xref: /linux/drivers/net/wireless/mediatek/mt76/mt7996/main.c (revision 7c2e6b43c3082c2242ecfa5875b2b4b2cd06140f)
1 // SPDX-License-Identifier: BSD-3-Clause-Clear
2 /*
3  * Copyright (C) 2022 MediaTek Inc.
4  */
5 
6 #include "mt7996.h"
7 #include "mcu.h"
8 #include "mac.h"
9 
10 int mt7996_run(struct mt7996_phy *phy)
11 {
12 	struct mt7996_dev *dev = phy->dev;
13 	int ret;
14 
15 	mt7996_mac_enable_nf(dev, phy->mt76->band_idx);
16 
17 	ret = mt7996_mcu_set_rts_thresh(phy, 0x92b);
18 	if (ret)
19 		return ret;
20 
21 	ret = mt7996_mcu_set_radio_en(phy, true);
22 	if (ret)
23 		return ret;
24 
25 	ret = mt7996_mcu_set_chan_info(phy, UNI_CHANNEL_RX_PATH);
26 	if (ret)
27 		return ret;
28 
29 	ret = mt7996_mcu_set_thermal_throttling(phy, MT7996_THERMAL_THROTTLE_MAX);
30 	if (ret)
31 		return ret;
32 
33 	ret = mt7996_mcu_set_thermal_protect(phy, true);
34 	if (ret)
35 		return ret;
36 
37 	set_bit(MT76_STATE_RUNNING, &phy->mt76->state);
38 
39 	ieee80211_queue_delayed_work(dev->mphy.hw, &phy->mt76->mac_work,
40 				     MT7996_WATCHDOG_TIME);
41 
42 	if (!phy->counter_reset) {
43 		mt7996_mac_reset_counters(phy);
44 		phy->counter_reset = true;
45 	}
46 
47 	return 0;
48 }
49 
50 static int mt7996_start(struct ieee80211_hw *hw)
51 {
52 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
53 	int ret;
54 
55 	flush_work(&dev->init_work);
56 
57 	mutex_lock(&dev->mt76.mutex);
58 	ret = mt7996_mcu_set_hdr_trans(dev, true);
59 	if (!ret && !is_mt7996(&dev->mt76)) {
60 		u8 queue = mt76_connac_lmac_mapping(IEEE80211_AC_VI);
61 
62 		ret = mt7996_mcu_cp_support(dev, queue);
63 	}
64 	mutex_unlock(&dev->mt76.mutex);
65 
66 	return ret;
67 }
68 
69 static void mt7996_stop_phy(struct mt7996_phy *phy)
70 {
71 	struct mt7996_dev *dev;
72 
73 	if (!phy || !test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
74 		return;
75 
76 	dev = phy->dev;
77 
78 	cancel_delayed_work_sync(&phy->mt76->mac_work);
79 
80 	mutex_lock(&dev->mt76.mutex);
81 
82 	mt7996_mcu_rdd_resume_tx(phy);
83 	mt7996_mcu_set_radio_en(phy, false);
84 
85 	clear_bit(MT76_STATE_RUNNING, &phy->mt76->state);
86 
87 	mutex_unlock(&dev->mt76.mutex);
88 }
89 
90 static void mt7996_stop(struct ieee80211_hw *hw, bool suspend)
91 {
92 }
93 
94 static inline int get_free_idx(u64 mask, u8 start, u8 end)
95 {
96 	if (~mask & GENMASK_ULL(end, start))
97 		return __ffs64(~mask & GENMASK_ULL(end, start)) + 1;
98 	return 0;
99 }
100 
101 static int get_omac_idx(enum nl80211_iftype type, u64 mask)
102 {
103 	int i;
104 
105 	switch (type) {
106 	case NL80211_IFTYPE_MESH_POINT:
107 	case NL80211_IFTYPE_ADHOC:
108 	case NL80211_IFTYPE_STATION:
109 		/* prefer hw bssid slot 1-3 */
110 		i = get_free_idx(mask, HW_BSSID_1, HW_BSSID_3);
111 		if (i)
112 			return i - 1;
113 
114 		if (type != NL80211_IFTYPE_STATION)
115 			break;
116 
117 		i = get_free_idx(mask, EXT_BSSID_1, EXT_BSSID_MAX);
118 		if (i)
119 			return i - 1;
120 
121 		if (~mask & BIT(HW_BSSID_0))
122 			return HW_BSSID_0;
123 
124 		break;
125 	case NL80211_IFTYPE_MONITOR:
126 	case NL80211_IFTYPE_AP:
127 		/* ap uses hw bssid 0 and ext bssid */
128 		if (~mask & BIT(HW_BSSID_0))
129 			return HW_BSSID_0;
130 
131 		i = get_free_idx(mask, EXT_BSSID_1, EXT_BSSID_MAX);
132 		if (i)
133 			return i - 1;
134 
135 		break;
136 	default:
137 		WARN_ON(1);
138 		break;
139 	}
140 
141 	return -1;
142 }
143 
144 static int get_own_mld_idx(u64 mask, bool group_mld)
145 {
146 	u8 start = group_mld ? 0 : 16;
147 	u8 end = group_mld ? 15 : 63;
148 	int idx;
149 
150 	idx = get_free_idx(mask, start, end);
151 	if (idx)
152 		return idx - 1;
153 
154 	/* If the 16-63 range is not available, perform another lookup in the
155 	 * range 0-15
156 	 */
157 	if (!group_mld) {
158 		idx = get_free_idx(mask, 0, 15);
159 		if (idx)
160 			return idx - 1;
161 	}
162 
163 	return -EINVAL;
164 }
165 
166 static void
167 mt7996_init_bitrate_mask(struct ieee80211_vif *vif, struct mt7996_vif_link *mlink)
168 {
169 	int i;
170 
171 	for (i = 0; i < ARRAY_SIZE(mlink->bitrate_mask.control); i++) {
172 		mlink->bitrate_mask.control[i].gi = NL80211_TXRATE_DEFAULT_GI;
173 		mlink->bitrate_mask.control[i].he_gi = 0xff;
174 		mlink->bitrate_mask.control[i].he_ltf = 0xff;
175 		mlink->bitrate_mask.control[i].legacy = GENMASK(31, 0);
176 		memset(mlink->bitrate_mask.control[i].ht_mcs, 0xff,
177 		       sizeof(mlink->bitrate_mask.control[i].ht_mcs));
178 		memset(mlink->bitrate_mask.control[i].vht_mcs, 0xff,
179 		       sizeof(mlink->bitrate_mask.control[i].vht_mcs));
180 		memset(mlink->bitrate_mask.control[i].he_mcs, 0xff,
181 		       sizeof(mlink->bitrate_mask.control[i].he_mcs));
182 	}
183 }
184 
185 static int
186 mt7996_set_hw_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
187 		  struct ieee80211_vif *vif, struct ieee80211_sta *sta,
188 		  unsigned int link_id, struct ieee80211_key_conf *key)
189 {
190 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
191 	struct ieee80211_bss_conf *link_conf;
192 	struct mt7996_sta_link *msta_link;
193 	struct mt7996_vif_link *link;
194 	int idx = key->keyidx;
195 	u8 *wcid_keyidx;
196 	bool is_bigtk;
197 	int err;
198 
199 	link = mt7996_vif_link(dev, vif, link_id);
200 	if (!link)
201 		return 0;
202 
203 	if (!mt7996_vif_link_phy(link))
204 		return 0;
205 
206 	if (sta) {
207 		struct mt7996_sta *msta;
208 
209 		msta = (struct mt7996_sta *)sta->drv_priv;
210 		msta_link = mt7996_sta_link_protected(dev, msta, link_id);
211 		if (!msta_link)
212 			return 0;
213 
214 		if (!msta_link->wcid.sta)
215 			return -EOPNOTSUPP;
216 	} else {
217 		msta_link = &link->msta_link;
218 	}
219 	wcid_keyidx = &msta_link->wcid.hw_key_idx;
220 
221 	is_bigtk = key->keyidx == 6 || key->keyidx == 7;
222 	switch (key->cipher) {
223 	case WLAN_CIPHER_SUITE_AES_CMAC:
224 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
225 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
226 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
227 		if (is_bigtk) {
228 			wcid_keyidx = &msta_link->wcid.hw_key_idx2;
229 			key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIE;
230 		}
231 		break;
232 	default:
233 		break;
234 	}
235 
236 	link_conf = link_conf_dereference_protected(vif, link_id);
237 	if (!link_conf)
238 		link_conf = &vif->bss_conf;
239 
240 	if (cmd == SET_KEY && !sta && !link->mt76.cipher) {
241 		struct mt7996_phy *phy = mt7996_vif_link_phy(link);
242 
243 		link->mt76.cipher =
244 			mt76_connac_mcu_get_cipher(key->cipher);
245 		if (phy)
246 			mt7996_mcu_add_bss_info(phy, vif, link_conf,
247 						&link->mt76, msta_link, true);
248 	}
249 
250 	if (cmd == SET_KEY)
251 		*wcid_keyidx = idx;
252 	else if (idx == *wcid_keyidx)
253 		*wcid_keyidx = -1;
254 
255 	/* only do remove key for BIGTK */
256 	if (cmd != SET_KEY && !is_bigtk)
257 		return 0;
258 
259 	mt76_wcid_key_setup(&dev->mt76, &msta_link->wcid, key);
260 
261 	err = mt7996_mcu_add_key(&dev->mt76, link, key,
262 				 MCU_WMWA_UNI_CMD(STA_REC_UPDATE),
263 				 &msta_link->wcid, cmd);
264 
265 	/* remove and add beacon in order to enable beacon protection */
266 	if (cmd == SET_KEY && is_bigtk && link_conf->enable_beacon) {
267 		mt7996_mcu_add_beacon(hw, vif, link_conf, false);
268 		mt7996_mcu_add_beacon(hw, vif, link_conf, true);
269 	}
270 
271 	return err;
272 }
273 
274 struct mt7996_key_iter_data {
275     enum set_key_cmd cmd;
276     unsigned int link_id;
277 };
278 
279 static void
280 mt7996_key_iter(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
281 		struct ieee80211_sta *sta, struct ieee80211_key_conf *key,
282 		void *data)
283 {
284 	struct mt7996_key_iter_data *it = data;
285 
286 	if (sta)
287 		return;
288 
289 	WARN_ON(mt7996_set_hw_key(hw, it->cmd, vif, NULL, it->link_id, key));
290 }
291 
292 int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,
293 			struct ieee80211_bss_conf *link_conf,
294 			struct mt76_vif_link *mlink)
295 {
296 	struct mt7996_vif_link *link = container_of(mlink, struct mt7996_vif_link, mt76);
297 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
298 	struct mt7996_sta_link *msta_link = &link->msta_link;
299 	struct mt7996_phy *phy = mphy->priv;
300 	struct mt7996_dev *dev = phy->dev;
301 	u8 band_idx = phy->mt76->band_idx;
302 	struct mt7996_key_iter_data it = {
303 		.cmd = SET_KEY,
304 		.link_id = link_conf->link_id,
305 	};
306 	int mld_idx, idx, ret;
307 
308 	if ((mvif->mt76.valid_links & BIT(link_conf->link_id)) &&
309 	    !mlink->offchannel) {
310 		if (vif->type == NL80211_IFTYPE_AP)
311 			return mt7996_mcu_mld_link_oper(dev, link_conf, link,
312 							true);
313 
314 		/* update the link address */
315 		ret = mt7996_mcu_add_dev_info(phy, vif, link_conf, mlink, true);
316 		if (ret)
317 			return ret;
318 
319 		return mt7996_mcu_add_bss_info(phy, vif, link_conf, mlink,
320 					       msta_link, true);
321 	}
322 
323 	mlink->idx = __ffs64(~dev->mt76.vif_mask);
324 	if (mlink->idx >= mt7996_max_interface_num(dev))
325 		return -ENOSPC;
326 
327 	idx = get_omac_idx(vif->type, phy->omac_mask);
328 	if (idx < 0)
329 		return -ENOSPC;
330 
331 	mld_idx = get_own_mld_idx(dev->mld_idx_mask, false);
332 	if (mld_idx < 0)
333 		return -ENOSPC;
334 
335 	link->mld_idx = mld_idx;
336 	mlink->omac_idx = idx;
337 	mlink->band_idx = band_idx;
338 	mlink->wmm_idx = vif->type == NL80211_IFTYPE_AP ? 0 : 3;
339 	mlink->wcid = &msta_link->wcid;
340 	mlink->wcid->offchannel = mlink->offchannel;
341 
342 	ret = mt7996_mcu_add_dev_info(phy, vif, link_conf, mlink, true);
343 	if (ret)
344 		return ret;
345 
346 	dev->mt76.vif_mask |= BIT_ULL(mlink->idx);
347 	dev->mld_idx_mask |= BIT_ULL(link->mld_idx);
348 	phy->omac_mask |= BIT_ULL(mlink->omac_idx);
349 
350 	idx = MT7996_WTBL_RESERVED - mlink->idx;
351 
352 	INIT_LIST_HEAD(&msta_link->rc_list);
353 	msta_link->wcid.idx = idx;
354 	msta_link->wcid.link_id = link_conf->link_id;
355 	msta_link->wcid.link_valid = ieee80211_vif_is_mld(vif);
356 	msta_link->wcid.tx_info |= MT_WCID_TX_INFO_SET;
357 	mt76_wcid_init(&msta_link->wcid, band_idx);
358 
359 	mt7996_mac_wtbl_update(dev, idx,
360 			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
361 
362 	if (vif->type != NL80211_IFTYPE_AP &&
363 	    (!mlink->omac_idx || mlink->omac_idx > 3))
364 		vif->offload_flags = 0;
365 
366 	if (phy->mt76->chandef.chan->band != NL80211_BAND_2GHZ)
