct {
2432 			u8 bss_idx;
2433 			u8 pad[3];
2434 		} __packed hdr;
2435 		struct mt76_connac_wow_ctrl_tlv wow_ctrl_tlv;
2436 		struct mt76_connac_wow_gpio_param_tlv gpio_tlv;
2437 	} req = {
2438 		.hdr = {
2439 			.bss_idx = mvif->idx,
2440 		},
2441 		.wow_ctrl_tlv = {
2442 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_CTRL),
2443 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_ctrl_tlv)),
2444 			.cmd = suspend ? 1 : 2,
2445 		},
2446 		.gpio_tlv = {
2447 			.tag = cpu_to_le16(UNI_SUSPEND_WOW_GPIO_PARAM),
2448 			.len = cpu_to_le16(sizeof(struct mt76_connac_wow_gpio_param_tlv)),
2449 			.gpio_pin = 0xff, /* follow fw about GPIO pin */
2450 		},
2451 	};
2452 
2453 	if (wowlan->magic_pkt)
2454 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_MAGIC;
2455 	if (wowlan->disconnect)
2456 		req.wow_ctrl_tlv.trigger |= (UNI_WOW_DETECT_TYPE_DISCONNECT |
2457 					     UNI_WOW_DETECT_TYPE_BCN_LOST);
2458 	if (wowlan->nd_config) {
2459 		mt76_connac_mcu_sched_scan_req(phy, vif, wowlan->nd_config);
2460 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_SCH_SCAN_HIT;
2461 		mt76_connac_mcu_sched_scan_enable(phy, vif, suspend);
2462 	}
2463 	if (wowlan->n_patterns)
2464 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_BITMAP;
2465 
2466 	if (mt76_is_mmio(dev))
2467 		req.wow_ctrl_tlv.wakeup_hif = WOW_PCIE;
2468 	else if (mt76_is_usb(dev))
2469 		req.wow_ctrl_tlv.wakeup_hif = WOW_USB;
2470 	else if (mt76_is_sdio(dev))
2471 		req.wow_ctrl_tlv.wakeup_hif = WOW_GPIO;
2472 
2473 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(SUSPEND), &req,
2474 				 sizeof(req), true);
2475 }
2476 
2477 int mt76_connac_mcu_set_hif_suspend(struct mt76_dev *dev, bool suspend)
2478 {
2479 	struct {
2480 		struct {
2481 			u8 hif_type; /* 0x0: HIF_SDIO
2482 				      * 0x1: HIF_USB
2483 				      * 0x2: HIF_PCIE
2484 				      */
2485 			u8 pad[3];
2486 		} __packed hdr;
2487 		struct hif_suspend_tlv {
2488 			__le16 tag;
2489 			__le16 len;
2490 			u8 suspend;
2491 		} __packed hif_suspend;
2492 	} req = {
2493 		.hif_suspend = {
2494 			.tag = cpu_to_le16(0), /* 0: UNI_HIF_CTRL_BASIC */
2495 			.len = cpu_to_le16(sizeof(struct hif_suspend_tlv)),
2496 			.suspend = suspend,
2497 		},
2498 	};
2499 
2500 	if (mt76_is_mmio(dev))
2501 		req.hdr.hif_type = 2;
2502 	else if (mt76_is_usb(dev))
2503 		req.hdr.hif_type = 1;
2504 	else if (mt76_is_sdio(dev))
2505 		req.hdr.hif_type = 0;
2506 
2507 	return mt76_mcu_send_msg(dev, MCU_UNI_CMD(HIF_CTRL), &req,
2508 				 sizeof(req), true);
2509 }
2510 EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_hif_suspend);
2511 
2512 void mt76_connac_mcu_set_suspend_iter(void *priv, u8 *mac,
2513 				      struct ieee80211_vif *vif)
2514 {
2515 	struct mt76_phy *phy = priv;
2516 	bool suspend = !test_bit(MT76_STATE_RUNNING, &phy->state);
2517 	struct ieee80211_hw *hw = phy->hw;
2518 	struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config;
2519 	int i;
2520 
