xref: /linux/drivers/net/wireless/realtek/rtw89/core.c (revision d30c1683aaecb93d2ab95685dc4300a33d3cea7a)
1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 /* Copyright(c) 2019-2020  Realtek Corporation
3  */
4 #include <linux/ip.h>
5 #include <linux/sort.h>
6 #include <linux/udp.h>
7 
8 #include "cam.h"
9 #include "chan.h"
10 #include "coex.h"
11 #include "core.h"
12 #include "efuse.h"
13 #include "fw.h"
14 #include "mac.h"
15 #include "phy.h"
16 #include "ps.h"
17 #include "reg.h"
18 #include "sar.h"
19 #include "ser.h"
20 #include "txrx.h"
21 #include "util.h"
22 #include "wow.h"
23 
24 static bool rtw89_disable_ps_mode;
25 module_param_named(disable_ps_mode, rtw89_disable_ps_mode, bool, 0644);
26 MODULE_PARM_DESC(disable_ps_mode, "Set Y to disable low power mode");
27 
28 #define RTW89_DEF_CHAN(_freq, _hw_val, _flags, _band)	\
29 	{ .center_freq = _freq, .hw_value = _hw_val, .flags = _flags, .band = _band, }
30 #define RTW89_DEF_CHAN_2G(_freq, _hw_val)	\
31 	RTW89_DEF_CHAN(_freq, _hw_val, 0, NL80211_BAND_2GHZ)
32 #define RTW89_DEF_CHAN_5G(_freq, _hw_val)	\
33 	RTW89_DEF_CHAN(_freq, _hw_val, 0, NL80211_BAND_5GHZ)
34 #define RTW89_DEF_CHAN_5G_NO_HT40MINUS(_freq, _hw_val)	\
35 	RTW89_DEF_CHAN(_freq, _hw_val, IEEE80211_CHAN_NO_HT40MINUS, NL80211_BAND_5GHZ)
36 #define RTW89_DEF_CHAN_6G(_freq, _hw_val)	\
37 	RTW89_DEF_CHAN(_freq, _hw_val, 0, NL80211_BAND_6GHZ)
38 
39 static struct ieee80211_channel rtw89_channels_2ghz[] = {
40 	RTW89_DEF_CHAN_2G(2412, 1),
41 	RTW89_DEF_CHAN_2G(2417, 2),
42 	RTW89_DEF_CHAN_2G(2422, 3),
43 	RTW89_DEF_CHAN_2G(2427, 4),
44 	RTW89_DEF_CHAN_2G(2432, 5),
45 	RTW89_DEF_CHAN_2G(2437, 6),
46 	RTW89_DEF_CHAN_2G(2442, 7),
47 	RTW89_DEF_CHAN_2G(2447, 8),
48 	RTW89_DEF_CHAN_2G(2452, 9),
49 	RTW89_DEF_CHAN_2G(2457, 10),
50 	RTW89_DEF_CHAN_2G(2462, 11),
51 	RTW89_DEF_CHAN_2G(2467, 12),
52 	RTW89_DEF_CHAN_2G(2472, 13),
53 	RTW89_DEF_CHAN_2G(2484, 14),
54 };
55 
56 static struct ieee80211_channel rtw89_channels_5ghz[] = {
57 	RTW89_DEF_CHAN_5G(5180, 36),
58 	RTW89_DEF_CHAN_5G(5200, 40),
59 	RTW89_DEF_CHAN_5G(5220, 44),
60 	RTW89_DEF_CHAN_5G(5240, 48),
61 	RTW89_DEF_CHAN_5G(5260, 52),
62 	RTW89_DEF_CHAN_5G(5280, 56),
63 	RTW89_DEF_CHAN_5G(5300, 60),
64 	RTW89_DEF_CHAN_5G(5320, 64),
65 	RTW89_DEF_CHAN_5G(5500, 100),
66 	RTW89_DEF_CHAN_5G(5520, 104),
67 	RTW89_DEF_CHAN_5G(5540, 108),
68 	RTW89_DEF_CHAN_5G(5560, 112),
69 	RTW89_DEF_CHAN_5G(5580, 116),
70 	RTW89_DEF_CHAN_5G(5600, 120),
71 	RTW89_DEF_CHAN_5G(5620, 124),
72 	RTW89_DEF_CHAN_5G(5640, 128),
73 	RTW89_DEF_CHAN_5G(5660, 132),
74 	RTW89_DEF_CHAN_5G(5680, 136),
75 	RTW89_DEF_CHAN_5G(5700, 140),
76 	RTW89_DEF_CHAN_5G(5720, 144),
77 	RTW89_DEF_CHAN_5G(5745, 149),
78 	RTW89_DEF_CHAN_5G(5765, 153),
79 	RTW89_DEF_CHAN_5G(5785, 157),
80 	RTW89_DEF_CHAN_5G(5805, 161),
81 	RTW89_DEF_CHAN_5G_NO_HT40MINUS(5825, 165),
82 	RTW89_DEF_CHAN_5G(5845, 169),
83 	RTW89_DEF_CHAN_5G(5865, 173),
84 	RTW89_DEF_CHAN_5G(5885, 177),
85 };
86 
87 static_assert(RTW89_5GHZ_UNII4_START_INDEX + RTW89_5GHZ_UNII4_CHANNEL_NUM ==
88 	      ARRAY_SIZE(rtw89_channels_5ghz));
89 
90 static struct ieee80211_channel rtw89_channels_6ghz[] = {
91 	RTW89_DEF_CHAN_6G(5955, 1),
92 	RTW89_DEF_CHAN_6G(5975, 5),
93 	RTW89_DEF_CHAN_6G(5995, 9),
94 	RTW89_DEF_CHAN_6G(6015, 13),
95 	RTW89_DEF_CHAN_6G(6035, 17),
96 	RTW89_DEF_CHAN_6G(6055, 21),
97 	RTW89_DEF_CHAN_6G(6075, 25),
98 	RTW89_DEF_CHAN_6G(6095, 29),
99 	RTW89_DEF_CHAN_6G(6115, 33),
100 	RTW89_DEF_CHAN_6G(6135, 37),
101 	RTW89_DEF_CHAN_6G(6155, 41),
102 	RTW89_DEF_CHAN_6G(6175, 45),
103 	RTW89_DEF_CHAN_6G(6195, 49),
104 	RTW89_DEF_CHAN_6G(6215, 53),
105 	RTW89_DEF_CHAN_6G(6235, 57),
106 	RTW89_DEF_CHAN_6G(6255, 61),
107 	RTW89_DEF_CHAN_6G(6275, 65),
108 	RTW89_DEF_CHAN_6G(6295, 69),
109 	RTW89_DEF_CHAN_6G(6315, 73),
110 	RTW89_DEF_CHAN_6G(6335, 77),
111 	RTW89_DEF_CHAN_6G(6355, 81),
112 	RTW89_DEF_CHAN_6G(6375, 85),
113 	RTW89_DEF_CHAN_6G(6395, 89),
114 	RTW89_DEF_CHAN_6G(6415, 93),
115 	RTW89_DEF_CHAN_6G(6435, 97),
116 	RTW89_DEF_CHAN_6G(6455, 101),
117 	RTW89_DEF_CHAN_6G(6475, 105),
118 	RTW89_DEF_CHAN_6G(6495, 109),
119 	RTW89_DEF_CHAN_6G(6515, 113),
120 	RTW89_DEF_CHAN_6G(6535, 117),
121 	RTW89_DEF_CHAN_6G(6555, 121),
122 	RTW89_DEF_CHAN_6G(6575, 125),
123 	RTW89_DEF_CHAN_6G(6595, 129),
124 	RTW89_DEF_CHAN_6G(6615, 133),
125 	RTW89_DEF_CHAN_6G(6635, 137),
126 	RTW89_DEF_CHAN_6G(6655, 141),
127 	RTW89_DEF_CHAN_6G(6675, 145),
128 	RTW89_DEF_CHAN_6G(6695, 149),
129 	RTW89_DEF_CHAN_6G(6715, 153),
130 	RTW89_DEF_CHAN_6G(6735, 157),
131 	RTW89_DEF_CHAN_6G(6755, 161),
132 	RTW89_DEF_CHAN_6G(6775, 165),
133 	RTW89_DEF_CHAN_6G(6795, 169),
134 	RTW89_DEF_CHAN_6G(6815, 173),
135 	RTW89_DEF_CHAN_6G(6835, 177),
136 	RTW89_DEF_CHAN_6G(6855, 181),
137 	RTW89_DEF_CHAN_6G(6875, 185),
138 	RTW89_DEF_CHAN_6G(6895, 189),
139 	RTW89_DEF_CHAN_6G(6915, 193),
140 	RTW89_DEF_CHAN_6G(6935, 197),
141 	RTW89_DEF_CHAN_6G(6955, 201),
142 	RTW89_DEF_CHAN_6G(6975, 205),
143 	RTW89_DEF_CHAN_6G(6995, 209),
144 	RTW89_DEF_CHAN_6G(7015, 213),
145 	RTW89_DEF_CHAN_6G(7035, 217),
146 	RTW89_DEF_CHAN_6G(7055, 221),
147 	RTW89_DEF_CHAN_6G(7075, 225),
148 	RTW89_DEF_CHAN_6G(7095, 229),
149 	RTW89_DEF_CHAN_6G(7115, 233),
150 };
151 
152 static struct ieee80211_rate rtw89_bitrates[] = {
153 	{ .bitrate = 10,  .hw_value = 0x00, },
154 	{ .bitrate = 20,  .hw_value = 0x01, },
155 	{ .bitrate = 55,  .hw_value = 0x02, },
156 	{ .bitrate = 110, .hw_value = 0x03, },
157 	{ .bitrate = 60,  .hw_value = 0x04, },
158 	{ .bitrate = 90,  .hw_value = 0x05, },
159 	{ .bitrate = 120, .hw_value = 0x06, },
160 	{ .bitrate = 180, .hw_value = 0x07, },
161 	{ .bitrate = 240, .hw_value = 0x08, },
162 	{ .bitrate = 360, .hw_value = 0x09, },
163 	{ .bitrate = 480, .hw_value = 0x0a, },
164 	{ .bitrate = 540, .hw_value = 0x0b, },
165 };
166 
167 static const struct ieee80211_iface_limit rtw89_iface_limits[] = {
168 	{
169 		.max = 1,
170 		.types = BIT(NL80211_IFTYPE_STATION),
171 	},
172 	{
173 		.max = 1,
174 		.types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
175 			 BIT(NL80211_IFTYPE_P2P_GO) |
176 			 BIT(NL80211_IFTYPE_AP),
177 	},
178 };
179 
180 static const struct ieee80211_iface_limit rtw89_iface_limits_mcc[] = {
181 	{
182 		.max = 1,
183 		.types = BIT(NL80211_IFTYPE_STATION),
184 	},
185 	{
186 		.max = 1,
187 		.types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
188 			 BIT(NL80211_IFTYPE_P2P_GO),
189 	},
190 };
191 
192 static const struct ieee80211_iface_combination rtw89_iface_combs[] = {
193 	{
194 		.limits = rtw89_iface_limits,
195 		.n_limits = ARRAY_SIZE(rtw89_iface_limits),
196 		.max_interfaces = RTW89_MAX_INTERFACE_NUM,
197 		.num_different_channels = 1,
198 	},
199 	{
200 		.limits = rtw89_iface_limits_mcc,
201 		.n_limits = ARRAY_SIZE(rtw89_iface_limits_mcc),
202 		.max_interfaces = RTW89_MAX_INTERFACE_NUM,
203 		.num_different_channels = 2,
204 	},
205 };
206 
207 static const u8 rtw89_ext_capa_sta[] = {
208 	[0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
209 	[2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
210 	[7] = WLAN_EXT_CAPA8_OPMODE_NOTIF,
211 };
212 
213 static const struct wiphy_iftype_ext_capab rtw89_iftypes_ext_capa[] = {
214 	{
215 		.iftype = NL80211_IFTYPE_STATION,
216 		.extended_capabilities = rtw89_ext_capa_sta,
217 		.extended_capabilities_mask = rtw89_ext_capa_sta,
218 		.extended_capabilities_len = sizeof(rtw89_ext_capa_sta),
219 		/* relevant only if EHT is supported */
220 		.eml_capabilities = 0,
221 		.mld_capa_and_ops = 0,
222 	},
223 };
224 
225 #define RTW89_6GHZ_SPAN_HEAD 6145
226 #define RTW89_6GHZ_SPAN_IDX(center_freq) \
227 	((((int)(center_freq) - RTW89_6GHZ_SPAN_HEAD) / 5) / 2)
228 
229 #define RTW89_DECL_6GHZ_SPAN(center_freq, subband_l, subband_h) \
230 	[RTW89_6GHZ_SPAN_IDX(center_freq)] = { \
231 		.sar_subband_low = RTW89_SAR_6GHZ_ ## subband_l, \
232 		.sar_subband_high = RTW89_SAR_6GHZ_ ## subband_h, \
233 		.acpi_sar_subband_low = RTW89_ACPI_SAR_6GHZ_ ## subband_l, \
234 		.acpi_sar_subband_high = RTW89_ACPI_SAR_6GHZ_ ## subband_h, \
235 		.ant_gain_subband_low = RTW89_ANT_GAIN_6GHZ_ ## subband_l, \
236 		.ant_gain_subband_high = RTW89_ANT_GAIN_6GHZ_ ## subband_h, \
237 	}
238 
239 /* Since 6GHz subbands are not edge aligned, some cases span two subbands.
240  * In the following, we describe each of them with rtw89_6ghz_span.
241  */
242 static const struct rtw89_6ghz_span rtw89_overlapping_6ghz[] = {
243 	RTW89_DECL_6GHZ_SPAN(6145, SUBBAND_5_L, SUBBAND_5_H),
244 	RTW89_DECL_6GHZ_SPAN(6165, SUBBAND_5_L, SUBBAND_5_H),
245 	RTW89_DECL_6GHZ_SPAN(6185, SUBBAND_5_L, SUBBAND_5_H),
246 	RTW89_DECL_6GHZ_SPAN(6505, SUBBAND_6, SUBBAND_7_L),
247 	RTW89_DECL_6GHZ_SPAN(6525, SUBBAND_6, SUBBAND_7_L),
248 	RTW89_DECL_6GHZ_SPAN(6545, SUBBAND_6, SUBBAND_7_L),
249 	RTW89_DECL_6GHZ_SPAN(6665, SUBBAND_7_L, SUBBAND_7_H),
250 	RTW89_DECL_6GHZ_SPAN(6705, SUBBAND_7_L, SUBBAND_7_H),
251 	RTW89_DECL_6GHZ_SPAN(6825, SUBBAND_7_H, SUBBAND_8),
252 	RTW89_DECL_6GHZ_SPAN(6865, SUBBAND_7_H, SUBBAND_8),
253 	RTW89_DECL_6GHZ_SPAN(6875, SUBBAND_7_H, SUBBAND_8),
254 	RTW89_DECL_6GHZ_SPAN(6885, SUBBAND_7_H, SUBBAND_8),
255 };
256 
257 const struct rtw89_6ghz_span *
258 rtw89_get_6ghz_span(struct rtw89_dev *rtwdev, u32 center_freq)
259 {
260 	int idx;
261 
262 	if (center_freq >= RTW89_6GHZ_SPAN_HEAD) {
263 		idx = RTW89_6GHZ_SPAN_IDX(center_freq);
264 		/* To decrease size of rtw89_overlapping_6ghz[],
265 		 * RTW89_6GHZ_SPAN_IDX() truncates the leading NULLs
266 		 * to make first span as index 0 of the table. So, if center
267 		 * frequency is less than the first one, it will get netative.
268 		 */
269 		if (idx >= 0 && idx < ARRAY_SIZE(rtw89_overlapping_6ghz))
270 			return &rtw89_overlapping_6ghz[idx];
271 	}
272 
273 	return NULL;
274 }
275 
276 bool rtw89_legacy_rate_to_bitrate(struct rtw89_dev *rtwdev, u8 legacy_rate, u16 *bitrate)
277 {
278 	const struct ieee80211_rate *rate;
279 
280 	if (unlikely(legacy_rate >= ARRAY_SIZE(rtw89_bitrates))) {
281 		rtw89_debug(rtwdev, RTW89_DBG_UNEXP,
282 			    "invalid legacy rate %d\n", legacy_rate);
283 		return false;
284 	}
285 
286 	rate = &rtw89_bitrates[legacy_rate];
287 	*bitrate = rate->bitrate;
288 
289 	return true;
290 }
291 
292 static const struct ieee80211_supported_band rtw89_sband_2ghz = {
293 	.band		= NL80211_BAND_2GHZ,
294 	.channels	= rtw89_channels_2ghz,
295 	.n_channels	= ARRAY_SIZE(rtw89_channels_2ghz),
296 	.bitrates	= rtw89_bitrates,
297 	.n_bitrates	= ARRAY_SIZE(rtw89_bitrates),
298 	.ht_cap		= {0},
299 	.vht_cap	= {0},
300 };
301 
302 static const struct ieee80211_supported_band rtw89_sband_5ghz = {
303 	.band		= NL80211_BAND_5GHZ,
304 	.channels	= rtw89_channels_5ghz,
305 	.n_channels	= ARRAY_SIZE(rtw89_channels_5ghz),
306 
307 	/* 5G has no CCK rates, 1M/2M/5.5M/11M */
308 	.bitrates	= rtw89_bitrates + 4,
309 	.n_bitrates	= ARRAY_SIZE(rtw89_bitrates) - 4,
310 	.ht_cap		= {0},
311 	.vht_cap	= {0},
312 };
313 
314 static const struct ieee80211_supported_band rtw89_sband_6ghz = {
315 	.band		= NL80211_BAND_6GHZ,
316 	.channels	= rtw89_channels_6ghz,
317 	.n_channels	= ARRAY_SIZE(rtw89_channels_6ghz),
318 
319 	/* 6G has no CCK rates, 1M/2M/5.5M/11M */
320 	.bitrates	= rtw89_bitrates + 4,
321 	.n_bitrates	= ARRAY_SIZE(rtw89_bitrates) - 4,
322 };
323 
324 static const struct rtw89_hw_rate_def {
325 	enum rtw89_hw_rate ht;
326 	enum rtw89_hw_rate vht[RTW89_NSS_NUM];
327 } rtw89_hw_rate[RTW89_CHIP_GEN_NUM] = {
328 	[RTW89_CHIP_AX] = {
329 		.ht = RTW89_HW_RATE_MCS0,
330 		.vht = {RTW89_HW_RATE_VHT_NSS1_MCS0,
331 			RTW89_HW_RATE_VHT_NSS2_MCS0,
332 			RTW89_HW_RATE_VHT_NSS3_MCS0,
333 			RTW89_HW_RATE_VHT_NSS4_MCS0},
334 	},
335 	[RTW89_CHIP_BE] = {
336 		.ht = RTW89_HW_RATE_V1_MCS0,
337 		.vht = {RTW89_HW_RATE_V1_VHT_NSS1_MCS0,
338 			RTW89_HW_RATE_V1_VHT_NSS2_MCS0,
339 			RTW89_HW_RATE_V1_VHT_NSS3_MCS0,
340 			RTW89_HW_RATE_V1_VHT_NSS4_MCS0},
341 	},
342 };
343 
344 static void __rtw89_traffic_stats_accu(struct rtw89_traffic_stats *stats,
345 				       struct sk_buff *skb, bool tx)
346 {
347 	if (tx) {
348 		stats->tx_cnt++;
349 		stats->tx_unicast += skb->len;
350 	} else {
351 		stats->rx_cnt++;
352 		stats->rx_unicast += skb->len;
353 	}
354 }
355 
356 static void rtw89_traffic_stats_accu(struct rtw89_dev *rtwdev,
357 				     struct rtw89_vif *rtwvif,
358 				     struct sk_buff *skb,
359 				     bool accu_dev, bool tx)
360 {
361 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
362 
363 	if (!ieee80211_is_data(hdr->frame_control))
364 		return;
365 
366 	if (is_broadcast_ether_addr(hdr->addr1) ||
367 	    is_multicast_ether_addr(hdr->addr1))
368 		return;
369 
370 	if (accu_dev)
371 		__rtw89_traffic_stats_accu(&rtwdev->stats, skb, tx);
372 
373 	if (rtwvif) {
374 		__rtw89_traffic_stats_accu(&rtwvif->stats, skb, tx);
375 		__rtw89_traffic_stats_accu(&rtwvif->stats_ps, skb, tx);
376 	}
377 }
378 
379 void rtw89_get_default_chandef(struct cfg80211_chan_def *chandef)
380 {
381 	cfg80211_chandef_create(chandef, &rtw89_channels_2ghz[0],
382 				NL80211_CHAN_NO_HT);
383 }
384 
385 void rtw89_get_channel_params(const struct cfg80211_chan_def *chandef,
386 			      struct rtw89_chan *chan)
387 {
388 	struct ieee80211_channel *channel = chandef->chan;
389 	enum nl80211_chan_width width = chandef->width;
390 	u32 primary_freq, center_freq;
391 	u8 center_chan;
392 	u8 bandwidth = RTW89_CHANNEL_WIDTH_20;
393 	u32 offset;
394 	u8 band;
395 
396 	center_chan = channel->hw_value;
397 	primary_freq = channel->center_freq;
398 	center_freq = chandef->center_freq1;
399 
400 	switch (width) {
401 	case NL80211_CHAN_WIDTH_20_NOHT:
402 	case NL80211_CHAN_WIDTH_20:
403 		bandwidth = RTW89_CHANNEL_WIDTH_20;
404 		break;
405 	case NL80211_CHAN_WIDTH_40:
406 		bandwidth = RTW89_CHANNEL_WIDTH_40;
407 		if (primary_freq > center_freq) {
408 			center_chan -= 2;
409 		} else {
410 			center_chan += 2;
411 		}
412 		break;
413 	case NL80211_CHAN_WIDTH_80:
414 	case NL80211_CHAN_WIDTH_160:
415 		bandwidth = nl_to_rtw89_bandwidth(width);
416 		if (primary_freq > center_freq) {
417 			offset = (primary_freq - center_freq - 10) / 20;
418 			center_chan -= 2 + offset * 4;
419 		} else {
420 			offset = (center_freq - primary_freq - 10) / 20;
421 			center_chan += 2 + offset * 4;
422 		}
423 		break;
424 	default:
425 		center_chan = 0;
426 		break;
427 	}
428 
429 	switch (channel->band) {
430 	default:
431 	case NL80211_BAND_2GHZ:
432 		band = RTW89_BAND_2G;
433 		break;
434 	case NL80211_BAND_5GHZ:
435 		band = RTW89_BAND_5G;
436 		break;
437 	case NL80211_BAND_6GHZ:
438 		band = RTW89_BAND_6G;
439 		break;
440 	}
441 
442 	rtw89_chan_create(chan, center_chan, channel->hw_value, band, bandwidth);
443 }
444 
445 static void __rtw89_core_set_chip_txpwr(struct rtw89_dev *rtwdev,
446 					const struct rtw89_chan *chan,
447 					enum rtw89_phy_idx phy_idx)
448 {
449 	const struct rtw89_chip_info *chip = rtwdev->chip;
450 	bool entity_active;
451 
452 	entity_active = rtw89_get_entity_state(rtwdev, phy_idx);
453 	if (!entity_active)
454 		return;
455 
456 	chip->ops->set_txpwr(rtwdev, chan, phy_idx);
457 }
458 
459 void rtw89_core_set_chip_txpwr(struct rtw89_dev *rtwdev)
460 {
461 	const struct rtw89_chan *chan;
462 
463 	chan = rtw89_mgnt_chan_get(rtwdev, 0);
464 	__rtw89_core_set_chip_txpwr(rtwdev, chan, RTW89_PHY_0);
465 
466 	if (!rtwdev->support_mlo)
467 		return;
468 
469 	chan = rtw89_mgnt_chan_get(rtwdev, 1);
470 	__rtw89_core_set_chip_txpwr(rtwdev, chan, RTW89_PHY_1);
471 }
472 
473 static void rtw89_chip_rfk_channel_for_pure_mon_vif(struct rtw89_dev *rtwdev,
474 						    enum rtw89_phy_idx phy_idx)
475 {
476 	struct rtw89_vif *rtwvif = rtwdev->pure_monitor_mode_vif;
477 	struct rtw89_vif_link *rtwvif_link;
478 
479 	if (!rtwvif)
480 		return;
481 
482 	rtwvif_link = rtw89_vif_get_link_inst(rtwvif, phy_idx);
483 	if (!rtwvif_link)
484 		return;
485 
486 	rtw89_chip_rfk_channel(rtwdev, rtwvif_link);
487 }
488 
489 static void __rtw89_set_channel(struct rtw89_dev *rtwdev,
490 				const struct rtw89_chan *chan,
491 				enum rtw89_mac_idx mac_idx,
492 				enum rtw89_phy_idx phy_idx)
493 {
494 	const struct rtw89_chip_info *chip = rtwdev->chip;
495 	const struct rtw89_chan_rcd *chan_rcd;
496 	struct rtw89_channel_help_params bak;
497 	bool entity_active;
498 
499 	entity_active = rtw89_get_entity_state(rtwdev, phy_idx);
500 
501 	chan_rcd = rtw89_chan_rcd_get_by_chan(chan);
502 
503 	rtw89_chip_set_channel_prepare(rtwdev, &bak, chan, mac_idx, phy_idx);
504 
505 	chip->ops->set_channel(rtwdev, chan, mac_idx, phy_idx);
506 
507 	chip->ops->set_txpwr(rtwdev, chan, phy_idx);
508 
509 	rtw89_chip_set_channel_done(rtwdev, &bak, chan, mac_idx, phy_idx);
510 
511 	if (!entity_active || chan_rcd->band_changed) {
512 		rtw89_btc_ntfy_switch_band(rtwdev, phy_idx, chan->band_type);
513 		rtw89_chip_rfk_band_changed(rtwdev, phy_idx, chan);
514 	}
515 
516 	rtw89_set_entity_state(rtwdev, phy_idx, true);
517 
518 	rtw89_chip_rfk_channel_for_pure_mon_vif(rtwdev, phy_idx);
519 }
520 
521 int rtw89_set_channel(struct rtw89_dev *rtwdev)
522 {
523 	const struct rtw89_chan *chan;
524 	enum rtw89_entity_mode mode;
525 
526 	mode = rtw89_entity_recalc(rtwdev);
527 	if (mode < 0 || mode >= NUM_OF_RTW89_ENTITY_MODE) {
528 		WARN(1, "Invalid ent mode: %d\n", mode);
529 		return -EINVAL;
530 	}
531 
532 	chan = rtw89_mgnt_chan_get(rtwdev, 0);
533 	__rtw89_set_channel(rtwdev, chan, RTW89_MAC_0, RTW89_PHY_0);
534 
535 	if (!rtwdev->support_mlo)
536 		return 0;
537 
538 	chan = rtw89_mgnt_chan_get(rtwdev, 1);
539 	__rtw89_set_channel(rtwdev, chan, RTW89_MAC_1, RTW89_PHY_1);
540 
541 	return 0;
542 }
543 
544 static enum rtw89_core_tx_type
545 rtw89_core_get_tx_type(struct rtw89_dev *rtwdev,
546 		       struct sk_buff *skb)
547 {
548 	struct ieee80211_hdr *hdr = (void *)skb->data;
549 	__le16 fc = hdr->frame_control;
550 
551 	if (ieee80211_is_mgmt(fc) || ieee80211_is_nullfunc(fc))
552 		return RTW89_CORE_TX_TYPE_MGMT;
553 
554 	return RTW89_CORE_TX_TYPE_DATA;
555 }
556 
557 static void
558 rtw89_core_tx_update_ampdu_info(struct rtw89_dev *rtwdev,
559 				struct rtw89_core_tx_request *tx_req,
560 				enum btc_pkt_type pkt_type)
561 {
562 	struct rtw89_sta_link *rtwsta_link = tx_req->rtwsta_link;
563 	struct rtw89_tx_desc_info *desc_info = &tx_req->desc_info;
564 	struct ieee80211_link_sta *link_sta;
565 	struct sk_buff *skb = tx_req->skb;
566 	struct rtw89_sta *rtwsta;
567 	u8 ampdu_num;
568 	u8 tid;
569 
570 	if (pkt_type == PACKET_EAPOL) {
571 		desc_info->bk = true;
572 		return;
573 	}
574 
575 	if (!(IEEE80211_SKB_CB(skb)->flags & IEEE80211_TX_CTL_AMPDU))
576 		return;
577 
578 	if (!rtwsta_link) {
579 		rtw89_warn(rtwdev, "cannot set ampdu info without sta\n");
580 		return;
581 	}
582 
583 	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
584 	rtwsta = rtwsta_link->rtwsta;
585 
586 	rcu_read_lock();
587 
588 	link_sta = rtw89_sta_rcu_dereference_link(rtwsta_link, false);
589 	ampdu_num = (u8)((rtwsta->ampdu_params[tid].agg_num ?
590 			  rtwsta->ampdu_params[tid].agg_num :
591 			  4 << link_sta->ht_cap.ampdu_factor) - 1);
592 
593 	desc_info->agg_en = true;
594 	desc_info->ampdu_density = link_sta->ht_cap.ampdu_density;
595 	desc_info->ampdu_num = ampdu_num;
596 
597 	rcu_read_unlock();
598 }
599 
600 static void
601 rtw89_core_tx_update_sec_key(struct rtw89_dev *rtwdev,
602 			     struct rtw89_core_tx_request *tx_req)
603 {
604 	struct rtw89_cam_info *cam_info = &rtwdev->cam_info;
605 	const struct rtw89_chip_info *chip = rtwdev->chip;
606 	const struct rtw89_sec_cam_entry *sec_cam;
607 	struct ieee80211_tx_info *info;
608 	struct ieee80211_key_conf *key;
609 	struct rtw89_tx_desc_info *desc_info = &tx_req->desc_info;
610 	struct sk_buff *skb = tx_req->skb;
611 	u8 sec_type = RTW89_SEC_KEY_TYPE_NONE;
612 	u8 sec_cam_idx;
613 	u64 pn64;
614 
615 	info = IEEE80211_SKB_CB(skb);
616 	key = info->control.hw_key;
617 	sec_cam_idx = key->hw_key_idx;
618 	sec_cam = cam_info->sec_entries[sec_cam_idx];
619 	if (!sec_cam) {
620 		rtw89_warn(rtwdev, "sec cam entry is empty\n");
621 		return;
622 	}
623 
624 	switch (key->cipher) {
625 	case WLAN_CIPHER_SUITE_WEP40:
626 		sec_type = RTW89_SEC_KEY_TYPE_WEP40;
627 		break;
628 	case WLAN_CIPHER_SUITE_WEP104:
629 		sec_type = RTW89_SEC_KEY_TYPE_WEP104;
630 		break;
631 	case WLAN_CIPHER_SUITE_TKIP:
632 		sec_type = RTW89_SEC_KEY_TYPE_TKIP;
633 		break;
634 	case WLAN_CIPHER_SUITE_CCMP:
635 		sec_type = RTW89_SEC_KEY_TYPE_CCMP128;
636 		break;
637 	case WLAN_CIPHER_SUITE_CCMP_256:
638 		sec_type = RTW89_SEC_KEY_TYPE_CCMP256;
639 		break;
640 	case WLAN_CIPHER_SUITE_GCMP:
641 		sec_type = RTW89_SEC_KEY_TYPE_GCMP128;
642 		break;
643 	case WLAN_CIPHER_SUITE_GCMP_256:
644 		sec_type = RTW89_SEC_KEY_TYPE_GCMP256;
645 		break;
646 	default:
647 		rtw89_warn(rtwdev, "key cipher not supported %d\n", key->cipher);
648 		return;
649 	}
650 
651 	desc_info->sec_en = true;
652 	desc_info->sec_keyid = key->keyidx;
653 	desc_info->sec_type = sec_type;
654 	desc_info->sec_cam_idx = sec_cam->sec_cam_idx;
655 
656 	if (!chip->hw_sec_hdr)
657 		return;
658 
659 	pn64 = atomic64_inc_return(&key->tx_pn);
660 	desc_info->sec_seq[0] = pn64;
661 	desc_info->sec_seq[1] = pn64 >> 8;
662 	desc_info->sec_seq[2] = pn64 >> 16;
663 	desc_info->sec_seq[3] = pn64 >> 24;
664 	desc_info->sec_seq[4] = pn64 >> 32;
665 	desc_info->sec_seq[5] = pn64 >> 40;
666 	desc_info->wp_offset = 1; /* in unit of 8 bytes for security header */
667 }
668 
669 static u16 rtw89_core_get_mgmt_rate(struct rtw89_dev *rtwdev,
670 				    struct rtw89_core_tx_request *tx_req,
671 				    const struct rtw89_chan *chan)
672 {
673 	struct sk_buff *skb = tx_req->skb;
674 	struct rtw89_vif_link *rtwvif_link = tx_req->rtwvif_link;
675 	struct rtw89_sta_link *rtwsta_link = tx_req->rtwsta_link;
676 	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
677 	struct ieee80211_vif *vif = tx_info->control.vif;
678 	struct ieee80211_bss_conf *bss_conf;
679 	u16 lowest_rate;
680 	u16 rate;
681 
682 	if (tx_info->flags & IEEE80211_TX_CTL_NO_CCK_RATE ||
683 	    (vif && vif->p2p))
684 		lowest_rate = RTW89_HW_RATE_OFDM6;
685 	else if (chan->band_type == RTW89_BAND_2G)
686 		lowest_rate = RTW89_HW_RATE_CCK1;
687 	else
688 		lowest_rate = RTW89_HW_RATE_OFDM6;
689 
690 	if (!rtwvif_link)
691 		return lowest_rate;
692 
693 	rcu_read_lock();
694 
695 	bss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, false);
696 	if (!bss_conf->basic_rates || !rtwsta_link) {
697 		rate = lowest_rate;
698 		goto out;
699 	}
700 
701 	rate = __ffs(bss_conf->basic_rates) + lowest_rate;
702 
703 out:
704 	rcu_read_unlock();
705 
706 	return rate;
707 }
708 
709 static u8 rtw89_core_tx_get_mac_id(struct rtw89_dev *rtwdev,
710 				   struct rtw89_core_tx_request *tx_req)
711 {
712 	struct rtw89_tx_desc_info *desc_info = &tx_req->desc_info;
713 	struct rtw89_vif_link *rtwvif_link = tx_req->rtwvif_link;
714 	struct rtw89_sta_link *rtwsta_link = tx_req->rtwsta_link;
715 
716 	if (desc_info->mlo && !desc_info->sw_mld) {
717 		if (rtwsta_link)
718 			return rtw89_sta_get_main_macid(rtwsta_link->rtwsta);
719 		else
720 			return rtw89_vif_get_main_macid(rtwvif_link->rtwvif);
721 	}
722 
723 	if (!rtwsta_link)
724 		return rtwvif_link->mac_id;
725 
726 	return rtwsta_link->mac_id;
727 }
728 
729 static void rtw89_core_tx_update_llc_hdr(struct rtw89_dev *rtwdev,
730 					 struct rtw89_tx_desc_info *desc_info,
731 					 struct sk_buff *skb)
732 {
733 	struct ieee80211_hdr *hdr = (void *)skb->data;
734 	__le16 fc = hdr->frame_control;
735 
736 	desc_info->hdr_llc_len = ieee80211_hdrlen(fc);
737 	desc_info->hdr_llc_len >>= 1; /* in unit of 2 bytes */
738 }
739 
740 u8 rtw89_core_get_ch_dma(struct rtw89_dev *rtwdev, u8 qsel)
741 {
742 	switch (qsel) {
743 	default:
744 		rtw89_warn(rtwdev, "Cannot map qsel to dma: %d\n", qsel);
745 		fallthrough;
746 	case RTW89_TX_QSEL_BE_0:
747 	case RTW89_TX_QSEL_BE_1:
748 	case RTW89_TX_QSEL_BE_2:
749 	case RTW89_TX_QSEL_BE_3:
750 		return RTW89_TXCH_ACH0;
751 	case RTW89_TX_QSEL_BK_0:
752 	case RTW89_TX_QSEL_BK_1:
753 	case RTW89_TX_QSEL_BK_2:
754 	case RTW89_TX_QSEL_BK_3:
755 		return RTW89_TXCH_ACH1;
756 	case RTW89_TX_QSEL_VI_0:
757 	case RTW89_TX_QSEL_VI_1:
758 	case RTW89_TX_QSEL_VI_2:
759 	case RTW89_TX_QSEL_VI_3:
760 		return RTW89_TXCH_ACH2;
761 	case RTW89_TX_QSEL_VO_0:
762 	case RTW89_TX_QSEL_VO_1:
763 	case RTW89_TX_QSEL_VO_2:
764 	case RTW89_TX_QSEL_VO_3:
765 		return RTW89_TXCH_ACH3;
766 	case RTW89_TX_QSEL_B0_MGMT:
767 		return RTW89_TXCH_CH8;
768 	case RTW89_TX_QSEL_B0_HI:
769 		return RTW89_TXCH_CH9;
770 	case RTW89_TX_QSEL_B1_MGMT:
771 		return RTW89_TXCH_CH10;
772 	case RTW89_TX_QSEL_B1_HI:
773 		return RTW89_TXCH_CH11;
774 	}
775 }
776 EXPORT_SYMBOL(rtw89_core_get_ch_dma);
777 
778 u8 rtw89_core_get_ch_dma_v1(struct rtw89_dev *rtwdev, u8 qsel)
779 {
780 	switch (qsel) {
781 	default:
782 		rtw89_warn(rtwdev, "Cannot map qsel to dma v1: %d\n", qsel);
783 		fallthrough;
784 	case RTW89_TX_QSEL_BE_0:
785 	case RTW89_TX_QSEL_BK_0:
786 		return RTW89_TXCH_ACH0;
787 	case RTW89_TX_QSEL_VI_0:
788 	case RTW89_TX_QSEL_VO_0:
789 		return RTW89_TXCH_ACH2;
790 	case RTW89_TX_QSEL_B0_MGMT:
791 	case RTW89_TX_QSEL_B0_HI:
792 		return RTW89_TXCH_CH8;
793 	case RTW89_TX_QSEL_B1_MGMT:
794 	case RTW89_TX_QSEL_B1_HI:
795 		return RTW89_TXCH_CH10;
796 	}
797 }
798 EXPORT_SYMBOL(rtw89_core_get_ch_dma_v1);
799 
800 u8 rtw89_core_get_ch_dma_v2(struct rtw89_dev *rtwdev, u8 qsel)
801 {
802 	switch (qsel) {
803 	default:
804 		rtw89_warn(rtwdev, "Cannot map qsel to dma v2: %d\n", qsel);
805 		fallthrough;
806 	case RTW89_TX_QSEL_BE_0:
807 	case RTW89_TX_QSEL_VO_0:
808 		return RTW89_TXCH_ACH0;
809 	case RTW89_TX_QSEL_BK_0:
810 	case RTW89_TX_QSEL_VI_0:
811 		return RTW89_TXCH_ACH2;
812 	case RTW89_TX_QSEL_B0_MGMT:
813 	case RTW89_TX_QSEL_B0_HI:
814 		return RTW89_TXCH_CH8;
815 	}
816 }
817 EXPORT_SYMBOL(rtw89_core_get_ch_dma_v2);
818 
819 static void
820 rtw89_core_tx_update_mgmt_info(struct rtw89_dev *rtwdev,
821 			       struct rtw89_core_tx_request *tx_req)
822 {
823 	const struct rtw89_chip_info *chip = rtwdev->chip;
824 	struct rtw89_vif_link *rtwvif_link = tx_req->rtwvif_link;
825 	struct rtw89_tx_desc_info *desc_info = &tx_req->desc_info;
826 	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev,
827 						       rtwvif_link->chanctx_idx);
828 	struct sk_buff *skb = tx_req->skb;
829 	u8 qsel, ch_dma;
830 
831 	qsel = rtw89_core_get_qsel_mgmt(rtwdev, tx_req);
832 	ch_dma = rtw89_chip_get_ch_dma(rtwdev, qsel);
833 
834 	desc_info->qsel = qsel;
835 	desc_info->ch_dma = ch_dma;
836 	desc_info->port = desc_info->hiq ? rtwvif_link->port : 0;
837 	desc_info->mac_id = rtw89_core_tx_get_mac_id(rtwdev, tx_req);
838 	desc_info->hw_ssn_sel = RTW89_MGMT_HW_SSN_SEL;
839 	desc_info->hw_seq_mode = RTW89_MGMT_HW_SEQ_MODE;
840 
841 	/* fixed data rate for mgmt frames */
842 	desc_info->en_wd_info = true;
843 	desc_info->use_rate = true;
844 	desc_info->dis_data_fb = true;
845 	desc_info->data_rate = rtw89_core_get_mgmt_rate(rtwdev, tx_req, chan);
846 
847 	if (chip->hw_mgmt_tx_encrypt && IEEE80211_SKB_CB(skb)->control.hw_key) {
848 		rtw89_core_tx_update_sec_key(rtwdev, tx_req);
849 		rtw89_core_tx_update_llc_hdr(rtwdev, desc_info, skb);
850 	}
851 
852 	rtw89_debug(rtwdev, RTW89_DBG_TXRX,
853 		    "tx mgmt frame with rate 0x%x on channel %d (band %d, bw %d)\n",
854 		    desc_info->data_rate, chan->channel, chan->band_type,
855 		    chan->band_width);
856 }
857 
858 static void
859 rtw89_core_tx_update_h2c_info(struct rtw89_dev *rtwdev,
860 			      struct rtw89_core_tx_request *tx_req)
861 {
862 	struct rtw89_tx_desc_info *desc_info = &tx_req->desc_info;
863 
864 	desc_info->is_bmc = false;
865 	desc_info->wd_page = false;
866 	desc_info->ch_dma = RTW89_DMA_H2C;
867 }
868 
869 static void rtw89_core_get_no_ul_ofdma_htc(struct rtw89_dev *rtwdev, __le32 *htc,
870 					   const struct rtw89_chan *chan)
871 {
872 	static const u8 rtw89_bandwidth_to_om[] = {
873 		[RTW89_CHANNEL_WIDTH_20] = HTC_OM_CHANNEL_WIDTH_20,
874 		[RTW89_CHANNEL_WIDTH_40] = HTC_OM_CHANNEL_WIDTH_40,
875 		[RTW89_CHANNEL_WIDTH_80] = HTC_OM_CHANNEL_WIDTH_80,
876 		[RTW89_CHANNEL_WIDTH_160] = HTC_OM_CHANNEL_WIDTH_160_OR_80_80,
877 		[RTW89_CHANNEL_WIDTH_80_80] = HTC_OM_CHANNEL_WIDTH_160_OR_80_80,
878 	};
879 	const struct rtw89_chip_info *chip = rtwdev->chip;
880 	struct rtw89_hal *hal = &rtwdev->hal;
881 	u8 om_bandwidth;
882 
883 	if (!chip->dis_2g_40m_ul_ofdma ||
884 	    chan->band_type != RTW89_BAND_2G ||
885 	    chan->band_width != RTW89_CHANNEL_WIDTH_40)
886 		return;
887 
888 	om_bandwidth = chan->band_width < ARRAY_SIZE(rtw89_bandwidth_to_om) ?