367 		mlink->basic_rates_idx = MT7996_BASIC_RATES_TBL + 4;
368 	else
369 		mlink->basic_rates_idx = MT7996_BASIC_RATES_TBL;
370 
371 	mt7996_init_bitrate_mask(vif, link);
372 
373 	mt7996_mcu_add_bss_info(phy, vif, link_conf, mlink, msta_link, true);
374 	/* defer the first STA_REC of BMC entry to BSS_CHANGED_BSSID for STA
375 	 * interface, since firmware only records BSSID when the entry is new
376 	 */
377 	if (vif->type != NL80211_IFTYPE_STATION)
378 		mt7996_mcu_add_sta(dev, link_conf, NULL, link, NULL,
379 				   CONN_STATE_PORT_SECURE, true);
380 	rcu_assign_pointer(dev->mt76.wcid[idx], &msta_link->wcid);
381 
382 	if (!mlink->wcid->offchannel)
383 		ieee80211_iter_keys(mphy->hw, vif, mt7996_key_iter, &it);
384 
385 	if (!mlink->wcid->offchannel) {
386 		if (vif->txq &&
387 		    mvif->mt76.deflink_id == IEEE80211_LINK_UNSPECIFIED) {
388 			struct mt76_txq *mtxq;
389 
390 			mtxq = (struct mt76_txq *)vif->txq->drv_priv;
391 			mvif->mt76.deflink_id = link_conf->link_id;
392 			mtxq->wcid = idx;
393 		}
394 		mvif->mt76.valid_links |= BIT(link_conf->link_id);
395 	}
396 
397 	if (vif->type == NL80211_IFTYPE_STATION) {
398 		vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER;
399 
400 		if (vif->cfg.assoc && link_conf->beacon_int) {
401 			mlink->beacon_mon_interval =
402 				msecs_to_jiffies(ieee80211_tu_to_usec(
403 					link_conf->beacon_int) / 1000);
404 			WRITE_ONCE(mlink->beacon_mon_last, jiffies);
405 		}
406 	}
407 
408 	return 0;
409 }
410 
411 static void mt7996_vif_link_destroy(struct mt7996_phy *phy,
412 				    struct mt7996_vif_link *link,
413 				    struct ieee80211_vif *vif,
414 				    struct ieee80211_bss_conf *link_conf)
415 {
416 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
417 	struct mt7996_sta_link *msta_link = &link->msta_link;
418 	unsigned int link_id = msta_link->wcid.link_id;
419 	struct mt76_vif_link *mlink = &link->mt76;
420 	struct mt7996_key_iter_data it = {
421 		.cmd = SET_KEY,
422 		.link_id = link_id,
423 	};
424 	struct mt7996_dev *dev = phy->dev;
425 	int idx = msta_link->wcid.idx;
426 
427 	if (!link_conf)
428 		link_conf = &vif->bss_conf;
429 
430 	if (!mlink->wcid->offchannel)
431 		ieee80211_iter_keys(phy->mt76->hw, vif, mt7996_key_iter, &it);
432 
433 	mt7996_mcu_add_sta(dev, link_conf, NULL, link, NULL,
434 			   CONN_STATE_DISCONNECT, false);
435 	mt7996_mcu_add_bss_info(phy, vif, link_conf, mlink, msta_link, false);
436 	mt7996_mcu_add_dev_info(phy, vif, link_conf, mlink, false);
437 
438 	rcu_assign_pointer(dev->mt76.wcid[idx], NULL);
439 
440 	dev->mt76.vif_mask &= ~BIT_ULL(mlink->idx);
441 	dev->mld_idx_mask &= ~BIT_ULL(link->mld_idx);
442 	phy->omac_mask &= ~BIT_ULL(mlink->omac_idx);
443 	if (!mlink->wcid->offchannel)
444 		mvif->mt76.valid_links &= ~BIT(link_id);
445 
446 	spin_lock_bh(&dev->mt76.sta_poll_lock);
447 	if (!list_empty(&msta_link->wcid.poll_list))
448 		list_del_init(&msta_link->wcid.poll_list);
449 	spin_unlock_bh(&dev->mt76.sta_poll_lock);
450 
451 	mt76_wcid_cleanup(&dev->mt76, &msta_link->wcid);
452 
453 	if (mlink != (struct mt76_vif_link *)vif->drv_priv &&
454 	    !mlink->wcid->offchannel) {
455 		rcu_assign_pointer(mlink->mvif->link[link_id], NULL);
456 		kfree_rcu(mlink, rcu_head);
457 	}
458 }
459 
460 void mt7996_vif_link_remove(struct mt76_phy *mphy, struct ieee80211_vif *vif,
461 			    struct ieee80211_bss_conf *link_conf,
462 			    struct mt76_vif_link *mlink)
463 {
464 	struct mt7996_vif_link *link = container_of(mlink, struct mt7996_vif_link, mt76);
465 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
466 	struct mt7996_sta_link *msta_link = &link->msta_link;
467 	unsigned int link_id = msta_link->wcid.link_id;
468 	struct mt7996_phy *phy = mphy->priv;
469 
470 	/* Hw requires to destroy active links tearing down the interface, so
471 	 * postpone it removing the interface.
472 	 */
473 	if (mlink->wcid->offchannel) {
474 		mt7996_vif_link_destroy(phy, link, vif, link_conf);
475 	} else {
476 		if (vif->type == NL80211_IFTYPE_AP) {
477 			mt7996_mcu_mld_reconf_stop_link(phy->dev, vif,
478 							BIT(link_id));
479 			mt7996_mcu_mld_link_oper(phy->dev, link_conf, link,
480 						 false);
481 		}
482 
483 		if (vif->txq && mvif->mt76.deflink_id == link_id) {
484 			struct ieee80211_bss_conf *iter;
485 			struct mt76_txq *mtxq;
486 
487 			mvif->mt76.deflink_id = IEEE80211_LINK_UNSPECIFIED;
488 			mtxq = (struct mt76_txq *)vif->txq->drv_priv;
489 			/* Primary link will be removed, look for a new one */
490 			for_each_vif_active_link(vif, iter, link_id) {
491 				if (link_id == msta_link->wcid.link_id)
492 					continue;
493 
494 				link = mt7996_vif_link(phy->dev, vif, link_id);
495 				if (!link)
496 					continue;
497 
498 				mtxq->wcid = link->msta_link.wcid.idx;
499 				mvif->mt76.deflink_id = link_id;
500 				break;
501 			}
502 		}
503 	}
504 }
505 
506 static void mt7996_phy_set_rxfilter(struct mt7996_phy *phy)
507 {
508 	struct mt7996_dev *dev = phy->dev;
509 	u32 ctl_flags = MT_WF_RFCR1_DROP_ACK |
510 			MT_WF_RFCR1_DROP_BF_POLL |
511 			MT_WF_RFCR1_DROP_BA |
512 			MT_WF_RFCR1_DROP_CFEND |
513 			MT_WF_RFCR1_DROP_CFACK;
514 	u32 filter = phy->rxfilter;
515 
516 	if (filter & MT_WF_RFCR_DROP_OTHER_UC) {
517 		filter |= MT_WF_RFCR_DROP_CTS |
518 			  MT_WF_RFCR_DROP_RTS |
519 			  MT_WF_RFCR_DROP_CTL_RSV |
520 			  MT_WF_RFCR_DROP_FCSFAIL;
521 	}
522 
523 	mt76_wr(dev, MT_WF_RFCR(phy->mt76->band_idx), filter);
524 	if (filter & MT_WF_RFCR_DROP_CTL_RSV)
525 		mt76_set(dev, MT_WF_RFCR1(phy->mt76->band_idx), ctl_flags);
526 	else
527 		mt76_clear(dev, MT_WF_RFCR1(phy->mt76->band_idx), ctl_flags);
528 }
529 
530 static void mt7996_set_monitor(struct mt7996_phy *phy, bool enabled)
531 {
532 	struct mt7996_dev *dev;
533 
534 	if (!phy)
535 		return;
536 
537 	dev = phy->dev;
538 
539 	if (enabled == !(phy->rxfilter & MT_WF_RFCR_DROP_OTHER_UC))
540 		return;
541 
542 	if (!enabled)
543 		phy->rxfilter |= MT_WF_RFCR_DROP_OTHER_UC;
544 	else
545 		phy->rxfilter &= ~MT_WF_RFCR_DROP_OTHER_UC;
546 
547 	mt76_rmw_field(dev, MT_DMA_DCR0(phy->mt76->band_idx),
548 		       MT_DMA_DCR0_RXD_G5_EN, enabled);
549 	mt76_rmw_field(dev, MT_MDP_DCR0,
550 		       MT_MDP_DCR0_RX_HDR_TRANS_EN, !enabled);
551 	mt7996_phy_set_rxfilter(phy);
552 	mt7996_mcu_set_sniffer_mode(phy, enabled);
553 }
554 
555 static int mt7996_add_interface(struct ieee80211_hw *hw,
556 				struct ieee80211_vif *vif)
557 {
558 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
559 	struct wireless_dev *wdev = ieee80211_vif_to_wdev(vif);
560 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
561 	int i, err = 0;
562 
563 	mutex_lock(&dev->mt76.mutex);
564 
565 	for (i = 0; i < MT7996_MAX_RADIOS; i++) {
566 		struct mt7996_phy *phy = dev->radio_phy[i];
567 
568 		if (!phy || !(wdev->radio_mask & BIT(i)) ||
569 		    test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
570 			continue;
571 
572 		err = mt7996_run(phy);
573 		if (err)
574 			goto out;
575 
576 		if (vif->type == NL80211_IFTYPE_MONITOR)
577 			mt7996_set_monitor(phy, true);
578 	}
579 
580 	mt76_vif_init(vif, &mvif->mt76);
581 
582 	vif->offload_flags |= IEEE80211_OFFLOAD_ENCAP_4ADDR;
583 	mvif->mt76.deflink_id = IEEE80211_LINK_UNSPECIFIED;
584 
585 out:
586 	mutex_unlock(&dev->mt76.mutex);
587 
588 	return err;
589 }
590 
591 struct mt7996_radio_data {
592 	u32 active_mask;
593 	u32 monitor_mask;
594 };
595 
596 static void mt7996_remove_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
597 {
598 	struct wireless_dev *wdev = ieee80211_vif_to_wdev(vif);
599 	struct mt7996_radio_data *rdata = data;
600 
601 	rdata->active_mask |= wdev->radio_mask;
602 	if (vif->type == NL80211_IFTYPE_MONITOR)
603 		rdata->monitor_mask |= wdev->radio_mask;
604 }
605 
606 static void mt7996_remove_interface(struct ieee80211_hw *hw,
607 				    struct ieee80211_vif *vif)
608 {
609 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
610 	unsigned long rem_links = mvif->mt76.valid_links;
611 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
612 	struct mt7996_radio_data rdata = {};
613 	unsigned int link_id;
614 	int i;
615 
616 	mutex_lock(&dev->mt76.mutex);
617 
618 	/* Remove all active links */
619 	for_each_set_bit(link_id, &rem_links, IEEE80211_MLD_MAX_NUM_LINKS) {
620 		struct mt7996_vif_link *link;
621 		struct mt7996_phy *phy;
622 
623 		link = mt7996_vif_link(dev, vif, link_id);
624 		if (!link)
625 			continue;
626 
627 		phy = __mt7996_phy(dev, link->msta_link.wcid.phy_idx);
628 		if (!phy)
629 			continue;
630 
631 		mt7996_vif_link_destroy(phy, link, vif, NULL);
632 	}
633 
634 	mutex_unlock(&dev->mt76.mutex);
635 
636 	ieee80211_iterate_active_interfaces_mtx(hw, 0, mt7996_remove_iter,
637 						&rdata);
638 	mt76_vif_cleanup(&dev->mt76, vif);
639 
640 	for (i = 0; i < MT7996_MAX_RADIOS; i++) {
641 		struct mt7996_phy *phy = dev->radio_phy[i];
642 
643 		if (!phy)
644 			continue;
645 		if (!(rdata.monitor_mask & BIT(i)))
646 			mt7996_set_monitor(phy, false);
647 		if (!(rdata.active_mask & BIT(i)))
648 			mt7996_stop_phy(phy);
649 	}
650 }
651 
652 int mt7996_set_channel(struct mt76_phy *mphy)
653 {
654 	struct mt7996_phy *phy = mphy->priv;
655 	int ret;
656 
657 	if (mphy->offchannel)
658 		mt7996_mac_update_beacons(phy);
659 
660 	ret = mt7996_mcu_set_chan_info(phy, UNI_CHANNEL_SWITCH);
661 	if (ret)
662 		goto out;
663 
664 	ret = mt7996_mcu_set_chan_info(phy, UNI_CHANNEL_RX_PATH);
665 	if (ret)
666 		goto out;
667 
668 	ret = mt7996_mcu_set_txpower_sku(phy);
669 	if (ret)
670 		goto out;
671 
672 	ret = mt7996_dfs_init_radar_detector(phy);
673 	mt7996_mac_cca_stats_reset(phy);
674 
675 	mt7996_mac_reset_counters(phy);
676 	phy->noise = 0;
677 	if (!mphy->offchannel)
678 		mt7996_mac_update_beacons(phy);
679 
680 out:
681 	ieee80211_queue_delayed_work(mphy->hw, &mphy->mac_work,
682 				     MT7996_WATCHDOG_TIME);
683 
684 	return ret;
685 }
686 
687 static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
688 			  struct ieee80211_vif *vif, struct ieee80211_sta *sta,
689 			  struct ieee80211_key_conf *key)
690 {
691 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
692 	unsigned int link_id;
693 	unsigned long links;
694 	int err = 0;
695 
696 	/* The hardware does not support per-STA RX GTK, fallback
697 	 * to software mode for these.