2521 	mt76_connac_mcu_set_gtk_rekey(phy->dev, vif, suspend);
2522 	mt76_connac_mcu_set_arp_filter(phy->dev, vif, suspend);
2523 
2524 	mt76_connac_mcu_set_suspend_mode(phy->dev, vif, suspend, 1, true);
2525 
2526 	for (i = 0; i < wowlan->n_patterns; i++)
2527 		mt76_connac_mcu_set_wow_pattern(phy->dev, vif, i, suspend,
2528 						&wowlan->patterns[i]);
2529 	mt76_connac_mcu_set_wow_ctrl(phy, vif, suspend, wowlan);
2530 }
2531 EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_suspend_iter);
2532 #endif /* CONFIG_PM */
2533 
2534 u32 mt76_connac_mcu_reg_rr(struct mt76_dev *dev, u32 offset)
2535 {
2536 	struct {
2537 		__le32 addr;
2538 		__le32 val;
2539 	} __packed req = {
2540 		.addr = cpu_to_le32(offset),
2541 	};
2542 
2543 	return mt76_mcu_send_msg(dev, MCU_CE_QUERY(REG_READ), &req,
2544 				 sizeof(req), true);
2545 }
2546 EXPORT_SYMBOL_GPL(mt76_connac_mcu_reg_rr);
2547 
2548 void mt76_connac_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val)
2549 {
2550 	struct {
2551 		__le32 addr;
2552 		__le32 val;
2553 	} __packed req = {
2554 		.addr = cpu_to_le32(offset),
2555 		.val = cpu_to_le32(val),
2556 	};
2557 
2558 	mt76_mcu_send_msg(dev, MCU_CE_CMD(REG_WRITE), &req,
2559 			  sizeof(req), false);
2560 }
2561 EXPORT_SYMBOL_GPL(mt76_connac_mcu_reg_wr);
2562 
2563 static int
2564 mt76_connac_mcu_sta_key_tlv(struct mt76_connac_sta_key_conf *sta_key_conf,
2565 			    struct sk_buff *skb,
2566 			    struct ieee80211_key_conf *key,
2567 			    enum set_key_cmd cmd)
2568 {
2569 	struct sta_rec_sec *sec;
2570 	u32 len = sizeof(*sec);
2571 	struct tlv *tlv;
2572 
2573 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
2574 	sec = (struct sta_rec_sec *)tlv;
2575 	sec->add = cmd;
2576 
2577 	if (cmd == SET_KEY) {
2578 		struct sec_key *sec_key;
2579 		u8 cipher;
2580 
2581 		cipher = mt76_connac_mcu_get_cipher(key->cipher);
2582 		if (cipher == MCU_CIPHER_NONE)
2583 			return -EOPNOTSUPP;
2584 
2585 		sec_key = &sec->key[0];
2586 		sec_key->cipher_len = sizeof(*sec_key);
2587 
2588 		if (cipher == MCU_CIPHER_BIP_CMAC_128) {
2589 			sec_key->cipher_id = MCU_CIPHER_AES_CCMP;
2590 			sec_key->key_id = sta_key_conf->keyidx;
2591 			sec_key->key_len = 16;
2592 			memcpy(sec_key->key, sta_key_conf->key, 16);
2593 
2594 			sec_key = &sec->key[1];
2595 			sec_key->cipher_id = MCU_CIPHER_BIP_CMAC_128;
2596 			sec_key->cipher_len = sizeof(*sec_key);
2597 			sec_key->key_len = 16;
2598 			memcpy(sec_key->key, key->key, 16);
2599 			sec->n_cipher = 2;
2600 		} else {
2601 			sec_key->cipher_id = cipher;
2602 			sec_key->key_id = key->keyidx;
2603 			sec_key->key_len = key->keylen;
2604 			memcpy(sec_key->key, key->key, key->keylen);
2605 
2606 			if (cipher == MCU_CIPHER_TKIP) {
2607 				/* Rx/Tx MIC keys are swapped */
2608 				memcpy(sec_key->key + 16, key->key + 24, 8);
2609 				memcpy(sec_key->key + 24, key->key + 16, 8);
2610 			}
2611 
2612 			/* store key_conf for BIP batch update */
2613 			if (cipher == MCU_CIPHER_AES_CCMP) {