889 		       rtw89_bandwidth_to_om[chan->band_width] : 0;
890 	*htc = le32_encode_bits(RTW89_HTC_VARIANT_HE, RTW89_HTC_MASK_VARIANT) |
891 	       le32_encode_bits(RTW89_HTC_VARIANT_HE_CID_OM, RTW89_HTC_MASK_CTL_ID) |
892 	       le32_encode_bits(hal->rx_nss - 1, RTW89_HTC_MASK_HTC_OM_RX_NSS) |
893 	       le32_encode_bits(om_bandwidth, RTW89_HTC_MASK_HTC_OM_CH_WIDTH) |
894 	       le32_encode_bits(1, RTW89_HTC_MASK_HTC_OM_UL_MU_DIS) |
895 	       le32_encode_bits(hal->tx_nss - 1, RTW89_HTC_MASK_HTC_OM_TX_NSTS) |
896 	       le32_encode_bits(0, RTW89_HTC_MASK_HTC_OM_ER_SU_DIS) |
897 	       le32_encode_bits(0, RTW89_HTC_MASK_HTC_OM_DL_MU_MIMO_RR) |
898 	       le32_encode_bits(0, RTW89_HTC_MASK_HTC_OM_UL_MU_DATA_DIS);
899 }
900 
901 static bool
902 __rtw89_core_tx_check_he_qos_htc(struct rtw89_dev *rtwdev,
903 				 struct rtw89_core_tx_request *tx_req,
904 				 enum btc_pkt_type pkt_type)
905 {
906 	struct rtw89_sta_link *rtwsta_link = tx_req->rtwsta_link;
907 	struct sk_buff *skb = tx_req->skb;
908 	struct ieee80211_hdr *hdr = (void *)skb->data;
909 	struct ieee80211_link_sta *link_sta;
910 	__le16 fc = hdr->frame_control;
911 
912 	/* AP IOT issue with EAPoL, ARP and DHCP */
913 	if (pkt_type < PACKET_MAX)
914 		return false;
915 
916 	if (!rtwsta_link)
917 		return false;
918 
919 	rcu_read_lock();
920 
921 	link_sta = rtw89_sta_rcu_dereference_link(rtwsta_link, false);
922 	if (!link_sta->he_cap.has_he) {
923 		rcu_read_unlock();
924 		return false;
925 	}
926 
927 	rcu_read_unlock();
928 
929 	if (!ieee80211_is_data_qos(fc))
930 		return false;
931 
932 	if (skb_headroom(skb) < IEEE80211_HT_CTL_LEN)
933 		return false;
934 
935 	if (rtwsta_link && rtwsta_link->ra_report.might_fallback_legacy)
936 		return false;
937 
938 	return true;
939 }
940 
941 static void
942 __rtw89_core_tx_adjust_he_qos_htc(struct rtw89_dev *rtwdev,
943 				  struct rtw89_core_tx_request *tx_req)
944 {
945 	struct rtw89_sta_link *rtwsta_link = tx_req->rtwsta_link;
946 	struct sk_buff *skb = tx_req->skb;
947 	struct ieee80211_hdr *hdr = (void *)skb->data;
948 	__le16 fc = hdr->frame_control;
949 	void *data;
950 	__le32 *htc;
951 	u8 *qc;
952 	int hdr_len;
953 
954 	hdr_len = ieee80211_has_a4(fc) ? 32 : 26;
955 	data = skb_push(skb, IEEE80211_HT_CTL_LEN);
956 	memmove(data, data + IEEE80211_HT_CTL_LEN, hdr_len);
957 
958 	hdr = data;
959 	htc = data + hdr_len;
960 	hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_ORDER);
961 	*htc = rtwsta_link->htc_template ? rtwsta_link->htc_template :
962 	       le32_encode_bits(RTW89_HTC_VARIANT_HE, RTW89_HTC_MASK_VARIANT) |
963 	       le32_encode_bits(RTW89_HTC_VARIANT_HE_CID_CAS, RTW89_HTC_MASK_CTL_ID);
964 
965 	qc = data + hdr_len - IEEE80211_QOS_CTL_LEN;
966 	qc[0] |= IEEE80211_QOS_CTL_EOSP;
967 }
968 
969 static void
970 rtw89_core_tx_update_he_qos_htc(struct rtw89_dev *rtwdev,
971 				struct rtw89_core_tx_request *tx_req,
972 				enum btc_pkt_type pkt_type)
973 {
974 	struct rtw89_tx_desc_info *desc_info = &tx_req->desc_info;
975 	struct rtw89_vif_link *rtwvif_link = tx_req->rtwvif_link;
976 
977 	if (!__rtw89_core_tx_check_he_qos_htc(rtwdev, tx_req, pkt_type))
978 		goto desc_bk;
979 
980 	__rtw89_core_tx_adjust_he_qos_htc(rtwdev, tx_req);
981 
982 	desc_info->pkt_size += IEEE80211_HT_CTL_LEN;
983 	desc_info->a_ctrl_bsr = true;
984 
985 desc_bk:
986 	if (!rtwvif_link || rtwvif_link->last_a_ctrl == desc_info->a_ctrl_bsr)
987 		return;
988 
989 	rtwvif_link->last_a_ctrl = desc_info->a_ctrl_bsr;
990 	desc_info->bk = true;
991 }
992 
993 static u16 rtw89_core_get_data_rate(struct rtw89_dev *rtwdev,
994 				    struct rtw89_core_tx_request *tx_req)
995 {
996 	struct rtw89_vif_link *rtwvif_link = tx_req->rtwvif_link;
997 	struct rtw89_sta_link *rtwsta_link = tx_req->rtwsta_link;
998 	struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
999 	struct rtw89_phy_rate_pattern *rate_pattern = &rtwvif_link->rate_pattern;
1000 	enum rtw89_chanctx_idx idx = rtwvif_link->chanctx_idx;
1001 	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, idx);
1002 	struct ieee80211_link_sta *link_sta;
1003 	u16 lowest_rate;
1004 	u16 rate;
1005 
1006 	if (rate_pattern->enable)
1007 		return rate_pattern->rate;
1008 
1009 	if (vif->p2p)
1010 		lowest_rate = RTW89_HW_RATE_OFDM6;
1011 	else if (chan->band_type == RTW89_BAND_2G)
1012 		lowest_rate = RTW89_HW_RATE_CCK1;
1013 	else
1014 		lowest_rate = RTW89_HW_RATE_OFDM6;
1015 
1016 	if (!rtwsta_link)
1017 		return lowest_rate;
1018 
1019 	rcu_read_lock();
1020 
1021 	link_sta = rtw89_sta_rcu_dereference_link(rtwsta_link, false);
1022 	if (!link_sta->supp_rates[chan->band_type]) {
1023 		rate = lowest_rate;
1024 		goto out;
1025 	}
1026 
1027 	rate = __ffs(link_sta->supp_rates[chan->band_type]) + lowest_rate;
1028 
1029 out:
1030 	rcu_read_unlock();
1031 
1032 	return rate;
1033 }
1034 
1035 static void
1036 rtw89_core_tx_update_data_info(struct rtw89_dev *rtwdev,
1037 			       struct rtw89_core_tx_request *tx_req)
1038 {
1039 	struct rtw89_vif_link *rtwvif_link = tx_req->rtwvif_link;
1040 	struct rtw89_sta_link *rtwsta_link = tx_req->rtwsta_link;
1041 	struct rtw89_tx_desc_info *desc_info = &tx_req->desc_info;
1042 	struct sk_buff *skb = tx_req->skb;
1043 	u8 tid, tid_indicate;
1044 	u8 qsel, ch_dma;
1045 
1046 	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
1047 	tid_indicate = rtw89_core_get_tid_indicate(rtwdev, tid);
1048 	qsel = desc_info->hiq ? RTW89_TX_QSEL_B0_HI : rtw89_core_get_qsel(rtwdev, tid);
1049 	ch_dma = rtw89_chip_get_ch_dma(rtwdev, qsel);
1050 
1051 	desc_info->ch_dma = ch_dma;
1052 	desc_info->tid_indicate = tid_indicate;
1053 	desc_info->qsel = qsel;
1054 	desc_info->mac_id = rtw89_core_tx_get_mac_id(rtwdev, tx_req);
1055 	desc_info->port = desc_info->hiq ? rtwvif_link->port : 0;
1056 	desc_info->er_cap = rtwsta_link ? rtwsta_link->er_cap : false;
1057 	desc_info->stbc = rtwsta_link ? rtwsta_link->ra.stbc_cap : false;
1058 	desc_info->ldpc = rtwsta_link ? rtwsta_link->ra.ldpc_cap : false;
1059 
1060 	/* enable wd_info for AMPDU */
1061 	desc_info->en_wd_info = true;
1062 
1063 	if (IEEE80211_SKB_CB(skb)->control.hw_key)
1064 		rtw89_core_tx_update_sec_key(rtwdev, tx_req);
1065 
1066 	desc_info->data_retry_lowest_rate = rtw89_core_get_data_rate(rtwdev, tx_req);
1067 }
1068 
1069 static enum btc_pkt_type
1070 rtw89_core_tx_btc_spec_pkt_notify(struct rtw89_dev *rtwdev,
1071 				  struct rtw89_core_tx_request *tx_req)
1072 {
1073 	struct wiphy *wiphy = rtwdev->hw->wiphy;
1074 	struct sk_buff *skb = tx_req->skb;
1075 	struct udphdr *udphdr;
1076 
1077 	if (IEEE80211_SKB_CB(skb)->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO) {
1078 		wiphy_work_queue(wiphy, &rtwdev->btc.eapol_notify_work);
1079 		return PACKET_EAPOL;
1080 	}
1081 
1082 	if (skb->protocol == htons(ETH_P_ARP)) {
1083 		wiphy_work_queue(wiphy, &rtwdev->btc.arp_notify_work);
1084 		return PACKET_ARP;
1085 	}
1086 
1087 	if (skb->protocol == htons(ETH_P_IP) &&
1088 	    ip_hdr(skb)->protocol == IPPROTO_UDP) {
1089 		udphdr = udp_hdr(skb);
1090 		if (((udphdr->source == htons(67) && udphdr->dest == htons(68)) ||
1091 		     (udphdr->source == htons(68) && udphdr->dest == htons(67))) &&
1092 		    skb->len > 282) {
1093 			wiphy_work_queue(wiphy, &rtwdev->btc.dhcp_notify_work);
1094 			return PACKET_DHCP;
1095 		}
1096 	}
1097 
1098 	if (skb->protocol == htons(ETH_P_IP) &&
1099 	    ip_hdr(skb)->protocol == IPPROTO_ICMP) {
1100 		wiphy_work_queue(wiphy, &rtwdev->btc.icmp_notify_work);
1101 		return PACKET_ICMP;
1102 	}
1103 
1104 	return PACKET_MAX;
1105 }
1106 
1107 static void
1108 rtw89_core_tx_wake(struct rtw89_dev *rtwdev,
1109 		   struct rtw89_core_tx_request *tx_req)
1110 {
1111 	const struct rtw89_chip_info *chip = rtwdev->chip;
1112 
1113 	if (!RTW89_CHK_FW_FEATURE(TX_WAKE, &rtwdev->fw))
1114 		return;
1115 
1116 	switch (chip->chip_id) {
1117 	case RTL8852BT:
1118 		if (test_bit(RTW89_FLAG_LEISURE_PS, rtwdev->flags))
1119 			goto notify;
1120 		break;
1121 	case RTL8852C:
1122 		if (test_bit(RTW89_FLAG_LOW_POWER_MODE, rtwdev->flags))
1123 			goto notify;
1124 		break;
1125 	default:
1126 		if (test_bit(RTW89_FLAG_LOW_POWER_MODE, rtwdev->flags) &&
1127 		    tx_req->tx_type == RTW89_CORE_TX_TYPE_MGMT)
1128 			goto notify;
1129 		break;
1130 	}
1131 
1132 	return;
1133 
1134 notify:
1135 	rtw89_mac_notify_wake(rtwdev);
1136 }
1137 
1138 static void rtw89_core_tx_update_injection(struct rtw89_dev *rtwdev,
1139 					   struct rtw89_core_tx_request *tx_req,
1140 					   struct ieee80211_tx_info *info)
1141 {
1142 	const struct rtw89_hw_rate_def *hw_rate = &rtw89_hw_rate[rtwdev->chip->chip_gen];
1143 	enum mac80211_rate_control_flags flags = info->control.rates[0].flags;
1144 	struct rtw89_tx_desc_info *desc_info = &tx_req->desc_info;
1145 	const struct rtw89_chan *chan;
1146 	u8 idx = info->control.rates[0].idx;
1147 	u8 nss, mcs;
1148 
1149 	desc_info->use_rate = true;
1150 	desc_info->dis_data_fb = true;
1151 
1152 	if (flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1153 		desc_info->data_bw = 3;
1154 	else if (flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1155 		desc_info->data_bw = 2;
1156 	else if (flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1157 		desc_info->data_bw = 1;
1158 
1159 	if (flags & IEEE80211_TX_RC_SHORT_GI)
1160 		desc_info->gi_ltf = 1;
1161 
1162 	if (flags & IEEE80211_TX_RC_VHT_MCS) {
1163 		nss = umin(idx >> 4, ARRAY_SIZE(hw_rate->vht) - 1);
1164 		mcs = idx & 0xf;
1165 		desc_info->data_rate = hw_rate->vht[nss] + mcs;
1166 	} else if (flags & IEEE80211_TX_RC_MCS) {
1167 		desc_info->data_rate = hw_rate->ht + idx;
1168 	} else {
1169 		chan = rtw89_chan_get(rtwdev, tx_req->rtwvif_link->chanctx_idx);
1170 
1171 		desc_info->data_rate = idx + (chan->band_type == RTW89_BAND_2G ?
1172 					      RTW89_HW_RATE_CCK1 : RTW89_HW_RATE_OFDM6);
1173 	}
1174 }
1175 
1176 static void
1177 rtw89_core_tx_update_desc_info(struct rtw89_dev *rtwdev,
1178 			       struct rtw89_core_tx_request *tx_req)
1179 {
1180 	struct rtw89_tx_desc_info *desc_info = &tx_req->desc_info;
1181 	struct sk_buff *skb = tx_req->skb;
1182 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1183 	struct ieee80211_hdr *hdr = (void *)skb->data;
1184 	struct rtw89_addr_cam_entry *addr_cam;
1185 	enum btc_pkt_type pkt_type;
1186 	bool upd_wlan_hdr = false;
1187 	bool is_bmc;
1188 	u16 seq;
1189 
1190 	desc_info->pkt_size = skb->len;
1191 
1192 	if (unlikely(tx_req->tx_type == RTW89_CORE_TX_TYPE_FWCMD)) {
1193 		rtw89_core_tx_update_h2c_info(rtwdev, tx_req);
1194 		return;
1195 	}
1196 
1197 	tx_req->tx_type = rtw89_core_get_tx_type(rtwdev, skb);
1198 
1199 	if (tx_req->sta)
1200 		desc_info->mlo = tx_req->sta->mlo;
1201 	else if (tx_req->vif)
1202 		desc_info->mlo = ieee80211_vif_is_mld(tx_req->vif);
1203 
1204 	seq = (le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4;
1205 	addr_cam = rtw89_get_addr_cam_of(tx_req->rtwvif_link,
1206 					 tx_req->rtwsta_link);
1207 	if (addr_cam->valid && desc_info->mlo)
1208 		upd_wlan_hdr = true;
1209 
1210 	if (rtw89_is_tx_rpt_skb(rtwdev, tx_req->skb))
1211 		rtw89_tx_rpt_init(rtwdev, tx_req);
1212 
1213 	is_bmc = (is_broadcast_ether_addr(hdr->addr1) ||
1214 		  is_multicast_ether_addr(hdr->addr1));
1215 
1216 	desc_info->seq = seq;
1217 	desc_info->is_bmc = is_bmc;
1218 	desc_info->wd_page = true;
1219 	desc_info->hiq = info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM;
1220 	desc_info->upd_wlan_hdr = upd_wlan_hdr;
1221 
1222 	switch (tx_req->tx_type) {
1223 	case RTW89_CORE_TX_TYPE_MGMT:
1224 		rtw89_core_tx_update_mgmt_info(rtwdev, tx_req);
1225 		break;
1226 	case RTW89_CORE_TX_TYPE_DATA:
1227 		rtw89_core_tx_update_data_info(rtwdev, tx_req);
1228 		pkt_type = rtw89_core_tx_btc_spec_pkt_notify(rtwdev, tx_req);
1229 		rtw89_core_tx_update_he_qos_htc(rtwdev, tx_req, pkt_type);
1230 		rtw89_core_tx_update_ampdu_info(rtwdev, tx_req, pkt_type);
1231 		rtw89_core_tx_update_llc_hdr(rtwdev, desc_info, skb);
1232 		break;
1233 	default:
1234 		break;
1235 	}
1236 
1237 	if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
1238 		rtw89_core_tx_update_injection(rtwdev, tx_req, info);
1239 }
1240 
1241 static void rtw89_tx_wait_work(struct wiphy *wiphy, struct wiphy_work *work)
1242 {
1243 	struct rtw89_dev *rtwdev = container_of(work, struct rtw89_dev,
1244 						tx_wait_work.work);
1245 
1246 	rtw89_tx_wait_list_clear(rtwdev);
1247 }
1248 
1249 void rtw89_core_tx_kick_off(struct rtw89_dev *rtwdev, u8 qsel)
1250 {
1251 	u8 ch_dma;
1252 
1253 	ch_dma = rtw89_chip_get_ch_dma(rtwdev, qsel);
1254 
1255 	rtw89_hci_tx_kick_off(rtwdev, ch_dma);
1256 }
1257 
1258 int rtw89_core_tx_kick_off_and_wait(struct rtw89_dev *rtwdev, struct sk_buff *skb,
1259 				    struct rtw89_tx_wait_info *wait, int qsel,
1260 				    unsigned int timeout)
1261 {
1262 	unsigned long time_left;
1263 	int ret = 0;
1264 
1265 	lockdep_assert_wiphy(rtwdev->hw->wiphy);
1266 
1267 	rtw89_core_tx_kick_off(rtwdev, qsel);
1268 	time_left = wait_for_completion_timeout(&wait->completion,
1269 						msecs_to_jiffies(timeout));
1270 
1271 	if (time_left == 0) {
1272 		ret = -ETIMEDOUT;
1273 		list_add_tail(&wait->list, &rtwdev->tx_waits);
1274 		wiphy_delayed_work_queue(rtwdev->hw->wiphy, &rtwdev->tx_wait_work,
1275 					 RTW89_TX_WAIT_WORK_TIMEOUT);
1276 	} else {
1277 		if (!wait->tx_done)
1278 			ret = -EAGAIN;
1279 		rtw89_tx_wait_release(wait);
1280 	}
1281 
1282 	return ret;
1283 }
1284 
1285 int rtw89_h2c_tx(struct rtw89_dev *rtwdev,
1286 		 struct sk_buff *skb, bool fwdl)
1287 {
1288 	struct rtw89_core_tx_request tx_req = {0};
1289 	u32 cnt;
1290 	int ret;
1291 
1292 	if (!test_bit(RTW89_FLAG_POWERON, rtwdev->flags)) {
1293 		rtw89_debug(rtwdev, RTW89_DBG_FW,
1294 			    "ignore h2c due to power is off with firmware state=%d\n",
1295 			    test_bit(RTW89_FLAG_FW_RDY, rtwdev->flags));
1296 		dev_kfree_skb(skb);
1297 		return 0;
1298 	}
1299 
1300 	tx_req.skb = skb;
1301 	tx_req.tx_type = RTW89_CORE_TX_TYPE_FWCMD;
1302 	if (fwdl)
1303 		tx_req.desc_info.fw_dl = true;
1304 
1305 	rtw89_core_tx_update_desc_info(rtwdev, &tx_req);
1306 
1307 	if (!fwdl)
1308 		rtw89_hex_dump(rtwdev, RTW89_DBG_FW, "H2C: ", skb->data, skb->len);
1309 
1310 	cnt = rtw89_hci_check_and_reclaim_tx_resource(rtwdev, RTW89_TXCH_CH12);
1311 	if (cnt == 0) {
1312 		rtw89_err(rtwdev, "no tx fwcmd resource\n");
1313 		return -ENOSPC;
1314 	}
1315 
1316 	ret = rtw89_hci_tx_write(rtwdev, &tx_req);
1317 	if (ret) {
1318 		rtw89_err(rtwdev, "failed to transmit skb to HCI\n");
1319 		return ret;
1320 	}
1321 	rtw89_hci_tx_kick_off(rtwdev, RTW89_TXCH_CH12);
1322 
1323 	return 0;
1324 }
1325 
1326 static int rtw89_core_tx_write_link(struct rtw89_dev *rtwdev,
1327 				    struct rtw89_vif_link *rtwvif_link,
1328 				    struct rtw89_sta_link *rtwsta_link,
1329 				    struct sk_buff *skb, int *qsel, bool sw_mld,
1330 				    struct rtw89_tx_wait_info *wait)
1331 {
1332 	struct ieee80211_sta *sta = rtwsta_link_to_sta_safe(rtwsta_link);
1333 	struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
1334 	struct rtw89_tx_skb_data *skb_data = RTW89_TX_SKB_CB(skb);
1335 	struct rtw89_vif *rtwvif = rtwvif_link->rtwvif;
1336 	struct rtw89_core_tx_request tx_req = {};
1337 	int ret;
1338 
1339 	tx_req.skb = skb;
1340 	tx_req.vif = vif;
1341 	tx_req.sta = sta;
1342 	tx_req.rtwvif_link = rtwvif_link;
1343 	tx_req.rtwsta_link = rtwsta_link;
1344 	tx_req.desc_info.sw_mld = sw_mld;
1345 	rcu_assign_pointer(skb_data->wait, wait);
1346 
1347 	rtw89_traffic_stats_accu(rtwdev, rtwvif, skb, true, true);
1348 	rtw89_wow_parse_akm(rtwdev, skb);
1349 	rtw89_core_tx_update_desc_info(rtwdev, &tx_req);
1350 	rtw89_core_tx_wake(rtwdev, &tx_req);
1351 
1352 	ret = rtw89_hci_tx_write(rtwdev, &tx_req);
1353 	if (ret) {
1354 		rtw89_err(rtwdev, "failed to transmit skb to HCI\n");
1355 		return ret;
1356 	}
1357 
1358 	if (qsel)
1359 		*qsel = tx_req.desc_info.qsel;
1360 
1361 	return 0;
1362 }
1363 
1364 int rtw89_core_tx_write(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif,
1365 			struct ieee80211_sta *sta, struct sk_buff *skb, int *qsel)
1366 {
1367 	struct rtw89_sta *rtwsta = sta_to_rtwsta_safe(sta);
1368 	struct rtw89_vif *rtwvif = vif_to_rtwvif(vif);
1369 	struct rtw89_sta_link *rtwsta_link = NULL;
1370 	struct rtw89_vif_link *rtwvif_link;
1371 
1372 	if (rtwsta) {
1373 		rtwsta_link = rtw89_get_designated_link(rtwsta);
1374 		if (unlikely(!rtwsta_link)) {
1375 			rtw89_err(rtwdev, "tx: find no sta designated link\n");
1376 			return -ENOLINK;
1377 		}
1378 
1379 		rtwvif_link = rtwsta_link->rtwvif_link;
1380 	} else {
1381 		rtwvif_link = rtw89_get_designated_link(rtwvif);
1382 		if (unlikely(!rtwvif_link)) {
1383 			rtw89_err(rtwdev, "tx: find no vif designated link\n");
1384 			return -ENOLINK;
1385 		}
1386 	}
1387 
1388 	return rtw89_core_tx_write_link(rtwdev, rtwvif_link, rtwsta_link, skb, qsel, false,
1389 					NULL);
1390 }
1391 
1392 static __le32 rtw89_build_txwd_body0(struct rtw89_tx_desc_info *desc_info)
1393 {
1394 	u32 dword = FIELD_PREP(RTW89_TXWD_BODY0_WP_OFFSET, desc_info->wp_offset) |
1395 		    FIELD_PREP(RTW89_TXWD_BODY0_WD_INFO_EN, desc_info->en_wd_info) |
1396 		    FIELD_PREP(RTW89_TXWD_BODY0_CHANNEL_DMA, desc_info->ch_dma) |
1397 		    FIELD_PREP(RTW89_TXWD_BODY0_HDR_LLC_LEN, desc_info->hdr_llc_len) |
1398 		    FIELD_PREP(RTW89_TXWD_BODY0_WD_PAGE, desc_info->wd_page) |
1399 		    FIELD_PREP(RTW89_TXWD_BODY0_FW_DL, desc_info->fw_dl) |
1400 		    FIELD_PREP(RTW89_TXWD_BODY0_HW_SSN_SEL, desc_info->hw_ssn_sel) |
1401 		    FIELD_PREP(RTW89_TXWD_BODY0_HW_SSN_MODE, desc_info->hw_seq_mode);
1402 
1403 	return cpu_to_le32(dword);
1404 }
1405 
1406 static __le32 rtw89_build_txwd_body0_v1(struct rtw89_tx_desc_info *desc_info)
1407 {
1408 	u32 dword = FIELD_PREP(RTW89_TXWD_BODY0_WP_OFFSET_V1, desc_info->wp_offset) |
1409 		    FIELD_PREP(RTW89_TXWD_BODY0_WD_INFO_EN, desc_info->en_wd_info) |
1410 		    FIELD_PREP(RTW89_TXWD_BODY0_CHANNEL_DMA, desc_info->ch_dma) |
1411 		    FIELD_PREP(RTW89_TXWD_BODY0_HDR_LLC_LEN, desc_info->hdr_llc_len) |
1412 		    FIELD_PREP(RTW89_TXWD_BODY0_WD_PAGE, desc_info->wd_page) |
1413 		    FIELD_PREP(RTW89_TXWD_BODY0_FW_DL, desc_info->fw_dl);
1414 
1415 	return cpu_to_le32(dword);
1416 }
1417 
1418 static __le32 rtw89_build_txwd_body1_v1(struct rtw89_tx_desc_info *desc_info)
1419 {
1420 	u32 dword = FIELD_PREP(RTW89_TXWD_BODY1_ADDR_INFO_NUM, desc_info->addr_info_nr) |
1421 		    FIELD_PREP(RTW89_TXWD_BODY1_SEC_KEYID, desc_info->sec_keyid) |
1422 		    FIELD_PREP(RTW89_TXWD_BODY1_SEC_TYPE, desc_info->sec_type);
1423 
1424 	return cpu_to_le32(dword);
1425 }
1426 
1427 static __le32 rtw89_build_txwd_body2(struct rtw89_tx_desc_info *desc_info)
1428 {
1429 	u32 dword = FIELD_PREP(RTW89_TXWD_BODY2_TID_INDICATE, desc_info->tid_indicate) |
1430 		    FIELD_PREP(RTW89_TXWD_BODY2_QSEL, desc_info->qsel) |
1431 		    FIELD_PREP(RTW89_TXWD_BODY2_TXPKT_SIZE, desc_info->pkt_size) |
1432 		    FIELD_PREP(RTW89_TXWD_BODY2_MACID, desc_info->mac_id);
1433 
1434 	return cpu_to_le32(dword);
1435 }
1436 
1437 static __le32 rtw89_build_txwd_body3(struct rtw89_tx_desc_info *desc_info)
1438 {
1439 	u32 dword = FIELD_PREP(RTW89_TXWD_BODY3_SW_SEQ, desc_info->seq) |
1440 		    FIELD_PREP(RTW89_TXWD_BODY3_AGG_EN, desc_info->agg_en) |
1441 		    FIELD_PREP(RTW89_TXWD_BODY3_BK, desc_info->bk);
1442 
1443 	return cpu_to_le32(dword);
1444 }
1445 
1446 static __le32 rtw89_build_txwd_body4(struct rtw89_tx_desc_info *desc_info)
1447 {
1448 	u32 dword = FIELD_PREP(RTW89_TXWD_BODY4_SEC_IV_L0, desc_info->sec_seq[0]) |
1449 		    FIELD_PREP(RTW89_TXWD_BODY4_SEC_IV_L1, desc_info->sec_seq[1]);
1450 
1451 	return cpu_to_le32(dword);
1452 }
1453 
1454 static __le32 rtw89_build_txwd_body5(struct rtw89_tx_desc_info *desc_info)
1455 {
1456 	u32 dword = FIELD_PREP(RTW89_TXWD_BODY5_SEC_IV_H2, desc_info->sec_seq[2]) |
1457 		    FIELD_PREP(RTW89_TXWD_BODY5_SEC_IV_H3, desc_info->sec_seq[3]) |
1458 		    FIELD_PREP(RTW89_TXWD_BODY5_SEC_IV_H4, desc_info->sec_seq[4]) |
1459 		    FIELD_PREP(RTW89_TXWD_BODY5_SEC_IV_H5, desc_info->sec_seq[5]);
1460 
1461 	return cpu_to_le32(dword);
1462 }
1463 
1464 static __le32 rtw89_build_txwd_body7_v1(struct rtw89_tx_desc_info *desc_info)
1465 {
1466 	u32 dword = FIELD_PREP(RTW89_TXWD_BODY7_USE_RATE_V1, desc_info->use_rate) |
1467 		    FIELD_PREP(RTW89_TXWD_BODY7_DATA_BW, desc_info->data_bw) |
1468 		    FIELD_PREP(RTW89_TXWD_BODY7_GI_LTF, desc_info->gi_ltf) |
1469 		    FIELD_PREP(RTW89_TXWD_BODY7_DATA_RATE, desc_info->data_rate);
1470 
1471 	return cpu_to_le32(dword);
1472 }
1473 
1474 static __le32 rtw89_build_txwd_info0(struct rtw89_tx_desc_info *desc_info)
1475 {
1476 	u32 dword = FIELD_PREP(RTW89_TXWD_INFO0_USE_RATE, desc_info->use_rate) |
1477 		    FIELD_PREP(RTW89_TXWD_INFO0_DATA_BW, desc_info->data_bw) |
1478 		    FIELD_PREP(RTW89_TXWD_INFO0_GI_LTF, desc_info->gi_ltf) |
1479 		    FIELD_PREP(RTW89_TXWD_INFO0_DATA_RATE, desc_info->data_rate) |
1480 		    FIELD_PREP(RTW89_TXWD_INFO0_DATA_STBC, desc_info->stbc) |
1481 		    FIELD_PREP(RTW89_TXWD_INFO0_DATA_LDPC, desc_info->ldpc) |
1482 		    FIELD_PREP(RTW89_TXWD_INFO0_DISDATAFB, desc_info->dis_data_fb) |
1483 		    FIELD_PREP(RTW89_TXWD_INFO0_MULTIPORT_ID, desc_info->port);
1484 
1485 	return cpu_to_le32(dword);
1486 }
1487 
1488 static __le32 rtw89_build_txwd_info0_v1(struct rtw89_tx_desc_info *desc_info)
1489 {
1490 	u32 dword = FIELD_PREP(RTW89_TXWD_INFO0_DATA_STBC, desc_info->stbc) |
1491 		    FIELD_PREP(RTW89_TXWD_INFO0_DATA_LDPC, desc_info->ldpc) |
1492 		    FIELD_PREP(RTW89_TXWD_INFO0_DISDATAFB, desc_info->dis_data_fb) |
1493 		    FIELD_PREP(RTW89_TXWD_INFO0_MULTIPORT_ID, desc_info->port) |
1494 		    FIELD_PREP(RTW89_TXWD_INFO0_DATA_ER, desc_info->er_cap) |
1495 		    FIELD_PREP(RTW89_TXWD_INFO0_DATA_BW_ER, 0);
1496 
1497 	return cpu_to_le32(dword);
1498 }
1499 
1500 static __le32 rtw89_build_txwd_info1(struct rtw89_tx_desc_info *desc_info)
1501 {
1502 	u32 dword = FIELD_PREP(RTW89_TXWD_INFO1_MAX_AGGNUM, desc_info->ampdu_num) |
1503 		    FIELD_PREP(RTW89_TXWD_INFO1_A_CTRL_BSR, desc_info->a_ctrl_bsr) |
1504 		    FIELD_PREP(RTW89_TXWD_INFO1_DATA_RTY_LOWEST_RATE,
1505 			       desc_info->data_retry_lowest_rate) |
1506 		    FIELD_PREP(RTW89_TXWD_INFO1_DATA_TXCNT_LMT_SEL,
1507 			       desc_info->tx_cnt_lmt_en) |
1508 		    FIELD_PREP(RTW89_TXWD_INFO1_DATA_TXCNT_LMT, desc_info->tx_cnt_lmt);
1509 
1510 	return cpu_to_le32(dword);
1511 }
1512 
1513 static __le32 rtw89_build_txwd_info2(struct rtw89_tx_desc_info *desc_info)
1514 {
1515 	u32 dword = FIELD_PREP(RTW89_TXWD_INFO2_AMPDU_DENSITY, desc_info->ampdu_density) |
1516 		    FIELD_PREP(RTW89_TXWD_INFO2_SEC_TYPE, desc_info->sec_type) |
1517 		    FIELD_PREP(RTW89_TXWD_INFO2_SEC_HW_ENC, desc_info->sec_en) |
1518 		    FIELD_PREP(RTW89_TXWD_INFO2_SEC_CAM_IDX, desc_info->sec_cam_idx);
1519 
1520 	return cpu_to_le32(dword);
1521 }
1522 
1523 static __le32 rtw89_build_txwd_info2_v1(struct rtw89_tx_desc_info *desc_info)
1524 {
1525 	u32 dword = FIELD_PREP(RTW89_TXWD_INFO2_AMPDU_DENSITY, desc_info->ampdu_density) |
1526 		    FIELD_PREP(RTW89_TXWD_INFO2_FORCE_KEY_EN, desc_info->sec_en) |
1527 		    FIELD_PREP(RTW89_TXWD_INFO2_SEC_CAM_IDX, desc_info->sec_cam_idx);
1528 
1529 	return cpu_to_le32(dword);
1530 }
1531 
1532 static __le32 rtw89_build_txwd_info3(struct rtw89_tx_desc_info *desc_info)
1533 {
1534 	u32 dword = FIELD_PREP(RTW89_TXWD_INFO3_SPE_RPT, desc_info->report);
1535 
1536 	return cpu_to_le32(dword);
1537 }
1538 
1539 static __le32 rtw89_build_txwd_info4(struct rtw89_tx_desc_info *desc_info)
1540 {
1541 	bool rts_en = !desc_info->is_bmc;
1542 	u32 dword = FIELD_PREP(RTW89_TXWD_INFO4_RTS_EN, rts_en) |
1543 		    FIELD_PREP(RTW89_TXWD_INFO4_HW_RTS_EN, 1) |
1544 		    FIELD_PREP(RTW89_TXWD_INFO4_SW_DEFINE, desc_info->sn);
1545 
1546 	return cpu_to_le32(dword);
1547 }
1548 
1549 void rtw89_core_fill_txdesc(struct rtw89_dev *rtwdev,
1550 			    struct rtw89_tx_desc_info *desc_info,
1551 			    void *txdesc)
1552 {
1553 	struct rtw89_txwd_body *txwd_body = (struct rtw89_txwd_body *)txdesc;
1554 	struct rtw89_txwd_info *txwd_info;
1555 
1556 	txwd_body->dword0 = rtw89_build_txwd_body0(desc_info);
1557 	txwd_body->dword2 = rtw89_build_txwd_body2(desc_info);
1558 	txwd_body->dword3 = rtw89_build_txwd_body3(desc_info);
1559 
1560 	if (!desc_info->en_wd_info)
1561 		return;
1562 
1563 	txwd_info = (struct rtw89_txwd_info *)(txwd_body + 1);
1564 	txwd_info->dword0 = rtw89_build_txwd_info0(desc_info);
1565 	txwd_info->dword1 = rtw89_build_txwd_info1(desc_info);
1566 	txwd_info->dword2 = rtw89_build_txwd_info2(desc_info);
1567 	txwd_info->dword3 = rtw89_build_txwd_info3(desc_info);
1568 	txwd_info->dword4 = rtw89_build_txwd_info4(desc_info);
1569 
1570 }
1571 EXPORT_SYMBOL(rtw89_core_fill_txdesc);
1572 
1573 void rtw89_core_fill_txdesc_v1(struct rtw89_dev *rtwdev,
1574 			       struct rtw89_tx_desc_info *desc_info,
1575 			       void *txdesc)
1576 {
1577 	struct rtw89_txwd_body_v1 *txwd_body = (struct rtw89_txwd_body_v1 *)txdesc;
1578 	struct rtw89_txwd_info *txwd_info;
1579 
1580 	txwd_body->dword0 = rtw89_build_txwd_body0_v1(desc_info);
1581 	txwd_body->dword1 = rtw89_build_txwd_body1_v1(desc_info);
1582 	txwd_body->dword2 = rtw89_build_txwd_body2(desc_info);
1583 	txwd_body->dword3 = rtw89_build_txwd_body3(desc_info);
1584 	if (desc_info->sec_en) {
1585 		txwd_body->dword4 = rtw89_build_txwd_body4(desc_info);
1586 		txwd_body->dword5 = rtw89_build_txwd_body5(desc_info);
1587 	}
1588 	txwd_body->dword7 = rtw89_build_txwd_body7_v1(desc_info);
1589 
1590 	if (!desc_info->en_wd_info)
1591 		return;
1592 
1593 	txwd_info = (struct rtw89_txwd_info *)(txwd_body + 1);
1594 	txwd_info->dword0 = rtw89_build_txwd_info0_v1(desc_info);
1595 	txwd_info->dword1 = rtw89_build_txwd_info1(desc_info);
1596 	txwd_info->dword2 = rtw89_build_txwd_info2_v1(desc_info);
1597 	txwd_info->dword3 = rtw89_build_txwd_info3(desc_info);
1598 	txwd_info->dword4 = rtw89_build_txwd_info4(desc_info);
1599 }
1600 EXPORT_SYMBOL(rtw89_core_fill_txdesc_v1);
1601 
1602 static __le32 rtw89_build_txwd_body0_v2(struct rtw89_tx_desc_info *desc_info)
1603 {
1604 	u32 dword = FIELD_PREP(BE_TXD_BODY0_WP_OFFSET_V1, desc_info->wp_offset) |
1605 		    FIELD_PREP(BE_TXD_BODY0_WDINFO_EN, desc_info->en_wd_info) |
1606 		    FIELD_PREP(BE_TXD_BODY0_CH_DMA, desc_info->ch_dma) |
1607 		    FIELD_PREP(BE_TXD_BODY0_HDR_LLC_LEN, desc_info->hdr_llc_len) |
1608 		    FIELD_PREP(BE_TXD_BODY0_WD_PAGE, desc_info->wd_page);
1609 
1610 	return cpu_to_le32(dword);
1611 }
1612 
1613 static __le32 rtw89_build_txwd_body1_v2(struct rtw89_tx_desc_info *desc_info)
1614 {
1615 	u32 dword = FIELD_PREP(BE_TXD_BODY1_ADDR_INFO_NUM, desc_info->addr_info_nr) |
1616 		    FIELD_PREP(BE_TXD_BODY1_SEC_KEYID, desc_info->sec_keyid) |
1617 		    FIELD_PREP(BE_TXD_BODY1_SEC_TYPE, desc_info->sec_type);
1618 
1619 	return cpu_to_le32(dword);
1620 }
1621 
1622 static __le32 rtw89_build_txwd_body2_v2(struct rtw89_tx_desc_info *desc_info)
1623 {
1624 	u32 dword = FIELD_PREP(BE_TXD_BODY2_TID_IND, desc_info->tid_indicate) |
1625 		    FIELD_PREP(BE_TXD_BODY2_QSEL, desc_info->qsel) |
1626 		    FIELD_PREP(BE_TXD_BODY2_TXPKTSIZE, desc_info->pkt_size) |
1627 		    FIELD_PREP(BE_TXD_BODY2_AGG_EN, desc_info->agg_en) |
1628 		    FIELD_PREP(BE_TXD_BODY2_BK, desc_info->bk) |
1629 		    FIELD_PREP(BE_TXD_BODY2_MACID, desc_info->mac_id);
1630 
1631 	return cpu_to_le32(dword);
1632 }
1633 
1634 static __le32 rtw89_build_txwd_body3_v2(struct rtw89_tx_desc_info *desc_info)
1635 {
1636 	u32 dword = FIELD_PREP(BE_TXD_BODY3_WIFI_SEQ, desc_info->seq) |
1637 		    FIELD_PREP(BE_TXD_BODY3_MLO_FLAG, desc_info->mlo) |
1638 		    FIELD_PREP(BE_TXD_BODY3_IS_MLD_SW_EN, desc_info->sw_mld);
1639 
1640 	return cpu_to_le32(dword);
1641 }
1642 
1643 static __le32 rtw89_build_txwd_body4_v2(struct rtw89_tx_desc_info *desc_info)
1644 {
1645 	u32 dword = FIELD_PREP(BE_TXD_BODY4_SEC_IV_L0, desc_info->sec_seq[0]) |
1646 		    FIELD_PREP(BE_TXD_BODY4_SEC_IV_L1, desc_info->sec_seq[1]);
1647 
1648 	return cpu_to_le32(dword);
1649 }
1650 
1651 static __le32 rtw89_build_txwd_body5_v2(struct rtw89_tx_desc_info *desc_info)
1652 {
1653 	u32 dword = FIELD_PREP(BE_TXD_BODY5_SEC_IV_H2, desc_info->sec_seq[2]) |
1654 		    FIELD_PREP(BE_TXD_BODY5_SEC_IV_H3, desc_info->sec_seq[3]) |
1655 		    FIELD_PREP(BE_TXD_BODY5_SEC_IV_H4, desc_info->sec_seq[4]) |
1656 		    FIELD_PREP(BE_TXD_BODY5_SEC_IV_H5, desc_info->sec_seq[5]);
1657 
1658 	return cpu_to_le32(dword);
1659 }
1660 
1661 static __le32 rtw89_build_txwd_body6_v2(struct rtw89_tx_desc_info *desc_info)
1662 {
1663 	u32 dword = FIELD_PREP(BE_TXD_BODY6_UPD_WLAN_HDR, desc_info->upd_wlan_hdr);
1664 
1665 	return cpu_to_le32(dword);
1666 }
1667 
1668 static __le32 rtw89_build_txwd_body7_v2(struct rtw89_tx_desc_info *desc_info)
1669 {
1670 	u32 dword = FIELD_PREP(BE_TXD_BODY7_USERATE_SEL, desc_info->use_rate) |
1671 		    FIELD_PREP(BE_TXD_BODY7_DATA_BW, desc_info->data_bw) |
1672 		    FIELD_PREP(BE_TXD_BODY7_GI_LTF, desc_info->gi_ltf) |
1673 		    FIELD_PREP(BE_TXD_BODY7_DATA_ER, desc_info->er_cap) |
1674 		    FIELD_PREP(BE_TXD_BODY7_DATA_BW_ER, 0) |
1675 		    FIELD_PREP(BE_TXD_BODY7_DATARATE, desc_info->data_rate);
1676 
1677 	return cpu_to_le32(dword);
1678 }
1679 
1680 static __le32 rtw89_build_txwd_info0_v2(struct rtw89_tx_desc_info *desc_info)
1681 {
1682 	u32 dword = FIELD_PREP(BE_TXD_INFO0_DATA_STBC, desc_info->stbc) |
1683 		    FIELD_PREP(BE_TXD_INFO0_DATA_LDPC, desc_info->ldpc) |
1684 		    FIELD_PREP(BE_TXD_INFO0_DISDATAFB, desc_info->dis_data_fb) |
1685 		    FIELD_PREP(BE_TXD_INFO0_MULTIPORT_ID, desc_info->port) |
1686 		    FIELD_PREP(BE_TXD_INFO0_DATA_TXCNT_LMT_SEL,
1687 			       desc_info->tx_cnt_lmt_en) |
1688 		    FIELD_PREP(BE_TXD_INFO0_DATA_TXCNT_LMT, desc_info->tx_cnt_lmt);
1689 
1690 	return cpu_to_le32(dword);
1691 }
1692 
1693 static __le32 rtw89_build_txwd_info1_v2(struct rtw89_tx_desc_info *desc_info)
1694 {
1695 	u32 dword = FIELD_PREP(BE_TXD_INFO1_MAX_AGG_NUM, desc_info->ampdu_num) |
1696 		    FIELD_PREP(BE_TXD_INFO1_A_CTRL_BSR, desc_info->a_ctrl_bsr) |
1697 		    FIELD_PREP(BE_TXD_INFO1_DATA_RTY_LOWEST_RATE,
1698 			       desc_info->data_retry_lowest_rate) |
1699 		    FIELD_PREP(BE_TXD_INFO1_SW_DEFINE, desc_info->sn);
1700 
1701 	return cpu_to_le32(dword);
1702 }
1703 
1704 static __le32 rtw89_build_txwd_info2_v2(struct rtw89_tx_desc_info *desc_info)
1705 {
1706 	u32 dword = FIELD_PREP(BE_TXD_INFO2_AMPDU_DENSITY, desc_info->ampdu_density) |
1707 		    FIELD_PREP(BE_TXD_INFO2_FORCE_KEY_EN, desc_info->sec_en) |
1708 		    FIELD_PREP(BE_TXD_INFO2_SEC_CAM_IDX, desc_info->sec_cam_idx) |
1709 		    FIELD_PREP(BE_TXD_INFO2_SPE_RPT_V1, desc_info->report);
1710 
1711 	return cpu_to_le32(dword);
1712 }
1713 
1714 static __le32 rtw89_build_txwd_info4_v2(struct rtw89_tx_desc_info *desc_info)
1715 {
1716 	bool rts_en = !desc_info->is_bmc;
1717 	u32 dword = FIELD_PREP(BE_TXD_INFO4_RTS_EN, rts_en) |
1718 		    FIELD_PREP(BE_TXD_INFO4_HW_RTS_EN, 1);
1719 
1720 	return cpu_to_le32(dword);
1721 }
1722 
1723 void rtw89_core_fill_txdesc_v2(struct rtw89_dev *rtwdev,
1724 			       struct rtw89_tx_desc_info *desc_info,
1725 			       void *txdesc)
1726 {
1727 	struct rtw89_txwd_body_v2 *txwd_body = txdesc;
1728 	struct rtw89_txwd_info_v2 *txwd_info;
1729 
1730 	txwd_body->dword0 = rtw89_build_txwd_body0_v2(desc_info);
1731 	txwd_body->dword1 = rtw89_build_txwd_body1_v2(desc_info);
1732 	txwd_body->dword2 = rtw89_build_txwd_body2_v2(desc_info);
1733 	txwd_body->dword3 = rtw89_build_txwd_body3_v2(desc_info);
1734 	if (desc_info->sec_en) {
1735 		txwd_body->dword4 = rtw89_build_txwd_body4_v2(desc_info);
1736 		txwd_body->dword5 = rtw89_build_txwd_body5_v2(desc_info);
1737 	}
1738 	txwd_body->dword6 = rtw89_build_txwd_body6_v2(desc_info);
1739 	txwd_body->dword7 = rtw89_build_txwd_body7_v2(desc_info);
1740 
1741 	if (!desc_info->en_wd_info)
1742 		return;
1743 
1744 	txwd_info = (struct rtw89_txwd_info_v2 *)(txwd_body + 1);
1745 	txwd_info->dword0 = rtw89_build_txwd_info0_v2(desc_info);
1746 	txwd_info->dword1 = rtw89_build_txwd_info1_v2(desc_info);
1747 	txwd_info->dword2 = rtw89_build_txwd_info2_v2(desc_info);
1748 	txwd_info->dword4 = rtw89_build_txwd_info4_v2(desc_info);
1749 }
1750 EXPORT_SYMBOL(rtw89_core_fill_txdesc_v2);
1751 
1752 static __le32 rtw89_build_txwd_fwcmd0_v1(struct rtw89_tx_desc_info *desc_info)