698 	 */
699 	if ((vif->type == NL80211_IFTYPE_ADHOC ||
700 	     vif->type == NL80211_IFTYPE_MESH_POINT) &&
701 	    (key->cipher == WLAN_CIPHER_SUITE_TKIP ||
702 	     key->cipher == WLAN_CIPHER_SUITE_CCMP) &&
703 	    !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
704 		return -EOPNOTSUPP;
705 
706 	/* fall back to sw encryption for unsupported ciphers */
707 	switch (key->cipher) {
708 	case WLAN_CIPHER_SUITE_TKIP:
709 	case WLAN_CIPHER_SUITE_CCMP:
710 	case WLAN_CIPHER_SUITE_CCMP_256:
711 	case WLAN_CIPHER_SUITE_GCMP:
712 	case WLAN_CIPHER_SUITE_GCMP_256:
713 	case WLAN_CIPHER_SUITE_SMS4:
714 		break;
715 	case WLAN_CIPHER_SUITE_AES_CMAC:
716 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
717 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
718 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
719 		if (key->keyidx == 6 || key->keyidx == 7)
720 			break;
721 		fallthrough;
722 	case WLAN_CIPHER_SUITE_WEP40:
723 	case WLAN_CIPHER_SUITE_WEP104:
724 	default:
725 		return -EOPNOTSUPP;
726 	}
727 
728 	mutex_lock(&dev->mt76.mutex);
729 
730 	if (key->link_id >= 0)
731 		links = BIT(key->link_id);
732 	else if (sta && sta->valid_links)
733 		links = sta->valid_links;
734 	else if (vif->valid_links)
735 		links = vif->valid_links;
736 	else
737 		links = BIT(0);
738 
739 	for_each_set_bit(link_id, &links, IEEE80211_MLD_MAX_NUM_LINKS) {
740 		err = mt7996_set_hw_key(hw, cmd, vif, sta, link_id, key);
741 		if (err)
742 			break;
743 	}
744 	mutex_unlock(&dev->mt76.mutex);
745 
746 	return err;
747 }
748 
749 static int mt7996_config(struct ieee80211_hw *hw, int radio_idx, u32 changed)
750 {
751 	return 0;
752 }
753 
754 static int
755 mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
756 	       unsigned int link_id, u16 queue,
757 	       const struct ieee80211_tx_queue_params *params)
758 {
759 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
760 	struct mt7996_vif_link_info *link_info = &mvif->link_info[link_id];
761 	static const u8 mq_to_aci[] = {
762 		[IEEE80211_AC_VO] = 3,
763 		[IEEE80211_AC_VI] = 2,
764 		[IEEE80211_AC_BE] = 0,
765 		[IEEE80211_AC_BK] = 1,
766 	};
767 
768 	/* firmware uses access class index */
769 	link_info->queue_params[mq_to_aci[queue]] = *params;
770 	/* no need to update right away, we'll get BSS_CHANGED_QOS */
771 
772 	return 0;
773 }
774 
775 static void mt7996_configure_filter(struct ieee80211_hw *hw,
776 				    unsigned int changed_flags,
777 				    unsigned int *total_flags,
778 				    u64 multicast)
779 {
780 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
781 	struct mt7996_phy *phy;
782 	u32 filter_mask = 0, filter_set = 0;
783 	u32 flags = 0;
784 
785 #define MT76_FILTER(_flag, _hw) do {				\
786 		flags |= *total_flags & FIF_##_flag;		\
787 		filter_mask |= (_hw);				\
788 		filter_set |= !(flags & FIF_##_flag) * (_hw);	\
789 	} while (0)
790 
791 	mutex_lock(&dev->mt76.mutex);
792 
793 	MT76_FILTER(OTHER_BSS, MT_WF_RFCR_DROP_OTHER_TIM |
794 			       MT_WF_RFCR_DROP_A3_MAC |
795 			       MT_WF_RFCR_DROP_A3_BSSID);
796 
797 	MT76_FILTER(FCSFAIL, MT_WF_RFCR_DROP_FCSFAIL);
798 
799 	MT76_FILTER(CONTROL, MT_WF_RFCR_DROP_CTS |
800 			     MT_WF_RFCR_DROP_RTS |
801 			     MT_WF_RFCR_DROP_CTL_RSV);
802 
803 	*total_flags = flags;
804 
805 	mt7996_for_each_phy(dev, phy) {
806 		phy->rxfilter &= ~(MT_WF_RFCR_DROP_OTHER_BSS |
807 				   MT_WF_RFCR_DROP_OTHER_BEACON |
808 				   MT_WF_RFCR_DROP_FRAME_REPORT |
809 				   MT_WF_RFCR_DROP_PROBEREQ |
810 				   MT_WF_RFCR_DROP_MCAST_FILTERED |
811 				   MT_WF_RFCR_DROP_MCAST |
812 				   MT_WF_RFCR_DROP_BCAST |
813 				   MT_WF_RFCR_DROP_DUPLICATE |
814 				   MT_WF_RFCR_DROP_A2_BSSID |
815 				   MT_WF_RFCR_DROP_UNWANTED_CTL |
816 				   MT_WF_RFCR_DROP_STBC_MULTI |
817 				   filter_mask);
818 		phy->rxfilter |= filter_set;
819 		mt7996_phy_set_rxfilter(phy);
820 	}
821 
822 	mutex_unlock(&dev->mt76.mutex);
823 }
824 
825 static int
826 mt7996_get_txpower(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
827 		   unsigned int link_id, int *dbm)
828 {
829 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
830 	struct mt7996_phy *phy = mt7996_vif_link_phy(&mvif->deflink);
831 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
832 	struct wireless_dev *wdev;
833 	int n_chains, delta, i;
834 
835 	if (!phy) {
836 		wdev = ieee80211_vif_to_wdev(vif);
837 		for (i = 0; i < hw->wiphy->n_radio; i++)
838 			if (wdev->radio_mask & BIT(i))
839 				phy = dev->radio_phy[i];
840 
841 		if (!phy)
842 			return -EINVAL;
843 	}
844 
845 	n_chains = hweight16(phy->mt76->chainmask);
846 	delta = mt76_tx_power_path_delta(n_chains);
847 	*dbm = DIV_ROUND_UP(phy->mt76->txpower_cur + delta, 2);
848 
849 	return 0;
850 }
851 
852 static u8
853 mt7996_get_rates_table(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
854 		       bool beacon, bool mcast)
855 {
856 	struct mt7996_dev *dev = phy->dev;
857 	struct mt76_vif_link *mvif = mt76_vif_conf_link(&dev->mt76, conf->vif, conf);
858 	u16 rate;
859 	u8 i, idx;
860 
861 	rate = mt76_connac2_mac_tx_rate_val(phy->mt76, conf, beacon, mcast);
862 
863 	if (beacon) {
864 		/* odd index for driver, even index for firmware */
865 		idx = MT7996_BEACON_RATES_TBL + 2 * phy->mt76->band_idx;
866 		if (phy->beacon_rate != rate)
867 			mt7996_mcu_set_fixed_rate_table(phy, idx, rate, beacon);
868 
869 		return idx;
870 	}
871 
872 	idx = FIELD_GET(MT_TX_RATE_IDX, rate);
873 	for (i = 0; i < ARRAY_SIZE(mt76_rates); i++)
874 		if ((mt76_rates[i].hw_value & GENMASK(7, 0)) == idx)
875 			return MT7996_BASIC_RATES_TBL + 2 * i;
876 
877 	return mvif->basic_rates_idx;
878 }
879 
880 static void
881 mt7996_update_mu_group(struct ieee80211_hw *hw, struct mt7996_vif_link *link,
882 		       struct ieee80211_bss_conf *info)
883 {
884 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
885 	u8 band = link->mt76.band_idx;
886 	u32 *mu;
887 
888 	mu = (u32 *)info->mu_group.membership;
889 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_VLD0(band), mu[0]);
890 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_VLD1(band), mu[1]);
891 
892 	mu = (u32 *)info->mu_group.position;
893 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_POS0(band), mu[0]);
894 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_POS1(band), mu[1]);
895 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_POS2(band), mu[2]);
896 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_POS3(band), mu[3]);
897 }
898 
899 static void
900 mt7996_vif_cfg_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
901 		       u64 changed)
902 {
903 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
904 
905 	mutex_lock(&dev->mt76.mutex);
906 
907 	if ((changed & BSS_CHANGED_ASSOC) && vif->cfg.assoc) {
908 		struct ieee80211_bss_conf *link_conf;
909 		unsigned long link_id;
910 
911 		for_each_vif_active_link(vif, link_conf, link_id) {
912 			struct mt7996_vif_link *link;
913 			struct mt7996_phy *phy;
914 
915 			link = mt7996_vif_link(dev, vif, link_id);
916 			if (!link)
917 				continue;
918 
919 			if (vif->type == NL80211_IFTYPE_STATION) {
920 				link->mt76.beacon_mon_interval =
921 					msecs_to_jiffies(ieee80211_tu_to_usec(
922 						link_conf->beacon_int) / 1000);
923 				WRITE_ONCE(link->mt76.beacon_mon_last, jiffies);
924 			}
925 
926 			phy = mt7996_vif_link_phy(link);
927 			if (!phy)
928 				continue;
929 
930 			mt7996_mcu_add_bss_info(phy, vif, link_conf,
931 						&link->mt76, &link->msta_link,
932 						true);
933 			mt7996_mcu_add_sta(dev, link_conf, NULL, link, NULL,
934 					   CONN_STATE_PORT_SECURE,
935 					   !!(changed & BSS_CHANGED_BSSID));
936 		}
937 	}
938 
939 	if ((changed & BSS_CHANGED_ASSOC) && !vif->cfg.assoc &&
940 	    vif->type == NL80211_IFTYPE_STATION) {
941 		struct ieee80211_bss_conf *link_conf;
942 		unsigned long link_id;
943 
944 		for_each_vif_active_link(vif, link_conf, link_id) {
945 			struct mt7996_vif_link *link;
946 
947 			link = mt7996_vif_link(dev, vif, link_id);
948 			if (link)
949 				link->mt76.beacon_mon_interval = 0;
950 		}
951 	}
952 
953 	mutex_unlock(&dev->mt76.mutex);
954 }
955 
956 static void
957 mt7996_link_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
958 			 struct ieee80211_bss_conf *info, u64 changed)
959 {
960 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
961 	struct mt7996_vif_link *link;
962 	struct mt7996_phy *phy;
963 	struct mt76_phy *mphy;
964 
965 	mutex_lock(&dev->mt76.mutex);
966 
967 	link = mt7996_vif_conf_link(dev, vif, info);
968 	if (!link)
969 		goto out;
970 
971 	mphy = mt76_vif_link_phy(&link->mt76);
972 	if (!mphy)
973 		goto out;
974 
975 	phy = mphy->priv;
976 
977 	/* station mode uses BSSID to map the wlan entry to a peer,
978 	 * and then peer references bss_info_rfch to set bandwidth cap.