2614 				memcpy(sta_key_conf->key, key->key, key->keylen);
2615 				sta_key_conf->keyidx = key->keyidx;
2616 			}
2617 
2618 			len -= sizeof(*sec_key);
2619 			sec->n_cipher = 1;
2620 		}
2621 	} else {
2622 		len -= sizeof(sec->key);
2623 		sec->n_cipher = 0;
2624 	}
2625 	sec->len = cpu_to_le16(len);
2626 
2627 	return 0;
2628 }
2629 
2630 int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
2631 			    struct mt76_connac_sta_key_conf *sta_key_conf,
2632 			    struct ieee80211_key_conf *key, int mcu_cmd,
2633 			    struct mt76_wcid *wcid, enum set_key_cmd cmd)
2634 {
2635 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2636 	struct sk_buff *skb;
2637 	int ret;
2638 
2639 	skb = mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid);
2640 	if (IS_ERR(skb))
2641 		return PTR_ERR(skb);
2642 
2643 	ret = mt76_connac_mcu_sta_key_tlv(sta_key_conf, skb, key, cmd);
2644 	if (ret)
2645 		return ret;
2646 
2647 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
2648 }
2649 EXPORT_SYMBOL_GPL(mt76_connac_mcu_add_key);
2650 
2651 /* SIFS 20us + 512 byte beacon tranmitted by 1Mbps (3906us) */
2652 #define BCN_TX_ESTIMATE_TIME (4096 + 20)
2653 void mt76_connac_mcu_bss_ext_tlv(struct sk_buff *skb, struct mt76_vif *mvif)
2654 {
2655 	struct bss_info_ext_bss *ext;
2656 	int ext_bss_idx, tsf_offset;
2657 	struct tlv *tlv;
2658 
2659 	ext_bss_idx = mvif->omac_idx - EXT_BSSID_START;
2660 	if (ext_bss_idx < 0)
2661 		return;
2662 
2663 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_EXT_BSS, sizeof(*ext));
2664 
2665 	ext = (struct bss_info_ext_bss *)tlv;
2666 	tsf_offset = ext_bss_idx * BCN_TX_ESTIMATE_TIME;
2667 	ext->mbss_tsf_offset = cpu_to_le32(tsf_offset);
2668 }
2669 EXPORT_SYMBOL_GPL(mt76_connac_mcu_bss_ext_tlv);
2670 
2671 int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
2672 				  struct ieee80211_vif *vif,
2673 				  struct ieee80211_sta *sta,
2674 				  struct mt76_phy *phy, u16 wlan_idx,
2675 				  bool enable)
2676 {
2677 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
2678 	u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
2679 	struct bss_info_basic *bss;
2680 	struct tlv *tlv;
2681 
2682 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
2683 	bss = (struct bss_info_basic *)tlv;
2684 
2685 	switch (vif->type) {
2686 	case NL80211_IFTYPE_MESH_POINT:
2687 	case NL80211_IFTYPE_MONITOR:
2688 		break;
2689 	case NL80211_IFTYPE_AP:
2690 		if (ieee80211_hw_check(phy->hw, SUPPORTS_MULTI_BSSID)) {
2691 			u8 bssid_id = vif->bss_conf.bssid_indicator;
2692 			struct wiphy *wiphy = phy->hw->wiphy;
2693 
2694 			if (bssid_id > ilog2(wiphy->mbssid_max_interfaces))
2695 				return -EINVAL;
2696 
2697 			bss->non_tx_bssid = vif->bss_conf.bssid_index;
2698 			bss->max_bssid = bssid_id;
2699 		}
2700 		break;
2701 	case NL80211_IFTYPE_STATION:
2702 		if (enable) {
2703 			rcu_read_lock();
2704 			if (!sta)
2705 				sta = ieee80211_find_sta(vif,
2706 							 vif->bss_conf.bssid);
2707 			/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
