xref: /linux/drivers/net/wireless/realtek/rtw89/core.c (revision a1afb959add1fad43cb337448c244ed70bac3109)
1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 /* Copyright(c) 2019-2020  Realtek Corporation
3  */
4 #include <linux/ip.h>
5 #include <linux/udp.h>
6 
7 #include "cam.h"
8 #include "chan.h"
9 #include "coex.h"
10 #include "core.h"
11 #include "efuse.h"
12 #include "fw.h"
13 #include "mac.h"
14 #include "phy.h"
15 #include "ps.h"
16 #include "reg.h"
17 #include "sar.h"
18 #include "ser.h"
19 #include "txrx.h"
20 #include "util.h"
21 #include "wow.h"
22 
23 static bool rtw89_disable_ps_mode;
24 module_param_named(disable_ps_mode, rtw89_disable_ps_mode, bool, 0644);
25 MODULE_PARM_DESC(disable_ps_mode, "Set Y to disable low power mode");
26 
27 #define RTW89_DEF_CHAN(_freq, _hw_val, _flags, _band)	\
28 	{ .center_freq = _freq, .hw_value = _hw_val, .flags = _flags, .band = _band, }
29 #define RTW89_DEF_CHAN_2G(_freq, _hw_val)	\
30 	RTW89_DEF_CHAN(_freq, _hw_val, 0, NL80211_BAND_2GHZ)
31 #define RTW89_DEF_CHAN_5G(_freq, _hw_val)	\
32 	RTW89_DEF_CHAN(_freq, _hw_val, 0, NL80211_BAND_5GHZ)
33 #define RTW89_DEF_CHAN_5G_NO_HT40MINUS(_freq, _hw_val)	\
34 	RTW89_DEF_CHAN(_freq, _hw_val, IEEE80211_CHAN_NO_HT40MINUS, NL80211_BAND_5GHZ)
35 #define RTW89_DEF_CHAN_6G(_freq, _hw_val)	\
36 	RTW89_DEF_CHAN(_freq, _hw_val, 0, NL80211_BAND_6GHZ)
37 
38 static struct ieee80211_channel rtw89_channels_2ghz[] = {
39 	RTW89_DEF_CHAN_2G(2412, 1),
40 	RTW89_DEF_CHAN_2G(2417, 2),
41 	RTW89_DEF_CHAN_2G(2422, 3),
42 	RTW89_DEF_CHAN_2G(2427, 4),
43 	RTW89_DEF_CHAN_2G(2432, 5),
44 	RTW89_DEF_CHAN_2G(2437, 6),
45 	RTW89_DEF_CHAN_2G(2442, 7),
46 	RTW89_DEF_CHAN_2G(2447, 8),
47 	RTW89_DEF_CHAN_2G(2452, 9),
48 	RTW89_DEF_CHAN_2G(2457, 10),
49 	RTW89_DEF_CHAN_2G(2462, 11),
50 	RTW89_DEF_CHAN_2G(2467, 12),
51 	RTW89_DEF_CHAN_2G(2472, 13),
52 	RTW89_DEF_CHAN_2G(2484, 14),
53 };
54 
55 static struct ieee80211_channel rtw89_channels_5ghz[] = {
56 	RTW89_DEF_CHAN_5G(5180, 36),
57 	RTW89_DEF_CHAN_5G(5200, 40),
58 	RTW89_DEF_CHAN_5G(5220, 44),
59 	RTW89_DEF_CHAN_5G(5240, 48),
60 	RTW89_DEF_CHAN_5G(5260, 52),
61 	RTW89_DEF_CHAN_5G(5280, 56),
62 	RTW89_DEF_CHAN_5G(5300, 60),
63 	RTW89_DEF_CHAN_5G(5320, 64),
64 	RTW89_DEF_CHAN_5G(5500, 100),
65 	RTW89_DEF_CHAN_5G(5520, 104),
66 	RTW89_DEF_CHAN_5G(5540, 108),
67 	RTW89_DEF_CHAN_5G(5560, 112),
68 	RTW89_DEF_CHAN_5G(5580, 116),
69 	RTW89_DEF_CHAN_5G(5600, 120),
70 	RTW89_DEF_CHAN_5G(5620, 124),
71 	RTW89_DEF_CHAN_5G(5640, 128),
72 	RTW89_DEF_CHAN_5G(5660, 132),
73 	RTW89_DEF_CHAN_5G(5680, 136),
74 	RTW89_DEF_CHAN_5G(5700, 140),
75 	RTW89_DEF_CHAN_5G(5720, 144),
76 	RTW89_DEF_CHAN_5G(5745, 149),
77 	RTW89_DEF_CHAN_5G(5765, 153),
78 	RTW89_DEF_CHAN_5G(5785, 157),
79 	RTW89_DEF_CHAN_5G(5805, 161),
80 	RTW89_DEF_CHAN_5G_NO_HT40MINUS(5825, 165),
81 	RTW89_DEF_CHAN_5G(5845, 169),
82 	RTW89_DEF_CHAN_5G(5865, 173),
83 	RTW89_DEF_CHAN_5G(5885, 177),
84 };
85 
86 static_assert(RTW89_5GHZ_UNII4_START_INDEX + RTW89_5GHZ_UNII4_CHANNEL_NUM ==
87 	      ARRAY_SIZE(rtw89_channels_5ghz));
88 
89 static struct ieee80211_channel rtw89_channels_6ghz[] = {
90 	RTW89_DEF_CHAN_6G(5955, 1),
91 	RTW89_DEF_CHAN_6G(5975, 5),
92 	RTW89_DEF_CHAN_6G(5995, 9),
93 	RTW89_DEF_CHAN_6G(6015, 13),
94 	RTW89_DEF_CHAN_6G(6035, 17),
95 	RTW89_DEF_CHAN_6G(6055, 21),
96 	RTW89_DEF_CHAN_6G(6075, 25),
97 	RTW89_DEF_CHAN_6G(6095, 29),
98 	RTW89_DEF_CHAN_6G(6115, 33),
99 	RTW89_DEF_CHAN_6G(6135, 37),
100 	RTW89_DEF_CHAN_6G(6155, 41),
101 	RTW89_DEF_CHAN_6G(6175, 45),
102 	RTW89_DEF_CHAN_6G(6195, 49),
103 	RTW89_DEF_CHAN_6G(6215, 53),
104 	RTW89_DEF_CHAN_6G(6235, 57),
105 	RTW89_DEF_CHAN_6G(6255, 61),
106 	RTW89_DEF_CHAN_6G(6275, 65),
107 	RTW89_DEF_CHAN_6G(6295, 69),
108 	RTW89_DEF_CHAN_6G(6315, 73),
109 	RTW89_DEF_CHAN_6G(6335, 77),
110 	RTW89_DEF_CHAN_6G(6355, 81),
111 	RTW89_DEF_CHAN_6G(6375, 85),
112 	RTW89_DEF_CHAN_6G(6395, 89),
113 	RTW89_DEF_CHAN_6G(6415, 93),
114 	RTW89_DEF_CHAN_6G(6435, 97),
115 	RTW89_DEF_CHAN_6G(6455, 101),
116 	RTW89_DEF_CHAN_6G(6475, 105),
117 	RTW89_DEF_CHAN_6G(6495, 109),
118 	RTW89_DEF_CHAN_6G(6515, 113),
119 	RTW89_DEF_CHAN_6G(6535, 117),
120 	RTW89_DEF_CHAN_6G(6555, 121),
121 	RTW89_DEF_CHAN_6G(6575, 125),
122 	RTW89_DEF_CHAN_6G(6595, 129),
123 	RTW89_DEF_CHAN_6G(6615, 133),
124 	RTW89_DEF_CHAN_6G(6635, 137),
125 	RTW89_DEF_CHAN_6G(6655, 141),
126 	RTW89_DEF_CHAN_6G(6675, 145),
127 	RTW89_DEF_CHAN_6G(6695, 149),
128 	RTW89_DEF_CHAN_6G(6715, 153),
129 	RTW89_DEF_CHAN_6G(6735, 157),
130 	RTW89_DEF_CHAN_6G(6755, 161),
131 	RTW89_DEF_CHAN_6G(6775, 165),
132 	RTW89_DEF_CHAN_6G(6795, 169),
133 	RTW89_DEF_CHAN_6G(6815, 173),
134 	RTW89_DEF_CHAN_6G(6835, 177),
135 	RTW89_DEF_CHAN_6G(6855, 181),
136 	RTW89_DEF_CHAN_6G(6875, 185),
137 	RTW89_DEF_CHAN_6G(6895, 189),
138 	RTW89_DEF_CHAN_6G(6915, 193),
139 	RTW89_DEF_CHAN_6G(6935, 197),
140 	RTW89_DEF_CHAN_6G(6955, 201),
141 	RTW89_DEF_CHAN_6G(6975, 205),
142 	RTW89_DEF_CHAN_6G(6995, 209),
143 	RTW89_DEF_CHAN_6G(7015, 213),
144 	RTW89_DEF_CHAN_6G(7035, 217),
145 	RTW89_DEF_CHAN_6G(7055, 221),
146 	RTW89_DEF_CHAN_6G(7075, 225),
147 	RTW89_DEF_CHAN_6G(7095, 229),
148 	RTW89_DEF_CHAN_6G(7115, 233),
149 };
150 
151 static struct ieee80211_rate rtw89_bitrates[] = {
152 	{ .bitrate = 10,  .hw_value = 0x00, },
153 	{ .bitrate = 20,  .hw_value = 0x01, },
154 	{ .bitrate = 55,  .hw_value = 0x02, },
155 	{ .bitrate = 110, .hw_value = 0x03, },
156 	{ .bitrate = 60,  .hw_value = 0x04, },
157 	{ .bitrate = 90,  .hw_value = 0x05, },
158 	{ .bitrate = 120, .hw_value = 0x06, },
159 	{ .bitrate = 180, .hw_value = 0x07, },
160 	{ .bitrate = 240, .hw_value = 0x08, },
161 	{ .bitrate = 360, .hw_value = 0x09, },
162 	{ .bitrate = 480, .hw_value = 0x0a, },
163 	{ .bitrate = 540, .hw_value = 0x0b, },
164 };
165 
166 static const struct ieee80211_iface_limit rtw89_iface_limits[] = {
167 	{
168 		.max = 1,
169 		.types = BIT(NL80211_IFTYPE_STATION),
170 	},
171 	{
172 		.max = 1,
173 		.types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
174 			 BIT(NL80211_IFTYPE_P2P_GO) |
175 			 BIT(NL80211_IFTYPE_AP),
176 	},
177 };
178 
179 static const struct ieee80211_iface_limit rtw89_iface_limits_mcc[] = {
180 	{
181 		.max = 1,
182 		.types = BIT(NL80211_IFTYPE_STATION),
183 	},
184 	{
185 		.max = 1,
186 		.types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
187 			 BIT(NL80211_IFTYPE_P2P_GO),
188 	},
189 };
190 
191 static const struct ieee80211_iface_combination rtw89_iface_combs[] = {
192 	{
193 		.limits = rtw89_iface_limits,
194 		.n_limits = ARRAY_SIZE(rtw89_iface_limits),
195 		.max_interfaces = 2,
196 		.num_different_channels = 1,
197 	},
198 	{
199 		.limits = rtw89_iface_limits_mcc,
200 		.n_limits = ARRAY_SIZE(rtw89_iface_limits_mcc),
201 		.max_interfaces = 2,
202 		.num_different_channels = 2,
203 	},
204 };
205 
206 bool rtw89_ra_report_to_bitrate(struct rtw89_dev *rtwdev, u8 rpt_rate, u16 *bitrate)
207 {
208 	struct ieee80211_rate rate;
209 
210 	if (unlikely(rpt_rate >= ARRAY_SIZE(rtw89_bitrates))) {
211 		rtw89_debug(rtwdev, RTW89_DBG_UNEXP, "invalid rpt rate %d\n", rpt_rate);
212 		return false;
213 	}
214 
215 	rate = rtw89_bitrates[rpt_rate];
216 	*bitrate = rate.bitrate;
217 
218 	return true;
219 }
220 
221 static const struct ieee80211_supported_band rtw89_sband_2ghz = {
222 	.band		= NL80211_BAND_2GHZ,
223 	.channels	= rtw89_channels_2ghz,
224 	.n_channels	= ARRAY_SIZE(rtw89_channels_2ghz),
225 	.bitrates	= rtw89_bitrates,
226 	.n_bitrates	= ARRAY_SIZE(rtw89_bitrates),
227 	.ht_cap		= {0},
228 	.vht_cap	= {0},
229 };
230 
231 static const struct ieee80211_supported_band rtw89_sband_5ghz = {
232 	.band		= NL80211_BAND_5GHZ,
233 	.channels	= rtw89_channels_5ghz,
234 	.n_channels	= ARRAY_SIZE(rtw89_channels_5ghz),
235 
236 	/* 5G has no CCK rates, 1M/2M/5.5M/11M */
237 	.bitrates	= rtw89_bitrates + 4,
238 	.n_bitrates	= ARRAY_SIZE(rtw89_bitrates) - 4,
239 	.ht_cap		= {0},
240 	.vht_cap	= {0},
241 };
242 
243 static const struct ieee80211_supported_band rtw89_sband_6ghz = {
244 	.band		= NL80211_BAND_6GHZ,
245 	.channels	= rtw89_channels_6ghz,
246 	.n_channels	= ARRAY_SIZE(rtw89_channels_6ghz),
247 
248 	/* 6G has no CCK rates, 1M/2M/5.5M/11M */
249 	.bitrates	= rtw89_bitrates + 4,
250 	.n_bitrates	= ARRAY_SIZE(rtw89_bitrates) - 4,
251 };
252 
253 static void rtw89_traffic_stats_accu(struct rtw89_dev *rtwdev,
254 				     struct rtw89_traffic_stats *stats,
255 				     struct sk_buff *skb, bool tx)
256 {
257 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
258 
259 	if (tx && ieee80211_is_assoc_req(hdr->frame_control))
260 		rtw89_wow_parse_akm(rtwdev, skb);
261 
262 	if (!ieee80211_is_data(hdr->frame_control))
263 		return;
264 
265 	if (is_broadcast_ether_addr(hdr->addr1) ||
266 	    is_multicast_ether_addr(hdr->addr1))
267 		return;
268 
269 	if (tx) {
270 		stats->tx_cnt++;
271 		stats->tx_unicast += skb->len;
272 	} else {
273 		stats->rx_cnt++;
274 		stats->rx_unicast += skb->len;
275 	}
276 }
277 
278 void rtw89_get_default_chandef(struct cfg80211_chan_def *chandef)
279 {
280 	cfg80211_chandef_create(chandef, &rtw89_channels_2ghz[0],
281 				NL80211_CHAN_NO_HT);
282 }
283 
284 void rtw89_get_channel_params(const struct cfg80211_chan_def *chandef,
285 			      struct rtw89_chan *chan)
286 {
287 	struct ieee80211_channel *channel = chandef->chan;
288 	enum nl80211_chan_width width = chandef->width;
289 	u32 primary_freq, center_freq;
290 	u8 center_chan;
291 	u8 bandwidth = RTW89_CHANNEL_WIDTH_20;
292 	u32 offset;
293 	u8 band;
294 
295 	center_chan = channel->hw_value;
296 	primary_freq = channel->center_freq;
297 	center_freq = chandef->center_freq1;
298 
299 	switch (width) {
300 	case NL80211_CHAN_WIDTH_20_NOHT:
301 	case NL80211_CHAN_WIDTH_20:
302 		bandwidth = RTW89_CHANNEL_WIDTH_20;
303 		break;
304 	case NL80211_CHAN_WIDTH_40:
305 		bandwidth = RTW89_CHANNEL_WIDTH_40;
306 		if (primary_freq > center_freq) {
307 			center_chan -= 2;
308 		} else {
309 			center_chan += 2;
310 		}
311 		break;
312 	case NL80211_CHAN_WIDTH_80:
313 	case NL80211_CHAN_WIDTH_160:
314 		bandwidth = nl_to_rtw89_bandwidth(width);
315 		if (primary_freq > center_freq) {
316 			offset = (primary_freq - center_freq - 10) / 20;
317 			center_chan -= 2 + offset * 4;
318 		} else {
319 			offset = (center_freq - primary_freq - 10) / 20;
320 			center_chan += 2 + offset * 4;
321 		}
322 		break;
323 	default:
324 		center_chan = 0;
325 		break;
326 	}
327 
328 	switch (channel->band) {
329 	default:
330 	case NL80211_BAND_2GHZ:
331 		band = RTW89_BAND_2G;
332 		break;
333 	case NL80211_BAND_5GHZ:
334 		band = RTW89_BAND_5G;
335 		break;
336 	case NL80211_BAND_6GHZ:
337 		band = RTW89_BAND_6G;
338 		break;
339 	}
340 
341 	rtw89_chan_create(chan, center_chan, channel->hw_value, band, bandwidth);
342 }
343 
344 void rtw89_core_set_chip_txpwr(struct rtw89_dev *rtwdev)
345 {
346 	struct rtw89_hal *hal = &rtwdev->hal;
347 	const struct rtw89_chip_info *chip = rtwdev->chip;
348 	const struct rtw89_chan *chan;
349 	enum rtw89_chanctx_idx chanctx_idx;
350 	enum rtw89_chanctx_idx roc_idx;
351 	enum rtw89_phy_idx phy_idx;
352 	enum rtw89_entity_mode mode;
353 	bool entity_active;
354 
355 	mode = rtw89_get_entity_mode(rtwdev);
356 	switch (mode) {
357 	case RTW89_ENTITY_MODE_SCC:
358 	case RTW89_ENTITY_MODE_MCC:
359 		chanctx_idx = RTW89_CHANCTX_0;
360 		break;
361 	case RTW89_ENTITY_MODE_MCC_PREPARE:
362 		chanctx_idx = RTW89_CHANCTX_1;
363 		break;
364 	default:
365 		WARN(1, "Invalid ent mode: %d\n", mode);
366 		return;
367 	}
368 
369 	roc_idx = atomic_read(&hal->roc_chanctx_idx);
370 	if (roc_idx != RTW89_CHANCTX_IDLE)
371 		chanctx_idx = roc_idx;
372 
373 	phy_idx = RTW89_PHY_0;
374 
375 	entity_active = rtw89_get_entity_state(rtwdev, phy_idx);
376 	if (!entity_active)
377 		return;
378 
379 	chan = rtw89_chan_get(rtwdev, chanctx_idx);
380 	chip->ops->set_txpwr(rtwdev, chan, phy_idx);
381 }
382 
383 int rtw89_set_channel(struct rtw89_dev *rtwdev)
384 {
385 	struct rtw89_hal *hal = &rtwdev->hal;
386 	const struct rtw89_chip_info *chip = rtwdev->chip;
387 	const struct rtw89_chan_rcd *chan_rcd;
388 	const struct rtw89_chan *chan;
389 	enum rtw89_chanctx_idx chanctx_idx;
390 	enum rtw89_chanctx_idx roc_idx;
391 	enum rtw89_mac_idx mac_idx;
392 	enum rtw89_phy_idx phy_idx;
393 	struct rtw89_channel_help_params bak;
394 	enum rtw89_entity_mode mode;
395 	bool entity_active;
396 
397 	mode = rtw89_entity_recalc(rtwdev);
398 	switch (mode) {
399 	case RTW89_ENTITY_MODE_SCC:
400 	case RTW89_ENTITY_MODE_MCC:
401 		chanctx_idx = RTW89_CHANCTX_0;
402 		break;
403 	case RTW89_ENTITY_MODE_MCC_PREPARE:
404 		chanctx_idx = RTW89_CHANCTX_1;
405 		break;
406 	default:
407 		WARN(1, "Invalid ent mode: %d\n", mode);
408 		return -EINVAL;
409 	}
410 
411 	roc_idx = atomic_read(&hal->roc_chanctx_idx);
412 	if (roc_idx != RTW89_CHANCTX_IDLE)
413 		chanctx_idx = roc_idx;
414 
415 	mac_idx = RTW89_MAC_0;
416 	phy_idx = RTW89_PHY_0;
417 
418 	entity_active = rtw89_get_entity_state(rtwdev, phy_idx);
419 
420 	chan = rtw89_chan_get(rtwdev, chanctx_idx);
421 	chan_rcd = rtw89_chan_rcd_get(rtwdev, chanctx_idx);
422 
423 	rtw89_chip_set_channel_prepare(rtwdev, &bak, chan, mac_idx, phy_idx);
424 
425 	chip->ops->set_channel(rtwdev, chan, mac_idx, phy_idx);
426 
427 	chip->ops->set_txpwr(rtwdev, chan, phy_idx);
428 
429 	rtw89_chip_set_channel_done(rtwdev, &bak, chan, mac_idx, phy_idx);
430 
431 	if (!entity_active || chan_rcd->band_changed) {
432 		rtw89_btc_ntfy_switch_band(rtwdev, phy_idx, chan->band_type);
433 		rtw89_chip_rfk_band_changed(rtwdev, phy_idx, chan);
434 	}
435 
436 	rtw89_set_entity_state(rtwdev, phy_idx, true);
437 	return 0;
438 }
439 
440 static enum rtw89_core_tx_type
441 rtw89_core_get_tx_type(struct rtw89_dev *rtwdev,
442 		       struct sk_buff *skb)
443 {
444 	struct ieee80211_hdr *hdr = (void *)skb->data;
445 	__le16 fc = hdr->frame_control;
446 
447 	if (ieee80211_is_mgmt(fc) || ieee80211_is_nullfunc(fc))
448 		return RTW89_CORE_TX_TYPE_MGMT;
449 
450 	return RTW89_CORE_TX_TYPE_DATA;
451 }
452 
453 static void
454 rtw89_core_tx_update_ampdu_info(struct rtw89_dev *rtwdev,
455 				struct rtw89_core_tx_request *tx_req,
456 				enum btc_pkt_type pkt_type)
457 {
458 	struct rtw89_sta_link *rtwsta_link = tx_req->rtwsta_link;
459 	struct rtw89_tx_desc_info *desc_info = &tx_req->desc_info;
460 	struct ieee80211_link_sta *link_sta;
461 	struct sk_buff *skb = tx_req->skb;
462 	struct rtw89_sta *rtwsta;
463 	u8 ampdu_num;
464 	u8 tid;
465 
466 	if (pkt_type == PACKET_EAPOL) {
467 		desc_info->bk = true;
468 		return;
469 	}
470 
471 	if (!(IEEE80211_SKB_CB(skb)->flags & IEEE80211_TX_CTL_AMPDU))
472 		return;
473 
474 	if (!rtwsta_link) {
475 		rtw89_warn(rtwdev, "cannot set ampdu info without sta\n");
476 		return;
477 	}
478 
479 	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
480 	rtwsta = rtwsta_link->rtwsta;
481 
482 	rcu_read_lock();
483 
484 	link_sta = rtw89_sta_rcu_dereference_link(rtwsta_link, false);
485 	ampdu_num = (u8)((rtwsta->ampdu_params[tid].agg_num ?
486 			  rtwsta->ampdu_params[tid].agg_num :
487 			  4 << link_sta->ht_cap.ampdu_factor) - 1);
488 
489 	desc_info->agg_en = true;
490 	desc_info->ampdu_density = link_sta->ht_cap.ampdu_density;
491 	desc_info->ampdu_num = ampdu_num;
492 
493 	rcu_read_unlock();
494 }
495 
496 static void
497 rtw89_core_tx_update_sec_key(struct rtw89_dev *rtwdev,
498 			     struct rtw89_core_tx_request *tx_req)
499 {
500 	struct rtw89_cam_info *cam_info = &rtwdev->cam_info;
501 	const struct rtw89_chip_info *chip = rtwdev->chip;
502 	const struct rtw89_sec_cam_entry *sec_cam;
503 	struct ieee80211_tx_info *info;
504 	struct ieee80211_key_conf *key;
505 	struct rtw89_tx_desc_info *desc_info = &tx_req->desc_info;
506 	struct sk_buff *skb = tx_req->skb;
507 	u8 sec_type = RTW89_SEC_KEY_TYPE_NONE;
508 	u8 sec_cam_idx;
509 	u64 pn64;
510 
511 	info = IEEE80211_SKB_CB(skb);
512 	key = info->control.hw_key;
513 	sec_cam_idx = key->hw_key_idx;
514 	sec_cam = cam_info->sec_entries[sec_cam_idx];
515 	if (!sec_cam) {
516 		rtw89_warn(rtwdev, "sec cam entry is empty\n");
517 		return;
518 	}
519 
520 	switch (key->cipher) {
521 	case WLAN_CIPHER_SUITE_WEP40:
522 		sec_type = RTW89_SEC_KEY_TYPE_WEP40;
523 		break;
524 	case WLAN_CIPHER_SUITE_WEP104:
525 		sec_type = RTW89_SEC_KEY_TYPE_WEP104;
526 		break;
527 	case WLAN_CIPHER_SUITE_TKIP:
528 		sec_type = RTW89_SEC_KEY_TYPE_TKIP;
529 		break;
530 	case WLAN_CIPHER_SUITE_CCMP:
531 		sec_type = RTW89_SEC_KEY_TYPE_CCMP128;
532 		break;
533 	case WLAN_CIPHER_SUITE_CCMP_256:
534 		sec_type = RTW89_SEC_KEY_TYPE_CCMP256;
535 		break;
536 	case WLAN_CIPHER_SUITE_GCMP:
537 		sec_type = RTW89_SEC_KEY_TYPE_GCMP128;
538 		break;
539 	case WLAN_CIPHER_SUITE_GCMP_256:
540 		sec_type = RTW89_SEC_KEY_TYPE_GCMP256;
541 		break;
542 	default:
543 		rtw89_warn(rtwdev, "key cipher not supported %d\n", key->cipher);
544 		return;
545 	}
546 
547 	desc_info->sec_en = true;
548 	desc_info->sec_keyid = key->keyidx;
549 	desc_info->sec_type = sec_type;
550 	desc_info->sec_cam_idx = sec_cam->sec_cam_idx;
551 
552 	if (!chip->hw_sec_hdr)
553 		return;
554 
555 	pn64 = atomic64_inc_return(&key->tx_pn);
556 	desc_info->sec_seq[0] = pn64;
557 	desc_info->sec_seq[1] = pn64 >> 8;
558 	desc_info->sec_seq[2] = pn64 >> 16;
559 	desc_info->sec_seq[3] = pn64 >> 24;
560 	desc_info->sec_seq[4] = pn64 >> 32;
561 	desc_info->sec_seq[5] = pn64 >> 40;
562 	desc_info->wp_offset = 1; /* in unit of 8 bytes for security header */
563 }
564 
565 static u16 rtw89_core_get_mgmt_rate(struct rtw89_dev *rtwdev,
566 				    struct rtw89_core_tx_request *tx_req,
567 				    const struct rtw89_chan *chan)
568 {
569 	struct sk_buff *skb = tx_req->skb;
570 	struct rtw89_vif_link *rtwvif_link = tx_req->rtwvif_link;
571 	struct rtw89_sta_link *rtwsta_link = tx_req->rtwsta_link;
572 	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
573 	struct ieee80211_vif *vif = tx_info->control.vif;
574 	struct ieee80211_bss_conf *bss_conf;
575 	u16 lowest_rate;
576 	u16 rate;
577 
578 	if (tx_info->flags & IEEE80211_TX_CTL_NO_CCK_RATE ||
579 	    (vif && vif->p2p))
580 		lowest_rate = RTW89_HW_RATE_OFDM6;
581 	else if (chan->band_type == RTW89_BAND_2G)
582 		lowest_rate = RTW89_HW_RATE_CCK1;
583 	else
584 		lowest_rate = RTW89_HW_RATE_OFDM6;
585 
586 	if (!rtwvif_link)
587 		return lowest_rate;
588 
589 	rcu_read_lock();
590 
591 	bss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, false);
592 	if (!bss_conf->basic_rates || !rtwsta_link) {
593 		rate = lowest_rate;
594 		goto out;
595 	}
596 
597 	rate = __ffs(bss_conf->basic_rates) + lowest_rate;
598 
599 out:
600 	rcu_read_unlock();
601 
602 	return rate;
603 }
604 
605 static u8 rtw89_core_tx_get_mac_id(struct rtw89_dev *rtwdev,
606 				   struct rtw89_core_tx_request *tx_req)
607 {
608 	struct rtw89_vif_link *rtwvif_link = tx_req->rtwvif_link;
609 	struct rtw89_sta_link *rtwsta_link = tx_req->rtwsta_link;
610 
611 	if (!rtwsta_link)
612 		return rtwvif_link->mac_id;
613 
614 	return rtwsta_link->mac_id;
615 }
616 
617 static void rtw89_core_tx_update_llc_hdr(struct rtw89_dev *rtwdev,
618 					 struct rtw89_tx_desc_info *desc_info,
619 					 struct sk_buff *skb)
620 {
621 	struct ieee80211_hdr *hdr = (void *)skb->data;
622 	__le16 fc = hdr->frame_control;
623 
624 	desc_info->hdr_llc_len = ieee80211_hdrlen(fc);
625 	desc_info->hdr_llc_len >>= 1; /* in unit of 2 bytes */
626 }
627 
628 static void
629 rtw89_core_tx_update_mgmt_info(struct rtw89_dev *rtwdev,
630 			       struct rtw89_core_tx_request *tx_req)
631 {
632 	const struct rtw89_chip_info *chip = rtwdev->chip;
633 	struct rtw89_vif_link *rtwvif_link = tx_req->rtwvif_link;
634 	struct rtw89_tx_desc_info *desc_info = &tx_req->desc_info;
635 	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev,
636 						       rtwvif_link->chanctx_idx);
637 	struct sk_buff *skb = tx_req->skb;
638 	u8 qsel, ch_dma;
639 
640 	qsel = desc_info->hiq ? RTW89_TX_QSEL_B0_HI : RTW89_TX_QSEL_B0_MGMT;
641 	ch_dma = rtw89_core_get_ch_dma(rtwdev, qsel);
642 
643 	desc_info->qsel = qsel;
644 	desc_info->ch_dma = ch_dma;
645 	desc_info->port = desc_info->hiq ? rtwvif_link->port : 0;
646 	desc_info->mac_id = rtw89_core_tx_get_mac_id(rtwdev, tx_req);
647 	desc_info->hw_ssn_sel = RTW89_MGMT_HW_SSN_SEL;
648 	desc_info->hw_seq_mode = RTW89_MGMT_HW_SEQ_MODE;
649 
650 	/* fixed data rate for mgmt frames */
651 	desc_info->en_wd_info = true;
652 	desc_info->use_rate = true;
653 	desc_info->dis_data_fb = true;
654 	desc_info->data_rate = rtw89_core_get_mgmt_rate(rtwdev, tx_req, chan);
655 
656 	if (chip->hw_mgmt_tx_encrypt && IEEE80211_SKB_CB(skb)->control.hw_key) {
657 		rtw89_core_tx_update_sec_key(rtwdev, tx_req);
658 		rtw89_core_tx_update_llc_hdr(rtwdev, desc_info, skb);
659 	}
660 
661 	rtw89_debug(rtwdev, RTW89_DBG_TXRX,
662 		    "tx mgmt frame with rate 0x%x on channel %d (band %d, bw %d)\n",
663 		    desc_info->data_rate, chan->channel, chan->band_type,
664 		    chan->band_width);
665 }
666 
667 static void
668 rtw89_core_tx_update_h2c_info(struct rtw89_dev *rtwdev,
669 			      struct rtw89_core_tx_request *tx_req)
670 {
671 	struct rtw89_tx_desc_info *desc_info = &tx_req->desc_info;
672 
673 	desc_info->is_bmc = false;
674 	desc_info->wd_page = false;
675 	desc_info->ch_dma = RTW89_DMA_H2C;
676 }
677 
678 static void rtw89_core_get_no_ul_ofdma_htc(struct rtw89_dev *rtwdev, __le32 *htc,
679 					   const struct rtw89_chan *chan)
680 {
681 	static const u8 rtw89_bandwidth_to_om[] = {
682 		[RTW89_CHANNEL_WIDTH_20] = HTC_OM_CHANNEL_WIDTH_20,
683 		[RTW89_CHANNEL_WIDTH_40] = HTC_OM_CHANNEL_WIDTH_40,
684 		[RTW89_CHANNEL_WIDTH_80] = HTC_OM_CHANNEL_WIDTH_80,
685 		[RTW89_CHANNEL_WIDTH_160] = HTC_OM_CHANNEL_WIDTH_160_OR_80_80,
686 		[RTW89_CHANNEL_WIDTH_80_80] = HTC_OM_CHANNEL_WIDTH_160_OR_80_80,
687 	};
688 	const struct rtw89_chip_info *chip = rtwdev->chip;
689 	struct rtw89_hal *hal = &rtwdev->hal;
690 	u8 om_bandwidth;
691 
692 	if (!chip->dis_2g_40m_ul_ofdma ||
693 	    chan->band_type != RTW89_BAND_2G ||
694 	    chan->band_width != RTW89_CHANNEL_WIDTH_40)
695 		return;
696 
697 	om_bandwidth = chan->band_width < ARRAY_SIZE(rtw89_bandwidth_to_om) ?