1753 {
1754 	u32 dword = FIELD_PREP(AX_RXD_RPKT_LEN_MASK, desc_info->pkt_size) |
1755 		    FIELD_PREP(AX_RXD_RPKT_TYPE_MASK, desc_info->fw_dl ?
1756 						      RTW89_CORE_RX_TYPE_FWDL :
1757 						      RTW89_CORE_RX_TYPE_H2C);
1758 
1759 	return cpu_to_le32(dword);
1760 }
1761 
1762 void rtw89_core_fill_txdesc_fwcmd_v1(struct rtw89_dev *rtwdev,
1763 				     struct rtw89_tx_desc_info *desc_info,
1764 				     void *txdesc)
1765 {
1766 	struct rtw89_rxdesc_short *txwd_v1 = (struct rtw89_rxdesc_short *)txdesc;
1767 
1768 	txwd_v1->dword0 = rtw89_build_txwd_fwcmd0_v1(desc_info);
1769 }
1770 EXPORT_SYMBOL(rtw89_core_fill_txdesc_fwcmd_v1);
1771 
1772 static __le32 rtw89_build_txwd_fwcmd0_v2(struct rtw89_tx_desc_info *desc_info)
1773 {
1774 	u32 dword = FIELD_PREP(BE_RXD_RPKT_LEN_MASK, desc_info->pkt_size) |
1775 		    FIELD_PREP(BE_RXD_RPKT_TYPE_MASK, desc_info->fw_dl ?
1776 						      RTW89_CORE_RX_TYPE_FWDL :
1777 						      RTW89_CORE_RX_TYPE_H2C);
1778 
1779 	return cpu_to_le32(dword);
1780 }
1781 
1782 void rtw89_core_fill_txdesc_fwcmd_v2(struct rtw89_dev *rtwdev,
1783 				     struct rtw89_tx_desc_info *desc_info,
1784 				     void *txdesc)
1785 {
1786 	struct rtw89_rxdesc_short_v2 *txwd_v2 = (struct rtw89_rxdesc_short_v2 *)txdesc;
1787 
1788 	txwd_v2->dword0 = rtw89_build_txwd_fwcmd0_v2(desc_info);
1789 }
1790 EXPORT_SYMBOL(rtw89_core_fill_txdesc_fwcmd_v2);
1791 
1792 static int rtw89_core_rx_process_mac_ppdu(struct rtw89_dev *rtwdev,
1793 					  struct sk_buff *skb,
1794 					  struct rtw89_rx_phy_ppdu *phy_ppdu)
1795 {
1796 	const struct rtw89_chip_info *chip = rtwdev->chip;
1797 	const struct rtw89_rxinfo *rxinfo = (const struct rtw89_rxinfo *)skb->data;
1798 	const struct rtw89_rxinfo_user *user;
1799 	enum rtw89_chip_gen chip_gen = rtwdev->chip->chip_gen;
1800 	int rx_cnt_size = RTW89_PPDU_MAC_RX_CNT_SIZE;
1801 	bool rx_cnt_valid = false;
1802 	bool invalid = false;
1803 	u8 plcp_size = 0;
1804 	u8 *phy_sts;
1805 	u8 usr_num;
1806 	int i;
1807 
1808 	if (chip_gen == RTW89_CHIP_BE) {
1809 		invalid = le32_get_bits(rxinfo->w0, RTW89_RXINFO_W0_INVALID_V1);
1810 		rx_cnt_size = RTW89_PPDU_MAC_RX_CNT_SIZE_V1;
1811 	}
1812 
1813 	if (invalid)
1814 		return -EINVAL;
1815 
1816 	rx_cnt_valid = le32_get_bits(rxinfo->w0, RTW89_RXINFO_W0_RX_CNT_VLD);
1817 	if (chip_gen == RTW89_CHIP_BE) {
1818 		plcp_size = le32_get_bits(rxinfo->w0, RTW89_RXINFO_W0_PLCP_LEN_V1) << 3;
1819 		usr_num = le32_get_bits(rxinfo->w0, RTW89_RXINFO_W0_USR_NUM_V1);
1820 	} else {
1821 		plcp_size = le32_get_bits(rxinfo->w1, RTW89_RXINFO_W1_PLCP_LEN) << 3;
1822 		usr_num = le32_get_bits(rxinfo->w0, RTW89_RXINFO_W0_USR_NUM);
1823 	}
1824 	if (usr_num > chip->ppdu_max_usr) {
1825 		rtw89_warn(rtwdev, "Invalid user number (%d) in mac info\n",
1826 			   usr_num);
1827 		return -EINVAL;
1828 	}
1829 
1830 	for (i = 0; i < usr_num; i++) {
1831 		user = &rxinfo->user[i];
1832 		if (!le32_get_bits(user->w0, RTW89_RXINFO_USER_MAC_ID_VALID))
1833 			continue;
1834 		/* For WiFi 7 chips, RXWD.mac_id of PPDU status is not set
1835 		 * by hardware, so update mac_id by rxinfo_user[].mac_id.
1836 		 */
1837 		if (chip->chip_id == RTL8922A)
1838 			phy_ppdu->mac_id =
1839 				le32_get_bits(user->w0, RTW89_RXINFO_USER_MACID);
1840 		else if (chip->chip_id == RTL8922D)
1841 			phy_ppdu->mac_id =
1842 				le32_get_bits(user->w0, RTW89_RXINFO_USER_MACID_V1);
1843 
1844 		phy_ppdu->has_data =
1845 			le32_get_bits(user->w0, RTW89_RXINFO_USER_DATA);
1846 		phy_ppdu->has_bcn =
1847 			le32_get_bits(user->w0, RTW89_RXINFO_USER_BCN);
1848 		break;
1849 	}
1850 
1851 	phy_sts = skb->data + RTW89_PPDU_MAC_INFO_SIZE;
1852 	phy_sts += usr_num * RTW89_PPDU_MAC_INFO_USR_SIZE;
1853 	/* 8-byte alignment */
1854 	if (usr_num & BIT(0))
1855 		phy_sts += RTW89_PPDU_MAC_INFO_USR_SIZE;
1856 	if (rx_cnt_valid)
1857 		phy_sts += rx_cnt_size;
1858 	phy_sts += plcp_size;
1859 
1860 	if (phy_sts > skb->data + skb->len)
1861 		return -EINVAL;
1862 
1863 	phy_ppdu->buf = phy_sts;
1864 	phy_ppdu->len = skb->data + skb->len - phy_sts;
1865 
1866 	return 0;
1867 }
1868 
1869 static u8 rtw89_get_data_rate_nss(struct rtw89_dev *rtwdev, u16 data_rate)
1870 {
1871 	u8 data_rate_mode;
1872 
1873 	data_rate_mode = rtw89_get_data_rate_mode(rtwdev, data_rate);
1874 	switch (data_rate_mode) {
1875 	case DATA_RATE_MODE_NON_HT:
1876 		return 1;
1877 	case DATA_RATE_MODE_HT:
1878 		return rtw89_get_data_ht_nss(rtwdev, data_rate) + 1;
1879 	case DATA_RATE_MODE_VHT:
1880 	case DATA_RATE_MODE_HE:
1881 	case DATA_RATE_MODE_EHT:
1882 		return rtw89_get_data_nss(rtwdev, data_rate) + 1;
1883 	default:
1884 		rtw89_warn(rtwdev, "invalid RX rate mode %d\n", data_rate_mode);
1885 		return 0;
1886 	}
1887 }
1888 
1889 static void rtw89_core_rx_process_phy_ppdu_iter(void *data,
1890 						struct ieee80211_sta *sta)
1891 {
1892 	struct rtw89_rx_phy_ppdu *phy_ppdu = (struct rtw89_rx_phy_ppdu *)data;
1893 	struct rtw89_sta *rtwsta = sta_to_rtwsta(sta);
1894 	struct rtw89_dev *rtwdev = rtwsta->rtwdev;
1895 	struct rtw89_hal *hal = &rtwdev->hal;
1896 	struct rtw89_sta_link *rtwsta_link;
1897 	u8 ant_num = hal->ant_diversity ? 2 : rtwdev->chip->rf_path_num;
1898 	u8 ant_pos = U8_MAX;
1899 	u8 evm_pos = 0;
1900 	int i;
1901 
1902 	rtwsta_link = rtw89_sta_get_link_inst(rtwsta, phy_ppdu->phy_idx);
1903 	if (unlikely(!rtwsta_link))
1904 		return;
1905 
1906 	if (rtwsta_link->mac_id != phy_ppdu->mac_id || !phy_ppdu->to_self)
1907 		return;
1908 
1909 	if (hal->ant_diversity && hal->antenna_rx) {
1910 		ant_pos = __ffs(hal->antenna_rx);
1911 		evm_pos = ant_pos;
1912 	}
1913 
1914 	ewma_rssi_add(&rtwsta_link->avg_rssi, phy_ppdu->rssi_avg);
1915 
1916 	if (ant_pos < ant_num) {
1917 		ewma_rssi_add(&rtwsta_link->rssi[ant_pos], phy_ppdu->rssi[0]);
1918 	} else {
1919 		for (i = 0; i < rtwdev->chip->rf_path_num; i++)
1920 			ewma_rssi_add(&rtwsta_link->rssi[i], phy_ppdu->rssi[i]);
1921 	}
1922 
1923 	if (phy_ppdu->ofdm.has && (phy_ppdu->has_data || phy_ppdu->has_bcn)) {
1924 		ewma_snr_add(&rtwsta_link->avg_snr, phy_ppdu->ofdm.avg_snr);
1925 		if (rtw89_get_data_rate_nss(rtwdev, phy_ppdu->rate) == 1) {
1926 			ewma_evm_add(&rtwsta_link->evm_1ss, phy_ppdu->ofdm.evm_min);
1927 		} else {
1928 			ewma_evm_add(&rtwsta_link->evm_min[evm_pos],
1929 				     phy_ppdu->ofdm.evm_min);
1930 			ewma_evm_add(&rtwsta_link->evm_max[evm_pos],
1931 				     phy_ppdu->ofdm.evm_max);
1932 		}
1933 	}
1934 }
1935 
1936 #define VAR_LEN 0xff
1937 #define VAR_LEN_UNIT 8
1938 static u16 rtw89_core_get_phy_status_ie_len(struct rtw89_dev *rtwdev,
1939 					    const struct rtw89_phy_sts_iehdr *iehdr)
1940 {
1941 	static const u8 physts_ie_len_tabs[RTW89_CHIP_GEN_NUM][32] = {
1942 		[RTW89_CHIP_AX] = {
1943 			16, 32, 24, 24, 8, 8, 8, 8, VAR_LEN, 8, VAR_LEN, 176, VAR_LEN,
1944 			VAR_LEN, VAR_LEN, VAR_LEN, VAR_LEN, VAR_LEN, 16, 24, VAR_LEN,
1945 			VAR_LEN, VAR_LEN, 0, 24, 24, 24, 24, 32, 32, 32, 32
1946 		},
1947 		[RTW89_CHIP_BE] = {
1948 			32, 40, 24, 24, 8, 8, 8, 8, VAR_LEN, 8, VAR_LEN, 176, VAR_LEN,
1949 			VAR_LEN, VAR_LEN, VAR_LEN, VAR_LEN, VAR_LEN, 88, 56, VAR_LEN,
1950 			VAR_LEN, VAR_LEN, 0, 24, 24, 24, 24, 32, 32, 32, 32
1951 		},
1952 	};
1953 	const u8 *physts_ie_len_tab;
1954 	u16 ie_len;
1955 	u8 ie;
1956 
1957 	physts_ie_len_tab = physts_ie_len_tabs[rtwdev->chip->chip_gen];
1958 
1959 	ie = le32_get_bits(iehdr->w0, RTW89_PHY_STS_IEHDR_TYPE);
1960 	if (physts_ie_len_tab[ie] != VAR_LEN)
1961 		ie_len = physts_ie_len_tab[ie];
1962 	else
1963 		ie_len = le32_get_bits(iehdr->w0, RTW89_PHY_STS_IEHDR_LEN) * VAR_LEN_UNIT;
1964 
1965 	return ie_len;
1966 }
1967 
1968 static void rtw89_core_parse_phy_status_ie01_v2(struct rtw89_dev *rtwdev,
1969 						const struct rtw89_phy_sts_iehdr *iehdr,
1970 						struct rtw89_rx_phy_ppdu *phy_ppdu)
1971 {
1972 	const struct rtw89_phy_sts_ie01_v2 *ie;
1973 	u8 *rpl_fd = phy_ppdu->rpl_fd;
1974 
1975 	ie = (const struct rtw89_phy_sts_ie01_v2 *)iehdr;
1976 	rpl_fd[RF_PATH_A] = le32_get_bits(ie->w8, RTW89_PHY_STS_IE01_V2_W8_RPL_FD_A);
1977 	rpl_fd[RF_PATH_B] = le32_get_bits(ie->w8, RTW89_PHY_STS_IE01_V2_W8_RPL_FD_B);
1978 	rpl_fd[RF_PATH_C] = le32_get_bits(ie->w9, RTW89_PHY_STS_IE01_V2_W9_RPL_FD_C);
1979 	rpl_fd[RF_PATH_D] = le32_get_bits(ie->w9, RTW89_PHY_STS_IE01_V2_W9_RPL_FD_D);
1980 
1981 	phy_ppdu->bw_idx = le32_get_bits(ie->w5, RTW89_PHY_STS_IE01_V2_W5_BW_IDX);
1982 }
1983 
1984 static void rtw89_core_parse_phy_status_ie01(struct rtw89_dev *rtwdev,
1985 					     const struct rtw89_phy_sts_iehdr *iehdr,
1986 					     struct rtw89_rx_phy_ppdu *phy_ppdu)
1987 {
1988 	const struct rtw89_phy_sts_ie01 *ie = (const struct rtw89_phy_sts_ie01 *)iehdr;
1989 	s16 cfo;
1990 	u32 t;
1991 
1992 	phy_ppdu->chan_idx = le32_get_bits(ie->w0, RTW89_PHY_STS_IE01_W0_CH_IDX);
1993 
1994 	if (rtwdev->hw->conf.flags & IEEE80211_CONF_MONITOR) {
1995 		phy_ppdu->ldpc = le32_get_bits(ie->w2, RTW89_PHY_STS_IE01_W2_LDPC);
1996 		phy_ppdu->stbc = le32_get_bits(ie->w2, RTW89_PHY_STS_IE01_W2_STBC);
1997 	}
1998 
1999 	if (!phy_ppdu->hdr_2_en)
2000 		phy_ppdu->rx_path_en =
2001 			le32_get_bits(ie->w0, RTW89_PHY_STS_IE01_W0_RX_PATH_EN);
2002 
2003 	if (phy_ppdu->rate < RTW89_HW_RATE_OFDM6)
2004 		return;
2005 
2006 	if (!phy_ppdu->to_self)
2007 		return;
2008 
2009 	phy_ppdu->rpl_avg = le32_get_bits(ie->w0, RTW89_PHY_STS_IE01_W0_RSSI_AVG_FD);
2010 	phy_ppdu->ofdm.avg_snr = le32_get_bits(ie->w2, RTW89_PHY_STS_IE01_W2_AVG_SNR);
2011 	phy_ppdu->ofdm.evm_max = le32_get_bits(ie->w2, RTW89_PHY_STS_IE01_W2_EVM_MAX);
2012 	phy_ppdu->ofdm.evm_min = le32_get_bits(ie->w2, RTW89_PHY_STS_IE01_W2_EVM_MIN);
2013 	phy_ppdu->ofdm.has = true;
2014 
2015 	/* sign conversion for S(12,2) */
2016 	if (rtwdev->chip->cfo_src_fd) {
2017 		t = le32_get_bits(ie->w1, RTW89_PHY_STS_IE01_W1_FD_CFO);
2018 		cfo = sign_extend32(t, 11);
2019 	} else {
2020 		t = le32_get_bits(ie->w1, RTW89_PHY_STS_IE01_W1_PREMB_CFO);
2021 		cfo = sign_extend32(t, 11);
2022 	}
2023 
2024 	rtw89_phy_cfo_parse(rtwdev, cfo, phy_ppdu);
2025 
2026 	if (rtwdev->chip->chip_gen == RTW89_CHIP_BE)
2027 		rtw89_core_parse_phy_status_ie01_v2(rtwdev, iehdr, phy_ppdu);
2028 }
2029 
2030 static void rtw89_core_parse_phy_status_ie00(struct rtw89_dev *rtwdev,
2031 					     const struct rtw89_phy_sts_iehdr *iehdr,
2032 					     struct rtw89_rx_phy_ppdu *phy_ppdu)
2033 {
2034 	const struct rtw89_phy_sts_ie00 *ie = (const struct rtw89_phy_sts_ie00 *)iehdr;
2035 	u16 tmp_rpl;
2036 
2037 	tmp_rpl = le32_get_bits(ie->w0, RTW89_PHY_STS_IE00_W0_RPL);
2038 	phy_ppdu->rpl_avg = tmp_rpl >> 1;
2039 
2040 	if (!phy_ppdu->hdr_2_en)
2041 		phy_ppdu->rx_path_en =
2042 			le32_get_bits(ie->w3, RTW89_PHY_STS_IE00_W3_RX_PATH_EN);
2043 }
2044 
2045 static void rtw89_core_parse_phy_status_ie00_v2(struct rtw89_dev *rtwdev,
2046 						const struct rtw89_phy_sts_iehdr *iehdr,
2047 						struct rtw89_rx_phy_ppdu *phy_ppdu)
2048 {
2049 	const struct rtw89_phy_sts_ie00_v2 *ie;
2050 	u8 *rpl_path = phy_ppdu->rpl_path;
2051 	u16 tmp_rpl[RF_PATH_MAX];
2052 	u8 i;
2053 
2054 	ie = (const struct rtw89_phy_sts_ie00_v2 *)iehdr;
2055 	tmp_rpl[RF_PATH_A] = le32_get_bits(ie->w4, RTW89_PHY_STS_IE00_V2_W4_RPL_TD_A);
2056 	tmp_rpl[RF_PATH_B] = le32_get_bits(ie->w4, RTW89_PHY_STS_IE00_V2_W4_RPL_TD_B);
2057 	tmp_rpl[RF_PATH_C] = le32_get_bits(ie->w4, RTW89_PHY_STS_IE00_V2_W4_RPL_TD_C);
2058 	tmp_rpl[RF_PATH_D] = le32_get_bits(ie->w5, RTW89_PHY_STS_IE00_V2_W5_RPL_TD_D);
2059 
2060 	for (i = 0; i < RF_PATH_MAX; i++)
2061 		rpl_path[i] = tmp_rpl[i] >> 1;
2062 }
2063 
2064 static int rtw89_core_process_phy_status_ie(struct rtw89_dev *rtwdev,
2065 					    const struct rtw89_phy_sts_iehdr *iehdr,
2066 					    struct rtw89_rx_phy_ppdu *phy_ppdu)
2067 {
2068 	u8 ie;
2069 
2070 	ie = le32_get_bits(iehdr->w0, RTW89_PHY_STS_IEHDR_TYPE);
2071 
2072 	switch (ie) {
2073 	case RTW89_PHYSTS_IE00_CMN_CCK:
2074 		rtw89_core_parse_phy_status_ie00(rtwdev, iehdr, phy_ppdu);
2075 		if (rtwdev->chip->chip_gen == RTW89_CHIP_BE)
2076 			rtw89_core_parse_phy_status_ie00_v2(rtwdev, iehdr, phy_ppdu);
2077 		break;
2078 	case RTW89_PHYSTS_IE01_CMN_OFDM:
2079 		rtw89_core_parse_phy_status_ie01(rtwdev, iehdr, phy_ppdu);
2080 		break;
2081 	default:
2082 		break;
2083 	}
2084 
2085 	return 0;
2086 }
2087 
2088 static void rtw89_core_update_phy_ppdu_hdr_v2(struct rtw89_rx_phy_ppdu *phy_ppdu)
2089 {
2090 	const struct rtw89_phy_sts_hdr_v2 *hdr = phy_ppdu->buf + PHY_STS_HDR_LEN;
2091 
2092 	phy_ppdu->rx_path_en = le32_get_bits(hdr->w0, RTW89_PHY_STS_HDR_V2_W0_PATH_EN);
2093 }
2094 
2095 static void rtw89_core_update_phy_ppdu(struct rtw89_rx_phy_ppdu *phy_ppdu)
2096 {
2097 	const struct rtw89_phy_sts_hdr *hdr = phy_ppdu->buf;
2098 	u8 *rssi = phy_ppdu->rssi;
2099 
2100 	phy_ppdu->ie = le32_get_bits(hdr->w0, RTW89_PHY_STS_HDR_W0_IE_MAP);
2101 	phy_ppdu->rssi_avg = le32_get_bits(hdr->w0, RTW89_PHY_STS_HDR_W0_RSSI_AVG);
2102 	rssi[RF_PATH_A] = le32_get_bits(hdr->w1, RTW89_PHY_STS_HDR_W1_RSSI_A);
2103 	rssi[RF_PATH_B] = le32_get_bits(hdr->w1, RTW89_PHY_STS_HDR_W1_RSSI_B);
2104 	rssi[RF_PATH_C] = le32_get_bits(hdr->w1, RTW89_PHY_STS_HDR_W1_RSSI_C);
2105 	rssi[RF_PATH_D] = le32_get_bits(hdr->w1, RTW89_PHY_STS_HDR_W1_RSSI_D);
2106 
2107 	phy_ppdu->hdr_2_en = le32_get_bits(hdr->w0, RTW89_PHY_STS_HDR_W0_HDR_2_EN);
2108 	if (phy_ppdu->hdr_2_en)
2109 		rtw89_core_update_phy_ppdu_hdr_v2(phy_ppdu);
2110 }
2111 
2112 static int rtw89_core_rx_process_phy_ppdu(struct rtw89_dev *rtwdev,
2113 					  struct rtw89_rx_phy_ppdu *phy_ppdu)
2114 {
2115 	const struct rtw89_phy_sts_hdr *hdr = phy_ppdu->buf;
2116 	u32 len_from_header;
2117 	bool physts_valid;
2118 
2119 	physts_valid = le32_get_bits(hdr->w0, RTW89_PHY_STS_HDR_W0_VALID);
2120 	if (!physts_valid)
2121 		return -EINVAL;
2122 
2123 	len_from_header = le32_get_bits(hdr->w0, RTW89_PHY_STS_HDR_W0_LEN) << 3;
2124 
2125 	if (rtwdev->chip->chip_gen == RTW89_CHIP_BE)
2126 		len_from_header += PHY_STS_HDR_LEN;
2127 
2128 	if (len_from_header != phy_ppdu->len) {
2129 		rtw89_debug(rtwdev, RTW89_DBG_UNEXP, "phy ppdu len mismatch\n");
2130 		return -EINVAL;
2131 	}
2132 	rtw89_core_update_phy_ppdu(phy_ppdu);
2133 
2134 	return 0;
2135 }
2136 
2137 static int rtw89_core_rx_parse_phy_sts(struct rtw89_dev *rtwdev,
2138 				       struct rtw89_rx_phy_ppdu *phy_ppdu)
2139 {
2140 	u16 ie_len;
2141 	void *pos, *end;
2142 
2143 	/* mark invalid reports and bypass them */
2144 	if (phy_ppdu->ie < RTW89_CCK_PKT)
2145 		return -EINVAL;
2146 
2147 	pos = phy_ppdu->buf + PHY_STS_HDR_LEN;
2148 	if (phy_ppdu->hdr_2_en)
2149 		pos += PHY_STS_HDR_LEN;
2150 	end = phy_ppdu->buf + phy_ppdu->len;
2151 	while (pos < end) {
2152 		const struct rtw89_phy_sts_iehdr *iehdr = pos;
2153 
2154 		ie_len = rtw89_core_get_phy_status_ie_len(rtwdev, iehdr);
2155 		rtw89_core_process_phy_status_ie(rtwdev, iehdr, phy_ppdu);
2156 		pos += ie_len;
2157 		if (pos > end || ie_len == 0) {
2158 			rtw89_debug(rtwdev, RTW89_DBG_TXRX,
2159 				    "phy status parse failed\n");
2160 			return -EINVAL;
2161 		}
2162 	}
2163 
2164 	rtw89_chip_convert_rpl_to_rssi(rtwdev, phy_ppdu);
2165 	rtw89_phy_antdiv_parse(rtwdev, phy_ppdu);
2166 
2167 	return 0;
2168 }
2169 
2170 static void rtw89_core_rx_process_phy_sts(struct rtw89_dev *rtwdev,
2171 					  struct rtw89_rx_phy_ppdu *phy_ppdu)
2172 {
2173 	int ret;
2174 
2175 	ret = rtw89_core_rx_parse_phy_sts(rtwdev, phy_ppdu);
2176 	if (ret)
2177 		rtw89_debug(rtwdev, RTW89_DBG_TXRX, "parse phy sts failed\n");
2178 	else
2179 		phy_ppdu->valid = true;
2180 
2181 	ieee80211_iterate_stations_atomic(rtwdev->hw,
2182 					  rtw89_core_rx_process_phy_ppdu_iter,
2183 					  phy_ppdu);
2184 }
2185 
2186 static u8 rtw89_rxdesc_to_nl_he_gi(struct rtw89_dev *rtwdev,
2187 				   u8 desc_info_gi,
2188 				   bool rx_status)
2189 {
2190 	switch (desc_info_gi) {
2191 	case RTW89_GILTF_SGI_4XHE08:
2192 	case RTW89_GILTF_2XHE08:
2193 	case RTW89_GILTF_1XHE08:
2194 		return NL80211_RATE_INFO_HE_GI_0_8;
2195 	case RTW89_GILTF_2XHE16:
2196 	case RTW89_GILTF_1XHE16:
2197 		return NL80211_RATE_INFO_HE_GI_1_6;
2198 	case RTW89_GILTF_LGI_4XHE32:
2199 		return NL80211_RATE_INFO_HE_GI_3_2;
2200 	default:
2201 		rtw89_warn(rtwdev, "invalid gi_ltf=%d", desc_info_gi);
2202 		if (rx_status)
2203 			return NL80211_RATE_INFO_HE_GI_3_2;
2204 		return U8_MAX;
2205 	}
2206 }
2207 
2208 static u8 rtw89_rxdesc_to_nl_eht_gi(struct rtw89_dev *rtwdev,
2209 				    u8 desc_info_gi,
2210 				    bool rx_status)
2211 {
2212 	switch (desc_info_gi) {
2213 	case RTW89_GILTF_SGI_4XHE08:
2214 	case RTW89_GILTF_2XHE08:
2215 	case RTW89_GILTF_1XHE08:
2216 		return NL80211_RATE_INFO_EHT_GI_0_8;
2217 	case RTW89_GILTF_2XHE16:
2218 	case RTW89_GILTF_1XHE16:
2219 		return NL80211_RATE_INFO_EHT_GI_1_6;
2220 	case RTW89_GILTF_LGI_4XHE32:
2221 		return NL80211_RATE_INFO_EHT_GI_3_2;
2222 	default:
2223 		rtw89_warn(rtwdev, "invalid gi_ltf=%d", desc_info_gi);
2224 		if (rx_status)
2225 			return NL80211_RATE_INFO_EHT_GI_3_2;
2226 		return U8_MAX;
2227 	}
2228 }
2229 
2230 static u8 rtw89_rxdesc_to_nl_he_eht_gi(struct rtw89_dev *rtwdev,
2231 				       u8 desc_info_gi,
2232 				       bool rx_status, bool eht)
2233 {
2234 	return eht ? rtw89_rxdesc_to_nl_eht_gi(rtwdev, desc_info_gi, rx_status) :
2235 		     rtw89_rxdesc_to_nl_he_gi(rtwdev, desc_info_gi, rx_status);
2236 }
2237 
2238 static
2239 bool rtw89_check_rx_statu_gi_match(struct ieee80211_rx_status *status, u8 gi_ltf,
2240 				   bool eht)
2241 {
2242 	if (eht)
2243 		return status->eht.gi == gi_ltf;
2244 
2245 	return status->he_gi == gi_ltf;
2246 }
2247 
2248 static bool rtw89_core_rx_ppdu_match(struct rtw89_dev *rtwdev,
2249 				     struct rtw89_rx_desc_info *desc_info,
2250 				     struct ieee80211_rx_status *status)
2251 {
2252 	u8 band = desc_info->bb_sel ? RTW89_PHY_1 : RTW89_PHY_0;
2253 	u8 data_rate_mode, bw, rate_idx = MASKBYTE0, gi_ltf;
2254 	bool eht = false;
2255 	u16 data_rate;
2256 	bool ret;
2257 
2258 	data_rate = desc_info->data_rate;
2259 	data_rate_mode = rtw89_get_data_rate_mode(rtwdev, data_rate);
2260 	if (data_rate_mode == DATA_RATE_MODE_NON_HT) {
2261 		rate_idx = rtw89_get_data_not_ht_idx(rtwdev, data_rate);
2262 		/* rate_idx is still hardware value here */
2263 	} else if (data_rate_mode == DATA_RATE_MODE_HT) {
2264 		rate_idx = rtw89_get_data_ht_mcs(rtwdev, data_rate);
2265 	} else if (data_rate_mode == DATA_RATE_MODE_VHT ||
2266 		   data_rate_mode == DATA_RATE_MODE_HE ||
2267 		   data_rate_mode == DATA_RATE_MODE_EHT) {
2268 		rate_idx = rtw89_get_data_mcs(rtwdev, data_rate);
2269 	} else {
2270 		rtw89_warn(rtwdev, "invalid RX rate mode %d\n", data_rate_mode);
2271 	}
2272 
2273 	eht = data_rate_mode == DATA_RATE_MODE_EHT;
2274 	bw = rtw89_hw_to_rate_info_bw(desc_info->bw);
2275 	gi_ltf = rtw89_rxdesc_to_nl_he_eht_gi(rtwdev, desc_info->gi_ltf, false, eht);
2276 	ret = rtwdev->ppdu_sts.curr_rx_ppdu_cnt[band] == desc_info->ppdu_cnt &&
2277 	      status->rate_idx == rate_idx &&
2278 	      rtw89_check_rx_statu_gi_match(status, gi_ltf, eht) &&
2279 	      status->bw == bw;
2280 
2281 	return ret;
2282 }
2283 
2284 struct rtw89_vif_rx_stats_iter_data {
2285 	struct rtw89_dev *rtwdev;
2286 	struct rtw89_rx_phy_ppdu *phy_ppdu;
2287 	struct rtw89_rx_desc_info *desc_info;
2288 	struct sk_buff *skb;
2289 	const u8 *bssid;
2290 };
2291 
2292 static void rtw89_stats_trigger_frame(struct rtw89_dev *rtwdev,
2293 				      struct rtw89_vif_link *rtwvif_link,
2294 				      struct ieee80211_bss_conf *bss_conf,
2295 				      struct sk_buff *skb)
2296 {
2297 	struct ieee80211_trigger *tf = (struct ieee80211_trigger *)skb->data;
2298 	struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
2299 	struct rtw89_vif *rtwvif = rtwvif_link->rtwvif;
2300 	u8 *pos, *end, type, tf_bw;
2301 	u16 aid, tf_rua;
2302 
2303 	if (!ether_addr_equal(bss_conf->bssid, tf->ta) ||
2304 	    rtwvif_link->wifi_role != RTW89_WIFI_ROLE_STATION ||
2305 	    rtwvif_link->net_type == RTW89_NET_TYPE_NO_LINK)
2306 		return;
2307 
2308 	type = le64_get_bits(tf->common_info, IEEE80211_TRIGGER_TYPE_MASK);
2309 	if (type != IEEE80211_TRIGGER_TYPE_BASIC && type != IEEE80211_TRIGGER_TYPE_MU_BAR)
2310 		return;
2311 
2312 	end = (u8 *)tf + skb->len;
2313 	pos = tf->variable;
2314 
2315 	while (end - pos >= RTW89_TF_BASIC_USER_INFO_SZ) {
2316 		aid = RTW89_GET_TF_USER_INFO_AID12(pos);
2317 		tf_rua = RTW89_GET_TF_USER_INFO_RUA(pos);
2318 		tf_bw = le64_get_bits(tf->common_info, IEEE80211_TRIGGER_ULBW_MASK);
2319 		rtw89_debug(rtwdev, RTW89_DBG_TXRX,
2320 			    "[TF] aid: %d, ul_mcs: %d, rua: %d, bw: %d\n",
2321 			    aid, RTW89_GET_TF_USER_INFO_UL_MCS(pos),
2322 			    tf_rua, tf_bw);
2323 
2324 		if (aid == RTW89_TF_PAD)
2325 			break;
2326 
2327 		if (aid == vif->cfg.aid) {
2328 			enum nl80211_he_ru_alloc rua;
2329 
2330 			rtwvif->stats.rx_tf_acc++;
2331 			rtwdev->stats.rx_tf_acc++;
2332 
2333 			/* The following only required for HE trigger frame, but we
2334 			 * cannot use UL HE-SIG-A2 reserved subfield to identify it
2335 			 * since some 11ax APs will fill it with all 0s, which will
2336 			 * be misunderstood as EHT trigger frame.