2708 			if (sta) {
2709 				struct mt76_wcid *wcid;
2710 
2711 				wcid = (struct mt76_wcid *)sta->drv_priv;
2712 				wlan_idx = wcid->idx;
2713 			}
2714 			rcu_read_unlock();
2715 		}
2716 		break;
2717 	case NL80211_IFTYPE_ADHOC:
2718 		type = NETWORK_IBSS;
2719 		break;
2720 	default:
2721 		WARN_ON(1);
2722 		break;
2723 	}
2724 
2725 	bss->network_type = cpu_to_le32(type);
2726 	bss->bmc_wcid_lo = to_wcid_lo(wlan_idx);
2727 	bss->bmc_wcid_hi = to_wcid_hi(wlan_idx);
2728 	bss->wmm_idx = mvif->wmm_idx;
2729 	bss->active = enable;
2730 	bss->cipher = mvif->cipher;
2731 
2732 	if (vif->type != NL80211_IFTYPE_MONITOR) {
2733 		struct cfg80211_chan_def *chandef = &phy->chandef;
2734 
2735 		memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
2736 		bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
2737 		bss->dtim_period = vif->bss_conf.dtim_period;
2738 		bss->phy_mode = mt76_connac_get_phy_mode(phy, vif,
2739 							 chandef->chan->band, NULL);
2740 	} else {
2741 		memcpy(bss->bssid, phy->macaddr, ETH_ALEN);
2742 	}
2743 
2744 	return 0;
2745 }
2746 EXPORT_SYMBOL_GPL(mt76_connac_mcu_bss_basic_tlv);
2747 
2748 #define ENTER_PM_STATE		1
2749 #define EXIT_PM_STATE		2
2750 int mt76_connac_mcu_set_pm(struct mt76_dev *dev, int band, int enter)
2751 {
2752 	struct {
2753 		u8 pm_number;
2754 		u8 pm_state;
2755 		u8 bssid[ETH_ALEN];
2756 		u8 dtim_period;
2757 		u8 wlan_idx_lo;
2758 		__le16 bcn_interval;
2759 		__le32 aid;
2760 		__le32 rx_filter;
2761 		u8 band_idx;
2762 		u8 wlan_idx_hi;
2763 		u8 rsv[2];
2764 		__le32 feature;
2765 		u8 omac_idx;
2766 		u8 wmm_idx;
2767 		u8 bcn_loss_cnt;
2768 		u8 bcn_sp_duration;
2769 	} __packed req = {
2770 		.pm_number = 5,
2771 		.pm_state = enter ? ENTER_PM_STATE : EXIT_PM_STATE,
2772 		.band_idx = band,
2773 	};
2774 
2775 	return mt76_mcu_send_msg(dev, MCU_EXT_CMD(PM_STATE_CTRL), &req,
2776 				 sizeof(req), true);
2777 }
2778 EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_pm);
2779 
2780 int mt76_connac_mcu_restart(struct mt76_dev *dev)
2781 {
2782 	struct {
2783 		u8 power_mode;
2784 		u8 rsv[3];
2785 	} req = {
2786 		.power_mode = 1,
2787 	};
2788 
2789 	return mt76_mcu_send_msg(dev, MCU_CMD(NIC_POWER_CTRL), &req,
2790 				 sizeof(req), false);
2791 }
2792 EXPORT_SYMBOL_GPL(mt76_connac_mcu_restart);
2793 
2794 int mt76_connac_mcu_rdd_cmd(struct mt76_dev *dev, int cmd, u8 index,
2795 			    u8 rx_sel, u8 val)
2796 {
2797 	struct {
2798 		u8 ctrl;
2799 		u8 rdd_idx;
2800 		u8 rdd_rx_sel;
2801 		u8 val;
2802 		u8 rsv[4];
2803 	} __packed req = {
2804 		.ctrl = cmd,
2805 		.rdd_idx = index,
2806 		.rdd_rx_sel = rx_sel,
2807 		.val = val,
2808 	};
2809 
2810 	return mt76_mcu_send_msg(dev, MCU_EXT_CMD(SET_RDD_CTRL), &req,
2811 				 sizeof(req), true);
2812 }
2813 EXPORT_SYMBOL_GPL(mt76_connac_mcu_rdd_cmd);
2814 
2815 static int
2816 mt76_connac_mcu_send_ram_firmware(struct mt76_dev *dev,
2817 				  const struct mt76_connac2_fw_trailer *hdr,
