diff --git a/sys/contrib/dev/rtw89/fw.c b/sys/contrib/dev/rtw89/fw.c
index 17e4ce7cd64a..c1dade182d88 100644
--- a/sys/contrib/dev/rtw89/fw.c
+++ b/sys/contrib/dev/rtw89/fw.c
@@ -1,4662 +1,4671 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /* Copyright(c) 2019-2020  Realtek Corporation
  */
 
 #include "cam.h"
 #include "chan.h"
 #include "coex.h"
 #include "debug.h"
 #include "fw.h"
 #include "mac.h"
 #include "phy.h"
 #include "reg.h"
 #include "util.h"
 
 static void rtw89_fw_c2h_cmd_handle(struct rtw89_dev *rtwdev,
 				    struct sk_buff *skb);
 static int rtw89_h2c_tx_and_wait(struct rtw89_dev *rtwdev, struct sk_buff *skb,
 				 struct rtw89_wait_info *wait, unsigned int cond);
 
 static struct sk_buff *rtw89_fw_h2c_alloc_skb(struct rtw89_dev *rtwdev, u32 len,
 					      bool header)
 {
 	struct sk_buff *skb;
 	u32 header_len = 0;
 	u32 h2c_desc_size = rtwdev->chip->h2c_desc_size;
 
 	if (header)
 		header_len = H2C_HEADER_LEN;
 
 	skb = dev_alloc_skb(len + header_len + h2c_desc_size);
 	if (!skb)
 		return NULL;
 	skb_reserve(skb, header_len + h2c_desc_size);
 	memset(skb->data, 0, len);
 
 	return skb;
 }
 
 struct sk_buff *rtw89_fw_h2c_alloc_skb_with_hdr(struct rtw89_dev *rtwdev, u32 len)
 {
 	return rtw89_fw_h2c_alloc_skb(rtwdev, len, true);
 }
 
 struct sk_buff *rtw89_fw_h2c_alloc_skb_no_hdr(struct rtw89_dev *rtwdev, u32 len)
 {
 	return rtw89_fw_h2c_alloc_skb(rtwdev, len, false);
 }
 
 static u8 _fw_get_rdy(struct rtw89_dev *rtwdev)
 {
 	u8 val = rtw89_read8(rtwdev, R_AX_WCPU_FW_CTRL);
 
 	return FIELD_GET(B_AX_WCPU_FWDL_STS_MASK, val);
 }
 
 #define FWDL_WAIT_CNT 400000
 int rtw89_fw_check_rdy(struct rtw89_dev *rtwdev)
 {
 	u8 val;
 	int ret;
 
 	ret = read_poll_timeout_atomic(_fw_get_rdy, val,
 				       val == RTW89_FWDL_WCPU_FW_INIT_RDY,
 				       1, FWDL_WAIT_CNT, false, rtwdev);
 	if (ret) {
 		switch (val) {
 		case RTW89_FWDL_CHECKSUM_FAIL:
 			rtw89_err(rtwdev, "fw checksum fail\n");
 			return -EINVAL;
 
 		case RTW89_FWDL_SECURITY_FAIL:
 			rtw89_err(rtwdev, "fw security fail\n");
 			return -EINVAL;
 
 		case RTW89_FWDL_CV_NOT_MATCH:
 			rtw89_err(rtwdev, "fw cv not match\n");
 			return -EINVAL;
 
 		default:
 			return -EBUSY;
 		}
 	}
 
 	set_bit(RTW89_FLAG_FW_RDY, rtwdev->flags);
 
 	return 0;
 }
 
 static int rtw89_fw_hdr_parser_v0(struct rtw89_dev *rtwdev, const u8 *fw, u32 len,
 				  struct rtw89_fw_bin_info *info)
 {
 	const struct rtw89_fw_hdr *fw_hdr = (const struct rtw89_fw_hdr *)fw;
 	struct rtw89_fw_hdr_section_info *section_info;
 	const struct rtw89_fw_dynhdr_hdr *fwdynhdr;
 	const struct rtw89_fw_hdr_section *section;
 	const u8 *fw_end = fw + len;
 	const u8 *bin;
 	u32 base_hdr_len;
 	u32 mssc_len = 0;
 	u32 i;
 
 	if (!info)
 		return -EINVAL;
 
 	info->section_num = le32_get_bits(fw_hdr->w6, FW_HDR_W6_SEC_NUM);
 	base_hdr_len = struct_size(fw_hdr, sections, info->section_num);
 	info->dynamic_hdr_en = le32_get_bits(fw_hdr->w7, FW_HDR_W7_DYN_HDR);
 
 	if (info->dynamic_hdr_en) {
 		info->hdr_len = le32_get_bits(fw_hdr->w3, FW_HDR_W3_LEN);
 		info->dynamic_hdr_len = info->hdr_len - base_hdr_len;
 		fwdynhdr = (const struct rtw89_fw_dynhdr_hdr *)(fw + base_hdr_len);
 		if (le32_to_cpu(fwdynhdr->hdr_len) != info->dynamic_hdr_len) {
 			rtw89_err(rtwdev, "[ERR]invalid fw dynamic header len\n");
 			return -EINVAL;
 		}
 	} else {
 		info->hdr_len = base_hdr_len;
 		info->dynamic_hdr_len = 0;
 	}
 
 	bin = fw + info->hdr_len;
 