698 		       rtw89_bandwidth_to_om[chan->band_width] : 0;
699 	*htc = le32_encode_bits(RTW89_HTC_VARIANT_HE, RTW89_HTC_MASK_VARIANT) |
700 	       le32_encode_bits(RTW89_HTC_VARIANT_HE_CID_OM, RTW89_HTC_MASK_CTL_ID) |
701 	       le32_encode_bits(hal->rx_nss - 1, RTW89_HTC_MASK_HTC_OM_RX_NSS) |
702 	       le32_encode_bits(om_bandwidth, RTW89_HTC_MASK_HTC_OM_CH_WIDTH) |
703 	       le32_encode_bits(1, RTW89_HTC_MASK_HTC_OM_UL_MU_DIS) |
704 	       le32_encode_bits(hal->tx_nss - 1, RTW89_HTC_MASK_HTC_OM_TX_NSTS) |
705 	       le32_encode_bits(0, RTW89_HTC_MASK_HTC_OM_ER_SU_DIS) |
706 	       le32_encode_bits(0, RTW89_HTC_MASK_HTC_OM_DL_MU_MIMO_RR) |
707 	       le32_encode_bits(0, RTW89_HTC_MASK_HTC_OM_UL_MU_DATA_DIS);
708 }
709 
710 static bool
711 __rtw89_core_tx_check_he_qos_htc(struct rtw89_dev *rtwdev,
712 				 struct rtw89_core_tx_request *tx_req,
713 				 enum btc_pkt_type pkt_type)
714 {
715 	struct rtw89_sta_link *rtwsta_link = tx_req->rtwsta_link;
716 	struct sk_buff *skb = tx_req->skb;
717 	struct ieee80211_hdr *hdr = (void *)skb->data;
718 	struct ieee80211_link_sta *link_sta;
719 	__le16 fc = hdr->frame_control;
720 
721 	/* AP IOT issue with EAPoL, ARP and DHCP */
722 	if (pkt_type < PACKET_MAX)
723 		return false;
724 
725 	if (!rtwsta_link)
726 		return false;
727 
728 	rcu_read_lock();
729 
730 	link_sta = rtw89_sta_rcu_dereference_link(rtwsta_link, false);
731 	if (!link_sta->he_cap.has_he) {
732 		rcu_read_unlock();
733 		return false;
734 	}
735 
736 	rcu_read_unlock();
737 
738 	if (!ieee80211_is_data_qos(fc))
739 		return false;
740 
741 	if (skb_headroom(skb) < IEEE80211_HT_CTL_LEN)
742 		return false;
743 
744 	if (rtwsta_link && rtwsta_link->ra_report.might_fallback_legacy)
745 		return false;
746 
747 	return true;
748 }
749 
750 static void
751 __rtw89_core_tx_adjust_he_qos_htc(struct rtw89_dev *rtwdev,
752 				  struct rtw89_core_tx_request *tx_req)
753 {
754 	struct rtw89_sta_link *rtwsta_link = tx_req->rtwsta_link;
755 	struct sk_buff *skb = tx_req->skb;
756 	struct ieee80211_hdr *hdr = (void *)skb->data;
757 	__le16 fc = hdr->frame_control;
758 	void *data;
759 	__le32 *htc;
760 	u8 *qc;
761 	int hdr_len;
762 
763 	hdr_len = ieee80211_has_a4(fc) ? 32 : 26;
764 	data = skb_push(skb, IEEE80211_HT_CTL_LEN);
765 	memmove(data, data + IEEE80211_HT_CTL_LEN, hdr_len);
766 
767 	hdr = data;
768 	htc = data + hdr_len;
769 	hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_ORDER);
770 	*htc = rtwsta_link->htc_template ? rtwsta_link->htc_template :
771 	       le32_encode_bits(RTW89_HTC_VARIANT_HE, RTW89_HTC_MASK_VARIANT) |
772 	       le32_encode_bits(RTW89_HTC_VARIANT_HE_CID_CAS, RTW89_HTC_MASK_CTL_ID);
773 
774 	qc = data + hdr_len - IEEE80211_QOS_CTL_LEN;
775 	qc[0] |= IEEE80211_QOS_CTL_EOSP;
776 }
777 
778 static void
779 rtw89_core_tx_update_he_qos_htc(struct rtw89_dev *rtwdev,
780 				struct rtw89_core_tx_request *tx_req,
781 				enum btc_pkt_type pkt_type)
782 {
783 	struct rtw89_tx_desc_info *desc_info = &tx_req->desc_info;
784 	struct rtw89_vif_link *rtwvif_link = tx_req->rtwvif_link;
785 
786 	if (!__rtw89_core_tx_check_he_qos_htc(rtwdev, tx_req, pkt_type))
787 		goto desc_bk;
788 
789 	__rtw89_core_tx_adjust_he_qos_htc(rtwdev, tx_req);
790 
791 	desc_info->pkt_size += IEEE80211_HT_CTL_LEN;
792 	desc_info->a_ctrl_bsr = true;
793 
794 desc_bk:
795 	if (!rtwvif_link || rtwvif_link->last_a_ctrl == desc_info->a_ctrl_bsr)
796 		return;
797 
798 	rtwvif_link->last_a_ctrl = desc_info->a_ctrl_bsr;
799 	desc_info->bk = true;
800 }
801 
802 static u16 rtw89_core_get_data_rate(struct rtw89_dev *rtwdev,
803 				    struct rtw89_core_tx_request *tx_req)
804 {
805 	struct rtw89_vif_link *rtwvif_link = tx_req->rtwvif_link;
806 	struct rtw89_sta_link *rtwsta_link = tx_req->rtwsta_link;
807 	struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
808 	struct rtw89_phy_rate_pattern *rate_pattern = &rtwvif_link->rate_pattern;
809 	enum rtw89_chanctx_idx idx = rtwvif_link->chanctx_idx;
810 	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, idx);
811 	struct ieee80211_link_sta *link_sta;
812 	u16 lowest_rate;
813 	u16 rate;
814 
815 	if (rate_pattern->enable)
816 		return rate_pattern->rate;
817 
818 	if (vif->p2p)
819 		lowest_rate = RTW89_HW_RATE_OFDM6;
820 	else if (chan->band_type == RTW89_BAND_2G)
821 		lowest_rate = RTW89_HW_RATE_CCK1;
822 	else
823 		lowest_rate = RTW89_HW_RATE_OFDM6;
824 
825 	if (!rtwsta_link)
826 		return lowest_rate;
827 
828 	rcu_read_lock();
829 
830 	link_sta = rtw89_sta_rcu_dereference_link(rtwsta_link, false);
831 	if (!link_sta->supp_rates[chan->band_type]) {
832 		rate = lowest_rate;
833 		goto out;
834 	}
835 
836 	rate = __ffs(link_sta->supp_rates[chan->band_type]) + lowest_rate;
837 
838 out:
839 	rcu_read_unlock();
840 
841 	return rate;
842 }
843 
844 static void
845 rtw89_core_tx_update_data_info(struct rtw89_dev *rtwdev,
846 			       struct rtw89_core_tx_request *tx_req)
847 {
848 	struct rtw89_vif_link *rtwvif_link = tx_req->rtwvif_link;
849 	struct rtw89_sta_link *rtwsta_link = tx_req->rtwsta_link;
850 	struct rtw89_tx_desc_info *desc_info = &tx_req->desc_info;
851 	struct sk_buff *skb = tx_req->skb;
852 	u8 tid, tid_indicate;
853 	u8 qsel, ch_dma;
854 
855 	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
856 	tid_indicate = rtw89_core_get_tid_indicate(rtwdev, tid);
857 	qsel = desc_info->hiq ? RTW89_TX_QSEL_B0_HI : rtw89_core_get_qsel(rtwdev, tid);
858 	ch_dma = rtw89_core_get_ch_dma(rtwdev, qsel);
859 
860 	desc_info->ch_dma = ch_dma;
861 	desc_info->tid_indicate = tid_indicate;
862 	desc_info->qsel = qsel;
863 	desc_info->mac_id = rtw89_core_tx_get_mac_id(rtwdev, tx_req);
864 	desc_info->port = desc_info->hiq ? rtwvif_link->port : 0;
865 	desc_info->er_cap = rtwsta_link ? rtwsta_link->er_cap : false;
866 	desc_info->stbc = rtwsta_link ? rtwsta_link->ra.stbc_cap : false;
867 	desc_info->ldpc = rtwsta_link ? rtwsta_link->ra.ldpc_cap : false;
868 
869 	/* enable wd_info for AMPDU */
870 	desc_info->en_wd_info = true;
871 
872 	if (IEEE80211_SKB_CB(skb)->control.hw_key)
873 		rtw89_core_tx_update_sec_key(rtwdev, tx_req);
874 
875 	desc_info->data_retry_lowest_rate = rtw89_core_get_data_rate(rtwdev, tx_req);
876 }
877 
878 static enum btc_pkt_type
879 rtw89_core_tx_btc_spec_pkt_notify(struct rtw89_dev *rtwdev,
880 				  struct rtw89_core_tx_request *tx_req)
881 {
882 	struct sk_buff *skb = tx_req->skb;
883 	struct udphdr *udphdr;
884 
885 	if (IEEE80211_SKB_CB(skb)->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO) {
886 		ieee80211_queue_work(rtwdev->hw, &rtwdev->btc.eapol_notify_work);
887 		return PACKET_EAPOL;
888 	}
889 
890 	if (skb->protocol == htons(ETH_P_ARP)) {
891 		ieee80211_queue_work(rtwdev->hw, &rtwdev->btc.arp_notify_work);
892 		return PACKET_ARP;
893 	}
894 
895 	if (skb->protocol == htons(ETH_P_IP) &&
896 	    ip_hdr(skb)->protocol == IPPROTO_UDP) {
897 		udphdr = udp_hdr(skb);
898 		if (((udphdr->source == htons(67) && udphdr->dest == htons(68)) ||
899 		     (udphdr->source == htons(68) && udphdr->dest == htons(67))) &&
900 		    skb->len > 282) {
901 			ieee80211_queue_work(rtwdev->hw, &rtwdev->btc.dhcp_notify_work);
902 			return PACKET_DHCP;
903 		}
904 	}
905 
906 	if (skb->protocol == htons(ETH_P_IP) &&
907 	    ip_hdr(skb)->protocol == IPPROTO_ICMP) {
908 		ieee80211_queue_work(rtwdev->hw, &rtwdev->btc.icmp_notify_work);
909 		return PACKET_ICMP;
910 	}
911 
912 	return PACKET_MAX;
913 }
914 
915 static void
916 rtw89_core_tx_wake(struct rtw89_dev *rtwdev,
917 		   struct rtw89_core_tx_request *tx_req)
918 {
919 	const struct rtw89_chip_info *chip = rtwdev->chip;
920 
921 	if (!RTW89_CHK_FW_FEATURE(TX_WAKE, &rtwdev->fw))
922 		return;
923 
924 	if (!test_bit(RTW89_FLAG_LOW_POWER_MODE, rtwdev->flags))
925 		return;
926 
927 	if (chip->chip_id != RTL8852C &&
928 	    tx_req->tx_type != RTW89_CORE_TX_TYPE_MGMT)
929 		return;
930 
931 	rtw89_mac_notify_wake(rtwdev);
932 }
933 
934 static void
935 rtw89_core_tx_update_desc_info(struct rtw89_dev *rtwdev,
936 			       struct rtw89_core_tx_request *tx_req)
937 {
938 	struct rtw89_tx_desc_info *desc_info = &tx_req->desc_info;
939 	struct sk_buff *skb = tx_req->skb;
940 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
941 	struct ieee80211_hdr *hdr = (void *)skb->data;
942 	enum rtw89_core_tx_type tx_type;
943 	enum btc_pkt_type pkt_type;
944 	bool is_bmc;
945 	u16 seq;
946 
947 	seq = (le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4;
948 	if (tx_req->tx_type != RTW89_CORE_TX_TYPE_FWCMD) {
949 		tx_type = rtw89_core_get_tx_type(rtwdev, skb);
950 		tx_req->tx_type = tx_type;
951 	}
952 	is_bmc = (is_broadcast_ether_addr(hdr->addr1) ||
953 		  is_multicast_ether_addr(hdr->addr1));
954 
955 	desc_info->seq = seq;
956 	desc_info->pkt_size = skb->len;
957 	desc_info->is_bmc = is_bmc;
958 	desc_info->wd_page = true;
959 	desc_info->hiq = info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM;
960 
961 	switch (tx_req->tx_type) {
962 	case RTW89_CORE_TX_TYPE_MGMT:
963 		rtw89_core_tx_update_mgmt_info(rtwdev, tx_req);
964 		break;
965 	case RTW89_CORE_TX_TYPE_DATA:
966 		rtw89_core_tx_update_data_info(rtwdev, tx_req);
967 		pkt_type = rtw89_core_tx_btc_spec_pkt_notify(rtwdev, tx_req);
968 		rtw89_core_tx_update_he_qos_htc(rtwdev, tx_req, pkt_type);
969 		rtw89_core_tx_update_ampdu_info(rtwdev, tx_req, pkt_type);
970 		rtw89_core_tx_update_llc_hdr(rtwdev, desc_info, skb);
971 		break;
972 	case RTW89_CORE_TX_TYPE_FWCMD:
973 		rtw89_core_tx_update_h2c_info(rtwdev, tx_req);
974 		break;
975 	}
976 }
977 
978 void rtw89_core_tx_kick_off(struct rtw89_dev *rtwdev, u8 qsel)
979 {
980 	u8 ch_dma;
981 
982 	ch_dma = rtw89_core_get_ch_dma(rtwdev, qsel);
983 
984 	rtw89_hci_tx_kick_off(rtwdev, ch_dma);
985 }
986 
987 int rtw89_core_tx_kick_off_and_wait(struct rtw89_dev *rtwdev, struct sk_buff *skb,
988 				    int qsel, unsigned int timeout)
989 {
990 	struct rtw89_tx_skb_data *skb_data = RTW89_TX_SKB_CB(skb);
991 	struct rtw89_tx_wait_info *wait;
992 	unsigned long time_left;
993 	int ret = 0;
994 
995 	wait = kzalloc(sizeof(*wait), GFP_KERNEL);
996 	if (!wait) {
997 		rtw89_core_tx_kick_off(rtwdev, qsel);
998 		return 0;
999 	}
1000 
1001 	init_completion(&wait->completion);
1002 	rcu_assign_pointer(skb_data->wait, wait);
1003 
1004 	rtw89_core_tx_kick_off(rtwdev, qsel);
1005 	time_left = wait_for_completion_timeout(&wait->completion,
1006 						msecs_to_jiffies(timeout));
1007 	if (time_left == 0)
1008 		ret = -ETIMEDOUT;
1009 	else if (!wait->tx_done)
1010 		ret = -EAGAIN;
1011 
1012 	rcu_assign_pointer(skb_data->wait, NULL);
1013 	kfree_rcu(wait, rcu_head);
1014 
1015 	return ret;
1016 }
1017 
1018 int rtw89_h2c_tx(struct rtw89_dev *rtwdev,
1019 		 struct sk_buff *skb, bool fwdl)
1020 {
1021 	struct rtw89_core_tx_request tx_req = {0};
1022 	u32 cnt;
1023 	int ret;
1024 
1025 	if (!test_bit(RTW89_FLAG_POWERON, rtwdev->flags)) {
1026 		rtw89_debug(rtwdev, RTW89_DBG_FW,
1027 			    "ignore h2c due to power is off with firmware state=%d\n",
1028 			    test_bit(RTW89_FLAG_FW_RDY, rtwdev->flags));
1029 		dev_kfree_skb(skb);
1030 		return 0;
1031 	}
1032 
1033 	tx_req.skb = skb;
1034 	tx_req.tx_type = RTW89_CORE_TX_TYPE_FWCMD;
1035 	if (fwdl)
1036 		tx_req.desc_info.fw_dl = true;
1037 
1038 	rtw89_core_tx_update_desc_info(rtwdev, &tx_req);
1039 
1040 	if (!fwdl)
1041 		rtw89_hex_dump(rtwdev, RTW89_DBG_FW, "H2C: ", skb->data, skb->len);
1042 
1043 	cnt = rtw89_hci_check_and_reclaim_tx_resource(rtwdev, RTW89_TXCH_CH12);
1044 	if (cnt == 0) {
1045 		rtw89_err(rtwdev, "no tx fwcmd resource\n");
1046 		return -ENOSPC;
1047 	}
1048 
1049 	ret = rtw89_hci_tx_write(rtwdev, &tx_req);
1050 	if (ret) {
1051 		rtw89_err(rtwdev, "failed to transmit skb to HCI\n");
1052 		return ret;
1053 	}
1054 	rtw89_hci_tx_kick_off(rtwdev, RTW89_TXCH_CH12);
1055 
1056 	return 0;
1057 }
1058 
1059 int rtw89_core_tx_write(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif,
1060 			struct ieee80211_sta *sta, struct sk_buff *skb, int *qsel)
1061 {
1062 	struct rtw89_sta *rtwsta = sta_to_rtwsta_safe(sta);
1063 	struct rtw89_vif *rtwvif = vif_to_rtwvif(vif);
1064 	struct rtw89_core_tx_request tx_req = {0};
1065 	struct rtw89_sta_link *rtwsta_link = NULL;
1066 	struct rtw89_vif_link *rtwvif_link;
1067 	int ret;
1068 
1069 	/* By default, driver writes tx via the link on HW-0. And then,
1070 	 * according to links' status, HW can change tx to another link.
1071 	 */
1072 
1073 	if (rtwsta) {
1074 		rtwsta_link = rtw89_sta_get_link_inst(rtwsta, 0);
1075 		if (unlikely(!rtwsta_link)) {
1076 			rtw89_err(rtwdev, "tx: find no sta link on HW-0\n");
1077 			return -ENOLINK;
1078 		}
1079 	}
1080 
1081 	rtwvif_link = rtw89_vif_get_link_inst(rtwvif, 0);
1082 	if (unlikely(!rtwvif_link)) {
1083 		rtw89_err(rtwdev, "tx: find no vif link on HW-0\n");
1084 		return -ENOLINK;
1085 	}
1086 
1087 	tx_req.skb = skb;
1088 	tx_req.rtwvif_link = rtwvif_link;
1089 	tx_req.rtwsta_link = rtwsta_link;
1090 
1091 	rtw89_traffic_stats_accu(rtwdev, &rtwdev->stats, skb, true);
1092 	rtw89_traffic_stats_accu(rtwdev, &rtwvif->stats, skb, true);
1093 	rtw89_core_tx_update_desc_info(rtwdev, &tx_req);
1094 	rtw89_core_tx_wake(rtwdev, &tx_req);
1095 
1096 	ret = rtw89_hci_tx_write(rtwdev, &tx_req);
1097 	if (ret) {
1098 		rtw89_err(rtwdev, "failed to transmit skb to HCI\n");
1099 		return ret;
1100 	}
1101 
1102 	if (qsel)
1103 		*qsel = tx_req.desc_info.qsel;
1104 
1105 	return 0;
1106 }
1107 
1108 static __le32 rtw89_build_txwd_body0(struct rtw89_tx_desc_info *desc_info)
1109 {
1110 	u32 dword = FIELD_PREP(RTW89_TXWD_BODY0_WP_OFFSET, desc_info->wp_offset) |
1111 		    FIELD_PREP(RTW89_TXWD_BODY0_WD_INFO_EN, desc_info->en_wd_info) |
1112 		    FIELD_PREP(RTW89_TXWD_BODY0_CHANNEL_DMA, desc_info->ch_dma) |
1113 		    FIELD_PREP(RTW89_TXWD_BODY0_HDR_LLC_LEN, desc_info->hdr_llc_len) |
1114 		    FIELD_PREP(RTW89_TXWD_BODY0_WD_PAGE, desc_info->wd_page) |
1115 		    FIELD_PREP(RTW89_TXWD_BODY0_FW_DL, desc_info->fw_dl) |
1116 		    FIELD_PREP(RTW89_TXWD_BODY0_HW_SSN_SEL, desc_info->hw_ssn_sel) |
1117 		    FIELD_PREP(RTW89_TXWD_BODY0_HW_SSN_MODE, desc_info->hw_seq_mode);
1118 
1119 	return cpu_to_le32(dword);
1120 }
1121 
1122 static __le32 rtw89_build_txwd_body0_v1(struct rtw89_tx_desc_info *desc_info)
1123 {
1124 	u32 dword = FIELD_PREP(RTW89_TXWD_BODY0_WP_OFFSET_V1, desc_info->wp_offset) |
1125 		    FIELD_PREP(RTW89_TXWD_BODY0_WD_INFO_EN, desc_info->en_wd_info) |
1126 		    FIELD_PREP(RTW89_TXWD_BODY0_CHANNEL_DMA, desc_info->ch_dma) |
1127 		    FIELD_PREP(RTW89_TXWD_BODY0_HDR_LLC_LEN, desc_info->hdr_llc_len) |
1128 		    FIELD_PREP(RTW89_TXWD_BODY0_WD_PAGE, desc_info->wd_page) |
1129 		    FIELD_PREP(RTW89_TXWD_BODY0_FW_DL, desc_info->fw_dl);
1130 
1131 	return cpu_to_le32(dword);
1132 }
1133 
1134 static __le32 rtw89_build_txwd_body1_v1(struct rtw89_tx_desc_info *desc_info)
1135 {
1136 	u32 dword = FIELD_PREP(RTW89_TXWD_BODY1_ADDR_INFO_NUM, desc_info->addr_info_nr) |
1137 		    FIELD_PREP(RTW89_TXWD_BODY1_SEC_KEYID, desc_info->sec_keyid) |
1138 		    FIELD_PREP(RTW89_TXWD_BODY1_SEC_TYPE, desc_info->sec_type);
1139 
1140 	return cpu_to_le32(dword);
1141 }
1142 
1143 static __le32 rtw89_build_txwd_body2(struct rtw89_tx_desc_info *desc_info)
1144 {
1145 	u32 dword = FIELD_PREP(RTW89_TXWD_BODY2_TID_INDICATE, desc_info->tid_indicate) |
1146 		    FIELD_PREP(RTW89_TXWD_BODY2_QSEL, desc_info->qsel) |
1147 		    FIELD_PREP(RTW89_TXWD_BODY2_TXPKT_SIZE, desc_info->pkt_size) |
1148 		    FIELD_PREP(RTW89_TXWD_BODY2_MACID, desc_info->mac_id);
1149 
1150 	return cpu_to_le32(dword);
1151 }
1152 
1153 static __le32 rtw89_build_txwd_body3(struct rtw89_tx_desc_info *desc_info)
1154 {
1155 	u32 dword = FIELD_PREP(RTW89_TXWD_BODY3_SW_SEQ, desc_info->seq) |
1156 		    FIELD_PREP(RTW89_TXWD_BODY3_AGG_EN, desc_info->agg_en) |
1157 		    FIELD_PREP(RTW89_TXWD_BODY3_BK, desc_info->bk);
1158 
1159 	return cpu_to_le32(dword);
1160 }
1161 
1162 static __le32 rtw89_build_txwd_body4(struct rtw89_tx_desc_info *desc_info)
1163 {
1164 	u32 dword = FIELD_PREP(RTW89_TXWD_BODY4_SEC_IV_L0, desc_info->sec_seq[0]) |
1165 		    FIELD_PREP(RTW89_TXWD_BODY4_SEC_IV_L1, desc_info->sec_seq[1]);
1166 
1167 	return cpu_to_le32(dword);
1168 }
1169 
1170 static __le32 rtw89_build_txwd_body5(struct rtw89_tx_desc_info *desc_info)
1171 {
1172 	u32 dword = FIELD_PREP(RTW89_TXWD_BODY5_SEC_IV_H2, desc_info->sec_seq[2]) |
1173 		    FIELD_PREP(RTW89_TXWD_BODY5_SEC_IV_H3, desc_info->sec_seq[3]) |
1174 		    FIELD_PREP(RTW89_TXWD_BODY5_SEC_IV_H4, desc_info->sec_seq[4]) |
1175 		    FIELD_PREP(RTW89_TXWD_BODY5_SEC_IV_H5, desc_info->sec_seq[5]);
1176 
1177 	return cpu_to_le32(dword);
1178 }
1179 
1180 static __le32 rtw89_build_txwd_body7_v1(struct rtw89_tx_desc_info *desc_info)
1181 {
1182 	u32 dword = FIELD_PREP(RTW89_TXWD_BODY7_USE_RATE_V1, desc_info->use_rate) |
1183 		    FIELD_PREP(RTW89_TXWD_BODY7_DATA_RATE, desc_info->data_rate);
1184 
1185 	return cpu_to_le32(dword);
1186 }
1187 
1188 static __le32 rtw89_build_txwd_info0(struct rtw89_tx_desc_info *desc_info)
1189 {
1190 	u32 dword = FIELD_PREP(RTW89_TXWD_INFO0_USE_RATE, desc_info->use_rate) |
1191 		    FIELD_PREP(RTW89_TXWD_INFO0_DATA_RATE, desc_info->data_rate) |
1192 		    FIELD_PREP(RTW89_TXWD_INFO0_DATA_STBC, desc_info->stbc) |
1193 		    FIELD_PREP(RTW89_TXWD_INFO0_DATA_LDPC, desc_info->ldpc) |
1194 		    FIELD_PREP(RTW89_TXWD_INFO0_DISDATAFB, desc_info->dis_data_fb) |
1195 		    FIELD_PREP(RTW89_TXWD_INFO0_MULTIPORT_ID, desc_info->port);
1196 
1197 	return cpu_to_le32(dword);
1198 }
1199 
1200 static __le32 rtw89_build_txwd_info0_v1(struct rtw89_tx_desc_info *desc_info)
1201 {
1202 	u32 dword = FIELD_PREP(RTW89_TXWD_INFO0_DATA_STBC, desc_info->stbc) |
1203 		    FIELD_PREP(RTW89_TXWD_INFO0_DATA_LDPC, desc_info->ldpc) |
1204 		    FIELD_PREP(RTW89_TXWD_INFO0_DISDATAFB, desc_info->dis_data_fb) |
1205 		    FIELD_PREP(RTW89_TXWD_INFO0_MULTIPORT_ID, desc_info->port) |
1206 		    FIELD_PREP(RTW89_TXWD_INFO0_DATA_ER, desc_info->er_cap) |
1207 		    FIELD_PREP(RTW89_TXWD_INFO0_DATA_BW_ER, 0);
1208 
1209 	return cpu_to_le32(dword);
1210 }
1211 
1212 static __le32 rtw89_build_txwd_info1(struct rtw89_tx_desc_info *desc_info)
1213 {
1214 	u32 dword = FIELD_PREP(RTW89_TXWD_INFO1_MAX_AGGNUM, desc_info->ampdu_num) |
1215 		    FIELD_PREP(RTW89_TXWD_INFO1_A_CTRL_BSR, desc_info->a_ctrl_bsr) |
1216 		    FIELD_PREP(RTW89_TXWD_INFO1_DATA_RTY_LOWEST_RATE,
1217 			       desc_info->data_retry_lowest_rate);
1218 
1219 	return cpu_to_le32(dword);
1220 }
1221 
1222 static __le32 rtw89_build_txwd_info2(struct rtw89_tx_desc_info *desc_info)
1223 {
1224 	u32 dword = FIELD_PREP(RTW89_TXWD_INFO2_AMPDU_DENSITY, desc_info->ampdu_density) |
1225 		    FIELD_PREP(RTW89_TXWD_INFO2_SEC_TYPE, desc_info->sec_type) |
1226 		    FIELD_PREP(RTW89_TXWD_INFO2_SEC_HW_ENC, desc_info->sec_en) |
1227 		    FIELD_PREP(RTW89_TXWD_INFO2_SEC_CAM_IDX, desc_info->sec_cam_idx);
1228 
1229 	return cpu_to_le32(dword);
1230 }
1231 
1232 static __le32 rtw89_build_txwd_info2_v1(struct rtw89_tx_desc_info *desc_info)
1233 {
1234 	u32 dword = FIELD_PREP(RTW89_TXWD_INFO2_AMPDU_DENSITY, desc_info->ampdu_density) |
1235 		    FIELD_PREP(RTW89_TXWD_INFO2_FORCE_KEY_EN, desc_info->sec_en) |
1236 		    FIELD_PREP(RTW89_TXWD_INFO2_SEC_CAM_IDX, desc_info->sec_cam_idx);
1237 
1238 	return cpu_to_le32(dword);
1239 }
1240 
1241 static __le32 rtw89_build_txwd_info4(struct rtw89_tx_desc_info *desc_info)
1242 {
1243 	bool rts_en = !desc_info->is_bmc;
1244 	u32 dword = FIELD_PREP(RTW89_TXWD_INFO4_RTS_EN, rts_en) |
1245 		    FIELD_PREP(RTW89_TXWD_INFO4_HW_RTS_EN, 1);
1246 
1247 	return cpu_to_le32(dword);
1248 }
1249 
1250 void rtw89_core_fill_txdesc(struct rtw89_dev *rtwdev,
1251 			    struct rtw89_tx_desc_info *desc_info,
1252 			    void *txdesc)
1253 {
1254 	struct rtw89_txwd_body *txwd_body = (struct rtw89_txwd_body *)txdesc;
1255 	struct rtw89_txwd_info *txwd_info;
1256 
1257 	txwd_body->dword0 = rtw89_build_txwd_body0(desc_info);
1258 	txwd_body->dword2 = rtw89_build_txwd_body2(desc_info);
1259 	txwd_body->dword3 = rtw89_build_txwd_body3(desc_info);
1260 
1261 	if (!desc_info->en_wd_info)
1262 		return;
1263 
1264 	txwd_info = (struct rtw89_txwd_info *)(txwd_body + 1);
1265 	txwd_info->dword0 = rtw89_build_txwd_info0(desc_info);
1266 	txwd_info->dword1 = rtw89_build_txwd_info1(desc_info);
1267 	txwd_info->dword2 = rtw89_build_txwd_info2(desc_info);
1268 	txwd_info->dword4 = rtw89_build_txwd_info4(desc_info);
1269 
1270 }
1271 EXPORT_SYMBOL(rtw89_core_fill_txdesc);
1272 
1273 void rtw89_core_fill_txdesc_v1(struct rtw89_dev *rtwdev,
1274 			       struct rtw89_tx_desc_info *desc_info,
1275 			       void *txdesc)
1276 {
1277 	struct rtw89_txwd_body_v1 *txwd_body = (struct rtw89_txwd_body_v1 *)txdesc;
1278 	struct rtw89_txwd_info *txwd_info;
1279 
1280 	txwd_body->dword0 = rtw89_build_txwd_body0_v1(desc_info);
1281 	txwd_body->dword1 = rtw89_build_txwd_body1_v1(desc_info);
1282 	txwd_body->dword2 = rtw89_build_txwd_body2(desc_info);
1283 	txwd_body->dword3 = rtw89_build_txwd_body3(desc_info);
1284 	if (desc_info->sec_en) {
1285 		txwd_body->dword4 = rtw89_build_txwd_body4(desc_info);
1286 		txwd_body->dword5 = rtw89_build_txwd_body5(desc_info);
1287 	}
1288 	txwd_body->dword7 = rtw89_build_txwd_body7_v1(desc_info);
1289 
1290 	if (!desc_info->en_wd_info)
1291 		return;
1292 
1293 	txwd_info = (struct rtw89_txwd_info *)(txwd_body + 1);
1294 	txwd_info->dword0 = rtw89_build_txwd_info0_v1(desc_info);
1295 	txwd_info->dword1 = rtw89_build_txwd_info1(desc_info);
1296 	txwd_info->dword2 = rtw89_build_txwd_info2_v1(desc_info);
1297 	txwd_info->dword4 = rtw89_build_txwd_info4(desc_info);
1298 }
1299 EXPORT_SYMBOL(rtw89_core_fill_txdesc_v1);
1300 
1301 static __le32 rtw89_build_txwd_body0_v2(struct rtw89_tx_desc_info *desc_info)
1302 {
1303 	u32 dword = FIELD_PREP(BE_TXD_BODY0_WP_OFFSET_V1, desc_info->wp_offset) |
1304 		    FIELD_PREP(BE_TXD_BODY0_WDINFO_EN, desc_info->en_wd_info) |
1305 		    FIELD_PREP(BE_TXD_BODY0_CH_DMA, desc_info->ch_dma) |
1306 		    FIELD_PREP(BE_TXD_BODY0_HDR_LLC_LEN, desc_info->hdr_llc_len) |
1307 		    FIELD_PREP(BE_TXD_BODY0_WD_PAGE, desc_info->wd_page);
1308 
1309 	return cpu_to_le32(dword);
1310 }
1311 
1312 static __le32 rtw89_build_txwd_body1_v2(struct rtw89_tx_desc_info *desc_info)
1313 {
1314 	u32 dword = FIELD_PREP(BE_TXD_BODY1_ADDR_INFO_NUM, desc_info->addr_info_nr) |
1315 		    FIELD_PREP(BE_TXD_BODY1_SEC_KEYID, desc_info->sec_keyid) |
1316 		    FIELD_PREP(BE_TXD_BODY1_SEC_TYPE, desc_info->sec_type);
1317 
1318 	return cpu_to_le32(dword);
1319 }
1320 
1321 static __le32 rtw89_build_txwd_body2_v2(struct rtw89_tx_desc_info *desc_info)
1322 {
1323 	u32 dword = FIELD_PREP(BE_TXD_BODY2_TID_IND, desc_info->tid_indicate) |
1324 		    FIELD_PREP(BE_TXD_BODY2_QSEL, desc_info->qsel) |
1325 		    FIELD_PREP(BE_TXD_BODY2_TXPKTSIZE, desc_info->pkt_size) |
1326 		    FIELD_PREP(BE_TXD_BODY2_AGG_EN, desc_info->agg_en) |
1327 		    FIELD_PREP(BE_TXD_BODY2_BK, desc_info->bk) |
1328 		    FIELD_PREP(BE_TXD_BODY2_MACID, desc_info->mac_id);
1329 
1330 	return cpu_to_le32(dword);
1331 }
1332 
1333 static __le32 rtw89_build_txwd_body3_v2(struct rtw89_tx_desc_info *desc_info)
1334 {
1335 	u32 dword = FIELD_PREP(BE_TXD_BODY3_WIFI_SEQ, desc_info->seq);
1336 
1337 	return cpu_to_le32(dword);
1338 }
1339 
1340 static __le32 rtw89_build_txwd_body4_v2(struct rtw89_tx_desc_info *desc_info)
1341 {
1342 	u32 dword = FIELD_PREP(BE_TXD_BODY4_SEC_IV_L0, desc_info->sec_seq[0]) |
1343 		    FIELD_PREP(BE_TXD_BODY4_SEC_IV_L1, desc_info->sec_seq[1]);
1344 
1345 	return cpu_to_le32(dword);
1346 }
1347 
1348 static __le32 rtw89_build_txwd_body5_v2(struct rtw89_tx_desc_info *desc_info)
1349 {
1350 	u32 dword = FIELD_PREP(BE_TXD_BODY5_SEC_IV_H2, desc_info->sec_seq[2]) |
1351 		    FIELD_PREP(BE_TXD_BODY5_SEC_IV_H3, desc_info->sec_seq[3]) |
1352 		    FIELD_PREP(BE_TXD_BODY5_SEC_IV_H4, desc_info->sec_seq[4]) |
1353 		    FIELD_PREP(BE_TXD_BODY5_SEC_IV_H5, desc_info->sec_seq[5]);
1354 
1355 	return cpu_to_le32(dword);
1356 }
1357 
1358 static __le32 rtw89_build_txwd_body7_v2(struct rtw89_tx_desc_info *desc_info)
1359 {
1360 	u32 dword = FIELD_PREP(BE_TXD_BODY7_USERATE_SEL, desc_info->use_rate) |
1361 		    FIELD_PREP(BE_TXD_BODY7_DATA_ER, desc_info->er_cap) |
1362 		    FIELD_PREP(BE_TXD_BODY7_DATA_BW_ER, 0) |
1363 		    FIELD_PREP(BE_TXD_BODY7_DATARATE, desc_info->data_rate);
1364 
1365 	return cpu_to_le32(dword);
1366 }
1367 
1368 static __le32 rtw89_build_txwd_info0_v2(struct rtw89_tx_desc_info *desc_info)
1369 {
1370 	u32 dword = FIELD_PREP(BE_TXD_INFO0_DATA_STBC, desc_info->stbc) |
1371 		    FIELD_PREP(BE_TXD_INFO0_DATA_LDPC, desc_info->ldpc) |
1372 		    FIELD_PREP(BE_TXD_INFO0_DISDATAFB, desc_info->dis_data_fb) |
1373 		    FIELD_PREP(BE_TXD_INFO0_MULTIPORT_ID, desc_info->port);
1374 
1375 	return cpu_to_le32(dword);
1376 }
1377 
1378 static __le32 rtw89_build_txwd_info1_v2(struct rtw89_tx_desc_info *desc_info)
1379 {
1380 	u32 dword = FIELD_PREP(BE_TXD_INFO1_MAX_AGG_NUM, desc_info->ampdu_num) |
1381 		    FIELD_PREP(BE_TXD_INFO1_A_CTRL_BSR, desc_info->a_ctrl_bsr) |
1382 		    FIELD_PREP(BE_TXD_INFO1_DATA_RTY_LOWEST_RATE,
1383 			       desc_info->data_retry_lowest_rate);
1384 
1385 	return cpu_to_le32(dword);
1386 }
1387 
1388 static __le32 rtw89_build_txwd_info2_v2(struct rtw89_tx_desc_info *desc_info)
1389 {
1390 	u32 dword = FIELD_PREP(BE_TXD_INFO2_AMPDU_DENSITY, desc_info->ampdu_density) |
1391 		    FIELD_PREP(BE_TXD_INFO2_FORCE_KEY_EN, desc_info->sec_en) |
1392 		    FIELD_PREP(BE_TXD_INFO2_SEC_CAM_IDX, desc_info->sec_cam_idx);
1393 
1394 	return cpu_to_le32(dword);
1395 }
1396 
1397 static __le32 rtw89_build_txwd_info4_v2(struct rtw89_tx_desc_info *desc_info)
1398 {
1399 	bool rts_en = !desc_info->is_bmc;
1400 	u32 dword = FIELD_PREP(BE_TXD_INFO4_RTS_EN, rts_en) |
1401 		    FIELD_PREP(BE_TXD_INFO4_HW_RTS_EN, 1);
1402 
1403 	return cpu_to_le32(dword);
1404 }
1405 
1406 void rtw89_core_fill_txdesc_v2(struct rtw89_dev *rtwdev,
1407 			       struct rtw89_tx_desc_info *desc_info,
1408 			       void *txdesc)
1409 {
1410 	struct rtw89_txwd_body_v2 *txwd_body = txdesc;
1411 	struct rtw89_txwd_info_v2 *txwd_info;
1412 
1413 	txwd_body->dword0 = rtw89_build_txwd_body0_v2(desc_info);
1414 	txwd_body->dword1 = rtw89_build_txwd_body1_v2(desc_info);
1415 	txwd_body->dword2 = rtw89_build_txwd_body2_v2(desc_info);
1416 	txwd_body->dword3 = rtw89_build_txwd_body3_v2(desc_info);
1417 	if (desc_info->sec_en) {
1418 		txwd_body->dword4 = rtw89_build_txwd_body4_v2(desc_info);
1419 		txwd_body->dword5 = rtw89_build_txwd_body5_v2(desc_info);
1420 	}
1421 	txwd_body->dword7 = rtw89_build_txwd_body7_v2(desc_info);
1422 
1423 	if (!desc_info->en_wd_info)
1424 		return;
1425 
1426 	txwd_info = (struct rtw89_txwd_info_v2 *)(txwd_body + 1);
1427 	txwd_info->dword0 = rtw89_build_txwd_info0_v2(desc_info);
1428 	txwd_info->dword1 = rtw89_build_txwd_info1_v2(desc_info);
1429 	txwd_info->dword2 = rtw89_build_txwd_info2_v2(desc_info);
1430 	txwd_info->dword4 = rtw89_build_txwd_info4_v2(desc_info);
1431 }
1432 EXPORT_SYMBOL(rtw89_core_fill_txdesc_v2);
1433 
1434 static __le32 rtw89_build_txwd_fwcmd0_v1(struct rtw89_tx_desc_info *desc_info)