979 	 */
980 	if ((changed & BSS_CHANGED_BSSID && !is_zero_ether_addr(info->bssid)) ||
981 	    (changed & BSS_CHANGED_BEACON_ENABLED && info->enable_beacon)) {
982 		mt7996_mcu_add_bss_info(phy, vif, info, &link->mt76,
983 					&link->msta_link, true);
984 		mt7996_mcu_add_sta(dev, info, NULL, link, NULL,
985 				   CONN_STATE_PORT_SECURE,
986 				   !!(changed & BSS_CHANGED_BSSID));
987 	}
988 
989 	if (changed & BSS_CHANGED_HT || changed & BSS_CHANGED_ERP_CTS_PROT)
990 		mt7996_mcu_set_protection(phy, link, info->ht_operation_mode,
991 					  info->use_cts_prot);
992 
993 	if (changed & BSS_CHANGED_ERP_SLOT) {
994 		int slottime = info->use_short_slot ? 9 : 20;
995 
996 		if (slottime != phy->slottime) {
997 			phy->slottime = slottime;
998 			mt7996_mcu_set_timing(phy, vif, info);
999 		}
1000 	}
1001 
1002 	if (changed & BSS_CHANGED_MCAST_RATE)
1003 		link->mt76.mcast_rates_idx =
1004 			mt7996_get_rates_table(phy, info, false, true);
1005 
1006 	if (changed & BSS_CHANGED_BASIC_RATES)
1007 		link->mt76.basic_rates_idx =
1008 			mt7996_get_rates_table(phy, info, false, false);
1009 
1010 	/* ensure that enable txcmd_mode after bss_info */
1011 	if (changed & (BSS_CHANGED_QOS | BSS_CHANGED_BEACON_ENABLED))
1012 		mt7996_mcu_set_tx(dev, vif, info);
1013 
1014 	if (changed & BSS_CHANGED_HE_OBSS_PD)
1015 		mt7996_mcu_add_obss_spr(phy, link, &info->he_obss_pd);
1016 
1017 	if (changed & BSS_CHANGED_HE_BSS_COLOR) {
1018 		if ((vif->type == NL80211_IFTYPE_AP &&
1019 		    link->mt76.omac_idx <= HW_BSSID_MAX) ||
1020 		   vif->type == NL80211_IFTYPE_STATION)
1021 			mt7996_mcu_update_bss_color(dev, &link->mt76,
1022 						    &info->he_bss_color);
1023 	}
1024 
1025 	if (changed & (BSS_CHANGED_BEACON |
1026 		       BSS_CHANGED_BEACON_ENABLED)) {
1027 		link->mt76.beacon_rates_idx =
1028 			mt7996_get_rates_table(phy, info, true, false);
1029 
1030 		mt7996_mcu_add_beacon(hw, vif, info, info->enable_beacon);
1031 	}
1032 
1033 	if (changed & (BSS_CHANGED_UNSOL_BCAST_PROBE_RESP |
1034 		       BSS_CHANGED_FILS_DISCOVERY))
1035 		mt7996_mcu_beacon_inband_discov(dev, info, link, changed);
1036 
1037 	if (changed & BSS_CHANGED_MU_GROUPS)
1038 		mt7996_update_mu_group(hw, link, info);
1039 
1040 	if (changed & BSS_CHANGED_TXPOWER &&
1041 	    info->txpower != phy->txpower) {
1042 		phy->txpower = info->txpower;
1043 		mt7996_mcu_set_txpower_sku(phy);
1044 	}
1045 
1046 out:
1047 	mutex_unlock(&dev->mt76.mutex);
1048 }
1049 
1050 static void
1051 mt7996_channel_switch_beacon(struct ieee80211_hw *hw,
1052 			     struct ieee80211_vif *vif,
1053 			     struct cfg80211_chan_def *chandef)
1054 {
1055 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
1056 	struct mt7996_phy *phy = mt7996_band_phy(dev, chandef->chan->band);
1057 	struct ieee80211_bss_conf *link_conf;
1058 	unsigned int link_id;
1059 
1060 	mutex_lock(&dev->mt76.mutex);
1061 
1062 	for_each_vif_active_link(vif, link_conf, link_id) {
1063 		struct mt7996_vif_link *link;
1064 		struct mt7996_phy *link_phy;
1065 
1066 		link = mt7996_vif_link(dev, vif, link_id);
1067 		if (!link)
1068 			continue;
1069 
1070 		link_phy = mt7996_vif_link_phy(link);
1071 		if (link_phy != phy)
1072 			continue;
1073 
1074 		/* Reset beacon when channel switch triggered during CAC to let
1075 		 * FW correctly perform CSA countdown
1076 		 */
1077 		if (!cfg80211_reg_can_beacon(hw->wiphy, &phy->mt76->chandef,
1078 					     vif->type))
1079 			mt7996_mcu_add_beacon(hw, vif, link_conf, false);
1080 
1081 		mt7996_mcu_add_beacon(hw, vif, link_conf, true);
1082 		break;
1083 	}
1084 
1085 	mutex_unlock(&dev->mt76.mutex);
1086 }
1087 
1088 static int
1089 mt7996_post_channel_switch(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1090 			   struct ieee80211_bss_conf *link_conf)
1091 {
1092 	struct cfg80211_chan_def *chandef = &link_conf->chanreq.oper;
1093 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
1094 	struct mt7996_phy *phy = mt7996_band_phy(dev, chandef->chan->band);
1095 	struct mt7996_vif_link *link;
1096 	int ret = -EINVAL;
1097 
1098 	mutex_lock(&dev->mt76.mutex);
1099 
1100 	link = mt7996_vif_conf_link(dev, vif, link_conf);
1101 	if (!link)
1102 		goto out;
1103 
1104 	ret = mt7996_mcu_update_bss_rfch(phy, link);
1105 	if (ret)
1106 		goto out;
1107 
1108 	ieee80211_iterate_stations_mtx(hw, mt7996_mcu_update_sta_rec_bw, link);
1109 
1110 	ret = mt7996_mcu_rdd_resume_tx(phy);
1111 
1112 out:
1113 	mutex_unlock(&dev->mt76.mutex);
1114 
1115 	return ret;
1116 }
1117 
1118 static void
1119 mt7996_sta_init_txq_wcid(struct ieee80211_sta *sta, int idx)
1120 {
1121 	int i;
1122 
1123 	for (i = 0; i < ARRAY_SIZE(sta->txq); i++) {
1124 		struct mt76_txq *mtxq;
1125 
1126 		if (!sta->txq[i])
1127 			continue;
1128 
1129 		mtxq = (struct mt76_txq *)sta->txq[i]->drv_priv;
1130 		mtxq->wcid = idx;
1131 	}
1132 }
1133 
1134 static int
1135 mt7996_mac_sta_init_link(struct mt7996_dev *dev,
1136 			 struct ieee80211_bss_conf *link_conf,
1137 			 struct ieee80211_link_sta *link_sta,
1138 			 struct mt7996_vif_link *link, unsigned int link_id)
1139 {
1140 	struct ieee80211_sta *sta = link_sta->sta;
1141 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
1142 	struct mt7996_phy *phy = mt7996_vif_link_phy(link);
1143 	struct mt7996_sta_link *msta_link;
1144 	int idx;
1145 
1146 	if (!phy)
1147 		return -EINVAL;
1148 
1149 	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7996_WTBL_STA);
1150 	if (idx < 0)
1151 		return -ENOSPC;
1152 
1153 	if (msta->deflink_id == IEEE80211_LINK_UNSPECIFIED) {
1154 		msta_link = &msta->deflink;
1155 		msta->deflink_id = link_id;
1156 		msta->seclink_id = msta->deflink_id;
1157 		mt7996_sta_init_txq_wcid(sta, idx);
1158 	} else {
1159 		msta_link = kzalloc_obj(*msta_link);
1160 		if (!msta_link)
1161 			return -ENOMEM;
1162 
1163 		if (msta->seclink_id == msta->deflink_id &&
1164 		    (sta->valid_links & ~BIT(msta->deflink_id)))
1165 			msta->seclink_id = __ffs(sta->valid_links &
1166 						 ~BIT(msta->deflink_id));
1167 	}
1168 
1169 	INIT_LIST_HEAD(&msta_link->rc_list);
1170 	INIT_LIST_HEAD(&msta_link->wcid.poll_list);
1171 	msta_link->sta = msta;
1172 	msta_link->wcid.sta = 1;
1173 	msta_link->wcid.idx = idx;
1174 	msta_link->wcid.link_id = link_id;
1175 	msta_link->wcid.link_valid = !!sta->valid_links;
1176 	msta_link->wcid.def_wcid = &msta->deflink.wcid;
1177 
1178 	if (link_sta->sta->tdls)
1179 		set_bit(MT_WCID_FLAG_TDLS_PEER, &msta_link->wcid.flags);
1180 
1181 	ewma_avg_signal_init(&msta_link->avg_ack_signal);
1182 	ewma_signal_init(&msta_link->wcid.rssi);
1183 
1184 	rcu_assign_pointer(msta->link[link_id], msta_link);
1185 
1186 	mt7996_mac_wtbl_update(dev, idx, MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
1187 	mt7996_mcu_add_sta(dev, link_conf, link_sta, link, msta_link,
1188 			   CONN_STATE_DISCONNECT, true);
1189 
1190 	rcu_assign_pointer(dev->mt76.wcid[idx], &msta_link->wcid);
1191 	mt76_wcid_init(&msta_link->wcid, phy->mt76->band_idx);
1192 
1193 	return 0;
1194 }
1195 
1196 void mt7996_mac_sta_remove_link(struct mt7996_dev *dev,
1197 				struct ieee80211_sta *sta,
1198 				unsigned int link_id, bool flush)
1199 {
1200 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
1201 	struct mt7996_sta_link *msta_link;
1202 
1203 	msta_link = mt76_dereference(msta->link[link_id], &dev->mt76);
1204 	if (!msta_link)
1205 		return;
1206 
1207 	spin_lock_bh(&dev->mt76.sta_poll_lock);
1208 	if (!list_empty(&msta_link->wcid.poll_list))
1209 		list_del_init(&msta_link->wcid.poll_list);
1210 	if (!list_empty(&msta_link->rc_list))
1211 		list_del_init(&msta_link->rc_list);
1212 	spin_unlock_bh(&dev->mt76.sta_poll_lock);
1213 
1214 	mt76_wcid_cleanup(&dev->mt76, &msta_link->wcid);
1215 
1216 	if (msta_link->wcid.link_valid) {
1217 		mt7996_mac_wtbl_update(dev, msta_link->wcid.idx,
1218 				       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
1219 
1220 		if (msta->deflink_id == link_id) {
1221 			msta->deflink_id = IEEE80211_LINK_UNSPECIFIED;
1222 			if (msta->seclink_id == link_id) {
1223 				/* no secondary link available */
1224 				msta->seclink_id = msta->deflink_id;
1225 			} else {
1226 				struct mt7996_sta_link *msta_seclink;
1227 
1228 				/* switch to the secondary link */
1229 				msta_seclink = mt76_dereference(
1230 						msta->link[msta->seclink_id],
1231 						&dev->mt76);
1232 				if (msta_seclink) {
1233 					msta->deflink_id = msta->seclink_id;
1234 					mt7996_sta_init_txq_wcid(sta,
1235 						msta_seclink->wcid.idx);
1236 				}
1237 			}
1238 		} else if (msta->seclink_id == link_id) {
1239 			msta->seclink_id = msta->deflink_id;
1240 		}
1241 		msta_link->wcid.link_valid = false;
1242 	}
1243 
1244 	if (flush) {
1245 		struct mt7996_phy *phy =
1246 			__mt7996_phy(dev, msta_link->wcid.phy_idx);
1247 
1248 		if (phy)
1249 			phy->mt76->num_sta--;
1250 
1251 		rcu_assign_pointer(msta->link[link_id], NULL);
1252 		rcu_assign_pointer(dev->mt76.wcid[msta_link->wcid.idx], NULL);
1253 		mt76_wcid_mask_clear(dev->mt76.wcid_mask, msta_link->wcid.idx);
1254 		if (msta_link != &msta->deflink)
1255 			kfree_rcu(msta_link, rcu_head);
1256 	}
1257 }
1258 
1259 static void
1260 mt7996_mac_sta_remove_links(struct mt7996_dev *dev, struct ieee80211_vif *vif,
1261 			    struct ieee80211_sta *sta, unsigned long links,
1262 			    bool flush)
1263 {
1264 	unsigned int link_id;
1265 
1266 	for_each_set_bit(link_id, &links, IEEE80211_MLD_MAX_NUM_LINKS)
1267 		mt7996_mac_sta_remove_link(dev, sta, link_id, flush);
1268 }
1269 
1270 static int
1271 mt7996_mac_sta_add_links(struct mt7996_dev *dev, struct ieee80211_vif *vif,
1272 			 struct ieee80211_sta *sta, unsigned long new_links)
1273 {
1274 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
1275 	unsigned int link_id;
1276 	int err = 0;
1277 
1278 	for_each_set_bit(link_id, &new_links, IEEE80211_MLD_MAX_NUM_LINKS) {
1279 		struct ieee80211_bss_conf *link_conf;
1280 		struct ieee80211_link_sta *link_sta;
1281 		struct mt7996_sta_link *msta_link;
1282 		struct mt7996_vif_link *link;
1283 		struct mt76_phy *mphy;
1284 
1285 		msta_link = mt76_dereference(msta->link[link_id], &dev->mt76);
1286 		if (msta_link) {
1287 			msta_link->wcid.link_valid = true;
1288 			continue;
1289 		}
1290 
1291 		link_conf = link_conf_dereference_protected(vif, link_id);
1292 		if (!link_conf) {
1293 			err = -EINVAL;
1294 			goto error_unlink;
1295 		}
1296 
1297 		link = mt7996_vif_link(dev, vif, link_id);
1298 		if (!link) {
1299 			err = -EINVAL;
1300 			goto error_unlink;
1301 		}
1302 
1303 		link_sta = link_sta_dereference_protected(sta, link_id);
1304 		if (!link_sta) {
1305 			err = -EINVAL;
1306 			goto error_unlink;
1307 		}
1308 
1309 		mphy = mt76_vif_link_phy(&link->mt76);
1310 		if (!mphy) {
1311 			err = -EINVAL;
1312 			goto error_unlink;
1313 		}
1314 
1315 		err = mt7996_mac_sta_init_link(dev, link_conf, link_sta, link,
1316 					       link_id);
1317 		if (err)
1318 			goto error_unlink;