 	/* jump to section header */
 	section_info = info->section_info;
 	for (i = 0; i < info->section_num; i++) {
 		section = &fw_hdr->sections[i];
 		section_info->type =
 			le32_get_bits(section->w1, FWSECTION_HDR_W1_SECTIONTYPE);
 		if (section_info->type == FWDL_SECURITY_SECTION_TYPE) {
 			section_info->mssc =
 				le32_get_bits(section->w2, FWSECTION_HDR_W2_MSSC);
 			mssc_len += section_info->mssc * FWDL_SECURITY_SIGLEN;
 		} else {
 			section_info->mssc = 0;
 		}
 
 		section_info->len = le32_get_bits(section->w1, FWSECTION_HDR_W1_SEC_SIZE);
 		if (le32_get_bits(section->w1, FWSECTION_HDR_W1_CHECKSUM))
 			section_info->len += FWDL_SECTION_CHKSUM_LEN;
 		section_info->redl = le32_get_bits(section->w1, FWSECTION_HDR_W1_REDL);
 		section_info->dladdr =
 			le32_get_bits(section->w0, FWSECTION_HDR_W0_DL_ADDR) & 0x1fffffff;
 		section_info->addr = bin;
 		bin += section_info->len;
 		section_info++;
 	}
 
 	if (fw_end != bin + mssc_len) {
 		rtw89_err(rtwdev, "[ERR]fw bin size\n");
 		return -EINVAL;
 	}
 
 	return 0;
 }
 
 static int rtw89_fw_hdr_parser_v1(struct rtw89_dev *rtwdev, const u8 *fw, u32 len,
 				  struct rtw89_fw_bin_info *info)
 {
 	const struct rtw89_fw_hdr_v1 *fw_hdr = (const struct rtw89_fw_hdr_v1 *)fw;
 	struct rtw89_fw_hdr_section_info *section_info;
 	const struct rtw89_fw_dynhdr_hdr *fwdynhdr;
 	const struct rtw89_fw_hdr_section_v1 *section;
 	const u8 *fw_end = fw + len;
 	const u8 *bin;
 	u32 base_hdr_len;
 	u32 mssc_len = 0;
 	u32 i;
 
 	info->section_num = le32_get_bits(fw_hdr->w6, FW_HDR_V1_W6_SEC_NUM);
 	base_hdr_len = struct_size(fw_hdr, sections, info->section_num);
 	info->dynamic_hdr_en = le32_get_bits(fw_hdr->w7, FW_HDR_V1_W7_DYN_HDR);
 
 	if (info->dynamic_hdr_en) {
 		info->hdr_len = le32_get_bits(fw_hdr->w5, FW_HDR_V1_W5_HDR_SIZE);
 		info->dynamic_hdr_len = info->hdr_len - base_hdr_len;
 		fwdynhdr = (const struct rtw89_fw_dynhdr_hdr *)(fw + base_hdr_len);
 		if (le32_to_cpu(fwdynhdr->hdr_len) != info->dynamic_hdr_len) {
 			rtw89_err(rtwdev, "[ERR]invalid fw dynamic header len\n");
 			return -EINVAL;
 		}
 	} else {
 		info->hdr_len = base_hdr_len;
 		info->dynamic_hdr_len = 0;
 	}
 
 	bin = fw + info->hdr_len;
 
 	/* jump to section header */
 	section_info = info->section_info;
 	for (i = 0; i < info->section_num; i++) {
 		section = &fw_hdr->sections[i];
 		section_info->type =
 			le32_get_bits(section->w1, FWSECTION_HDR_V1_W1_SECTIONTYPE);
 		if (section_info->type == FWDL_SECURITY_SECTION_TYPE) {
 			section_info->mssc =
 				le32_get_bits(section->w2, FWSECTION_HDR_V1_W2_MSSC);
 			mssc_len += section_info->mssc * FWDL_SECURITY_SIGLEN;
 		} else {
 			section_info->mssc = 0;
 		}
 
 		section_info->len =
 			le32_get_bits(section->w1, FWSECTION_HDR_V1_W1_SEC_SIZE);
 		if (le32_get_bits(section->w1, FWSECTION_HDR_V1_W1_CHECKSUM))
 			section_info->len += FWDL_SECTION_CHKSUM_LEN;
 		section_info->redl = le32_get_bits(section->w1, FWSECTION_HDR_V1_W1_REDL);
 		section_info->dladdr =
 			le32_get_bits(section->w0, FWSECTION_HDR_V1_W0_DL_ADDR);
 		section_info->addr = bin;
 		bin += section_info->len;
 		section_info++;
 	}
 
 	if (fw_end != bin + mssc_len) {
 		rtw89_err(rtwdev, "[ERR]fw bin size\n");
 		return -EINVAL;
 	}
 
 	return 0;
 }
 
 static int rtw89_fw_hdr_parser(struct rtw89_dev *rtwdev,
 			       const struct rtw89_fw_suit *fw_suit,
 			       struct rtw89_fw_bin_info *info)
 {
 	const u8 *fw = fw_suit->data;
 	u32 len = fw_suit->size;
 