1435 {
1436 	u32 dword = FIELD_PREP(AX_RXD_RPKT_LEN_MASK, desc_info->pkt_size) |
1437 		    FIELD_PREP(AX_RXD_RPKT_TYPE_MASK, desc_info->fw_dl ?
1438 						      RTW89_CORE_RX_TYPE_FWDL :
1439 						      RTW89_CORE_RX_TYPE_H2C);
1440 
1441 	return cpu_to_le32(dword);
1442 }
1443 
1444 void rtw89_core_fill_txdesc_fwcmd_v1(struct rtw89_dev *rtwdev,
1445 				     struct rtw89_tx_desc_info *desc_info,
1446 				     void *txdesc)
1447 {
1448 	struct rtw89_rxdesc_short *txwd_v1 = (struct rtw89_rxdesc_short *)txdesc;
1449 
1450 	txwd_v1->dword0 = rtw89_build_txwd_fwcmd0_v1(desc_info);
1451 }
1452 EXPORT_SYMBOL(rtw89_core_fill_txdesc_fwcmd_v1);
1453 
1454 static __le32 rtw89_build_txwd_fwcmd0_v2(struct rtw89_tx_desc_info *desc_info)
1455 {
1456 	u32 dword = FIELD_PREP(BE_RXD_RPKT_LEN_MASK, desc_info->pkt_size) |
1457 		    FIELD_PREP(BE_RXD_RPKT_TYPE_MASK, desc_info->fw_dl ?
1458 						      RTW89_CORE_RX_TYPE_FWDL :
1459 						      RTW89_CORE_RX_TYPE_H2C);
1460 
1461 	return cpu_to_le32(dword);
1462 }
1463 
1464 void rtw89_core_fill_txdesc_fwcmd_v2(struct rtw89_dev *rtwdev,
1465 				     struct rtw89_tx_desc_info *desc_info,
1466 				     void *txdesc)
1467 {
1468 	struct rtw89_rxdesc_short_v2 *txwd_v2 = (struct rtw89_rxdesc_short_v2 *)txdesc;
1469 
1470 	txwd_v2->dword0 = rtw89_build_txwd_fwcmd0_v2(desc_info);
1471 }
1472 EXPORT_SYMBOL(rtw89_core_fill_txdesc_fwcmd_v2);
1473 
1474 static int rtw89_core_rx_process_mac_ppdu(struct rtw89_dev *rtwdev,
1475 					  struct sk_buff *skb,
1476 					  struct rtw89_rx_phy_ppdu *phy_ppdu)
1477 {
1478 	const struct rtw89_chip_info *chip = rtwdev->chip;
1479 	const struct rtw89_rxinfo *rxinfo = (const struct rtw89_rxinfo *)skb->data;
1480 	const struct rtw89_rxinfo_user *user;
1481 	enum rtw89_chip_gen chip_gen = rtwdev->chip->chip_gen;
1482 	int rx_cnt_size = RTW89_PPDU_MAC_RX_CNT_SIZE;
1483 	bool rx_cnt_valid = false;
1484 	bool invalid = false;
1485 	u8 plcp_size = 0;
1486 	u8 *phy_sts;
1487 	u8 usr_num;
1488 	int i;
1489 
1490 	if (chip_gen == RTW89_CHIP_BE) {
1491 		invalid = le32_get_bits(rxinfo->w0, RTW89_RXINFO_W0_INVALID_V1);
1492 		rx_cnt_size = RTW89_PPDU_MAC_RX_CNT_SIZE_V1;
1493 	}
1494 
1495 	if (invalid)
1496 		return -EINVAL;
1497 
1498 	rx_cnt_valid = le32_get_bits(rxinfo->w0, RTW89_RXINFO_W0_RX_CNT_VLD);
1499 	if (chip_gen == RTW89_CHIP_BE) {
1500 		plcp_size = le32_get_bits(rxinfo->w0, RTW89_RXINFO_W0_PLCP_LEN_V1) << 3;
1501 		usr_num = le32_get_bits(rxinfo->w0, RTW89_RXINFO_W0_USR_NUM_V1);
1502 	} else {
1503 		plcp_size = le32_get_bits(rxinfo->w1, RTW89_RXINFO_W1_PLCP_LEN) << 3;
1504 		usr_num = le32_get_bits(rxinfo->w0, RTW89_RXINFO_W0_USR_NUM);
1505 	}
1506 	if (usr_num > chip->ppdu_max_usr) {
1507 		rtw89_warn(rtwdev, "Invalid user number (%d) in mac info\n",
1508 			   usr_num);
1509 		return -EINVAL;
1510 	}
1511 
1512 	for (i = 0; i < usr_num; i++) {
1513 		user = &rxinfo->user[i];
1514 		if (!le32_get_bits(user->w0, RTW89_RXINFO_USER_MAC_ID_VALID))
1515 			continue;
1516 		/* For WiFi 7 chips, RXWD.mac_id of PPDU status is not set
1517 		 * by hardware, so update mac_id by rxinfo_user[].mac_id.
1518 		 */
1519 		if (chip_gen == RTW89_CHIP_BE)
1520 			phy_ppdu->mac_id =
1521 				le32_get_bits(user->w0, RTW89_RXINFO_USER_MACID);
1522 		phy_ppdu->has_data =
1523 			le32_get_bits(user->w0, RTW89_RXINFO_USER_DATA);
1524 		phy_ppdu->has_bcn =
1525 			le32_get_bits(user->w0, RTW89_RXINFO_USER_BCN);
1526 		break;
1527 	}
1528 
1529 	phy_sts = skb->data + RTW89_PPDU_MAC_INFO_SIZE;
1530 	phy_sts += usr_num * RTW89_PPDU_MAC_INFO_USR_SIZE;
1531 	/* 8-byte alignment */
1532 	if (usr_num & BIT(0))
1533 		phy_sts += RTW89_PPDU_MAC_INFO_USR_SIZE;
1534 	if (rx_cnt_valid)
1535 		phy_sts += rx_cnt_size;
1536 	phy_sts += plcp_size;
1537 
1538 	if (phy_sts > skb->data + skb->len)
1539 		return -EINVAL;
1540 
1541 	phy_ppdu->buf = phy_sts;
1542 	phy_ppdu->len = skb->data + skb->len - phy_sts;
1543 
1544 	return 0;
1545 }
1546 
1547 static u8 rtw89_get_data_rate_nss(struct rtw89_dev *rtwdev, u16 data_rate)
1548 {
1549 	u8 data_rate_mode;
1550 
1551 	data_rate_mode = rtw89_get_data_rate_mode(rtwdev, data_rate);
1552 	switch (data_rate_mode) {
1553 	case DATA_RATE_MODE_NON_HT:
1554 		return 1;
1555 	case DATA_RATE_MODE_HT:
1556 		return rtw89_get_data_ht_nss(rtwdev, data_rate) + 1;
1557 	case DATA_RATE_MODE_VHT:
1558 	case DATA_RATE_MODE_HE:
1559 	case DATA_RATE_MODE_EHT:
1560 		return rtw89_get_data_nss(rtwdev, data_rate) + 1;
1561 	default:
1562 		rtw89_warn(rtwdev, "invalid RX rate mode %d\n", data_rate_mode);
1563 		return 0;
1564 	}
1565 }
1566 
1567 static void rtw89_core_rx_process_phy_ppdu_iter(void *data,
1568 						struct ieee80211_sta *sta)
1569 {
1570 	struct rtw89_rx_phy_ppdu *phy_ppdu = (struct rtw89_rx_phy_ppdu *)data;
1571 	struct rtw89_sta *rtwsta = sta_to_rtwsta(sta);
1572 	struct rtw89_dev *rtwdev = rtwsta->rtwdev;
1573 	struct rtw89_hal *hal = &rtwdev->hal;
1574 	struct rtw89_sta_link *rtwsta_link;
1575 	u8 ant_num = hal->ant_diversity ? 2 : rtwdev->chip->rf_path_num;
1576 	u8 ant_pos = U8_MAX;
1577 	u8 evm_pos = 0;
1578 	int i;
1579 
1580 	/* FIXME: For single link, taking link on HW-0 here is okay. But, when
1581 	 * enabling multiple active links, we should determine the right link.
1582 	 */
1583 	rtwsta_link = rtw89_sta_get_link_inst(rtwsta, 0);
1584 	if (unlikely(!rtwsta_link))
1585 		return;
1586 
1587 	if (rtwsta_link->mac_id != phy_ppdu->mac_id || !phy_ppdu->to_self)
1588 		return;
1589 
1590 	if (hal->ant_diversity && hal->antenna_rx) {
1591 		ant_pos = __ffs(hal->antenna_rx);
1592 		evm_pos = ant_pos;
1593 	}
1594 
1595 	ewma_rssi_add(&rtwsta_link->avg_rssi, phy_ppdu->rssi_avg);
1596 
1597 	if (ant_pos < ant_num) {
1598 		ewma_rssi_add(&rtwsta_link->rssi[ant_pos], phy_ppdu->rssi[0]);
1599 	} else {
1600 		for (i = 0; i < rtwdev->chip->rf_path_num; i++)
1601 			ewma_rssi_add(&rtwsta_link->rssi[i], phy_ppdu->rssi[i]);
1602 	}
1603 
1604 	if (phy_ppdu->ofdm.has && (phy_ppdu->has_data || phy_ppdu->has_bcn)) {
1605 		ewma_snr_add(&rtwsta_link->avg_snr, phy_ppdu->ofdm.avg_snr);
1606 		if (rtw89_get_data_rate_nss(rtwdev, phy_ppdu->rate) == 1) {
1607 			ewma_evm_add(&rtwsta_link->evm_1ss, phy_ppdu->ofdm.evm_min);
1608 		} else {
1609 			ewma_evm_add(&rtwsta_link->evm_min[evm_pos],
1610 				     phy_ppdu->ofdm.evm_min);
1611 			ewma_evm_add(&rtwsta_link->evm_max[evm_pos],
1612 				     phy_ppdu->ofdm.evm_max);
1613 		}
1614 	}
1615 }
1616 
1617 #define VAR_LEN 0xff
1618 #define VAR_LEN_UNIT 8
1619 static u16 rtw89_core_get_phy_status_ie_len(struct rtw89_dev *rtwdev,
1620 					    const struct rtw89_phy_sts_iehdr *iehdr)
1621 {
1622 	static const u8 physts_ie_len_tabs[RTW89_CHIP_GEN_NUM][32] = {
1623 		[RTW89_CHIP_AX] = {
1624 			16, 32, 24, 24, 8, 8, 8, 8, VAR_LEN, 8, VAR_LEN, 176, VAR_LEN,
1625 			VAR_LEN, VAR_LEN, VAR_LEN, VAR_LEN, VAR_LEN, 16, 24, VAR_LEN,
1626 			VAR_LEN, VAR_LEN, 0, 24, 24, 24, 24, 32, 32, 32, 32
1627 		},
1628 		[RTW89_CHIP_BE] = {
1629 			32, 40, 24, 24, 8, 8, 8, 8, VAR_LEN, 8, VAR_LEN, 176, VAR_LEN,
1630 			VAR_LEN, VAR_LEN, VAR_LEN, VAR_LEN, VAR_LEN, 16, 24, VAR_LEN,
1631 			VAR_LEN, VAR_LEN, 0, 24, 24, 24, 24, 32, 32, 32, 32
1632 		},
1633 	};
1634 	const u8 *physts_ie_len_tab;
1635 	u16 ie_len;
1636 	u8 ie;
1637 
1638 	physts_ie_len_tab = physts_ie_len_tabs[rtwdev->chip->chip_gen];
1639 
1640 	ie = le32_get_bits(iehdr->w0, RTW89_PHY_STS_IEHDR_TYPE);
1641 	if (physts_ie_len_tab[ie] != VAR_LEN)
1642 		ie_len = physts_ie_len_tab[ie];
1643 	else
1644 		ie_len = le32_get_bits(iehdr->w0, RTW89_PHY_STS_IEHDR_LEN) * VAR_LEN_UNIT;
1645 
1646 	return ie_len;
1647 }
1648 
1649 static void rtw89_core_parse_phy_status_ie01_v2(struct rtw89_dev *rtwdev,
1650 						const struct rtw89_phy_sts_iehdr *iehdr,
1651 						struct rtw89_rx_phy_ppdu *phy_ppdu)
1652 {
1653 	const struct rtw89_phy_sts_ie01_v2 *ie;
1654 	u8 *rpl_fd = phy_ppdu->rpl_fd;
1655 
1656 	ie = (const struct rtw89_phy_sts_ie01_v2 *)iehdr;
1657 	rpl_fd[RF_PATH_A] = le32_get_bits(ie->w8, RTW89_PHY_STS_IE01_V2_W8_RPL_FD_A);
1658 	rpl_fd[RF_PATH_B] = le32_get_bits(ie->w8, RTW89_PHY_STS_IE01_V2_W8_RPL_FD_B);
1659 	rpl_fd[RF_PATH_C] = le32_get_bits(ie->w9, RTW89_PHY_STS_IE01_V2_W9_RPL_FD_C);
1660 	rpl_fd[RF_PATH_D] = le32_get_bits(ie->w9, RTW89_PHY_STS_IE01_V2_W9_RPL_FD_D);
1661 
1662 	phy_ppdu->bw_idx = le32_get_bits(ie->w5, RTW89_PHY_STS_IE01_V2_W5_BW_IDX);
1663 }
1664 
1665 static void rtw89_core_parse_phy_status_ie01(struct rtw89_dev *rtwdev,
1666 					     const struct rtw89_phy_sts_iehdr *iehdr,
1667 					     struct rtw89_rx_phy_ppdu *phy_ppdu)
1668 {
1669 	const struct rtw89_phy_sts_ie01 *ie = (const struct rtw89_phy_sts_ie01 *)iehdr;
1670 	s16 cfo;
1671 	u32 t;
1672 
1673 	phy_ppdu->chan_idx = le32_get_bits(ie->w0, RTW89_PHY_STS_IE01_W0_CH_IDX);
1674 
1675 	if (rtwdev->hw->conf.flags & IEEE80211_CONF_MONITOR) {
1676 		phy_ppdu->ldpc = le32_get_bits(ie->w2, RTW89_PHY_STS_IE01_W2_LDPC);
1677 		phy_ppdu->stbc = le32_get_bits(ie->w2, RTW89_PHY_STS_IE01_W2_STBC);
1678 	}
1679 
1680 	if (!phy_ppdu->hdr_2_en)
1681 		phy_ppdu->rx_path_en =
1682 			le32_get_bits(ie->w0, RTW89_PHY_STS_IE01_W0_RX_PATH_EN);
1683 
1684 	if (phy_ppdu->rate < RTW89_HW_RATE_OFDM6)
1685 		return;
1686 
1687 	if (!phy_ppdu->to_self)
1688 		return;
1689 
1690 	phy_ppdu->rpl_avg = le32_get_bits(ie->w0, RTW89_PHY_STS_IE01_W0_RSSI_AVG_FD);
1691 	phy_ppdu->ofdm.avg_snr = le32_get_bits(ie->w2, RTW89_PHY_STS_IE01_W2_AVG_SNR);
1692 	phy_ppdu->ofdm.evm_max = le32_get_bits(ie->w2, RTW89_PHY_STS_IE01_W2_EVM_MAX);
1693 	phy_ppdu->ofdm.evm_min = le32_get_bits(ie->w2, RTW89_PHY_STS_IE01_W2_EVM_MIN);
1694 	phy_ppdu->ofdm.has = true;
1695 
1696 	/* sign conversion for S(12,2) */
1697 	if (rtwdev->chip->cfo_src_fd) {
1698 		t = le32_get_bits(ie->w1, RTW89_PHY_STS_IE01_W1_FD_CFO);
1699 		cfo = sign_extend32(t, 11);
1700 	} else {
1701 		t = le32_get_bits(ie->w1, RTW89_PHY_STS_IE01_W1_PREMB_CFO);
1702 		cfo = sign_extend32(t, 11);
1703 	}
1704 
1705 	rtw89_phy_cfo_parse(rtwdev, cfo, phy_ppdu);
1706 
1707 	if (rtwdev->chip->chip_gen == RTW89_CHIP_BE)
1708 		rtw89_core_parse_phy_status_ie01_v2(rtwdev, iehdr, phy_ppdu);
1709 }
1710 
1711 static void rtw89_core_parse_phy_status_ie00(struct rtw89_dev *rtwdev,
1712 					     const struct rtw89_phy_sts_iehdr *iehdr,
1713 					     struct rtw89_rx_phy_ppdu *phy_ppdu)
1714 {
1715 	const struct rtw89_phy_sts_ie00 *ie = (const struct rtw89_phy_sts_ie00 *)iehdr;
1716 	u16 tmp_rpl;
1717 
1718 	tmp_rpl = le32_get_bits(ie->w0, RTW89_PHY_STS_IE00_W0_RPL);
1719 	phy_ppdu->rpl_avg = tmp_rpl >> 1;
1720 }
1721 
1722 static void rtw89_core_parse_phy_status_ie00_v2(struct rtw89_dev *rtwdev,
1723 						const struct rtw89_phy_sts_iehdr *iehdr,
1724 						struct rtw89_rx_phy_ppdu *phy_ppdu)
1725 {
1726 	const struct rtw89_phy_sts_ie00_v2 *ie;
1727 	u8 *rpl_path = phy_ppdu->rpl_path;
1728 	u16 tmp_rpl[RF_PATH_MAX];
1729 	u8 i;
1730 
1731 	ie = (const struct rtw89_phy_sts_ie00_v2 *)iehdr;
1732 	tmp_rpl[RF_PATH_A] = le32_get_bits(ie->w4, RTW89_PHY_STS_IE00_V2_W4_RPL_TD_A);
1733 	tmp_rpl[RF_PATH_B] = le32_get_bits(ie->w4, RTW89_PHY_STS_IE00_V2_W4_RPL_TD_B);
1734 	tmp_rpl[RF_PATH_C] = le32_get_bits(ie->w4, RTW89_PHY_STS_IE00_V2_W4_RPL_TD_C);
1735 	tmp_rpl[RF_PATH_D] = le32_get_bits(ie->w5, RTW89_PHY_STS_IE00_V2_W5_RPL_TD_D);
1736 
1737 	for (i = 0; i < RF_PATH_MAX; i++)
1738 		rpl_path[i] = tmp_rpl[i] >> 1;
1739 }
1740 
1741 static int rtw89_core_process_phy_status_ie(struct rtw89_dev *rtwdev,
1742 					    const struct rtw89_phy_sts_iehdr *iehdr,
1743 					    struct rtw89_rx_phy_ppdu *phy_ppdu)
1744 {
1745 	u8 ie;
1746 
1747 	ie = le32_get_bits(iehdr->w0, RTW89_PHY_STS_IEHDR_TYPE);
1748 
1749 	switch (ie) {
1750 	case RTW89_PHYSTS_IE00_CMN_CCK:
1751 		rtw89_core_parse_phy_status_ie00(rtwdev, iehdr, phy_ppdu);
1752 		if (rtwdev->chip->chip_gen == RTW89_CHIP_BE)
1753 			rtw89_core_parse_phy_status_ie00_v2(rtwdev, iehdr, phy_ppdu);
1754 		break;
1755 	case RTW89_PHYSTS_IE01_CMN_OFDM:
1756 		rtw89_core_parse_phy_status_ie01(rtwdev, iehdr, phy_ppdu);
1757 		break;
1758 	default:
1759 		break;
1760 	}
1761 
1762 	return 0;
1763 }
1764 
1765 static void rtw89_core_update_phy_ppdu_hdr_v2(struct rtw89_rx_phy_ppdu *phy_ppdu)
1766 {
1767 	const struct rtw89_phy_sts_hdr_v2 *hdr = phy_ppdu->buf + PHY_STS_HDR_LEN;
1768 
1769 	phy_ppdu->rx_path_en = le32_get_bits(hdr->w0, RTW89_PHY_STS_HDR_V2_W0_PATH_EN);
1770 }
1771 
1772 static void rtw89_core_update_phy_ppdu(struct rtw89_rx_phy_ppdu *phy_ppdu)
1773 {
1774 	const struct rtw89_phy_sts_hdr *hdr = phy_ppdu->buf;
1775 	u8 *rssi = phy_ppdu->rssi;
1776 
1777 	phy_ppdu->ie = le32_get_bits(hdr->w0, RTW89_PHY_STS_HDR_W0_IE_MAP);
1778 	phy_ppdu->rssi_avg = le32_get_bits(hdr->w0, RTW89_PHY_STS_HDR_W0_RSSI_AVG);
1779 	rssi[RF_PATH_A] = le32_get_bits(hdr->w1, RTW89_PHY_STS_HDR_W1_RSSI_A);
1780 	rssi[RF_PATH_B] = le32_get_bits(hdr->w1, RTW89_PHY_STS_HDR_W1_RSSI_B);
1781 	rssi[RF_PATH_C] = le32_get_bits(hdr->w1, RTW89_PHY_STS_HDR_W1_RSSI_C);
1782 	rssi[RF_PATH_D] = le32_get_bits(hdr->w1, RTW89_PHY_STS_HDR_W1_RSSI_D);
1783 
1784 	phy_ppdu->hdr_2_en = le32_get_bits(hdr->w0, RTW89_PHY_STS_HDR_W0_HDR_2_EN);
1785 	if (phy_ppdu->hdr_2_en)
1786 		rtw89_core_update_phy_ppdu_hdr_v2(phy_ppdu);
1787 }
1788 
1789 static int rtw89_core_rx_process_phy_ppdu(struct rtw89_dev *rtwdev,
1790 					  struct rtw89_rx_phy_ppdu *phy_ppdu)
1791 {
1792 	const struct rtw89_phy_sts_hdr *hdr = phy_ppdu->buf;
1793 	u32 len_from_header;
1794 	bool physts_valid;
1795 
1796 	physts_valid = le32_get_bits(hdr->w0, RTW89_PHY_STS_HDR_W0_VALID);
1797 	if (!physts_valid)
1798 		return -EINVAL;
1799 
1800 	len_from_header = le32_get_bits(hdr->w0, RTW89_PHY_STS_HDR_W0_LEN) << 3;
1801 
1802 	if (rtwdev->chip->chip_gen == RTW89_CHIP_BE)
1803 		len_from_header += PHY_STS_HDR_LEN;
1804 
1805 	if (len_from_header != phy_ppdu->len) {
1806 		rtw89_debug(rtwdev, RTW89_DBG_UNEXP, "phy ppdu len mismatch\n");
1807 		return -EINVAL;
1808 	}
1809 	rtw89_core_update_phy_ppdu(phy_ppdu);
1810 
1811 	return 0;
1812 }
1813 
1814 static int rtw89_core_rx_parse_phy_sts(struct rtw89_dev *rtwdev,
1815 				       struct rtw89_rx_phy_ppdu *phy_ppdu)
1816 {
1817 	u16 ie_len;
1818 	void *pos, *end;
1819 
1820 	/* mark invalid reports and bypass them */
1821 	if (phy_ppdu->ie < RTW89_CCK_PKT)
1822 		return -EINVAL;
1823 
1824 	pos = phy_ppdu->buf + PHY_STS_HDR_LEN;
1825 	end = phy_ppdu->buf + phy_ppdu->len;
1826 	while (pos < end) {
1827 		const struct rtw89_phy_sts_iehdr *iehdr = pos;
1828 
1829 		ie_len = rtw89_core_get_phy_status_ie_len(rtwdev, iehdr);
1830 		rtw89_core_process_phy_status_ie(rtwdev, iehdr, phy_ppdu);
1831 		pos += ie_len;
1832 		if (pos > end || ie_len == 0) {
1833 			rtw89_debug(rtwdev, RTW89_DBG_TXRX,
1834 				    "phy status parse failed\n");
1835 			return -EINVAL;
1836 		}
1837 	}
1838 
1839 	rtw89_chip_convert_rpl_to_rssi(rtwdev, phy_ppdu);
1840 	rtw89_phy_antdiv_parse(rtwdev, phy_ppdu);
1841 
1842 	return 0;
1843 }
1844 
1845 static void rtw89_core_rx_process_phy_sts(struct rtw89_dev *rtwdev,
1846 					  struct rtw89_rx_phy_ppdu *phy_ppdu)
1847 {
1848 	int ret;
1849 
1850 	ret = rtw89_core_rx_parse_phy_sts(rtwdev, phy_ppdu);
1851 	if (ret)
1852 		rtw89_debug(rtwdev, RTW89_DBG_TXRX, "parse phy sts failed\n");
1853 	else
1854 		phy_ppdu->valid = true;
1855 
1856 	ieee80211_iterate_stations_atomic(rtwdev->hw,
1857 					  rtw89_core_rx_process_phy_ppdu_iter,
1858 					  phy_ppdu);
1859 }
1860 
1861 static u8 rtw89_rxdesc_to_nl_he_eht_gi(struct rtw89_dev *rtwdev,
1862 				       u8 desc_info_gi,
1863 				       bool rx_status, bool eht)
1864 {
1865 	switch (desc_info_gi) {
1866 	case RTW89_GILTF_SGI_4XHE08:
1867 	case RTW89_GILTF_2XHE08:
1868 	case RTW89_GILTF_1XHE08:
1869 		return eht ? NL80211_RATE_INFO_EHT_GI_0_8 :
1870 			     NL80211_RATE_INFO_HE_GI_0_8;
1871 	case RTW89_GILTF_2XHE16:
1872 	case RTW89_GILTF_1XHE16:
1873 		return eht ? NL80211_RATE_INFO_EHT_GI_1_6 :
1874 			     NL80211_RATE_INFO_HE_GI_1_6;
1875 	case RTW89_GILTF_LGI_4XHE32:
1876 		return eht ? NL80211_RATE_INFO_EHT_GI_3_2 :
1877 			     NL80211_RATE_INFO_HE_GI_3_2;
1878 	default:
1879 		rtw89_warn(rtwdev, "invalid gi_ltf=%d", desc_info_gi);
1880 		if (rx_status)
1881 			return eht ? NL80211_RATE_INFO_EHT_GI_3_2 :
1882 				     NL80211_RATE_INFO_HE_GI_3_2;
1883 		return U8_MAX;
1884 	}
1885 }
1886 
1887 static
1888 bool rtw89_check_rx_statu_gi_match(struct ieee80211_rx_status *status, u8 gi_ltf,
1889 				   bool eht)
1890 {
1891 	if (eht)
1892 		return status->eht.gi == gi_ltf;
1893 
1894 	return status->he_gi == gi_ltf;
1895 }
1896 
1897 static bool rtw89_core_rx_ppdu_match(struct rtw89_dev *rtwdev,
1898 				     struct rtw89_rx_desc_info *desc_info,
1899 				     struct ieee80211_rx_status *status)
1900 {
1901 	u8 band = desc_info->bb_sel ? RTW89_PHY_1 : RTW89_PHY_0;
1902 	u8 data_rate_mode, bw, rate_idx = MASKBYTE0, gi_ltf;
1903 	bool eht = false;
1904 	u16 data_rate;
1905 	bool ret;
1906 
1907 	data_rate = desc_info->data_rate;
1908 	data_rate_mode = rtw89_get_data_rate_mode(rtwdev, data_rate);
1909 	if (data_rate_mode == DATA_RATE_MODE_NON_HT) {
1910 		rate_idx = rtw89_get_data_not_ht_idx(rtwdev, data_rate);
1911 		/* rate_idx is still hardware value here */
1912 	} else if (data_rate_mode == DATA_RATE_MODE_HT) {
1913 		rate_idx = rtw89_get_data_ht_mcs(rtwdev, data_rate);
1914 	} else if (data_rate_mode == DATA_RATE_MODE_VHT ||
1915 		   data_rate_mode == DATA_RATE_MODE_HE ||
1916 		   data_rate_mode == DATA_RATE_MODE_EHT) {
1917 		rate_idx = rtw89_get_data_mcs(rtwdev, data_rate);
1918 	} else {
1919 		rtw89_warn(rtwdev, "invalid RX rate mode %d\n", data_rate_mode);
1920 	}
1921 
1922 	eht = data_rate_mode == DATA_RATE_MODE_EHT;
1923 	bw = rtw89_hw_to_rate_info_bw(desc_info->bw);
1924 	gi_ltf = rtw89_rxdesc_to_nl_he_eht_gi(rtwdev, desc_info->gi_ltf, false, eht);
1925 	ret = rtwdev->ppdu_sts.curr_rx_ppdu_cnt[band] == desc_info->ppdu_cnt &&
1926 	      status->rate_idx == rate_idx &&
1927 	      rtw89_check_rx_statu_gi_match(status, gi_ltf, eht) &&
1928 	      status->bw == bw;
1929 
1930 	return ret;
1931 }
1932 
1933 struct rtw89_vif_rx_stats_iter_data {
1934 	struct rtw89_dev *rtwdev;
1935 	struct rtw89_rx_phy_ppdu *phy_ppdu;
1936 	struct rtw89_rx_desc_info *desc_info;
1937 	struct sk_buff *skb;
1938 	const u8 *bssid;
1939 };
1940 
1941 static void rtw89_stats_trigger_frame(struct rtw89_dev *rtwdev,
1942 				      struct rtw89_vif_link *rtwvif_link,
1943 				      struct ieee80211_bss_conf *bss_conf,
1944 				      struct sk_buff *skb)
1945 {
1946 	struct ieee80211_trigger *tf = (struct ieee80211_trigger *)skb->data;
1947 	struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
1948 	struct rtw89_vif *rtwvif = rtwvif_link->rtwvif;
1949 	u8 *pos, *end, type, tf_bw;
1950 	u16 aid, tf_rua;
1951 
1952 	if (!ether_addr_equal(bss_conf->bssid, tf->ta) ||
1953 	    rtwvif_link->wifi_role != RTW89_WIFI_ROLE_STATION ||
1954 	    rtwvif_link->net_type == RTW89_NET_TYPE_NO_LINK)
1955 		return;
1956 
1957 	type = le64_get_bits(tf->common_info, IEEE80211_TRIGGER_TYPE_MASK);
1958 	if (type != IEEE80211_TRIGGER_TYPE_BASIC && type != IEEE80211_TRIGGER_TYPE_MU_BAR)
1959 		return;
1960 
1961 	end = (u8 *)tf + skb->len;
1962 	pos = tf->variable;
1963 
1964 	while (end - pos >= RTW89_TF_BASIC_USER_INFO_SZ) {
1965 		aid = RTW89_GET_TF_USER_INFO_AID12(pos);
1966 		tf_rua = RTW89_GET_TF_USER_INFO_RUA(pos);
1967 		tf_bw = le64_get_bits(tf->common_info, IEEE80211_TRIGGER_ULBW_MASK);
1968 		rtw89_debug(rtwdev, RTW89_DBG_TXRX,
1969 			    "[TF] aid: %d, ul_mcs: %d, rua: %d, bw: %d\n",
1970 			    aid, RTW89_GET_TF_USER_INFO_UL_MCS(pos),
1971 			    tf_rua, tf_bw);
1972 
1973 		if (aid == RTW89_TF_PAD)
1974 			break;
1975 
1976 		if (aid == vif->cfg.aid) {
1977 			enum nl80211_he_ru_alloc rua = rtw89_he_rua_to_ru_alloc(tf_rua >> 1);
1978 
1979 			rtwvif->stats.rx_tf_acc++;
1980 			rtwdev->stats.rx_tf_acc++;
1981 			if (tf_bw == IEEE80211_TRIGGER_ULBW_160_80P80MHZ &&
1982 			    rua <= NL80211_RATE_INFO_HE_RU_ALLOC_106)
1983 				rtwvif_link->pwr_diff_en = true;
1984 			break;
1985 		}
1986 
1987 		pos += RTW89_TF_BASIC_USER_INFO_SZ;
1988 	}
1989 }
1990 
1991 static void rtw89_cancel_6ghz_probe_work(struct work_struct *work)
1992 {
1993 	struct rtw89_dev *rtwdev = container_of(work, struct rtw89_dev,
1994 						cancel_6ghz_probe_work);
1995 	struct list_head *pkt_list = rtwdev->scan_info.pkt_list;
1996 	struct rtw89_pktofld_info *info;
1997 
1998 	mutex_lock(&rtwdev->mutex);
1999 
2000 	if (!rtwdev->scanning)
2001 		goto out;
2002 
2003 	list_for_each_entry(info, &pkt_list[NL80211_BAND_6GHZ], list) {
2004 		if (!info->cancel || !test_bit(info->id, rtwdev->pkt_offload))
2005 			continue;
2006 
2007 		rtw89_fw_h2c_del_pkt_offload(rtwdev, info->id);
2008 
2009 		/* Don't delete/free info from pkt_list at this moment. Let it
2010 		 * be deleted/freed in rtw89_release_pkt_list() after scanning,
2011 		 * since if during scanning, pkt_list is accessed in bottom half.