1319 
1320 		mphy->num_sta++;
1321 	}
1322 
1323 	return 0;
1324 
1325 error_unlink:
1326 	mt7996_mac_sta_remove_links(dev, vif, sta, new_links, true);
1327 
1328 	return err;
1329 }
1330 
1331 static int
1332 mt7996_mac_sta_change_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1333 			    struct ieee80211_sta *sta, u16 old_links,
1334 			    u16 new_links)
1335 {
1336 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
1337 	unsigned long add = new_links & ~old_links;
1338 	unsigned long rem = old_links & ~new_links;
1339 	int ret;
1340 
1341 	mutex_lock(&dev->mt76.mutex);
1342 
1343 	mt7996_mac_sta_remove_links(dev, vif, sta, rem, false);
1344 	ret = mt7996_mac_sta_add_links(dev, vif, sta, add);
1345 
1346 	mutex_unlock(&dev->mt76.mutex);
1347 
1348 	return ret;
1349 }
1350 
1351 static int
1352 mt7996_mac_sta_add(struct mt7996_dev *dev, struct ieee80211_vif *vif,
1353 		   struct ieee80211_sta *sta)
1354 {
1355 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
1356 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
1357 	unsigned long links = sta->valid_links ? sta->valid_links : BIT(0);
1358 	int err;
1359 
1360 	mutex_lock(&dev->mt76.mutex);
1361 
1362 	msta->deflink_id = IEEE80211_LINK_UNSPECIFIED;
1363 	msta->seclink_id = IEEE80211_LINK_UNSPECIFIED;
1364 	msta->vif = mvif;
1365 	err = mt7996_mac_sta_add_links(dev, vif, sta, links);
1366 
1367 	mutex_unlock(&dev->mt76.mutex);
1368 
1369 	return err;
1370 }
1371 
1372 static int
1373 mt7996_mac_sta_event(struct mt7996_dev *dev, struct ieee80211_vif *vif,
1374 		     struct ieee80211_sta *sta, enum mt76_sta_event ev)
1375 {
1376 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
1377 	unsigned long links = sta->valid_links;
1378 	struct ieee80211_link_sta *link_sta;
1379 	unsigned int link_id;
1380 	int err = 0;
1381 
1382 	mutex_lock(&dev->mt76.mutex);
1383 
1384 	for_each_sta_active_link(vif, sta, link_sta, link_id) {
1385 		struct ieee80211_bss_conf *link_conf;
1386 		struct mt7996_sta_link *msta_link;
1387 		struct mt7996_vif_link *link;
1388 		int i;
1389 
1390 		link_conf = link_conf_dereference_protected(vif, link_id);
1391 		if (!link_conf)
1392 			continue;
1393 
1394 		link = mt7996_vif_link(dev, vif, link_id);
1395 		if (!link)
1396 			continue;
1397 
1398 		msta_link = mt7996_sta_link_protected(dev, msta, link_id);
1399 		if (!msta_link)
1400 			continue;
1401 
1402 		switch (ev) {
1403 		case MT76_STA_EVENT_ASSOC:
1404 			err = mt7996_mcu_add_sta(dev, link_conf, link_sta,
1405 						 link, msta_link,
1406 						 CONN_STATE_CONNECT, true);
1407 			if (err)
1408 				goto unlock;
1409 
1410 			err = mt7996_mcu_add_rate_ctrl(dev, msta_link->sta, vif,
1411 						       link_id, false);
1412 			if (err)
1413 				goto unlock;
1414 
1415 			msta_link->wcid.tx_info |= MT_WCID_TX_INFO_SET;
1416 			break;
1417 		case MT76_STA_EVENT_AUTHORIZE:
1418 			err = mt7996_mcu_add_sta(dev, link_conf, link_sta,
1419 						 link, msta_link,
1420 						 CONN_STATE_PORT_SECURE, false);
1421 			if (err)
1422 				goto unlock;
1423 			break;
1424 		case MT76_STA_EVENT_DISASSOC:
1425 			for (i = 0; i < ARRAY_SIZE(msta_link->twt.flow); i++)
1426 				mt7996_mac_twt_teardown_flow(dev, link,
1427 							     msta_link, i);
1428 
1429 			if (!sta->mlo)
1430 				mt7996_mcu_add_sta(dev, link_conf, link_sta,
1431 						   link, msta_link,
1432 						   CONN_STATE_DISCONNECT, false);
1433 			else if (sta->mlo && links == BIT(link_id)) /* last link */
1434 				mt7996_mcu_teardown_mld_sta(dev, link,
1435 							    msta_link);
1436 			msta_link->wcid.tx_info &= ~MT_WCID_TX_INFO_SET;
1437 			msta_link->wcid.sta_disabled = 1;
1438 			msta_link->wcid.sta = 0;
1439 			links = links & ~BIT(link_id);
1440 			break;
1441 		}
1442 	}
1443 unlock:
1444 	mutex_unlock(&dev->mt76.mutex);
1445 
1446 	return err;
1447 }
1448 
1449 static void
1450 mt7996_mac_sta_remove(struct mt7996_dev *dev, struct ieee80211_vif *vif,
1451 		      struct ieee80211_sta *sta)
1452 {
1453 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
1454 	int i;
1455 
1456 	mutex_lock(&dev->mt76.mutex);
1457 	for (i = 0; i < ARRAY_SIZE(msta->link); i++)
1458 		mt7996_mac_sta_remove_link(dev, sta, i, true);
1459 	mutex_unlock(&dev->mt76.mutex);
1460 }
1461 
1462 static void
1463 mt7996_set_active_links(struct ieee80211_vif *vif)
1464 {
1465 	u16 active_links;
1466 
1467 	if (vif->type != NL80211_IFTYPE_STATION)
1468 		return;
1469 
1470 	if (!ieee80211_vif_is_mld(vif))
1471 		return;
1472 
1473 	active_links = mt76_select_links(vif, MT7996_MAX_RADIOS);
1474 	if (hweight16(active_links) < 2)
1475 		return;
1476 
1477 	ieee80211_set_active_links_async(vif, active_links);
1478 }
1479 
1480 static int
1481 mt7996_sta_state(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1482 		 struct ieee80211_sta *sta, enum ieee80211_sta_state old_state,
1483 		 enum ieee80211_sta_state new_state)
1484 {
1485 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
1486 	enum mt76_sta_event ev;
1487 
1488 	if (old_state == IEEE80211_STA_NOTEXIST &&
1489 	    new_state == IEEE80211_STA_NONE)
1490 		return mt7996_mac_sta_add(dev, vif, sta);
1491 
1492 	if (old_state == IEEE80211_STA_NONE &&
1493 	    new_state == IEEE80211_STA_NOTEXIST)
1494 		mt7996_mac_sta_remove(dev, vif, sta);
1495 
1496 	if (old_state == IEEE80211_STA_AUTH &&
1497 	    new_state == IEEE80211_STA_ASSOC) {
1498 		mt7996_set_active_links(vif);
1499 		ev = MT76_STA_EVENT_ASSOC;
1500 	} else if (old_state == IEEE80211_STA_ASSOC &&
1501 		   new_state == IEEE80211_STA_AUTHORIZED) {
1502 		ev = MT76_STA_EVENT_AUTHORIZE;
1503 	} else if (old_state == IEEE80211_STA_ASSOC &&
1504 		   new_state == IEEE80211_STA_AUTH) {
1505 		ev = MT76_STA_EVENT_DISASSOC;
1506 	} else {
1507 		return 0;
1508 	}
1509 
1510 	return mt7996_mac_sta_event(dev, vif, sta, ev);
1511 }
1512 
1513 static void mt7996_tx(struct ieee80211_hw *hw,
1514 		      struct ieee80211_tx_control *control,
1515 		      struct sk_buff *skb)
1516 {
1517 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1518 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
1519 	struct ieee80211_sta *sta = control->sta;
1520 	struct mt7996_sta *msta = sta ? (void *)sta->drv_priv : NULL;
1521 	struct mt76_phy *mphy = hw->priv;
1522 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1523 	struct ieee80211_vif *vif = info->control.vif;
1524 	struct mt7996_vif *mvif = vif ? (void *)vif->drv_priv : NULL;
1525 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
1526 	u8 deflink_id = IEEE80211_LINK_UNSPECIFIED;
1527 	u8 link_id = u32_get_bits(info->control.flags,
1528 				  IEEE80211_TX_CTRL_MLO_LINK);
1529 
1530 	rcu_read_lock();
1531 
1532 	if (msta)
1533 		deflink_id = msta->deflink_id;
1534 	else if (mvif)
1535 		deflink_id = mvif->mt76.deflink_id;
1536 
1537 	/* the primary link is unset until the first link has been added */
1538 	if (deflink_id >= IEEE80211_MLD_MAX_NUM_LINKS)
1539 		deflink_id = 0;
1540 
1541 	/* Use primary link_id if the value from mac80211 is set to
1542 	 * IEEE80211_LINK_UNSPECIFIED.
1543 	 */
1544 	if (link_id == IEEE80211_LINK_UNSPECIFIED)
1545 		link_id = deflink_id;
1546 
1547 	if (vif && ieee80211_vif_is_mld(vif)) {
1548 		struct ieee80211_bss_conf *link_conf;
1549 
1550 		if (msta) {
1551 			struct ieee80211_link_sta *link_sta;
1552 
1553 			link_sta = rcu_dereference(sta->link[link_id]);
1554 			if (!link_sta)
1555 				link_sta = rcu_dereference(sta->link[deflink_id]);
1556 
1557 			if (link_sta) {
1558 				memcpy(hdr->addr1, link_sta->addr, ETH_ALEN);
1559 				if (ether_addr_equal(sta->addr, hdr->addr3))
1560 					memcpy(hdr->addr3, link_sta->addr, ETH_ALEN);
1561 			}
1562 		}
1563 
1564 		link_conf = rcu_dereference(vif->link_conf[link_id]);
1565 		if (link_conf) {
1566 			memcpy(hdr->addr2, link_conf->addr, ETH_ALEN);
1567 			if (ether_addr_equal(vif->addr, hdr->addr3))
1568 				memcpy(hdr->addr3, link_conf->addr, ETH_ALEN);
1569 		}
1570 	}
1571 
1572 	if (mvif) {
1573 		struct mt76_vif_link *mlink;
1574 
1575 		mlink = rcu_dereference(mvif->mt76.link[link_id]);
1576 		if (mlink && mlink->wcid)
1577 			wcid = mlink->wcid;
1578 
1579 		if (mvif->mt76.roc_phy &&
1580 		    (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN)) {
1581 			mphy = mvif->mt76.roc_phy;
1582 			if (mphy->roc_link)
1583 				wcid = mphy->roc_link->wcid;
1584 		} else if (mlink) {
1585 			mphy = mt76_vif_link_phy(mlink);
1586 		}
1587 	}
1588 
1589 	if (!mphy) {
1590 		ieee80211_free_txskb(hw, skb);
1591 		goto unlock;
1592 	}
1593 
1594 	if (msta) {
1595 		struct mt7996_sta_link *msta_link;
1596 
1597 		msta_link = mt7996_sta_link(msta, link_id);
1598 		if (msta_link)
1599 			wcid = &msta_link->wcid;
1600 	}
1601 	mt76_tx(mphy, control->sta, mt7996_get_tx_wcid(wcid), skb);
1602 unlock:
1603 	rcu_read_unlock();
1604 }
1605 
1606 static int mt7996_set_rts_threshold(struct ieee80211_hw *hw, int radio_idx,
1607 				    u32 val)
1608 {
1609 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
1610 	int i, ret = 0;
1611 
1612 	mutex_lock(&dev->mt76.mutex);
1613 
1614 	for (i = 0; i < hw->wiphy->n_radio; i++) {
1615 		struct mt7996_phy *phy = dev->radio_phy[i];
1616 
1617 		ret = mt7996_mcu_set_rts_thresh(phy, val);
1618 		if (ret)
1619 			break;
1620 	}
1621 
1622 	mutex_unlock(&dev->mt76.mutex);
1623 
1624 	return ret;
1625 }
1626 
1627 static int
1628 mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1629 		    struct ieee80211_ampdu_params *params)
1630 {
1631 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
1632 	struct ieee80211_sta *sta = params->sta;
1633 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
1634 	struct ieee80211_txq *txq = sta->txq[params->tid];
1635 	u16 tid = params->tid;
1636 	u16 ssn = params->ssn;
1637 	struct mt76_txq *mtxq;
1638 	int ret = 0;
1639 
1640 	if (!txq)
1641 		return -EINVAL;
1642 
1643 	mtxq = (struct mt76_txq *)txq->drv_priv;
1644 
1645 	mutex_lock(&dev->mt76.mutex);
1646 
1647 	switch (params->action) {
1648 	case IEEE80211_AMPDU_RX_START:
1649 		/* Since packets belonging to the same TID can be split over
1650 		 * multiple links, store the AMPDU state for reordering in the
1651 		 * primary link
1652 		 */
1653 		mt76_rx_aggr_start(&dev->mt76, &msta->deflink.wcid, tid,
1654 				   ssn, params->buf_size);
1655 		ret = mt7996_mcu_add_rx_ba(dev, params, vif, true);
1656 		break;
1657 	case IEEE80211_AMPDU_RX_STOP:
1658 		mt76_rx_aggr_stop(&dev->mt76, &msta->deflink.wcid, tid);
1659 		ret = mt7996_mcu_add_rx_ba(dev, params, vif, false);
1660 		break;
1661 	case IEEE80211_AMPDU_TX_OPERATIONAL:
1662 		mtxq->aggr = true;
1663 		mtxq->send_bar = false;
1664 		ret = mt7996_mcu_add_tx_ba(dev, params, vif, true);
1665 		break;
1666 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
1667 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
1668 		mtxq->aggr = false;
1669 		clear_bit(tid, &msta->deflink.wcid.ampdu_state);
1670 		ret = mt7996_mcu_add_tx_ba(dev, params, vif, false);