 	if (!fw || !len) {
 		rtw89_err(rtwdev, "fw type %d isn't recognized\n", fw_suit->type);
 		return -ENOENT;
 	}
 
 	switch (fw_suit->hdr_ver) {
 	case 0:
 		return rtw89_fw_hdr_parser_v0(rtwdev, fw, len, info);
 	case 1:
 		return rtw89_fw_hdr_parser_v1(rtwdev, fw, len, info);
 	default:
 		return -ENOENT;
 	}
 }
 
 static
 int rtw89_mfw_recognize(struct rtw89_dev *rtwdev, enum rtw89_fw_type type,
 			struct rtw89_fw_suit *fw_suit, bool nowarn)
 {
 	struct rtw89_fw_info *fw_info = &rtwdev->fw;
 	const struct firmware *firmware = fw_info->req.firmware;
 	const u8 *mfw = firmware->data;
 	u32 mfw_len = firmware->size;
 	const struct rtw89_mfw_hdr *mfw_hdr = (const struct rtw89_mfw_hdr *)mfw;
 	const struct rtw89_mfw_info *mfw_info;
 	int i;
 
 	if (mfw_hdr->sig != RTW89_MFW_SIG) {
 		rtw89_debug(rtwdev, RTW89_DBG_FW, "use legacy firmware\n");
 		/* legacy firmware support normal type only */
 		if (type != RTW89_FW_NORMAL)
 			return -EINVAL;
 		fw_suit->data = mfw;
 		fw_suit->size = mfw_len;
 		return 0;
 	}
 
 	for (i = 0; i < mfw_hdr->fw_nr; i++) {
 		mfw_info = &mfw_hdr->info[i];
 		if (mfw_info->type == type) {
 			if (mfw_info->cv == rtwdev->hal.cv && !mfw_info->mp)
 				goto found;
 			if (type == RTW89_FW_LOGFMT)
 				goto found;
 		}
 	}
 
 	if (!nowarn)
 		rtw89_err(rtwdev, "no suitable firmware found\n");
 	return -ENOENT;
 
 found:
 	fw_suit->data = mfw + le32_to_cpu(mfw_info->shift);
 	fw_suit->size = le32_to_cpu(mfw_info->size);
 	return 0;
 }
 
 static u32 rtw89_mfw_get_size(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_fw_info *fw_info = &rtwdev->fw;
 	const struct firmware *firmware = fw_info->req.firmware;
 	const struct rtw89_mfw_hdr *mfw_hdr =
 		(const struct rtw89_mfw_hdr *)firmware->data;
 	const struct rtw89_mfw_info *mfw_info;
 	u32 size;
 
 	if (mfw_hdr->sig != RTW89_MFW_SIG) {
 		rtw89_warn(rtwdev, "not mfw format\n");
 		return 0;
 	}
 
 	mfw_info = &mfw_hdr->info[mfw_hdr->fw_nr - 1];
 	size = le32_to_cpu(mfw_info->shift) + le32_to_cpu(mfw_info->size);
 
 	return size;
 }
 
 static void rtw89_fw_update_ver_v0(struct rtw89_dev *rtwdev,
 				   struct rtw89_fw_suit *fw_suit,
 				   const struct rtw89_fw_hdr *hdr)
 {
 	fw_suit->major_ver = le32_get_bits(hdr->w1, FW_HDR_W1_MAJOR_VERSION);
 	fw_suit->minor_ver = le32_get_bits(hdr->w1, FW_HDR_W1_MINOR_VERSION);
 	fw_suit->sub_ver = le32_get_bits(hdr->w1, FW_HDR_W1_SUBVERSION);
 	fw_suit->sub_idex = le32_get_bits(hdr->w1, FW_HDR_W1_SUBINDEX);
 	fw_suit->commitid = le32_get_bits(hdr->w2, FW_HDR_W2_COMMITID);
 	fw_suit->build_year = le32_get_bits(hdr->w5, FW_HDR_W5_YEAR);
 	fw_suit->build_mon = le32_get_bits(hdr->w4, FW_HDR_W4_MONTH);
 	fw_suit->build_date = le32_get_bits(hdr->w4, FW_HDR_W4_DATE);
 	fw_suit->build_hour = le32_get_bits(hdr->w4, FW_HDR_W4_HOUR);
 	fw_suit->build_min = le32_get_bits(hdr->w4, FW_HDR_W4_MIN);
 	fw_suit->cmd_ver = le32_get_bits(hdr->w7, FW_HDR_W7_CMD_VERSERION);
 }
 