2818 				  const u8 *data, bool is_wa)
2819 {
2820 	int i, offset = 0, max_len = mt76_is_sdio(dev) ? 2048 : 4096;
2821 	u32 override = 0, option = 0;
2822 
2823 	for (i = 0; i < hdr->n_region; i++) {
2824 		const struct mt76_connac2_fw_region *region;
2825 		u32 len, addr, mode;
2826 		int err;
2827 
2828 		region = (const void *)((const u8 *)hdr -
2829 					(hdr->n_region - i) * sizeof(*region));
2830 		mode = mt76_connac_mcu_gen_dl_mode(dev, region->feature_set,
2831 						   is_wa);
2832 		len = le32_to_cpu(region->len);
2833 		addr = le32_to_cpu(region->addr);
2834 
2835 		if (region->feature_set & FW_FEATURE_OVERRIDE_ADDR)
2836 			override = addr;
2837 
2838 		err = mt76_connac_mcu_init_download(dev, addr, len, mode);
2839 		if (err) {
2840 			dev_err(dev->dev, "Download request failed\n");
2841 			return err;
2842 		}
2843 
2844 		err = __mt76_mcu_send_firmware(dev, MCU_CMD(FW_SCATTER),
2845 					       data + offset, len, max_len);
2846 		if (err) {
2847 			dev_err(dev->dev, "Failed to send firmware.\n");
2848 			return err;
2849 		}
2850 
2851 		offset += len;
2852 	}
2853 
2854 	if (override)
2855 		option |= FW_START_OVERRIDE;
2856 	if (is_wa)
2857 		option |= FW_START_WORKING_PDA_CR4;
2858 
2859 	return mt76_connac_mcu_start_firmware(dev, override, option);
2860 }
2861 
2862 int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
2863 			  const char *fw_wa)
2864 {
2865 	const struct mt76_connac2_fw_trailer *hdr;
2866 	const struct firmware *fw;
2867 	int ret;
2868 
2869 	ret = request_firmware(&fw, fw_wm, dev->dev);
2870 	if (ret)
2871 		return ret;
2872 
2873 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2874 		dev_err(dev->dev, "Invalid firmware\n");
2875 		ret = -EINVAL;
2876 		goto out;
2877 	}
2878 
2879 	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
2880 	dev_info(dev->dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
2881 		 hdr->fw_ver, hdr->build_date);
2882 
2883 	ret = mt76_connac_mcu_send_ram_firmware(dev, hdr, fw->data, false);
2884 	if (ret) {
2885 		dev_err(dev->dev, "Failed to start WM firmware\n");
2886 		goto out;
2887 	}
2888 
2889 	release_firmware(fw);
2890 
2891 	if (!fw_wa)
2892 		return 0;
2893 
2894 	ret = request_firmware(&fw, fw_wa, dev->dev);
2895 	if (ret)
2896 		return ret;
2897 
2898 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2899 		dev_err(dev->dev, "Invalid firmware\n");
2900 		ret = -EINVAL;
2901 		goto out;
2902 	}
2903 
2904 	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
2905 	dev_info(dev->dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
2906 		 hdr->fw_ver, hdr->build_date);
2907 
2908 	ret = mt76_connac_mcu_send_ram_firmware(dev, hdr, fw->data, true);
2909 	if (ret) {
2910 		dev_err(dev->dev, "Failed to start WA firmware\n");
2911 		goto out;
2912 	}
2913 
2914 	snprintf(dev->hw->wiphy->fw_version,
2915 		 sizeof(dev->hw->wiphy->fw_version),
2916 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
2917 
2918 out:
2919 	release_firmware(fw);