1671 		break;
1672 	case IEEE80211_AMPDU_TX_START:
1673 		set_bit(tid, &msta->deflink.wcid.ampdu_state);
1674 		ret = IEEE80211_AMPDU_TX_START_IMMEDIATE;
1675 		break;
1676 	case IEEE80211_AMPDU_TX_STOP_CONT:
1677 		mtxq->aggr = false;
1678 		clear_bit(tid, &msta->deflink.wcid.ampdu_state);
1679 		ret = mt7996_mcu_add_tx_ba(dev, params, vif, false);
1680 		ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
1681 		break;
1682 	}
1683 
1684 	mutex_unlock(&dev->mt76.mutex);
1685 
1686 	return ret;
1687 }
1688 
1689 static int
1690 mt7996_get_stats(struct ieee80211_hw *hw,
1691 		 struct ieee80211_low_level_stats *stats)
1692 {
1693 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
1694 	int i;
1695 
1696 	mutex_lock(&dev->mt76.mutex);
1697 
1698 	memset(stats, 0, sizeof(*stats));
1699 	for (i = 0; i < hw->wiphy->n_radio; i++) {
1700 		struct mt7996_phy *phy = dev->radio_phy[i];
1701 		struct mt76_mib_stats *mib = &phy->mib;
1702 
1703 		stats->dot11RTSSuccessCount += mib->rts_cnt;
1704 		stats->dot11RTSFailureCount += mib->rts_retries_cnt;
1705 		stats->dot11FCSErrorCount += mib->fcs_err_cnt;
1706 		stats->dot11ACKFailureCount += mib->ack_fail_cnt;
1707 	}
1708 
1709 	mutex_unlock(&dev->mt76.mutex);
1710 
1711 	return 0;
1712 }
1713 
1714 u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif_link *link)
1715 {
1716 	struct mt7996_phy *phy = mt7996_vif_link_phy(link);
1717 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
1718 	union {
1719 		u64 t64;
1720 		u32 t32[2];
1721 	} tsf;
1722 	u16 n;
1723 
1724 	if (!phy)
1725 		return 0;
1726 
1727 	lockdep_assert_held(&dev->mt76.mutex);
1728 
1729 	n = link->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
1730 					       : link->mt76.omac_idx;
1731 	/* TSF software read */
1732 	mt76_rmw(dev, MT_LPON_TCR(phy->mt76->band_idx, n), MT_LPON_TCR_SW_MODE,
1733 		 MT_LPON_TCR_SW_READ);
1734 	tsf.t32[0] = mt76_rr(dev, MT_LPON_UTTR0(phy->mt76->band_idx));
1735 	tsf.t32[1] = mt76_rr(dev, MT_LPON_UTTR1(phy->mt76->band_idx));
1736 
1737 	return tsf.t64;
1738 }
1739 
1740 static u64
1741 mt7996_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
1742 {
1743 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
1744 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
1745 	u64 ret;
1746 
1747 	mutex_lock(&dev->mt76.mutex);
1748 	ret = __mt7996_get_tsf(hw, &mvif->deflink);
1749 	mutex_unlock(&dev->mt76.mutex);
1750 
1751 	return ret;
1752 }
1753 
1754 static void
1755 mt7996_set_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1756 	       u64 timestamp)
1757 {
1758 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
1759 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
1760 	struct mt7996_vif_link *link;
1761 	struct mt7996_phy *phy;
1762 	union {
1763 		u64 t64;
1764 		u32 t32[2];
1765 	} tsf = { .t64 = timestamp, };
1766 	u16 n;
1767 
1768 	mutex_lock(&dev->mt76.mutex);
1769 
1770 	link = mt7996_vif_link(dev, vif, mvif->mt76.deflink_id);
1771 	if (!link)
1772 		goto unlock;
1773 
1774 	n = link->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
1775 					       : link->mt76.omac_idx;
1776 	phy = mt7996_vif_link_phy(link);
1777 	if (!phy)
1778 		goto unlock;
1779 
1780 	mt76_wr(dev, MT_LPON_UTTR0(phy->mt76->band_idx), tsf.t32[0]);
1781 	mt76_wr(dev, MT_LPON_UTTR1(phy->mt76->band_idx), tsf.t32[1]);
1782 	/* TSF software overwrite */
1783 	mt76_rmw(dev, MT_LPON_TCR(phy->mt76->band_idx, n), MT_LPON_TCR_SW_MODE,
1784 		 MT_LPON_TCR_SW_WRITE);
1785 
1786 unlock:
1787 	mutex_unlock(&dev->mt76.mutex);
1788 }
1789 
1790 static void
1791 mt7996_offset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1792 		  s64 timestamp)
1793 {
1794 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
1795 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
1796 	struct mt7996_vif_link *link;
1797 	struct mt7996_phy *phy;
1798 	union {
1799 		u64 t64;
1800 		u32 t32[2];
1801 	} tsf = { .t64 = timestamp, };
1802 	u16 n;
1803 
1804 	mutex_lock(&dev->mt76.mutex);
1805 
1806 	link = mt7996_vif_link(dev, vif, mvif->mt76.deflink_id);
1807 	if (!link)
1808 		goto unlock;
1809 
1810 	phy = mt7996_vif_link_phy(link);
1811 	if (!phy)
1812 		goto unlock;
1813 
1814 	n = link->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
1815 					       : link->mt76.omac_idx;
1816 	mt76_wr(dev, MT_LPON_UTTR0(phy->mt76->band_idx), tsf.t32[0]);
1817 	mt76_wr(dev, MT_LPON_UTTR1(phy->mt76->band_idx), tsf.t32[1]);
1818 	/* TSF software adjust*/
1819 	mt76_rmw(dev, MT_LPON_TCR(phy->mt76->band_idx, n), MT_LPON_TCR_SW_MODE,
1820 		 MT_LPON_TCR_SW_ADJUST);
1821 
1822 unlock:
1823 	mutex_unlock(&dev->mt76.mutex);
1824 }
1825 
1826 static void
1827 mt7996_set_coverage_class(struct ieee80211_hw *hw, int radio_idx,
1828 			  s16 coverage_class)
1829 {
1830 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
1831 	struct mt7996_phy *phy;
1832 
1833 	mutex_lock(&dev->mt76.mutex);
1834 	mt7996_for_each_phy(dev, phy) {
1835 		phy->coverage_class = max_t(s16, coverage_class, 0);
1836 		mt7996_mac_set_coverage_class(phy);
1837 	}
1838 	mutex_unlock(&dev->mt76.mutex);
1839 }
1840 
1841 static int
1842 mt7996_set_antenna(struct ieee80211_hw *hw, int radio_idx,
1843 		   u32 tx_ant, u32 rx_ant)
1844 {
1845 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
1846 	int i;
1847 
1848 	if (tx_ant != rx_ant)
1849 		return -EINVAL;
1850 
1851 	for (i = 0; i < hw->wiphy->n_radio; i++) {
1852 		struct mt7996_phy *phy = dev->radio_phy[i];
1853 
1854 		if (!(tx_ant & phy->orig_chainmask))
1855 			return -EINVAL;
1856 	}
1857 
1858 	mutex_lock(&dev->mt76.mutex);
1859 
1860 	for (i = 0; i < hw->wiphy->n_radio; i++) {
1861 		struct mt7996_phy *phy = dev->radio_phy[i];
1862 		u8 band_idx = phy->mt76->band_idx;
1863 		u8 shift = dev->chainshift[band_idx];
1864 
1865 		phy->mt76->chainmask = tx_ant & phy->orig_chainmask;
1866 		phy->mt76->antenna_mask = (phy->mt76->chainmask >> shift) &
1867 					  phy->orig_antenna_mask;
1868 
1869 		mt76_set_stream_caps(phy->mt76, true);
1870 		mt7996_set_stream_vht_txbf_caps(phy);
1871 		mt7996_set_stream_he_eht_caps(phy);
1872 		mt7996_mcu_set_txpower_sku(phy);
1873 	}
1874 
1875 	mutex_unlock(&dev->mt76.mutex);
1876 
1877 	return 0;
1878 }
1879 
1880 static void mt7996_sta_statistics(struct ieee80211_hw *hw,
1881 				  struct ieee80211_vif *vif,
1882 				  struct ieee80211_sta *sta,
1883 				  struct station_info *sinfo)
1884 {
1885 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
1886 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
1887 	struct mt7996_sta_link *msta_link = &msta->deflink;
1888 	struct rate_info *txrate = &msta_link->wcid.rate;
1889 
1890 	if (txrate->legacy || txrate->flags) {
1891 		if (txrate->legacy) {
1892 			sinfo->txrate.legacy = txrate->legacy;
1893 		} else {
1894 			sinfo->txrate.mcs = txrate->mcs;
1895 			sinfo->txrate.nss = txrate->nss;
1896 			sinfo->txrate.bw = txrate->bw;
1897 			sinfo->txrate.he_gi = txrate->he_gi;
1898 			sinfo->txrate.he_dcm = txrate->he_dcm;
1899 			sinfo->txrate.he_ru_alloc = txrate->he_ru_alloc;
1900 			sinfo->txrate.eht_gi = txrate->eht_gi;
1901 		}
1902 		sinfo->txrate.flags = txrate->flags;
1903 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
1904 	}
1905 
1906 	sinfo->tx_failed = msta_link->wcid.stats.tx_failed;
1907 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
1908 
1909 	sinfo->tx_retries = msta_link->wcid.stats.tx_retries;
1910 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
1911 
1912 	sinfo->ack_signal = (s8)msta_link->ack_signal;
1913 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL);
1914 
1915 	sinfo->avg_ack_signal =
1916 		-(s8)ewma_avg_signal_read(&msta_link->avg_ack_signal);
1917 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL_AVG);
1918 
1919 	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
1920 		sinfo->tx_bytes = msta_link->wcid.stats.tx_bytes;
1921 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES64);
1922 
1923 		sinfo->rx_bytes = msta_link->wcid.stats.rx_bytes;
1924 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES64);
1925 
1926 		sinfo->tx_packets = msta_link->wcid.stats.tx_packets;
1927 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
1928 
1929 		sinfo->rx_packets = msta_link->wcid.stats.rx_packets;
1930 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
1931 	}
1932 }
1933 
1934 static void mt7996_link_rate_ctrl_update(void *data,
1935 					 struct mt7996_sta_link *msta_link)
1936 {
1937 	struct mt7996_sta *msta = msta_link->sta;
1938 	struct mt7996_phy *phy = mt7996_vif_link_phy(&msta->vif->deflink);
1939 	struct mt7996_dev *dev;
1940 	u32 *changed = data;
1941 
1942 	if (!phy)
1943 		return;
1944 
1945 	dev = phy->dev;
1946 	spin_lock_bh(&dev->mt76.sta_poll_lock);
1947 
1948 	msta_link->changed |= *changed;
1949 	if (list_empty(&msta_link->rc_list))
1950 		list_add_tail(&msta_link->rc_list, &dev->sta_rc_list);
1951 
1952 	spin_unlock_bh(&dev->mt76.sta_poll_lock);
1953 }
1954 
1955 static void mt7996_link_sta_rc_update(struct ieee80211_hw *hw,
1956 				      struct ieee80211_vif *vif,
1957 				      struct ieee80211_link_sta *link_sta,
1958 				      u32 changed)
1959 {
1960 	struct ieee80211_sta *sta = link_sta->sta;
1961 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
1962 	struct mt7996_sta_link *msta_link;
1963 
1964 	rcu_read_lock();
1965 
1966 	msta_link = mt7996_sta_link(msta, link_sta->link_id);
1967 	if (msta_link) {
1968 		struct mt7996_dev *dev = mt7996_hw_dev(hw);
1969 
1970 		mt7996_link_rate_ctrl_update(&changed, msta_link);
1971 		ieee80211_queue_work(hw, &dev->rc_work);
1972 	}
1973 
1974 	rcu_read_unlock();
1975 }
1976 
1977 static void mt7996_sta_rate_ctrl_update(void *data, struct ieee80211_sta *sta)
1978 {
1979 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
1980 	struct mt7996_sta_link *msta_link;
1981 	struct mt7996_vif *mvif = data;
1982 	u32 changed = IEEE80211_RC_SUPP_RATES_CHANGED;
1983 
1984 	if (msta->vif != mvif)
1985 		return;
1986 
1987 	msta_link = mt7996_sta_link(msta, msta->deflink_id);
1988 	if (msta_link)
1989 		mt7996_link_rate_ctrl_update(&changed, msta_link);
1990 }
1991 
1992 static int
1993 mt7996_set_bitrate_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1994 			const struct cfg80211_bitrate_mask *mask)
1995 {
1996 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
1997 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
1998 
1999 	mvif->deflink.bitrate_mask = *mask;
2000 
2001 	/* if multiple rates across different preambles are given we can
2002 	 * reconfigure this info with all peers using sta_rec command with
2003 	 * the below exception cases.
2004 	 * - single rate : if a rate is passed along with different preambles,
2005 	 * we select the highest one as fixed rate. i.e VHT MCS for VHT peers.
2006 	 * - multiple rates: if it's not in range format i.e 0-{7,8,9} for VHT
2007 	 * then multiple MCS setting (MCS 4,5,6) is not supported.