 static void rtw89_fw_update_ver_v1(struct rtw89_dev *rtwdev,
 				   struct rtw89_fw_suit *fw_suit,
 				   const struct rtw89_fw_hdr_v1 *hdr)
 {
 	fw_suit->major_ver = le32_get_bits(hdr->w1, FW_HDR_V1_W1_MAJOR_VERSION);
 	fw_suit->minor_ver = le32_get_bits(hdr->w1, FW_HDR_V1_W1_MINOR_VERSION);
 	fw_suit->sub_ver = le32_get_bits(hdr->w1, FW_HDR_V1_W1_SUBVERSION);
 	fw_suit->sub_idex = le32_get_bits(hdr->w1, FW_HDR_V1_W1_SUBINDEX);
 	fw_suit->commitid = le32_get_bits(hdr->w2, FW_HDR_V1_W2_COMMITID);
 	fw_suit->build_year = le32_get_bits(hdr->w5, FW_HDR_V1_W5_YEAR);
 	fw_suit->build_mon = le32_get_bits(hdr->w4, FW_HDR_V1_W4_MONTH);
 	fw_suit->build_date = le32_get_bits(hdr->w4, FW_HDR_V1_W4_DATE);
 	fw_suit->build_hour = le32_get_bits(hdr->w4, FW_HDR_V1_W4_HOUR);
 	fw_suit->build_min = le32_get_bits(hdr->w4, FW_HDR_V1_W4_MIN);
 	fw_suit->cmd_ver = le32_get_bits(hdr->w7, FW_HDR_V1_W3_CMD_VERSERION);
 }
 
 static int rtw89_fw_update_ver(struct rtw89_dev *rtwdev,
 			       enum rtw89_fw_type type,
 			       struct rtw89_fw_suit *fw_suit)
 {
 	const struct rtw89_fw_hdr *v0 = (const struct rtw89_fw_hdr *)fw_suit->data;
 	const struct rtw89_fw_hdr_v1 *v1 = (const struct rtw89_fw_hdr_v1 *)fw_suit->data;
 
 	if (type == RTW89_FW_LOGFMT)
 		return 0;
 
 	fw_suit->type = type;
 	fw_suit->hdr_ver = le32_get_bits(v0->w3, FW_HDR_W3_HDR_VER);
 
 	switch (fw_suit->hdr_ver) {
 	case 0:
 		rtw89_fw_update_ver_v0(rtwdev, fw_suit, v0);
 		break;
 	case 1:
 		rtw89_fw_update_ver_v1(rtwdev, fw_suit, v1);
 		break;
 	default:
 		rtw89_err(rtwdev, "Unknown firmware header version %u\n",
 			  fw_suit->hdr_ver);
 		return -ENOENT;
 	}
 
 	rtw89_info(rtwdev,
 		   "Firmware version %u.%u.%u.%u (%08x), cmd version %u, type %u\n",
 		   fw_suit->major_ver, fw_suit->minor_ver, fw_suit->sub_ver,
 		   fw_suit->sub_idex, fw_suit->commitid, fw_suit->cmd_ver, type);
 
 	return 0;
 }
 
 static
 int __rtw89_fw_recognize(struct rtw89_dev *rtwdev, enum rtw89_fw_type type,
 			 bool nowarn)
 {
 	struct rtw89_fw_suit *fw_suit = rtw89_fw_suit_get(rtwdev, type);
 	int ret;
 
 	ret = rtw89_mfw_recognize(rtwdev, type, fw_suit, nowarn);
 	if (ret)
 		return ret;
 
 	return rtw89_fw_update_ver(rtwdev, type, fw_suit);
 }
 
 static
 int __rtw89_fw_recognize_from_elm(struct rtw89_dev *rtwdev,
 				  const struct rtw89_fw_element_hdr *elm,
 #if defined(__linux__)
 				  const void *data)
 #elif defined(__FreeBSD__)
 				  const int data)
 #endif
 {
 #if defined(__linux__)
 	enum rtw89_fw_type type = (enum rtw89_fw_type)data;
 #elif defined(__FreeBSD__)
 	const enum rtw89_fw_type type = (const enum rtw89_fw_type)data;
 #endif
 	struct rtw89_fw_suit *fw_suit;
 
 	fw_suit = rtw89_fw_suit_get(rtwdev, type);
 	fw_suit->data = elm->u.common.contents;
 	fw_suit->size = le32_to_cpu(elm->size);
 
 	return rtw89_fw_update_ver(rtwdev, type, fw_suit);
 }
 
 #define __DEF_FW_FEAT_COND(__cond, __op) \
 static bool __fw_feat_cond_ ## __cond(u32 suit_ver_code, u32 comp_ver_code) \
 { \
 	return suit_ver_code __op comp_ver_code; \
 }
 
 __DEF_FW_FEAT_COND(ge, >=); /* greater or equal */
 __DEF_FW_FEAT_COND(le, <=); /* less or equal */
 __DEF_FW_FEAT_COND(lt, <); /* less than */
 
 struct __fw_feat_cfg {
 	enum rtw89_core_chip_id chip_id;
 	enum rtw89_fw_feature feature;
 	u32 ver_code;
 	bool (*cond)(u32 suit_ver_code, u32 comp_ver_code);
 };
 