2920 
2921 	return ret;
2922 }
2923 EXPORT_SYMBOL_GPL(mt76_connac2_load_ram);
2924 
2925 static u32 mt76_connac2_get_data_mode(struct mt76_dev *dev, u32 info)
2926 {
2927 	u32 mode = DL_MODE_NEED_RSP;
2928 
2929 	if (!is_mt7921(dev) || info == PATCH_SEC_NOT_SUPPORT)
2930 		return mode;
2931 
2932 	switch (FIELD_GET(PATCH_SEC_ENC_TYPE_MASK, info)) {
2933 	case PATCH_SEC_ENC_TYPE_PLAIN:
2934 		break;
2935 	case PATCH_SEC_ENC_TYPE_AES:
2936 		mode |= DL_MODE_ENCRYPT;
2937 		mode |= FIELD_PREP(DL_MODE_KEY_IDX,
2938 				(info & PATCH_SEC_ENC_AES_KEY_MASK)) & DL_MODE_KEY_IDX;
2939 		mode |= DL_MODE_RESET_SEC_IV;
2940 		break;
2941 	case PATCH_SEC_ENC_TYPE_SCRAMBLE:
2942 		mode |= DL_MODE_ENCRYPT;
2943 		mode |= DL_CONFIG_ENCRY_MODE_SEL;
2944 		mode |= DL_MODE_RESET_SEC_IV;
2945 		break;
2946 	default:
2947 		dev_err(dev->dev, "Encryption type not support!\n");
2948 	}
2949 
2950 	return mode;
2951 }
2952 
2953 int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
2954 {
2955 	int i, ret, sem, max_len = mt76_is_sdio(dev) ? 2048 : 4096;
2956 	const struct mt76_connac2_patch_hdr *hdr;
2957 	const struct firmware *fw = NULL;
2958 
2959 	sem = mt76_connac_mcu_patch_sem_ctrl(dev, true);
2960 	switch (sem) {
2961 	case PATCH_IS_DL:
2962 		return 0;
2963 	case PATCH_NOT_DL_SEM_SUCCESS:
2964 		break;
2965 	default:
2966 		dev_err(dev->dev, "Failed to get patch semaphore\n");
2967 		return -EAGAIN;
2968 	}
2969 
2970 	ret = request_firmware(&fw, fw_name, dev->dev);
2971 	if (ret)
2972 		goto out;
2973 
2974 	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
2975 		dev_err(dev->dev, "Invalid firmware\n");
2976 		ret = -EINVAL;
2977 		goto out;
2978 	}
2979 
2980 	hdr = (const void *)fw->data;
2981 	dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
2982 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
2983 
2984 	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
2985 		struct mt76_connac2_patch_sec *sec;
2986 		u32 len, addr, mode;
2987 		const u8 *dl;
2988 		u32 sec_info;
2989 
2990 		sec = (void *)(fw->data + sizeof(*hdr) + i * sizeof(*sec));
2991 		if ((be32_to_cpu(sec->type) & PATCH_SEC_TYPE_MASK) !=
2992 		    PATCH_SEC_TYPE_INFO) {
2993 			ret = -EINVAL;
2994 			goto out;
2995 		}
2996 
2997 		addr = be32_to_cpu(sec->info.addr);
2998 		len = be32_to_cpu(sec->info.len);
2999 		dl = fw->data + be32_to_cpu(sec->offs);
3000 		sec_info = be32_to_cpu(sec->info.sec_key_idx);
3001 		mode = mt76_connac2_get_data_mode(dev, sec_info);
3002 
3003 		ret = mt76_connac_mcu_init_download(dev, addr, len, mode);
3004 		if (ret) {
3005 			dev_err(dev->dev, "Download request failed\n");
3006 			goto out;
3007 		}
3008 
3009 		ret = __mt76_mcu_send_firmware(dev, MCU_CMD(FW_SCATTER),
3010 					       dl, len, max_len);
3011 		if (ret) {
3012 			dev_err(dev->dev, "Failed to send patch\n");
3013 			goto out;
3014 		}
3015 	}
3016 
3017 	ret = mt76_connac_mcu_start_patch(dev);
3018 	if (ret)
3019 		dev_err(dev->dev, "Failed to start patch\n");