2008 	 */
2009 	ieee80211_iterate_stations_atomic(hw, mt7996_sta_rate_ctrl_update,
2010 					  mvif);
2011 	ieee80211_queue_work(hw, &dev->rc_work);
2012 
2013 	return 0;
2014 }
2015 
2016 static void mt7996_sta_set_4addr(struct ieee80211_hw *hw,
2017 				 struct ieee80211_vif *vif,
2018 				 struct ieee80211_sta *sta,
2019 				 bool enabled)
2020 {
2021 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
2022 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
2023 	struct ieee80211_link_sta *link_sta;
2024 	unsigned int link_id;
2025 
2026 	mutex_lock(&dev->mt76.mutex);
2027 
2028 	for_each_sta_active_link(vif, sta, link_sta, link_id) {
2029 		struct mt7996_sta_link *msta_link;
2030 		struct mt7996_vif_link *link;
2031 
2032 		link = mt7996_vif_link(dev, vif, link_id);
2033 		if (!link)
2034 			continue;
2035 
2036 		msta_link = mt7996_sta_link_protected(dev, msta, link_id);
2037 		if (!msta_link)
2038 			continue;
2039 
2040 		if (enabled)
2041 			set_bit(MT_WCID_FLAG_4ADDR, &msta_link->wcid.flags);
2042 		else
2043 			clear_bit(MT_WCID_FLAG_4ADDR, &msta_link->wcid.flags);
2044 
2045 		if (!msta_link->wcid.sta)
2046 			continue;
2047 
2048 		mt7996_mcu_wtbl_update_hdr_trans(dev, vif, link, msta_link);
2049 
2050 		/* HW cannot derive the BSSID from 4-address non-AMSDU frames,
2051 		 * so PS exit is missed on links other than the setup link.
2052 		 * Let the firmware wake those links instead.
2053 		 */
2054 		if (enabled && msta->deflink_id != link_id &&
2055 		    is_mt7996(&dev->mt76))
2056 			mt7996_mcu_ps_leave(dev, link, msta_link);
2057 	}
2058 
2059 	mutex_unlock(&dev->mt76.mutex);
2060 }
2061 
2062 static void mt7996_sta_set_decap_offload(struct ieee80211_hw *hw,
2063 					 struct ieee80211_vif *vif,
2064 					 struct ieee80211_sta *sta,
2065 					 bool enabled)
2066 {
2067 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
2068 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
2069 	struct ieee80211_link_sta *link_sta;
2070 	unsigned int link_id;
2071 
2072 	mutex_lock(&dev->mt76.mutex);
2073 
2074 	for_each_sta_active_link(vif, sta, link_sta, link_id) {
2075 		struct mt7996_sta_link *msta_link;
2076 		struct mt7996_vif_link *link;
2077 
2078 		link = mt7996_vif_link(dev, vif, link_id);
2079 		if (!link)
2080 			continue;
2081 
2082 		msta_link = mt7996_sta_link_protected(dev, msta, link_id);
2083 		if (!msta_link)
2084 			continue;
2085 
2086 		if (enabled)
2087 			set_bit(MT_WCID_FLAG_HDR_TRANS,
2088 				&msta_link->wcid.flags);
2089 		else
2090 			clear_bit(MT_WCID_FLAG_HDR_TRANS,
2091 				  &msta_link->wcid.flags);
2092 
2093 		if (!msta_link->wcid.sta)
2094 			continue;
2095 
2096 		mt7996_mcu_wtbl_update_hdr_trans(dev, vif, link, msta_link);
2097 	}
2098 
2099 	mutex_unlock(&dev->mt76.mutex);
2100 }
2101 
2102 static const char mt7996_gstrings_stats[][ETH_GSTRING_LEN] = {
2103 	"tx_ampdu_cnt",
2104 	"tx_stop_q_empty_cnt",
2105 	"tx_mpdu_attempts",
2106 	"tx_mpdu_success",
2107 	"tx_rwp_fail_cnt",
2108 	"tx_rwp_need_cnt",
2109 	"tx_pkt_ebf_cnt",
2110 	"tx_pkt_ibf_cnt",
2111 	"tx_ampdu_len:0-1",
2112 	"tx_ampdu_len:2-10",
2113 	"tx_ampdu_len:11-19",
2114 	"tx_ampdu_len:20-28",
2115 	"tx_ampdu_len:29-37",
2116 	"tx_ampdu_len:38-46",
2117 	"tx_ampdu_len:47-55",
2118 	"tx_ampdu_len:56-79",
2119 	"tx_ampdu_len:80-103",
2120 	"tx_ampdu_len:104-127",
2121 	"tx_ampdu_len:128-151",
2122 	"tx_ampdu_len:152-175",
2123 	"tx_ampdu_len:176-199",
2124 	"tx_ampdu_len:200-223",
2125 	"tx_ampdu_len:224-247",
2126 	"ba_miss_count",
2127 	"tx_beamformer_ppdu_iBF",
2128 	"tx_beamformer_ppdu_eBF",
2129 	"tx_beamformer_rx_feedback_all",
2130 	"tx_beamformer_rx_feedback_he",
2131 	"tx_beamformer_rx_feedback_vht",
2132 	"tx_beamformer_rx_feedback_ht",
2133 	"tx_beamformer_rx_feedback_bw", /* zero based idx: 20, 40, 80, 160 */
2134 	"tx_beamformer_rx_feedback_nc",
2135 	"tx_beamformer_rx_feedback_nr",
2136 	"tx_beamformee_ok_feedback_pkts",
2137 	"tx_beamformee_feedback_trig",
2138 	"tx_mu_beamforming",
2139 	"tx_mu_mpdu",
2140 	"tx_mu_successful_mpdu",
2141 	"tx_su_successful_mpdu",
2142 	"tx_msdu_pack_1",
2143 	"tx_msdu_pack_2",
2144 	"tx_msdu_pack_3",
2145 	"tx_msdu_pack_4",
2146 	"tx_msdu_pack_5",
2147 	"tx_msdu_pack_6",
2148 	"tx_msdu_pack_7",
2149 	"tx_msdu_pack_8",
2150 
2151 	/* rx counters */
2152 	"rx_fifo_full_cnt",
2153 	"rx_mpdu_cnt",
2154 	"channel_idle_cnt",
2155 	"rx_vector_mismatch_cnt",
2156 	"rx_delimiter_fail_cnt",
2157 	"rx_len_mismatch_cnt",
2158 	"rx_ampdu_cnt",
2159 	"rx_ampdu_bytes_cnt",
2160 	"rx_ampdu_valid_subframe_cnt",
2161 	"rx_ampdu_valid_subframe_b_cnt",
2162 	"rx_pfdrop_cnt",
2163 	"rx_vec_queue_overflow_drop_cnt",
2164 	"rx_ba_cnt",
2165 
2166 	/* per vif counters */
2167 	"v_tx_mode_cck",
2168 	"v_tx_mode_ofdm",
2169 	"v_tx_mode_ht",
2170 	"v_tx_mode_ht_gf",
2171 	"v_tx_mode_vht",
2172 	"v_tx_mode_he_su",
2173 	"v_tx_mode_he_ext_su",
2174 	"v_tx_mode_he_tb",
2175 	"v_tx_mode_he_mu",
2176 	"v_tx_mode_eht_su",
2177 	"v_tx_mode_eht_trig",
2178 	"v_tx_mode_eht_mu",
2179 	"v_tx_bw_20",
2180 	"v_tx_bw_40",
2181 	"v_tx_bw_80",
2182 	"v_tx_bw_160",
2183 	"v_tx_bw_320",
2184 	"v_tx_mcs_0",
2185 	"v_tx_mcs_1",
2186 	"v_tx_mcs_2",
2187 	"v_tx_mcs_3",
2188 	"v_tx_mcs_4",
2189 	"v_tx_mcs_5",
2190 	"v_tx_mcs_6",
2191 	"v_tx_mcs_7",
2192 	"v_tx_mcs_8",
2193 	"v_tx_mcs_9",
2194 	"v_tx_mcs_10",
2195 	"v_tx_mcs_11",
2196 	"v_tx_mcs_12",
2197 	"v_tx_mcs_13",
2198 	"v_tx_nss_1",
2199 	"v_tx_nss_2",
2200 	"v_tx_nss_3",
2201 	"v_tx_nss_4",
2202 };
2203 
2204 #define MT7996_SSTATS_LEN ARRAY_SIZE(mt7996_gstrings_stats)
2205 
2206 /* Ethtool related API */
2207 static
2208 void mt7996_get_et_strings(struct ieee80211_hw *hw,
2209 			   struct ieee80211_vif *vif,
2210 			   u32 sset, u8 *data)
2211 {
2212 	if (sset == ETH_SS_STATS)
2213 		memcpy(data, mt7996_gstrings_stats,
2214 		       sizeof(mt7996_gstrings_stats));
2215 }
2216 
2217 static
2218 int mt7996_get_et_sset_count(struct ieee80211_hw *hw,
2219 			     struct ieee80211_vif *vif, int sset)
2220 {
2221 	if (sset == ETH_SS_STATS)
2222 		return MT7996_SSTATS_LEN;
2223 
2224 	return 0;
2225 }
2226 
2227 static void mt7996_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
2228 {
2229 	struct mt76_ethtool_worker_info *wi = wi_data;
2230 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
2231 	struct mt7996_sta_link *msta_link = &msta->deflink;
2232 
2233 	if (msta->vif->deflink.mt76.idx != wi->idx)
2234 		return;
2235 
2236 	mt76_ethtool_worker(wi, &msta_link->wcid.stats, true);
2237 }
2238 
2239 static
2240 void mt7996_get_et_stats(struct ieee80211_hw *hw,
2241 			 struct ieee80211_vif *vif,
2242 			 struct ethtool_stats *stats, u64 *data)
2243 {
2244 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
2245 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
2246 	struct mt7996_phy *phy = mt7996_vif_link_phy(&mvif->deflink);
2247 	struct mt76_mib_stats *mib = &phy->mib;
2248 	struct mt76_ethtool_worker_info wi = {
2249 		.data = data,
2250 		.idx = mvif->deflink.mt76.idx,
2251 	};
2252 	/* See mt7996_ampdu_stat_read_phy, etc */
2253 	int i, ei = 0;
2254 
2255 	if (!phy)
2256 		return;
2257 
2258 	mutex_lock(&dev->mt76.mutex);
2259 
2260 	mt7996_mac_update_stats(phy);
2261 
2262 	data[ei++] = mib->tx_ampdu_cnt;
2263 	data[ei++] = mib->tx_stop_q_empty_cnt;
2264 	data[ei++] = mib->tx_mpdu_attempts_cnt;
2265 	data[ei++] = mib->tx_mpdu_success_cnt;
2266 	data[ei++] = mib->tx_rwp_fail_cnt;
2267 	data[ei++] = mib->tx_rwp_need_cnt;
2268 	data[ei++] = mib->tx_bf_ebf_ppdu_cnt;
2269 	data[ei++] = mib->tx_bf_ibf_ppdu_cnt;
2270 
2271 	/* Tx ampdu stat */
2272 	for (i = 0; i < 15 /*ARRAY_SIZE(bound)*/; i++)
2273 		data[ei++] = phy->mt76->aggr_stats[i];
2274 	data[ei++] = phy->mib.ba_miss_cnt;
2275 
2276 	/* Tx Beamformer monitor */
2277 	data[ei++] = mib->tx_bf_ibf_ppdu_cnt;
2278 	data[ei++] = mib->tx_bf_ebf_ppdu_cnt;
2279 
2280 	/* Tx Beamformer Rx feedback monitor */
2281 	data[ei++] = mib->tx_bf_rx_fb_all_cnt;
2282 	data[ei++] = mib->tx_bf_rx_fb_he_cnt;
2283 	data[ei++] = mib->tx_bf_rx_fb_vht_cnt;
2284 	data[ei++] = mib->tx_bf_rx_fb_ht_cnt;
2285 
2286 	data[ei++] = mib->tx_bf_rx_fb_bw;
2287 	data[ei++] = mib->tx_bf_rx_fb_nc_cnt;
2288 	data[ei++] = mib->tx_bf_rx_fb_nr_cnt;
2289 
2290 	/* Tx Beamformee Rx NDPA & Tx feedback report */
2291 	data[ei++] = mib->tx_bf_fb_cpl_cnt;
2292 	data[ei++] = mib->tx_bf_fb_trig_cnt;
2293 
2294 	/* Tx SU & MU counters */
2295 	data[ei++] = mib->tx_mu_bf_cnt;
2296 	data[ei++] = mib->tx_mu_mpdu_cnt;
2297 	data[ei++] = mib->tx_mu_acked_mpdu_cnt;
2298 	data[ei++] = mib->tx_su_acked_mpdu_cnt;
2299 
2300 	/* Tx amsdu info (pack-count histogram) */
2301 	for (i = 0; i < ARRAY_SIZE(mib->tx_amsdu); i++)
2302 		data[ei++] = mib->tx_amsdu[i];
2303 
2304 	/* rx counters */
2305 	data[ei++] = mib->rx_fifo_full_cnt;
2306 	data[ei++] = mib->rx_mpdu_cnt;
2307 	data[ei++] = mib->channel_idle_cnt;
2308 	data[ei++] = mib->rx_vector_mismatch_cnt;
2309 	data[ei++] = mib->rx_delimiter_fail_cnt;
2310 	data[ei++] = mib->rx_len_mismatch_cnt;
2311 	data[ei++] = mib->rx_ampdu_cnt;
2312 	data[ei++] = mib->rx_ampdu_bytes_cnt;
2313 	data[ei++] = mib->rx_ampdu_valid_subframe_cnt;
2314 	data[ei++] = mib->rx_ampdu_valid_subframe_bytes_cnt;
2315 	data[ei++] = mib->rx_pfdrop_cnt;
2316 	data[ei++] = mib->rx_vec_queue_overflow_drop_cnt;
2317 	data[ei++] = mib->rx_ba_cnt;
2318 
2319 	/* Add values for all stations owned by this vif */
2320 	wi.initial_stat_idx = ei;
2321 	ieee80211_iterate_stations_atomic(hw, mt7996_ethtool_worker, &wi);
2322 
2323 	mutex_unlock(&dev->mt76.mutex);
2324 
2325 	if (wi.sta_count == 0)
2326 		return;
2327 
2328 	ei += wi.worker_stat_count;
2329 	if (ei != MT7996_SSTATS_LEN)