 #define __CFG_FW_FEAT(_chip, _cond, _maj, _min, _sub, _idx, _feat) \
 	{ \
 		.chip_id = _chip, \
 		.feature = RTW89_FW_FEATURE_ ## _feat, \
 		.ver_code = RTW89_FW_VER_CODE(_maj, _min, _sub, _idx), \
 		.cond = __fw_feat_cond_ ## _cond, \
 	}
 
 static const struct __fw_feat_cfg fw_feat_tbl[] = {
 	__CFG_FW_FEAT(RTL8851B, ge, 0, 29, 37, 1, TX_WAKE),
 	__CFG_FW_FEAT(RTL8851B, ge, 0, 29, 37, 1, SCAN_OFFLOAD),
 	__CFG_FW_FEAT(RTL8851B, ge, 0, 29, 41, 0, CRASH_TRIGGER),
 	__CFG_FW_FEAT(RTL8852A, le, 0, 13, 29, 0, OLD_HT_RA_FORMAT),
 	__CFG_FW_FEAT(RTL8852A, ge, 0, 13, 35, 0, SCAN_OFFLOAD),
 	__CFG_FW_FEAT(RTL8852A, ge, 0, 13, 35, 0, TX_WAKE),
 	__CFG_FW_FEAT(RTL8852A, ge, 0, 13, 36, 0, CRASH_TRIGGER),
 	__CFG_FW_FEAT(RTL8852A, lt, 0, 13, 38, 0, NO_PACKET_DROP),
 	__CFG_FW_FEAT(RTL8852B, ge, 0, 29, 26, 0, NO_LPS_PG),
 	__CFG_FW_FEAT(RTL8852B, ge, 0, 29, 26, 0, TX_WAKE),
 	__CFG_FW_FEAT(RTL8852B, ge, 0, 29, 29, 0, CRASH_TRIGGER),
 	__CFG_FW_FEAT(RTL8852B, ge, 0, 29, 29, 0, SCAN_OFFLOAD),
 	__CFG_FW_FEAT(RTL8852C, le, 0, 27, 33, 0, NO_DEEP_PS),
 	__CFG_FW_FEAT(RTL8852C, ge, 0, 27, 34, 0, TX_WAKE),
 	__CFG_FW_FEAT(RTL8852C, ge, 0, 27, 36, 0, SCAN_OFFLOAD),
 	__CFG_FW_FEAT(RTL8852C, ge, 0, 27, 40, 0, CRASH_TRIGGER),
 	__CFG_FW_FEAT(RTL8852C, ge, 0, 27, 56, 10, BEACON_FILTER),
 };
 
 static void rtw89_fw_iterate_feature_cfg(struct rtw89_fw_info *fw,
 					 const struct rtw89_chip_info *chip,
 					 u32 ver_code)
 {
 	int i;
 
 	for (i = 0; i < ARRAY_SIZE(fw_feat_tbl); i++) {
 		const struct __fw_feat_cfg *ent = &fw_feat_tbl[i];
 
 		if (chip->chip_id != ent->chip_id)
 			continue;
 
 		if (ent->cond(ver_code, ent->ver_code))
 			RTW89_SET_FW_FEATURE(ent->feature, fw);
 	}
 }
 
 static void rtw89_fw_recognize_features(struct rtw89_dev *rtwdev)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	const struct rtw89_fw_suit *fw_suit;
 	u32 suit_ver_code;
 
 	fw_suit = rtw89_fw_suit_get(rtwdev, RTW89_FW_NORMAL);
 	suit_ver_code = RTW89_FW_SUIT_VER_CODE(fw_suit);
 
 	rtw89_fw_iterate_feature_cfg(&rtwdev->fw, chip, suit_ver_code);
 }
 
 const struct firmware *
 rtw89_early_fw_feature_recognize(struct device *device,
 				 const struct rtw89_chip_info *chip,
 				 struct rtw89_fw_info *early_fw,
 				 int *used_fw_format)
 {
 	const struct firmware *firmware;
 	char fw_name[64];
 	int fw_format;
 	u32 ver_code;
 	int ret;
 
 	for (fw_format = chip->fw_format_max; fw_format >= 0; fw_format--) {
 		rtw89_fw_get_filename(fw_name, sizeof(fw_name),
 				      chip->fw_basename, fw_format);
 
 		ret = request_firmware(&firmware, fw_name, device);
 		if (!ret) {
 			dev_info(device, "loaded firmware %s\n", fw_name);
 			*used_fw_format = fw_format;
 			break;
 		}
 	}
 
 	if (ret) {
 		dev_err(device, "failed to early request firmware: %d\n", ret);
 		return NULL;
 	}
 
 	ver_code = rtw89_compat_fw_hdr_ver_code(firmware->data);
 
 	if (!ver_code)
 		goto out;
 
 	rtw89_fw_iterate_feature_cfg(early_fw, chip, ver_code);
 
 out:
 	return firmware;
 }
 
 int rtw89_fw_recognize(struct rtw89_dev *rtwdev)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	int ret;
 
 	if (chip->try_ce_fw) {
 		ret = __rtw89_fw_recognize(rtwdev, RTW89_FW_NORMAL_CE, true);
 		if (!ret)
 			goto normal_done;
 	}
 
 	ret = __rtw89_fw_recognize(rtwdev, RTW89_FW_NORMAL, false);
 	if (ret)
 		return ret;
 
 normal_done:
 	/* It still works if wowlan firmware isn't existing. */
 	__rtw89_fw_recognize(rtwdev, RTW89_FW_WOWLAN, false);
 