2337 			 */
2338 			if (bss_conf->eht_support)
2339 				break;
2340 
2341 			rua = rtw89_he_rua_to_ru_alloc(tf_rua >> 1);
2342 
2343 			if (tf_bw == IEEE80211_TRIGGER_ULBW_160_80P80MHZ &&
2344 			    rua <= NL80211_RATE_INFO_HE_RU_ALLOC_106)
2345 				rtwvif_link->pwr_diff_en = true;
2346 			break;
2347 		}
2348 
2349 		pos += RTW89_TF_BASIC_USER_INFO_SZ;
2350 	}
2351 }
2352 
2353 static void rtw89_cancel_6ghz_probe_work(struct wiphy *wiphy, struct wiphy_work *work)
2354 {
2355 	struct rtw89_dev *rtwdev = container_of(work, struct rtw89_dev,
2356 						cancel_6ghz_probe_work);
2357 	struct list_head *pkt_list = rtwdev->scan_info.pkt_list;
2358 	struct rtw89_pktofld_info *info;
2359 
2360 	lockdep_assert_wiphy(wiphy);
2361 
2362 	if (!rtwdev->scanning)
2363 		return;
2364 
2365 	list_for_each_entry(info, &pkt_list[NL80211_BAND_6GHZ], list) {
2366 		if (!info->cancel || !test_bit(info->id, rtwdev->pkt_offload))
2367 			continue;
2368 
2369 		rtw89_fw_h2c_del_pkt_offload(rtwdev, info->id);
2370 
2371 		/* Don't delete/free info from pkt_list at this moment. Let it
2372 		 * be deleted/freed in rtw89_release_pkt_list() after scanning,
2373 		 * since if during scanning, pkt_list is accessed in bottom half.
2374 		 */
2375 	}
2376 }
2377 
2378 static void rtw89_core_cancel_6ghz_probe_tx(struct rtw89_dev *rtwdev,
2379 					    struct sk_buff *skb)
2380 {
2381 	struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
2382 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
2383 	struct list_head *pkt_list = rtwdev->scan_info.pkt_list;
2384 	struct rtw89_pktofld_info *info;
2385 	const u8 *ies = mgmt->u.beacon.variable, *ssid_ie;
2386 	bool queue_work = false;
2387 
2388 	if (rx_status->band != NL80211_BAND_6GHZ)
2389 		return;
2390 
2391 	if (unlikely(!(rtwdev->chip->support_bands & BIT(NL80211_BAND_6GHZ)))) {
2392 		rtw89_debug(rtwdev, RTW89_DBG_UNEXP, "invalid rx on unsupported 6 GHz\n");
2393 		return;
2394 	}
2395 
2396 	ssid_ie = cfg80211_find_ie(WLAN_EID_SSID, ies, skb->len);
2397 
2398 	list_for_each_entry(info, &pkt_list[NL80211_BAND_6GHZ], list) {
2399 		if (ether_addr_equal(info->bssid, mgmt->bssid)) {
2400 			info->cancel = true;
2401 			queue_work = true;
2402 			continue;
2403 		}
2404 
2405 		if (!ssid_ie || ssid_ie[1] != info->ssid_len || info->ssid_len == 0)
2406 			continue;
2407 
2408 		if (memcmp(&ssid_ie[2], info->ssid, info->ssid_len) == 0) {
2409 			info->cancel = true;
2410 			queue_work = true;
2411 		}
2412 	}
2413 
2414 	if (queue_work)
2415 		wiphy_work_queue(rtwdev->hw->wiphy, &rtwdev->cancel_6ghz_probe_work);
2416 }
2417 
2418 static void rtw89_vif_sync_bcn_tsf(struct rtw89_vif_link *rtwvif_link,
2419 				   struct ieee80211_hdr *hdr, size_t len)
2420 {
2421 	struct ieee80211_mgmt *mgmt = (typeof(mgmt))hdr;
2422 
2423 	if (len < offsetof(typeof(*mgmt), u.beacon.variable))
2424 		return;
2425 
2426 	WRITE_ONCE(rtwvif_link->sync_bcn_tsf, le64_to_cpu(mgmt->u.beacon.timestamp));
2427 }
2428 
2429 static u32 rtw89_bcn_calc_min_tbtt(struct rtw89_dev *rtwdev, u32 tbtt1, u32 tbtt2)
2430 {
2431 	struct rtw89_beacon_track_info *bcn_track = &rtwdev->bcn_track;
2432 	u32 close_bcn_intvl_th = bcn_track->close_bcn_intvl_th;
2433 	u32 tbtt_diff_th = bcn_track->tbtt_diff_th;
2434 
2435 	if (tbtt2 > tbtt1)
2436 		swap(tbtt1, tbtt2);
2437 
2438 	if (tbtt1 - tbtt2 > tbtt_diff_th)
2439 		return tbtt1;
2440 	else if (tbtt2 > close_bcn_intvl_th)
2441 		return tbtt2;
2442 	else if (tbtt1 > close_bcn_intvl_th)
2443 		return tbtt1;
2444 	else
2445 		return tbtt2;
2446 }
2447 
2448 static void rtw89_bcn_cfg_tbtt_offset(struct rtw89_dev *rtwdev,
2449 				      struct rtw89_vif_link *rtwvif_link)
2450 {
2451 	struct rtw89_beacon_track_info *bcn_track = &rtwdev->bcn_track;
2452 	enum rtw89_core_chip_id chip_id = rtwdev->chip->chip_id;
2453 	u32 offset = bcn_track->tbtt_offset;
2454 
2455 	if (chip_id == RTL8852A || rtw89_is_rtl885xb(rtwdev)) {
2456 		const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;
2457 		const struct rtw89_port_reg *p = mac->port_base;
2458 		u32 bcnspc, val;
2459 
2460 		bcnspc = rtw89_read32_port_mask(rtwdev, rtwvif_link,
2461 						p->bcn_space, B_AX_BCN_SPACE_MASK);
2462 		val = bcnspc - (offset / 1024);
2463 		val = u32_encode_bits(val, B_AX_TBTT_SHIFT_OFST_MAG) |
2464 				      B_AX_TBTT_SHIFT_OFST_SIGN;
2465 
2466 		rtw89_write16_port_mask(rtwdev, rtwvif_link, p->tbtt_shift,
2467 					B_AX_TBTT_SHIFT_OFST_MASK, val);
2468 
2469 		return;
2470 	}
2471 
2472 	rtw89_fw_h2c_tbtt_tuning(rtwdev, rtwvif_link, offset);
2473 }
2474 
2475 static void rtw89_bcn_update_tbtt_offset(struct rtw89_dev *rtwdev,
2476 					 struct rtw89_vif_link *rtwvif_link)
2477 {
2478 	struct rtw89_beacon_stat *bcn_stat = &rtwdev->phystat.bcn_stat;
2479 	struct rtw89_beacon_track_info *bcn_track = &rtwdev->bcn_track;
2480 	u32 *tbtt_us = bcn_stat->tbtt_us;
2481 	u32 offset = tbtt_us[0];
2482 	u8 i;
2483 
2484 	for (i = 1; i < RTW89_BCN_TRACK_STAT_NR; i++)
2485 		offset = rtw89_bcn_calc_min_tbtt(rtwdev, tbtt_us[i], offset);
2486 
2487 	if (bcn_track->tbtt_offset == offset)
2488 		return;
2489 
2490 	bcn_track->tbtt_offset = offset;
2491 	rtw89_bcn_cfg_tbtt_offset(rtwdev, rtwvif_link);
2492 }
2493 
2494 static int cmp_u16(const void *a, const void *b)
2495 {
2496 	return *(const u16 *)a - *(const u16 *)b;
2497 }
2498 
2499 static u16 _rtw89_bcn_calc_drift(u16 tbtt, u16 offset, u16 beacon_int)
2500 {
2501 	if (tbtt < offset)
2502 		return beacon_int - offset + tbtt;
2503 
2504 	return tbtt - offset;
2505 }
2506 
2507 static void rtw89_bcn_calc_drift(struct rtw89_dev *rtwdev)
2508 {
2509 	struct rtw89_beacon_stat *bcn_stat = &rtwdev->phystat.bcn_stat;
2510 	struct rtw89_beacon_track_info *bcn_track = &rtwdev->bcn_track;
2511 	u16 offset_tu = bcn_track->tbtt_offset / 1024;
2512 	u16 *tbtt_tu = bcn_stat->tbtt_tu;
2513 	u16 *drift = bcn_stat->drift;
2514 	u8 i;
2515 
2516 	bcn_stat->tbtt_tu_min = U16_MAX;
2517 	bcn_stat->tbtt_tu_max = 0;
2518 	for (i = 0; i < RTW89_BCN_TRACK_STAT_NR; i++) {
2519 		drift[i] = _rtw89_bcn_calc_drift(tbtt_tu[i], offset_tu,
2520 						 bcn_track->beacon_int);
2521 
2522 		bcn_stat->tbtt_tu_min = min(bcn_stat->tbtt_tu_min, tbtt_tu[i]);
2523 		bcn_stat->tbtt_tu_max = max(bcn_stat->tbtt_tu_max, tbtt_tu[i]);
2524 	}
2525 
2526 	sort(drift, RTW89_BCN_TRACK_STAT_NR, sizeof(*drift), cmp_u16, NULL);
2527 }
2528 
2529 static void rtw89_bcn_calc_distribution(struct rtw89_dev *rtwdev)
2530 {
2531 	struct rtw89_beacon_stat *bcn_stat = &rtwdev->phystat.bcn_stat;
2532 	struct rtw89_beacon_dist *bcn_dist = &bcn_stat->bcn_dist;
2533 	u16 lower_bound, upper_bound, outlier_count = 0;
2534 	u16 *drift = bcn_stat->drift;
2535 	u16 *bins = bcn_dist->bins;
2536 	u16 q1, q3, iqr, tmp;
2537 	u8 i;
2538 
2539 	BUILD_BUG_ON(RTW89_BCN_TRACK_STAT_NR % 4 != 0);
2540 
2541 	memset(bcn_dist, 0, sizeof(*bcn_dist));
2542 
2543 	bcn_dist->min = drift[0];
2544 	bcn_dist->max = drift[RTW89_BCN_TRACK_STAT_NR - 1];
2545 
2546 	tmp = RTW89_BCN_TRACK_STAT_NR / 4;
2547 	q1 = ((drift[tmp] + drift[tmp - 1]) * RTW89_BCN_TRACK_SCALE_FACTOR) / 2;
2548 
2549 	tmp = (RTW89_BCN_TRACK_STAT_NR * 3) / 4;
2550 	q3 = ((drift[tmp] + drift[tmp - 1]) * RTW89_BCN_TRACK_SCALE_FACTOR) / 2;
2551 
2552 	iqr = q3 - q1;
2553 	tmp = (3 * iqr) / 2;
2554 
2555 	if (bcn_dist->min <= 5)
2556 		lower_bound = bcn_dist->min;
2557 	else if (q1 > tmp)
2558 		lower_bound = (q1 - tmp) / RTW89_BCN_TRACK_SCALE_FACTOR;
2559 	else
2560 		lower_bound = 0;
2561 
2562 	upper_bound = (q3 + tmp) / RTW89_BCN_TRACK_SCALE_FACTOR;
2563 
2564 	for (i = 0; i < RTW89_BCN_TRACK_STAT_NR; i++) {
2565 		u16 tbtt = bcn_stat->tbtt_tu[i];
2566 		u16 min = bcn_stat->tbtt_tu_min;
2567 		u8 bin_idx;
2568 
2569 		/* histogram */
2570 		bin_idx = min((tbtt - min) / RTW89_BCN_TRACK_BIN_WIDTH,
2571 			      RTW89_BCN_TRACK_MAX_BIN_NUM - 1);
2572 		bins[bin_idx]++;
2573 
2574 		/* boxplot outlier */
2575 		if (drift[i] < lower_bound || drift[i] > upper_bound)
2576 			outlier_count++;
2577 	}
2578 
2579 	bcn_dist->outlier_count = outlier_count;
2580 	bcn_dist->lower_bound = lower_bound;
2581 	bcn_dist->upper_bound = upper_bound;
2582 }
2583 
2584 static u8 rtw89_bcn_get_coverage(struct rtw89_dev *rtwdev, u16 threshold)
2585 {
2586 	struct rtw89_beacon_stat *bcn_stat = &rtwdev->phystat.bcn_stat;
2587 	int l = 0, r = RTW89_BCN_TRACK_STAT_NR - 1, m;
2588 	u16 *drift = bcn_stat->drift;
2589 	int index = -1;
2590 	u8 count = 0;
2591 
2592 	while (l <= r) {
2593 		m = l + (r - l) / 2;
2594 
2595 		if (drift[m] <= threshold) {
2596 			index = m;
2597 			l = m + 1;
2598 		} else {
2599 			r = m - 1;
2600 		}
2601 	}
2602 
2603 	count = (index == -1) ? 0 : (index + 1);
2604 
2605 	return (count * PERCENT) / RTW89_BCN_TRACK_STAT_NR;
2606 }
2607 
2608 static u16 rtw89_bcn_get_histogram_bound(struct rtw89_dev *rtwdev, u8 target)
2609 {
2610 	struct rtw89_beacon_stat *bcn_stat = &rtwdev->phystat.bcn_stat;
2611 	struct rtw89_beacon_dist *bcn_dist = &bcn_stat->bcn_dist;
2612 	u16 tbtt_tu_max = bcn_stat->tbtt_tu_max;
2613 	u16 upper, lower = bcn_stat->tbtt_tu_min;
2614 	u8 i, count = 0;
2615 
2616 	for (i = 0; i < RTW89_BCN_TRACK_MAX_BIN_NUM; i++) {
2617 		upper = lower + RTW89_BCN_TRACK_BIN_WIDTH - 1;
2618 		if (i == RTW89_BCN_TRACK_MAX_BIN_NUM - 1)
2619 			upper = max(upper, tbtt_tu_max);
2620 
2621 		count += bcn_dist->bins[i];
2622 		if (count > target)
2623 			break;
2624 
2625 		lower = upper + 1;
2626 	}
2627 
2628 	return upper;
2629 }
2630 
2631 static u16 rtw89_bcn_get_rx_time(struct rtw89_dev *rtwdev,
2632 				 const struct rtw89_chan *chan)
2633 {
2634 #define RTW89_SYMBOL_TIME_2GHZ 192
2635 #define RTW89_SYMBOL_TIME_5GHZ 20
2636 #define RTW89_SYMBOL_TIME_6GHZ 20
2637 	struct rtw89_pkt_stat *pkt_stat = &rtwdev->phystat.cur_pkt_stat;
2638 	u16 bitrate, val;
2639 
2640 	if (!rtw89_legacy_rate_to_bitrate(rtwdev, pkt_stat->beacon_rate, &bitrate))
2641 		return 0;
2642 
2643 	val = (pkt_stat->beacon_len * 8 * RTW89_BCN_TRACK_SCALE_FACTOR) / bitrate;
2644 
2645 	switch (chan->band_type) {
2646 	default:
2647 	case RTW89_BAND_2G:
2648 		val += RTW89_SYMBOL_TIME_2GHZ;
2649 		break;
2650 	case RTW89_BAND_5G:
2651 		val += RTW89_SYMBOL_TIME_5GHZ;
2652 		break;
2653 	case RTW89_BAND_6G:
2654 		val += RTW89_SYMBOL_TIME_6GHZ;
2655 		break;
2656 	}
2657 
2658 	/* convert to millisecond */
2659 	return DIV_ROUND_UP(val, 1000);
2660 }
2661 
2662 static void rtw89_bcn_calc_timeout(struct rtw89_dev *rtwdev,
2663 				   struct rtw89_vif_link *rtwvif_link)
2664 {
2665 #define RTW89_BCN_TRACK_EXTEND_TIMEOUT 5
2666 #define RTW89_BCN_TRACK_COVERAGE_TH 0 /* unit: TU */
2667 #define RTW89_BCN_TRACK_STRONG_RSSI 80
2668 	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, rtwvif_link->chanctx_idx);
2669 	struct rtw89_pkt_stat *pkt_stat = &rtwdev->phystat.cur_pkt_stat;
2670 	struct rtw89_beacon_stat *bcn_stat = &rtwdev->phystat.bcn_stat;
2671 	struct rtw89_beacon_track_info *bcn_track = &rtwdev->bcn_track;
2672 	struct rtw89_beacon_dist *bcn_dist = &bcn_stat->bcn_dist;
2673 	u16 outlier_high_bcn_th = bcn_track->outlier_high_bcn_th;
2674 	u16 outlier_low_bcn_th = bcn_track->outlier_low_bcn_th;
2675 	u8 rssi = ewma_rssi_read(&rtwdev->phystat.bcn_rssi);
2676 	u16 target_bcn_th = bcn_track->target_bcn_th;
2677 	u16 low_bcn_th = bcn_track->low_bcn_th;
2678 	u16 med_bcn_th = bcn_track->med_bcn_th;
2679 	u16 beacon_int = bcn_track->beacon_int;
2680 	u16 bcn_timeout;
2681 
2682 	if (pkt_stat->beacon_nr < low_bcn_th) {
2683 		bcn_timeout = (RTW89_BCN_TRACK_TARGET_BCN * beacon_int) / PERCENT;
2684 		goto out;
2685 	}
2686 
2687 	if (bcn_dist->outlier_count >= outlier_high_bcn_th) {
2688 		bcn_timeout = bcn_dist->max;
2689 		goto out;
2690 	}
2691 
2692 	if (pkt_stat->beacon_nr < med_bcn_th) {
2693 		if (bcn_dist->outlier_count > outlier_low_bcn_th)
2694 			bcn_timeout = (bcn_dist->max + bcn_dist->upper_bound) / 2;
2695 		else
2696 			bcn_timeout = bcn_dist->upper_bound +
2697 				      RTW89_BCN_TRACK_EXTEND_TIMEOUT;
2698 
2699 		goto out;
2700 	}
2701 
2702 	if (rssi >= RTW89_BCN_TRACK_STRONG_RSSI) {
2703 		if (rtw89_bcn_get_coverage(rtwdev, RTW89_BCN_TRACK_COVERAGE_TH) >= 90) {
2704 			/* ideal case */
2705 			bcn_timeout = 0;
2706 		} else {
2707 			u16 offset_tu = bcn_track->tbtt_offset / 1024;
2708 			u16 upper_bound;
2709 
2710 			upper_bound =
2711 				rtw89_bcn_get_histogram_bound(rtwdev, target_bcn_th);
2712 			bcn_timeout =
2713 				_rtw89_bcn_calc_drift(upper_bound, offset_tu, beacon_int);
2714 		}
2715 
2716 		goto out;
2717 	}
2718 
2719 	bcn_timeout = bcn_stat->drift[target_bcn_th];
2720 
2721 out:
2722 	bcn_track->bcn_timeout = bcn_timeout + rtw89_bcn_get_rx_time(rtwdev, chan);
2723 }
2724 
2725 static void rtw89_bcn_update_timeout(struct rtw89_dev *rtwdev,
2726 				     struct rtw89_vif_link *rtwvif_link)
2727 {
2728 	rtw89_bcn_calc_drift(rtwdev);
2729 	rtw89_bcn_calc_distribution(rtwdev);
2730 	rtw89_bcn_calc_timeout(rtwdev, rtwvif_link);
2731 }
2732 
2733 static void rtw89_core_bcn_track(struct rtw89_dev *rtwdev)
2734 {
2735 	struct rtw89_beacon_track_info *bcn_track = &rtwdev->bcn_track;
2736 	struct rtw89_vif_link *rtwvif_link;
2737 	struct rtw89_vif *rtwvif;
2738 	unsigned int link_id;
2739 
2740 	if (!RTW89_CHK_FW_FEATURE(BEACON_TRACKING, &rtwdev->fw))
2741 		return;
2742 
2743 	if (!rtwdev->lps_enabled)
2744 		return;
2745 
2746 	if (!bcn_track->is_data_ready)
2747 		return;
2748 
2749 	rtw89_for_each_rtwvif(rtwdev, rtwvif) {
2750 		rtw89_vif_for_each_link(rtwvif, rtwvif_link, link_id) {
2751 			if (!(rtwvif_link->wifi_role == RTW89_WIFI_ROLE_STATION ||
2752 			      rtwvif_link->wifi_role == RTW89_WIFI_ROLE_P2P_CLIENT))
2753 				continue;
2754 
2755 			rtw89_bcn_update_tbtt_offset(rtwdev, rtwvif_link);
2756 			rtw89_bcn_update_timeout(rtwdev, rtwvif_link);
2757 		}
2758 	}
2759 }
2760 
2761 static bool rtw89_core_bcn_track_can_lps(struct rtw89_dev *rtwdev)
2762 {
2763 	struct rtw89_beacon_track_info *bcn_track = &rtwdev->bcn_track;
2764 
2765 	if (!RTW89_CHK_FW_FEATURE(BEACON_TRACKING, &rtwdev->fw))
2766 		return true;
2767 
2768 	return bcn_track->is_data_ready;
2769 }
2770 
2771 static void rtw89_core_bcn_track_assoc(struct rtw89_dev *rtwdev,
2772 				       struct rtw89_vif_link *rtwvif_link)
2773 {
2774 #define RTW89_BCN_TRACK_MED_BCN 70
2775 #define RTW89_BCN_TRACK_LOW_BCN 30
2776 #define RTW89_BCN_TRACK_OUTLIER_HIGH_BCN 30
2777 #define RTW89_BCN_TRACK_OUTLIER_LOW_BCN 20
2778 	struct rtw89_beacon_track_info *bcn_track = &rtwdev->bcn_track;
2779 	u32 period = jiffies_to_msecs(RTW89_TRACK_WORK_PERIOD);
2780 	struct ieee80211_bss_conf *bss_conf;
2781 	u32 beacons_in_period;
2782 	u32 bcn_intvl_us;
2783 	u16 beacon_int;
2784 	u8 dtim;
2785 
2786 	rcu_read_lock();
2787 	bss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, true);
2788 	beacon_int = bss_conf->beacon_int;
2789 	dtim = bss_conf->dtim_period;
2790 	rcu_read_unlock();
2791 
2792 	beacons_in_period = period / beacon_int / dtim;
2793 	bcn_intvl_us = ieee80211_tu_to_usec(beacon_int);
2794 
2795 	bcn_track->low_bcn_th =
2796 		(beacons_in_period * RTW89_BCN_TRACK_LOW_BCN) / PERCENT;
2797 	bcn_track->med_bcn_th =
2798 		(beacons_in_period * RTW89_BCN_TRACK_MED_BCN) / PERCENT;
2799 	bcn_track->outlier_low_bcn_th =
2800 		(RTW89_BCN_TRACK_STAT_NR * RTW89_BCN_TRACK_OUTLIER_LOW_BCN) / PERCENT;
2801 	bcn_track->outlier_high_bcn_th =
2802 		(RTW89_BCN_TRACK_STAT_NR * RTW89_BCN_TRACK_OUTLIER_HIGH_BCN) / PERCENT;
2803 	bcn_track->target_bcn_th =
2804 		(RTW89_BCN_TRACK_STAT_NR * RTW89_BCN_TRACK_TARGET_BCN) / PERCENT;
2805 
2806 	bcn_track->close_bcn_intvl_th = ieee80211_tu_to_usec(beacon_int - 3);
2807 	bcn_track->tbtt_diff_th = (bcn_intvl_us * 85) / PERCENT;
2808 	bcn_track->beacon_int = beacon_int;
2809 	bcn_track->dtim = dtim;
2810 }
2811 
2812 static void rtw89_core_bcn_track_reset(struct rtw89_dev *rtwdev)
2813 {
2814 	memset(&rtwdev->phystat.bcn_stat, 0, sizeof(rtwdev->phystat.bcn_stat));
2815 	memset(&rtwdev->bcn_track, 0, sizeof(rtwdev->bcn_track));
2816 }
2817 
2818 static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev,
2819 				  struct ieee80211_bss_conf *bss_conf,
2820 				  struct sk_buff *skb)
2821 {
2822 #define RTW89_APPEND_TSF_2GHZ 384
2823 #define RTW89_APPEND_TSF_5GHZ 52
2824 #define RTW89_APPEND_TSF_6GHZ 52
2825 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
2826 	struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
2827 	struct rtw89_beacon_stat *bcn_stat = &rtwdev->phystat.bcn_stat;
2828 	struct rtw89_beacon_track_info *bcn_track = &rtwdev->bcn_track;
2829 	u32 bcn_intvl_us = ieee80211_tu_to_usec(bss_conf->beacon_int);
2830 	u64 tsf = le64_to_cpu(mgmt->u.beacon.timestamp);
2831 	u8 wp, num = bcn_stat->num;
2832 	u16 append;
2833 
2834 	if (!RTW89_CHK_FW_FEATURE(BEACON_TRACKING, &rtwdev->fw))
2835 		return;
2836 
2837 	switch (rx_status->band) {
2838 	default:
2839 	case NL80211_BAND_2GHZ:
2840 		append = RTW89_APPEND_TSF_2GHZ;
2841 		break;
2842 	case NL80211_BAND_5GHZ:
2843 		append = RTW89_APPEND_TSF_5GHZ;
2844 		break;
2845 	case NL80211_BAND_6GHZ:
2846 		append = RTW89_APPEND_TSF_6GHZ;
2847 		break;
2848 	}
2849 
2850 	wp = bcn_stat->wp;
2851 	div_u64_rem(tsf - append, bcn_intvl_us, &bcn_stat->tbtt_us[wp]);
2852 	bcn_stat->tbtt_tu[wp] = bcn_stat->tbtt_us[wp] / 1024;
2853 	bcn_stat->wp = (wp + 1) % RTW89_BCN_TRACK_STAT_NR;
2854 	bcn_stat->num = umin(num + 1, RTW89_BCN_TRACK_STAT_NR);
2855 	bcn_track->is_data_ready = bcn_stat->num == RTW89_BCN_TRACK_STAT_NR;
2856 }
2857 
2858 static void rtw89_vif_rx_stats_iter(void *data, u8 *mac,
2859 				    struct ieee80211_vif *vif)
2860 {
2861 	struct rtw89_vif_rx_stats_iter_data *iter_data = data;
2862 	struct rtw89_dev *rtwdev = iter_data->rtwdev;
2863 	struct rtw89_vif *rtwvif = vif_to_rtwvif(vif);
2864 	struct rtw89_pkt_stat *pkt_stat = &rtwdev->phystat.cur_pkt_stat;
2865 	struct rtw89_rx_desc_info *desc_info = iter_data->desc_info;
2866 	struct sk_buff *skb = iter_data->skb;
2867 	struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
2868 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2869 	struct rtw89_rx_phy_ppdu *phy_ppdu = iter_data->phy_ppdu;
2870 	bool is_mld = ieee80211_vif_is_mld(vif);
2871 	struct ieee80211_bss_conf *bss_conf;
2872 	struct rtw89_vif_link *rtwvif_link;
2873 	const u8 *bssid = iter_data->bssid;
2874 	const u8 *target_bssid;
2875 
2876 	if (rtwdev->scanning &&
2877 	    (ieee80211_is_beacon(hdr->frame_control) ||
2878 	     ieee80211_is_probe_resp(hdr->frame_control)))
2879 		rtw89_core_cancel_6ghz_probe_tx(rtwdev, skb);
2880 
2881 	rcu_read_lock();
2882 
2883 	rtwvif_link = rtw89_vif_get_link_inst(rtwvif, desc_info->bb_sel);
2884 	if (unlikely(!rtwvif_link))
2885 		goto out;
2886 
2887 	bss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, false);
2888 	if (!bss_conf->bssid)
2889 		goto out;
2890 
2891 	if (ieee80211_is_trigger(hdr->frame_control)) {
2892 		rtw89_stats_trigger_frame(rtwdev, rtwvif_link, bss_conf, skb);
2893 		goto out;
2894 	}
2895 
2896 	target_bssid = ieee80211_is_beacon(hdr->frame_control) &&
2897 		       bss_conf->nontransmitted ?
2898 		       bss_conf->transmitter_bssid : bss_conf->bssid;
2899 	if (!ether_addr_equal(target_bssid, bssid))
2900 		goto out;
2901 
2902 	if (is_mld) {
2903 		rx_status->link_valid = true;
2904 		rx_status->link_id = rtwvif_link->link_id;
2905 	}
2906 
2907 	if (ieee80211_is_beacon(hdr->frame_control)) {
2908 		if (vif->type == NL80211_IFTYPE_STATION &&
2909 		    !test_bit(RTW89_FLAG_WOWLAN, rtwdev->flags)) {
2910 			rtw89_vif_sync_bcn_tsf(rtwvif_link, hdr, skb->len);
2911 			rtw89_fw_h2c_rssi_offload(rtwdev, phy_ppdu);
2912 		}
2913 
2914 		if (phy_ppdu) {
2915 			ewma_rssi_add(&rtwdev->phystat.bcn_rssi, phy_ppdu->rssi_avg);
2916 			if (!test_bit(RTW89_FLAG_LOW_POWER_MODE, rtwdev->flags))
2917 				rtwvif_link->bcn_bw_idx = phy_ppdu->bw_idx;
2918 		}
2919 
2920 		pkt_stat->beacon_nr++;
2921 		pkt_stat->beacon_rate = desc_info->data_rate;
2922 		pkt_stat->beacon_len = skb->len;
2923 
2924 		rtw89_vif_rx_bcn_stat(rtwdev, bss_conf, skb);
2925 	}
2926 
2927 	if (!ether_addr_equal(bss_conf->addr, hdr->addr1))
2928 		goto out;
2929 
2930 	if (desc_info->data_rate < RTW89_HW_RATE_NR)
2931 		pkt_stat->rx_rate_cnt[desc_info->data_rate]++;
2932 
2933 	rtw89_traffic_stats_accu(rtwdev, rtwvif, skb, false, false);
2934 
2935 out:
2936 	rcu_read_unlock();
2937 }
2938 
2939 static void rtw89_core_rx_stats(struct rtw89_dev *rtwdev,
2940 				struct rtw89_rx_phy_ppdu *phy_ppdu,
2941 				struct rtw89_rx_desc_info *desc_info,
2942 				struct sk_buff *skb)
2943 {
2944 	struct rtw89_vif_rx_stats_iter_data iter_data;
2945 
2946 	rtw89_traffic_stats_accu(rtwdev, NULL, skb, true, false);
2947 
2948 	iter_data.rtwdev = rtwdev;
2949 	iter_data.phy_ppdu = phy_ppdu;
2950 	iter_data.desc_info = desc_info;
2951 	iter_data.skb = skb;
2952 	iter_data.bssid = get_hdr_bssid((struct ieee80211_hdr *)skb->data);
2953 	rtw89_iterate_vifs_bh(rtwdev, rtw89_vif_rx_stats_iter, &iter_data);
2954 }
2955 
2956 static void rtw89_correct_cck_chan(struct rtw89_dev *rtwdev,
2957 				   struct ieee80211_rx_status *status)
2958 {
2959 	const struct rtw89_chan_rcd *rcd =
2960 		rtw89_chan_rcd_get(rtwdev, RTW89_CHANCTX_0);
2961 	u16 chan = rcd->prev_primary_channel;
2962 	u8 band = rtw89_hw_to_nl80211_band(rcd->prev_band_type);
2963 
2964 	if (status->band != NL80211_BAND_2GHZ &&
2965 	    status->encoding == RX_ENC_LEGACY &&
2966 	    status->rate_idx < RTW89_HW_RATE_OFDM6) {
2967 		status->freq = ieee80211_channel_to_frequency(chan, band);
2968 		status->band = band;
2969 	}
2970 }
2971 
2972 static void rtw89_core_hw_to_sband_rate(struct ieee80211_rx_status *rx_status)
2973 {
2974 	if (rx_status->band == NL80211_BAND_2GHZ ||
2975 	    rx_status->encoding != RX_ENC_LEGACY)
2976 		return;
2977 
2978 	/* Some control frames' freq(ACKs in this case) are reported wrong due
2979 	 * to FW notify timing, set to lowest rate to prevent overflow.
2980 	 */
2981 	if (rx_status->rate_idx < RTW89_HW_RATE_OFDM6) {
2982 		rx_status->rate_idx = 0;
2983 		return;
2984 	}
2985 
2986 	/* No 4 CCK rates for non-2G */
2987 	rx_status->rate_idx -= 4;
2988 }
2989 
2990 static
2991 void rtw89_core_update_rx_status_by_ppdu(struct rtw89_dev *rtwdev,
2992 					 struct ieee80211_rx_status *rx_status,
2993 					 struct rtw89_rx_phy_ppdu *phy_ppdu)
2994 {
2995 	if (!(rtwdev->hw->conf.flags & IEEE80211_CONF_MONITOR))
2996 		return;
2997 
2998 	if (!phy_ppdu)
2999 		return;
3000 
3001 	if (phy_ppdu->ldpc)
3002 		rx_status->enc_flags |= RX_ENC_FLAG_LDPC;
3003 	if (phy_ppdu->stbc)
3004 		rx_status->enc_flags |= u8_encode_bits(1, RX_ENC_FLAG_STBC_MASK);
3005 }
3006 
3007 static const u8 rx_status_bw_to_radiotap_eht_usig[] = {
3008 	[RATE_INFO_BW_20] = IEEE80211_RADIOTAP_EHT_USIG_COMMON_BW_20MHZ,
3009 	[RATE_INFO_BW_5] = U8_MAX,
3010 	[RATE_INFO_BW_10] = U8_MAX,
3011 	[RATE_INFO_BW_40] = IEEE80211_RADIOTAP_EHT_USIG_COMMON_BW_40MHZ,
3012 	[RATE_INFO_BW_80] = IEEE80211_RADIOTAP_EHT_USIG_COMMON_BW_80MHZ,
3013 	[RATE_INFO_BW_160] = IEEE80211_RADIOTAP_EHT_USIG_COMMON_BW_160MHZ,
3014 	[RATE_INFO_BW_HE_RU] = U8_MAX,
3015 	[RATE_INFO_BW_320] = IEEE80211_RADIOTAP_EHT_USIG_COMMON_BW_320MHZ_1,
3016 	[RATE_INFO_BW_EHT_RU] = U8_MAX,
3017 };
3018 
3019 static void rtw89_core_update_radiotap_eht(struct rtw89_dev *rtwdev,
3020 					   struct sk_buff *skb,
3021 					   struct ieee80211_rx_status *rx_status)
3022 {
3023 	struct ieee80211_radiotap_eht_usig *usig;
3024 	struct ieee80211_radiotap_eht *eht;
3025 	struct ieee80211_radiotap_tlv *tlv;
3026 	int eht_len = struct_size(eht, user_info, 1);
3027 	int usig_len = sizeof(*usig);
3028 	int len;
3029 	u8 bw;
3030 
3031 	len = sizeof(*tlv) + ALIGN(eht_len, 4) +
3032 	      sizeof(*tlv) + ALIGN(usig_len, 4);
3033 
3034 	rx_status->flag |= RX_FLAG_RADIOTAP_TLV_AT_END;
3035 	skb_reset_mac_header(skb);
3036 
3037 	/* EHT */
3038 	tlv = skb_push(skb, len);
3039 	memset(tlv, 0, len);
3040 	tlv->type = cpu_to_le16(IEEE80211_RADIOTAP_EHT);
3041 	tlv->len = cpu_to_le16(eht_len);
3042 
3043 	eht = (struct ieee80211_radiotap_eht *)tlv->data;
3044 	eht->known = cpu_to_le32(IEEE80211_RADIOTAP_EHT_KNOWN_GI);
3045 	eht->data[0] =
3046 		le32_encode_bits(rx_status->eht.gi, IEEE80211_RADIOTAP_EHT_DATA0_GI);
3047 
3048 	eht->user_info[0] =
3049 		cpu_to_le32(IEEE80211_RADIOTAP_EHT_USER_INFO_MCS_KNOWN |
3050 			    IEEE80211_RADIOTAP_EHT_USER_INFO_NSS_KNOWN_O |
3051 			    IEEE80211_RADIOTAP_EHT_USER_INFO_CODING_KNOWN);
3052 	eht->user_info[0] |=
3053 		le32_encode_bits(rx_status->rate_idx, IEEE80211_RADIOTAP_EHT_USER_INFO_MCS) |
3054 		le32_encode_bits(rx_status->nss, IEEE80211_RADIOTAP_EHT_USER_INFO_NSS_O);
3055 	if (rx_status->enc_flags & RX_ENC_FLAG_LDPC)
3056 		eht->user_info[0] |=
3057 			cpu_to_le32(IEEE80211_RADIOTAP_EHT_USER_INFO_CODING);
3058 
3059 	/* U-SIG */
3060 	tlv = (void *)tlv + sizeof(*tlv) + ALIGN(eht_len, 4);
3061 	tlv->type = cpu_to_le16(IEEE80211_RADIOTAP_EHT_USIG);
3062 	tlv->len = cpu_to_le16(usig_len);
3063 
3064 	if (rx_status->bw >= ARRAY_SIZE(rx_status_bw_to_radiotap_eht_usig))
3065 		return;
3066 
3067 	bw = rx_status_bw_to_radiotap_eht_usig[rx_status->bw];
3068 	if (bw == U8_MAX)
3069 		return;
3070 
3071 	usig = (struct ieee80211_radiotap_eht_usig *)tlv->data;
3072 	usig->common =
3073 		le32_encode_bits(1, IEEE80211_RADIOTAP_EHT_USIG_COMMON_BW_KNOWN) |
3074 		le32_encode_bits(bw, IEEE80211_RADIOTAP_EHT_USIG_COMMON_BW);
3075 }
3076 
3077 static void rtw89_core_update_radiotap(struct rtw89_dev *rtwdev,
3078 				       struct sk_buff *skb,
3079 				       struct ieee80211_rx_status *rx_status)
3080 {
3081 	static const struct ieee80211_radiotap_he known_he = {
3082 		.data1 = cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_DATA_MCS_KNOWN |
3083 				     IEEE80211_RADIOTAP_HE_DATA1_CODING_KNOWN |
3084 				     IEEE80211_RADIOTAP_HE_DATA1_STBC_KNOWN |
3085 				     IEEE80211_RADIOTAP_HE_DATA1_BW_RU_ALLOC_KNOWN),
3086 		.data2 = cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_GI_KNOWN),
3087 	};
3088 	struct ieee80211_radiotap_he *he;
3089 
3090 	if (!(rtwdev->hw->conf.flags & IEEE80211_CONF_MONITOR))
3091 		return;
3092 
3093 	if (rx_status->encoding == RX_ENC_HE) {
3094 		rx_status->flag |= RX_FLAG_RADIOTAP_HE;
3095 		he = skb_push(skb, sizeof(*he));
3096 		*he = known_he;
3097 	} else if (rx_status->encoding == RX_ENC_EHT) {
3098 		rtw89_core_update_radiotap_eht(rtwdev, skb, rx_status);
3099 	}
3100 }
3101 
3102 static void rtw89_core_validate_rx_signal(struct ieee80211_rx_status *rx_status)
3103 {
3104 	if (!rx_status->signal)
3105 		rx_status->flag |= RX_FLAG_NO_SIGNAL_VAL;
3106 }
3107 
3108 static void rtw89_core_update_rx_freq_from_ie(struct rtw89_dev *rtwdev,
3109 					      struct sk_buff *skb,
3110 					      struct ieee80211_rx_status *rx_status)
3111 {
3112 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
3113 	size_t hdr_len, ielen;
3114 	u8 *variable;
3115 	int chan;
3116 
3117 	if (!rtwdev->chip->rx_freq_frome_ie)
3118 		return;
3119 
3120 	if (!rtwdev->scanning)
3121 		return;
3122 
3123 	if (ieee80211_is_beacon(mgmt->frame_control)) {
3124 		variable = mgmt->u.beacon.variable;
3125 		hdr_len = offsetof(struct ieee80211_mgmt,
3126 				   u.beacon.variable);
3127 	} else if (ieee80211_is_probe_resp(mgmt->frame_control)) {
3128 		variable = mgmt->u.probe_resp.variable;
3129 		hdr_len = offsetof(struct ieee80211_mgmt,
3130 				   u.probe_resp.variable);
3131 	} else {
3132 		return;
3133 	}
3134 
3135 	if (skb->len > hdr_len)
3136 		ielen = skb->len - hdr_len;
3137 	else
3138 		return;
3139 
3140 	/* The parsing code for both 2GHz and 5GHz bands is the same in this
3141 	 * function.