2012 		 */
2013 	}
2014 
2015 out:
2016 	mutex_unlock(&rtwdev->mutex);
2017 }
2018 
2019 static void rtw89_core_cancel_6ghz_probe_tx(struct rtw89_dev *rtwdev,
2020 					    struct sk_buff *skb)
2021 {
2022 	struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
2023 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
2024 	struct list_head *pkt_list = rtwdev->scan_info.pkt_list;
2025 	struct rtw89_pktofld_info *info;
2026 	const u8 *ies = mgmt->u.beacon.variable, *ssid_ie;
2027 	bool queue_work = false;
2028 
2029 	if (rx_status->band != NL80211_BAND_6GHZ)
2030 		return;
2031 
2032 	ssid_ie = cfg80211_find_ie(WLAN_EID_SSID, ies, skb->len);
2033 
2034 	list_for_each_entry(info, &pkt_list[NL80211_BAND_6GHZ], list) {
2035 		if (ether_addr_equal(info->bssid, mgmt->bssid)) {
2036 			info->cancel = true;
2037 			queue_work = true;
2038 			continue;
2039 		}
2040 
2041 		if (!ssid_ie || ssid_ie[1] != info->ssid_len || info->ssid_len == 0)
2042 			continue;
2043 
2044 		if (memcmp(&ssid_ie[2], info->ssid, info->ssid_len) == 0) {
2045 			info->cancel = true;
2046 			queue_work = true;
2047 		}
2048 	}
2049 
2050 	if (queue_work)
2051 		ieee80211_queue_work(rtwdev->hw, &rtwdev->cancel_6ghz_probe_work);
2052 }
2053 
2054 static void rtw89_vif_sync_bcn_tsf(struct rtw89_vif_link *rtwvif_link,
2055 				   struct ieee80211_hdr *hdr, size_t len)
2056 {
2057 	struct ieee80211_mgmt *mgmt = (typeof(mgmt))hdr;
2058 
2059 	if (len < offsetof(typeof(*mgmt), u.beacon.variable))
2060 		return;
2061 
2062 	WRITE_ONCE(rtwvif_link->sync_bcn_tsf, le64_to_cpu(mgmt->u.beacon.timestamp));
2063 }
2064 
2065 static void rtw89_vif_rx_stats_iter(void *data, u8 *mac,
2066 				    struct ieee80211_vif *vif)
2067 {
2068 	struct rtw89_vif_rx_stats_iter_data *iter_data = data;
2069 	struct rtw89_dev *rtwdev = iter_data->rtwdev;
2070 	struct rtw89_vif *rtwvif = vif_to_rtwvif(vif);
2071 	struct rtw89_pkt_stat *pkt_stat = &rtwdev->phystat.cur_pkt_stat;
2072 	struct rtw89_rx_desc_info *desc_info = iter_data->desc_info;
2073 	struct sk_buff *skb = iter_data->skb;
2074 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2075 	struct rtw89_rx_phy_ppdu *phy_ppdu = iter_data->phy_ppdu;
2076 	struct ieee80211_bss_conf *bss_conf;
2077 	struct rtw89_vif_link *rtwvif_link;
2078 	const u8 *bssid = iter_data->bssid;
2079 
2080 	if (rtwdev->scanning &&
2081 	    (ieee80211_is_beacon(hdr->frame_control) ||
2082 	     ieee80211_is_probe_resp(hdr->frame_control)))
2083 		rtw89_core_cancel_6ghz_probe_tx(rtwdev, skb);
2084 
2085 	rcu_read_lock();
2086 
2087 	/* FIXME: For single link, taking link on HW-0 here is okay. But, when
2088 	 * enabling multiple active links, we should determine the right link.
2089 	 */
2090 	rtwvif_link = rtw89_vif_get_link_inst(rtwvif, 0);
2091 	if (unlikely(!rtwvif_link))
2092 		goto out;
2093 
2094 	bss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, false);
2095 	if (!bss_conf->bssid)
2096 		goto out;
2097 
2098 	if (ieee80211_is_trigger(hdr->frame_control)) {
2099 		rtw89_stats_trigger_frame(rtwdev, rtwvif_link, bss_conf, skb);
2100 		goto out;
2101 	}
2102 
2103 	if (!ether_addr_equal(bss_conf->bssid, bssid))
2104 		goto out;
2105 
2106 	if (ieee80211_is_beacon(hdr->frame_control)) {
2107 		if (vif->type == NL80211_IFTYPE_STATION &&
2108 		    !test_bit(RTW89_FLAG_WOWLAN, rtwdev->flags)) {
2109 			rtw89_vif_sync_bcn_tsf(rtwvif_link, hdr, skb->len);
2110 			rtw89_fw_h2c_rssi_offload(rtwdev, phy_ppdu);
2111 		}
2112 		pkt_stat->beacon_nr++;
2113 
2114 		if (phy_ppdu)
2115 			ewma_rssi_add(&rtwdev->phystat.bcn_rssi, phy_ppdu->rssi_avg);
2116 	}
2117 
2118 	if (!ether_addr_equal(bss_conf->addr, hdr->addr1))
2119 		goto out;
2120 
2121 	if (desc_info->data_rate < RTW89_HW_RATE_NR)
2122 		pkt_stat->rx_rate_cnt[desc_info->data_rate]++;
2123 
2124 	rtw89_traffic_stats_accu(rtwdev, &rtwvif->stats, skb, false);
2125 
2126 out:
2127 	rcu_read_unlock();
2128 }
2129 
2130 static void rtw89_core_rx_stats(struct rtw89_dev *rtwdev,
2131 				struct rtw89_rx_phy_ppdu *phy_ppdu,
2132 				struct rtw89_rx_desc_info *desc_info,
2133 				struct sk_buff *skb)
2134 {
2135 	struct rtw89_vif_rx_stats_iter_data iter_data;
2136 
2137 	rtw89_traffic_stats_accu(rtwdev, &rtwdev->stats, skb, false);
2138 
2139 	iter_data.rtwdev = rtwdev;
2140 	iter_data.phy_ppdu = phy_ppdu;
2141 	iter_data.desc_info = desc_info;
2142 	iter_data.skb = skb;
2143 	iter_data.bssid = get_hdr_bssid((struct ieee80211_hdr *)skb->data);
2144 	rtw89_iterate_vifs_bh(rtwdev, rtw89_vif_rx_stats_iter, &iter_data);
2145 }
2146 
2147 static void rtw89_correct_cck_chan(struct rtw89_dev *rtwdev,
2148 				   struct ieee80211_rx_status *status)
2149 {
2150 	const struct rtw89_chan_rcd *rcd =
2151 		rtw89_chan_rcd_get(rtwdev, RTW89_CHANCTX_0);
2152 	u16 chan = rcd->prev_primary_channel;
2153 	u8 band = rtw89_hw_to_nl80211_band(rcd->prev_band_type);
2154 
2155 	if (status->band != NL80211_BAND_2GHZ &&
2156 	    status->encoding == RX_ENC_LEGACY &&
2157 	    status->rate_idx < RTW89_HW_RATE_OFDM6) {
2158 		status->freq = ieee80211_channel_to_frequency(chan, band);
2159 		status->band = band;
2160 	}
2161 }
2162 
2163 static void rtw89_core_hw_to_sband_rate(struct ieee80211_rx_status *rx_status)
2164 {
2165 	if (rx_status->band == NL80211_BAND_2GHZ ||
2166 	    rx_status->encoding != RX_ENC_LEGACY)
2167 		return;
2168 
2169 	/* Some control frames' freq(ACKs in this case) are reported wrong due
2170 	 * to FW notify timing, set to lowest rate to prevent overflow.
2171 	 */
2172 	if (rx_status->rate_idx < RTW89_HW_RATE_OFDM6) {
2173 		rx_status->rate_idx = 0;
2174 		return;
2175 	}
2176 
2177 	/* No 4 CCK rates for non-2G */
2178 	rx_status->rate_idx -= 4;
2179 }
2180 
2181 static
2182 void rtw89_core_update_rx_status_by_ppdu(struct rtw89_dev *rtwdev,
2183 					 struct ieee80211_rx_status *rx_status,
2184 					 struct rtw89_rx_phy_ppdu *phy_ppdu)
2185 {
2186 	if (!(rtwdev->hw->conf.flags & IEEE80211_CONF_MONITOR))
2187 		return;
2188 
2189 	if (!phy_ppdu)
2190 		return;
2191 
2192 	if (phy_ppdu->ldpc)
2193 		rx_status->enc_flags |= RX_ENC_FLAG_LDPC;
2194 	if (phy_ppdu->stbc)
2195 		rx_status->enc_flags |= u8_encode_bits(1, RX_ENC_FLAG_STBC_MASK);
2196 }
2197 
2198 static const u8 rx_status_bw_to_radiotap_eht_usig[] = {
2199 	[RATE_INFO_BW_20] = IEEE80211_RADIOTAP_EHT_USIG_COMMON_BW_20MHZ,
2200 	[RATE_INFO_BW_5] = U8_MAX,
2201 	[RATE_INFO_BW_10] = U8_MAX,
2202 	[RATE_INFO_BW_40] = IEEE80211_RADIOTAP_EHT_USIG_COMMON_BW_40MHZ,
2203 	[RATE_INFO_BW_80] = IEEE80211_RADIOTAP_EHT_USIG_COMMON_BW_80MHZ,
2204 	[RATE_INFO_BW_160] = IEEE80211_RADIOTAP_EHT_USIG_COMMON_BW_160MHZ,
2205 	[RATE_INFO_BW_HE_RU] = U8_MAX,
2206 	[RATE_INFO_BW_320] = IEEE80211_RADIOTAP_EHT_USIG_COMMON_BW_320MHZ_1,
2207 	[RATE_INFO_BW_EHT_RU] = U8_MAX,
2208 };
2209 
2210 static void rtw89_core_update_radiotap_eht(struct rtw89_dev *rtwdev,
2211 					   struct sk_buff *skb,
2212 					   struct ieee80211_rx_status *rx_status)
2213 {
2214 	struct ieee80211_radiotap_eht_usig *usig;
2215 	struct ieee80211_radiotap_eht *eht;
2216 	struct ieee80211_radiotap_tlv *tlv;
2217 	int eht_len = struct_size(eht, user_info, 1);
2218 	int usig_len = sizeof(*usig);
2219 	int len;
2220 	u8 bw;
2221 
2222 	len = sizeof(*tlv) + ALIGN(eht_len, 4) +
2223 	      sizeof(*tlv) + ALIGN(usig_len, 4);
2224 
2225 	rx_status->flag |= RX_FLAG_RADIOTAP_TLV_AT_END;
2226 	skb_reset_mac_header(skb);
2227 
2228 	/* EHT */
2229 	tlv = skb_push(skb, len);
2230 	memset(tlv, 0, len);
2231 	tlv->type = cpu_to_le16(IEEE80211_RADIOTAP_EHT);
2232 	tlv->len = cpu_to_le16(eht_len);
2233 
2234 	eht = (struct ieee80211_radiotap_eht *)tlv->data;
2235 	eht->known = cpu_to_le32(IEEE80211_RADIOTAP_EHT_KNOWN_GI);
2236 	eht->data[0] =
2237 		le32_encode_bits(rx_status->eht.gi, IEEE80211_RADIOTAP_EHT_DATA0_GI);
2238 
2239 	eht->user_info[0] =
2240 		cpu_to_le32(IEEE80211_RADIOTAP_EHT_USER_INFO_MCS_KNOWN |
2241 			    IEEE80211_RADIOTAP_EHT_USER_INFO_NSS_KNOWN_O |
2242 			    IEEE80211_RADIOTAP_EHT_USER_INFO_CODING_KNOWN);
2243 	eht->user_info[0] |=
2244 		le32_encode_bits(rx_status->rate_idx, IEEE80211_RADIOTAP_EHT_USER_INFO_MCS) |
2245 		le32_encode_bits(rx_status->nss, IEEE80211_RADIOTAP_EHT_USER_INFO_NSS_O);
2246 	if (rx_status->enc_flags & RX_ENC_FLAG_LDPC)
2247 		eht->user_info[0] |=
2248 			cpu_to_le32(IEEE80211_RADIOTAP_EHT_USER_INFO_CODING);
2249 
2250 	/* U-SIG */
2251 	tlv = (void *)tlv + sizeof(*tlv) + ALIGN(eht_len, 4);
2252 	tlv->type = cpu_to_le16(IEEE80211_RADIOTAP_EHT_USIG);
2253 	tlv->len = cpu_to_le16(usig_len);
2254 
2255 	if (rx_status->bw >= ARRAY_SIZE(rx_status_bw_to_radiotap_eht_usig))
2256 		return;
2257 
2258 	bw = rx_status_bw_to_radiotap_eht_usig[rx_status->bw];
2259 	if (bw == U8_MAX)
2260 		return;
2261 
2262 	usig = (struct ieee80211_radiotap_eht_usig *)tlv->data;
2263 	usig->common =
2264 		le32_encode_bits(1, IEEE80211_RADIOTAP_EHT_USIG_COMMON_BW_KNOWN) |
2265 		le32_encode_bits(bw, IEEE80211_RADIOTAP_EHT_USIG_COMMON_BW);
2266 }
2267 
2268 static void rtw89_core_update_radiotap(struct rtw89_dev *rtwdev,
2269 				       struct sk_buff *skb,
2270 				       struct ieee80211_rx_status *rx_status)
2271 {
2272 	static const struct ieee80211_radiotap_he known_he = {
2273 		.data1 = cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_DATA_MCS_KNOWN |
2274 				     IEEE80211_RADIOTAP_HE_DATA1_CODING_KNOWN |
2275 				     IEEE80211_RADIOTAP_HE_DATA1_STBC_KNOWN |
2276 				     IEEE80211_RADIOTAP_HE_DATA1_BW_RU_ALLOC_KNOWN),
2277 		.data2 = cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_GI_KNOWN),
2278 	};
2279 	struct ieee80211_radiotap_he *he;
2280 
2281 	if (!(rtwdev->hw->conf.flags & IEEE80211_CONF_MONITOR))
2282 		return;
2283 
2284 	if (rx_status->encoding == RX_ENC_HE) {
2285 		rx_status->flag |= RX_FLAG_RADIOTAP_HE;
2286 		he = skb_push(skb, sizeof(*he));
2287 		*he = known_he;
2288 	} else if (rx_status->encoding == RX_ENC_EHT) {
2289 		rtw89_core_update_radiotap_eht(rtwdev, skb, rx_status);
2290 	}
2291 }
2292 
2293 static void rtw89_core_rx_to_mac80211(struct rtw89_dev *rtwdev,
2294 				      struct rtw89_rx_phy_ppdu *phy_ppdu,
2295 				      struct rtw89_rx_desc_info *desc_info,
2296 				      struct sk_buff *skb_ppdu,
2297 				      struct ieee80211_rx_status *rx_status)
2298 {
2299 	struct napi_struct *napi = &rtwdev->napi;
2300 
2301 	/* In low power mode, napi isn't scheduled. Receive it to netif. */
2302 	if (unlikely(!napi_is_scheduled(napi)))
2303 		napi = NULL;
2304 
2305 	rtw89_core_hw_to_sband_rate(rx_status);
2306 	rtw89_core_rx_stats(rtwdev, phy_ppdu, desc_info, skb_ppdu);
2307 	rtw89_core_update_rx_status_by_ppdu(rtwdev, rx_status, phy_ppdu);
2308 	rtw89_core_update_radiotap(rtwdev, skb_ppdu, rx_status);
2309 	/* In low power mode, it does RX in thread context. */
2310 	local_bh_disable();
2311 	ieee80211_rx_napi(rtwdev->hw, NULL, skb_ppdu, napi);
2312 	local_bh_enable();
2313 	rtwdev->napi_budget_countdown--;
2314 }
2315 
2316 static void rtw89_core_rx_pending_skb(struct rtw89_dev *rtwdev,
2317 				      struct rtw89_rx_phy_ppdu *phy_ppdu,
2318 				      struct rtw89_rx_desc_info *desc_info,
2319 				      struct sk_buff *skb)
2320 {
2321 	u8 band = desc_info->bb_sel ? RTW89_PHY_1 : RTW89_PHY_0;
2322 	int curr = rtwdev->ppdu_sts.curr_rx_ppdu_cnt[band];
2323 	struct sk_buff *skb_ppdu = NULL, *tmp;
2324 	struct ieee80211_rx_status *rx_status;
2325 
2326 	if (curr > RTW89_MAX_PPDU_CNT)
2327 		return;
2328 
2329 	skb_queue_walk_safe(&rtwdev->ppdu_sts.rx_queue[band], skb_ppdu, tmp) {
2330 		skb_unlink(skb_ppdu, &rtwdev->ppdu_sts.rx_queue[band]);
2331 		rx_status = IEEE80211_SKB_RXCB(skb_ppdu);
2332 		if (rtw89_core_rx_ppdu_match(rtwdev, desc_info, rx_status))
2333 			rtw89_chip_query_ppdu(rtwdev, phy_ppdu, rx_status);
2334 		rtw89_correct_cck_chan(rtwdev, rx_status);
2335 		rtw89_core_rx_to_mac80211(rtwdev, phy_ppdu, desc_info, skb_ppdu, rx_status);
2336 	}
2337 }
2338 
2339 static void rtw89_core_rx_process_ppdu_sts(struct rtw89_dev *rtwdev,
2340 					   struct rtw89_rx_desc_info *desc_info,
2341 					   struct sk_buff *skb)
2342 {
2343 	struct rtw89_rx_phy_ppdu phy_ppdu = {.buf = skb->data, .valid = false,
2344 					     .len = skb->len,
2345 					     .to_self = desc_info->addr1_match,
2346 					     .rate = desc_info->data_rate,
2347 					     .mac_id = desc_info->mac_id};
2348 	int ret;
2349 
2350 	if (desc_info->mac_info_valid) {
2351 		ret = rtw89_core_rx_process_mac_ppdu(rtwdev, skb, &phy_ppdu);
2352 		if (ret)
2353 			goto out;
2354 	}
2355 
2356 	ret = rtw89_core_rx_process_phy_ppdu(rtwdev, &phy_ppdu);
2357 	if (ret)
2358 		goto out;
2359 
2360 	rtw89_core_rx_process_phy_sts(rtwdev, &phy_ppdu);
2361 
2362 out:
2363 	rtw89_core_rx_pending_skb(rtwdev, &phy_ppdu, desc_info, skb);
2364 	dev_kfree_skb_any(skb);
2365 }
2366 
2367 static void rtw89_core_rx_process_report(struct rtw89_dev *rtwdev,
2368 					 struct rtw89_rx_desc_info *desc_info,
2369 					 struct sk_buff *skb)
2370 {
2371 	switch (desc_info->pkt_type) {
2372 	case RTW89_CORE_RX_TYPE_C2H:
2373 		rtw89_fw_c2h_irqsafe(rtwdev, skb);
2374 		break;
2375 	case RTW89_CORE_RX_TYPE_PPDU_STAT:
2376 		rtw89_core_rx_process_ppdu_sts(rtwdev, desc_info, skb);
2377 		break;
2378 	default:
2379 		rtw89_debug(rtwdev, RTW89_DBG_TXRX, "unhandled pkt_type=%d\n",
2380 			    desc_info->pkt_type);
2381 		dev_kfree_skb_any(skb);
2382 		break;
2383 	}
2384 }
2385 
2386 void rtw89_core_query_rxdesc(struct rtw89_dev *rtwdev,
2387 			     struct rtw89_rx_desc_info *desc_info,
2388 			     u8 *data, u32 data_offset)
2389 {
2390 	const struct rtw89_chip_info *chip = rtwdev->chip;
2391 	struct rtw89_rxdesc_short *rxd_s;
2392 	struct rtw89_rxdesc_long *rxd_l;
2393 	u8 shift_len, drv_info_len;
2394 
2395 	rxd_s = (struct rtw89_rxdesc_short *)(data + data_offset);
2396 	desc_info->pkt_size = le32_get_bits(rxd_s->dword0, AX_RXD_RPKT_LEN_MASK);
2397 	desc_info->drv_info_size = le32_get_bits(rxd_s->dword0, AX_RXD_DRV_INFO_SIZE_MASK);
2398 	desc_info->long_rxdesc = le32_get_bits(rxd_s->dword0,  AX_RXD_LONG_RXD);
2399 	desc_info->pkt_type = le32_get_bits(rxd_s->dword0,  AX_RXD_RPKT_TYPE_MASK);
2400 	desc_info->mac_info_valid = le32_get_bits(rxd_s->dword0, AX_RXD_MAC_INFO_VLD);
2401 	if (chip->chip_id == RTL8852C)
2402 		desc_info->bw = le32_get_bits(rxd_s->dword1, AX_RXD_BW_v1_MASK);
2403 	else
2404 		desc_info->bw = le32_get_bits(rxd_s->dword1, AX_RXD_BW_MASK);
2405 	desc_info->data_rate = le32_get_bits(rxd_s->dword1, AX_RXD_RX_DATARATE_MASK);
2406 	desc_info->gi_ltf = le32_get_bits(rxd_s->dword1, AX_RXD_RX_GI_LTF_MASK);
2407 	desc_info->user_id = le32_get_bits(rxd_s->dword1, AX_RXD_USER_ID_MASK);
2408 	desc_info->sr_en = le32_get_bits(rxd_s->dword1, AX_RXD_SR_EN);
2409 	desc_info->ppdu_cnt = le32_get_bits(rxd_s->dword1, AX_RXD_PPDU_CNT_MASK);
2410 	desc_info->ppdu_type = le32_get_bits(rxd_s->dword1, AX_RXD_PPDU_TYPE_MASK);
2411 	desc_info->free_run_cnt = le32_get_bits(rxd_s->dword2, AX_RXD_FREERUN_CNT_MASK);
2412 	desc_info->icv_err = le32_get_bits(rxd_s->dword3, AX_RXD_ICV_ERR);
2413 	desc_info->crc32_err = le32_get_bits(rxd_s->dword3, AX_RXD_CRC32_ERR);
2414 	desc_info->hw_dec = le32_get_bits(rxd_s->dword3, AX_RXD_HW_DEC);
2415 	desc_info->sw_dec = le32_get_bits(rxd_s->dword3, AX_RXD_SW_DEC);
2416 	desc_info->addr1_match = le32_get_bits(rxd_s->dword3, AX_RXD_A1_MATCH);
2417 
2418 	shift_len = desc_info->shift << 1; /* 2-byte unit */
2419 	drv_info_len = desc_info->drv_info_size << 3; /* 8-byte unit */
2420 	desc_info->offset = data_offset + shift_len + drv_info_len;
2421 	if (desc_info->long_rxdesc)
2422 		desc_info->rxd_len = sizeof(struct rtw89_rxdesc_long);
2423 	else
2424 		desc_info->rxd_len = sizeof(struct rtw89_rxdesc_short);
2425 	desc_info->ready = true;
2426 
2427 	if (!desc_info->long_rxdesc)
2428 		return;
2429 
2430 	rxd_l = (struct rtw89_rxdesc_long *)(data + data_offset);
2431 	desc_info->frame_type = le32_get_bits(rxd_l->dword4, AX_RXD_TYPE_MASK);
2432 	desc_info->addr_cam_valid = le32_get_bits(rxd_l->dword5, AX_RXD_ADDR_CAM_VLD);
2433 	desc_info->addr_cam_id = le32_get_bits(rxd_l->dword5, AX_RXD_ADDR_CAM_MASK);
2434 	desc_info->sec_cam_id = le32_get_bits(rxd_l->dword5, AX_RXD_SEC_CAM_IDX_MASK);
2435 	desc_info->mac_id = le32_get_bits(rxd_l->dword5, AX_RXD_MAC_ID_MASK);
2436 	desc_info->rx_pl_id = le32_get_bits(rxd_l->dword5, AX_RXD_RX_PL_ID_MASK);
2437 }
2438 EXPORT_SYMBOL(rtw89_core_query_rxdesc);
2439 
2440 void rtw89_core_query_rxdesc_v2(struct rtw89_dev *rtwdev,
2441 				struct rtw89_rx_desc_info *desc_info,
2442 				u8 *data, u32 data_offset)
2443 {
2444 	struct rtw89_rxdesc_short_v2 *rxd_s;
2445 	struct rtw89_rxdesc_long_v2 *rxd_l;
2446 	u16 shift_len, drv_info_len, phy_rtp_len, hdr_cnv_len;
2447 
2448 	rxd_s = (struct rtw89_rxdesc_short_v2 *)(data + data_offset);
2449 
2450 	desc_info->pkt_size = le32_get_bits(rxd_s->dword0, BE_RXD_RPKT_LEN_MASK);
2451 	desc_info->drv_info_size = le32_get_bits(rxd_s->dword0, BE_RXD_DRV_INFO_SZ_MASK);
2452 	desc_info->phy_rpt_size = le32_get_bits(rxd_s->dword0, BE_RXD_PHY_RPT_SZ_MASK);
2453 	desc_info->hdr_cnv_size = le32_get_bits(rxd_s->dword0, BE_RXD_HDR_CNV_SZ_MASK);
2454 	desc_info->shift = le32_get_bits(rxd_s->dword0, BE_RXD_SHIFT_MASK);
2455 	desc_info->long_rxdesc = le32_get_bits(rxd_s->dword0, BE_RXD_LONG_RXD);
2456 	desc_info->pkt_type = le32_get_bits(rxd_s->dword0, BE_RXD_RPKT_TYPE_MASK);
2457 	if (desc_info->pkt_type == RTW89_CORE_RX_TYPE_PPDU_STAT)
2458 		desc_info->mac_info_valid = true;
2459 
2460 	desc_info->frame_type = le32_get_bits(rxd_s->dword2, BE_RXD_TYPE_MASK);
2461 	desc_info->mac_id = le32_get_bits(rxd_s->dword2, BE_RXD_MAC_ID_MASK);
2462 	desc_info->addr_cam_valid = le32_get_bits(rxd_s->dword2, BE_RXD_ADDR_CAM_VLD);
2463 
2464 	desc_info->icv_err = le32_get_bits(rxd_s->dword3, BE_RXD_ICV_ERR);
2465 	desc_info->crc32_err = le32_get_bits(rxd_s->dword3, BE_RXD_CRC32_ERR);
2466 	desc_info->hw_dec = le32_get_bits(rxd_s->dword3, BE_RXD_HW_DEC);
2467 	desc_info->sw_dec = le32_get_bits(rxd_s->dword3, BE_RXD_SW_DEC);
2468 	desc_info->addr1_match = le32_get_bits(rxd_s->dword3, BE_RXD_A1_MATCH);
2469 
2470 	desc_info->bw = le32_get_bits(rxd_s->dword4, BE_RXD_BW_MASK);
2471 	desc_info->data_rate = le32_get_bits(rxd_s->dword4, BE_RXD_RX_DATARATE_MASK);
2472 	desc_info->gi_ltf = le32_get_bits(rxd_s->dword4, BE_RXD_RX_GI_LTF_MASK);
2473 	desc_info->ppdu_cnt = le32_get_bits(rxd_s->dword4, BE_RXD_PPDU_CNT_MASK);
2474 	desc_info->ppdu_type = le32_get_bits(rxd_s->dword4, BE_RXD_PPDU_TYPE_MASK);
2475 
2476 	desc_info->free_run_cnt = le32_to_cpu(rxd_s->dword5);
2477 
2478 	shift_len = desc_info->shift << 1; /* 2-byte unit */
2479 	drv_info_len = desc_info->drv_info_size << 3; /* 8-byte unit */
2480 	phy_rtp_len = desc_info->phy_rpt_size << 3; /* 8-byte unit */
2481 	hdr_cnv_len = desc_info->hdr_cnv_size << 4; /* 16-byte unit */
2482 	desc_info->offset = data_offset + shift_len + drv_info_len +
2483 			    phy_rtp_len + hdr_cnv_len;
2484 
2485 	if (desc_info->long_rxdesc)
2486 		desc_info->rxd_len = sizeof(struct rtw89_rxdesc_long_v2);
2487 	else
2488 		desc_info->rxd_len = sizeof(struct rtw89_rxdesc_short_v2);
2489 	desc_info->ready = true;
2490 
2491 	if (!desc_info->long_rxdesc)
2492 		return;
2493 
2494 	rxd_l = (struct rtw89_rxdesc_long_v2 *)(data + data_offset);
2495 
2496 	desc_info->sr_en = le32_get_bits(rxd_l->dword6, BE_RXD_SR_EN);
2497 	desc_info->user_id = le32_get_bits(rxd_l->dword6, BE_RXD_USER_ID_MASK);
2498 	desc_info->addr_cam_id = le32_get_bits(rxd_l->dword6, BE_RXD_ADDR_CAM_MASK);
2499 	desc_info->sec_cam_id = le32_get_bits(rxd_l->dword6, BE_RXD_SEC_CAM_IDX_MASK);
2500 
2501 	desc_info->rx_pl_id = le32_get_bits(rxd_l->dword7, BE_RXD_RX_PL_ID_MASK);
2502 }
2503 EXPORT_SYMBOL(rtw89_core_query_rxdesc_v2);
2504 
2505 struct rtw89_core_iter_rx_status {
2506 	struct rtw89_dev *rtwdev;
2507 	struct ieee80211_rx_status *rx_status;
2508 	struct rtw89_rx_desc_info *desc_info;
2509 	u8 mac_id;
2510 };
2511 
2512 static
2513 void rtw89_core_stats_sta_rx_status_iter(void *data, struct ieee80211_sta *sta)
2514 {
2515 	struct rtw89_core_iter_rx_status *iter_data =
2516 				(struct rtw89_core_iter_rx_status *)data;
2517 	struct ieee80211_rx_status *rx_status = iter_data->rx_status;
2518 	struct rtw89_rx_desc_info *desc_info = iter_data->desc_info;
2519 	struct rtw89_sta *rtwsta = sta_to_rtwsta(sta);
2520 	struct rtw89_sta_link *rtwsta_link;
2521 	u8 mac_id = iter_data->mac_id;
2522 
2523 	/* FIXME: For single link, taking link on HW-0 here is okay. But, when
2524 	 * enabling multiple active links, we should determine the right link.