 	/* It still works if log format file isn't existing. */
 	__rtw89_fw_recognize(rtwdev, RTW89_FW_LOGFMT, true);
 
 	rtw89_fw_recognize_features(rtwdev);
 
 	rtw89_coex_recognize_ver(rtwdev);
 
 	return 0;
 }
 
 static
 int rtw89_build_phy_tbl_from_elm(struct rtw89_dev *rtwdev,
 				 const struct rtw89_fw_element_hdr *elm,
 #if defined(__linux__)
 				 const void *data)
 #elif defined(__FreeBSD__)
 				 const int data)
 #endif
 {
 	struct rtw89_fw_elm_info *elm_info = &rtwdev->fw.elm_info;
 	struct rtw89_phy_table *tbl;
 	struct rtw89_reg2_def *regs;
 	enum rtw89_rf_path rf_path;
 	u32 n_regs, i;
 	u8 idx;
 
 	tbl = kzalloc(sizeof(*tbl), GFP_KERNEL);
 	if (!tbl)
 		return -ENOMEM;
 
 	switch (le32_to_cpu(elm->id)) {
 	case RTW89_FW_ELEMENT_ID_BB_REG:
 		elm_info->bb_tbl = tbl;
 		break;
 	case RTW89_FW_ELEMENT_ID_BB_GAIN:
 		elm_info->bb_gain = tbl;
 		break;
 	case RTW89_FW_ELEMENT_ID_RADIO_A:
 	case RTW89_FW_ELEMENT_ID_RADIO_B:
 	case RTW89_FW_ELEMENT_ID_RADIO_C:
 	case RTW89_FW_ELEMENT_ID_RADIO_D:
 		rf_path = (enum rtw89_rf_path)data;
 		idx = elm->u.reg2.idx;
 
 		elm_info->rf_radio[idx] = tbl;
 		tbl->rf_path = rf_path;
 		tbl->config = rtw89_phy_config_rf_reg_v1;
 		break;
 	case RTW89_FW_ELEMENT_ID_RF_NCTL:
 		elm_info->rf_nctl = tbl;
 		break;
 	default:
 		kfree(tbl);
 		return -ENOENT;
 	}
 
 	n_regs = le32_to_cpu(elm->size) / sizeof(tbl->regs[0]);
 	regs = kcalloc(n_regs, sizeof(tbl->regs[0]), GFP_KERNEL);
 	if (!regs)
 		goto out;
 
 	for (i = 0; i < n_regs; i++) {
 		regs[i].addr = le32_to_cpu(elm->u.reg2.regs[i].addr);
 		regs[i].data = le32_to_cpu(elm->u.reg2.regs[i].data);
 	}
 
 	tbl->n_regs = n_regs;
 	tbl->regs = regs;
 
 	return 0;
 
 out:
 	kfree(tbl);
 	return -ENOMEM;
 }
 
 struct rtw89_fw_element_handler {
 	int (*fn)(struct rtw89_dev *rtwdev,
 #if defined(__linux__)
 		  const struct rtw89_fw_element_hdr *elm, const void *data);
 	const void *data;
 #elif defined(__FreeBSD__)
 		  const struct rtw89_fw_element_hdr *elm, const int data);
 	const int data;
 #endif
 	const char *name;
 };
 
 static const struct rtw89_fw_element_handler __fw_element_handlers[] = {
 #if defined(__linux__)
 	[RTW89_FW_ELEMENT_ID_BBMCU0] = {__rtw89_fw_recognize_from_elm,
 					(const void *)RTW89_FW_BBMCU0, NULL},
 	[RTW89_FW_ELEMENT_ID_BBMCU1] = {__rtw89_fw_recognize_from_elm,
 					(const void *)RTW89_FW_BBMCU1, NULL},
 	[RTW89_FW_ELEMENT_ID_BB_REG] = {rtw89_build_phy_tbl_from_elm, NULL, "BB"},
 	[RTW89_FW_ELEMENT_ID_BB_GAIN] = {rtw89_build_phy_tbl_from_elm, NULL, NULL},
 	[RTW89_FW_ELEMENT_ID_RADIO_A] = {rtw89_build_phy_tbl_from_elm,
 					 (const void *)RF_PATH_A, "radio A"},
 	[RTW89_FW_ELEMENT_ID_RADIO_B] = {rtw89_build_phy_tbl_from_elm,
 					 (const void *)RF_PATH_B, NULL},
 	[RTW89_FW_ELEMENT_ID_RADIO_C] = {rtw89_build_phy_tbl_from_elm,
 					 (const void *)RF_PATH_C, NULL},
 	[RTW89_FW_ELEMENT_ID_RADIO_D] = {rtw89_build_phy_tbl_from_elm,
 					 (const void *)RF_PATH_D, NULL},
 	[RTW89_FW_ELEMENT_ID_RF_NCTL] = {rtw89_build_phy_tbl_from_elm, NULL, "NCTL"},
 #elif defined(__FreeBSD__)
 	[RTW89_FW_ELEMENT_ID_BBMCU0] = {__rtw89_fw_recognize_from_elm,
 					RTW89_FW_BBMCU0, NULL},
 	[RTW89_FW_ELEMENT_ID_BBMCU1] = {__rtw89_fw_recognize_from_elm,
 					RTW89_FW_BBMCU1, NULL},
 	[RTW89_FW_ELEMENT_ID_BB_REG] = {rtw89_build_phy_tbl_from_elm, -1, "BB"},
 	[RTW89_FW_ELEMENT_ID_BB_GAIN] = {rtw89_build_phy_tbl_from_elm, -1, NULL},
 	[RTW89_FW_ELEMENT_ID_RADIO_A] = {rtw89_build_phy_tbl_from_elm,
 					 RF_PATH_A, "radio A"},
 	[RTW89_FW_ELEMENT_ID_RADIO_B] = {rtw89_build_phy_tbl_from_elm,
 					 RF_PATH_B, NULL},
 	[RTW89_FW_ELEMENT_ID_RADIO_C] = {rtw89_build_phy_tbl_from_elm,
 					 RF_PATH_C, NULL},
 	[RTW89_FW_ELEMENT_ID_RADIO_D] = {rtw89_build_phy_tbl_from_elm,
 					 RF_PATH_D, NULL},
 	[RTW89_FW_ELEMENT_ID_RF_NCTL] = {rtw89_build_phy_tbl_from_elm, -1, "NCTL"},
 #endif
 };
 