3142 	 */
3143 	chan = cfg80211_get_ies_channel_number(variable, ielen, NL80211_BAND_2GHZ);
3144 	if (chan == -1)
3145 		return;
3146 
3147 	rx_status->band = chan > 14 ? RTW89_BAND_5G : RTW89_BAND_2G;
3148 	rx_status->freq = ieee80211_channel_to_frequency(chan, rx_status->band);
3149 }
3150 
3151 static void rtw89_core_correct_mcc_chan(struct rtw89_dev *rtwdev,
3152 					struct rtw89_rx_desc_info *desc_info,
3153 					struct ieee80211_rx_status *rx_status,
3154 					struct rtw89_rx_phy_ppdu *phy_ppdu)
3155 {
3156 	enum rtw89_chip_gen chip_gen = rtwdev->chip->chip_gen;
3157 	struct rtw89_vif_link *rtwvif_link;
3158 	struct rtw89_sta_link *rtwsta_link;
3159 	const struct rtw89_chan *chan;
3160 	u8 mac_id = desc_info->mac_id;
3161 	enum rtw89_entity_mode mode;
3162 	enum nl80211_band band;
3163 
3164 	mode = rtw89_get_entity_mode(rtwdev);
3165 	if (likely(mode != RTW89_ENTITY_MODE_MCC))
3166 		return;
3167 
3168 	if (chip_gen == RTW89_CHIP_BE && phy_ppdu)
3169 		mac_id = phy_ppdu->mac_id;
3170 
3171 	rcu_read_lock();
3172 
3173 	rtwsta_link = rtw89_assoc_link_rcu_dereference(rtwdev, mac_id);
3174 	if (!rtwsta_link)
3175 		goto out;
3176 
3177 	rtwvif_link = rtwsta_link->rtwvif_link;
3178 	chan = rtw89_chan_get(rtwdev, rtwvif_link->chanctx_idx);
3179 	band = rtw89_hw_to_nl80211_band(chan->band_type);
3180 	rx_status->freq = ieee80211_channel_to_frequency(chan->primary_channel, band);
3181 
3182 out:
3183 	rcu_read_unlock();
3184 }
3185 
3186 static void rtw89_core_rx_to_mac80211(struct rtw89_dev *rtwdev,
3187 				      struct rtw89_rx_phy_ppdu *phy_ppdu,
3188 				      struct rtw89_rx_desc_info *desc_info,
3189 				      struct sk_buff *skb_ppdu,
3190 				      struct ieee80211_rx_status *rx_status)
3191 {
3192 	struct napi_struct *napi = &rtwdev->napi;
3193 
3194 	/* In low power mode, napi isn't scheduled. Receive it to netif. */
3195 	if (unlikely(!napi_is_scheduled(napi)))
3196 		napi = NULL;
3197 
3198 	rtw89_core_hw_to_sband_rate(rx_status);
3199 	rtw89_core_rx_stats(rtwdev, phy_ppdu, desc_info, skb_ppdu);
3200 	rtw89_core_update_rx_status_by_ppdu(rtwdev, rx_status, phy_ppdu);
3201 	rtw89_core_update_radiotap(rtwdev, skb_ppdu, rx_status);
3202 	rtw89_core_validate_rx_signal(rx_status);
3203 	rtw89_core_update_rx_freq_from_ie(rtwdev, skb_ppdu, rx_status);
3204 	rtw89_core_correct_mcc_chan(rtwdev, desc_info, rx_status, phy_ppdu);
3205 
3206 	/* In low power mode, it does RX in thread context. */
3207 	local_bh_disable();
3208 	ieee80211_rx_napi(rtwdev->hw, NULL, skb_ppdu, napi);
3209 	local_bh_enable();
3210 	rtwdev->napi_budget_countdown--;
3211 }
3212 
3213 static void rtw89_core_rx_pending_skb(struct rtw89_dev *rtwdev,
3214 				      struct rtw89_rx_phy_ppdu *phy_ppdu,
3215 				      struct rtw89_rx_desc_info *desc_info,
3216 				      struct sk_buff *skb)
3217 {
3218 	u8 band = desc_info->bb_sel ? RTW89_PHY_1 : RTW89_PHY_0;
3219 	int curr = rtwdev->ppdu_sts.curr_rx_ppdu_cnt[band];
3220 	struct sk_buff *skb_ppdu = NULL, *tmp;
3221 	struct ieee80211_rx_status *rx_status;
3222 
3223 	if (curr > RTW89_MAX_PPDU_CNT)
3224 		return;
3225 
3226 	skb_queue_walk_safe(&rtwdev->ppdu_sts.rx_queue[band], skb_ppdu, tmp) {
3227 		skb_unlink(skb_ppdu, &rtwdev->ppdu_sts.rx_queue[band]);
3228 		rx_status = IEEE80211_SKB_RXCB(skb_ppdu);
3229 		if (rtw89_core_rx_ppdu_match(rtwdev, desc_info, rx_status))
3230 			rtw89_chip_query_ppdu(rtwdev, phy_ppdu, rx_status);
3231 		rtw89_correct_cck_chan(rtwdev, rx_status);
3232 		rtw89_core_rx_to_mac80211(rtwdev, phy_ppdu, desc_info, skb_ppdu, rx_status);
3233 	}
3234 }
3235 
3236 static void rtw89_core_rx_process_ppdu_sts(struct rtw89_dev *rtwdev,
3237 					   struct rtw89_rx_desc_info *desc_info,
3238 					   struct sk_buff *skb)
3239 {
3240 	struct rtw89_rx_phy_ppdu phy_ppdu = {.buf = skb->data, .valid = false,
3241 					     .len = skb->len,
3242 					     .to_self = desc_info->addr1_match,
3243 					     .rate = desc_info->data_rate,
3244 					     .mac_id = desc_info->mac_id,
3245 					     .phy_idx = desc_info->bb_sel};
3246 	int ret;
3247 
3248 	if (desc_info->mac_info_valid) {
3249 		ret = rtw89_core_rx_process_mac_ppdu(rtwdev, skb, &phy_ppdu);
3250 		if (ret)
3251 			goto out;
3252 	}
3253 
3254 	ret = rtw89_core_rx_process_phy_ppdu(rtwdev, &phy_ppdu);
3255 	if (ret)
3256 		goto out;
3257 
3258 	rtw89_core_rx_process_phy_sts(rtwdev, &phy_ppdu);
3259 
3260 out:
3261 	rtw89_core_rx_pending_skb(rtwdev, &phy_ppdu, desc_info, skb);
3262 	dev_kfree_skb_any(skb);
3263 }
3264 
3265 static void rtw89_core_rx_process_report(struct rtw89_dev *rtwdev,
3266 					 struct rtw89_rx_desc_info *desc_info,
3267 					 struct sk_buff *skb)
3268 {
3269 	switch (desc_info->pkt_type) {
3270 	case RTW89_CORE_RX_TYPE_C2H:
3271 		rtw89_fw_c2h_irqsafe(rtwdev, skb);
3272 		break;
3273 	case RTW89_CORE_RX_TYPE_PPDU_STAT:
3274 		rtw89_core_rx_process_ppdu_sts(rtwdev, desc_info, skb);
3275 		break;
3276 	default:
3277 		rtw89_debug(rtwdev, RTW89_DBG_TXRX, "unhandled pkt_type=%d\n",
3278 			    desc_info->pkt_type);
3279 		dev_kfree_skb_any(skb);
3280 		break;
3281 	}
3282 }
3283 
3284 void rtw89_core_query_rxdesc(struct rtw89_dev *rtwdev,
3285 			     struct rtw89_rx_desc_info *desc_info,
3286 			     u8 *data, u32 data_offset)
3287 {
3288 	const struct rtw89_chip_info *chip = rtwdev->chip;
3289 	struct rtw89_rxdesc_short *rxd_s;
3290 	struct rtw89_rxdesc_long *rxd_l;
3291 	u8 shift_len, drv_info_len;
3292 
3293 	rxd_s = (struct rtw89_rxdesc_short *)(data + data_offset);
3294 	desc_info->pkt_size = le32_get_bits(rxd_s->dword0, AX_RXD_RPKT_LEN_MASK);
3295 	desc_info->drv_info_size = le32_get_bits(rxd_s->dword0, AX_RXD_DRV_INFO_SIZE_MASK);
3296 	desc_info->long_rxdesc = le32_get_bits(rxd_s->dword0,  AX_RXD_LONG_RXD);
3297 	desc_info->pkt_type = le32_get_bits(rxd_s->dword0,  AX_RXD_RPKT_TYPE_MASK);
3298 	desc_info->mac_info_valid = le32_get_bits(rxd_s->dword0, AX_RXD_MAC_INFO_VLD);
3299 	if (chip->chip_id == RTL8852C)
3300 		desc_info->bw = le32_get_bits(rxd_s->dword1, AX_RXD_BW_v1_MASK);
3301 	else
3302 		desc_info->bw = le32_get_bits(rxd_s->dword1, AX_RXD_BW_MASK);
3303 	desc_info->data_rate = le32_get_bits(rxd_s->dword1, AX_RXD_RX_DATARATE_MASK);
3304 	desc_info->gi_ltf = le32_get_bits(rxd_s->dword1, AX_RXD_RX_GI_LTF_MASK);
3305 	desc_info->user_id = le32_get_bits(rxd_s->dword1, AX_RXD_USER_ID_MASK);
3306 	desc_info->sr_en = le32_get_bits(rxd_s->dword1, AX_RXD_SR_EN);
3307 	desc_info->ppdu_cnt = le32_get_bits(rxd_s->dword1, AX_RXD_PPDU_CNT_MASK);
3308 	desc_info->ppdu_type = le32_get_bits(rxd_s->dword1, AX_RXD_PPDU_TYPE_MASK);
3309 	desc_info->free_run_cnt = le32_get_bits(rxd_s->dword2, AX_RXD_FREERUN_CNT_MASK);
3310 	desc_info->icv_err = le32_get_bits(rxd_s->dword3, AX_RXD_ICV_ERR);
3311 	desc_info->crc32_err = le32_get_bits(rxd_s->dword3, AX_RXD_CRC32_ERR);
3312 	desc_info->hw_dec = le32_get_bits(rxd_s->dword3, AX_RXD_HW_DEC);
3313 	desc_info->sw_dec = le32_get_bits(rxd_s->dword3, AX_RXD_SW_DEC);
3314 	desc_info->addr1_match = le32_get_bits(rxd_s->dword3, AX_RXD_A1_MATCH);
3315 
3316 	shift_len = desc_info->shift << 1; /* 2-byte unit */
3317 	drv_info_len = desc_info->drv_info_size << 3; /* 8-byte unit */
3318 	desc_info->offset = data_offset + shift_len + drv_info_len;
3319 	if (desc_info->long_rxdesc)
3320 		desc_info->rxd_len = sizeof(struct rtw89_rxdesc_long);
3321 	else
3322 		desc_info->rxd_len = sizeof(struct rtw89_rxdesc_short);
3323 	desc_info->ready = true;
3324 
3325 	if (!desc_info->long_rxdesc)
3326 		return;
3327 
3328 	rxd_l = (struct rtw89_rxdesc_long *)(data + data_offset);
3329 	desc_info->frame_type = le32_get_bits(rxd_l->dword4, AX_RXD_TYPE_MASK);
3330 	desc_info->addr_cam_valid = le32_get_bits(rxd_l->dword5, AX_RXD_ADDR_CAM_VLD);
3331 	desc_info->addr_cam_id = le32_get_bits(rxd_l->dword5, AX_RXD_ADDR_CAM_MASK);
3332 	desc_info->sec_cam_id = le32_get_bits(rxd_l->dword5, AX_RXD_SEC_CAM_IDX_MASK);
3333 	desc_info->mac_id = le32_get_bits(rxd_l->dword5, AX_RXD_MAC_ID_MASK);
3334 	desc_info->rx_pl_id = le32_get_bits(rxd_l->dword5, AX_RXD_RX_PL_ID_MASK);
3335 }
3336 EXPORT_SYMBOL(rtw89_core_query_rxdesc);
3337 
3338 void rtw89_core_query_rxdesc_v2(struct rtw89_dev *rtwdev,
3339 				struct rtw89_rx_desc_info *desc_info,
3340 				u8 *data, u32 data_offset)
3341 {
3342 	struct rtw89_rxdesc_phy_rpt_v2 *rxd_rpt;
3343 	struct rtw89_rxdesc_short_v2 *rxd_s;
3344 	struct rtw89_rxdesc_long_v2 *rxd_l;
3345 	u16 shift_len, drv_info_len, phy_rtp_len, hdr_cnv_len;
3346 
3347 	rxd_s = (struct rtw89_rxdesc_short_v2 *)(data + data_offset);
3348 
3349 	desc_info->pkt_size = le32_get_bits(rxd_s->dword0, BE_RXD_RPKT_LEN_MASK);
3350 	desc_info->drv_info_size = le32_get_bits(rxd_s->dword0, BE_RXD_DRV_INFO_SZ_MASK);
3351 	desc_info->phy_rpt_size = le32_get_bits(rxd_s->dword0, BE_RXD_PHY_RPT_SZ_MASK);
3352 	desc_info->hdr_cnv_size = le32_get_bits(rxd_s->dword0, BE_RXD_HDR_CNV_SZ_MASK);
3353 	desc_info->shift = le32_get_bits(rxd_s->dword0, BE_RXD_SHIFT_MASK);
3354 	desc_info->long_rxdesc = le32_get_bits(rxd_s->dword0, BE_RXD_LONG_RXD);
3355 	desc_info->pkt_type = le32_get_bits(rxd_s->dword0, BE_RXD_RPKT_TYPE_MASK);
3356 	desc_info->bb_sel = le32_get_bits(rxd_s->dword0, BE_RXD_BB_SEL);
3357 	if (desc_info->pkt_type == RTW89_CORE_RX_TYPE_PPDU_STAT)
3358 		desc_info->mac_info_valid = true;
3359 
3360 	desc_info->frame_type = le32_get_bits(rxd_s->dword2, BE_RXD_TYPE_MASK);
3361 	desc_info->mac_id = le32_get_bits(rxd_s->dword2, BE_RXD_MAC_ID_MASK);
3362 	desc_info->addr_cam_valid = le32_get_bits(rxd_s->dword2, BE_RXD_ADDR_CAM_VLD);
3363 
3364 	desc_info->icv_err = le32_get_bits(rxd_s->dword3, BE_RXD_ICV_ERR);
3365 	desc_info->crc32_err = le32_get_bits(rxd_s->dword3, BE_RXD_CRC32_ERR);
3366 	desc_info->hw_dec = le32_get_bits(rxd_s->dword3, BE_RXD_HW_DEC);
3367 	desc_info->sw_dec = le32_get_bits(rxd_s->dword3, BE_RXD_SW_DEC);
3368 	desc_info->addr1_match = le32_get_bits(rxd_s->dword3, BE_RXD_A1_MATCH);
3369 
3370 	desc_info->bw = le32_get_bits(rxd_s->dword4, BE_RXD_BW_MASK);
3371 	desc_info->data_rate = le32_get_bits(rxd_s->dword4, BE_RXD_RX_DATARATE_MASK);
3372 	desc_info->gi_ltf = le32_get_bits(rxd_s->dword4, BE_RXD_RX_GI_LTF_MASK);
3373 	desc_info->ppdu_cnt = le32_get_bits(rxd_s->dword4, BE_RXD_PPDU_CNT_MASK);
3374 	desc_info->ppdu_type = le32_get_bits(rxd_s->dword4, BE_RXD_PPDU_TYPE_MASK);
3375 
3376 	desc_info->free_run_cnt = le32_to_cpu(rxd_s->dword5);
3377 
3378 	shift_len = desc_info->shift << 1; /* 2-byte unit */
3379 	drv_info_len = desc_info->drv_info_size << 3; /* 8-byte unit */
3380 	phy_rtp_len = desc_info->phy_rpt_size << 3; /* 8-byte unit */
3381 	hdr_cnv_len = desc_info->hdr_cnv_size << 4; /* 16-byte unit */
3382 	desc_info->offset = data_offset + shift_len + drv_info_len +
3383 			    phy_rtp_len + hdr_cnv_len;
3384 
3385 	if (desc_info->long_rxdesc)
3386 		desc_info->rxd_len = sizeof(struct rtw89_rxdesc_long_v2);
3387 	else
3388 		desc_info->rxd_len = sizeof(struct rtw89_rxdesc_short_v2);
3389 	desc_info->ready = true;
3390 
3391 	if (phy_rtp_len == sizeof(*rxd_rpt)) {
3392 		rxd_rpt = (struct rtw89_rxdesc_phy_rpt_v2 *)(data + data_offset +
3393 							     desc_info->rxd_len);
3394 		desc_info->rssi = le32_get_bits(rxd_rpt->dword0, BE_RXD_PHY_RSSI);
3395 	}
3396 
3397 	if (!desc_info->long_rxdesc)
3398 		return;
3399 
3400 	rxd_l = (struct rtw89_rxdesc_long_v2 *)(data + data_offset);
3401 
3402 	desc_info->sr_en = le32_get_bits(rxd_l->dword6, BE_RXD_SR_EN);
3403 	desc_info->user_id = le32_get_bits(rxd_l->dword6, BE_RXD_USER_ID_MASK);
3404 	desc_info->addr_cam_id = le32_get_bits(rxd_l->dword6, BE_RXD_ADDR_CAM_MASK);
3405 	desc_info->sec_cam_id = le32_get_bits(rxd_l->dword6, BE_RXD_SEC_CAM_IDX_MASK);
3406 
3407 	desc_info->rx_pl_id = le32_get_bits(rxd_l->dword7, BE_RXD_RX_PL_ID_MASK);
3408 }
3409 EXPORT_SYMBOL(rtw89_core_query_rxdesc_v2);
3410 
3411 struct rtw89_core_iter_rx_status {
3412 	struct rtw89_dev *rtwdev;
3413 	struct ieee80211_rx_status *rx_status;
3414 	struct rtw89_rx_desc_info *desc_info;
3415 	u8 mac_id;
3416 };
3417 
3418 static
3419 void rtw89_core_stats_sta_rx_status_iter(void *data, struct ieee80211_sta *sta)
3420 {
3421 	struct rtw89_core_iter_rx_status *iter_data =
3422 				(struct rtw89_core_iter_rx_status *)data;
3423 	struct ieee80211_rx_status *rx_status = iter_data->rx_status;
3424 	struct rtw89_rx_desc_info *desc_info = iter_data->desc_info;
3425 	struct rtw89_sta *rtwsta = sta_to_rtwsta(sta);
3426 	struct rtw89_sta_link *rtwsta_link;
3427 	u8 mac_id = iter_data->mac_id;
3428 
3429 	rtwsta_link = rtw89_sta_get_link_inst(rtwsta, desc_info->bb_sel);
3430 	if (unlikely(!rtwsta_link))
3431 		return;
3432 
3433 	if (mac_id != rtwsta_link->mac_id)
3434 		return;
3435 
3436 	rtwsta_link->rx_status = *rx_status;
3437 	rtwsta_link->rx_hw_rate = desc_info->data_rate;
3438 }
3439 
3440 static void rtw89_core_stats_sta_rx_status(struct rtw89_dev *rtwdev,
3441 					   struct rtw89_rx_desc_info *desc_info,
3442 					   struct ieee80211_rx_status *rx_status)
3443 {
3444 	struct rtw89_core_iter_rx_status iter_data;
3445 
3446 	if (!desc_info->addr1_match || !desc_info->long_rxdesc)
3447 		return;
3448 
3449 	if (desc_info->frame_type != RTW89_RX_TYPE_DATA)
3450 		return;
3451 
3452 	iter_data.rtwdev = rtwdev;
3453 	iter_data.rx_status = rx_status;
3454 	iter_data.desc_info = desc_info;
3455 	iter_data.mac_id = desc_info->mac_id;
3456 	ieee80211_iterate_stations_atomic(rtwdev->hw,
3457 					  rtw89_core_stats_sta_rx_status_iter,
3458 					  &iter_data);
3459 }
3460 
3461 static void rtw89_core_update_rx_status(struct rtw89_dev *rtwdev,
3462 					struct sk_buff *skb,
3463 					struct rtw89_rx_desc_info *desc_info,
3464 					struct ieee80211_rx_status *rx_status)
3465 {
3466 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
3467 	const struct cfg80211_chan_def *chandef =
3468 		rtw89_chandef_get(rtwdev, RTW89_CHANCTX_0);
3469 	u16 data_rate;
3470 	u8 data_rate_mode;
3471 	bool eht = false;
3472 	u8 gi;
3473 
3474 	/* currently using single PHY */
3475 	rx_status->freq = chandef->chan->center_freq;
3476 	rx_status->band = chandef->chan->band;
3477 
3478 	if (ieee80211_is_beacon(hdr->frame_control) ||
3479 	    ieee80211_is_probe_resp(hdr->frame_control))
3480 		rx_status->boottime_ns = ktime_get_boottime_ns();
3481 
3482 	if (rtwdev->scanning &&
3483 	    RTW89_CHK_FW_FEATURE(SCAN_OFFLOAD, &rtwdev->fw)) {
3484 		const struct rtw89_chan *cur = rtw89_scan_chan_get(rtwdev);
3485 		u8 chan = cur->primary_channel;
3486 		u8 band = cur->band_type;
3487 		enum nl80211_band nl_band;
3488 
3489 		nl_band = rtw89_hw_to_nl80211_band(band);
3490 		rx_status->freq = ieee80211_channel_to_frequency(chan, nl_band);
3491 		rx_status->band = nl_band;
3492 	}
3493 
3494 	if (desc_info->icv_err || desc_info->crc32_err)
3495 		rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
3496 
3497 	if (desc_info->hw_dec &&
3498 	    !(desc_info->sw_dec || desc_info->icv_err))
3499 		rx_status->flag |= RX_FLAG_DECRYPTED;
3500 
3501 	rx_status->bw = rtw89_hw_to_rate_info_bw(desc_info->bw);
3502 
3503 	data_rate = desc_info->data_rate;
3504 	data_rate_mode = rtw89_get_data_rate_mode(rtwdev, data_rate);
3505 	if (data_rate_mode == DATA_RATE_MODE_NON_HT) {
3506 		rx_status->encoding = RX_ENC_LEGACY;
3507 		rx_status->rate_idx = rtw89_get_data_not_ht_idx(rtwdev, data_rate);
3508 		/* convert rate_idx after we get the correct band */
3509 	} else if (data_rate_mode == DATA_RATE_MODE_HT) {
3510 		rx_status->encoding = RX_ENC_HT;
3511 		rx_status->rate_idx = rtw89_get_data_ht_mcs(rtwdev, data_rate);
3512 		if (desc_info->gi_ltf)
3513 			rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
3514 	} else if (data_rate_mode == DATA_RATE_MODE_VHT) {
3515 		rx_status->encoding = RX_ENC_VHT;
3516 		rx_status->rate_idx = rtw89_get_data_mcs(rtwdev, data_rate);
3517 		rx_status->nss = rtw89_get_data_nss(rtwdev, data_rate) + 1;
3518 		if (desc_info->gi_ltf)
3519 			rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
3520 	} else if (data_rate_mode == DATA_RATE_MODE_HE) {
3521 		rx_status->encoding = RX_ENC_HE;
3522 		rx_status->rate_idx = rtw89_get_data_mcs(rtwdev, data_rate);
3523 		rx_status->nss = rtw89_get_data_nss(rtwdev, data_rate) + 1;
3524 	} else if (data_rate_mode == DATA_RATE_MODE_EHT) {
3525 		rx_status->encoding = RX_ENC_EHT;
3526 		rx_status->rate_idx = rtw89_get_data_mcs(rtwdev, data_rate);
3527 		rx_status->nss = rtw89_get_data_nss(rtwdev, data_rate) + 1;
3528 		eht = true;
3529 	} else {
3530 		rtw89_warn(rtwdev, "invalid RX rate mode %d\n", data_rate_mode);
3531 	}
3532 
3533 	/* he_gi is used to match ppdu, so we always fill it. */
3534 	gi = rtw89_rxdesc_to_nl_he_eht_gi(rtwdev, desc_info->gi_ltf, true, eht);
3535 	if (eht)
3536 		rx_status->eht.gi = gi;
3537 	else
3538 		rx_status->he_gi = gi;
3539 	rx_status->flag |= RX_FLAG_MACTIME_START;
3540 	rx_status->mactime = desc_info->free_run_cnt;
3541 
3542 	rtw89_chip_phy_rpt_to_rssi(rtwdev, desc_info, rx_status);
3543 	rtw89_core_stats_sta_rx_status(rtwdev, desc_info, rx_status);
3544 }
3545 
3546 static enum rtw89_ps_mode rtw89_update_ps_mode(struct rtw89_dev *rtwdev)
3547 {
3548 	const struct rtw89_chip_info *chip = rtwdev->chip;
3549 
3550 	if (rtwdev->hci.type != RTW89_HCI_TYPE_PCIE)
3551 		return RTW89_PS_MODE_NONE;
3552 
3553 	if (rtw89_disable_ps_mode || !chip->ps_mode_supported ||
3554 	    RTW89_CHK_FW_FEATURE(NO_DEEP_PS, &rtwdev->fw))
3555 		return RTW89_PS_MODE_NONE;
3556 
3557 	if ((chip->ps_mode_supported & BIT(RTW89_PS_MODE_PWR_GATED)) &&
3558 	    !RTW89_CHK_FW_FEATURE(NO_LPS_PG, &rtwdev->fw))
3559 		return RTW89_PS_MODE_PWR_GATED;
3560 
3561 	if (chip->ps_mode_supported & BIT(RTW89_PS_MODE_CLK_GATED))
3562 		return RTW89_PS_MODE_CLK_GATED;
3563 
3564 	if (chip->ps_mode_supported & BIT(RTW89_PS_MODE_RFOFF))
3565 		return RTW89_PS_MODE_RFOFF;
3566 
3567 	return RTW89_PS_MODE_NONE;
3568 }
3569 
3570 static void rtw89_core_flush_ppdu_rx_queue(struct rtw89_dev *rtwdev,
3571 					   struct rtw89_rx_desc_info *desc_info)
3572 {
3573 	struct rtw89_ppdu_sts_info *ppdu_sts = &rtwdev->ppdu_sts;
3574 	u8 band = desc_info->bb_sel ? RTW89_PHY_1 : RTW89_PHY_0;
3575 	struct ieee80211_rx_status *rx_status;
3576 	struct sk_buff *skb_ppdu, *tmp;
3577 
3578 	skb_queue_walk_safe(&ppdu_sts->rx_queue[band], skb_ppdu, tmp) {
3579 		skb_unlink(skb_ppdu, &ppdu_sts->rx_queue[band]);
3580 		rx_status = IEEE80211_SKB_RXCB(skb_ppdu);
3581 		rtw89_core_rx_to_mac80211(rtwdev, NULL, desc_info, skb_ppdu, rx_status);
3582 	}
3583 }
3584 
3585 static
3586 void rtw89_core_rx_pkt_hdl(struct rtw89_dev *rtwdev, const struct sk_buff *skb,
3587 			   const struct rtw89_rx_desc_info *desc)
3588 {
3589 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
3590 	struct rtw89_sta_link *rtwsta_link;
3591 	struct ieee80211_sta *sta;
3592 	struct rtw89_sta *rtwsta;
3593 	u8 macid = desc->mac_id;
3594 
3595 	if (!refcount_read(&rtwdev->refcount_ap_info))
3596 		return;
3597 
3598 	rcu_read_lock();
3599 
3600 	rtwsta_link = rtw89_assoc_link_rcu_dereference(rtwdev, macid);
3601 	if (!rtwsta_link)
3602 		goto out;
3603 
3604 	rtwsta = rtwsta_link->rtwsta;
3605 	if (!test_bit(RTW89_REMOTE_STA_IN_PS, rtwsta->flags))
3606 		goto out;
3607 
3608 	sta = rtwsta_to_sta(rtwsta);
3609 	if (ieee80211_is_pspoll(hdr->frame_control))
3610 		ieee80211_sta_pspoll(sta);
3611 	else if (ieee80211_has_pm(hdr->frame_control) &&
3612 		 (ieee80211_is_data_qos(hdr->frame_control) ||
3613 		  ieee80211_is_qos_nullfunc(hdr->frame_control)))
3614 		ieee80211_sta_uapsd_trigger(sta, ieee80211_get_tid(hdr));
3615 
3616 out:
3617 	rcu_read_unlock();
3618 }
3619 
3620 void rtw89_core_rx(struct rtw89_dev *rtwdev,
3621 		   struct rtw89_rx_desc_info *desc_info,
3622 		   struct sk_buff *skb)
3623 {
3624 	struct ieee80211_rx_status *rx_status;
3625 	struct rtw89_ppdu_sts_info *ppdu_sts = &rtwdev->ppdu_sts;
3626 	u8 ppdu_cnt = desc_info->ppdu_cnt;
3627 	u8 band = desc_info->bb_sel ? RTW89_PHY_1 : RTW89_PHY_0;
3628 
3629 	if (desc_info->pkt_type != RTW89_CORE_RX_TYPE_WIFI) {
3630 		rtw89_core_rx_process_report(rtwdev, desc_info, skb);
3631 		return;
3632 	}
3633 
3634 	if (ppdu_sts->curr_rx_ppdu_cnt[band] != ppdu_cnt) {
3635 		rtw89_core_flush_ppdu_rx_queue(rtwdev, desc_info);
3636 		ppdu_sts->curr_rx_ppdu_cnt[band] = ppdu_cnt;
3637 	}
3638 
3639 	rx_status = IEEE80211_SKB_RXCB(skb);
3640 	memset(rx_status, 0, sizeof(*rx_status));
3641 	rtw89_core_update_rx_status(rtwdev, skb, desc_info, rx_status);
3642 	rtw89_core_rx_pkt_hdl(rtwdev, skb, desc_info);
3643 	if (desc_info->long_rxdesc &&
3644 	    BIT(desc_info->frame_type) & PPDU_FILTER_BITMAP)
3645 		skb_queue_tail(&ppdu_sts->rx_queue[band], skb);
3646 	else
3647 		rtw89_core_rx_to_mac80211(rtwdev, NULL, desc_info, skb, rx_status);
3648 }
3649 EXPORT_SYMBOL(rtw89_core_rx);
3650 
3651 void rtw89_core_napi_start(struct rtw89_dev *rtwdev)
3652 {
3653 	if (test_and_set_bit(RTW89_FLAG_NAPI_RUNNING, rtwdev->flags))
3654 		return;
3655 
3656 	napi_enable(&rtwdev->napi);
3657 }
3658 EXPORT_SYMBOL(rtw89_core_napi_start);
3659 
3660 void rtw89_core_napi_stop(struct rtw89_dev *rtwdev)
3661 {
3662 	if (!test_and_clear_bit(RTW89_FLAG_NAPI_RUNNING, rtwdev->flags))
3663 		return;
3664 
3665 	napi_synchronize(&rtwdev->napi);
3666 	napi_disable(&rtwdev->napi);
3667 }
3668 EXPORT_SYMBOL(rtw89_core_napi_stop);
3669 
3670 int rtw89_core_napi_init(struct rtw89_dev *rtwdev)
3671 {
3672 	rtwdev->netdev = alloc_netdev_dummy(0);
3673 	if (!rtwdev->netdev)
3674 		return -ENOMEM;
3675 
3676 	netif_napi_add(rtwdev->netdev, &rtwdev->napi,
3677 		       rtwdev->hci.ops->napi_poll);
3678 	return 0;
3679 }
3680 EXPORT_SYMBOL(rtw89_core_napi_init);
3681 
3682 void rtw89_core_napi_deinit(struct rtw89_dev *rtwdev)
3683 {
3684 	rtw89_core_napi_stop(rtwdev);
3685 	netif_napi_del(&rtwdev->napi);
3686 	free_netdev(rtwdev->netdev);
3687 }
3688 EXPORT_SYMBOL(rtw89_core_napi_deinit);
3689 
3690 static void rtw89_core_ba_work(struct work_struct *work)
3691 {
3692 	struct rtw89_dev *rtwdev =
3693 		container_of(work, struct rtw89_dev, ba_work);
3694 	struct rtw89_txq *rtwtxq, *tmp;
3695 	int ret;
3696 
3697 	spin_lock_bh(&rtwdev->ba_lock);
3698 	list_for_each_entry_safe(rtwtxq, tmp, &rtwdev->ba_list, list) {
3699 		struct ieee80211_txq *txq = rtw89_txq_to_txq(rtwtxq);
3700 		struct ieee80211_sta *sta = txq->sta;
3701 		struct rtw89_sta *rtwsta = sta_to_rtwsta_safe(sta);
3702 		u8 tid = txq->tid;
3703 
3704 		if (!sta) {
3705 			rtw89_warn(rtwdev, "cannot start BA without sta\n");
3706 			goto skip_ba_work;
3707 		}
3708 
3709 		if (rtwsta->disassoc) {
3710 			rtw89_debug(rtwdev, RTW89_DBG_TXRX,
3711 				    "cannot start BA with disassoc sta\n");
3712 			goto skip_ba_work;
3713 		}
3714 
3715 		ret = ieee80211_start_tx_ba_session(sta, tid, 0);
3716 		if (ret) {
3717 			rtw89_debug(rtwdev, RTW89_DBG_TXRX,
3718 				    "failed to setup BA session for %pM:%2d: %d\n",
3719 				    sta->addr, tid, ret);
3720 			if (ret == -EINVAL)
3721 				set_bit(RTW89_TXQ_F_BLOCK_BA, &rtwtxq->flags);
3722 		}
3723 skip_ba_work:
3724 		list_del_init(&rtwtxq->list);
3725 	}
3726 	spin_unlock_bh(&rtwdev->ba_lock);
3727 }
3728 
3729 void rtw89_core_free_sta_pending_ba(struct rtw89_dev *rtwdev,
3730 				    struct ieee80211_sta *sta)
3731 {
3732 	struct rtw89_txq *rtwtxq, *tmp;
3733 
3734 	spin_lock_bh(&rtwdev->ba_lock);
3735 	list_for_each_entry_safe(rtwtxq, tmp, &rtwdev->ba_list, list) {
3736 		struct ieee80211_txq *txq = rtw89_txq_to_txq(rtwtxq);
3737 
3738 		if (sta == txq->sta)
3739 			list_del_init(&rtwtxq->list);
3740 	}
3741 	spin_unlock_bh(&rtwdev->ba_lock);
3742 }
3743 
3744 void rtw89_core_free_sta_pending_forbid_ba(struct rtw89_dev *rtwdev,
3745 					   struct ieee80211_sta *sta)
3746 {
3747 	struct rtw89_txq *rtwtxq, *tmp;
3748 
3749 	spin_lock_bh(&rtwdev->ba_lock);
3750 	list_for_each_entry_safe(rtwtxq, tmp, &rtwdev->forbid_ba_list, list) {
3751 		struct ieee80211_txq *txq = rtw89_txq_to_txq(rtwtxq);
3752 
3753 		if (sta == txq->sta) {
3754 			clear_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags);
3755 			list_del_init(&rtwtxq->list);
3756 		}
3757 	}
3758 	spin_unlock_bh(&rtwdev->ba_lock);
3759 }
3760 
3761 void rtw89_core_free_sta_pending_roc_tx(struct rtw89_dev *rtwdev,
3762 					struct ieee80211_sta *sta)
3763 {
3764 	struct rtw89_sta *rtwsta = sta_to_rtwsta(sta);
3765 	struct sk_buff *skb;
3766 
3767 	while ((skb = skb_dequeue(&rtwsta->roc_queue)))
3768 		dev_kfree_skb_any(skb);
3769 }
3770 
3771 static void rtw89_core_stop_tx_ba_session(struct rtw89_dev *rtwdev,
3772 					  struct rtw89_txq *rtwtxq)
3773 {
3774 	struct ieee80211_txq *txq = rtw89_txq_to_txq(rtwtxq);
3775 	struct ieee80211_sta *sta = txq->sta;
3776 	struct rtw89_sta *rtwsta = sta_to_rtwsta_safe(sta);
3777 
3778 	if (unlikely(!rtwsta) || unlikely(rtwsta->disassoc))
3779 		return;
3780 
3781 	if (!test_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags) ||
3782 	    test_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags))
3783 		return;
3784 
3785 	spin_lock_bh(&rtwdev->ba_lock);
3786 	if (!test_and_set_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags))
3787 		list_add_tail(&rtwtxq->list, &rtwdev->forbid_ba_list);
3788 	spin_unlock_bh(&rtwdev->ba_lock);
3789 
3790 	ieee80211_stop_tx_ba_session(sta, txq->tid);
3791 	cancel_delayed_work(&rtwdev->forbid_ba_work);
3792 	ieee80211_queue_delayed_work(rtwdev->hw, &rtwdev->forbid_ba_work,
3793 				     RTW89_FORBID_BA_TIMER);
3794 }
3795 
3796 static void rtw89_core_txq_check_agg(struct rtw89_dev *rtwdev,
3797 				     struct rtw89_txq *rtwtxq,
3798 				     struct sk_buff *skb)
3799 {
3800 	struct ieee80211_hw *hw = rtwdev->hw;
3801 	struct ieee80211_txq *txq = rtw89_txq_to_txq(rtwtxq);
3802 	struct ieee80211_sta *sta = txq->sta;
3803 	struct rtw89_sta *rtwsta = sta_to_rtwsta_safe(sta);
3804 
3805 	if (test_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags))
3806 		return;
3807 
3808 	if (unlikely(skb->protocol == cpu_to_be16(ETH_P_PAE))) {
3809 		rtw89_core_stop_tx_ba_session(rtwdev, rtwtxq);
3810 		return;
3811 	}
3812 
3813 	if (unlikely(!sta))
3814 		return;
3815 
3816 	if (unlikely(test_bit(RTW89_TXQ_F_BLOCK_BA, &rtwtxq->flags)))
3817 		return;
3818 
3819 	if (test_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags)) {
3820 		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_AMPDU;
3821 		return;
3822 	}
3823 
3824 	spin_lock_bh(&rtwdev->ba_lock);
3825 	if (!rtwsta->disassoc && list_empty(&rtwtxq->list)) {
3826 		list_add_tail(&rtwtxq->list, &rtwdev->ba_list);
3827 		ieee80211_queue_work(hw, &rtwdev->ba_work);
3828 	}
3829 	spin_unlock_bh(&rtwdev->ba_lock);
3830 }
3831 
3832 static void rtw89_core_txq_push(struct rtw89_dev *rtwdev,
3833 				struct rtw89_txq *rtwtxq,
3834 				unsigned long frame_cnt,
3835 				unsigned long byte_cnt)
3836 {
3837 	struct ieee80211_txq *txq = rtw89_txq_to_txq(rtwtxq);
3838 	struct ieee80211_vif *vif = txq->vif;
3839 	struct ieee80211_sta *sta = txq->sta;
3840 	struct sk_buff *skb;
3841 	unsigned long i;
3842 	int ret;
3843 
3844 	rcu_read_lock();
3845 	for (i = 0; i < frame_cnt; i++) {
3846 		skb = ieee80211_tx_dequeue_ni(rtwdev->hw, txq);
3847 		if (!skb) {
3848 			rtw89_debug(rtwdev, RTW89_DBG_TXRX, "dequeue a NULL skb\n");
3849 			goto out;
3850 		}
3851 		rtw89_core_txq_check_agg(rtwdev, rtwtxq, skb);
3852 		ret = rtw89_core_tx_write(rtwdev, vif, sta, skb, NULL);
3853 		if (ret) {
3854 			rtw89_err(rtwdev, "failed to push txq: %d\n", ret);
3855 			ieee80211_free_txskb(rtwdev->hw, skb);
3856 			break;
3857 		}
3858 	}
3859 out:
3860 	rcu_read_unlock();
3861 }
3862 
3863 static u32 rtw89_check_and_reclaim_tx_resource(struct rtw89_dev *rtwdev, u8 tid)
3864 {
3865 	u8 qsel, ch_dma;
3866 
3867 	qsel = rtw89_core_get_qsel(rtwdev, tid);
3868 	ch_dma = rtw89_chip_get_ch_dma(rtwdev, qsel);
3869 
3870 	return rtw89_hci_check_and_reclaim_tx_resource(rtwdev, ch_dma);
3871 }
3872 
3873 static bool rtw89_core_txq_agg_wait(struct rtw89_dev *rtwdev,
3874 				    struct ieee80211_txq *txq,
3875 				    unsigned long *frame_cnt,
3876 				    bool *sched_txq, bool *reinvoke)
3877 {
3878 	struct rtw89_txq *rtwtxq = (struct rtw89_txq *)txq->drv_priv;
3879 	struct rtw89_sta *rtwsta = sta_to_rtwsta_safe(txq->sta);
3880 	struct rtw89_sta_link *rtwsta_link;
3881 
3882 	if (!rtwsta)
3883 		return false;
3884 
3885 	rtwsta_link = rtw89_get_designated_link(rtwsta);
3886 	if (unlikely(!rtwsta_link)) {
3887 		rtw89_err(rtwdev, "agg wait: find no designated link\n");
3888 		return false;
3889 	}
3890 
3891 	if (rtwsta_link->max_agg_wait <= 0)
3892 		return false;
3893 
3894 	if (rtwdev->stats.tx_tfc_lv <= RTW89_TFC_MID)
3895 		return false;
3896 
3897 	if (*frame_cnt > 1) {
3898 		*frame_cnt -= 1;
3899 		*sched_txq = true;
3900 		*reinvoke = true;
3901 		rtwtxq->wait_cnt = 1;
3902 		return false;
3903 	}
3904 
3905 	if (*frame_cnt == 1 && rtwtxq->wait_cnt < rtwsta_link->max_agg_wait) {
3906 		*reinvoke = true;
3907 		rtwtxq->wait_cnt++;
3908 		return true;
3909 	}
3910 
3911 	rtwtxq->wait_cnt = 0;
3912 	return false;
3913 }
3914 
3915 static void rtw89_core_txq_schedule(struct rtw89_dev *rtwdev, u8 ac, bool *reinvoke)
3916 {
3917 	struct ieee80211_hw *hw = rtwdev->hw;
3918 	struct ieee80211_txq *txq;
3919 	struct rtw89_vif *rtwvif;
3920 	struct rtw89_txq *rtwtxq;
3921 	unsigned long frame_cnt;
3922 	unsigned long byte_cnt;
3923 	u32 tx_resource;
3924 	bool sched_txq;
3925 
3926 	ieee80211_txq_schedule_start(hw, ac);
3927 	while ((txq = ieee80211_next_txq(hw, ac))) {
3928 		rtwtxq = (struct rtw89_txq *)txq->drv_priv;
3929 		rtwvif = vif_to_rtwvif(txq->vif);
3930 
3931 		if (rtwvif->offchan) {
3932 			ieee80211_return_txq(hw, txq, true);
3933 			continue;
3934 		}
3935 		tx_resource = rtw89_check_and_reclaim_tx_resource(rtwdev, txq->tid);
3936 		sched_txq = false;
3937 
3938 		ieee80211_txq_get_depth(txq, &frame_cnt, &byte_cnt);
3939 		if (rtw89_core_txq_agg_wait(rtwdev, txq, &frame_cnt, &sched_txq, reinvoke)) {
3940 			ieee80211_return_txq(hw, txq, true);
3941 			continue;
3942 		}
3943 		frame_cnt = min_t(unsigned long, frame_cnt, tx_resource);
3944 		rtw89_core_txq_push(rtwdev, rtwtxq, frame_cnt, byte_cnt);
3945 		ieee80211_return_txq(hw, txq, sched_txq);
3946 		if (frame_cnt != 0)
3947 			rtw89_core_tx_kick_off(rtwdev, rtw89_core_get_qsel(rtwdev, txq->tid));
3948 
3949 		/* bound of tx_resource could get stuck due to burst traffic */
3950 		if (frame_cnt == tx_resource)
3951 			*reinvoke = true;
3952 	}
3953 	ieee80211_txq_schedule_end(hw, ac);
3954 }
3955 
3956 static void rtw89_ips_work(struct wiphy *wiphy, struct wiphy_work *work)
3957 {
3958 	struct rtw89_dev *rtwdev = container_of(work, struct rtw89_dev,
3959 						ips_work);
3960 
3961 	lockdep_assert_wiphy(wiphy);
3962 
3963 	rtw89_enter_ips_by_hwflags(rtwdev);
3964 }
3965 
3966 static void rtw89_core_txq_work(struct work_struct *w)
3967 {
3968 	struct rtw89_dev *rtwdev = container_of(w, struct rtw89_dev, txq_work);
3969 	bool reinvoke = false;
3970 	u8 ac;
3971 
3972 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
3973 		rtw89_core_txq_schedule(rtwdev, ac, &reinvoke);
3974 
3975 	if (reinvoke) {
3976 		/* reinvoke to process the last frame */
3977 		mod_delayed_work(rtwdev->txq_wq, &rtwdev->txq_reinvoke_work, 1);
3978 	}
3979 }
3980 
3981 static void rtw89_core_txq_reinvoke_work(struct work_struct *w)
3982 {
3983 	struct rtw89_dev *rtwdev = container_of(w, struct rtw89_dev,
3984 						txq_reinvoke_work.work);
3985 
3986 	queue_work(rtwdev->txq_wq, &rtwdev->txq_work);
3987 }
3988 
3989 static void rtw89_forbid_ba_work(struct work_struct *w)
3990 {
3991 	struct rtw89_dev *rtwdev = container_of(w, struct rtw89_dev,
3992 						forbid_ba_work.work);
3993 	struct rtw89_txq *rtwtxq, *tmp;
3994 
3995 	spin_lock_bh(&rtwdev->ba_lock);
3996 	list_for_each_entry_safe(rtwtxq, tmp, &rtwdev->forbid_ba_list, list) {
3997 		clear_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags);
3998 		list_del_init(&rtwtxq->list);
3999 	}
4000 	spin_unlock_bh(&rtwdev->ba_lock);
4001 }
4002 
4003 static void rtw89_core_sta_pending_tx_iter(void *data,
4004 					   struct ieee80211_sta *sta)
4005 {
4006 	struct rtw89_sta *rtwsta = sta_to_rtwsta(sta);
4007 	struct rtw89_dev *rtwdev = rtwsta->rtwdev;
4008 	struct rtw89_vif *rtwvif = rtwsta->rtwvif;
4009 	struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif);
4010 	struct rtw89_vif_link *target = data;
4011 	struct rtw89_vif_link *rtwvif_link;
4012 	unsigned int link_id;
4013 	struct sk_buff *skb;
4014 	int qsel, ret;
4015 
4016 	rtw89_vif_for_each_link(rtwvif, rtwvif_link, link_id)
4017 		if (rtwvif_link->chanctx_idx == target->chanctx_idx)
4018 			goto bottom;
4019 
4020 	return;
4021 
4022 bottom:
4023 	if (skb_queue_len(&rtwsta->roc_queue) == 0)
4024 		return;
4025 
4026 	while ((skb = skb_dequeue(&rtwsta->roc_queue))) {
4027 		ret = rtw89_core_tx_write(rtwdev, vif, sta, skb, &qsel);
4028 		if (ret) {
4029 			rtw89_warn(rtwdev, "pending tx failed with %d\n", ret);
4030 			dev_kfree_skb_any(skb);
4031 		} else {
4032 			rtw89_core_tx_kick_off(rtwdev, qsel);
4033 		}
4034 	}
4035 }
4036 
4037 static void rtw89_core_handle_sta_pending_tx(struct rtw89_dev *rtwdev,
4038 					     struct rtw89_vif_link *rtwvif_link)