2525 	 */
2526 	rtwsta_link = rtw89_sta_get_link_inst(rtwsta, 0);
2527 	if (unlikely(!rtwsta_link))
2528 		return;
2529 
2530 	if (mac_id != rtwsta_link->mac_id)
2531 		return;
2532 
2533 	rtwsta_link->rx_status = *rx_status;
2534 	rtwsta_link->rx_hw_rate = desc_info->data_rate;
2535 }
2536 
2537 static void rtw89_core_stats_sta_rx_status(struct rtw89_dev *rtwdev,
2538 					   struct rtw89_rx_desc_info *desc_info,
2539 					   struct ieee80211_rx_status *rx_status)
2540 {
2541 	struct rtw89_core_iter_rx_status iter_data;
2542 
2543 	if (!desc_info->addr1_match || !desc_info->long_rxdesc)
2544 		return;
2545 
2546 	if (desc_info->frame_type != RTW89_RX_TYPE_DATA)
2547 		return;
2548 
2549 	iter_data.rtwdev = rtwdev;
2550 	iter_data.rx_status = rx_status;
2551 	iter_data.desc_info = desc_info;
2552 	iter_data.mac_id = desc_info->mac_id;
2553 	ieee80211_iterate_stations_atomic(rtwdev->hw,
2554 					  rtw89_core_stats_sta_rx_status_iter,
2555 					  &iter_data);
2556 }
2557 
2558 static void rtw89_core_update_rx_status(struct rtw89_dev *rtwdev,
2559 					struct rtw89_rx_desc_info *desc_info,
2560 					struct ieee80211_rx_status *rx_status)
2561 {
2562 	const struct cfg80211_chan_def *chandef =
2563 		rtw89_chandef_get(rtwdev, RTW89_CHANCTX_0);
2564 	u16 data_rate;
2565 	u8 data_rate_mode;
2566 	bool eht = false;
2567 	u8 gi;
2568 
2569 	/* currently using single PHY */
2570 	rx_status->freq = chandef->chan->center_freq;
2571 	rx_status->band = chandef->chan->band;
2572 
2573 	if (rtwdev->scanning &&
2574 	    RTW89_CHK_FW_FEATURE(SCAN_OFFLOAD, &rtwdev->fw)) {
2575 		const struct rtw89_chan *cur = rtw89_scan_chan_get(rtwdev);
2576 		u8 chan = cur->primary_channel;
2577 		u8 band = cur->band_type;
2578 		enum nl80211_band nl_band;
2579 
2580 		nl_band = rtw89_hw_to_nl80211_band(band);
2581 		rx_status->freq = ieee80211_channel_to_frequency(chan, nl_band);
2582 		rx_status->band = nl_band;
2583 	}
2584 
2585 	if (desc_info->icv_err || desc_info->crc32_err)
2586 		rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
2587 
2588 	if (desc_info->hw_dec &&
2589 	    !(desc_info->sw_dec || desc_info->icv_err))
2590 		rx_status->flag |= RX_FLAG_DECRYPTED;
2591 
2592 	rx_status->bw = rtw89_hw_to_rate_info_bw(desc_info->bw);
2593 
2594 	data_rate = desc_info->data_rate;
2595 	data_rate_mode = rtw89_get_data_rate_mode(rtwdev, data_rate);
2596 	if (data_rate_mode == DATA_RATE_MODE_NON_HT) {
2597 		rx_status->encoding = RX_ENC_LEGACY;
2598 		rx_status->rate_idx = rtw89_get_data_not_ht_idx(rtwdev, data_rate);
2599 		/* convert rate_idx after we get the correct band */
2600 	} else if (data_rate_mode == DATA_RATE_MODE_HT) {
2601 		rx_status->encoding = RX_ENC_HT;
2602 		rx_status->rate_idx = rtw89_get_data_ht_mcs(rtwdev, data_rate);
2603 		if (desc_info->gi_ltf)
2604 			rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
2605 	} else if (data_rate_mode == DATA_RATE_MODE_VHT) {
2606 		rx_status->encoding = RX_ENC_VHT;
2607 		rx_status->rate_idx = rtw89_get_data_mcs(rtwdev, data_rate);
2608 		rx_status->nss = rtw89_get_data_nss(rtwdev, data_rate) + 1;
2609 		if (desc_info->gi_ltf)
2610 			rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
2611 	} else if (data_rate_mode == DATA_RATE_MODE_HE) {
2612 		rx_status->encoding = RX_ENC_HE;
2613 		rx_status->rate_idx = rtw89_get_data_mcs(rtwdev, data_rate);
2614 		rx_status->nss = rtw89_get_data_nss(rtwdev, data_rate) + 1;
2615 	} else if (data_rate_mode == DATA_RATE_MODE_EHT) {
2616 		rx_status->encoding = RX_ENC_EHT;
2617 		rx_status->rate_idx = rtw89_get_data_mcs(rtwdev, data_rate);
2618 		rx_status->nss = rtw89_get_data_nss(rtwdev, data_rate) + 1;
2619 		eht = true;
2620 	} else {
2621 		rtw89_warn(rtwdev, "invalid RX rate mode %d\n", data_rate_mode);
2622 	}
2623 
2624 	/* he_gi is used to match ppdu, so we always fill it. */
2625 	gi = rtw89_rxdesc_to_nl_he_eht_gi(rtwdev, desc_info->gi_ltf, true, eht);
2626 	if (eht)
2627 		rx_status->eht.gi = gi;
2628 	else
2629 		rx_status->he_gi = gi;
2630 	rx_status->flag |= RX_FLAG_MACTIME_START;
2631 	rx_status->mactime = desc_info->free_run_cnt;
2632 
2633 	rtw89_core_stats_sta_rx_status(rtwdev, desc_info, rx_status);
2634 }
2635 
2636 static enum rtw89_ps_mode rtw89_update_ps_mode(struct rtw89_dev *rtwdev)
2637 {
2638 	const struct rtw89_chip_info *chip = rtwdev->chip;
2639 
2640 	/* FIXME: Fix __rtw89_enter_ps_mode() to consider MLO cases. */
2641 	if (rtwdev->support_mlo)
2642 		return RTW89_PS_MODE_NONE;
2643 
2644 	if (rtw89_disable_ps_mode || !chip->ps_mode_supported ||
2645 	    RTW89_CHK_FW_FEATURE(NO_DEEP_PS, &rtwdev->fw))
2646 		return RTW89_PS_MODE_NONE;
2647 
2648 	if ((chip->ps_mode_supported & BIT(RTW89_PS_MODE_PWR_GATED)) &&
2649 	    !RTW89_CHK_FW_FEATURE(NO_LPS_PG, &rtwdev->fw))
2650 		return RTW89_PS_MODE_PWR_GATED;
2651 
2652 	if (chip->ps_mode_supported & BIT(RTW89_PS_MODE_CLK_GATED))
2653 		return RTW89_PS_MODE_CLK_GATED;
2654 
2655 	if (chip->ps_mode_supported & BIT(RTW89_PS_MODE_RFOFF))
2656 		return RTW89_PS_MODE_RFOFF;
2657 
2658 	return RTW89_PS_MODE_NONE;
2659 }
2660 
2661 static void rtw89_core_flush_ppdu_rx_queue(struct rtw89_dev *rtwdev,
2662 					   struct rtw89_rx_desc_info *desc_info)
2663 {
2664 	struct rtw89_ppdu_sts_info *ppdu_sts = &rtwdev->ppdu_sts;
2665 	u8 band = desc_info->bb_sel ? RTW89_PHY_1 : RTW89_PHY_0;
2666 	struct ieee80211_rx_status *rx_status;
2667 	struct sk_buff *skb_ppdu, *tmp;
2668 
2669 	skb_queue_walk_safe(&ppdu_sts->rx_queue[band], skb_ppdu, tmp) {
2670 		skb_unlink(skb_ppdu, &ppdu_sts->rx_queue[band]);
2671 		rx_status = IEEE80211_SKB_RXCB(skb_ppdu);
2672 		rtw89_core_rx_to_mac80211(rtwdev, NULL, desc_info, skb_ppdu, rx_status);
2673 	}
2674 }
2675 
2676 void rtw89_core_rx(struct rtw89_dev *rtwdev,
2677 		   struct rtw89_rx_desc_info *desc_info,
2678 		   struct sk_buff *skb)
2679 {
2680 	struct ieee80211_rx_status *rx_status;
2681 	struct rtw89_ppdu_sts_info *ppdu_sts = &rtwdev->ppdu_sts;
2682 	u8 ppdu_cnt = desc_info->ppdu_cnt;
2683 	u8 band = desc_info->bb_sel ? RTW89_PHY_1 : RTW89_PHY_0;
2684 
2685 	if (desc_info->pkt_type != RTW89_CORE_RX_TYPE_WIFI) {
2686 		rtw89_core_rx_process_report(rtwdev, desc_info, skb);
2687 		return;
2688 	}
2689 
2690 	if (ppdu_sts->curr_rx_ppdu_cnt[band] != ppdu_cnt) {
2691 		rtw89_core_flush_ppdu_rx_queue(rtwdev, desc_info);
2692 		ppdu_sts->curr_rx_ppdu_cnt[band] = ppdu_cnt;
2693 	}
2694 
2695 	rx_status = IEEE80211_SKB_RXCB(skb);
2696 	memset(rx_status, 0, sizeof(*rx_status));
2697 	rtw89_core_update_rx_status(rtwdev, desc_info, rx_status);
2698 	if (desc_info->long_rxdesc &&
2699 	    BIT(desc_info->frame_type) & PPDU_FILTER_BITMAP)
2700 		skb_queue_tail(&ppdu_sts->rx_queue[band], skb);
2701 	else
2702 		rtw89_core_rx_to_mac80211(rtwdev, NULL, desc_info, skb, rx_status);
2703 }
2704 EXPORT_SYMBOL(rtw89_core_rx);
2705 
2706 void rtw89_core_napi_start(struct rtw89_dev *rtwdev)
2707 {
2708 	if (test_and_set_bit(RTW89_FLAG_NAPI_RUNNING, rtwdev->flags))
2709 		return;
2710 
2711 	napi_enable(&rtwdev->napi);
2712 }
2713 EXPORT_SYMBOL(rtw89_core_napi_start);
2714 
2715 void rtw89_core_napi_stop(struct rtw89_dev *rtwdev)
2716 {
2717 	if (!test_and_clear_bit(RTW89_FLAG_NAPI_RUNNING, rtwdev->flags))
2718 		return;
2719 
2720 	napi_synchronize(&rtwdev->napi);
2721 	napi_disable(&rtwdev->napi);
2722 }
2723 EXPORT_SYMBOL(rtw89_core_napi_stop);
2724 
2725 int rtw89_core_napi_init(struct rtw89_dev *rtwdev)
2726 {
2727 	rtwdev->netdev = alloc_netdev_dummy(0);
2728 	if (!rtwdev->netdev)
2729 		return -ENOMEM;
2730 
2731 	netif_napi_add(rtwdev->netdev, &rtwdev->napi,
2732 		       rtwdev->hci.ops->napi_poll);
2733 	return 0;
2734 }
2735 EXPORT_SYMBOL(rtw89_core_napi_init);
2736 
2737 void rtw89_core_napi_deinit(struct rtw89_dev *rtwdev)
2738 {
2739 	rtw89_core_napi_stop(rtwdev);
2740 	netif_napi_del(&rtwdev->napi);
2741 	free_netdev(rtwdev->netdev);
2742 }
2743 EXPORT_SYMBOL(rtw89_core_napi_deinit);
2744 
2745 static void rtw89_core_ba_work(struct work_struct *work)
2746 {
2747 	struct rtw89_dev *rtwdev =
2748 		container_of(work, struct rtw89_dev, ba_work);
2749 	struct rtw89_txq *rtwtxq, *tmp;
2750 	int ret;
2751 
2752 	spin_lock_bh(&rtwdev->ba_lock);
2753 	list_for_each_entry_safe(rtwtxq, tmp, &rtwdev->ba_list, list) {
2754 		struct ieee80211_txq *txq = rtw89_txq_to_txq(rtwtxq);
2755 		struct ieee80211_sta *sta = txq->sta;
2756 		struct rtw89_sta *rtwsta = sta_to_rtwsta_safe(sta);
2757 		u8 tid = txq->tid;
2758 
2759 		if (!sta) {
2760 			rtw89_warn(rtwdev, "cannot start BA without sta\n");
2761 			goto skip_ba_work;
2762 		}
2763 
2764 		if (rtwsta->disassoc) {
2765 			rtw89_debug(rtwdev, RTW89_DBG_TXRX,
2766 				    "cannot start BA with disassoc sta\n");
2767 			goto skip_ba_work;
2768 		}
2769 
2770 		ret = ieee80211_start_tx_ba_session(sta, tid, 0);
2771 		if (ret) {
2772 			rtw89_debug(rtwdev, RTW89_DBG_TXRX,
2773 				    "failed to setup BA session for %pM:%2d: %d\n",
2774 				    sta->addr, tid, ret);
2775 			if (ret == -EINVAL)
2776 				set_bit(RTW89_TXQ_F_BLOCK_BA, &rtwtxq->flags);
2777 		}
2778 skip_ba_work:
2779 		list_del_init(&rtwtxq->list);
2780 	}
2781 	spin_unlock_bh(&rtwdev->ba_lock);
2782 }
2783 
2784 void rtw89_core_free_sta_pending_ba(struct rtw89_dev *rtwdev,
2785 				    struct ieee80211_sta *sta)
2786 {
2787 	struct rtw89_txq *rtwtxq, *tmp;
2788 
2789 	spin_lock_bh(&rtwdev->ba_lock);
2790 	list_for_each_entry_safe(rtwtxq, tmp, &rtwdev->ba_list, list) {
2791 		struct ieee80211_txq *txq = rtw89_txq_to_txq(rtwtxq);
2792 
2793 		if (sta == txq->sta)
2794 			list_del_init(&rtwtxq->list);
2795 	}
2796 	spin_unlock_bh(&rtwdev->ba_lock);
2797 }
2798 
2799 void rtw89_core_free_sta_pending_forbid_ba(struct rtw89_dev *rtwdev,
2800 					   struct ieee80211_sta *sta)
2801 {
2802 	struct rtw89_txq *rtwtxq, *tmp;
2803 
2804 	spin_lock_bh(&rtwdev->ba_lock);
2805 	list_for_each_entry_safe(rtwtxq, tmp, &rtwdev->forbid_ba_list, list) {
2806 		struct ieee80211_txq *txq = rtw89_txq_to_txq(rtwtxq);
2807 
2808 		if (sta == txq->sta) {
2809 			clear_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags);
2810 			list_del_init(&rtwtxq->list);
2811 		}
2812 	}
2813 	spin_unlock_bh(&rtwdev->ba_lock);
2814 }
2815 
2816 void rtw89_core_free_sta_pending_roc_tx(struct rtw89_dev *rtwdev,
2817 					struct ieee80211_sta *sta)
2818 {
2819 	struct rtw89_sta *rtwsta = sta_to_rtwsta(sta);
2820 	struct sk_buff *skb, *tmp;
2821 
2822 	skb_queue_walk_safe(&rtwsta->roc_queue, skb, tmp) {
2823 		skb_unlink(skb, &rtwsta->roc_queue);
2824 		dev_kfree_skb_any(skb);
2825 	}
2826 }
2827 
2828 static void rtw89_core_stop_tx_ba_session(struct rtw89_dev *rtwdev,
2829 					  struct rtw89_txq *rtwtxq)
2830 {
2831 	struct ieee80211_txq *txq = rtw89_txq_to_txq(rtwtxq);
2832 	struct ieee80211_sta *sta = txq->sta;
2833 	struct rtw89_sta *rtwsta = sta_to_rtwsta_safe(sta);
2834 
2835 	if (unlikely(!rtwsta) || unlikely(rtwsta->disassoc))
2836 		return;
2837 
2838 	if (!test_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags) ||
2839 	    test_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags))
2840 		return;
2841 
2842 	spin_lock_bh(&rtwdev->ba_lock);
2843 	if (!test_and_set_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags))
2844 		list_add_tail(&rtwtxq->list, &rtwdev->forbid_ba_list);
2845 	spin_unlock_bh(&rtwdev->ba_lock);
2846 
2847 	ieee80211_stop_tx_ba_session(sta, txq->tid);
2848 	cancel_delayed_work(&rtwdev->forbid_ba_work);
2849 	ieee80211_queue_delayed_work(rtwdev->hw, &rtwdev->forbid_ba_work,
2850 				     RTW89_FORBID_BA_TIMER);
2851 }
2852 
2853 static void rtw89_core_txq_check_agg(struct rtw89_dev *rtwdev,
2854 				     struct rtw89_txq *rtwtxq,
2855 				     struct sk_buff *skb)
2856 {
2857 	struct ieee80211_hw *hw = rtwdev->hw;
2858 	struct ieee80211_txq *txq = rtw89_txq_to_txq(rtwtxq);
2859 	struct ieee80211_sta *sta = txq->sta;
2860 	struct rtw89_sta *rtwsta = sta_to_rtwsta_safe(sta);
2861 
2862 	if (test_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags))
2863 		return;
2864 
2865 	if (unlikely(skb->protocol == cpu_to_be16(ETH_P_PAE))) {
2866 		rtw89_core_stop_tx_ba_session(rtwdev, rtwtxq);
2867 		return;
2868 	}
2869 
2870 	if (unlikely(!sta))
2871 		return;
2872 
2873 	if (unlikely(test_bit(RTW89_TXQ_F_BLOCK_BA, &rtwtxq->flags)))
2874 		return;
2875 
2876 	if (test_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags)) {
2877 		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_AMPDU;
2878 		return;
2879 	}
2880 
2881 	spin_lock_bh(&rtwdev->ba_lock);
2882 	if (!rtwsta->disassoc && list_empty(&rtwtxq->list)) {
2883 		list_add_tail(&rtwtxq->list, &rtwdev->ba_list);
2884 		ieee80211_queue_work(hw, &rtwdev->ba_work);
2885 	}
2886 	spin_unlock_bh(&rtwdev->ba_lock);
2887 }
2888 
2889 static void rtw89_core_txq_push(struct rtw89_dev *rtwdev,
2890 				struct rtw89_txq *rtwtxq,
2891 				unsigned long frame_cnt,
2892 				unsigned long byte_cnt)
2893 {
2894 	struct ieee80211_txq *txq = rtw89_txq_to_txq(rtwtxq);
2895 	struct ieee80211_vif *vif = txq->vif;
2896 	struct ieee80211_sta *sta = txq->sta;
2897 	struct sk_buff *skb;
2898 	unsigned long i;
2899 	int ret;
2900 
2901 	rcu_read_lock();
2902 	for (i = 0; i < frame_cnt; i++) {
2903 		skb = ieee80211_tx_dequeue_ni(rtwdev->hw, txq);
2904 		if (!skb) {
2905 			rtw89_debug(rtwdev, RTW89_DBG_TXRX, "dequeue a NULL skb\n");
2906 			goto out;
2907 		}
2908 		rtw89_core_txq_check_agg(rtwdev, rtwtxq, skb);
2909 		ret = rtw89_core_tx_write(rtwdev, vif, sta, skb, NULL);
2910 		if (ret) {
2911 			rtw89_err(rtwdev, "failed to push txq: %d\n", ret);
2912 			ieee80211_free_txskb(rtwdev->hw, skb);
2913 			break;
2914 		}
2915 	}
2916 out:
2917 	rcu_read_unlock();
2918 }
2919 
2920 static u32 rtw89_check_and_reclaim_tx_resource(struct rtw89_dev *rtwdev, u8 tid)
2921 {
2922 	u8 qsel, ch_dma;
2923 
2924 	qsel = rtw89_core_get_qsel(rtwdev, tid);
2925 	ch_dma = rtw89_core_get_ch_dma(rtwdev, qsel);
2926 
2927 	return rtw89_hci_check_and_reclaim_tx_resource(rtwdev, ch_dma);
2928 }
2929 
2930 static bool rtw89_core_txq_agg_wait(struct rtw89_dev *rtwdev,
2931 				    struct ieee80211_txq *txq,
2932 				    unsigned long *frame_cnt,
2933 				    bool *sched_txq, bool *reinvoke)
2934 {
2935 	struct rtw89_txq *rtwtxq = (struct rtw89_txq *)txq->drv_priv;
2936 	struct rtw89_sta *rtwsta = sta_to_rtwsta_safe(txq->sta);
2937 	struct rtw89_sta_link *rtwsta_link;
2938 
2939 	if (!rtwsta)
2940 		return false;
2941 
2942 	rtwsta_link = rtw89_sta_get_link_inst(rtwsta, 0);
2943 	if (unlikely(!rtwsta_link)) {
2944 		rtw89_err(rtwdev, "agg wait: find no link on HW-0\n");
2945 		return false;
2946 	}
2947 
2948 	if (rtwsta_link->max_agg_wait <= 0)
2949 		return false;
2950 
2951 	if (rtwdev->stats.tx_tfc_lv <= RTW89_TFC_MID)
2952 		return false;
2953 
2954 	if (*frame_cnt > 1) {
2955 		*frame_cnt -= 1;
2956 		*sched_txq = true;
2957 		*reinvoke = true;
2958 		rtwtxq->wait_cnt = 1;
2959 		return false;
2960 	}
2961 
2962 	if (*frame_cnt == 1 && rtwtxq->wait_cnt < rtwsta_link->max_agg_wait) {
2963 		*reinvoke = true;
2964 		rtwtxq->wait_cnt++;
2965 		return true;
2966 	}
2967 
2968 	rtwtxq->wait_cnt = 0;
2969 	return false;
2970 }
2971 
2972 static void rtw89_core_txq_schedule(struct rtw89_dev *rtwdev, u8 ac, bool *reinvoke)
2973 {
2974 	struct ieee80211_hw *hw = rtwdev->hw;
2975 	struct ieee80211_txq *txq;
2976 	struct rtw89_vif *rtwvif;
2977 	struct rtw89_txq *rtwtxq;
2978 	unsigned long frame_cnt;
2979 	unsigned long byte_cnt;
2980 	u32 tx_resource;
2981 	bool sched_txq;
2982 
2983 	ieee80211_txq_schedule_start(hw, ac);
2984 	while ((txq = ieee80211_next_txq(hw, ac))) {
2985 		rtwtxq = (struct rtw89_txq *)txq->drv_priv;
2986 		rtwvif = vif_to_rtwvif(txq->vif);
2987 
2988 		if (rtwvif->offchan) {
2989 			ieee80211_return_txq(hw, txq, true);
2990 			continue;
2991 		}
2992 		tx_resource = rtw89_check_and_reclaim_tx_resource(rtwdev, txq->tid);
2993 		sched_txq = false;
2994 
2995 		ieee80211_txq_get_depth(txq, &frame_cnt, &byte_cnt);
2996 		if (rtw89_core_txq_agg_wait(rtwdev, txq, &frame_cnt, &sched_txq, reinvoke)) {
2997 			ieee80211_return_txq(hw, txq, true);
2998 			continue;
2999 		}
3000 		frame_cnt = min_t(unsigned long, frame_cnt, tx_resource);
3001 		rtw89_core_txq_push(rtwdev, rtwtxq, frame_cnt, byte_cnt);
3002 		ieee80211_return_txq(hw, txq, sched_txq);
3003 		if (frame_cnt != 0)
3004 			rtw89_core_tx_kick_off(rtwdev, rtw89_core_get_qsel(rtwdev, txq->tid));
3005 
3006 		/* bound of tx_resource could get stuck due to burst traffic */
3007 		if (frame_cnt == tx_resource)
3008 			*reinvoke = true;
3009 	}
3010 	ieee80211_txq_schedule_end(hw, ac);
3011 }
3012 
3013 static void rtw89_ips_work(struct work_struct *work)
3014 {
3015 	struct rtw89_dev *rtwdev = container_of(work, struct rtw89_dev,
3016 						ips_work);
3017 	mutex_lock(&rtwdev->mutex);
3018 	rtw89_enter_ips_by_hwflags(rtwdev);
3019 	mutex_unlock(&rtwdev->mutex);
3020 }
3021 
3022 static void rtw89_core_txq_work(struct work_struct *w)
3023 {
3024 	struct rtw89_dev *rtwdev = container_of(w, struct rtw89_dev, txq_work);
3025 	bool reinvoke = false;
3026 	u8 ac;
3027 
3028 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
3029 		rtw89_core_txq_schedule(rtwdev, ac, &reinvoke);
3030 
3031 	if (reinvoke) {
3032 		/* reinvoke to process the last frame */
3033 		mod_delayed_work(rtwdev->txq_wq, &rtwdev->txq_reinvoke_work, 1);
3034 	}
3035 }
3036 
3037 static void rtw89_core_txq_reinvoke_work(struct work_struct *w)
3038 {
3039 	struct rtw89_dev *rtwdev = container_of(w, struct rtw89_dev,
3040 						txq_reinvoke_work.work);
3041 
3042 	queue_work(rtwdev->txq_wq, &rtwdev->txq_work);
3043 }
3044 
3045 static void rtw89_forbid_ba_work(struct work_struct *w)
3046 {
3047 	struct rtw89_dev *rtwdev = container_of(w, struct rtw89_dev,
3048 						forbid_ba_work.work);
3049 	struct rtw89_txq *rtwtxq, *tmp;
3050 
3051 	spin_lock_bh(&rtwdev->ba_lock);
3052 	list_for_each_entry_safe(rtwtxq, tmp, &rtwdev->forbid_ba_list, list) {
3053 		clear_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags);
3054 		list_del_init(&rtwtxq->list);
3055 	}
3056 	spin_unlock_bh(&rtwdev->ba_lock);
3057 }
3058 
3059 static void rtw89_core_sta_pending_tx_iter(void *data,
3060 					   struct ieee80211_sta *sta)
3061 {
3062 	struct rtw89_sta *rtwsta = sta_to_rtwsta(sta);
3063 	struct rtw89_dev *rtwdev = rtwsta->rtwdev;
3064 	struct rtw89_vif *rtwvif = rtwsta->rtwvif;
3065 	struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif);
3066 	struct rtw89_vif_link *target = data;
3067 	struct rtw89_vif_link *rtwvif_link;
3068 	struct sk_buff *skb, *tmp;
3069 	unsigned int link_id;
3070 	int qsel, ret;
3071 
3072 	rtw89_vif_for_each_link(rtwvif, rtwvif_link, link_id)
3073 		if (rtwvif_link->chanctx_idx == target->chanctx_idx)
3074 			goto bottom;
3075 
3076 	return;
3077 
3078 bottom:
3079 	if (skb_queue_len(&rtwsta->roc_queue) == 0)
3080 		return;
3081 
3082 	skb_queue_walk_safe(&rtwsta->roc_queue, skb, tmp) {
3083 		skb_unlink(skb, &rtwsta->roc_queue);
3084 
3085 		ret = rtw89_core_tx_write(rtwdev, vif, sta, skb, &qsel);
3086 		if (ret) {
3087 			rtw89_warn(rtwdev, "pending tx failed with %d\n", ret);
3088 			dev_kfree_skb_any(skb);
3089 		} else {
3090 			rtw89_core_tx_kick_off(rtwdev, qsel);
3091 		}
3092 	}
3093 }
3094 
3095 static void rtw89_core_handle_sta_pending_tx(struct rtw89_dev *rtwdev,
3096 					     struct rtw89_vif_link *rtwvif_link)
3097 {
3098 	ieee80211_iterate_stations_atomic(rtwdev->hw,
3099 					  rtw89_core_sta_pending_tx_iter,
3100 					  rtwvif_link);
3101 }
3102 
3103 static int rtw89_core_send_nullfunc(struct rtw89_dev *rtwdev,
3104 				    struct rtw89_vif_link *rtwvif_link, bool qos, bool ps)
3105 {
3106 	struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
3107 	struct ieee80211_sta *sta;
3108 	struct ieee80211_hdr *hdr;
3109 	struct sk_buff *skb;
3110 	int ret, qsel;
3111 
3112 	if (vif->type != NL80211_IFTYPE_STATION || !vif->cfg.assoc)
3113 		return 0;
3114 
3115 	rcu_read_lock();
3116 	sta = ieee80211_find_sta(vif, vif->cfg.ap_addr);
3117 	if (!sta) {
3118 		ret = -EINVAL;
3119 		goto out;
3120 	}
3121 
3122 	skb = ieee80211_nullfunc_get(rtwdev->hw, vif, -1, qos);
3123 	if (!skb) {
3124 		ret = -ENOMEM;
3125 		goto out;
3126 	}
3127 
3128 	hdr = (struct ieee80211_hdr *)skb->data;
3129 	if (ps)
3130 		hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
3131 
3132 	ret = rtw89_core_tx_write(rtwdev, vif, sta, skb, &qsel);
3133 	if (ret) {
3134 		rtw89_warn(rtwdev, "nullfunc transmit failed: %d\n", ret);
3135 		dev_kfree_skb_any(skb);
3136 		goto out;
3137 	}
3138 
3139 	rcu_read_unlock();
3140 
3141 	return rtw89_core_tx_kick_off_and_wait(rtwdev, skb, qsel,
3142 					       RTW89_ROC_TX_TIMEOUT);
3143 out:
3144 	rcu_read_unlock();
3145 
3146 	return ret;
3147 }
3148 
3149 void rtw89_roc_start(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif)
3150 {
3151 	const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;
3152 	struct ieee80211_hw *hw = rtwdev->hw;
3153 	struct rtw89_roc *roc = &rtwvif->roc;
3154 	struct rtw89_vif_link *rtwvif_link;
3155 	struct cfg80211_chan_def roc_chan;
3156 	struct rtw89_vif *tmp_vif;
3157 	u32 reg;
3158 	int ret;
3159 
3160 	lockdep_assert_held(&rtwdev->mutex);
3161 
3162 	rtw89_leave_ips_by_hwflags(rtwdev);
3163 	rtw89_leave_lps(rtwdev);
3164 
3165 	rtwvif_link = rtw89_vif_get_link_inst(rtwvif, 0);
3166 	if (unlikely(!rtwvif_link)) {
3167 		rtw89_err(rtwdev, "roc start: find no link on HW-0\n");
3168 		return;
3169 	}
3170 
3171 	rtw89_chanctx_pause(rtwdev, RTW89_CHANCTX_PAUSE_REASON_ROC);
3172 
3173 	ret = rtw89_core_send_nullfunc(rtwdev, rtwvif_link, true, true);
3174 	if (ret)
3175 		rtw89_debug(rtwdev, RTW89_DBG_TXRX,
3176 			    "roc send null-1 failed: %d\n", ret);
3177 
3178 	rtw89_for_each_rtwvif(rtwdev, tmp_vif) {
3179 		struct rtw89_vif_link *tmp_link;
3180 		unsigned int link_id;
3181 
3182 		rtw89_vif_for_each_link(tmp_vif, tmp_link, link_id) {
3183 			if (tmp_link->chanctx_idx == rtwvif_link->chanctx_idx) {
3184 				tmp_vif->offchan = true;
3185 				break;
3186 			}
3187 		}
3188 	}
3189 
3190 	cfg80211_chandef_create(&roc_chan, &roc->chan, NL80211_CHAN_NO_HT);
3191 	rtw89_config_roc_chandef(rtwdev, rtwvif_link->chanctx_idx, &roc_chan);
3192 	rtw89_set_channel(rtwdev);
3193 
3194 	reg = rtw89_mac_reg_by_idx(rtwdev, mac->rx_fltr, rtwvif_link->mac_idx);
3195 	rtw89_write32_clr(rtwdev, reg, B_AX_A_UC_CAM_MATCH | B_AX_A_BC_CAM_MATCH);
3196 
3197 	ieee80211_ready_on_channel(hw);
3198 	cancel_delayed_work(&rtwvif->roc.roc_work);
3199 	ieee80211_queue_delayed_work(hw, &rtwvif->roc.roc_work,
3200 				     msecs_to_jiffies(rtwvif->roc.duration));
3201 }
3202 
3203 void rtw89_roc_end(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif)
3204 {
3205 	const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;
3206 	struct ieee80211_hw *hw = rtwdev->hw;
3207 	struct rtw89_roc *roc = &rtwvif->roc;
3208 	struct rtw89_vif_link *rtwvif_link;
3209 	struct rtw89_vif *tmp_vif;
3210 	u32 reg;
3211 	int ret;
3212 
3213 	lockdep_assert_held(&rtwdev->mutex);
3214 
3215 	ieee80211_remain_on_channel_expired(hw);
3216 
3217 	rtw89_leave_ips_by_hwflags(rtwdev);
3218 	rtw89_leave_lps(rtwdev);
3219 
3220 	rtwvif_link = rtw89_vif_get_link_inst(rtwvif, 0);
3221 	if (unlikely(!rtwvif_link)) {
3222 		rtw89_err(rtwdev, "roc end: find no link on HW-0\n");
3223 		return;
3224 	}
3225 
3226 	reg = rtw89_mac_reg_by_idx(rtwdev, mac->rx_fltr, rtwvif_link->mac_idx);
3227 	rtw89_write32_mask(rtwdev, reg, B_AX_RX_FLTR_CFG_MASK, rtwdev->hal.rx_fltr);
3228 
3229 	roc->state = RTW89_ROC_IDLE;
3230 	rtw89_config_roc_chandef(rtwdev, rtwvif_link->chanctx_idx, NULL);
3231 	rtw89_chanctx_proceed(rtwdev);
3232 	ret = rtw89_core_send_nullfunc(rtwdev, rtwvif_link, true, false);
3233 	if (ret)
3234 		rtw89_debug(rtwdev, RTW89_DBG_TXRX,
3235 			    "roc send null-0 failed: %d\n", ret);
3236 
3237 	rtw89_for_each_rtwvif(rtwdev, tmp_vif)
3238 		tmp_vif->offchan = false;
3239 
3240 	rtw89_core_handle_sta_pending_tx(rtwdev, rtwvif_link);
3241 	queue_work(rtwdev->txq_wq, &rtwdev->txq_work);
3242 
3243 	if (hw->conf.flags & IEEE80211_CONF_IDLE)
3244 		ieee80211_queue_delayed_work(hw, &roc->roc_work,
3245 					     msecs_to_jiffies(RTW89_ROC_IDLE_TIMEOUT));
3246 }
3247 
3248 void rtw89_roc_work(struct work_struct *work)
3249 {
3250 	struct rtw89_vif *rtwvif = container_of(work, struct rtw89_vif,
3251 						roc.roc_work.work);
3252 	struct rtw89_dev *rtwdev = rtwvif->rtwdev;
3253 	struct rtw89_roc *roc = &rtwvif->roc;
3254 
3255 	mutex_lock(&rtwdev->mutex);
3256 
3257 	switch (roc->state) {
3258 	case RTW89_ROC_IDLE:
3259 		rtw89_enter_ips_by_hwflags(rtwdev);
3260 		break;
3261 	case RTW89_ROC_MGMT:
3262 	case RTW89_ROC_NORMAL:
3263 		rtw89_roc_end(rtwdev, rtwvif);
3264 		break;
3265 	default:
3266 		break;
3267 	}
3268 
3269 	mutex_unlock(&rtwdev->mutex);
3270 }
3271 
3272 static enum rtw89_tfc_lv rtw89_get_traffic_level(struct rtw89_dev *rtwdev,
3273 						 u32 throughput, u64 cnt)
3274 {
3275 	if (cnt < 100)
3276 		return RTW89_TFC_IDLE;
3277 	if (throughput > 50)
3278 		return RTW89_TFC_HIGH;
3279 	if (throughput > 10)
3280 		return RTW89_TFC_MID;
3281 	if (throughput > 2)
3282 		return RTW89_TFC_LOW;
3283 	return RTW89_TFC_ULTRA_LOW;
3284 }
3285 
3286 static bool rtw89_traffic_stats_calc(struct rtw89_dev *rtwdev,
3287 				     struct rtw89_traffic_stats *stats)
3288 {
3289 	enum rtw89_tfc_lv tx_tfc_lv = stats->tx_tfc_lv;
3290 	enum rtw89_tfc_lv rx_tfc_lv = stats->rx_tfc_lv;
3291 
3292 	stats->tx_throughput_raw = (u32)(stats->tx_unicast >> RTW89_TP_SHIFT);
3293 	stats->rx_throughput_raw = (u32)(stats->rx_unicast >> RTW89_TP_SHIFT);
3294 
3295 	ewma_tp_add(&stats->tx_ewma_tp, stats->tx_throughput_raw);
3296 	ewma_tp_add(&stats->rx_ewma_tp, stats->rx_throughput_raw);
3297 
3298 	stats->tx_throughput = ewma_tp_read(&stats->tx_ewma_tp);
3299 	stats->rx_throughput = ewma_tp_read(&stats->rx_ewma_tp);
3300 	stats->tx_tfc_lv = rtw89_get_traffic_level(rtwdev, stats->tx_throughput,
3301 						   stats->tx_cnt);
3302 	stats->rx_tfc_lv = rtw89_get_traffic_level(rtwdev, stats->rx_throughput,
3303 						   stats->rx_cnt);
3304 	stats->tx_avg_len = stats->tx_cnt ?