 int rtw89_fw_recognize_elements(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_fw_info *fw_info = &rtwdev->fw;
 	const struct firmware *firmware = fw_info->req.firmware;
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	u32 unrecognized_elements = chip->needed_fw_elms;
 	const struct rtw89_fw_element_handler *handler;
 	const struct rtw89_fw_element_hdr *hdr;
 	u32 elm_size;
 	u32 elem_id;
 	u32 offset;
 	int ret;
 
 	BUILD_BUG_ON(sizeof(chip->needed_fw_elms) * 8 < RTW89_FW_ELEMENT_ID_NUM);
 
 	offset = rtw89_mfw_get_size(rtwdev);
 	offset = ALIGN(offset, RTW89_FW_ELEMENT_ALIGN);
 	if (offset == 0)
 		return -EINVAL;
 
 	while (offset + sizeof(*hdr) < firmware->size) {
 		hdr = (const struct rtw89_fw_element_hdr *)(firmware->data + offset);
 
 		elm_size = le32_to_cpu(hdr->size);
 		if (offset + elm_size >= firmware->size) {
 			rtw89_warn(rtwdev, "firmware element size exceeds\n");
 			break;
 		}
 
 		elem_id = le32_to_cpu(hdr->id);
 		if (elem_id >= ARRAY_SIZE(__fw_element_handlers))
 			goto next;
 
 		handler = &__fw_element_handlers[elem_id];
 		if (!handler->fn)
 			goto next;
 
 		ret = handler->fn(rtwdev, hdr, handler->data);
 		if (ret)
 			return ret;
 
 		if (handler->name)
 			rtw89_info(rtwdev, "Firmware element %s version: %4ph\n",
 				   handler->name, hdr->ver);
 
 		unrecognized_elements &= ~BIT(elem_id);
 next:
 		offset += sizeof(*hdr) + elm_size;
 		offset = ALIGN(offset, RTW89_FW_ELEMENT_ALIGN);
 	}
 
 	if (unrecognized_elements) {
 		rtw89_err(rtwdev, "Firmware elements 0x%08x are unrecognized\n",
 			  unrecognized_elements);
 		return -ENOENT;
 	}
 
 	return 0;
 }
 
 void rtw89_h2c_pkt_set_hdr(struct rtw89_dev *rtwdev, struct sk_buff *skb,
 			   u8 type, u8 cat, u8 class, u8 func,
 			   bool rack, bool dack, u32 len)
 {
 	struct fwcmd_hdr *hdr;
 
 	hdr = (struct fwcmd_hdr *)skb_push(skb, 8);
 
 	if (!(rtwdev->fw.h2c_seq % 4))
 		rack = true;
 	hdr->hdr0 = cpu_to_le32(FIELD_PREP(H2C_HDR_DEL_TYPE, type) |
 				FIELD_PREP(H2C_HDR_CAT, cat) |
 				FIELD_PREP(H2C_HDR_CLASS, class) |
 				FIELD_PREP(H2C_HDR_FUNC, func) |
 				FIELD_PREP(H2C_HDR_H2C_SEQ, rtwdev->fw.h2c_seq));
 
 	hdr->hdr1 = cpu_to_le32(FIELD_PREP(H2C_HDR_TOTAL_LEN,
 					   len + H2C_HEADER_LEN) |
 				(rack ? H2C_HDR_REC_ACK : 0) |
 				(dack ? H2C_HDR_DONE_ACK : 0));
 
 	rtwdev->fw.h2c_seq++;
 }
 
 static void rtw89_h2c_pkt_set_hdr_fwdl(struct rtw89_dev *rtwdev,
 				       struct sk_buff *skb,
 				       u8 type, u8 cat, u8 class, u8 func,
 				       u32 len)
 {
 	struct fwcmd_hdr *hdr;
 
 	hdr = (struct fwcmd_hdr *)skb_push(skb, 8);
 
 	hdr->hdr0 = cpu_to_le32(FIELD_PREP(H2C_HDR_DEL_TYPE, type) |
 				FIELD_PREP(H2C_HDR_CAT, cat) |
 				FIELD_PREP(H2C_HDR_CLASS, class) |
 				FIELD_PREP(H2C_HDR_FUNC, func) |
 				FIELD_PREP(H2C_HDR_H2C_SEQ, rtwdev->fw.h2c_seq));
 