2330 		dev_err(dev->mt76.dev, "ei: %d  MT7996_SSTATS_LEN: %d",
2331 			ei, (int)MT7996_SSTATS_LEN);
2332 }
2333 
2334 static void
2335 mt7996_twt_teardown_request(struct ieee80211_hw *hw,
2336 			    struct ieee80211_sta *sta,
2337 			    u8 flowid)
2338 {
2339 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
2340 	struct mt7996_sta_link *msta_link = &msta->deflink;
2341 	struct mt7996_vif_link *link = &msta->vif->deflink;
2342 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
2343 
2344 	mutex_lock(&dev->mt76.mutex);
2345 	mt7996_mac_twt_teardown_flow(dev, link, msta_link, flowid);
2346 	mutex_unlock(&dev->mt76.mutex);
2347 }
2348 
2349 static int
2350 mt7996_set_radar_background(struct ieee80211_hw *hw,
2351 			    struct cfg80211_chan_def *chandef)
2352 {
2353 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
2354 	struct mt7996_phy *phy;
2355 	int ret = -EINVAL;
2356 	bool running;
2357 
2358 	if (chandef)
2359 		phy = mt7996_band_phy(dev, chandef->chan->band);
2360 	else
2361 		phy = dev->rdd2_phy;
2362 	if (!phy)
2363 	    return -EINVAL;
2364 
2365 	mutex_lock(&dev->mt76.mutex);
2366 
2367 	if (dev->mt76.region == NL80211_DFS_UNSET)
2368 		goto out;
2369 
2370 	if (dev->rdd2_phy && dev->rdd2_phy != phy) {
2371 		/* rdd2 is already locked */
2372 		ret = -EBUSY;
2373 		goto out;
2374 	}
2375 
2376 	/* rdd2 already configured on a radar channel */
2377 	running = dev->rdd2_phy &&
2378 		  cfg80211_chandef_valid(&dev->rdd2_chandef) &&
2379 		  !!(dev->rdd2_chandef.chan->flags & IEEE80211_CHAN_RADAR);
2380 
2381 	if (!chandef || running ||
2382 	    !(chandef->chan->flags & IEEE80211_CHAN_RADAR)) {
2383 		ret = mt7996_mcu_rdd_background_enable(phy, NULL);
2384 		if (ret)
2385 			goto out;
2386 
2387 		if (!running)
2388 			goto update_phy;
2389 	}
2390 
2391 	ret = mt7996_mcu_rdd_background_enable(phy, chandef);
2392 	if (ret)
2393 		goto out;
2394 
2395 update_phy:
2396 	dev->rdd2_phy = chandef ? phy : NULL;
2397 	if (chandef)
2398 		dev->rdd2_chandef = *chandef;
2399 out:
2400 	mutex_unlock(&dev->mt76.mutex);
2401 
2402 	return ret;
2403 }
2404 
2405 static int
2406 mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
2407 			     struct ieee80211_vif *vif,
2408 			     struct ieee80211_sta *sta,
2409 			     struct net_device_path_ctx *ctx,
2410 			     struct net_device_path *path)
2411 {
2412 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
2413 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
2414 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
2415 	struct mt7996_sta_link *msta_link;
2416 	struct mt7996_vif_link *link;
2417 
2418 	link = mt7996_vif_link(dev, vif, msta->deflink_id);
2419 	if (!link)
2420 		return -EIO;
2421 
2422 	msta_link = mt7996_sta_link(msta, msta->deflink_id);
2423 	if (!msta_link)
2424 		return -EIO;
2425 
2426 	if (!msta_link->wcid.sta || msta_link->wcid.idx > MT7996_WTBL_STA)
2427 		return -EIO;
2428 
2429 	if (dev->hif2 &&
2430 	    ((is_mt7996(&dev->mt76) && msta_link->wcid.phy_idx == MT_BAND2) ||
2431 	     (is_mt7992(&dev->mt76) && msta_link->wcid.phy_idx == MT_BAND1)))
2432 		wed = &dev->mt76.mmio.wed_hif2;
2433 
2434 	if (!mtk_wed_device_active(wed) &&
2435 	    !mt76_npu_device_active(&dev->mt76))
2436 		return -ENODEV;
2437 
2438 	path->type = DEV_PATH_MTK_WDMA;
2439 	path->dev = ctx->dev;
2440 #ifdef CONFIG_NET_MEDIATEK_SOC_WED
2441 	if (mtk_wed_device_active(wed))
2442 		path->mtk_wdma.wdma_idx = wed->wdma_idx;
2443 	else
2444 #endif
2445 	if (is_mt7996(&dev->mt76) && mt76_npu_device_active(&dev->mt76) &&
2446 	    msta_link->wcid.phy_idx == MT_BAND2)
2447 		path->mtk_wdma.wdma_idx = 1;
2448 	else
2449 		path->mtk_wdma.wdma_idx = link->mt76.band_idx;
2450 	path->mtk_wdma.bss = link->mt76.idx;
2451 	path->mtk_wdma.queue = 0;
2452 	path->mtk_wdma.wcid = msta_link->wcid.idx;
2453 
2454 	if (ieee80211_hw_check(hw, SUPPORTS_AMSDU_IN_AMPDU) &&
2455 	    mtk_wed_is_amsdu_supported(wed))
2456 		path->mtk_wdma.amsdu = msta_link->wcid.amsdu;
2457 	else
2458 		path->mtk_wdma.amsdu = 0;
2459 	ctx->dev = NULL;
2460 
2461 	return 0;
2462 }
2463 
2464 #if defined(CONFIG_NET_MEDIATEK_SOC_WED) || defined(CONFIG_MT7996_NPU)
2465 static int
2466 mt7996_net_setup_tc(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2467 		    struct net_device *netdev, enum tc_setup_type type,
2468 		    void *type_data)
2469 {
2470 #ifdef CONFIG_NET_MEDIATEK_SOC_WED
2471 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
2472 
2473 	if (mtk_wed_device_active(&dev->mt76.mmio.wed))
2474 		return mt76_wed_net_setup_tc(hw, vif, netdev, type,
2475 					     type_data);
2476 #endif
2477 	return mt76_npu_net_setup_tc(hw, vif, netdev, type, type_data);
2478 }
2479 #endif
2480 
2481 static int
2482 mt7996_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2483 			u16 old_links, u16 new_links,
2484 			struct ieee80211_bss_conf *old[IEEE80211_MLD_MAX_NUM_LINKS])
2485 {
2486 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
2487 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
2488 	int ret = 0;
2489 
2490 	mutex_lock(&dev->mt76.mutex);
2491 
2492 	if (!old_links) {
2493 		int idx;
2494 
2495 		idx = get_own_mld_idx(dev->mld_idx_mask, true);
2496 		if (idx < 0) {
2497 			ret = -ENOSPC;
2498 			goto out;
2499 		}
2500 		mvif->mld_group_idx = idx;
2501 		dev->mld_idx_mask |= BIT_ULL(mvif->mld_group_idx);
2502 
2503 		idx = get_free_idx(dev->mld_remap_idx_mask, 0, 15) - 1;
2504 		if (idx < 0) {
2505 			dev->mld_idx_mask &= ~BIT_ULL(mvif->mld_group_idx);
2506 			ret = -ENOSPC;
2507 			goto out;
2508 		}
2509 		mvif->mld_remap_idx = idx;
2510 		dev->mld_remap_idx_mask |= BIT_ULL(mvif->mld_remap_idx);
2511 	}
2512 
2513 	if (new_links)
2514 		goto out;
2515 
2516 	dev->mld_idx_mask &= ~BIT_ULL(mvif->mld_group_idx);
2517 	dev->mld_remap_idx_mask &= ~BIT_ULL(mvif->mld_remap_idx);
2518 
2519 out:
2520 	mutex_unlock(&dev->mt76.mutex);
2521 
2522 	return ret;
2523 }
2524 
2525 static void
2526 mt7996_reconfig_complete(struct ieee80211_hw *hw,
2527 			 enum ieee80211_reconfig_type reconfig_type)
2528 {
2529 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
2530 	struct mt7996_phy *phy;
2531 
2532 	ieee80211_wake_queues(hw);
2533 	mt7996_for_each_phy(dev, phy)
2534 		ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
2535 					     MT7996_WATCHDOG_TIME);
2536 }
2537 
2538 static int
2539 mt7996_set_eml_op_mode(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2540 		       struct ieee80211_sta *sta,
2541 		       struct ieee80211_eml_params *eml_params)
2542 {
2543 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
2544 	int ret;
2545 
2546 	mutex_lock(&dev->mt76.mutex);
2547 	ret = mt7996_mcu_set_emlsr_mode(dev, vif, sta, eml_params);
2548 	mutex_unlock(&dev->mt76.mutex);
2549 
2550 	return ret;
2551 }
2552 
2553 const struct ieee80211_ops mt7996_ops = {
2554 	.add_chanctx = mt76_add_chanctx,
2555 	.remove_chanctx = mt76_remove_chanctx,
2556 	.change_chanctx = mt76_change_chanctx,
2557 	.assign_vif_chanctx = mt76_assign_vif_chanctx,
2558 	.unassign_vif_chanctx = mt76_unassign_vif_chanctx,
2559 	.switch_vif_chanctx = mt76_switch_vif_chanctx,
2560 	.tx = mt7996_tx,
2561 	.start = mt7996_start,
2562 	.stop = mt7996_stop,
2563 	.add_interface = mt7996_add_interface,
2564 	.remove_interface = mt7996_remove_interface,
2565 	.config = mt7996_config,
2566 	.conf_tx = mt7996_conf_tx,
2567 	.configure_filter = mt7996_configure_filter,
2568 	.vif_cfg_changed = mt7996_vif_cfg_changed,
2569 	.link_info_changed = mt7996_link_info_changed,
2570 	.sta_state = mt7996_sta_state,
2571 	.sta_pre_rcu_remove = mt76_sta_pre_rcu_remove,
2572 	.link_sta_rc_update = mt7996_link_sta_rc_update,
2573 	.set_key = mt7996_set_key,
2574 	.ampdu_action = mt7996_ampdu_action,
2575 	.set_rts_threshold = mt7996_set_rts_threshold,
2576 	.wake_tx_queue = mt76_wake_tx_queue,
2577 	.hw_scan = mt76_hw_scan,
2578 	.cancel_hw_scan = mt76_cancel_hw_scan,
2579 	.remain_on_channel = mt76_remain_on_channel,
2580 	.cancel_remain_on_channel = mt76_cancel_remain_on_channel,
2581 	.release_buffered_frames = mt76_release_buffered_frames,
2582 	.get_txpower = mt7996_get_txpower,
2583 	.channel_switch_beacon = mt7996_channel_switch_beacon,
2584 	.post_channel_switch = mt7996_post_channel_switch,
2585 	.get_stats = mt7996_get_stats,
2586 	.get_et_sset_count = mt7996_get_et_sset_count,
2587 	.get_et_stats = mt7996_get_et_stats,
2588 	.get_et_strings = mt7996_get_et_strings,
2589 	.get_tsf = mt7996_get_tsf,
2590 	.set_tsf = mt7996_set_tsf,
2591 	.offset_tsf = mt7996_offset_tsf,
2592 	.get_survey = mt76_get_survey,
2593 	.get_antenna = mt76_get_antenna,
2594 	.set_antenna = mt7996_set_antenna,
2595 	.set_bitrate_mask = mt7996_set_bitrate_mask,
2596 	.set_coverage_class = mt7996_set_coverage_class,
2597 	.sta_statistics = mt7996_sta_statistics,
2598 	.sta_set_4addr = mt7996_sta_set_4addr,
2599 	.sta_set_decap_offload = mt7996_sta_set_decap_offload,
2600 	.add_twt_setup = mt7996_mac_add_twt_setup,
2601 	.twt_teardown_request = mt7996_twt_teardown_request,
2602 #ifdef CONFIG_MAC80211_DEBUGFS
2603 	.sta_add_debugfs = mt7996_sta_add_debugfs,
2604 	.link_sta_add_debugfs = mt7996_link_sta_add_debugfs,
2605 #endif
2606 	.set_radar_background = mt7996_set_radar_background,
2607 	.net_fill_forward_path = mt7996_net_fill_forward_path,
2608 #if defined(CONFIG_NET_MEDIATEK_SOC_WED) || defined(CONFIG_MT7996_NPU)
2609 	.net_setup_tc = mt7996_net_setup_tc,
2610 #endif
2611 	.change_vif_links = mt7996_change_vif_links,
2612 	.change_sta_links = mt7996_mac_sta_change_links,
2613 	.reconfig_complete = mt7996_reconfig_complete,
2614 	.set_eml_op_mode = mt7996_set_eml_op_mode,
2615 };
2616