3305 			    DIV_ROUND_DOWN_ULL(stats->tx_unicast, stats->tx_cnt) : 0;
3306 	stats->rx_avg_len = stats->rx_cnt ?
3307 			    DIV_ROUND_DOWN_ULL(stats->rx_unicast, stats->rx_cnt) : 0;
3308 
3309 	stats->tx_unicast = 0;
3310 	stats->rx_unicast = 0;
3311 	stats->tx_cnt = 0;
3312 	stats->rx_cnt = 0;
3313 	stats->rx_tf_periodic = stats->rx_tf_acc;
3314 	stats->rx_tf_acc = 0;
3315 
3316 	if (tx_tfc_lv != stats->tx_tfc_lv || rx_tfc_lv != stats->rx_tfc_lv)
3317 		return true;
3318 
3319 	return false;
3320 }
3321 
3322 static bool rtw89_traffic_stats_track(struct rtw89_dev *rtwdev)
3323 {
3324 	struct rtw89_vif_link *rtwvif_link;
3325 	struct rtw89_vif *rtwvif;
3326 	unsigned int link_id;
3327 	bool tfc_changed;
3328 
3329 	tfc_changed = rtw89_traffic_stats_calc(rtwdev, &rtwdev->stats);
3330 
3331 	rtw89_for_each_rtwvif(rtwdev, rtwvif) {
3332 		rtw89_traffic_stats_calc(rtwdev, &rtwvif->stats);
3333 
3334 		rtw89_vif_for_each_link(rtwvif, rtwvif_link, link_id)
3335 			rtw89_fw_h2c_tp_offload(rtwdev, rtwvif_link);
3336 	}
3337 
3338 	return tfc_changed;
3339 }
3340 
3341 static void rtw89_vif_enter_lps(struct rtw89_dev *rtwdev,
3342 				struct rtw89_vif_link *rtwvif_link)
3343 {
3344 	if (rtwvif_link->wifi_role != RTW89_WIFI_ROLE_STATION &&
3345 	    rtwvif_link->wifi_role != RTW89_WIFI_ROLE_P2P_CLIENT)
3346 		return;
3347 
3348 	rtw89_enter_lps(rtwdev, rtwvif_link, true);
3349 }
3350 
3351 static void rtw89_enter_lps_track(struct rtw89_dev *rtwdev)
3352 {
3353 	struct rtw89_vif_link *rtwvif_link;
3354 	struct rtw89_vif *rtwvif;
3355 	unsigned int link_id;
3356 
3357 	rtw89_for_each_rtwvif(rtwdev, rtwvif) {
3358 		if (rtwvif->tdls_peer)
3359 			continue;
3360 		if (rtwvif->offchan)
3361 			continue;
3362 
3363 		if (rtwvif->stats.tx_tfc_lv != RTW89_TFC_IDLE ||
3364 		    rtwvif->stats.rx_tfc_lv != RTW89_TFC_IDLE)
3365 			continue;
3366 
3367 		rtw89_vif_for_each_link(rtwvif, rtwvif_link, link_id)
3368 			rtw89_vif_enter_lps(rtwdev, rtwvif_link);
3369 	}
3370 }
3371 
3372 static void rtw89_core_rfk_track(struct rtw89_dev *rtwdev)
3373 {
3374 	enum rtw89_entity_mode mode;
3375 
3376 	mode = rtw89_get_entity_mode(rtwdev);
3377 	if (mode == RTW89_ENTITY_MODE_MCC)
3378 		return;
3379 
3380 	rtw89_chip_rfk_track(rtwdev);
3381 }
3382 
3383 void rtw89_core_update_p2p_ps(struct rtw89_dev *rtwdev,
3384 			      struct rtw89_vif_link *rtwvif_link,
3385 			      struct ieee80211_bss_conf *bss_conf)
3386 {
3387 	enum rtw89_entity_mode mode = rtw89_get_entity_mode(rtwdev);
3388 
3389 	if (mode == RTW89_ENTITY_MODE_MCC)
3390 		rtw89_queue_chanctx_change(rtwdev, RTW89_CHANCTX_P2P_PS_CHANGE);
3391 	else
3392 		rtw89_process_p2p_ps(rtwdev, rtwvif_link, bss_conf);
3393 }
3394 
3395 void rtw89_traffic_stats_init(struct rtw89_dev *rtwdev,
3396 			      struct rtw89_traffic_stats *stats)
3397 {
3398 	stats->tx_unicast = 0;
3399 	stats->rx_unicast = 0;
3400 	stats->tx_cnt = 0;
3401 	stats->rx_cnt = 0;
3402 	ewma_tp_init(&stats->tx_ewma_tp);
3403 	ewma_tp_init(&stats->rx_ewma_tp);
3404 }
3405 
3406 static void rtw89_track_work(struct work_struct *work)
3407 {
3408 	struct rtw89_dev *rtwdev = container_of(work, struct rtw89_dev,
3409 						track_work.work);
3410 	bool tfc_changed;
3411 
3412 	if (test_bit(RTW89_FLAG_FORBIDDEN_TRACK_WROK, rtwdev->flags))
3413 		return;
3414 
3415 	mutex_lock(&rtwdev->mutex);
3416 
3417 	if (!test_bit(RTW89_FLAG_RUNNING, rtwdev->flags))
3418 		goto out;
3419 
3420 	ieee80211_queue_delayed_work(rtwdev->hw, &rtwdev->track_work,
3421 				     RTW89_TRACK_WORK_PERIOD);
3422 
3423 	tfc_changed = rtw89_traffic_stats_track(rtwdev);
3424 	if (rtwdev->scanning)
3425 		goto out;
3426 
3427 	rtw89_leave_lps(rtwdev);
3428 
3429 	if (tfc_changed) {
3430 		rtw89_hci_recalc_int_mit(rtwdev);
3431 		rtw89_btc_ntfy_wl_sta(rtwdev);
3432 	}
3433 	rtw89_mac_bf_monitor_track(rtwdev);
3434 	rtw89_phy_stat_track(rtwdev);
3435 	rtw89_phy_env_monitor_track(rtwdev);
3436 	rtw89_phy_dig(rtwdev);
3437 	rtw89_core_rfk_track(rtwdev);
3438 	rtw89_phy_ra_update(rtwdev);
3439 	rtw89_phy_cfo_track(rtwdev);
3440 	rtw89_phy_tx_path_div_track(rtwdev);
3441 	rtw89_phy_antdiv_track(rtwdev);
3442 	rtw89_phy_ul_tb_ctrl_track(rtwdev);
3443 	rtw89_phy_edcca_track(rtwdev);
3444 	rtw89_tas_track(rtwdev);
3445 	rtw89_chanctx_track(rtwdev);
3446 	rtw89_core_rfkill_poll(rtwdev, false);
3447 
3448 	if (rtwdev->lps_enabled && !rtwdev->btc.lps)
3449 		rtw89_enter_lps_track(rtwdev);
3450 
3451 out:
3452 	mutex_unlock(&rtwdev->mutex);
3453 }
3454 
3455 u8 rtw89_core_acquire_bit_map(unsigned long *addr, unsigned long size)
3456 {
3457 	unsigned long bit;
3458 
3459 	bit = find_first_zero_bit(addr, size);
3460 	if (bit < size)
3461 		set_bit(bit, addr);
3462 
3463 	return bit;
3464 }
3465 
3466 void rtw89_core_release_bit_map(unsigned long *addr, u8 bit)
3467 {
3468 	clear_bit(bit, addr);
3469 }
3470 
3471 void rtw89_core_release_all_bits_map(unsigned long *addr, unsigned int nbits)
3472 {
3473 	bitmap_zero(addr, nbits);
3474 }
3475 
3476 int rtw89_core_acquire_sta_ba_entry(struct rtw89_dev *rtwdev,
3477 				    struct rtw89_sta_link *rtwsta_link, u8 tid,
3478 				    u8 *cam_idx)
3479 {
3480 	const struct rtw89_chip_info *chip = rtwdev->chip;
3481 	struct rtw89_cam_info *cam_info = &rtwdev->cam_info;
3482 	struct rtw89_ba_cam_entry *entry = NULL, *tmp;
3483 	u8 idx;
3484 	int i;
3485 
3486 	lockdep_assert_held(&rtwdev->mutex);
3487 
3488 	idx = rtw89_core_acquire_bit_map(cam_info->ba_cam_map, chip->bacam_num);
3489 	if (idx == chip->bacam_num) {
3490 		/* allocate a static BA CAM to tid=0/5, so replace the existing
3491 		 * one if BA CAM is full. Hardware will process the original tid
3492 		 * automatically.
3493 		 */
3494 		if (tid != 0 && tid != 5)
3495 			return -ENOSPC;
3496 
3497 		for_each_set_bit(i, cam_info->ba_cam_map, chip->bacam_num) {
3498 			tmp = &cam_info->ba_cam_entry[i];
3499 			if (tmp->tid == 0 || tmp->tid == 5)
3500 				continue;
3501 
3502 			idx = i;
3503 			entry = tmp;
3504 			list_del(&entry->list);
3505 			break;
3506 		}
3507 
3508 		if (!entry)
3509 			return -ENOSPC;
3510 	} else {
3511 		entry = &cam_info->ba_cam_entry[idx];
3512 	}
3513 
3514 	entry->tid = tid;
3515 	list_add_tail(&entry->list, &rtwsta_link->ba_cam_list);
3516 
3517 	*cam_idx = idx;
3518 
3519 	return 0;
3520 }
3521 
3522 int rtw89_core_release_sta_ba_entry(struct rtw89_dev *rtwdev,
3523 				    struct rtw89_sta_link *rtwsta_link, u8 tid,
3524 				    u8 *cam_idx)
3525 {
3526 	struct rtw89_cam_info *cam_info = &rtwdev->cam_info;
3527 	struct rtw89_ba_cam_entry *entry = NULL, *tmp;
3528 	u8 idx;
3529 
3530 	lockdep_assert_held(&rtwdev->mutex);
3531 
3532 	list_for_each_entry_safe(entry, tmp, &rtwsta_link->ba_cam_list, list) {
3533 		if (entry->tid != tid)
3534 			continue;
3535 
3536 		idx = entry - cam_info->ba_cam_entry;
3537 		list_del(&entry->list);
3538 
3539 		rtw89_core_release_bit_map(cam_info->ba_cam_map, idx);
3540 		*cam_idx = idx;
3541 		return 0;
3542 	}
3543 
3544 	return -ENOENT;
3545 }
3546 
3547 #define RTW89_TYPE_MAPPING(_type)	\
3548 	case NL80211_IFTYPE_ ## _type:	\
3549 		rtwvif_link->wifi_role = RTW89_WIFI_ROLE_ ## _type;	\
3550 		break
3551 void rtw89_vif_type_mapping(struct rtw89_vif_link *rtwvif_link, bool assoc)
3552 {
3553 	const struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
3554 	const struct ieee80211_bss_conf *bss_conf;
3555 
3556 	switch (vif->type) {
3557 	case NL80211_IFTYPE_STATION:
3558 		if (vif->p2p)
3559 			rtwvif_link->wifi_role = RTW89_WIFI_ROLE_P2P_CLIENT;
3560 		else
3561 			rtwvif_link->wifi_role = RTW89_WIFI_ROLE_STATION;
3562 		break;
3563 	case NL80211_IFTYPE_AP:
3564 		if (vif->p2p)
3565 			rtwvif_link->wifi_role = RTW89_WIFI_ROLE_P2P_GO;
3566 		else
3567 			rtwvif_link->wifi_role = RTW89_WIFI_ROLE_AP;
3568 		break;
3569 	RTW89_TYPE_MAPPING(ADHOC);
3570 	RTW89_TYPE_MAPPING(MONITOR);
3571 	RTW89_TYPE_MAPPING(MESH_POINT);
3572 	default:
3573 		WARN_ON(1);
3574 		break;
3575 	}
3576 
3577 	switch (vif->type) {
3578 	case NL80211_IFTYPE_AP:
3579 	case NL80211_IFTYPE_MESH_POINT:
3580 		rtwvif_link->net_type = RTW89_NET_TYPE_AP_MODE;
3581 		rtwvif_link->self_role = RTW89_SELF_ROLE_AP;
3582 		break;
3583 	case NL80211_IFTYPE_ADHOC:
3584 		rtwvif_link->net_type = RTW89_NET_TYPE_AD_HOC;
3585 		rtwvif_link->self_role = RTW89_SELF_ROLE_CLIENT;
3586 		break;
3587 	case NL80211_IFTYPE_STATION:
3588 		if (assoc) {
3589 			rtwvif_link->net_type = RTW89_NET_TYPE_INFRA;
3590 
3591 			rcu_read_lock();
3592 			bss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, false);
3593 			rtwvif_link->trigger = bss_conf->he_support;
3594 			rcu_read_unlock();
3595 		} else {
3596 			rtwvif_link->net_type = RTW89_NET_TYPE_NO_LINK;
3597 			rtwvif_link->trigger = false;
3598 		}
3599 		rtwvif_link->self_role = RTW89_SELF_ROLE_CLIENT;
3600 		rtwvif_link->addr_cam.sec_ent_mode = RTW89_ADDR_CAM_SEC_NORMAL;
3601 		break;
3602 	case NL80211_IFTYPE_MONITOR:
3603 		break;
3604 	default:
3605 		WARN_ON(1);
3606 		break;
3607 	}
3608 }
3609 
3610 int rtw89_core_sta_link_add(struct rtw89_dev *rtwdev,
3611 			    struct rtw89_vif_link *rtwvif_link,
3612 			    struct rtw89_sta_link *rtwsta_link)
3613 {
3614 	const struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
3615 	const struct ieee80211_sta *sta = rtwsta_link_to_sta(rtwsta_link);
3616 	struct rtw89_hal *hal = &rtwdev->hal;
3617 	u8 ant_num = hal->ant_diversity ? 2 : rtwdev->chip->rf_path_num;
3618 	int i;
3619 	int ret;
3620 
3621 	rtwsta_link->prev_rssi = 0;
3622 	INIT_LIST_HEAD(&rtwsta_link->ba_cam_list);
3623 	ewma_rssi_init(&rtwsta_link->avg_rssi);
3624 	ewma_snr_init(&rtwsta_link->avg_snr);
3625 	ewma_evm_init(&rtwsta_link->evm_1ss);
3626 	for (i = 0; i < ant_num; i++) {
3627 		ewma_rssi_init(&rtwsta_link->rssi[i]);
3628 		ewma_evm_init(&rtwsta_link->evm_min[i]);
3629 		ewma_evm_init(&rtwsta_link->evm_max[i]);
3630 	}
3631 
3632 	if (vif->type == NL80211_IFTYPE_STATION && !sta->tdls) {
3633 		/* must do rtw89_reg_6ghz_recalc() before rfk channel */
3634 		ret = rtw89_reg_6ghz_recalc(rtwdev, rtwvif_link, true);
3635 		if (ret)
3636 			return ret;
3637 
3638 		rtw89_btc_ntfy_role_info(rtwdev, rtwvif_link, rtwsta_link,
3639 					 BTC_ROLE_MSTS_STA_CONN_START);
3640 		rtw89_chip_rfk_channel(rtwdev, rtwvif_link);
3641 	} else if (vif->type == NL80211_IFTYPE_AP || sta->tdls) {
3642 		ret = rtw89_mac_set_macid_pause(rtwdev, rtwsta_link->mac_id, false);
3643 		if (ret) {
3644 			rtw89_warn(rtwdev, "failed to send h2c macid pause\n");
3645 			return ret;
3646 		}
3647 
3648 		ret = rtw89_fw_h2c_role_maintain(rtwdev, rtwvif_link, rtwsta_link,
3649 						 RTW89_ROLE_CREATE);
3650 		if (ret) {
3651 			rtw89_warn(rtwdev, "failed to send h2c role info\n");
3652 			return ret;
3653 		}
3654 
3655 		ret = rtw89_chip_h2c_default_cmac_tbl(rtwdev, rtwvif_link, rtwsta_link);
3656 		if (ret)
3657 			return ret;
3658 
3659 		ret = rtw89_chip_h2c_default_dmac_tbl(rtwdev, rtwvif_link, rtwsta_link);
3660 		if (ret)
3661 			return ret;
3662 	}
3663 
3664 	return 0;
3665 }
3666 
3667 int rtw89_core_sta_link_disassoc(struct rtw89_dev *rtwdev,
3668 				 struct rtw89_vif_link *rtwvif_link,
3669 				 struct rtw89_sta_link *rtwsta_link)
3670 {
3671 	const struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
3672 
3673 	if (vif->type == NL80211_IFTYPE_STATION)
3674 		rtw89_fw_h2c_set_bcn_fltr_cfg(rtwdev, rtwvif_link, false);
3675 
3676 	return 0;
3677 }
3678 
3679 int rtw89_core_sta_link_disconnect(struct rtw89_dev *rtwdev,
3680 				   struct rtw89_vif_link *rtwvif_link,
3681 				   struct rtw89_sta_link *rtwsta_link)
3682 {
3683 	const struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
3684 	const struct ieee80211_sta *sta = rtwsta_link_to_sta(rtwsta_link);
3685 	int ret;
3686 
3687 	rtw89_mac_bf_monitor_calc(rtwdev, rtwsta_link, true);
3688 	rtw89_mac_bf_disassoc(rtwdev, rtwvif_link, rtwsta_link);
3689 
3690 	if (vif->type == NL80211_IFTYPE_AP || sta->tdls)
3691 		rtw89_cam_deinit_addr_cam(rtwdev, &rtwsta_link->addr_cam);
3692 	if (sta->tdls)
3693 		rtw89_cam_deinit_bssid_cam(rtwdev, &rtwsta_link->bssid_cam);
3694 
3695 	if (vif->type == NL80211_IFTYPE_STATION && !sta->tdls) {
3696 		rtw89_vif_type_mapping(rtwvif_link, false);
3697 		rtw89_fw_release_general_pkt_list_vif(rtwdev, rtwvif_link, true);
3698 	}
3699 
3700 	ret = rtw89_chip_h2c_assoc_cmac_tbl(rtwdev, rtwvif_link, rtwsta_link);
3701 	if (ret) {
3702 		rtw89_warn(rtwdev, "failed to send h2c cmac table\n");
3703 		return ret;
3704 	}
3705 
3706 	ret = rtw89_fw_h2c_join_info(rtwdev, rtwvif_link, rtwsta_link, true);
3707 	if (ret) {
3708 		rtw89_warn(rtwdev, "failed to send h2c join info\n");
3709 		return ret;
3710 	}
3711 
3712 	/* update cam aid mac_id net_type */
3713 	ret = rtw89_fw_h2c_cam(rtwdev, rtwvif_link, rtwsta_link, NULL);
3714 	if (ret) {
3715 		rtw89_warn(rtwdev, "failed to send h2c cam\n");
3716 		return ret;
3717 	}
3718 
3719 	return ret;
3720 }
3721 
3722 int rtw89_core_sta_link_assoc(struct rtw89_dev *rtwdev,
3723 			      struct rtw89_vif_link *rtwvif_link,
3724 			      struct rtw89_sta_link *rtwsta_link)
3725 {
3726 	const struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
3727 	const struct ieee80211_sta *sta = rtwsta_link_to_sta(rtwsta_link);
3728 	struct rtw89_bssid_cam_entry *bssid_cam = rtw89_get_bssid_cam_of(rtwvif_link,
3729 									 rtwsta_link);
3730 	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev,
3731 						       rtwvif_link->chanctx_idx);
3732 	int ret;
3733 
3734 	if (vif->type == NL80211_IFTYPE_AP || sta->tdls) {
3735 		if (sta->tdls) {
3736 			struct ieee80211_link_sta *link_sta;
3737 
3738 			rcu_read_lock();
3739 
3740 			link_sta = rtw89_sta_rcu_dereference_link(rtwsta_link, true);
3741 			ret = rtw89_cam_init_bssid_cam(rtwdev, rtwvif_link, bssid_cam,
3742 						       link_sta->addr);
3743 			if (ret) {
3744 				rtw89_warn(rtwdev, "failed to send h2c init bssid cam for TDLS\n");
3745 				rcu_read_unlock();
3746 				return ret;
3747 			}
3748 
3749 			rcu_read_unlock();
3750 		}
3751 
3752 		ret = rtw89_cam_init_addr_cam(rtwdev, &rtwsta_link->addr_cam, bssid_cam);
3753 		if (ret) {
3754 			rtw89_warn(rtwdev, "failed to send h2c init addr cam\n");
3755 			return ret;
3756 		}
3757 	}
3758 
3759 	ret = rtw89_chip_h2c_assoc_cmac_tbl(rtwdev, rtwvif_link, rtwsta_link);
3760 	if (ret) {
3761 		rtw89_warn(rtwdev, "failed to send h2c cmac table\n");
3762 		return ret;
3763 	}
3764 
3765 	ret = rtw89_fw_h2c_join_info(rtwdev, rtwvif_link, rtwsta_link, false);
3766 	if (ret) {
3767 		rtw89_warn(rtwdev, "failed to send h2c join info\n");
3768 		return ret;
3769 	}
3770 
3771 	/* update cam aid mac_id net_type */
3772 	ret = rtw89_fw_h2c_cam(rtwdev, rtwvif_link, rtwsta_link, NULL);
3773 	if (ret) {
3774 		rtw89_warn(rtwdev, "failed to send h2c cam\n");
3775 		return ret;
3776 	}
3777 
3778 	rtw89_phy_ra_assoc(rtwdev, rtwsta_link);
3779 	rtw89_mac_bf_assoc(rtwdev, rtwvif_link, rtwsta_link);
3780 	rtw89_mac_bf_monitor_calc(rtwdev, rtwsta_link, false);
3781 
3782 	if (vif->type == NL80211_IFTYPE_STATION && !sta->tdls) {
3783 		struct ieee80211_bss_conf *bss_conf;
3784 
3785 		rcu_read_lock();
3786 
3787 		bss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, true);
3788 		if (bss_conf->he_support &&
3789 		    !(bss_conf->he_oper.params & IEEE80211_HE_OPERATION_ER_SU_DISABLE))
3790 			rtwsta_link->er_cap = true;
3791 
3792 		rcu_read_unlock();
3793 
3794 		rtw89_btc_ntfy_role_info(rtwdev, rtwvif_link, rtwsta_link,
3795 					 BTC_ROLE_MSTS_STA_CONN_END);
3796 		rtw89_core_get_no_ul_ofdma_htc(rtwdev, &rtwsta_link->htc_template, chan);
3797 		rtw89_phy_ul_tb_assoc(rtwdev, rtwvif_link);
3798 
3799 		ret = rtw89_fw_h2c_general_pkt(rtwdev, rtwvif_link, rtwsta_link->mac_id);
3800 		if (ret) {
3801 			rtw89_warn(rtwdev, "failed to send h2c general packet\n");
3802 			return ret;
3803 		}
3804 
3805 		rtw89_fw_h2c_set_bcn_fltr_cfg(rtwdev, rtwvif_link, true);
3806 	}
3807 
3808 	return ret;
3809 }
3810 
3811 int rtw89_core_sta_link_remove(struct rtw89_dev *rtwdev,
3812 			       struct rtw89_vif_link *rtwvif_link,
3813 			       struct rtw89_sta_link *rtwsta_link)
3814 {
3815 	const struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
3816 	const struct ieee80211_sta *sta = rtwsta_link_to_sta(rtwsta_link);
3817 	int ret;
3818 
3819 	if (vif->type == NL80211_IFTYPE_STATION && !sta->tdls) {
3820 		rtw89_reg_6ghz_recalc(rtwdev, rtwvif_link, false);
3821 		rtw89_btc_ntfy_role_info(rtwdev, rtwvif_link, rtwsta_link,
3822 					 BTC_ROLE_MSTS_STA_DIS_CONN);
3823 	} else if (vif->type == NL80211_IFTYPE_AP || sta->tdls) {
3824 		ret = rtw89_fw_h2c_role_maintain(rtwdev, rtwvif_link, rtwsta_link,
3825 						 RTW89_ROLE_REMOVE);
3826 		if (ret) {
3827 			rtw89_warn(rtwdev, "failed to send h2c role info\n");
3828 			return ret;
3829 		}
3830 	}
3831 
3832 	return 0;
3833 }
3834 
3835 static void _rtw89_core_set_tid_config(struct rtw89_dev *rtwdev,
3836 				       struct ieee80211_sta *sta,
3837 				       struct cfg80211_tid_cfg *tid_conf)
3838 {
3839 	struct ieee80211_txq *txq;
3840 	struct rtw89_txq *rtwtxq;
3841 	u32 mask = tid_conf->mask;
3842 	u8 tids = tid_conf->tids;
3843 	int tids_nbit = BITS_PER_BYTE;
3844 	int i;
3845 
3846 	for (i = 0; i < tids_nbit; i++, tids >>= 1) {
3847 		if (!tids)
3848 			break;
3849 
3850 		if (!(tids & BIT(0)))
3851 			continue;
3852 
3853 		txq = sta->txq[i];
3854 		rtwtxq = (struct rtw89_txq *)txq->drv_priv;
3855 
3856 		if (mask & BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL)) {
3857 			if (tid_conf->ampdu == NL80211_TID_CONFIG_ENABLE) {
3858 				clear_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags);
3859 			} else {
3860 				if (test_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags))
3861 					ieee80211_stop_tx_ba_session(sta, txq->tid);
3862 				spin_lock_bh(&rtwdev->ba_lock);
3863 				list_del_init(&rtwtxq->list);
3864 				set_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags);
3865 				spin_unlock_bh(&rtwdev->ba_lock);
3866 			}
3867 		}
3868 
3869 		if (mask & BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL) && tids == 0xff) {
3870 			if (tid_conf->amsdu == NL80211_TID_CONFIG_ENABLE)
3871 				sta->max_amsdu_subframes = 0;
3872 			else
3873 				sta->max_amsdu_subframes = 1;
3874 		}
3875 	}
3876 }
3877 
3878 void rtw89_core_set_tid_config(struct rtw89_dev *rtwdev,
3879 			       struct ieee80211_sta *sta,
3880 			       struct cfg80211_tid_config *tid_config)
3881 {
3882 	int i;
3883 
3884 	for (i = 0; i < tid_config->n_tid_conf; i++)
3885 		_rtw89_core_set_tid_config(rtwdev, sta,
3886 					   &tid_config->tid_conf[i]);
3887 }
3888 
3889 static void rtw89_init_ht_cap(struct rtw89_dev *rtwdev,
3890 			      struct ieee80211_sta_ht_cap *ht_cap)
3891 {
3892 	static const __le16 highest[RF_PATH_MAX] = {
3893 		cpu_to_le16(150), cpu_to_le16(300), cpu_to_le16(450), cpu_to_le16(600),
3894 	};
3895 	struct rtw89_hal *hal = &rtwdev->hal;
3896 	u8 nss = hal->rx_nss;
3897 	int i;
3898 
3899 	ht_cap->ht_supported = true;
3900 	ht_cap->cap = 0;
3901 	ht_cap->cap |= IEEE80211_HT_CAP_SGI_20 |
3902 		       IEEE80211_HT_CAP_MAX_AMSDU |
3903 		       IEEE80211_HT_CAP_TX_STBC |
3904 		       (1 << IEEE80211_HT_CAP_RX_STBC_SHIFT);
3905 	ht_cap->cap |= IEEE80211_HT_CAP_LDPC_CODING;
3906 	ht_cap->cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
3907 		       IEEE80211_HT_CAP_DSSSCCK40 |
3908 		       IEEE80211_HT_CAP_SGI_40;
3909 	ht_cap->ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
3910 	ht_cap->ampdu_density = IEEE80211_HT_MPDU_DENSITY_NONE;
3911 	ht_cap->mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
3912 	for (i = 0; i < nss; i++)
3913 		ht_cap->mcs.rx_mask[i] = 0xFF;
3914 	ht_cap->mcs.rx_mask[4] = 0x01;
3915 	ht_cap->mcs.rx_highest = highest[nss - 1];
3916 }
3917 
3918 static void rtw89_init_vht_cap(struct rtw89_dev *rtwdev,
3919 			       struct ieee80211_sta_vht_cap *vht_cap)
3920 {
3921 	static const __le16 highest_bw80[RF_PATH_MAX] = {
3922 		cpu_to_le16(433), cpu_to_le16(867), cpu_to_le16(1300), cpu_to_le16(1733),
3923 	};
3924 	static const __le16 highest_bw160[RF_PATH_MAX] = {
3925 		cpu_to_le16(867), cpu_to_le16(1733), cpu_to_le16(2600), cpu_to_le16(3467),
3926 	};
3927 	const struct rtw89_chip_info *chip = rtwdev->chip;
3928 	const __le16 *highest = chip->support_bandwidths & BIT(NL80211_CHAN_WIDTH_160) ?