4039 {
4040 	ieee80211_iterate_stations_atomic(rtwdev->hw,
4041 					  rtw89_core_sta_pending_tx_iter,
4042 					  rtwvif_link);
4043 }
4044 
4045 int rtw89_core_send_nullfunc(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link,
4046 			     bool qos, bool ps, int timeout)
4047 {
4048 	struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
4049 	int link_id = ieee80211_vif_is_mld(vif) ? rtwvif_link->link_id : -1;
4050 	struct rtw89_sta_link *rtwsta_link;
4051 	struct rtw89_tx_wait_info *wait;
4052 	struct ieee80211_sta *sta;
4053 	struct ieee80211_hdr *hdr;
4054 	struct rtw89_sta *rtwsta;
4055 	struct sk_buff *skb;
4056 	int ret, qsel;
4057 
4058 	if (vif->type != NL80211_IFTYPE_STATION || !vif->cfg.assoc)
4059 		return 0;
4060 
4061 	wait = kzalloc(sizeof(*wait), GFP_KERNEL);
4062 	if (!wait)
4063 		return -ENOMEM;
4064 
4065 	init_completion(&wait->completion);
4066 
4067 	rcu_read_lock();
4068 	sta = ieee80211_find_sta(vif, vif->cfg.ap_addr);
4069 	if (!sta) {
4070 		ret = -EINVAL;
4071 		goto out;
4072 	}
4073 	rtwsta = sta_to_rtwsta(sta);
4074 
4075 	skb = ieee80211_nullfunc_get(rtwdev->hw, vif, link_id, qos);
4076 	if (!skb) {
4077 		ret = -ENOMEM;
4078 		goto out;
4079 	}
4080 
4081 	wait->skb = skb;
4082 
4083 	hdr = (struct ieee80211_hdr *)skb->data;
4084 	if (ps)
4085 		hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
4086 
4087 	rtwsta_link = rtwsta->links[rtwvif_link->link_id];
4088 	if (unlikely(!rtwsta_link)) {
4089 		ret = -ENOLINK;
4090 		dev_kfree_skb_any(skb);
4091 		goto out;
4092 	}
4093 
4094 	ret = rtw89_core_tx_write_link(rtwdev, rtwvif_link, rtwsta_link, skb, &qsel, true,
4095 				       wait);
4096 	if (ret) {
4097 		rtw89_warn(rtwdev, "nullfunc transmit failed: %d\n", ret);
4098 		dev_kfree_skb_any(skb);
4099 		goto out;
4100 	}
4101 
4102 	rcu_read_unlock();
4103 
4104 	return rtw89_core_tx_kick_off_and_wait(rtwdev, skb, wait, qsel,
4105 					       timeout);
4106 out:
4107 	rcu_read_unlock();
4108 	kfree(wait);
4109 
4110 	return ret;
4111 }
4112 
4113 void rtw89_roc_start(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif)
4114 {
4115 	const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;
4116 	struct rtw89_chanctx_pause_parm pause_parm = {
4117 		.rsn = RTW89_CHANCTX_PAUSE_REASON_ROC,
4118 	};
4119 	struct ieee80211_hw *hw = rtwdev->hw;
4120 	struct rtw89_roc *roc = &rtwvif->roc;
4121 	struct rtw89_vif_link *rtwvif_link;
4122 	struct cfg80211_chan_def roc_chan;
4123 	struct rtw89_vif *tmp_vif;
4124 	u32 reg;
4125 	int ret;
4126 
4127 	lockdep_assert_wiphy(hw->wiphy);
4128 
4129 	rtw89_leave_ips_by_hwflags(rtwdev);
4130 	rtw89_leave_lps(rtwdev);
4131 
4132 	rtwvif_link = rtw89_get_designated_link(rtwvif);
4133 	if (unlikely(!rtwvif_link)) {
4134 		rtw89_err(rtwdev, "roc start: find no designated link\n");
4135 		return;
4136 	}
4137 
4138 	roc->link_id = rtwvif_link->link_id;
4139 
4140 	pause_parm.trigger = rtwvif_link;
4141 	rtw89_chanctx_pause(rtwdev, &pause_parm);
4142 
4143 	ret = rtw89_core_send_nullfunc(rtwdev, rtwvif_link, true, true,
4144 				       RTW89_ROC_TX_TIMEOUT);
4145 	if (ret)
4146 		rtw89_debug(rtwdev, RTW89_DBG_TXRX,
4147 			    "roc send null-1 failed: %d\n", ret);
4148 
4149 	rtw89_for_each_rtwvif(rtwdev, tmp_vif) {
4150 		struct rtw89_vif_link *tmp_link;
4151 		unsigned int link_id;
4152 
4153 		rtw89_vif_for_each_link(tmp_vif, tmp_link, link_id) {
4154 			if (tmp_link->chanctx_idx == rtwvif_link->chanctx_idx) {
4155 				tmp_vif->offchan = true;
4156 				break;
4157 			}
4158 		}
4159 	}
4160 
4161 	cfg80211_chandef_create(&roc_chan, &roc->chan, NL80211_CHAN_NO_HT);
4162 	rtw89_config_roc_chandef(rtwdev, rtwvif_link, &roc_chan);
4163 	rtw89_set_channel(rtwdev);
4164 
4165 	reg = rtw89_mac_reg_by_idx(rtwdev, mac->rx_fltr, rtwvif_link->mac_idx);
4166 	rtw89_write32_clr(rtwdev, reg, B_AX_A_UC_CAM_MATCH | B_AX_A_BC_CAM_MATCH);
4167 
4168 	ieee80211_ready_on_channel(hw);
4169 	wiphy_delayed_work_cancel(hw->wiphy, &rtwvif->roc.roc_work);
4170 	wiphy_delayed_work_queue(hw->wiphy, &rtwvif->roc.roc_work,
4171 				 msecs_to_jiffies(rtwvif->roc.duration));
4172 }
4173 
4174 void rtw89_roc_end(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif)
4175 {
4176 	struct ieee80211_hw *hw = rtwdev->hw;
4177 	struct rtw89_roc *roc = &rtwvif->roc;
4178 	struct rtw89_vif_link *rtwvif_link;
4179 	struct rtw89_vif *tmp_vif;
4180 	int ret;
4181 
4182 	lockdep_assert_wiphy(hw->wiphy);
4183 
4184 	ieee80211_remain_on_channel_expired(hw);
4185 
4186 	rtw89_leave_ips_by_hwflags(rtwdev);
4187 	rtw89_leave_lps(rtwdev);
4188 
4189 	rtwvif_link = rtwvif->links[roc->link_id];
4190 	if (unlikely(!rtwvif_link)) {
4191 		rtw89_err(rtwdev, "roc end: find no link (link id %u)\n",
4192 			  roc->link_id);
4193 		return;
4194 	}
4195 
4196 	rtw89_mac_set_rx_fltr(rtwdev, rtwvif_link->mac_idx, rtwdev->hal.rx_fltr);
4197 
4198 	roc->state = RTW89_ROC_IDLE;
4199 	rtw89_config_roc_chandef(rtwdev, rtwvif_link, NULL);
4200 	rtw89_chanctx_proceed(rtwdev, NULL);
4201 	ret = rtw89_core_send_nullfunc(rtwdev, rtwvif_link, true, false,
4202 				       RTW89_ROC_TX_TIMEOUT);
4203 	if (ret)
4204 		rtw89_debug(rtwdev, RTW89_DBG_TXRX,
4205 			    "roc send null-0 failed: %d\n", ret);
4206 
4207 	rtw89_for_each_rtwvif(rtwdev, tmp_vif)
4208 		tmp_vif->offchan = false;
4209 
4210 	rtw89_core_handle_sta_pending_tx(rtwdev, rtwvif_link);
4211 	queue_work(rtwdev->txq_wq, &rtwdev->txq_work);
4212 
4213 	if (hw->conf.flags & IEEE80211_CONF_IDLE)
4214 		wiphy_delayed_work_queue(hw->wiphy, &roc->roc_work,
4215 					 msecs_to_jiffies(RTW89_ROC_IDLE_TIMEOUT));
4216 }
4217 
4218 void rtw89_roc_work(struct wiphy *wiphy, struct wiphy_work *work)
4219 {
4220 	struct rtw89_vif *rtwvif = container_of(work, struct rtw89_vif,
4221 						roc.roc_work.work);
4222 	struct rtw89_dev *rtwdev = rtwvif->rtwdev;
4223 	struct rtw89_roc *roc = &rtwvif->roc;
4224 
4225 	lockdep_assert_wiphy(wiphy);
4226 
4227 	switch (roc->state) {
4228 	case RTW89_ROC_IDLE:
4229 		rtw89_enter_ips_by_hwflags(rtwdev);
4230 		break;
4231 	case RTW89_ROC_MGMT:
4232 	case RTW89_ROC_NORMAL:
4233 		rtw89_roc_end(rtwdev, rtwvif);
4234 		break;
4235 	default:
4236 		break;
4237 	}
4238 }
4239 
4240 static enum rtw89_tfc_lv rtw89_get_traffic_level(struct rtw89_dev *rtwdev,
4241 						 u32 throughput, u64 cnt,
4242 						 enum rtw89_tfc_interval interval)
4243 {
4244 	u64 cnt_level;
4245 
4246 	switch (interval) {
4247 	default:
4248 	case RTW89_TFC_INTERVAL_100MS:
4249 		cnt_level = 5;
4250 		break;
4251 	case RTW89_TFC_INTERVAL_2SEC:
4252 		cnt_level = 100;
4253 		break;
4254 	}
4255 
4256 	if (cnt < cnt_level)
4257 		return RTW89_TFC_IDLE;
4258 	if (throughput > 50)
4259 		return RTW89_TFC_HIGH;
4260 	if (throughput > 10)
4261 		return RTW89_TFC_MID;
4262 	if (throughput > 2)
4263 		return RTW89_TFC_LOW;
4264 	return RTW89_TFC_ULTRA_LOW;
4265 }
4266 
4267 static bool rtw89_traffic_stats_calc(struct rtw89_dev *rtwdev,
4268 				     struct rtw89_traffic_stats *stats,
4269 				     enum rtw89_tfc_interval interval)
4270 {
4271 	enum rtw89_tfc_lv tx_tfc_lv = stats->tx_tfc_lv;
4272 	enum rtw89_tfc_lv rx_tfc_lv = stats->rx_tfc_lv;
4273 
4274 	stats->tx_throughput_raw = rtw89_bytes_to_mbps(stats->tx_unicast, interval);
4275 	stats->rx_throughput_raw = rtw89_bytes_to_mbps(stats->rx_unicast, interval);
4276 
4277 	ewma_tp_add(&stats->tx_ewma_tp, stats->tx_throughput_raw);
4278 	ewma_tp_add(&stats->rx_ewma_tp, stats->rx_throughput_raw);
4279 
4280 	stats->tx_throughput = ewma_tp_read(&stats->tx_ewma_tp);
4281 	stats->rx_throughput = ewma_tp_read(&stats->rx_ewma_tp);
4282 	stats->tx_tfc_lv = rtw89_get_traffic_level(rtwdev, stats->tx_throughput,
4283 						   stats->tx_cnt, interval);
4284 	stats->rx_tfc_lv = rtw89_get_traffic_level(rtwdev, stats->rx_throughput,
4285 						   stats->rx_cnt, interval);
4286 	stats->tx_avg_len = stats->tx_cnt ?
4287 			    DIV_ROUND_DOWN_ULL(stats->tx_unicast, stats->tx_cnt) : 0;
4288 	stats->rx_avg_len = stats->rx_cnt ?
4289 			    DIV_ROUND_DOWN_ULL(stats->rx_unicast, stats->rx_cnt) : 0;
4290 
4291 	stats->tx_unicast = 0;
4292 	stats->rx_unicast = 0;
4293 	stats->tx_cnt = 0;
4294 	stats->rx_cnt = 0;
4295 	stats->rx_tf_periodic = stats->rx_tf_acc;
4296 	stats->rx_tf_acc = 0;
4297 
4298 	if (tx_tfc_lv != stats->tx_tfc_lv || rx_tfc_lv != stats->rx_tfc_lv)
4299 		return true;
4300 
4301 	return false;
4302 }
4303 
4304 static bool rtw89_traffic_stats_track(struct rtw89_dev *rtwdev)
4305 {
4306 	struct rtw89_vif_link *rtwvif_link;
4307 	struct rtw89_vif *rtwvif;
4308 	unsigned int link_id;
4309 	bool tfc_changed;
4310 
4311 	tfc_changed = rtw89_traffic_stats_calc(rtwdev, &rtwdev->stats,
4312 					       RTW89_TFC_INTERVAL_2SEC);
4313 
4314 	rtw89_for_each_rtwvif(rtwdev, rtwvif) {
4315 		rtw89_traffic_stats_calc(rtwdev, &rtwvif->stats,
4316 					 RTW89_TFC_INTERVAL_2SEC);
4317 
4318 		rtw89_vif_for_each_link(rtwvif, rtwvif_link, link_id)
4319 			rtw89_fw_h2c_tp_offload(rtwdev, rtwvif_link);
4320 	}
4321 
4322 	return tfc_changed;
4323 }
4324 
4325 static void rtw89_enter_lps_track(struct rtw89_dev *rtwdev)
4326 {
4327 	struct ieee80211_vif *vif;
4328 	struct rtw89_vif *rtwvif;
4329 
4330 	rtw89_for_each_rtwvif(rtwdev, rtwvif) {
4331 		if (rtwvif->tdls_peer)
4332 			continue;
4333 		if (rtwvif->offchan)
4334 			continue;
4335 
4336 		if (rtwvif->stats_ps.tx_tfc_lv >= RTW89_TFC_MID ||
4337 		    rtwvif->stats_ps.rx_tfc_lv >= RTW89_TFC_MID)
4338 			continue;
4339 
4340 		vif = rtwvif_to_vif(rtwvif);
4341 
4342 		if (!(vif->type == NL80211_IFTYPE_STATION ||
4343 		      vif->type == NL80211_IFTYPE_P2P_CLIENT))
4344 			continue;
4345 
4346 		if (!rtw89_core_bcn_track_can_lps(rtwdev))
4347 			continue;
4348 
4349 		rtw89_enter_lps(rtwdev, rtwvif, true);
4350 	}
4351 }
4352 
4353 static void rtw89_core_rfk_track(struct rtw89_dev *rtwdev)
4354 {
4355 	enum rtw89_entity_mode mode;
4356 
4357 	mode = rtw89_get_entity_mode(rtwdev);
4358 	if (mode == RTW89_ENTITY_MODE_MCC)
4359 		return;
4360 
4361 	rtw89_chip_rfk_track(rtwdev);
4362 }
4363 
4364 void rtw89_core_update_p2p_ps(struct rtw89_dev *rtwdev,
4365 			      struct rtw89_vif_link *rtwvif_link,
4366 			      struct ieee80211_bss_conf *bss_conf)
4367 {
4368 	enum rtw89_entity_mode mode = rtw89_get_entity_mode(rtwdev);
4369 
4370 	if (mode == RTW89_ENTITY_MODE_MCC)
4371 		rtw89_queue_chanctx_change(rtwdev, RTW89_CHANCTX_P2P_PS_CHANGE);
4372 	else
4373 		rtw89_process_p2p_ps(rtwdev, rtwvif_link, bss_conf);
4374 }
4375 
4376 void rtw89_traffic_stats_init(struct rtw89_dev *rtwdev,
4377 			      struct rtw89_traffic_stats *stats)
4378 {
4379 	stats->tx_unicast = 0;
4380 	stats->rx_unicast = 0;
4381 	stats->tx_cnt = 0;
4382 	stats->rx_cnt = 0;
4383 	ewma_tp_init(&stats->tx_ewma_tp);
4384 	ewma_tp_init(&stats->rx_ewma_tp);
4385 }
4386 
4387 #define RTW89_MLSR_GOTO_2GHZ_THRESHOLD -53
4388 #define RTW89_MLSR_EXIT_2GHZ_THRESHOLD -38
4389 static void rtw89_core_mlsr_link_decision(struct rtw89_dev *rtwdev,
4390 					  struct rtw89_vif *rtwvif)
4391 {
4392 	unsigned int sel_link_id = IEEE80211_MLD_MAX_NUM_LINKS;
4393 	struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif);
4394 	struct rtw89_vif_link *rtwvif_link;
4395 	const struct rtw89_chan *chan;
4396 	unsigned long usable_links;
4397 	unsigned int link_id;
4398 	u8 decided_bands;
4399 	u8 rssi;
4400 
4401 	rssi = ewma_rssi_read(&rtwdev->phystat.bcn_rssi);
4402 	if (unlikely(!rssi))
4403 		return;
4404 
4405 	if (RTW89_RSSI_RAW_TO_DBM(rssi) >= RTW89_MLSR_EXIT_2GHZ_THRESHOLD)
4406 		decided_bands = BIT(RTW89_BAND_5G) | BIT(RTW89_BAND_6G);
4407 	else if (RTW89_RSSI_RAW_TO_DBM(rssi) <= RTW89_MLSR_GOTO_2GHZ_THRESHOLD)
4408 		decided_bands = BIT(RTW89_BAND_2G);
4409 	else
4410 		return;
4411 
4412 	usable_links = ieee80211_vif_usable_links(vif);
4413 
4414 	rtwvif_link = rtw89_get_designated_link(rtwvif);
4415 	if (unlikely(!rtwvif_link))
4416 		goto select;
4417 
4418 	chan = rtw89_chan_get(rtwdev, rtwvif_link->chanctx_idx);
4419 	if (decided_bands & BIT(chan->band_type))
4420 		return;
4421 
4422 	usable_links &= ~BIT(rtwvif_link->link_id);
4423 
4424 select:
4425 	rcu_read_lock();
4426 
4427 	for_each_set_bit(link_id, &usable_links, IEEE80211_MLD_MAX_NUM_LINKS) {
4428 		struct ieee80211_bss_conf *link_conf;
4429 		struct ieee80211_channel *channel;
4430 		enum rtw89_band band;
4431 
4432 		link_conf = rcu_dereference(vif->link_conf[link_id]);
4433 		if (unlikely(!link_conf))
4434 			continue;
4435 
4436 		channel = link_conf->chanreq.oper.chan;
4437 		if (unlikely(!channel))
4438 			continue;
4439 
4440 		band = rtw89_nl80211_to_hw_band(channel->band);
4441 		if (decided_bands & BIT(band)) {
4442 			sel_link_id = link_id;
4443 			break;
4444 		}
4445 	}
4446 
4447 	rcu_read_unlock();
4448 
4449 	if (sel_link_id == IEEE80211_MLD_MAX_NUM_LINKS)
4450 		return;
4451 
4452 	rtw89_core_mlsr_switch(rtwdev, rtwvif, sel_link_id);
4453 }
4454 
4455 static void rtw89_core_mlo_track(struct rtw89_dev *rtwdev)
4456 {
4457 	struct rtw89_hal *hal = &rtwdev->hal;
4458 	struct ieee80211_vif *vif;
4459 	struct rtw89_vif *rtwvif;
4460 
4461 	if (hal->disabled_dm_bitmap & BIT(RTW89_DM_MLO))
4462 		return;
4463 
4464 	rtw89_for_each_rtwvif(rtwdev, rtwvif) {
4465 		vif = rtwvif_to_vif(rtwvif);
4466 		if (!vif->cfg.assoc || !ieee80211_vif_is_mld(vif))
4467 			continue;
4468 
4469 		switch (rtwvif->mlo_mode) {
4470 		case RTW89_MLO_MODE_MLSR:
4471 			rtw89_core_mlsr_link_decision(rtwdev, rtwvif);
4472 			break;
4473 		default:
4474 			break;
4475 		}
4476 	}
4477 }
4478 
4479 static void rtw89_track_ps_work(struct wiphy *wiphy, struct wiphy_work *work)
4480 {
4481 	struct rtw89_dev *rtwdev = container_of(work, struct rtw89_dev,
4482 						track_ps_work.work);
4483 	struct rtw89_vif *rtwvif;
4484 
4485 	lockdep_assert_wiphy(wiphy);
4486 
4487 	if (test_bit(RTW89_FLAG_FORBIDDEN_TRACK_WORK, rtwdev->flags))
4488 		return;
4489 
4490 	if (!test_bit(RTW89_FLAG_RUNNING, rtwdev->flags))
4491 		return;
4492 
4493 	wiphy_delayed_work_queue(wiphy, &rtwdev->track_ps_work,
4494 				 RTW89_TRACK_PS_WORK_PERIOD);
4495 
4496 	rtw89_for_each_rtwvif(rtwdev, rtwvif)
4497 		rtw89_traffic_stats_calc(rtwdev, &rtwvif->stats_ps,
4498 					 RTW89_TFC_INTERVAL_100MS);
4499 
4500 	if (rtwdev->scanning)
4501 		return;
4502 
4503 	if (rtwdev->lps_enabled && !rtwdev->btc.lps)
4504 		rtw89_enter_lps_track(rtwdev);
4505 }
4506 
4507 static void rtw89_track_work(struct wiphy *wiphy, struct wiphy_work *work)
4508 {
4509 	struct rtw89_dev *rtwdev = container_of(work, struct rtw89_dev,
4510 						track_work.work);
4511 	bool tfc_changed;
4512 
4513 	lockdep_assert_wiphy(wiphy);
4514 
4515 	if (test_bit(RTW89_FLAG_FORBIDDEN_TRACK_WORK, rtwdev->flags))
4516 		return;
4517 
4518 	if (!test_bit(RTW89_FLAG_RUNNING, rtwdev->flags))
4519 		return;
4520 
4521 	wiphy_delayed_work_queue(wiphy, &rtwdev->track_work,
4522 				 RTW89_TRACK_WORK_PERIOD);
4523 
4524 	tfc_changed = rtw89_traffic_stats_track(rtwdev);
4525 	if (rtwdev->scanning)
4526 		return;
4527 
4528 	rtw89_leave_lps(rtwdev);
4529 
4530 	if (tfc_changed) {
4531 		rtw89_hci_recalc_int_mit(rtwdev);
4532 		rtw89_btc_ntfy_wl_sta(rtwdev);
4533 	}
4534 	rtw89_mac_bf_monitor_track(rtwdev);
4535 	rtw89_core_bcn_track(rtwdev);
4536 	rtw89_phy_stat_track(rtwdev);
4537 	rtw89_phy_env_monitor_track(rtwdev);
4538 	rtw89_phy_dig(rtwdev);
4539 	rtw89_core_rfk_track(rtwdev);
4540 	rtw89_phy_ra_update(rtwdev);
4541 	rtw89_phy_cfo_track(rtwdev);
4542 	rtw89_phy_tx_path_div_track(rtwdev);
4543 	rtw89_phy_antdiv_track(rtwdev);
4544 	rtw89_phy_ul_tb_ctrl_track(rtwdev);
4545 	rtw89_phy_edcca_track(rtwdev);
4546 	rtw89_sar_track(rtwdev);
4547 	rtw89_chanctx_track(rtwdev);
4548 	rtw89_core_rfkill_poll(rtwdev, false);
4549 	rtw89_core_mlo_track(rtwdev);
4550 
4551 	if (rtwdev->lps_enabled && !rtwdev->btc.lps)
4552 		rtw89_enter_lps_track(rtwdev);
4553 }
4554 
4555 u8 rtw89_core_acquire_bit_map(unsigned long *addr, unsigned long size)
4556 {
4557 	unsigned long bit;
4558 
4559 	bit = find_first_zero_bit(addr, size);
4560 	if (bit < size)
4561 		set_bit(bit, addr);
4562 
4563 	return bit;
4564 }
4565 
4566 void rtw89_core_release_bit_map(unsigned long *addr, u8 bit)
4567 {
4568 	clear_bit(bit, addr);
4569 }
4570 
4571 void rtw89_core_release_all_bits_map(unsigned long *addr, unsigned int nbits)
4572 {
4573 	bitmap_zero(addr, nbits);
4574 }
4575 
4576 int rtw89_core_acquire_sta_ba_entry(struct rtw89_dev *rtwdev,
4577 				    struct rtw89_sta_link *rtwsta_link, u8 tid,
4578 				    u8 *cam_idx)
4579 {
4580 	const struct rtw89_chip_info *chip = rtwdev->chip;
4581 	struct rtw89_cam_info *cam_info = &rtwdev->cam_info;
4582 	struct rtw89_ba_cam_entry *entry = NULL, *tmp;
4583 	u8 idx;
4584 	int i;
4585 
4586 	lockdep_assert_wiphy(rtwdev->hw->wiphy);
4587 
4588 	idx = rtw89_core_acquire_bit_map(cam_info->ba_cam_map, chip->bacam_num);
4589 	if (idx == chip->bacam_num) {
4590 		/* allocate a static BA CAM to tid=0/5, so replace the existing
4591 		 * one if BA CAM is full. Hardware will process the original tid
4592 		 * automatically.
4593 		 */
4594 		if (tid != 0 && tid != 5)
4595 			return -ENOSPC;
4596 
4597 		for_each_set_bit(i, cam_info->ba_cam_map, chip->bacam_num) {
4598 			tmp = &cam_info->ba_cam_entry[i];
4599 			if (tmp->tid == 0 || tmp->tid == 5)
4600 				continue;
4601 
4602 			idx = i;
4603 			entry = tmp;
4604 			list_del(&entry->list);
4605 			break;
4606 		}
4607 
4608 		if (!entry)
4609 			return -ENOSPC;
4610 	} else {
4611 		entry = &cam_info->ba_cam_entry[idx];
4612 	}
4613 
4614 	entry->tid = tid;
4615 	list_add_tail(&entry->list, &rtwsta_link->ba_cam_list);
4616 
4617 	*cam_idx = idx;
4618 
4619 	return 0;
4620 }
4621 
4622 int rtw89_core_release_sta_ba_entry(struct rtw89_dev *rtwdev,
4623 				    struct rtw89_sta_link *rtwsta_link, u8 tid,
4624 				    u8 *cam_idx)
4625 {
4626 	struct rtw89_cam_info *cam_info = &rtwdev->cam_info;
4627 	struct rtw89_ba_cam_entry *entry = NULL, *tmp;
4628 	u8 idx;
4629 
4630 	lockdep_assert_wiphy(rtwdev->hw->wiphy);
4631 
4632 	list_for_each_entry_safe(entry, tmp, &rtwsta_link->ba_cam_list, list) {
4633 		if (entry->tid != tid)
4634 			continue;
4635 
4636 		idx = entry - cam_info->ba_cam_entry;
4637 		list_del(&entry->list);
4638 
4639 		rtw89_core_release_bit_map(cam_info->ba_cam_map, idx);
4640 		*cam_idx = idx;
4641 		return 0;
4642 	}
4643 
4644 	return -ENOENT;
4645 }
4646 
4647 #define RTW89_TYPE_MAPPING(_type)	\
4648 	case NL80211_IFTYPE_ ## _type:	\
4649 		rtwvif_link->wifi_role = RTW89_WIFI_ROLE_ ## _type;	\
4650 		break
4651 void rtw89_vif_type_mapping(struct rtw89_vif_link *rtwvif_link, bool assoc)
4652 {
4653 	const struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
4654 	const struct ieee80211_bss_conf *bss_conf;
4655 
4656 	switch (vif->type) {
4657 	case NL80211_IFTYPE_STATION:
4658 		if (vif->p2p)
4659 			rtwvif_link->wifi_role = RTW89_WIFI_ROLE_P2P_CLIENT;
4660 		else
4661 			rtwvif_link->wifi_role = RTW89_WIFI_ROLE_STATION;
4662 		break;
4663 	case NL80211_IFTYPE_AP:
4664 		if (vif->p2p)
4665 			rtwvif_link->wifi_role = RTW89_WIFI_ROLE_P2P_GO;
4666 		else
4667 			rtwvif_link->wifi_role = RTW89_WIFI_ROLE_AP;
4668 		break;
4669 	RTW89_TYPE_MAPPING(ADHOC);
4670 	RTW89_TYPE_MAPPING(MONITOR);
4671 	RTW89_TYPE_MAPPING(MESH_POINT);
4672 	default:
4673 		WARN_ON(1);
4674 		break;
4675 	}
4676 
4677 	switch (vif->type) {
4678 	case NL80211_IFTYPE_AP:
4679 	case NL80211_IFTYPE_MESH_POINT:
4680 		rtwvif_link->net_type = RTW89_NET_TYPE_AP_MODE;
4681 		rtwvif_link->self_role = RTW89_SELF_ROLE_AP;
4682 		break;
4683 	case NL80211_IFTYPE_ADHOC:
4684 		rtwvif_link->net_type = RTW89_NET_TYPE_AD_HOC;
4685 		rtwvif_link->self_role = RTW89_SELF_ROLE_CLIENT;
4686 		break;
4687 	case NL80211_IFTYPE_STATION:
4688 		if (assoc) {
4689 			rtwvif_link->net_type = RTW89_NET_TYPE_INFRA;
4690 
4691 			rcu_read_lock();
4692 			bss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, false);
4693 			rtwvif_link->trigger = bss_conf->he_support;
4694 			rcu_read_unlock();
4695 		} else {
4696 			rtwvif_link->net_type = RTW89_NET_TYPE_NO_LINK;
4697 			rtwvif_link->trigger = false;
4698 		}
4699 		rtwvif_link->self_role = RTW89_SELF_ROLE_CLIENT;
4700 		rtwvif_link->addr_cam.sec_ent_mode = RTW89_ADDR_CAM_SEC_NORMAL;
4701 		break;
4702 	case NL80211_IFTYPE_MONITOR:
4703 		break;
4704 	default:
4705 		WARN_ON(1);
4706 		break;
4707 	}
4708 }
4709 
4710 int rtw89_core_sta_link_add(struct rtw89_dev *rtwdev,
4711 			    struct rtw89_vif_link *rtwvif_link,
4712 			    struct rtw89_sta_link *rtwsta_link)
4713 {
4714 	const struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
4715 	const struct ieee80211_sta *sta = rtwsta_link_to_sta(rtwsta_link);
4716 	struct rtw89_hal *hal = &rtwdev->hal;
4717 	u8 ant_num = hal->ant_diversity ? 2 : rtwdev->chip->rf_path_num;
4718 	int i;
4719 	int ret;
4720 
4721 	rtwsta_link->prev_rssi = 0;
4722 	INIT_LIST_HEAD(&rtwsta_link->ba_cam_list);
4723 	ewma_rssi_init(&rtwsta_link->avg_rssi);
4724 	ewma_snr_init(&rtwsta_link->avg_snr);
4725 	ewma_evm_init(&rtwsta_link->evm_1ss);
4726 	for (i = 0; i < ant_num; i++) {
4727 		ewma_rssi_init(&rtwsta_link->rssi[i]);
4728 		ewma_evm_init(&rtwsta_link->evm_min[i]);
4729 		ewma_evm_init(&rtwsta_link->evm_max[i]);
4730 	}
4731 
4732 	if (vif->type == NL80211_IFTYPE_STATION && !sta->tdls) {
4733 		/* must do rtw89_reg_6ghz_recalc() before rfk channel */
4734 		ret = rtw89_reg_6ghz_recalc(rtwdev, rtwvif_link, true);
4735 		if (ret)
4736 			return ret;
4737 
4738 		rtw89_btc_ntfy_role_info(rtwdev, rtwvif_link, rtwsta_link,
4739 					 BTC_ROLE_MSTS_STA_CONN_START);
4740 		rtw89_chip_rfk_channel(rtwdev, rtwvif_link);
4741 
4742 		if (vif->p2p) {
4743 			rtw89_mac_get_tx_retry_limit(rtwdev, rtwsta_link,
4744 						     &rtwsta_link->tx_retry);
4745 			rtw89_mac_set_tx_retry_limit(rtwdev, rtwsta_link, false, 60);
4746 		}
4747 		rtw89_phy_dig_suspend(rtwdev);
4748 	} else if (vif->type == NL80211_IFTYPE_AP || sta->tdls) {
4749 		ret = rtw89_mac_set_macid_pause(rtwdev, rtwsta_link->mac_id, false);
4750 		if (ret) {
4751 			rtw89_warn(rtwdev, "failed to send h2c macid pause\n");
4752 			return ret;
4753 		}
4754 
4755 		ret = rtw89_fw_h2c_role_maintain(rtwdev, rtwvif_link, rtwsta_link,
4756 						 RTW89_ROLE_CREATE);
4757 		if (ret) {
4758 			rtw89_warn(rtwdev, "failed to send h2c role info\n");
4759 			return ret;
4760 		}
4761 
4762 		ret = rtw89_chip_h2c_default_cmac_tbl(rtwdev, rtwvif_link, rtwsta_link);
4763 		if (ret)
4764 			return ret;
4765 
4766 		ret = rtw89_chip_h2c_default_dmac_tbl(rtwdev, rtwvif_link, rtwsta_link);
4767 		if (ret)
4768 			return ret;
4769 	}
4770 
4771 	return 0;
4772 }
4773 
4774 int rtw89_core_sta_link_disassoc(struct rtw89_dev *rtwdev,
4775 				 struct rtw89_vif_link *rtwvif_link,
4776 				 struct rtw89_sta_link *rtwsta_link)
4777 {
4778 	const struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
4779 
4780 	rtw89_assoc_link_clr(rtwsta_link);
4781 
4782 	if (vif->type == NL80211_IFTYPE_STATION) {
4783 		rtw89_fw_h2c_set_bcn_fltr_cfg(rtwdev, rtwvif_link, false);
4784 		rtw89_core_bcn_track_reset(rtwdev);
4785 	}
4786 
4787 	if (rtwvif_link->wifi_role == RTW89_WIFI_ROLE_P2P_CLIENT)
4788 		rtw89_p2p_noa_once_deinit(rtwvif_link);
4789 
4790 	return 0;
4791 }
4792 
4793 int rtw89_core_sta_link_disconnect(struct rtw89_dev *rtwdev,
4794 				   struct rtw89_vif_link *rtwvif_link,
4795 				   struct rtw89_sta_link *rtwsta_link)
4796 {
4797 	const struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
4798 	const struct ieee80211_sta *sta = rtwsta_link_to_sta(rtwsta_link);
4799 	int ret;
4800 
4801 	rtw89_mac_bf_monitor_calc(rtwdev, rtwsta_link, true);
4802 	rtw89_mac_bf_disassoc(rtwdev, rtwvif_link, rtwsta_link);
4803 
4804 	if (vif->type == NL80211_IFTYPE_AP || sta->tdls)
4805 		rtw89_cam_deinit_addr_cam(rtwdev, &rtwsta_link->addr_cam);
4806 	if (sta->tdls)
4807 		rtw89_cam_deinit_bssid_cam(rtwdev, &rtwsta_link->bssid_cam);
4808 
4809 	if (vif->type == NL80211_IFTYPE_STATION && !sta->tdls) {
4810 		rtw89_vif_type_mapping(rtwvif_link, false);
4811 		rtw89_fw_release_general_pkt_list_vif(rtwdev, rtwvif_link, true);
4812 	}
4813 
4814 	ret = rtw89_chip_h2c_assoc_cmac_tbl(rtwdev, rtwvif_link, rtwsta_link);
4815 	if (ret) {
4816 		rtw89_warn(rtwdev, "failed to send h2c cmac table\n");
4817 		return ret;
4818 	}
4819 
4820 	ret = rtw89_fw_h2c_join_info(rtwdev, rtwvif_link, rtwsta_link, true);
4821 	if (ret) {
4822 		rtw89_warn(rtwdev, "failed to send h2c join info\n");
4823 		return ret;
4824 	}
4825 
4826 	/* update cam aid mac_id net_type */
4827 	ret = rtw89_fw_h2c_cam(rtwdev, rtwvif_link, rtwsta_link, NULL,
4828 			       RTW89_ROLE_CON_DISCONN);
4829 	if (ret) {
4830 		rtw89_warn(rtwdev, "failed to send h2c cam\n");
4831 		return ret;
4832 	}
4833 
4834 	return ret;
4835 }
4836 
4837 static bool rtw89_sta_link_can_er(struct rtw89_dev *rtwdev,
4838 				  struct ieee80211_bss_conf *bss_conf,
4839 				  struct ieee80211_link_sta *link_sta)
4840 {
4841 	if (!bss_conf->he_support ||
4842 	    bss_conf->he_oper.params & IEEE80211_HE_OPERATION_ER_SU_DISABLE)
4843 		return false;
4844 
4845 	if (rtwdev->chip->chip_id == RTL8852C &&
4846 	    rtw89_sta_link_has_su_mu_4xhe08(link_sta) &&
4847 	    !rtw89_sta_link_has_er_su_4xhe08(link_sta))
4848 		return false;
4849 
4850 	return true;
4851 }
4852 
4853 int rtw89_core_sta_link_assoc(struct rtw89_dev *rtwdev,
4854 			      struct rtw89_vif_link *rtwvif_link,
4855 			      struct rtw89_sta_link *rtwsta_link)
4856 {
4857 	const struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
4858 	const struct ieee80211_sta *sta = rtwsta_link_to_sta(rtwsta_link);
4859 	struct rtw89_bssid_cam_entry *bssid_cam = rtw89_get_bssid_cam_of(rtwvif_link,
4860 									 rtwsta_link);
4861 	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev,
4862 						       rtwvif_link->chanctx_idx);
4863 	struct ieee80211_link_sta *link_sta;
4864 	int ret;
4865 
4866 	if (vif->type == NL80211_IFTYPE_AP || sta->tdls) {
4867 		if (sta->tdls) {
4868 			rcu_read_lock();
4869 
4870 			link_sta = rtw89_sta_rcu_dereference_link(rtwsta_link, true);
4871 			ret = rtw89_cam_init_bssid_cam(rtwdev, rtwvif_link, bssid_cam,
4872 						       link_sta->addr);
4873 			if (ret) {
4874 				rtw89_warn(rtwdev, "failed to send h2c init bssid cam for TDLS\n");
4875 				rcu_read_unlock();
4876 				return ret;
4877 			}
4878 
4879 			rcu_read_unlock();
4880 		}
4881 
4882 		ret = rtw89_cam_init_addr_cam(rtwdev, &rtwsta_link->addr_cam, bssid_cam);
4883 		if (ret) {
4884 			rtw89_warn(rtwdev, "failed to send h2c init addr cam\n");
4885 			return ret;
4886 		}
4887 	}
4888 
4889 	ret = rtw89_chip_h2c_assoc_cmac_tbl(rtwdev, rtwvif_link, rtwsta_link);
4890 	if (ret) {
4891 		rtw89_warn(rtwdev, "failed to send h2c cmac table\n");
4892 		return ret;
4893 	}
4894 
4895 	ret = rtw89_fw_h2c_join_info(rtwdev, rtwvif_link, rtwsta_link, false);
4896 	if (ret) {
4897 		rtw89_warn(rtwdev, "failed to send h2c join info\n");
4898 		return ret;
4899 	}
4900 
4901 	/* update cam aid mac_id net_type */
4902 	ret = rtw89_fw_h2c_cam(rtwdev, rtwvif_link, rtwsta_link, NULL,
4903 			       RTW89_ROLE_CON_DISCONN);
4904 	if (ret) {
4905 		rtw89_warn(rtwdev, "failed to send h2c cam\n");
4906 		return ret;
4907 	}
4908 
4909 	rtw89_phy_ra_assoc(rtwdev, rtwsta_link);
4910 	rtw89_mac_bf_assoc(rtwdev, rtwvif_link, rtwsta_link);
4911 	rtw89_mac_bf_monitor_calc(rtwdev, rtwsta_link, false);
4912 
4913 	if (vif->type == NL80211_IFTYPE_STATION && !sta->tdls) {
4914 		struct ieee80211_bss_conf *bss_conf;
4915 
4916 		rcu_read_lock();
4917 
4918 		bss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, true);
4919 		link_sta = rtw89_sta_rcu_dereference_link(rtwsta_link, true);
4920 		rtwsta_link->er_cap = rtw89_sta_link_can_er(rtwdev, bss_conf, link_sta);
4921 
4922 		rcu_read_unlock();
4923 
4924 		rtw89_btc_ntfy_role_info(rtwdev, rtwvif_link, rtwsta_link,
4925 					 BTC_ROLE_MSTS_STA_CONN_END);
4926 		rtw89_core_get_no_ul_ofdma_htc(rtwdev, &rtwsta_link->htc_template, chan);
4927 		rtw89_phy_ul_tb_assoc(rtwdev, rtwvif_link);
4928 		rtw89_core_bcn_track_assoc(rtwdev, rtwvif_link);
4929 
4930 		ret = rtw89_fw_h2c_general_pkt(rtwdev, rtwvif_link, rtwsta_link->mac_id);
4931 		if (ret) {
4932 			rtw89_warn(rtwdev, "failed to send h2c general packet\n");
4933 			return ret;
4934 		}
4935 
4936 		rtw89_fw_h2c_set_bcn_fltr_cfg(rtwdev, rtwvif_link, true);
4937 
4938 		if (vif->p2p)
4939 			rtw89_mac_set_tx_retry_limit(rtwdev, rtwsta_link, false,
4940 						     rtwsta_link->tx_retry);
4941 		rtw89_phy_dig_resume(rtwdev, false);
4942 	}
4943 
4944 	rtw89_assoc_link_set(rtwsta_link);
4945 	return ret;
4946 }
4947 
4948 int rtw89_core_sta_link_remove(struct rtw89_dev *rtwdev,
4949 			       struct rtw89_vif_link *rtwvif_link,
4950 			       struct rtw89_sta_link *rtwsta_link)
4951 {
4952 	const struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
4953 	const struct ieee80211_sta *sta = rtwsta_link_to_sta(rtwsta_link);
4954 	int ret;
4955 
4956 	if (vif->type == NL80211_IFTYPE_STATION && !sta->tdls) {
4957 		rtw89_reg_6ghz_recalc(rtwdev, rtwvif_link, false);
4958 		rtw89_btc_ntfy_role_info(rtwdev, rtwvif_link, rtwsta_link,
4959 					 BTC_ROLE_MSTS_STA_DIS_CONN);
4960 
4961 		if (vif->p2p)
4962 			rtw89_mac_set_tx_retry_limit(rtwdev, rtwsta_link, false,
4963 						     rtwsta_link->tx_retry);
4964 	} else if (vif->type == NL80211_IFTYPE_AP || sta->tdls) {
4965 		ret = rtw89_fw_h2c_role_maintain(rtwdev, rtwvif_link, rtwsta_link,
4966 						 RTW89_ROLE_REMOVE);
4967 		if (ret) {
4968 			rtw89_warn(rtwdev, "failed to send h2c role info\n");
4969 			return ret;
4970 		}
4971 	}
4972 
4973 	return 0;
4974 }
4975 
4976 static void _rtw89_core_set_tid_config(struct rtw89_dev *rtwdev,
4977 				       struct ieee80211_sta *sta,
4978 				       struct cfg80211_tid_cfg *tid_conf)
4979 {
4980 	struct ieee80211_txq *txq;
4981 	struct rtw89_txq *rtwtxq;
4982 	u32 mask = tid_conf->mask;
4983 	u8 tids = tid_conf->tids;
4984 	int tids_nbit = BITS_PER_BYTE;
4985 	int i;
4986 
4987 	for (i = 0; i < tids_nbit; i++, tids >>= 1) {
4988 		if (!tids)
4989 			break;
4990 
4991 		if (!(tids & BIT(0)))
4992 			continue;
4993 
4994 		txq = sta->txq[i];
4995 		rtwtxq = (struct rtw89_txq *)txq->drv_priv;
4996 
4997 		if (mask & BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL)) {
4998 			if (tid_conf->ampdu == NL80211_TID_CONFIG_ENABLE) {
4999 				clear_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags);
5000 			} else {
5001 				if (test_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags))
5002 					ieee80211_stop_tx_ba_session(sta, txq->tid);
5003 				spin_lock_bh(&rtwdev->ba_lock);
5004 				list_del_init(&rtwtxq->list);
5005 				set_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags);
5006 				spin_unlock_bh(&rtwdev->ba_lock);
5007 			}
5008 		}
5009 
5010 		if (mask & BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL) && tids == 0xff) {
5011 			if (tid_conf->amsdu == NL80211_TID_CONFIG_ENABLE)
5012 				sta->max_amsdu_subframes = 0;
5013 			else
5014 				sta->max_amsdu_subframes = 1;
5015 		}
5016 	}
5017 }
5018 
5019 void rtw89_core_set_tid_config(struct rtw89_dev *rtwdev,
5020 			       struct ieee80211_sta *sta,
5021 			       struct cfg80211_tid_config *tid_config)
5022 {
5023 	int i;
5024 
5025 	for (i = 0; i < tid_config->n_tid_conf; i++)
5026 		_rtw89_core_set_tid_config(rtwdev, sta,
5027 					   &tid_config->tid_conf[i]);
5028 }
5029 
5030 static void rtw89_init_ht_cap(struct rtw89_dev *rtwdev,
5031 			      struct ieee80211_sta_ht_cap *ht_cap)
5032 {
5033 	static const __le16 highest[RF_PATH_MAX] = {
5034 		cpu_to_le16(150), cpu_to_le16(300), cpu_to_le16(450), cpu_to_le16(600),
5035 	};
5036 	struct rtw89_hal *hal = &rtwdev->hal;
5037 	u8 nss = hal->rx_nss;
5038 	int i;
5039 
5040 	ht_cap->ht_supported = true;
5041 	ht_cap->cap = 0;
5042 	ht_cap->cap |= IEEE80211_HT_CAP_SGI_20 |
5043 		       IEEE80211_HT_CAP_MAX_AMSDU |
5044 		       IEEE80211_HT_CAP_TX_STBC |
5045 		       (1 << IEEE80211_HT_CAP_RX_STBC_SHIFT);
5046 	ht_cap->cap |= IEEE80211_HT_CAP_LDPC_CODING;
5047 	ht_cap->cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
5048 		       IEEE80211_HT_CAP_DSSSCCK40 |
5049 		       IEEE80211_HT_CAP_SGI_40;
5050 	ht_cap->ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
5051 	ht_cap->ampdu_density = IEEE80211_HT_MPDU_DENSITY_NONE;
5052 	ht_cap->mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
5053 	for (i = 0; i < nss; i++)
5054 		ht_cap->mcs.rx_mask[i] = 0xFF;
5055 	ht_cap->mcs.rx_mask[4] = 0x01;
5056 	ht_cap->mcs.rx_highest = highest[nss - 1];
5057 }
5058 
5059 static void rtw89_init_vht_cap(struct rtw89_dev *rtwdev,
5060 			       struct ieee80211_sta_vht_cap *vht_cap)
5061 {
5062 	static const __le16 highest_bw80[RF_PATH_MAX] = {
5063 		cpu_to_le16(433), cpu_to_le16(867), cpu_to_le16(1300), cpu_to_le16(1733),
5064 	};
5065 	static const __le16 highest_bw160[RF_PATH_MAX] = {
5066 		cpu_to_le16(867), cpu_to_le16(1733), cpu_to_le16(2600), cpu_to_le16(3467),
5067 	};
5068 	const struct rtw89_chip_info *chip = rtwdev->chip;
5069 	const __le16 *highest = chip->support_bandwidths & BIT(NL80211_CHAN_WIDTH_160) ?