3020 
3021 out:
3022 	sem = mt76_connac_mcu_patch_sem_ctrl(dev, false);
3023 	switch (sem) {
3024 	case PATCH_REL_SEM_SUCCESS:
3025 		break;
3026 	default:
3027 		ret = -EAGAIN;
3028 		dev_err(dev->dev, "Failed to release patch semaphore\n");
3029 		break;
3030 	}
3031 
3032 	release_firmware(fw);
3033 
3034 	return ret;
3035 }
3036 EXPORT_SYMBOL_GPL(mt76_connac2_load_patch);
3037 
3038 int mt76_connac2_mcu_fill_message(struct mt76_dev *dev, struct sk_buff *skb,
3039 				  int cmd, int *wait_seq)
3040 {
3041 	int txd_len, mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
3042 	struct mt76_connac2_mcu_uni_txd *uni_txd;
3043 	struct mt76_connac2_mcu_txd *mcu_txd;
3044 	__le32 *txd;
3045 	u32 val;
3046 	u8 seq;
3047 
3048 	/* TODO: make dynamic based on msg type */
3049 	dev->mcu.timeout = 20 * HZ;
3050 
3051 	seq = ++dev->mcu.msg_seq & 0xf;
3052 	if (!seq)
3053 		seq = ++dev->mcu.msg_seq & 0xf;
3054 
3055 	if (cmd == MCU_CMD(FW_SCATTER))
3056 		goto exit;
3057 
3058 	txd_len = cmd & __MCU_CMD_FIELD_UNI ? sizeof(*uni_txd) : sizeof(*mcu_txd);
3059 	txd = (__le32 *)skb_push(skb, txd_len);
3060 
3061 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len) |
3062 	      FIELD_PREP(MT_TXD0_PKT_FMT, MT_TX_TYPE_CMD) |
3063 	      FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_MCU_PORT_RX_Q0);
3064 	txd[0] = cpu_to_le32(val);
3065 
3066 	val = MT_TXD1_LONG_FORMAT |
3067 	      FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_CMD);
3068 	txd[1] = cpu_to_le32(val);
3069 
3070 	if (cmd & __MCU_CMD_FIELD_UNI) {
3071 		uni_txd = (struct mt76_connac2_mcu_uni_txd *)txd;
3072 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
3073 		uni_txd->option = MCU_CMD_UNI_EXT_ACK;
3074 		uni_txd->cid = cpu_to_le16(mcu_cmd);
3075 		uni_txd->s2d_index = MCU_S2D_H2N;
3076 		uni_txd->pkt_type = MCU_PKT_ID;
3077 		uni_txd->seq = seq;
3078 
3079 		goto exit;
3080 	}
3081 
3082 	mcu_txd = (struct mt76_connac2_mcu_txd *)txd;
3083 	mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
3084 	mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU,
3085 					       MT_TX_MCU_PORT_RX_Q0));
3086 	mcu_txd->pkt_type = MCU_PKT_ID;
3087 	mcu_txd->seq = seq;
3088 	mcu_txd->cid = mcu_cmd;
3089 	mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
3090 
3091 	if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
3092 		if (cmd & __MCU_CMD_FIELD_QUERY)
3093 			mcu_txd->set_query = MCU_Q_QUERY;
3094 		else
3095 			mcu_txd->set_query = MCU_Q_SET;
3096 		mcu_txd->ext_cid_ack = !!mcu_txd->ext_cid;
3097 	} else {
3098 		mcu_txd->set_query = MCU_Q_NA;
3099 	}
3100 
3101 	if (cmd & __MCU_CMD_FIELD_WA)
3102 		mcu_txd->s2d_index = MCU_S2D_H2C;
3103 	else
3104 		mcu_txd->s2d_index = MCU_S2D_H2N;
3105 
3106 exit:
3107 	if (wait_seq)
3108 		*wait_seq = seq;
3109 
3110 	return 0;
3111 }
3112 EXPORT_SYMBOL_GPL(mt76_connac2_mcu_fill_message);
3113 
3114 MODULE_AUTHOR("Lorenzo Bianconi <lorenzo@kernel.org>");
3115 MODULE_LICENSE("Dual BSD/GPL");
3116