3929 				highest_bw160 : highest_bw80;
3930 	struct rtw89_hal *hal = &rtwdev->hal;
3931 	u16 tx_mcs_map = 0, rx_mcs_map = 0;
3932 	u8 sts_cap = 3;
3933 	int i;
3934 
3935 	for (i = 0; i < 8; i++) {
3936 		if (i < hal->tx_nss)
3937 			tx_mcs_map |= IEEE80211_VHT_MCS_SUPPORT_0_9 << (i * 2);
3938 		else
3939 			tx_mcs_map |= IEEE80211_VHT_MCS_NOT_SUPPORTED << (i * 2);
3940 		if (i < hal->rx_nss)
3941 			rx_mcs_map |= IEEE80211_VHT_MCS_SUPPORT_0_9 << (i * 2);
3942 		else
3943 			rx_mcs_map |= IEEE80211_VHT_MCS_NOT_SUPPORTED << (i * 2);
3944 	}
3945 
3946 	vht_cap->vht_supported = true;
3947 	vht_cap->cap = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
3948 		       IEEE80211_VHT_CAP_SHORT_GI_80 |
3949 		       IEEE80211_VHT_CAP_RXSTBC_1 |
3950 		       IEEE80211_VHT_CAP_HTC_VHT |
3951 		       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK |
3952 		       0;
3953 	vht_cap->cap |= IEEE80211_VHT_CAP_TXSTBC;
3954 	vht_cap->cap |= IEEE80211_VHT_CAP_RXLDPC;
3955 	vht_cap->cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE |
3956 			IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
3957 	vht_cap->cap |= sts_cap << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT;
3958 	if (chip->support_bandwidths & BIT(NL80211_CHAN_WIDTH_160))
3959 		vht_cap->cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ |
3960 				IEEE80211_VHT_CAP_SHORT_GI_160;
3961 	vht_cap->vht_mcs.rx_mcs_map = cpu_to_le16(rx_mcs_map);
3962 	vht_cap->vht_mcs.tx_mcs_map = cpu_to_le16(tx_mcs_map);
3963 	vht_cap->vht_mcs.rx_highest = highest[hal->rx_nss - 1];
3964 	vht_cap->vht_mcs.tx_highest = highest[hal->tx_nss - 1];
3965 
3966 	if (ieee80211_hw_check(rtwdev->hw, SUPPORTS_VHT_EXT_NSS_BW))
3967 		vht_cap->vht_mcs.tx_highest |=
3968 			cpu_to_le16(IEEE80211_VHT_EXT_NSS_BW_CAPABLE);
3969 }
3970 
3971 static void rtw89_init_he_cap(struct rtw89_dev *rtwdev,
3972 			      enum nl80211_band band,
3973 			      enum nl80211_iftype iftype,
3974 			      struct ieee80211_sband_iftype_data *iftype_data)
3975 {
3976 	const struct rtw89_chip_info *chip = rtwdev->chip;
3977 	struct rtw89_hal *hal = &rtwdev->hal;
3978 	bool no_ng16 = (chip->chip_id == RTL8852A && hal->cv == CHIP_CBV) ||
3979 		       (chip->chip_id == RTL8852B && hal->cv == CHIP_CAV);
3980 	struct ieee80211_sta_he_cap *he_cap;
3981 	int nss = hal->rx_nss;
3982 	u8 *mac_cap_info;
3983 	u8 *phy_cap_info;
3984 	u16 mcs_map = 0;
3985 	int i;
3986 
3987 	for (i = 0; i < 8; i++) {
3988 		if (i < nss)
3989 			mcs_map |= IEEE80211_HE_MCS_SUPPORT_0_11 << (i * 2);
3990 		else
3991 			mcs_map |= IEEE80211_HE_MCS_NOT_SUPPORTED << (i * 2);
3992 	}
3993 
3994 	he_cap = &iftype_data->he_cap;
3995 	mac_cap_info = he_cap->he_cap_elem.mac_cap_info;
3996 	phy_cap_info = he_cap->he_cap_elem.phy_cap_info;
3997 
3998 	he_cap->has_he = true;
3999 	mac_cap_info[0] = IEEE80211_HE_MAC_CAP0_HTC_HE;
4000 	if (iftype == NL80211_IFTYPE_STATION)
4001 		mac_cap_info[1] = IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US;
4002 	mac_cap_info[2] = IEEE80211_HE_MAC_CAP2_ALL_ACK |
4003 			  IEEE80211_HE_MAC_CAP2_BSR;
4004 	mac_cap_info[3] = IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_2;
4005 	if (iftype == NL80211_IFTYPE_AP)
4006 		mac_cap_info[3] |= IEEE80211_HE_MAC_CAP3_OMI_CONTROL;
4007 	mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_OPS |
4008 			  IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU;
4009 	if (iftype == NL80211_IFTYPE_STATION)
4010 		mac_cap_info[5] = IEEE80211_HE_MAC_CAP5_HT_VHT_TRIG_FRAME_RX;
4011 	if (band == NL80211_BAND_2GHZ) {
4012 		phy_cap_info[0] =
4013 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G;
4014 	} else {
4015 		phy_cap_info[0] =
4016 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G;
4017 		if (chip->support_bandwidths & BIT(NL80211_CHAN_WIDTH_160))
4018 			phy_cap_info[0] |= IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
4019 	}
4020 	phy_cap_info[1] = IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4021 			  IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4022 			  IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US;
4023 	phy_cap_info[2] = IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4024 			  IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4025 			  IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4026 			  IEEE80211_HE_PHY_CAP2_DOPPLER_TX;
4027 	phy_cap_info[3] = IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_16_QAM;
4028 	if (iftype == NL80211_IFTYPE_STATION)
4029 		phy_cap_info[3] |= IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_16_QAM |
4030 				   IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_2;
4031 	if (iftype == NL80211_IFTYPE_AP)
4032 		phy_cap_info[3] |= IEEE80211_HE_PHY_CAP3_RX_PARTIAL_BW_SU_IN_20MHZ_MU;
4033 	phy_cap_info[4] = IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE |
4034 			  IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_4;
4035 	if (chip->support_bandwidths & BIT(NL80211_CHAN_WIDTH_160))
4036 		phy_cap_info[4] |= IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_4;
4037 	phy_cap_info[5] = no_ng16 ? 0 :
4038 			  IEEE80211_HE_PHY_CAP5_NG16_SU_FEEDBACK |
4039 			  IEEE80211_HE_PHY_CAP5_NG16_MU_FEEDBACK;
4040 	phy_cap_info[6] = IEEE80211_HE_PHY_CAP6_CODEBOOK_SIZE_42_SU |
4041 			  IEEE80211_HE_PHY_CAP6_CODEBOOK_SIZE_75_MU |
4042 			  IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |
4043 			  IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE;
4044 	phy_cap_info[7] = IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP |
4045 			  IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI |
4046 			  IEEE80211_HE_PHY_CAP7_MAX_NC_1;
4047 	phy_cap_info[8] = IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
4048 			  IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI |
4049 			  IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_996;
4050 	if (chip->support_bandwidths & BIT(NL80211_CHAN_WIDTH_160))
4051 		phy_cap_info[8] |= IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU |
4052 				   IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU;
4053 	phy_cap_info[9] = IEEE80211_HE_PHY_CAP9_LONGER_THAN_16_SIGB_OFDM_SYM |
4054 			  IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU |
4055 			  IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_COMP_SIGB |
4056 			  IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_NON_COMP_SIGB |
4057 			  u8_encode_bits(IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_16US,
4058 					 IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_MASK);
4059 	if (iftype == NL80211_IFTYPE_STATION)
4060 		phy_cap_info[9] |= IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU;
4061 	he_cap->he_mcs_nss_supp.rx_mcs_80 = cpu_to_le16(mcs_map);
4062 	he_cap->he_mcs_nss_supp.tx_mcs_80 = cpu_to_le16(mcs_map);
4063 	if (chip->support_bandwidths & BIT(NL80211_CHAN_WIDTH_160)) {
4064 		he_cap->he_mcs_nss_supp.rx_mcs_160 = cpu_to_le16(mcs_map);
4065 		he_cap->he_mcs_nss_supp.tx_mcs_160 = cpu_to_le16(mcs_map);
4066 	}
4067 
4068 	if (band == NL80211_BAND_6GHZ) {
4069 		__le16 capa;
4070 
4071 		capa = le16_encode_bits(IEEE80211_HT_MPDU_DENSITY_NONE,
4072 					IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START) |
4073 		       le16_encode_bits(IEEE80211_VHT_MAX_AMPDU_1024K,
4074 					IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP) |
4075 		       le16_encode_bits(IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454,
4076 					IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN);
4077 		iftype_data->he_6ghz_capa.capa = capa;
4078 	}
4079 }
4080 
4081 static void rtw89_init_eht_cap(struct rtw89_dev *rtwdev,
4082 			       enum nl80211_band band,
4083 			       enum nl80211_iftype iftype,
4084 			       struct ieee80211_sband_iftype_data *iftype_data)
4085 {
4086 	const struct rtw89_chip_info *chip = rtwdev->chip;
4087 	struct ieee80211_eht_cap_elem_fixed *eht_cap_elem;
4088 	struct ieee80211_eht_mcs_nss_supp *eht_nss;
4089 	struct ieee80211_sta_eht_cap *eht_cap;
4090 	struct rtw89_hal *hal = &rtwdev->hal;
4091 	bool support_320mhz = false;
4092 	int sts = 8;
4093 	u8 val;
4094 
4095 	if (chip->chip_gen == RTW89_CHIP_AX)
4096 		return;
4097 
4098 	if (band == NL80211_BAND_6GHZ &&
4099 	    chip->support_bandwidths & BIT(NL80211_CHAN_WIDTH_320))
4100 		support_320mhz = true;
4101 
4102 	eht_cap = &iftype_data->eht_cap;
4103 	eht_cap_elem = &eht_cap->eht_cap_elem;
4104 	eht_nss = &eht_cap->eht_mcs_nss_supp;
4105 
4106 	eht_cap->has_eht = true;
4107 
4108 	eht_cap_elem->mac_cap_info[0] =
4109 		u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_7991,
4110 			       IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK);
4111 	eht_cap_elem->mac_cap_info[1] = 0;
4112 
4113 	eht_cap_elem->phy_cap_info[0] =
4114 		IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4115 		IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE;
4116 	if (support_320mhz)
4117 		eht_cap_elem->phy_cap_info[0] |=
4118 			IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ;
4119 
4120 	eht_cap_elem->phy_cap_info[0] |=
4121 		u8_encode_bits(u8_get_bits(sts - 1, BIT(0)),
4122 			       IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK);
4123 	eht_cap_elem->phy_cap_info[1] =
4124 		u8_encode_bits(u8_get_bits(sts - 1, GENMASK(2, 1)),
4125 			       IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK) |
4126 		u8_encode_bits(sts - 1,
4127 			       IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK);
4128 	if (support_320mhz)
4129 		eht_cap_elem->phy_cap_info[1] |=
4130 			u8_encode_bits(sts - 1,
4131 				       IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK);
4132 
4133 	eht_cap_elem->phy_cap_info[2] = 0;
4134 
4135 	eht_cap_elem->phy_cap_info[3] =
4136 		IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4137 		IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4138 		IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4139 		IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK;
4140 
4141 	eht_cap_elem->phy_cap_info[4] =
4142 		IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4143 		u8_encode_bits(1, IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK);
4144 
4145 	eht_cap_elem->phy_cap_info[5] =
4146 		u8_encode_bits(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_20US,
4147 			       IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK);
4148 
4149 	eht_cap_elem->phy_cap_info[6] = 0;
4150 	eht_cap_elem->phy_cap_info[7] = 0;
4151 	eht_cap_elem->phy_cap_info[8] = 0;
4152 
4153 	val = u8_encode_bits(hal->rx_nss, IEEE80211_EHT_MCS_NSS_RX) |
4154 	      u8_encode_bits(hal->tx_nss, IEEE80211_EHT_MCS_NSS_TX);
4155 	eht_nss->bw._80.rx_tx_mcs9_max_nss = val;
4156 	eht_nss->bw._80.rx_tx_mcs11_max_nss = val;
4157 	eht_nss->bw._80.rx_tx_mcs13_max_nss = val;
4158 	eht_nss->bw._160.rx_tx_mcs9_max_nss = val;
4159 	eht_nss->bw._160.rx_tx_mcs11_max_nss = val;
4160 	eht_nss->bw._160.rx_tx_mcs13_max_nss = val;
4161 	if (support_320mhz) {
4162 		eht_nss->bw._320.rx_tx_mcs9_max_nss = val;
4163 		eht_nss->bw._320.rx_tx_mcs11_max_nss = val;
4164 		eht_nss->bw._320.rx_tx_mcs13_max_nss = val;
4165 	}
4166 }
4167 
4168 #define RTW89_SBAND_IFTYPES_NR 2
4169 
4170 static void rtw89_init_he_eht_cap(struct rtw89_dev *rtwdev,
4171 				  enum nl80211_band band,
4172 				  struct ieee80211_supported_band *sband)
4173 {
4174 	struct ieee80211_sband_iftype_data *iftype_data;
4175 	enum nl80211_iftype iftype;
4176 	int idx = 0;
4177 
4178 	iftype_data = kcalloc(RTW89_SBAND_IFTYPES_NR, sizeof(*iftype_data), GFP_KERNEL);
4179 	if (!iftype_data)
4180 		return;
4181 
4182 	for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
4183 		switch (iftype) {
4184 		case NL80211_IFTYPE_STATION:
4185 		case NL80211_IFTYPE_AP:
4186 			break;
4187 		default:
4188 			continue;
4189 		}
4190 
4191 		if (idx >= RTW89_SBAND_IFTYPES_NR) {
4192 			rtw89_warn(rtwdev, "run out of iftype_data\n");
4193 			break;
4194 		}
4195 
4196 		iftype_data[idx].types_mask = BIT(iftype);
4197 
4198 		rtw89_init_he_cap(rtwdev, band, iftype, &iftype_data[idx]);
4199 		rtw89_init_eht_cap(rtwdev, band, iftype, &iftype_data[idx]);
4200 
4201 		idx++;
4202 	}
4203 
4204 	_ieee80211_set_sband_iftype_data(sband, iftype_data, idx);
4205 }
4206 
4207 static int rtw89_core_set_supported_band(struct rtw89_dev *rtwdev)
4208 {
4209 	struct ieee80211_hw *hw = rtwdev->hw;
4210 	struct ieee80211_supported_band *sband_2ghz = NULL, *sband_5ghz = NULL;
4211 	struct ieee80211_supported_band *sband_6ghz = NULL;
4212 	u32 size = sizeof(struct ieee80211_supported_band);
4213 	u8 support_bands = rtwdev->chip->support_bands;
4214 
4215 	if (support_bands & BIT(NL80211_BAND_2GHZ)) {
4216 		sband_2ghz = kmemdup(&rtw89_sband_2ghz, size, GFP_KERNEL);
4217 		if (!sband_2ghz)
4218 			goto err;
4219 		rtw89_init_ht_cap(rtwdev, &sband_2ghz->ht_cap);
4220 		rtw89_init_he_eht_cap(rtwdev, NL80211_BAND_2GHZ, sband_2ghz);
4221 		hw->wiphy->bands[NL80211_BAND_2GHZ] = sband_2ghz;
4222 	}
4223 
4224 	if (support_bands & BIT(NL80211_BAND_5GHZ)) {
4225 		sband_5ghz = kmemdup(&rtw89_sband_5ghz, size, GFP_KERNEL);
4226 		if (!sband_5ghz)
4227 			goto err;
4228 		rtw89_init_ht_cap(rtwdev, &sband_5ghz->ht_cap);
4229 		rtw89_init_vht_cap(rtwdev, &sband_5ghz->vht_cap);
4230 		rtw89_init_he_eht_cap(rtwdev, NL80211_BAND_5GHZ, sband_5ghz);
4231 		hw->wiphy->bands[NL80211_BAND_5GHZ] = sband_5ghz;
4232 	}
4233 
4234 	if (support_bands & BIT(NL80211_BAND_6GHZ)) {
4235 		sband_6ghz = kmemdup(&rtw89_sband_6ghz, size, GFP_KERNEL);
4236 		if (!sband_6ghz)
4237 			goto err;
4238 		rtw89_init_he_eht_cap(rtwdev, NL80211_BAND_6GHZ, sband_6ghz);
4239 		hw->wiphy->bands[NL80211_BAND_6GHZ] = sband_6ghz;
4240 	}
4241 
4242 	return 0;
4243 
4244 err:
4245 	hw->wiphy->bands[NL80211_BAND_2GHZ] = NULL;
4246 	hw->wiphy->bands[NL80211_BAND_5GHZ] = NULL;
4247 	hw->wiphy->bands[NL80211_BAND_6GHZ] = NULL;
4248 	if (sband_2ghz)
4249 		kfree((__force void *)sband_2ghz->iftype_data);
4250 	if (sband_5ghz)
4251 		kfree((__force void *)sband_5ghz->iftype_data);
4252 	if (sband_6ghz)
4253 		kfree((__force void *)sband_6ghz->iftype_data);
4254 	kfree(sband_2ghz);
4255 	kfree(sband_5ghz);
4256 	kfree(sband_6ghz);
4257 	return -ENOMEM;
4258 }
4259 
4260 static void rtw89_core_clr_supported_band(struct rtw89_dev *rtwdev)
4261 {
4262 	struct ieee80211_hw *hw = rtwdev->hw;
4263 
4264 	if (hw->wiphy->bands[NL80211_BAND_2GHZ])
4265 		kfree((__force void *)hw->wiphy->bands[NL80211_BAND_2GHZ]->iftype_data);
4266 	if (hw->wiphy->bands[NL80211_BAND_5GHZ])
4267 		kfree((__force void *)hw->wiphy->bands[NL80211_BAND_5GHZ]->iftype_data);
4268 	if (hw->wiphy->bands[NL80211_BAND_6GHZ])
4269 		kfree((__force void *)hw->wiphy->bands[NL80211_BAND_6GHZ]->iftype_data);
4270 	kfree(hw->wiphy->bands[NL80211_BAND_2GHZ]);
4271 	kfree(hw->wiphy->bands[NL80211_BAND_5GHZ]);
4272 	kfree(hw->wiphy->bands[NL80211_BAND_6GHZ]);
4273 	hw->wiphy->bands[NL80211_BAND_2GHZ] = NULL;
4274 	hw->wiphy->bands[NL80211_BAND_5GHZ] = NULL;
4275 	hw->wiphy->bands[NL80211_BAND_6GHZ] = NULL;
4276 }
4277 
4278 static void rtw89_core_ppdu_sts_init(struct rtw89_dev *rtwdev)
4279 {
4280 	int i;
4281 
4282 	for (i = 0; i < RTW89_PHY_MAX; i++)
4283 		skb_queue_head_init(&rtwdev->ppdu_sts.rx_queue[i]);
4284 	for (i = 0; i < RTW89_PHY_MAX; i++)
4285 		rtwdev->ppdu_sts.curr_rx_ppdu_cnt[i] = U8_MAX;
4286 }
4287 
4288 void rtw89_core_update_beacon_work(struct work_struct *work)
4289 {
4290 	struct rtw89_dev *rtwdev;
4291 	struct rtw89_vif_link *rtwvif_link = container_of(work, struct rtw89_vif_link,
4292 							  update_beacon_work);
4293 
4294 	if (rtwvif_link->net_type != RTW89_NET_TYPE_AP_MODE)
4295 		return;
4296 
4297 	rtwdev = rtwvif_link->rtwvif->rtwdev;
4298 
4299 	mutex_lock(&rtwdev->mutex);
4300 	rtw89_chip_h2c_update_beacon(rtwdev, rtwvif_link);
4301 	mutex_unlock(&rtwdev->mutex);
4302 }
4303 
4304 int rtw89_wait_for_cond(struct rtw89_wait_info *wait, unsigned int cond)
4305 {
4306 	struct completion *cmpl = &wait->completion;
4307 	unsigned long time_left;
4308 	unsigned int cur;
4309 
4310 	cur = atomic_cmpxchg(&wait->cond, RTW89_WAIT_COND_IDLE, cond);
4311 	if (cur != RTW89_WAIT_COND_IDLE)
4312 		return -EBUSY;
4313 
4314 	time_left = wait_for_completion_timeout(cmpl, RTW89_WAIT_FOR_COND_TIMEOUT);
4315 	if (time_left == 0) {
4316 		atomic_set(&wait->cond, RTW89_WAIT_COND_IDLE);
4317 		return -ETIMEDOUT;
4318 	}
4319 
4320 	if (wait->data.err)
4321 		return -EFAULT;
4322 
4323 	return 0;
4324 }
4325 
4326 void rtw89_complete_cond(struct rtw89_wait_info *wait, unsigned int cond,
4327 			 const struct rtw89_completion_data *data)
4328 {
4329 	unsigned int cur;
4330 
4331 	cur = atomic_cmpxchg(&wait->cond, cond, RTW89_WAIT_COND_IDLE);
4332 	if (cur != cond)
4333 		return;
4334 
4335 	wait->data = *data;
4336 	complete(&wait->completion);
4337 }
4338 
4339 void rtw89_core_ntfy_btc_event(struct rtw89_dev *rtwdev, enum rtw89_btc_hmsg event)
4340 {
4341 	u16 bt_req_len;
4342 
4343 	switch (event) {
4344 	case RTW89_BTC_HMSG_SET_BT_REQ_SLOT:
4345 		bt_req_len = rtw89_coex_query_bt_req_len(rtwdev, RTW89_PHY_0);
4346 		rtw89_debug(rtwdev, RTW89_DBG_BTC,
4347 			    "coex updates BT req len to %d TU\n", bt_req_len);
4348 		rtw89_queue_chanctx_change(rtwdev, RTW89_CHANCTX_BT_SLOT_CHANGE);
4349 		break;
4350 	default:
4351 		if (event < NUM_OF_RTW89_BTC_HMSG)
4352 			rtw89_debug(rtwdev, RTW89_DBG_BTC,
4353 				    "unhandled BTC HMSG event: %d\n", event);
4354 		else
4355 			rtw89_warn(rtwdev,
4356 				   "unrecognized BTC HMSG event: %d\n", event);
4357 		break;
4358 	}
4359 }
4360 
4361 void rtw89_check_quirks(struct rtw89_dev *rtwdev, const struct dmi_system_id *quirks)
4362 {
4363 	const struct dmi_system_id *match;
4364 	enum rtw89_quirks quirk;
4365 
4366 	if (!quirks)
4367 		return;
4368 
4369 	for (match = dmi_first_match(quirks); match; match = dmi_first_match(match + 1)) {
4370 		quirk = (uintptr_t)match->driver_data;
4371 		if (quirk >= NUM_OF_RTW89_QUIRKS)
4372 			continue;
4373 
4374 		set_bit(quirk, rtwdev->quirks);
4375 	}
4376 }
4377 EXPORT_SYMBOL(rtw89_check_quirks);
4378 
4379 int rtw89_core_start(struct rtw89_dev *rtwdev)
4380 {
4381 	int ret;
4382 
4383 	ret = rtw89_mac_init(rtwdev);
4384 	if (ret) {
4385 		rtw89_err(rtwdev, "mac init fail, ret:%d\n", ret);
4386 		return ret;
4387 	}
4388 
4389 	rtw89_btc_ntfy_poweron(rtwdev);
4390 
4391 	/* efuse process */
4392 
4393 	/* pre-config BB/RF, BB reset/RFC reset */
4394 	ret = rtw89_chip_reset_bb_rf(rtwdev);
4395 	if (ret)
4396 		return ret;
4397 
4398 	rtw89_phy_init_bb_reg(rtwdev);
4399 	rtw89_chip_bb_postinit(rtwdev);
4400 	rtw89_phy_init_rf_reg(rtwdev, false);
4401 
4402 	rtw89_btc_ntfy_init(rtwdev, BTC_MODE_NORMAL);
4403 
4404 	rtw89_phy_dm_init(rtwdev);
4405 
4406 	rtw89_mac_cfg_ppdu_status_bands(rtwdev, true);
4407 	rtw89_mac_update_rts_threshold(rtwdev);
4408 
4409 	rtw89_tas_reset(rtwdev);
4410 
4411 	ret = rtw89_hci_start(rtwdev);
4412 	if (ret) {
4413 		rtw89_err(rtwdev, "failed to start hci\n");
4414 		return ret;
4415 	}
4416 
4417 	ieee80211_queue_delayed_work(rtwdev->hw, &rtwdev->track_work,
4418 				     RTW89_TRACK_WORK_PERIOD);
4419 
4420 	set_bit(RTW89_FLAG_RUNNING, rtwdev->flags);
4421 
4422 	rtw89_chip_rfk_init_late(rtwdev);
4423 	rtw89_btc_ntfy_radio_state(rtwdev, BTC_RFCTRL_WL_ON);
4424 	rtw89_fw_h2c_fw_log(rtwdev, rtwdev->fw.log.enable);
4425 	rtw89_fw_h2c_init_ba_cam(rtwdev);
4426 
4427 	return 0;
4428 }
4429 
4430 void rtw89_core_stop(struct rtw89_dev *rtwdev)
4431 {
4432 	struct rtw89_btc *btc = &rtwdev->btc;
4433 
4434 	/* Prvent to stop twice; enter_ips and ops_stop */
4435 	if (!test_bit(RTW89_FLAG_RUNNING, rtwdev->flags))
4436 		return;
4437 
4438 	rtw89_btc_ntfy_radio_state(rtwdev, BTC_RFCTRL_WL_OFF);
4439 
4440 	clear_bit(RTW89_FLAG_RUNNING, rtwdev->flags);
4441 
4442 	mutex_unlock(&rtwdev->mutex);
4443 
4444 	cancel_work_sync(&rtwdev->c2h_work);
4445 	cancel_work_sync(&rtwdev->cancel_6ghz_probe_work);
4446 	cancel_work_sync(&btc->eapol_notify_work);
4447 	cancel_work_sync(&btc->arp_notify_work);
4448 	cancel_work_sync(&btc->dhcp_notify_work);
4449 	cancel_work_sync(&btc->icmp_notify_work);
4450 	cancel_delayed_work_sync(&rtwdev->txq_reinvoke_work);
4451 	cancel_delayed_work_sync(&rtwdev->track_work);
4452 	cancel_delayed_work_sync(&rtwdev->chanctx_work);
4453 	cancel_delayed_work_sync(&rtwdev->coex_act1_work);
4454 	cancel_delayed_work_sync(&rtwdev->coex_bt_devinfo_work);
4455 	cancel_delayed_work_sync(&rtwdev->coex_rfk_chk_work);
4456 	cancel_delayed_work_sync(&rtwdev->cfo_track_work);
4457 	cancel_delayed_work_sync(&rtwdev->forbid_ba_work);
4458 	cancel_delayed_work_sync(&rtwdev->antdiv_work);
4459 
4460 	mutex_lock(&rtwdev->mutex);
4461 
4462 	rtw89_btc_ntfy_poweroff(rtwdev);
4463 	rtw89_hci_flush_queues(rtwdev, BIT(rtwdev->hw->queues) - 1, true);
4464 	rtw89_mac_flush_txq(rtwdev, BIT(rtwdev->hw->queues) - 1, true);
4465 	rtw89_hci_stop(rtwdev);
4466 	rtw89_hci_deinit(rtwdev);
4467 	rtw89_mac_pwr_off(rtwdev);
4468 	rtw89_hci_reset(rtwdev);
4469 }
4470 
4471 u8 rtw89_acquire_mac_id(struct rtw89_dev *rtwdev)
4472 {
4473 	const struct rtw89_chip_info *chip = rtwdev->chip;
4474 	u8 mac_id_num;
4475 	u8 mac_id;
4476 
4477 	if (rtwdev->support_mlo)
4478 		mac_id_num = chip->support_macid_num / chip->support_link_num;
4479 	else
4480 		mac_id_num = chip->support_macid_num;
4481 
4482 	mac_id = find_first_zero_bit(rtwdev->mac_id_map, mac_id_num);
4483 	if (mac_id == mac_id_num)
4484 		return RTW89_MAX_MAC_ID_NUM;
4485 
4486 	set_bit(mac_id, rtwdev->mac_id_map);
4487 	return mac_id;
4488 }
4489 
4490 void rtw89_release_mac_id(struct rtw89_dev *rtwdev, u8 mac_id)
4491 {
4492 	clear_bit(mac_id, rtwdev->mac_id_map);
4493 }
4494 
4495 void rtw89_init_vif(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif,
4496 		    u8 mac_id, u8 port)
4497 {
4498 	const struct rtw89_chip_info *chip = rtwdev->chip;
4499 	u8 support_link_num = chip->support_link_num;
4500 	u8 support_mld_num = 0;
4501 	unsigned int link_id;
4502 	u8 index;
4503 
4504 	bitmap_zero(rtwvif->links_inst_map, __RTW89_MLD_MAX_LINK_NUM);
4505 	for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++)
4506 		rtwvif->links[link_id] = NULL;
4507 
4508 	rtwvif->rtwdev = rtwdev;
4509 
4510 	if (rtwdev->support_mlo) {
4511 		rtwvif->links_inst_valid_num = support_link_num;
4512 		support_mld_num = chip->support_macid_num / support_link_num;
4513 	} else {
4514 		rtwvif->links_inst_valid_num = 1;
4515 	}
4516 
4517 	for (index = 0; index < rtwvif->links_inst_valid_num; index++) {
4518 		struct rtw89_vif_link *inst = &rtwvif->links_inst[index];
4519 
4520 		inst->rtwvif = rtwvif;
4521 		inst->mac_id = mac_id + index * support_mld_num;
4522 		inst->mac_idx = RTW89_MAC_0 + index;
4523 		inst->phy_idx = RTW89_PHY_0 + index;
4524 
4525 		/* multi-link use the same port id on different HW bands */
4526 		inst->port = port;
4527 	}
4528 }
4529 
4530 void rtw89_init_sta(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif,
4531 		    struct rtw89_sta *rtwsta, u8 mac_id)
4532 {
4533 	const struct rtw89_chip_info *chip = rtwdev->chip;
4534 	u8 support_link_num = chip->support_link_num;
4535 	u8 support_mld_num = 0;
4536 	unsigned int link_id;
4537 	u8 index;
4538 
4539 	bitmap_zero(rtwsta->links_inst_map, __RTW89_MLD_MAX_LINK_NUM);
4540 	for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++)
4541 		rtwsta->links[link_id] = NULL;
4542 
4543 	rtwsta->rtwdev = rtwdev;
4544 	rtwsta->rtwvif = rtwvif;
4545 
4546 	if (rtwdev->support_mlo) {
4547 		rtwsta->links_inst_valid_num = support_link_num;