5070 				highest_bw160 : highest_bw80;
5071 	struct rtw89_hal *hal = &rtwdev->hal;
5072 	u16 tx_mcs_map = 0, rx_mcs_map = 0;
5073 	u8 sts_cap = 3;
5074 	int i;
5075 
5076 	for (i = 0; i < 8; i++) {
5077 		if (i < hal->tx_nss)
5078 			tx_mcs_map |= IEEE80211_VHT_MCS_SUPPORT_0_9 << (i * 2);
5079 		else
5080 			tx_mcs_map |= IEEE80211_VHT_MCS_NOT_SUPPORTED << (i * 2);
5081 		if (i < hal->rx_nss)
5082 			rx_mcs_map |= IEEE80211_VHT_MCS_SUPPORT_0_9 << (i * 2);
5083 		else
5084 			rx_mcs_map |= IEEE80211_VHT_MCS_NOT_SUPPORTED << (i * 2);
5085 	}
5086 
5087 	vht_cap->vht_supported = true;
5088 	vht_cap->cap = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
5089 		       IEEE80211_VHT_CAP_SHORT_GI_80 |
5090 		       IEEE80211_VHT_CAP_RXSTBC_1 |
5091 		       IEEE80211_VHT_CAP_HTC_VHT |
5092 		       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK |
5093 		       0;
5094 	vht_cap->cap |= IEEE80211_VHT_CAP_TXSTBC;
5095 	vht_cap->cap |= IEEE80211_VHT_CAP_RXLDPC;
5096 	vht_cap->cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE |
5097 			IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
5098 	vht_cap->cap |= sts_cap << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT;
5099 	if (chip->support_bandwidths & BIT(NL80211_CHAN_WIDTH_160))
5100 		vht_cap->cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ |
5101 				IEEE80211_VHT_CAP_SHORT_GI_160;
5102 	vht_cap->vht_mcs.rx_mcs_map = cpu_to_le16(rx_mcs_map);
5103 	vht_cap->vht_mcs.tx_mcs_map = cpu_to_le16(tx_mcs_map);
5104 	vht_cap->vht_mcs.rx_highest = highest[hal->rx_nss - 1];
5105 	vht_cap->vht_mcs.tx_highest = highest[hal->tx_nss - 1];
5106 
5107 	if (ieee80211_hw_check(rtwdev->hw, SUPPORTS_VHT_EXT_NSS_BW))
5108 		vht_cap->vht_mcs.tx_highest |=
5109 			cpu_to_le16(IEEE80211_VHT_EXT_NSS_BW_CAPABLE);
5110 }
5111 
5112 static void rtw89_init_he_cap(struct rtw89_dev *rtwdev,
5113 			      enum nl80211_band band,
5114 			      enum nl80211_iftype iftype,
5115 			      struct ieee80211_sband_iftype_data *iftype_data)
5116 {
5117 	const struct rtw89_chip_info *chip = rtwdev->chip;
5118 	struct rtw89_hal *hal = &rtwdev->hal;
5119 	bool no_ng16 = (chip->chip_id == RTL8852A && hal->cv == CHIP_CBV) ||
5120 		       (chip->chip_id == RTL8852B && hal->cv == CHIP_CAV);
5121 	struct ieee80211_sta_he_cap *he_cap;
5122 	int nss = hal->rx_nss;
5123 	u8 *mac_cap_info;
5124 	u8 *phy_cap_info;
5125 	u16 mcs_map = 0;
5126 	int i;
5127 
5128 	for (i = 0; i < 8; i++) {
5129 		if (i < nss)
5130 			mcs_map |= IEEE80211_HE_MCS_SUPPORT_0_11 << (i * 2);
5131 		else
5132 			mcs_map |= IEEE80211_HE_MCS_NOT_SUPPORTED << (i * 2);
5133 	}
5134 
5135 	he_cap = &iftype_data->he_cap;
5136 	mac_cap_info = he_cap->he_cap_elem.mac_cap_info;
5137 	phy_cap_info = he_cap->he_cap_elem.phy_cap_info;
5138 
5139 	he_cap->has_he = true;
5140 	mac_cap_info[0] = IEEE80211_HE_MAC_CAP0_HTC_HE;
5141 	if (iftype == NL80211_IFTYPE_STATION)
5142 		mac_cap_info[1] = IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US;
5143 	mac_cap_info[2] = IEEE80211_HE_MAC_CAP2_ALL_ACK |
5144 			  IEEE80211_HE_MAC_CAP2_BSR;
5145 	mac_cap_info[3] = IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_2;
5146 	if (iftype == NL80211_IFTYPE_AP)
5147 		mac_cap_info[3] |= IEEE80211_HE_MAC_CAP3_OMI_CONTROL;
5148 	mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_OPS |
5149 			  IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU;
5150 	if (iftype == NL80211_IFTYPE_STATION)
5151 		mac_cap_info[5] = IEEE80211_HE_MAC_CAP5_HT_VHT_TRIG_FRAME_RX;
5152 	if (band == NL80211_BAND_2GHZ) {
5153 		phy_cap_info[0] =
5154 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G;
5155 	} else {
5156 		phy_cap_info[0] =
5157 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G;
5158 		if (chip->support_bandwidths & BIT(NL80211_CHAN_WIDTH_160))
5159 			phy_cap_info[0] |= IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
5160 	}
5161 	phy_cap_info[1] = IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
5162 			  IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
5163 			  IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US;
5164 	phy_cap_info[2] = IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
5165 			  IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
5166 			  IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
5167 			  IEEE80211_HE_PHY_CAP2_DOPPLER_TX;
5168 	phy_cap_info[3] = IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_16_QAM;
5169 	if (iftype == NL80211_IFTYPE_STATION)
5170 		phy_cap_info[3] |= IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_16_QAM |
5171 				   IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_2;
5172 	if (iftype == NL80211_IFTYPE_AP)
5173 		phy_cap_info[3] |= IEEE80211_HE_PHY_CAP3_RX_PARTIAL_BW_SU_IN_20MHZ_MU;
5174 	phy_cap_info[4] = IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE |
5175 			  IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_4;
5176 	if (chip->support_bandwidths & BIT(NL80211_CHAN_WIDTH_160))
5177 		phy_cap_info[4] |= IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_4;
5178 	phy_cap_info[5] = no_ng16 ? 0 :
5179 			  IEEE80211_HE_PHY_CAP5_NG16_SU_FEEDBACK |
5180 			  IEEE80211_HE_PHY_CAP5_NG16_MU_FEEDBACK;
5181 	phy_cap_info[6] = IEEE80211_HE_PHY_CAP6_CODEBOOK_SIZE_42_SU |
5182 			  IEEE80211_HE_PHY_CAP6_CODEBOOK_SIZE_75_MU |
5183 			  IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |
5184 			  IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE;
5185 	phy_cap_info[7] = IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP |
5186 			  IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI |
5187 			  IEEE80211_HE_PHY_CAP7_MAX_NC_1;
5188 	phy_cap_info[8] = IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI |
5189 			  IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI |
5190 			  IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_996;
5191 	if (chip->support_bandwidths & BIT(NL80211_CHAN_WIDTH_160))
5192 		phy_cap_info[8] |= IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU |
5193 				   IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU;
5194 	phy_cap_info[9] = IEEE80211_HE_PHY_CAP9_LONGER_THAN_16_SIGB_OFDM_SYM |
5195 			  IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU |
5196 			  IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_COMP_SIGB |
5197 			  IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_NON_COMP_SIGB |
5198 			  u8_encode_bits(IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_16US,
5199 					 IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_MASK);
5200 	if (iftype == NL80211_IFTYPE_STATION)
5201 		phy_cap_info[9] |= IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU;
5202 	he_cap->he_mcs_nss_supp.rx_mcs_80 = cpu_to_le16(mcs_map);
5203 	he_cap->he_mcs_nss_supp.tx_mcs_80 = cpu_to_le16(mcs_map);
5204 	if (chip->support_bandwidths & BIT(NL80211_CHAN_WIDTH_160)) {
5205 		he_cap->he_mcs_nss_supp.rx_mcs_160 = cpu_to_le16(mcs_map);
5206 		he_cap->he_mcs_nss_supp.tx_mcs_160 = cpu_to_le16(mcs_map);
5207 	}
5208 
5209 	if (band == NL80211_BAND_6GHZ) {
5210 		__le16 capa;
5211 
5212 		capa = le16_encode_bits(IEEE80211_HT_MPDU_DENSITY_NONE,
5213 					IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START) |
5214 		       le16_encode_bits(IEEE80211_VHT_MAX_AMPDU_1024K,
5215 					IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP) |
5216 		       le16_encode_bits(IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454,
5217 					IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN);
5218 		iftype_data->he_6ghz_capa.capa = capa;
5219 	}
5220 }
5221 
5222 static void rtw89_init_eht_cap(struct rtw89_dev *rtwdev,
5223 			       enum nl80211_band band,
5224 			       enum nl80211_iftype iftype,
5225 			       struct ieee80211_sband_iftype_data *iftype_data)
5226 {
5227 	const struct rtw89_chip_info *chip = rtwdev->chip;
5228 	struct ieee80211_eht_cap_elem_fixed *eht_cap_elem;
5229 	struct ieee80211_eht_mcs_nss_supp *eht_nss;
5230 	struct ieee80211_sta_eht_cap *eht_cap;
5231 	struct rtw89_hal *hal = &rtwdev->hal;
5232 	bool support_mcs_12_13 = true;
5233 	bool support_320mhz = false;
5234 	u8 val, val_mcs13;
5235 	int sts = 8;
5236 
5237 	if (chip->chip_gen == RTW89_CHIP_AX)
5238 		return;
5239 
5240 	if (hal->no_mcs_12_13)
5241 		support_mcs_12_13 = false;
5242 
5243 	if (band == NL80211_BAND_6GHZ &&
5244 	    chip->support_bandwidths & BIT(NL80211_CHAN_WIDTH_320))
5245 		support_320mhz = true;
5246 
5247 	eht_cap = &iftype_data->eht_cap;
5248 	eht_cap_elem = &eht_cap->eht_cap_elem;
5249 	eht_nss = &eht_cap->eht_mcs_nss_supp;
5250 
5251 	eht_cap->has_eht = true;
5252 
5253 	eht_cap_elem->mac_cap_info[0] =
5254 		u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_7991,
5255 			       IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK);
5256 	eht_cap_elem->mac_cap_info[1] = 0;
5257 
5258 	eht_cap_elem->phy_cap_info[0] =
5259 		IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
5260 		IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE;
5261 	if (support_320mhz)
5262 		eht_cap_elem->phy_cap_info[0] |=
5263 			IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ;
5264 
5265 	eht_cap_elem->phy_cap_info[0] |=
5266 		u8_encode_bits(u8_get_bits(sts - 1, BIT(0)),
5267 			       IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK);
5268 	eht_cap_elem->phy_cap_info[1] =
5269 		u8_encode_bits(u8_get_bits(sts - 1, GENMASK(2, 1)),
5270 			       IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK) |
5271 		u8_encode_bits(sts - 1,
5272 			       IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK);
5273 	if (support_320mhz)
5274 		eht_cap_elem->phy_cap_info[1] |=
5275 			u8_encode_bits(sts - 1,
5276 				       IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK);
5277 
5278 	eht_cap_elem->phy_cap_info[2] = 0;
5279 
5280 	eht_cap_elem->phy_cap_info[3] =
5281 		IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
5282 		IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
5283 		IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
5284 		IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK;
5285 
5286 	eht_cap_elem->phy_cap_info[4] =
5287 		IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
5288 		u8_encode_bits(1, IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK);
5289 
5290 	eht_cap_elem->phy_cap_info[5] =
5291 		u8_encode_bits(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_20US,
5292 			       IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK);
5293 
5294 	eht_cap_elem->phy_cap_info[6] = 0;
5295 	eht_cap_elem->phy_cap_info[7] = 0;
5296 	eht_cap_elem->phy_cap_info[8] = 0;
5297 
5298 	val = u8_encode_bits(hal->rx_nss, IEEE80211_EHT_MCS_NSS_RX) |
5299 	      u8_encode_bits(hal->tx_nss, IEEE80211_EHT_MCS_NSS_TX);
5300 	val_mcs13 = support_mcs_12_13 ? val : 0;
5301 
5302 	eht_nss->bw._80.rx_tx_mcs9_max_nss = val;
5303 	eht_nss->bw._80.rx_tx_mcs11_max_nss = val;
5304 	eht_nss->bw._80.rx_tx_mcs13_max_nss = val_mcs13;
5305 	eht_nss->bw._160.rx_tx_mcs9_max_nss = val;
5306 	eht_nss->bw._160.rx_tx_mcs11_max_nss = val;
5307 	eht_nss->bw._160.rx_tx_mcs13_max_nss = val_mcs13;
5308 	if (support_320mhz) {
5309 		eht_nss->bw._320.rx_tx_mcs9_max_nss = val;
5310 		eht_nss->bw._320.rx_tx_mcs11_max_nss = val;
5311 		eht_nss->bw._320.rx_tx_mcs13_max_nss = val_mcs13;
5312 	}
5313 }
5314 
5315 #define RTW89_SBAND_IFTYPES_NR 2
5316 
5317 static int rtw89_init_he_eht_cap(struct rtw89_dev *rtwdev,
5318 				 enum nl80211_band band,
5319 				 struct ieee80211_supported_band *sband)
5320 {
5321 	struct ieee80211_sband_iftype_data *iftype_data;
5322 	enum nl80211_iftype iftype;
5323 	int idx = 0;
5324 
5325 	iftype_data = devm_kcalloc(rtwdev->dev, RTW89_SBAND_IFTYPES_NR,
5326 				   sizeof(*iftype_data), GFP_KERNEL);
5327 	if (!iftype_data)
5328 		return -ENOMEM;
5329 
5330 	for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
5331 		switch (iftype) {
5332 		case NL80211_IFTYPE_STATION:
5333 		case NL80211_IFTYPE_AP:
5334 			break;
5335 		default:
5336 			continue;
5337 		}
5338 
5339 		if (idx >= RTW89_SBAND_IFTYPES_NR) {
5340 			rtw89_warn(rtwdev, "run out of iftype_data\n");
5341 			break;
5342 		}
5343 
5344 		iftype_data[idx].types_mask = BIT(iftype);
5345 
5346 		rtw89_init_he_cap(rtwdev, band, iftype, &iftype_data[idx]);
5347 		rtw89_init_eht_cap(rtwdev, band, iftype, &iftype_data[idx]);
5348 
5349 		idx++;
5350 	}
5351 
5352 	_ieee80211_set_sband_iftype_data(sband, iftype_data, idx);
5353 	return 0;
5354 }
5355 
5356 static struct ieee80211_supported_band *
5357 rtw89_core_sband_dup(struct rtw89_dev *rtwdev,
5358 		     const struct ieee80211_supported_band *sband)
5359 {
5360 	struct ieee80211_supported_band *dup;
5361 
5362 	dup = devm_kmemdup(rtwdev->dev, sband, sizeof(*sband), GFP_KERNEL);
5363 	if (!dup)
5364 		return NULL;
5365 
5366 	dup->channels = devm_kmemdup(rtwdev->dev, sband->channels,
5367 				     sizeof(*sband->channels) * sband->n_channels,
5368 				     GFP_KERNEL);
5369 	if (!dup->channels)
5370 		return NULL;
5371 
5372 	dup->bitrates = devm_kmemdup(rtwdev->dev, sband->bitrates,
5373 				     sizeof(*sband->bitrates) * sband->n_bitrates,
5374 				     GFP_KERNEL);
5375 	if (!dup->bitrates)
5376 		return NULL;
5377 
5378 	return dup;
5379 }
5380 
5381 static int rtw89_core_set_supported_band(struct rtw89_dev *rtwdev)
5382 {
5383 	struct ieee80211_hw *hw = rtwdev->hw;
5384 	struct ieee80211_supported_band *sband;
5385 	u8 support_bands = rtwdev->chip->support_bands;
5386 	int ret;
5387 
5388 	if (support_bands & BIT(NL80211_BAND_2GHZ)) {
5389 		sband = rtw89_core_sband_dup(rtwdev, &rtw89_sband_2ghz);
5390 		if (!sband)
5391 			return -ENOMEM;
5392 		rtw89_init_ht_cap(rtwdev, &sband->ht_cap);
5393 		ret = rtw89_init_he_eht_cap(rtwdev, NL80211_BAND_2GHZ, sband);
5394 		if (ret)
5395 			return ret;
5396 		hw->wiphy->bands[NL80211_BAND_2GHZ] = sband;
5397 	}
5398 
5399 	if (support_bands & BIT(NL80211_BAND_5GHZ)) {
5400 		sband = rtw89_core_sband_dup(rtwdev, &rtw89_sband_5ghz);
5401 		if (!sband)
5402 			return -ENOMEM;
5403 		rtw89_init_ht_cap(rtwdev, &sband->ht_cap);
5404 		rtw89_init_vht_cap(rtwdev, &sband->vht_cap);
5405 		ret = rtw89_init_he_eht_cap(rtwdev, NL80211_BAND_5GHZ, sband);
5406 		if (ret)
5407 			return ret;
5408 		hw->wiphy->bands[NL80211_BAND_5GHZ] = sband;
5409 	}
5410 
5411 	if (support_bands & BIT(NL80211_BAND_6GHZ)) {
5412 		sband = rtw89_core_sband_dup(rtwdev, &rtw89_sband_6ghz);
5413 		if (!sband)
5414 			return -ENOMEM;
5415 		ret = rtw89_init_he_eht_cap(rtwdev, NL80211_BAND_6GHZ, sband);
5416 		if (ret)
5417 			return ret;
5418 		hw->wiphy->bands[NL80211_BAND_6GHZ] = sband;
5419 	}
5420 
5421 	return 0;
5422 }
5423 
5424 static void rtw89_core_ppdu_sts_init(struct rtw89_dev *rtwdev)
5425 {
5426 	int i;
5427 
5428 	for (i = 0; i < RTW89_PHY_NUM; i++)
5429 		skb_queue_head_init(&rtwdev->ppdu_sts.rx_queue[i]);
5430 	for (i = 0; i < RTW89_PHY_NUM; i++)
5431 		rtwdev->ppdu_sts.curr_rx_ppdu_cnt[i] = U8_MAX;
5432 }
5433 
5434 void rtw89_core_update_beacon_work(struct wiphy *wiphy, struct wiphy_work *work)
5435 {
5436 	struct rtw89_dev *rtwdev;
5437 	struct rtw89_vif_link *rtwvif_link = container_of(work, struct rtw89_vif_link,
5438 							  update_beacon_work);
5439 
5440 	lockdep_assert_wiphy(wiphy);
5441 
5442 	if (rtwvif_link->net_type != RTW89_NET_TYPE_AP_MODE)
5443 		return;
5444 
5445 	rtwdev = rtwvif_link->rtwvif->rtwdev;
5446 
5447 	rtw89_chip_h2c_update_beacon(rtwdev, rtwvif_link);
5448 }
5449 
5450 void rtw89_core_csa_beacon_work(struct wiphy *wiphy, struct wiphy_work *work)
5451 {
5452 	struct rtw89_vif_link *rtwvif_link =
5453 		container_of(work, struct rtw89_vif_link, csa_beacon_work.work);
5454 	struct rtw89_vif *rtwvif = rtwvif_link->rtwvif;
5455 	struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif);
5456 	struct rtw89_dev *rtwdev = rtwvif->rtwdev;
5457 	struct ieee80211_bss_conf *bss_conf;
5458 	unsigned int delay;
5459 
5460 	lockdep_assert_wiphy(wiphy);
5461 
5462 	if (rtwvif_link->net_type != RTW89_NET_TYPE_AP_MODE)
5463 		return;
5464 
5465 	rcu_read_lock();
5466 
5467 	bss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, true);
5468 	if (!bss_conf->csa_active) {
5469 		rcu_read_unlock();
5470 		return;
5471 	}
5472 
5473 	delay = ieee80211_tu_to_usec(bss_conf->beacon_int);
5474 
5475 	rcu_read_unlock();
5476 
5477 	if (!ieee80211_beacon_cntdwn_is_complete(vif, rtwvif_link->link_id)) {
5478 		rtw89_chip_h2c_update_beacon(rtwdev, rtwvif_link);
5479 
5480 		wiphy_delayed_work_queue(wiphy, &rtwvif_link->csa_beacon_work,
5481 					 usecs_to_jiffies(delay));
5482 	} else {
5483 		ieee80211_csa_finish(vif, rtwvif_link->link_id);
5484 	}
5485 }
5486 
5487 struct rtw89_wait_response *
5488 rtw89_wait_for_cond_prep(struct rtw89_wait_info *wait, unsigned int cond)
5489 {
5490 	struct rtw89_wait_response *prep;
5491 	unsigned int cur;
5492 
5493 	/* use -EPERM _iff_ telling eval side not to make any changes */
5494 
5495 	cur = atomic_cmpxchg(&wait->cond, RTW89_WAIT_COND_IDLE, cond);
5496 	if (cur != RTW89_WAIT_COND_IDLE)
5497 		return ERR_PTR(-EPERM);
5498 
5499 	prep = kzalloc(sizeof(*prep), GFP_KERNEL);
5500 	if (!prep)
5501 		return ERR_PTR(-ENOMEM);
5502 
5503 	init_completion(&prep->completion);
5504 
5505 	rcu_assign_pointer(wait->resp, prep);
5506 
5507 	return prep;
5508 }
5509 
5510 int rtw89_wait_for_cond_eval(struct rtw89_wait_info *wait,
5511 			     struct rtw89_wait_response *prep, int err)
5512 {
5513 	unsigned long time_left;
5514 
5515 	if (IS_ERR(prep)) {
5516 		err = err ?: PTR_ERR(prep);
5517 
5518 		/* special error case: no permission to reset anything */
5519 		if (PTR_ERR(prep) == -EPERM)
5520 			return err;
5521 
5522 		goto reset;
5523 	}
5524 
5525 	if (err)
5526 		goto cleanup;
5527 
5528 	time_left = wait_for_completion_timeout(&prep->completion,
5529 						RTW89_WAIT_FOR_COND_TIMEOUT);
5530 	if (time_left == 0) {
5531 		err = -ETIMEDOUT;
5532 		goto cleanup;
5533 	}
5534 
5535 	wait->data = prep->data;
5536 
5537 cleanup:
5538 	rcu_assign_pointer(wait->resp, NULL);
5539 	kfree_rcu(prep, rcu_head);
5540 
5541 reset:
5542 	atomic_set(&wait->cond, RTW89_WAIT_COND_IDLE);
5543 
5544 	if (err)
5545 		return err;
5546 
5547 	if (wait->data.err)
5548 		return -EFAULT;
5549 
5550 	return 0;
5551 }
5552 
5553 static void rtw89_complete_cond_resp(struct rtw89_wait_response *resp,
5554 				     const struct rtw89_completion_data *data)
5555 {
5556 	resp->data = *data;
5557 	complete(&resp->completion);
5558 }
5559 
5560 void rtw89_complete_cond(struct rtw89_wait_info *wait, unsigned int cond,
5561 			 const struct rtw89_completion_data *data)
5562 {
5563 	struct rtw89_wait_response *resp;
5564 	unsigned int cur;
5565 
5566 	guard(rcu)();
5567 
5568 	resp = rcu_dereference(wait->resp);
5569 	if (!resp)
5570 		return;
5571 
5572 	cur = atomic_cmpxchg(&wait->cond, cond, RTW89_WAIT_COND_IDLE);
5573 	if (cur != cond)
5574 		return;
5575 
5576 	rtw89_complete_cond_resp(resp, data);
5577 }
5578 
5579 void rtw89_core_ntfy_btc_event(struct rtw89_dev *rtwdev, enum rtw89_btc_hmsg event)
5580 {
5581 	u16 bt_req_len;
5582 
5583 	switch (event) {
5584 	case RTW89_BTC_HMSG_SET_BT_REQ_SLOT:
5585 		bt_req_len = rtw89_coex_query_bt_req_len(rtwdev, RTW89_PHY_0);
5586 		rtw89_debug(rtwdev, RTW89_DBG_BTC,
5587 			    "coex updates BT req len to %d TU\n", bt_req_len);
5588 		rtw89_queue_chanctx_change(rtwdev, RTW89_CHANCTX_BT_SLOT_CHANGE);
5589 		break;
5590 	default:
5591 		if (event < NUM_OF_RTW89_BTC_HMSG)
5592 			rtw89_debug(rtwdev, RTW89_DBG_BTC,
5593 				    "unhandled BTC HMSG event: %d\n", event);
5594 		else
5595 			rtw89_warn(rtwdev,
5596 				   "unrecognized BTC HMSG event: %d\n", event);
5597 		break;
5598 	}
5599 }
5600 
5601 void rtw89_check_quirks(struct rtw89_dev *rtwdev, const struct dmi_system_id *quirks)
5602 {
5603 	const struct dmi_system_id *match;
5604 	enum rtw89_quirks quirk;
5605 
5606 	if (!quirks)
5607 		return;
5608 
5609 	for (match = dmi_first_match(quirks); match; match = dmi_first_match(match + 1)) {
5610 		quirk = (uintptr_t)match->driver_data;
5611 		if (quirk >= NUM_OF_RTW89_QUIRKS)
5612 			continue;
5613 
5614 		set_bit(quirk, rtwdev->quirks);
5615 	}
5616 }
5617 EXPORT_SYMBOL(rtw89_check_quirks);
5618 
5619 int rtw89_core_start(struct rtw89_dev *rtwdev)
5620 {
5621 	bool no_bbmcu = !rtwdev->chip->bbmcu_nr;
5622 	int ret;
5623 
5624 	ret = rtw89_mac_preinit(rtwdev);
5625 	if (ret) {
5626 		rtw89_err(rtwdev, "mac preinit fail, ret: %d\n", ret);
5627 		return ret;
5628 	}
5629 
5630 	if (no_bbmcu)
5631 		rtw89_chip_bb_preinit(rtwdev);
5632 
5633 	rtw89_phy_init_bb_afe(rtwdev);
5634 
5635 	/* above do preinit before downloading firmware */
5636 
5637 	ret = rtw89_mac_init(rtwdev);
5638 	if (ret) {
5639 		rtw89_err(rtwdev, "mac init fail, ret:%d\n", ret);
5640 		return ret;
5641 	}
5642 
5643 	rtw89_btc_ntfy_poweron(rtwdev);
5644 
5645 	/* efuse process */
5646 
5647 	/* pre-config BB/RF, BB reset/RFC reset */
5648 	ret = rtw89_chip_reset_bb_rf(rtwdev);
5649 	if (ret)
5650 		return ret;
5651 
5652 	rtw89_phy_init_bb_reg(rtwdev);
5653 	rtw89_chip_bb_postinit(rtwdev);
5654 	rtw89_phy_init_rf_reg(rtwdev, false);
5655 
5656 	rtw89_btc_ntfy_init(rtwdev, BTC_MODE_NORMAL);
5657 
5658 	rtw89_phy_dm_init(rtwdev);
5659 
5660 	rtw89_mac_cfg_ppdu_status_bands(rtwdev, true);
5661 	rtw89_mac_cfg_phy_rpt_bands(rtwdev, true);
5662 	rtw89_mac_update_rts_threshold(rtwdev);
5663 
5664 	ret = rtw89_hci_start(rtwdev);
5665 	if (ret) {
5666 		rtw89_err(rtwdev, "failed to start hci\n");
5667 		return ret;
5668 	}
5669 
5670 	wiphy_delayed_work_queue(rtwdev->hw->wiphy, &rtwdev->track_work,
5671 				 RTW89_TRACK_WORK_PERIOD);
5672 	wiphy_delayed_work_queue(rtwdev->hw->wiphy, &rtwdev->track_ps_work,
5673 				 RTW89_TRACK_PS_WORK_PERIOD);
5674 
5675 	set_bit(RTW89_FLAG_RUNNING, rtwdev->flags);
5676 
5677 	rtw89_chip_rfk_init_late(rtwdev);
5678 	rtw89_btc_ntfy_radio_state(rtwdev, BTC_RFCTRL_WL_ON);
5679 	rtw89_fw_h2c_fw_log(rtwdev, rtwdev->fw.log.enable);
5680 	rtw89_fw_h2c_init_ba_cam(rtwdev);
5681 	rtw89_tas_fw_timer_enable(rtwdev, true);
5682 	rtwdev->ps_hang_cnt = 0;
5683 
5684 	return 0;
5685 }
5686 
5687 void rtw89_core_stop(struct rtw89_dev *rtwdev)
5688 {
5689 	struct wiphy *wiphy = rtwdev->hw->wiphy;
5690 	struct rtw89_btc *btc = &rtwdev->btc;
5691 
5692 	lockdep_assert_wiphy(wiphy);
5693 
5694 	/* Prvent to stop twice; enter_ips and ops_stop */
5695 	if (!test_bit(RTW89_FLAG_RUNNING, rtwdev->flags))
5696 		return;
5697 
5698 	rtw89_tas_fw_timer_enable(rtwdev, false);
5699 	rtw89_btc_ntfy_radio_state(rtwdev, BTC_RFCTRL_WL_OFF);
5700 
5701 	clear_bit(RTW89_FLAG_RUNNING, rtwdev->flags);
5702 
5703 	wiphy_work_cancel(wiphy, &rtwdev->c2h_work);
5704 	wiphy_work_cancel(wiphy, &rtwdev->cancel_6ghz_probe_work);
5705 	wiphy_work_cancel(wiphy, &btc->eapol_notify_work);
5706 	wiphy_work_cancel(wiphy, &btc->arp_notify_work);
5707 	wiphy_work_cancel(wiphy, &btc->dhcp_notify_work);
5708 	wiphy_work_cancel(wiphy, &btc->icmp_notify_work);
5709 	cancel_delayed_work_sync(&rtwdev->txq_reinvoke_work);
5710 	wiphy_delayed_work_cancel(wiphy, &rtwdev->tx_wait_work);
5711 	wiphy_delayed_work_cancel(wiphy, &rtwdev->track_work);
5712 	wiphy_delayed_work_cancel(wiphy, &rtwdev->track_ps_work);
5713 	wiphy_delayed_work_cancel(wiphy, &rtwdev->chanctx_work);
5714 	wiphy_delayed_work_cancel(wiphy, &rtwdev->coex_act1_work);
5715 	wiphy_delayed_work_cancel(wiphy, &rtwdev->coex_bt_devinfo_work);
5716 	wiphy_delayed_work_cancel(wiphy, &rtwdev->coex_rfk_chk_work);
5717 	wiphy_delayed_work_cancel(wiphy, &rtwdev->cfo_track_work);
5718 	wiphy_delayed_work_cancel(wiphy, &rtwdev->mcc_prepare_done_work);
5719 	cancel_delayed_work_sync(&rtwdev->forbid_ba_work);
5720 	wiphy_delayed_work_cancel(wiphy, &rtwdev->antdiv_work);
5721 
5722 	rtw89_btc_ntfy_poweroff(rtwdev);
5723 	rtw89_hci_flush_queues(rtwdev, BIT(rtwdev->hw->queues) - 1, true);
5724 	rtw89_mac_flush_txq(rtwdev, BIT(rtwdev->hw->queues) - 1, true);
5725 	rtw89_hci_stop(rtwdev);
5726 	rtw89_hci_deinit(rtwdev);
5727 	rtw89_mac_pwr_off(rtwdev);
5728 	rtw89_hci_reset(rtwdev);
5729 }
5730 
5731 u8 rtw89_acquire_mac_id(struct rtw89_dev *rtwdev)
5732 {
5733 	const struct rtw89_chip_info *chip = rtwdev->chip;
5734 	u8 mac_id_num;
5735 	u8 mac_id;
5736 
5737 	if (rtwdev->support_mlo)
5738 		mac_id_num = chip->support_macid_num / chip->support_link_num;
5739 	else
5740 		mac_id_num = chip->support_macid_num;
5741 
5742 	mac_id = find_first_zero_bit(rtwdev->mac_id_map, mac_id_num);
5743 	if (mac_id == mac_id_num)
5744 		return RTW89_MAX_MAC_ID_NUM;
5745 
5746 	set_bit(mac_id, rtwdev->mac_id_map);
5747 	return mac_id;
5748 }
5749 
5750 void rtw89_release_mac_id(struct rtw89_dev *rtwdev, u8 mac_id)
5751 {
5752 	clear_bit(mac_id, rtwdev->mac_id_map);
5753 }
5754 
5755 void rtw89_init_vif(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif,
5756 		    u8 mac_id, u8 port)
5757 {
5758 	const struct rtw89_chip_info *chip = rtwdev->chip;
5759 	u8 support_link_num = chip->support_link_num;
5760 	u8 support_mld_num = 0;
5761 	unsigned int link_id;
5762 	u8 index;
5763 
5764 	bitmap_zero(rtwvif->links_inst_map, __RTW89_MLD_MAX_LINK_NUM);
5765 	for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++)
5766 		rtwvif->links[link_id] = NULL;
5767 
5768 	rtwvif->rtwdev = rtwdev;
5769 
5770 	if (rtwdev->support_mlo) {
5771 		rtwvif->links_inst_valid_num = support_link_num;
5772 		support_mld_num = chip->support_macid_num / support_link_num;
5773 	} else {
5774 		rtwvif->links_inst_valid_num = 1;
5775 	}
5776 
5777 	for (index = 0; index < rtwvif->links_inst_valid_num; index++) {
5778 		struct rtw89_vif_link *inst = &rtwvif->links_inst[index];
5779 
5780 		inst->rtwvif = rtwvif;
5781 		inst->mac_id = mac_id + index * support_mld_num;
5782 		inst->mac_idx = RTW89_MAC_0 + index;
5783 		inst->phy_idx = RTW89_PHY_0 + index;
5784 
5785 		/* multi-link use the same port id on different HW bands */
5786 		inst->port = port;
5787 	}
5788 }
5789 
5790 void rtw89_init_sta(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif,
5791 		    struct rtw89_sta *rtwsta, u8 mac_id)
5792 {
5793 	const struct rtw89_chip_info *chip = rtwdev->chip;
5794 	u8 support_link_num = chip->support_link_num;
5795 	u8 support_mld_num = 0;
5796 	unsigned int link_id;
5797 	u8 index;
5798 
5799 	bitmap_zero(rtwsta->links_inst_map, __RTW89_MLD_MAX_LINK_NUM);
5800 	for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++)
5801 		rtwsta->links[link_id] = NULL;
5802 
5803 	rtwsta->rtwdev = rtwdev;
5804 	rtwsta->rtwvif = rtwvif;
5805 
5806 	if (rtwdev->support_mlo) {
5807 		rtwsta->links_inst_valid_num = support_link_num;
5808 		support_mld_num = chip->support_macid_num / support_link_num;
5809 	} else {
5810 		rtwsta->links_inst_valid_num = 1;
5811 	}
5812 
5813 	for (index = 0; index < rtwsta->links_inst_valid_num; index++) {
5814 		struct rtw89_sta_link *inst = &rtwsta->links_inst[index];
5815 
5816 		inst->rtwvif_link = &rtwvif->links_inst[index];
5817 
5818 		inst->rtwsta = rtwsta;
5819 		inst->mac_id = mac_id + index * support_mld_num;
5820 	}
5821 }
5822 
5823 struct rtw89_vif_link *rtw89_vif_set_link(struct rtw89_vif *rtwvif,
5824 					  unsigned int link_id)