4548 		support_mld_num = chip->support_macid_num / support_link_num;
4549 	} else {
4550 		rtwsta->links_inst_valid_num = 1;
4551 	}
4552 
4553 	for (index = 0; index < rtwsta->links_inst_valid_num; index++) {
4554 		struct rtw89_sta_link *inst = &rtwsta->links_inst[index];
4555 
4556 		inst->rtwvif_link = &rtwvif->links_inst[index];
4557 
4558 		inst->rtwsta = rtwsta;
4559 		inst->mac_id = mac_id + index * support_mld_num;
4560 	}
4561 }
4562 
4563 struct rtw89_vif_link *rtw89_vif_set_link(struct rtw89_vif *rtwvif,
4564 					  unsigned int link_id)
4565 {
4566 	struct rtw89_vif_link *rtwvif_link = rtwvif->links[link_id];
4567 	u8 index;
4568 	int ret;
4569 
4570 	if (rtwvif_link)
4571 		return rtwvif_link;
4572 
4573 	index = find_first_zero_bit(rtwvif->links_inst_map,
4574 				    rtwvif->links_inst_valid_num);
4575 	if (index == rtwvif->links_inst_valid_num) {
4576 		ret = -EBUSY;
4577 		goto err;
4578 	}
4579 
4580 	rtwvif_link = &rtwvif->links_inst[index];
4581 	rtwvif_link->link_id = link_id;
4582 
4583 	set_bit(index, rtwvif->links_inst_map);
4584 	rtwvif->links[link_id] = rtwvif_link;
4585 	return rtwvif_link;
4586 
4587 err:
4588 	rtw89_err(rtwvif->rtwdev, "vif (link_id %u) failed to set link: %d\n",
4589 		  link_id, ret);
4590 	return NULL;
4591 }
4592 
4593 void rtw89_vif_unset_link(struct rtw89_vif *rtwvif, unsigned int link_id)
4594 {
4595 	struct rtw89_vif_link **container = &rtwvif->links[link_id];
4596 	struct rtw89_vif_link *link = *container;
4597 	u8 index;
4598 
4599 	if (!link)
4600 		return;
4601 
4602 	index = rtw89_vif_link_inst_get_index(link);
4603 	clear_bit(index, rtwvif->links_inst_map);
4604 	*container = NULL;
4605 }
4606 
4607 struct rtw89_sta_link *rtw89_sta_set_link(struct rtw89_sta *rtwsta,
4608 					  unsigned int link_id)
4609 {
4610 	struct rtw89_vif *rtwvif = rtwsta->rtwvif;
4611 	struct rtw89_vif_link *rtwvif_link = rtwvif->links[link_id];
4612 	struct rtw89_sta_link *rtwsta_link = rtwsta->links[link_id];
4613 	u8 index;
4614 	int ret;
4615 
4616 	if (rtwsta_link)
4617 		return rtwsta_link;
4618 
4619 	if (!rtwvif_link) {
4620 		ret = -ENOLINK;
4621 		goto err;
4622 	}
4623 
4624 	index = rtw89_vif_link_inst_get_index(rtwvif_link);
4625 	if (test_bit(index, rtwsta->links_inst_map)) {
4626 		ret = -EBUSY;
4627 		goto err;
4628 	}
4629 
4630 	rtwsta_link = &rtwsta->links_inst[index];
4631 	rtwsta_link->link_id = link_id;
4632 
4633 	set_bit(index, rtwsta->links_inst_map);
4634 	rtwsta->links[link_id] = rtwsta_link;
4635 	return rtwsta_link;
4636 
4637 err:
4638 	rtw89_err(rtwsta->rtwdev, "sta (link_id %u) failed to set link: %d\n",
4639 		  link_id, ret);
4640 	return NULL;
4641 }
4642 
4643 void rtw89_sta_unset_link(struct rtw89_sta *rtwsta, unsigned int link_id)
4644 {
4645 	struct rtw89_sta_link **container = &rtwsta->links[link_id];
4646 	struct rtw89_sta_link *link = *container;
4647 	u8 index;
4648 
4649 	if (!link)
4650 		return;
4651 
4652 	index = rtw89_sta_link_inst_get_index(link);
4653 	clear_bit(index, rtwsta->links_inst_map);
4654 	*container = NULL;
4655 }
4656 
4657 int rtw89_core_init(struct rtw89_dev *rtwdev)
4658 {
4659 	struct rtw89_btc *btc = &rtwdev->btc;
4660 	u8 band;
4661 
4662 	INIT_LIST_HEAD(&rtwdev->ba_list);
4663 	INIT_LIST_HEAD(&rtwdev->forbid_ba_list);
4664 	INIT_LIST_HEAD(&rtwdev->rtwvifs_list);
4665 	INIT_LIST_HEAD(&rtwdev->early_h2c_list);
4666 	for (band = NL80211_BAND_2GHZ; band < NUM_NL80211_BANDS; band++) {
4667 		if (!(rtwdev->chip->support_bands & BIT(band)))
4668 			continue;
4669 		INIT_LIST_HEAD(&rtwdev->scan_info.pkt_list[band]);
4670 	}
4671 	INIT_WORK(&rtwdev->ba_work, rtw89_core_ba_work);
4672 	INIT_WORK(&rtwdev->txq_work, rtw89_core_txq_work);
4673 	INIT_DELAYED_WORK(&rtwdev->txq_reinvoke_work, rtw89_core_txq_reinvoke_work);
4674 	INIT_DELAYED_WORK(&rtwdev->track_work, rtw89_track_work);
4675 	INIT_DELAYED_WORK(&rtwdev->chanctx_work, rtw89_chanctx_work);
4676 	INIT_DELAYED_WORK(&rtwdev->coex_act1_work, rtw89_coex_act1_work);
4677 	INIT_DELAYED_WORK(&rtwdev->coex_bt_devinfo_work, rtw89_coex_bt_devinfo_work);
4678 	INIT_DELAYED_WORK(&rtwdev->coex_rfk_chk_work, rtw89_coex_rfk_chk_work);
4679 	INIT_DELAYED_WORK(&rtwdev->cfo_track_work, rtw89_phy_cfo_track_work);
4680 	INIT_DELAYED_WORK(&rtwdev->forbid_ba_work, rtw89_forbid_ba_work);
4681 	INIT_DELAYED_WORK(&rtwdev->antdiv_work, rtw89_phy_antdiv_work);
4682 	rtwdev->txq_wq = alloc_workqueue("rtw89_tx_wq", WQ_UNBOUND | WQ_HIGHPRI, 0);
4683 	if (!rtwdev->txq_wq)
4684 		return -ENOMEM;
4685 	spin_lock_init(&rtwdev->ba_lock);
4686 	spin_lock_init(&rtwdev->rpwm_lock);
4687 	mutex_init(&rtwdev->mutex);
4688 	mutex_init(&rtwdev->rf_mutex);
4689 	rtwdev->total_sta_assoc = 0;
4690 
4691 	rtw89_init_wait(&rtwdev->mcc.wait);
4692 	rtw89_init_wait(&rtwdev->mac.fw_ofld_wait);
4693 	rtw89_init_wait(&rtwdev->wow.wait);
4694 	rtw89_init_wait(&rtwdev->mac.ps_wait);
4695 
4696 	INIT_WORK(&rtwdev->c2h_work, rtw89_fw_c2h_work);
4697 	INIT_WORK(&rtwdev->ips_work, rtw89_ips_work);
4698 	INIT_WORK(&rtwdev->load_firmware_work, rtw89_load_firmware_work);
4699 	INIT_WORK(&rtwdev->cancel_6ghz_probe_work, rtw89_cancel_6ghz_probe_work);
4700 
4701 	skb_queue_head_init(&rtwdev->c2h_queue);
4702 	rtw89_core_ppdu_sts_init(rtwdev);
4703 	rtw89_traffic_stats_init(rtwdev, &rtwdev->stats);
4704 
4705 	rtwdev->hal.rx_fltr = DEFAULT_AX_RX_FLTR;
4706 	rtwdev->dbcc_en = false;
4707 	rtwdev->mlo_dbcc_mode = MLO_DBCC_NOT_SUPPORT;
4708 	rtwdev->mac.qta_mode = RTW89_QTA_SCC;
4709 
4710 	if (rtwdev->chip->chip_gen == RTW89_CHIP_BE) {
4711 		rtwdev->dbcc_en = true;
4712 		rtwdev->mac.qta_mode = RTW89_QTA_DBCC;
4713 		rtwdev->mlo_dbcc_mode = MLO_2_PLUS_0_1RF;
4714 	}
4715 
4716 	INIT_WORK(&btc->eapol_notify_work, rtw89_btc_ntfy_eapol_packet_work);
4717 	INIT_WORK(&btc->arp_notify_work, rtw89_btc_ntfy_arp_packet_work);
4718 	INIT_WORK(&btc->dhcp_notify_work, rtw89_btc_ntfy_dhcp_packet_work);
4719 	INIT_WORK(&btc->icmp_notify_work, rtw89_btc_ntfy_icmp_packet_work);
4720 
4721 	init_completion(&rtwdev->fw.req.completion);
4722 	init_completion(&rtwdev->rfk_wait.completion);
4723 
4724 	schedule_work(&rtwdev->load_firmware_work);
4725 
4726 	rtw89_ser_init(rtwdev);
4727 	rtw89_entity_init(rtwdev);
4728 	rtw89_tas_init(rtwdev);
4729 
4730 	return 0;
4731 }
4732 EXPORT_SYMBOL(rtw89_core_init);
4733 
4734 void rtw89_core_deinit(struct rtw89_dev *rtwdev)
4735 {
4736 	rtw89_ser_deinit(rtwdev);
4737 	rtw89_unload_firmware(rtwdev);
4738 	rtw89_fw_free_all_early_h2c(rtwdev);
4739 
4740 	destroy_workqueue(rtwdev->txq_wq);
4741 	mutex_destroy(&rtwdev->rf_mutex);
4742 	mutex_destroy(&rtwdev->mutex);
4743 }
4744 EXPORT_SYMBOL(rtw89_core_deinit);
4745 
4746 void rtw89_core_scan_start(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link,
4747 			   const u8 *mac_addr, bool hw_scan)
4748 {
4749 	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev,
4750 						       rtwvif_link->chanctx_idx);
4751 
4752 	rtwdev->scanning = true;
4753 	rtw89_leave_lps(rtwdev);
4754 	if (hw_scan)
4755 		rtw89_leave_ips_by_hwflags(rtwdev);
4756 
4757 	ether_addr_copy(rtwvif_link->mac_addr, mac_addr);
4758 	rtw89_btc_ntfy_scan_start(rtwdev, rtwvif_link->phy_idx, chan->band_type);
4759 	rtw89_chip_rfk_scan(rtwdev, rtwvif_link, true);
4760 	rtw89_hci_recalc_int_mit(rtwdev);
4761 	rtw89_phy_config_edcca(rtwdev, true);
4762 
4763 	rtw89_fw_h2c_cam(rtwdev, rtwvif_link, NULL, mac_addr);
4764 }
4765 
4766 void rtw89_core_scan_complete(struct rtw89_dev *rtwdev,
4767 			      struct rtw89_vif_link *rtwvif_link, bool hw_scan)
4768 {
4769 	struct ieee80211_bss_conf *bss_conf;
4770 
4771 	if (!rtwvif_link)
4772 		return;
4773 
4774 	rcu_read_lock();
4775 
4776 	bss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, true);
4777 	ether_addr_copy(rtwvif_link->mac_addr, bss_conf->addr);
4778 
4779 	rcu_read_unlock();
4780 
4781 	rtw89_fw_h2c_cam(rtwdev, rtwvif_link, NULL, NULL);
4782 
4783 	rtw89_chip_rfk_scan(rtwdev, rtwvif_link, false);
4784 	rtw89_btc_ntfy_scan_finish(rtwdev, rtwvif_link->phy_idx);
4785 	rtw89_phy_config_edcca(rtwdev, false);
4786 
4787 	rtwdev->scanning = false;
4788 	rtwdev->dig.bypass_dig = true;
4789 	if (hw_scan && (rtwdev->hw->conf.flags & IEEE80211_CONF_IDLE))
4790 		ieee80211_queue_work(rtwdev->hw, &rtwdev->ips_work);
4791 }
4792 
4793 static void rtw89_read_chip_ver(struct rtw89_dev *rtwdev)
4794 {
4795 	const struct rtw89_chip_info *chip = rtwdev->chip;
4796 	int ret;
4797 	u8 val;
4798 	u8 cv;
4799 
4800 	cv = rtw89_read32_mask(rtwdev, R_AX_SYS_CFG1, B_AX_CHIP_VER_MASK);
4801 	if (chip->chip_id == RTL8852A && cv <= CHIP_CBV) {
4802 		if (rtw89_read32(rtwdev, R_AX_GPIO0_7_FUNC_SEL) == RTW89_R32_DEAD)
4803 			cv = CHIP_CAV;
4804 		else
4805 			cv = CHIP_CBV;
4806 	}
4807 
4808 	rtwdev->hal.cv = cv;
4809 
4810 	if (rtw89_is_rtl885xb(rtwdev)) {
4811 		ret = rtw89_mac_read_xtal_si(rtwdev, XTAL_SI_CV, &val);
4812 		if (ret)
4813 			return;
4814 
4815 		rtwdev->hal.acv = u8_get_bits(val, XTAL_SI_ACV_MASK);
4816 	}
4817 }
4818 
4819 static void rtw89_core_setup_phycap(struct rtw89_dev *rtwdev)
4820 {
4821 	rtwdev->hal.support_cckpd =
4822 		!(rtwdev->chip->chip_id == RTL8852A && rtwdev->hal.cv <= CHIP_CBV) &&
4823 		!(rtwdev->chip->chip_id == RTL8852B && rtwdev->hal.cv <= CHIP_CAV);
4824 	rtwdev->hal.support_igi =
4825 		rtwdev->chip->chip_id == RTL8852A && rtwdev->hal.cv <= CHIP_CBV;
4826 }
4827 
4828 static void rtw89_core_setup_rfe_parms(struct rtw89_dev *rtwdev)
4829 {
4830 	const struct rtw89_chip_info *chip = rtwdev->chip;
4831 	const struct rtw89_rfe_parms_conf *conf = chip->rfe_parms_conf;
4832 	struct rtw89_efuse *efuse = &rtwdev->efuse;
4833 	const struct rtw89_rfe_parms *sel;
4834 	u8 rfe_type = efuse->rfe_type;
4835 
4836 	if (!conf) {
4837 		sel = chip->dflt_parms;
4838 		goto out;
4839 	}
4840 
4841 	while (conf->rfe_parms) {
4842 		if (rfe_type == conf->rfe_type) {
4843 			sel = conf->rfe_parms;
4844 			goto out;
4845 		}
4846 		conf++;
4847 	}
4848 
4849 	sel = chip->dflt_parms;
4850 
4851 out:
4852 	rtwdev->rfe_parms = rtw89_load_rfe_data_from_fw(rtwdev, sel);
4853 	rtw89_load_txpwr_table(rtwdev, rtwdev->rfe_parms->byr_tbl);
4854 }
4855 
4856 static int rtw89_chip_efuse_info_setup(struct rtw89_dev *rtwdev)
4857 {
4858 	const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;
4859 	int ret;
4860 
4861 	ret = rtw89_mac_partial_init(rtwdev, false);
4862 	if (ret)
4863 		return ret;
4864 
4865 	ret = mac->parse_efuse_map(rtwdev);
4866 	if (ret)
4867 		return ret;
4868 
4869 	ret = mac->parse_phycap_map(rtwdev);
4870 	if (ret)
4871 		return ret;
4872 
4873 	ret = rtw89_mac_setup_phycap(rtwdev);
4874 	if (ret)
4875 		return ret;
4876 
4877 	rtw89_core_setup_phycap(rtwdev);
4878 
4879 	rtw89_hci_mac_pre_deinit(rtwdev);
4880 
4881 	rtw89_mac_pwr_off(rtwdev);
4882 
4883 	return 0;
4884 }
4885 
4886 static int rtw89_chip_board_info_setup(struct rtw89_dev *rtwdev)
4887 {
4888 	rtw89_chip_fem_setup(rtwdev);
4889 
4890 	return 0;
4891 }
4892 
4893 static bool rtw89_chip_has_rfkill(struct rtw89_dev *rtwdev)
4894 {
4895 	return !!rtwdev->chip->rfkill_init;
4896 }
4897 
4898 static void rtw89_core_rfkill_init(struct rtw89_dev *rtwdev)
4899 {
4900 	const struct rtw89_rfkill_regs *regs = rtwdev->chip->rfkill_init;
4901 
4902 	rtw89_write16_mask(rtwdev, regs->pinmux.addr,
4903 			   regs->pinmux.mask, regs->pinmux.data);
4904 	rtw89_write16_mask(rtwdev, regs->mode.addr,
4905 			   regs->mode.mask, regs->mode.data);
4906 }
4907 
4908 static bool rtw89_core_rfkill_get(struct rtw89_dev *rtwdev)
4909 {
4910 	const struct rtw89_reg_def *reg = &rtwdev->chip->rfkill_get;
4911 
4912 	return !rtw89_read8_mask(rtwdev, reg->addr, reg->mask);
4913 }
4914 
4915 static void rtw89_rfkill_polling_init(struct rtw89_dev *rtwdev)
4916 {
4917 	if (!rtw89_chip_has_rfkill(rtwdev))
4918 		return;
4919 
4920 	rtw89_core_rfkill_init(rtwdev);
4921 	rtw89_core_rfkill_poll(rtwdev, true);
4922 	wiphy_rfkill_start_polling(rtwdev->hw->wiphy);
4923 }
4924 
4925 static void rtw89_rfkill_polling_deinit(struct rtw89_dev *rtwdev)
4926 {
4927 	if (!rtw89_chip_has_rfkill(rtwdev))
4928 		return;
4929 
4930 	wiphy_rfkill_stop_polling(rtwdev->hw->wiphy);
4931 }
4932 
4933 void rtw89_core_rfkill_poll(struct rtw89_dev *rtwdev, bool force)
4934 {
4935 	bool prev, blocked;
4936 
4937 	if (!rtw89_chip_has_rfkill(rtwdev))
4938 		return;
4939 
4940 	prev = test_bit(RTW89_FLAG_HW_RFKILL_STATE, rtwdev->flags);
4941 	blocked = rtw89_core_rfkill_get(rtwdev);
4942 
4943 	if (!force && prev == blocked)
4944 		return;
4945 
4946 	rtw89_info(rtwdev, "rfkill hardware state changed to %s\n",
4947 		   blocked ? "disable" : "enable");
4948 
4949 	if (blocked)
4950 		set_bit(RTW89_FLAG_HW_RFKILL_STATE, rtwdev->flags);
4951 	else
4952 		clear_bit(RTW89_FLAG_HW_RFKILL_STATE, rtwdev->flags);
4953 
4954 	wiphy_rfkill_set_hw_state(rtwdev->hw->wiphy, blocked);
4955 }
4956 
4957 int rtw89_chip_info_setup(struct rtw89_dev *rtwdev)
4958 {
4959 	int ret;
4960 
4961 	rtw89_read_chip_ver(rtwdev);
4962 
4963 	ret = rtw89_wait_firmware_completion(rtwdev);
4964 	if (ret) {
4965 		rtw89_err(rtwdev, "failed to wait firmware completion\n");
4966 		return ret;
4967 	}
4968 
4969 	ret = rtw89_fw_recognize(rtwdev);
4970 	if (ret) {
4971 		rtw89_err(rtwdev, "failed to recognize firmware\n");
4972 		return ret;
4973 	}
4974 
4975 	ret = rtw89_chip_efuse_info_setup(rtwdev);
4976 	if (ret)
4977 		return ret;
4978 
4979 	ret = rtw89_fw_recognize_elements(rtwdev);
4980 	if (ret) {
4981 		rtw89_err(rtwdev, "failed to recognize firmware elements\n");
4982 		return ret;
4983 	}
4984 
4985 	ret = rtw89_chip_board_info_setup(rtwdev);
4986 	if (ret)
4987 		return ret;
4988 
4989 	rtw89_core_setup_rfe_parms(rtwdev);
4990 	rtwdev->ps_mode = rtw89_update_ps_mode(rtwdev);
4991 
4992 	return 0;
4993 }
4994 EXPORT_SYMBOL(rtw89_chip_info_setup);
4995 
4996 void rtw89_chip_cfg_txpwr_ul_tb_offset(struct rtw89_dev *rtwdev,
4997 				       struct rtw89_vif_link *rtwvif_link)
4998 {
4999 	struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
5000 	const struct rtw89_chip_info *chip = rtwdev->chip;
5001 	struct ieee80211_bss_conf *bss_conf;
5002 
5003 	rcu_read_lock();
5004 
5005 	bss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, false);
5006 	if (!bss_conf->he_support || !vif->cfg.assoc) {
5007 		rcu_read_unlock();
5008 		return;
5009 	}
5010 
5011 	rcu_read_unlock();
5012 
5013 	if (chip->ops->set_txpwr_ul_tb_offset)
5014 		chip->ops->set_txpwr_ul_tb_offset(rtwdev, 0, rtwvif_link->mac_idx);
5015 }
5016 
5017 static int rtw89_core_register_hw(struct rtw89_dev *rtwdev)
5018 {
5019 	const struct rtw89_chip_info *chip = rtwdev->chip;
5020 	u8 n = rtwdev->support_mlo ? chip->support_link_num : 1;
5021 	struct ieee80211_hw *hw = rtwdev->hw;
5022 	struct rtw89_efuse *efuse = &rtwdev->efuse;
5023 	struct rtw89_hal *hal = &rtwdev->hal;
5024 	int ret;
5025 	int tx_headroom = IEEE80211_HT_CTL_LEN;
5026 
5027 	hw->vif_data_size = struct_size_t(struct rtw89_vif, links_inst, n);
5028 	hw->sta_data_size = struct_size_t(struct rtw89_sta, links_inst, n);
5029 	hw->txq_data_size = sizeof(struct rtw89_txq);
5030 	hw->chanctx_data_size = sizeof(struct rtw89_chanctx_cfg);
5031 
5032 	SET_IEEE80211_PERM_ADDR(hw, efuse->addr);
5033 
5034 	hw->extra_tx_headroom = tx_headroom;
5035 	hw->queues = IEEE80211_NUM_ACS;
5036 	hw->max_rx_aggregation_subframes = RTW89_MAX_RX_AGG_NUM;
5037 	hw->max_tx_aggregation_subframes = RTW89_MAX_TX_AGG_NUM;
5038 	hw->uapsd_max_sp_len = IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL;
5039 
5040 	hw->radiotap_mcs_details |= IEEE80211_RADIOTAP_MCS_HAVE_FEC |
5041 				    IEEE80211_RADIOTAP_MCS_HAVE_STBC;
5042 	hw->radiotap_vht_details |= IEEE80211_RADIOTAP_VHT_KNOWN_STBC;
5043 
5044 	ieee80211_hw_set(hw, SIGNAL_DBM);
5045 	ieee80211_hw_set(hw, HAS_RATE_CONTROL);
5046 	ieee80211_hw_set(hw, MFP_CAPABLE);
5047 	ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
5048 	ieee80211_hw_set(hw, AMPDU_AGGREGATION);
5049 	ieee80211_hw_set(hw, RX_INCLUDES_FCS);
5050 	ieee80211_hw_set(hw, TX_AMSDU);
5051 	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
5052 	ieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);
5053 	ieee80211_hw_set(hw, SUPPORTS_PS);
5054 	ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
5055 	ieee80211_hw_set(hw, SINGLE_SCAN_ON_ALL_BANDS);
5056 	ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
5057 	ieee80211_hw_set(hw, WANT_MONITOR_VIF);
5058 
5059 	if (chip->support_bandwidths & BIT(NL80211_CHAN_WIDTH_160))
5060 		ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);
5061 
5062 	if (RTW89_CHK_FW_FEATURE(BEACON_FILTER, &rtwdev->fw))
5063 		ieee80211_hw_set(hw, CONNECTION_MONITOR);
5064 
5065 	hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
5066 				     BIT(NL80211_IFTYPE_AP) |
5067 				     BIT(NL80211_IFTYPE_P2P_CLIENT) |
5068 				     BIT(NL80211_IFTYPE_P2P_GO);
5069 
5070 	if (hal->ant_diversity) {
5071 		hw->wiphy->available_antennas_tx = 0x3;
5072 		hw->wiphy->available_antennas_rx = 0x3;
5073 	} else {
5074 		hw->wiphy->available_antennas_tx = BIT(rtwdev->chip->rf_path_num) - 1;
5075 		hw->wiphy->available_antennas_rx = BIT(rtwdev->chip->rf_path_num) - 1;
5076 	}
5077 
5078 	hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS |
5079 			    WIPHY_FLAG_TDLS_EXTERNAL_SETUP |
5080 			    WIPHY_FLAG_AP_UAPSD |
5081 			    WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK;
5082 
5083 	if (!chip->support_rnr)
5084 		hw->wiphy->flags |= WIPHY_FLAG_SPLIT_SCAN_6GHZ;
5085 
5086 	if (chip->chip_gen == RTW89_CHIP_BE)
5087 		hw->wiphy->flags |= WIPHY_FLAG_DISABLE_WEXT;
5088 
5089 	if (rtwdev->support_mlo)
5090 		hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_MLO;
5091 
5092 	hw->wiphy->features |= NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
5093 
5094 	hw->wiphy->max_scan_ssids = RTW89_SCANOFLD_MAX_SSID;
5095 	hw->wiphy->max_scan_ie_len = RTW89_SCANOFLD_MAX_IE_LEN;
5096 
5097 #ifdef CONFIG_PM
5098 	hw->wiphy->wowlan = rtwdev->chip->wowlan_stub;
5099 	hw->wiphy->max_sched_scan_ssids = RTW89_SCANOFLD_MAX_SSID;
5100 #endif
5101 
5102 	hw->wiphy->tid_config_support.vif |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
5103 	hw->wiphy->tid_config_support.peer |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
5104 	hw->wiphy->tid_config_support.vif |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
5105 	hw->wiphy->tid_config_support.peer |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
5106 	hw->wiphy->max_remain_on_channel_duration = 1000;
5107 
5108 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CAN_REPLACE_PTK0);
5109 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_SCAN_RANDOM_SN);
5110 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_SET_SCAN_DWELL);
5111 
5112 	ret = rtw89_core_set_supported_band(rtwdev);
5113 	if (ret) {
5114 		rtw89_err(rtwdev, "failed to set supported band\n");
5115 		return ret;
5116 	}
5117 
5118 	ret = rtw89_regd_setup(rtwdev);
5119 	if (ret) {
5120 		rtw89_err(rtwdev, "failed to set up regd\n");
5121 		goto err_free_supported_band;
5122 	}
5123 
5124 	hw->wiphy->sar_capa = &rtw89_sar_capa;
5125 
5126 	ret = ieee80211_register_hw(hw);
5127 	if (ret) {
5128 		rtw89_err(rtwdev, "failed to register hw\n");
5129 		goto err_free_supported_band;
5130 	}
5131 
5132 	ret = rtw89_regd_init(rtwdev, rtw89_regd_notifier);
5133 	if (ret) {
5134 		rtw89_err(rtwdev, "failed to init regd\n");
5135 		goto err_unregister_hw;
5136 	}
5137 
5138 	rtw89_rfkill_polling_init(rtwdev);
5139 
5140 	return 0;
5141 
5142 err_unregister_hw:
5143 	ieee80211_unregister_hw(hw);
5144 err_free_supported_band:
5145 	rtw89_core_clr_supported_band(rtwdev);
5146 
5147 	return ret;
5148 }
5149 
5150 static void rtw89_core_unregister_hw(struct rtw89_dev *rtwdev)
5151 {
5152 	struct ieee80211_hw *hw = rtwdev->hw;
5153 
5154 	rtw89_rfkill_polling_deinit(rtwdev);
5155 	ieee80211_unregister_hw(hw);
5156 	rtw89_core_clr_supported_band(rtwdev);
5157 }
5158 
5159 int rtw89_core_register(struct rtw89_dev *rtwdev)
5160 {
5161 	int ret;
5162 
5163 	ret = rtw89_core_register_hw(rtwdev);
5164 	if (ret) {
5165 		rtw89_err(rtwdev, "failed to register core hw\n");
5166 		return ret;
5167 	}
5168 
5169 	rtw89_debugfs_init(rtwdev);
5170 
5171 	return 0;
5172 }
5173 EXPORT_SYMBOL(rtw89_core_register);
5174 
5175 void rtw89_core_unregister(struct rtw89_dev *rtwdev)
5176 {
5177 	rtw89_core_unregister_hw(rtwdev);
5178 
5179 	rtw89_debugfs_deinit(rtwdev);
5180 }
5181 EXPORT_SYMBOL(rtw89_core_unregister);
5182 
5183 struct rtw89_dev *rtw89_alloc_ieee80211_hw(struct device *device,
5184 					   u32 bus_data_size,
5185 					   const struct rtw89_chip_info *chip)
5186 {
5187 	struct rtw89_fw_info early_fw = {};
5188 	const struct firmware *firmware;
5189 	struct ieee80211_hw *hw;
5190 	struct rtw89_dev *rtwdev;
5191 	struct ieee80211_ops *ops;
5192 	u32 driver_data_size;
5193 	int fw_format = -1;
5194 	bool support_mlo;
5195 	bool no_chanctx;
5196 
5197 	firmware = rtw89_early_fw_feature_recognize(device, chip, &early_fw, &fw_format);
5198 
5199 	ops = kmemdup(&rtw89_ops, sizeof(rtw89_ops), GFP_KERNEL);
5200 	if (!ops)
5201 		goto err;
5202 
5203 	no_chanctx = chip->support_chanctx_num == 0 ||
5204 		     !RTW89_CHK_FW_FEATURE(SCAN_OFFLOAD, &early_fw) ||
5205 		     !RTW89_CHK_FW_FEATURE(BEACON_FILTER, &early_fw);
5206 
5207 	if (no_chanctx) {
5208 		ops->add_chanctx = ieee80211_emulate_add_chanctx;
5209 		ops->remove_chanctx = ieee80211_emulate_remove_chanctx;
5210 		ops->change_chanctx = ieee80211_emulate_change_chanctx;
5211 		ops->switch_vif_chanctx = ieee80211_emulate_switch_vif_chanctx;
5212 		ops->assign_vif_chanctx = NULL;
5213 		ops->unassign_vif_chanctx = NULL;
5214 		ops->remain_on_channel = NULL;
5215 		ops->cancel_remain_on_channel = NULL;
5216 	}
5217 
5218 	driver_data_size = sizeof(struct rtw89_dev) + bus_data_size;
5219 	hw = ieee80211_alloc_hw(driver_data_size, ops);
5220 	if (!hw)
5221 		goto err;
5222 
5223 	/* TODO: When driver MLO arch. is done, determine whether to support MLO
5224 	 * according to the following conditions.
5225 	 * 1. run with chanctx_ops
5226 	 * 2. chip->support_link_num != 0
5227 	 * 3. FW feature supports AP_LINK_PS
5228 	 */
5229 	support_mlo = false;
5230 
5231 	hw->wiphy->iface_combinations = rtw89_iface_combs;
5232 
5233 	if (no_chanctx || chip->support_chanctx_num == 1)
5234 		hw->wiphy->n_iface_combinations = 1;
5235 	else
5236 		hw->wiphy->n_iface_combinations = ARRAY_SIZE(rtw89_iface_combs);
5237 
5238 	rtwdev = hw->priv;
5239 	rtwdev->hw = hw;
5240 	rtwdev->dev = device;
5241 	rtwdev->ops = ops;
5242 	rtwdev->chip = chip;
5243 	rtwdev->fw.req.firmware = firmware;
5244 	rtwdev->fw.fw_format = fw_format;
5245 	rtwdev->support_mlo = support_mlo;
5246 
5247 	rtw89_debug(rtwdev, RTW89_DBG_CHAN, "probe driver %s chanctx\n",
5248 		    no_chanctx ? "without" : "with");
5249 	rtw89_debug(rtwdev, RTW89_DBG_CHAN, "probe driver %s MLO cap\n",
5250 		    support_mlo ? "with" : "without");
5251 
5252 	return rtwdev;
5253 
5254 err:
5255 	kfree(ops);
5256 	release_firmware(firmware);
5257 	return NULL;
5258 }
5259 EXPORT_SYMBOL(rtw89_alloc_ieee80211_hw);
5260 
5261 void rtw89_free_ieee80211_hw(struct rtw89_dev *rtwdev)
5262 {
5263 	kfree(rtwdev->ops);
5264 	kfree(rtwdev->rfe_data);
5265 	release_firmware(rtwdev->fw.req.firmware);
5266 	ieee80211_free_hw(rtwdev->hw);
5267 }
5268 EXPORT_SYMBOL(rtw89_free_ieee80211_hw);
5269 
5270 MODULE_AUTHOR("Realtek Corporation");
5271 MODULE_DESCRIPTION("Realtek 802.11ax wireless core module");
5272 MODULE_LICENSE("Dual BSD/GPL");
5273