5825 {
5826 	struct rtw89_vif_link *rtwvif_link = rtwvif->links[link_id];
5827 	u8 index;
5828 	int ret;
5829 
5830 	if (rtwvif_link)
5831 		return rtwvif_link;
5832 
5833 	index = find_first_zero_bit(rtwvif->links_inst_map,
5834 				    rtwvif->links_inst_valid_num);
5835 	if (index == rtwvif->links_inst_valid_num) {
5836 		ret = -EBUSY;
5837 		goto err;
5838 	}
5839 
5840 	rtwvif_link = &rtwvif->links_inst[index];
5841 	rtwvif_link->link_id = link_id;
5842 
5843 	set_bit(index, rtwvif->links_inst_map);
5844 	rtwvif->links[link_id] = rtwvif_link;
5845 	list_add_tail(&rtwvif_link->dlink_schd, &rtwvif->dlink_pool);
5846 	return rtwvif_link;
5847 
5848 err:
5849 	rtw89_err(rtwvif->rtwdev, "vif (link_id %u) failed to set link: %d\n",
5850 		  link_id, ret);
5851 	return NULL;
5852 }
5853 
5854 void rtw89_vif_unset_link(struct rtw89_vif *rtwvif, unsigned int link_id)
5855 {
5856 	struct rtw89_vif_link **container = &rtwvif->links[link_id];
5857 	struct rtw89_vif_link *link = *container;
5858 	u8 index;
5859 
5860 	if (!link)
5861 		return;
5862 
5863 	index = rtw89_vif_link_inst_get_index(link);
5864 	clear_bit(index, rtwvif->links_inst_map);
5865 	*container = NULL;
5866 	list_del(&link->dlink_schd);
5867 }
5868 
5869 struct rtw89_sta_link *rtw89_sta_set_link(struct rtw89_sta *rtwsta,
5870 					  unsigned int link_id)
5871 {
5872 	struct rtw89_vif *rtwvif = rtwsta->rtwvif;
5873 	struct rtw89_vif_link *rtwvif_link = rtwvif->links[link_id];
5874 	struct rtw89_sta_link *rtwsta_link = rtwsta->links[link_id];
5875 	u8 index;
5876 	int ret;
5877 
5878 	if (rtwsta_link)
5879 		return rtwsta_link;
5880 
5881 	if (!rtwvif_link) {
5882 		ret = -ENOLINK;
5883 		goto err;
5884 	}
5885 
5886 	index = rtw89_vif_link_inst_get_index(rtwvif_link);
5887 	if (test_bit(index, rtwsta->links_inst_map)) {
5888 		ret = -EBUSY;
5889 		goto err;
5890 	}
5891 
5892 	rtwsta_link = &rtwsta->links_inst[index];
5893 	rtwsta_link->link_id = link_id;
5894 
5895 	set_bit(index, rtwsta->links_inst_map);
5896 	rtwsta->links[link_id] = rtwsta_link;
5897 	list_add_tail(&rtwsta_link->dlink_schd, &rtwsta->dlink_pool);
5898 	return rtwsta_link;
5899 
5900 err:
5901 	rtw89_err(rtwsta->rtwdev, "sta (link_id %u) failed to set link: %d\n",
5902 		  link_id, ret);
5903 	return NULL;
5904 }
5905 
5906 void rtw89_sta_unset_link(struct rtw89_sta *rtwsta, unsigned int link_id)
5907 {
5908 	struct rtw89_sta_link **container = &rtwsta->links[link_id];
5909 	struct rtw89_sta_link *link = *container;
5910 	u8 index;
5911 
5912 	if (!link)
5913 		return;
5914 
5915 	index = rtw89_sta_link_inst_get_index(link);
5916 	clear_bit(index, rtwsta->links_inst_map);
5917 	*container = NULL;
5918 	list_del(&link->dlink_schd);
5919 }
5920 
5921 int rtw89_core_init(struct rtw89_dev *rtwdev)
5922 {
5923 	struct rtw89_btc *btc = &rtwdev->btc;
5924 	u8 band;
5925 
5926 	INIT_LIST_HEAD(&rtwdev->ba_list);
5927 	INIT_LIST_HEAD(&rtwdev->forbid_ba_list);
5928 	INIT_LIST_HEAD(&rtwdev->rtwvifs_list);
5929 	INIT_LIST_HEAD(&rtwdev->early_h2c_list);
5930 	for (band = NL80211_BAND_2GHZ; band < NUM_NL80211_BANDS; band++) {
5931 		if (!(rtwdev->chip->support_bands & BIT(band)))
5932 			continue;
5933 		INIT_LIST_HEAD(&rtwdev->scan_info.pkt_list[band]);
5934 	}
5935 	INIT_LIST_HEAD(&rtwdev->scan_info.chan_list);
5936 	INIT_LIST_HEAD(&rtwdev->tx_waits);
5937 	INIT_WORK(&rtwdev->ba_work, rtw89_core_ba_work);
5938 	INIT_WORK(&rtwdev->txq_work, rtw89_core_txq_work);
5939 	INIT_DELAYED_WORK(&rtwdev->txq_reinvoke_work, rtw89_core_txq_reinvoke_work);
5940 	wiphy_delayed_work_init(&rtwdev->track_work, rtw89_track_work);
5941 	wiphy_delayed_work_init(&rtwdev->track_ps_work, rtw89_track_ps_work);
5942 	wiphy_delayed_work_init(&rtwdev->chanctx_work, rtw89_chanctx_work);
5943 	wiphy_delayed_work_init(&rtwdev->coex_act1_work, rtw89_coex_act1_work);
5944 	wiphy_delayed_work_init(&rtwdev->coex_bt_devinfo_work, rtw89_coex_bt_devinfo_work);
5945 	wiphy_delayed_work_init(&rtwdev->coex_rfk_chk_work, rtw89_coex_rfk_chk_work);
5946 	wiphy_delayed_work_init(&rtwdev->cfo_track_work, rtw89_phy_cfo_track_work);
5947 	wiphy_delayed_work_init(&rtwdev->mcc_prepare_done_work, rtw89_mcc_prepare_done_work);
5948 	wiphy_delayed_work_init(&rtwdev->tx_wait_work, rtw89_tx_wait_work);
5949 	INIT_DELAYED_WORK(&rtwdev->forbid_ba_work, rtw89_forbid_ba_work);
5950 	wiphy_delayed_work_init(&rtwdev->antdiv_work, rtw89_phy_antdiv_work);
5951 	rtwdev->txq_wq = alloc_workqueue("rtw89_tx_wq", WQ_UNBOUND | WQ_HIGHPRI, 0);
5952 	if (!rtwdev->txq_wq)
5953 		return -ENOMEM;
5954 	spin_lock_init(&rtwdev->ba_lock);
5955 	spin_lock_init(&rtwdev->rpwm_lock);
5956 	mutex_init(&rtwdev->rf_mutex);
5957 	rtwdev->total_sta_assoc = 0;
5958 
5959 	rtw89_init_wait(&rtwdev->mcc.wait);
5960 	rtw89_init_wait(&rtwdev->mlo.wait);
5961 	rtw89_init_wait(&rtwdev->mac.fw_ofld_wait);
5962 	rtw89_init_wait(&rtwdev->wow.wait);
5963 	rtw89_init_wait(&rtwdev->mac.ps_wait);
5964 
5965 	wiphy_work_init(&rtwdev->c2h_work, rtw89_fw_c2h_work);
5966 	wiphy_work_init(&rtwdev->ips_work, rtw89_ips_work);
5967 	wiphy_work_init(&rtwdev->cancel_6ghz_probe_work, rtw89_cancel_6ghz_probe_work);
5968 	INIT_WORK(&rtwdev->load_firmware_work, rtw89_load_firmware_work);
5969 
5970 	spin_lock_init(&rtwdev->tx_rpt.skb_lock);
5971 	skb_queue_head_init(&rtwdev->c2h_queue);
5972 	rtw89_core_ppdu_sts_init(rtwdev);
5973 	rtw89_traffic_stats_init(rtwdev, &rtwdev->stats);
5974 
5975 	rtwdev->hal.rx_fltr = DEFAULT_AX_RX_FLTR;
5976 	rtwdev->dbcc_en = false;
5977 	rtwdev->mlo_dbcc_mode = MLO_DBCC_NOT_SUPPORT;
5978 	rtwdev->mac.qta_mode = RTW89_QTA_SCC;
5979 
5980 	if (rtwdev->chip->chip_gen == RTW89_CHIP_BE) {
5981 		rtwdev->dbcc_en = true;
5982 		rtwdev->mac.qta_mode = RTW89_QTA_DBCC;
5983 		rtwdev->mlo_dbcc_mode = MLO_1_PLUS_1_1RF;
5984 	}
5985 
5986 	rtwdev->bbs[RTW89_PHY_0].phy_idx = RTW89_PHY_0;
5987 	rtwdev->bbs[RTW89_PHY_1].phy_idx = RTW89_PHY_1;
5988 
5989 	wiphy_work_init(&btc->eapol_notify_work, rtw89_btc_ntfy_eapol_packet_work);
5990 	wiphy_work_init(&btc->arp_notify_work, rtw89_btc_ntfy_arp_packet_work);
5991 	wiphy_work_init(&btc->dhcp_notify_work, rtw89_btc_ntfy_dhcp_packet_work);
5992 	wiphy_work_init(&btc->icmp_notify_work, rtw89_btc_ntfy_icmp_packet_work);
5993 
5994 	init_completion(&rtwdev->fw.req.completion);
5995 	init_completion(&rtwdev->rfk_wait.completion);
5996 
5997 	schedule_work(&rtwdev->load_firmware_work);
5998 
5999 	rtw89_ser_init(rtwdev);
6000 	rtw89_entity_init(rtwdev);
6001 	rtw89_sar_init(rtwdev);
6002 	rtw89_phy_ant_gain_init(rtwdev);
6003 
6004 	return 0;
6005 }
6006 EXPORT_SYMBOL(rtw89_core_init);
6007 
6008 void rtw89_core_deinit(struct rtw89_dev *rtwdev)
6009 {
6010 	rtw89_ser_deinit(rtwdev);
6011 	rtw89_unload_firmware(rtwdev);
6012 	__rtw89_fw_free_all_early_h2c(rtwdev);
6013 
6014 	destroy_workqueue(rtwdev->txq_wq);
6015 	mutex_destroy(&rtwdev->rf_mutex);
6016 }
6017 EXPORT_SYMBOL(rtw89_core_deinit);
6018 
6019 void rtw89_core_scan_start(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link,
6020 			   const u8 *mac_addr, bool hw_scan)
6021 {
6022 	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev,
6023 						       rtwvif_link->chanctx_idx);
6024 	struct rtw89_bb_ctx *bb = rtw89_get_bb_ctx(rtwdev, rtwvif_link->phy_idx);
6025 
6026 	rtwdev->scanning = true;
6027 
6028 	ether_addr_copy(rtwvif_link->mac_addr, mac_addr);
6029 	rtw89_btc_ntfy_scan_start(rtwdev, rtwvif_link->phy_idx, chan->band_type);
6030 	rtw89_chip_rfk_scan(rtwdev, rtwvif_link, true);
6031 	rtw89_hci_recalc_int_mit(rtwdev);
6032 	rtw89_phy_config_edcca(rtwdev, bb, true);
6033 	rtw89_tas_scan(rtwdev, true);
6034 
6035 	rtw89_fw_h2c_cam(rtwdev, rtwvif_link, NULL, mac_addr,
6036 			 RTW89_ROLE_INFO_CHANGE);
6037 }
6038 
6039 void rtw89_core_scan_complete(struct rtw89_dev *rtwdev,
6040 			      struct rtw89_vif_link *rtwvif_link, bool hw_scan)
6041 {
6042 	struct ieee80211_bss_conf *bss_conf;
6043 	struct rtw89_bb_ctx *bb;
6044 	int ret;
6045 
6046 	if (!rtwvif_link)
6047 		return;
6048 
6049 	rcu_read_lock();
6050 
6051 	bss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, true);
6052 	ether_addr_copy(rtwvif_link->mac_addr, bss_conf->addr);
6053 
6054 	rcu_read_unlock();
6055 
6056 	rtw89_fw_h2c_cam(rtwdev, rtwvif_link, NULL, NULL,
6057 			 RTW89_ROLE_INFO_CHANGE);
6058 
6059 	rtw89_chip_rfk_scan(rtwdev, rtwvif_link, false);
6060 	rtw89_btc_ntfy_scan_finish(rtwdev, rtwvif_link->phy_idx);
6061 	bb = rtw89_get_bb_ctx(rtwdev, rtwvif_link->phy_idx);
6062 	rtw89_phy_config_edcca(rtwdev, bb, false);
6063 	rtw89_tas_scan(rtwdev, false);
6064 
6065 	if (hw_scan) {
6066 		ret = rtw89_core_send_nullfunc(rtwdev, rtwvif_link, false, false,
6067 					       RTW89_SCAN_NULL_TIMEOUT);
6068 		if (ret)
6069 			rtw89_debug(rtwdev, RTW89_DBG_TXRX,
6070 				    "scan send null-0 failed: %d\n", ret);
6071 	}
6072 
6073 	rtwdev->scanning = false;
6074 	rtw89_for_each_active_bb(rtwdev, bb)
6075 		bb->dig.bypass_dig = true;
6076 	if (hw_scan && (rtwdev->hw->conf.flags & IEEE80211_CONF_IDLE))
6077 		wiphy_work_queue(rtwdev->hw->wiphy, &rtwdev->ips_work);
6078 }
6079 
6080 static void rtw89_read_chip_ver(struct rtw89_dev *rtwdev)
6081 {
6082 	const struct rtw89_chip_info *chip = rtwdev->chip;
6083 	int ret;
6084 	u8 val;
6085 	u8 cv;
6086 
6087 	cv = rtw89_read32_mask(rtwdev, R_AX_SYS_CFG1, B_AX_CHIP_VER_MASK);
6088 	if (chip->chip_id == RTL8852A && cv <= CHIP_CBV) {
6089 		if (rtw89_read32(rtwdev, R_AX_GPIO0_7_FUNC_SEL) == RTW89_R32_DEAD)
6090 			cv = CHIP_CAV;
6091 		else
6092 			cv = CHIP_CBV;
6093 	}
6094 
6095 	rtwdev->hal.cv = cv;
6096 
6097 	if (rtw89_is_rtl885xb(rtwdev)) {
6098 		ret = rtw89_mac_read_xtal_si(rtwdev, XTAL_SI_CV, &val);
6099 		if (ret)
6100 			return;
6101 
6102 		rtwdev->hal.acv = u8_get_bits(val, XTAL_SI_ACV_MASK);
6103 	}
6104 }
6105 
6106 static void rtw89_core_setup_phycap(struct rtw89_dev *rtwdev)
6107 {
6108 	const struct rtw89_chip_info *chip = rtwdev->chip;
6109 
6110 	rtwdev->hal.support_cckpd =
6111 		!(rtwdev->chip->chip_id == RTL8852A && rtwdev->hal.cv <= CHIP_CBV) &&
6112 		!(rtwdev->chip->chip_id == RTL8852B && rtwdev->hal.cv <= CHIP_CAV);
6113 	rtwdev->hal.support_igi =
6114 		rtwdev->chip->chip_id == RTL8852A && rtwdev->hal.cv <= CHIP_CBV;
6115 
6116 	if (test_bit(RTW89_QUIRK_THERMAL_PROT_120C, rtwdev->quirks))
6117 		rtwdev->hal.thermal_prot_th = chip->thermal_th[1];
6118 	else if (test_bit(RTW89_QUIRK_THERMAL_PROT_110C, rtwdev->quirks))
6119 		rtwdev->hal.thermal_prot_th = chip->thermal_th[0];
6120 	else
6121 		rtwdev->hal.thermal_prot_th = 0;
6122 }
6123 
6124 static void rtw89_core_setup_rfe_parms(struct rtw89_dev *rtwdev)
6125 {
6126 	const struct rtw89_chip_info *chip = rtwdev->chip;
6127 	const struct rtw89_rfe_parms_conf *conf = chip->rfe_parms_conf;
6128 	struct rtw89_efuse *efuse = &rtwdev->efuse;
6129 	const struct rtw89_rfe_parms *sel;
6130 	u8 rfe_type = efuse->rfe_type;
6131 
6132 	if (!conf) {
6133 		sel = chip->dflt_parms;
6134 		goto out;
6135 	}
6136 
6137 	while (conf->rfe_parms) {
6138 		if (rfe_type == conf->rfe_type) {
6139 			sel = conf->rfe_parms;
6140 			goto out;
6141 		}
6142 		conf++;
6143 	}
6144 
6145 	sel = chip->dflt_parms;
6146 
6147 out:
6148 	rtwdev->rfe_parms = rtw89_load_rfe_data_from_fw(rtwdev, sel);
6149 	rtw89_load_txpwr_table(rtwdev, rtwdev->rfe_parms->byr_tbl);
6150 }
6151 
6152 int rtw89_core_mlsr_switch(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif,
6153 			   unsigned int link_id)
6154 {
6155 	struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif);
6156 	u16 usable_links = ieee80211_vif_usable_links(vif);
6157 	u16 active_links = vif->active_links;
6158 	struct rtw89_vif_link *target;
6159 	int ret;
6160 
6161 	lockdep_assert_wiphy(rtwdev->hw->wiphy);
6162 
6163 	if (unlikely(!ieee80211_vif_is_mld(vif)))
6164 		return -EOPNOTSUPP;
6165 
6166 	if (unlikely(link_id >= IEEE80211_MLD_MAX_NUM_LINKS ||
6167 		     !(usable_links & BIT(link_id)))) {
6168 		rtw89_warn(rtwdev, "%s: link id %u is not usable\n", __func__,
6169 			   link_id);
6170 		return -ENOLINK;
6171 	}
6172 
6173 	if (active_links == BIT(link_id))
6174 		return 0;
6175 
6176 	rtw89_debug(rtwdev, RTW89_DBG_STATE, "%s: switch to link id %u MLSR\n",
6177 		    __func__, link_id);
6178 
6179 	rtw89_leave_lps(rtwdev);
6180 
6181 	ieee80211_stop_queues(rtwdev->hw);
6182 	flush_work(&rtwdev->txq_work);
6183 
6184 	ret = ieee80211_set_active_links(vif, BIT(link_id));
6185 	if (ret) {
6186 		rtw89_err(rtwdev, "%s: failed to work on link id %u\n",
6187 			  __func__, link_id);
6188 		goto wake_queue;
6189 	}
6190 
6191 	target = rtwvif->links[link_id];
6192 	if (unlikely(!target)) {
6193 		rtw89_err(rtwdev, "%s: failed to confirm link id %u\n",
6194 			  __func__, link_id);
6195 
6196 		ieee80211_set_active_links(vif, active_links);
6197 		ret = -EFAULT;
6198 		goto wake_queue;
6199 	}
6200 
6201 	rtw89_chip_rfk_channel(rtwdev, target);
6202 
6203 	rtwvif->mlo_mode = RTW89_MLO_MODE_MLSR;
6204 
6205 wake_queue:
6206 	ieee80211_wake_queues(rtwdev->hw);
6207 
6208 	return ret;
6209 }
6210 
6211 static int rtw89_chip_efuse_info_setup(struct rtw89_dev *rtwdev)
6212 {
6213 	const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;
6214 	int ret;
6215 
6216 	ret = rtw89_mac_partial_init(rtwdev, false);
6217 	if (ret)
6218 		return ret;
6219 
6220 	ret = mac->parse_efuse_map(rtwdev);
6221 	if (ret)
6222 		return ret;
6223 
6224 	ret = mac->parse_phycap_map(rtwdev);
6225 	if (ret)
6226 		return ret;
6227 
6228 	ret = rtw89_mac_setup_phycap(rtwdev);
6229 	if (ret)
6230 		return ret;
6231 
6232 	rtw89_core_setup_phycap(rtwdev);
6233 
6234 	rtw89_hci_mac_pre_deinit(rtwdev);
6235 
6236 	return 0;
6237 }
6238 
6239 static int rtw89_chip_board_info_setup(struct rtw89_dev *rtwdev)
6240 {
6241 	rtw89_chip_fem_setup(rtwdev);
6242 
6243 	return 0;
6244 }
6245 
6246 static bool rtw89_chip_has_rfkill(struct rtw89_dev *rtwdev)
6247 {
6248 	return !!rtwdev->chip->rfkill_init;
6249 }
6250 
6251 static void rtw89_core_rfkill_init(struct rtw89_dev *rtwdev)
6252 {
6253 	const struct rtw89_rfkill_regs *regs = rtwdev->chip->rfkill_init;
6254 
6255 	rtw89_write16_mask(rtwdev, regs->pinmux.addr,
6256 			   regs->pinmux.mask, regs->pinmux.data);
6257 	rtw89_write16_mask(rtwdev, regs->mode.addr,
6258 			   regs->mode.mask, regs->mode.data);
6259 }
6260 
6261 static bool rtw89_core_rfkill_get(struct rtw89_dev *rtwdev)
6262 {
6263 	const struct rtw89_reg_def *reg = &rtwdev->chip->rfkill_get;
6264 
6265 	return !rtw89_read8_mask(rtwdev, reg->addr, reg->mask);
6266 }
6267 
6268 static void rtw89_rfkill_polling_init(struct rtw89_dev *rtwdev)
6269 {
6270 	if (!rtw89_chip_has_rfkill(rtwdev))
6271 		return;
6272 
6273 	rtw89_core_rfkill_init(rtwdev);
6274 	rtw89_core_rfkill_poll(rtwdev, true);
6275 	wiphy_rfkill_start_polling(rtwdev->hw->wiphy);
6276 }
6277 
6278 static void rtw89_rfkill_polling_deinit(struct rtw89_dev *rtwdev)
6279 {
6280 	if (!rtw89_chip_has_rfkill(rtwdev))
6281 		return;
6282 
6283 	wiphy_rfkill_stop_polling(rtwdev->hw->wiphy);
6284 }
6285 
6286 void rtw89_core_rfkill_poll(struct rtw89_dev *rtwdev, bool force)
6287 {
6288 	bool prev, blocked;
6289 
6290 	if (!rtw89_chip_has_rfkill(rtwdev))
6291 		return;
6292 
6293 	prev = test_bit(RTW89_FLAG_HW_RFKILL_STATE, rtwdev->flags);
6294 	blocked = rtw89_core_rfkill_get(rtwdev);
6295 
6296 	if (!force && prev == blocked)
6297 		return;
6298 
6299 	rtw89_info(rtwdev, "rfkill hardware state changed to %s\n",
6300 		   blocked ? "disable" : "enable");
6301 
6302 	if (blocked)
6303 		set_bit(RTW89_FLAG_HW_RFKILL_STATE, rtwdev->flags);
6304 	else
6305 		clear_bit(RTW89_FLAG_HW_RFKILL_STATE, rtwdev->flags);
6306 
6307 	wiphy_rfkill_set_hw_state(rtwdev->hw->wiphy, blocked);
6308 }
6309 
6310 int rtw89_chip_info_setup(struct rtw89_dev *rtwdev)
6311 {
6312 	int ret;
6313 
6314 	rtw89_read_chip_ver(rtwdev);
6315 
6316 	ret = rtw89_mac_pwr_on(rtwdev);
6317 	if (ret) {
6318 		rtw89_err(rtwdev, "failed to power on\n");
6319 		return ret;
6320 	}
6321 
6322 	ret = rtw89_wait_firmware_completion(rtwdev);
6323 	if (ret) {
6324 		rtw89_err(rtwdev, "failed to wait firmware completion\n");
6325 		goto out;
6326 	}
6327 
6328 	ret = rtw89_fw_recognize(rtwdev);
6329 	if (ret) {
6330 		rtw89_err(rtwdev, "failed to recognize firmware\n");
6331 		goto out;
6332 	}
6333 
6334 	ret = rtw89_chip_efuse_info_setup(rtwdev);
6335 	if (ret)
6336 		goto out;
6337 
6338 	ret = rtw89_fw_recognize_elements(rtwdev);
6339 	if (ret) {
6340 		rtw89_err(rtwdev, "failed to recognize firmware elements\n");
6341 		goto out;
6342 	}
6343 
6344 	ret = rtw89_chip_board_info_setup(rtwdev);
6345 	if (ret)
6346 		goto out;
6347 
6348 	rtw89_core_setup_rfe_parms(rtwdev);
6349 	rtwdev->ps_mode = rtw89_update_ps_mode(rtwdev);
6350 
6351 out:
6352 	rtw89_mac_pwr_off(rtwdev);
6353 
6354 	return ret;
6355 }
6356 EXPORT_SYMBOL(rtw89_chip_info_setup);
6357 
6358 void rtw89_chip_cfg_txpwr_ul_tb_offset(struct rtw89_dev *rtwdev,
6359 				       struct rtw89_vif_link *rtwvif_link)
6360 {
6361 	struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
6362 	const struct rtw89_chip_info *chip = rtwdev->chip;
6363 	struct ieee80211_bss_conf *bss_conf;
6364 
6365 	rcu_read_lock();
6366 
6367 	bss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, false);
6368 	if (!bss_conf->he_support || !vif->cfg.assoc) {
6369 		rcu_read_unlock();
6370 		return;
6371 	}
6372 
6373 	rcu_read_unlock();
6374 
6375 	if (chip->ops->set_txpwr_ul_tb_offset)
6376 		chip->ops->set_txpwr_ul_tb_offset(rtwdev, 0, rtwvif_link->mac_idx);
6377 }
6378 
6379 static int rtw89_core_register_hw(struct rtw89_dev *rtwdev)
6380 {
6381 	const struct rtw89_chip_info *chip = rtwdev->chip;
6382 	u8 n = rtwdev->support_mlo ? chip->support_link_num : 1;
6383 	struct ieee80211_hw *hw = rtwdev->hw;
6384 	struct rtw89_efuse *efuse = &rtwdev->efuse;
6385 	struct rtw89_hal *hal = &rtwdev->hal;
6386 	int ret;
6387 	int tx_headroom = IEEE80211_HT_CTL_LEN;
6388 
6389 	if (rtwdev->hci.type == RTW89_HCI_TYPE_USB)
6390 		tx_headroom += chip->txwd_body_size + chip->txwd_info_size;
6391 
6392 	hw->vif_data_size = struct_size_t(struct rtw89_vif, links_inst, n);
6393 	hw->sta_data_size = struct_size_t(struct rtw89_sta, links_inst, n);
6394 	hw->txq_data_size = sizeof(struct rtw89_txq);
6395 	hw->chanctx_data_size = sizeof(struct rtw89_chanctx_cfg);
6396 
6397 	SET_IEEE80211_PERM_ADDR(hw, efuse->addr);
6398 
6399 	hw->extra_tx_headroom = tx_headroom;
6400 	hw->queues = IEEE80211_NUM_ACS;
6401 	hw->max_rx_aggregation_subframes = RTW89_MAX_RX_AGG_NUM;
6402 	hw->max_tx_aggregation_subframes = RTW89_MAX_TX_AGG_NUM;
6403 	hw->uapsd_max_sp_len = IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL;
6404 
6405 	hw->radiotap_mcs_details |= IEEE80211_RADIOTAP_MCS_HAVE_FEC |
6406 				    IEEE80211_RADIOTAP_MCS_HAVE_STBC;
6407 	hw->radiotap_vht_details |= IEEE80211_RADIOTAP_VHT_KNOWN_STBC;
6408 
6409 	ieee80211_hw_set(hw, SIGNAL_DBM);
6410 	ieee80211_hw_set(hw, HAS_RATE_CONTROL);
6411 	ieee80211_hw_set(hw, MFP_CAPABLE);
6412 	ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
6413 	ieee80211_hw_set(hw, AMPDU_AGGREGATION);
6414 	ieee80211_hw_set(hw, RX_INCLUDES_FCS);
6415 	ieee80211_hw_set(hw, TX_AMSDU);
6416 	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
6417 	ieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);
6418 	ieee80211_hw_set(hw, SUPPORTS_PS);
6419 	ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
6420 	ieee80211_hw_set(hw, SINGLE_SCAN_ON_ALL_BANDS);
6421 	ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
6422 	ieee80211_hw_set(hw, WANT_MONITOR_VIF);
6423 	ieee80211_hw_set(hw, CHANCTX_STA_CSA);
6424 
6425 	if (chip->support_bandwidths & BIT(NL80211_CHAN_WIDTH_160))
6426 		ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);
6427 
6428 	if (RTW89_CHK_FW_FEATURE(BEACON_FILTER, &rtwdev->fw))
6429 		ieee80211_hw_set(hw, CONNECTION_MONITOR);
6430 
6431 	if (RTW89_CHK_FW_FEATURE(NOTIFY_AP_INFO, &rtwdev->fw))
6432 		ieee80211_hw_set(hw, AP_LINK_PS);
6433 
6434 	hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
6435 				     BIT(NL80211_IFTYPE_AP) |
6436 				     BIT(NL80211_IFTYPE_P2P_CLIENT) |
6437 				     BIT(NL80211_IFTYPE_P2P_GO);
6438 
6439 	if (hal->ant_diversity) {
6440 		hw->wiphy->available_antennas_tx = 0x3;
6441 		hw->wiphy->available_antennas_rx = 0x3;
6442 	} else {
6443 		hw->wiphy->available_antennas_tx = BIT(rtwdev->chip->rf_path_num) - 1;
6444 		hw->wiphy->available_antennas_rx = BIT(rtwdev->chip->rf_path_num) - 1;
6445 	}
6446 
6447 	hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS |
6448 			    WIPHY_FLAG_TDLS_EXTERNAL_SETUP |
6449 			    WIPHY_FLAG_AP_UAPSD |
6450 			    WIPHY_FLAG_HAS_CHANNEL_SWITCH |
6451 			    WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK;
6452 
6453 	if (!chip->support_rnr)
6454 		hw->wiphy->flags |= WIPHY_FLAG_SPLIT_SCAN_6GHZ;
6455 
6456 	if (chip->chip_gen == RTW89_CHIP_BE)
6457 		hw->wiphy->flags |= WIPHY_FLAG_DISABLE_WEXT;
6458 
6459 	if (rtwdev->support_mlo) {
6460 		hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_MLO;
6461 		hw->wiphy->iftype_ext_capab = rtw89_iftypes_ext_capa;
6462 		hw->wiphy->num_iftype_ext_capab = ARRAY_SIZE(rtw89_iftypes_ext_capa);
6463 	}
6464 
6465 	hw->wiphy->features |= NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
6466 
6467 	hw->wiphy->max_scan_ssids = RTW89_SCANOFLD_MAX_SSID;
6468 	hw->wiphy->max_scan_ie_len = RTW89_SCANOFLD_MAX_IE_LEN;
6469 
6470 #ifdef CONFIG_PM
6471 	hw->wiphy->wowlan = rtwdev->chip->wowlan_stub;
6472 	hw->wiphy->max_sched_scan_ssids = RTW89_SCANOFLD_MAX_SSID;
6473 #endif
6474 
6475 	hw->wiphy->tid_config_support.vif |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
6476 	hw->wiphy->tid_config_support.peer |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
6477 	hw->wiphy->tid_config_support.vif |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
6478 	hw->wiphy->tid_config_support.peer |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
6479 	hw->wiphy->max_remain_on_channel_duration = 1000;
6480 
6481 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CAN_REPLACE_PTK0);
6482 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_SCAN_RANDOM_SN);
6483 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_SET_SCAN_DWELL);
6484 
6485 	ret = rtw89_core_set_supported_band(rtwdev);
6486 	if (ret) {
6487 		rtw89_err(rtwdev, "failed to set supported band\n");
6488 		return ret;
6489 	}
6490 
6491 	ret = rtw89_regd_setup(rtwdev);
6492 	if (ret) {
6493 		rtw89_err(rtwdev, "failed to set up regd\n");
6494 		return ret;
6495 	}
6496 
6497 	hw->wiphy->sar_capa = &rtw89_sar_capa;
6498 
6499 	ret = ieee80211_register_hw(hw);
6500 	if (ret) {
6501 		rtw89_err(rtwdev, "failed to register hw\n");
6502 		return ret;
6503 	}
6504 
6505 	ret = rtw89_regd_init_hint(rtwdev);
6506 	if (ret) {
6507 		rtw89_err(rtwdev, "failed to init regd\n");
6508 		goto err_unregister_hw;
6509 	}
6510 
6511 	rtw89_rfkill_polling_init(rtwdev);
6512 
6513 	return 0;
6514 
6515 err_unregister_hw:
6516 	ieee80211_unregister_hw(hw);
6517 
6518 	return ret;
6519 }
6520 
6521 static void rtw89_core_unregister_hw(struct rtw89_dev *rtwdev)
6522 {
6523 	struct ieee80211_hw *hw = rtwdev->hw;
6524 
6525 	rtw89_rfkill_polling_deinit(rtwdev);
6526 	ieee80211_unregister_hw(hw);
6527 }
6528 
6529 int rtw89_core_register(struct rtw89_dev *rtwdev)
6530 {
6531 	int ret;
6532 
6533 	ret = rtw89_core_register_hw(rtwdev);
6534 	if (ret) {
6535 		rtw89_err(rtwdev, "failed to register core hw\n");
6536 		return ret;
6537 	}
6538 
6539 	rtw89_phy_dm_init_data(rtwdev);
6540 	rtw89_debugfs_init(rtwdev);
6541 
6542 	return 0;
6543 }
6544 EXPORT_SYMBOL(rtw89_core_register);
6545 
6546 void rtw89_core_unregister(struct rtw89_dev *rtwdev)
6547 {
6548 	rtw89_core_unregister_hw(rtwdev);
6549 
6550 	rtw89_debugfs_deinit(rtwdev);
6551 }
6552 EXPORT_SYMBOL(rtw89_core_unregister);
6553 
6554 struct rtw89_dev *rtw89_alloc_ieee80211_hw(struct device *device,
6555 					   u32 bus_data_size,
6556 					   const struct rtw89_chip_info *chip,
6557 					   const struct rtw89_chip_variant *variant)
6558 {
6559 	struct rtw89_fw_info early_fw = {};
6560 	const struct firmware *firmware;
6561 	struct ieee80211_hw *hw;
6562 	struct rtw89_dev *rtwdev;
6563 	struct ieee80211_ops *ops;
6564 	u32 driver_data_size;
6565 	int fw_format = -1;
6566 	bool support_mlo;
6567 	bool no_chanctx;
6568 
6569 	firmware = rtw89_early_fw_feature_recognize(device, chip, &early_fw, &fw_format);
6570 
6571 	ops = kmemdup(&rtw89_ops, sizeof(rtw89_ops), GFP_KERNEL);
6572 	if (!ops)
6573 		goto err;
6574 
6575 	no_chanctx = chip->support_chanctx_num == 0 ||
6576 		     !RTW89_CHK_FW_FEATURE(SCAN_OFFLOAD, &early_fw) ||
6577 		     !RTW89_CHK_FW_FEATURE(BEACON_FILTER, &early_fw);
6578 
6579 	if (no_chanctx) {
6580 		ops->add_chanctx = ieee80211_emulate_add_chanctx;
6581 		ops->remove_chanctx = ieee80211_emulate_remove_chanctx;
6582 		ops->change_chanctx = ieee80211_emulate_change_chanctx;
6583 		ops->switch_vif_chanctx = ieee80211_emulate_switch_vif_chanctx;
6584 		ops->assign_vif_chanctx = NULL;
6585 		ops->unassign_vif_chanctx = NULL;
6586 		ops->remain_on_channel = NULL;
6587 		ops->cancel_remain_on_channel = NULL;
6588 	}
6589 
6590 	if (!chip->support_noise)
6591 		ops->get_survey = NULL;
6592 
6593 	driver_data_size = sizeof(struct rtw89_dev) + bus_data_size;
6594 	hw = ieee80211_alloc_hw(driver_data_size, ops);
6595 	if (!hw)
6596 		goto err;
6597 
6598 	/* Currently, our AP_LINK_PS handling only works for non-MLD softap
6599 	 * or MLD-single-link softap. If RTW89_MLD_NON_STA_LINK_NUM enlarges,
6600 	 * please tweak entire AP_LINKS_PS handling before supporting MLO.
6601 	 */
6602 	support_mlo = !no_chanctx && chip->support_link_num &&
6603 		      RTW89_CHK_FW_FEATURE(NOTIFY_AP_INFO, &early_fw) &&
6604 		      RTW89_MLD_NON_STA_LINK_NUM == 1;
6605 
6606 	hw->wiphy->iface_combinations = rtw89_iface_combs;
6607 
6608 	if (no_chanctx || chip->support_chanctx_num == 1)
6609 		hw->wiphy->n_iface_combinations = 1;
6610 	else
6611 		hw->wiphy->n_iface_combinations = ARRAY_SIZE(rtw89_iface_combs);
6612 
6613 	rtwdev = hw->priv;
6614 	rtwdev->hw = hw;
6615 	rtwdev->dev = device;
6616 	rtwdev->ops = ops;
6617 	rtwdev->chip = chip;
6618 	rtwdev->variant = variant;
6619 	rtwdev->fw.req.firmware = firmware;
6620 	rtwdev->fw.fw_format = fw_format;
6621 	rtwdev->support_mlo = support_mlo;
6622 
6623 	rtw89_debug(rtwdev, RTW89_DBG_CHAN, "probe driver %s chanctx\n",
6624 		    no_chanctx ? "without" : "with");
6625 	rtw89_debug(rtwdev, RTW89_DBG_CHAN, "probe driver %s MLO cap\n",
6626 		    support_mlo ? "with" : "without");
6627 
6628 	return rtwdev;
6629 
6630 err:
6631 	kfree(ops);
6632 	release_firmware(firmware);
6633 	return NULL;
6634 }
6635 EXPORT_SYMBOL(rtw89_alloc_ieee80211_hw);
6636 
6637 void rtw89_free_ieee80211_hw(struct rtw89_dev *rtwdev)
6638 {
6639 	kfree(rtwdev->ops);
6640 	kfree(rtwdev->rfe_data);
6641 	release_firmware(rtwdev->fw.req.firmware);
6642 	ieee80211_free_hw(rtwdev->hw);
6643 }
6644 EXPORT_SYMBOL(rtw89_free_ieee80211_hw);
6645 
6646 MODULE_AUTHOR("Realtek Corporation");
6647 MODULE_DESCRIPTION("Realtek 802.11ax wireless core module");
6648 MODULE_LICENSE("Dual BSD/GPL");
6649