 	hdr->hdr1 = cpu_to_le32(FIELD_PREP(H2C_HDR_TOTAL_LEN,
 					   len + H2C_HEADER_LEN));
 }
 
 static int __rtw89_fw_download_hdr(struct rtw89_dev *rtwdev, const u8 *fw, u32 len)
 {
 	struct sk_buff *skb;
 	u32 ret = 0;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for fw hdr dl\n");
 		return -ENOMEM;
 	}
 
 	skb_put_data(skb, fw, len);
 	SET_FW_HDR_PART_SIZE(skb->data, FWDL_SECTION_PER_PKT_LEN);
 	rtw89_h2c_pkt_set_hdr_fwdl(rtwdev, skb, FWCMD_TYPE_H2C,
 				   H2C_CAT_MAC, H2C_CL_MAC_FWDL,
 				   H2C_FUNC_MAC_FWHDR_DL, len);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		ret = -1;
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 static int rtw89_fw_download_hdr(struct rtw89_dev *rtwdev, const u8 *fw, u32 len)
 {
 	u8 val;
 	int ret;
 
 	ret = __rtw89_fw_download_hdr(rtwdev, fw, len);
 	if (ret) {
 		rtw89_err(rtwdev, "[ERR]FW header download\n");
 		return ret;
 	}
 
 	ret = read_poll_timeout_atomic(rtw89_read8, val, val & B_AX_FWDL_PATH_RDY,
 				       1, FWDL_WAIT_CNT, false,
 				       rtwdev, R_AX_WCPU_FW_CTRL);
 	if (ret) {
 		rtw89_err(rtwdev, "[ERR]FWDL path ready\n");
 		return ret;
 	}
 
 	rtw89_write32(rtwdev, R_AX_HALT_H2C_CTRL, 0);
 	rtw89_write32(rtwdev, R_AX_HALT_C2H_CTRL, 0);
 
 	return 0;
 }
 
 static int __rtw89_fw_download_main(struct rtw89_dev *rtwdev,
 				    struct rtw89_fw_hdr_section_info *info)
 {
 	struct sk_buff *skb;
 	const u8 *section = info->addr;
 	u32 residue_len = info->len;
 	u32 pkt_len;
 	int ret;
 
 	while (residue_len) {
 		if (residue_len >= FWDL_SECTION_PER_PKT_LEN)
 			pkt_len = FWDL_SECTION_PER_PKT_LEN;
 		else
 			pkt_len = residue_len;
 
 		skb = rtw89_fw_h2c_alloc_skb_no_hdr(rtwdev, pkt_len);
 		if (!skb) {
 			rtw89_err(rtwdev, "failed to alloc skb for fw dl\n");
 			return -ENOMEM;
 		}
 		skb_put_data(skb, section, pkt_len);
 
 		ret = rtw89_h2c_tx(rtwdev, skb, true);
 		if (ret) {
 			rtw89_err(rtwdev, "failed to send h2c\n");
 			ret = -1;
 			goto fail;
 		}
 
 		section += pkt_len;
 		residue_len -= pkt_len;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 static int rtw89_fw_download_main(struct rtw89_dev *rtwdev, const u8 *fw,
 				  struct rtw89_fw_bin_info *info)
 {
 	struct rtw89_fw_hdr_section_info *section_info = info->section_info;
 	u8 section_num = info->section_num;
 	int ret;
 
 	while (section_num--) {
 		ret = __rtw89_fw_download_main(rtwdev, section_info);
 		if (ret)
 			return ret;
 		section_info++;
 	}
 
 	mdelay(5);
 
 	ret = rtw89_fw_check_rdy(rtwdev);
 	if (ret) {
 		rtw89_warn(rtwdev, "download firmware fail\n");
 		return ret;
 	}
 
 	return 0;
 }
 
 static void rtw89_fw_prog_cnt_dump(struct rtw89_dev *rtwdev)
 {
 	u32 val32;
 	u16 index;
 
 	rtw89_write32(rtwdev, R_AX_DBG_CTRL,
 		      FIELD_PREP(B_AX_DBG_SEL0, FW_PROG_CNTR_DBG_SEL) |
 		      FIELD_PREP(B_AX_DBG_SEL1, FW_PROG_CNTR_DBG_SEL));
 	rtw89_write32_mask(rtwdev, R_AX_SYS_STATUS1, B_AX_SEL_0XC0_MASK, MAC_DBG_SEL);
 
 	for (index = 0; index < 15; index++) {
 		val32 = rtw89_read32(rtwdev, R_AX_DBG_PORT_SEL);
 		rtw89_err(rtwdev, "[ERR]fw PC = 0x%x\n", val32);
+#if defined(__linux__)
 		fsleep(10);
+#elif defined(__FreeBSD__)
+		/* Seems we are called from a context we cannot sleep. */
+		udelay(10);
+#endif
 	}
 }
 
 static void rtw89_fw_dl_fail_dump(struct rtw89_dev *rtwdev)
 {
 	u32 val32;
 	u16 val16;
 
 	val32 = rtw89_read32(rtwdev, R_AX_WCPU_FW_CTRL);
 	rtw89_err(rtwdev, "[ERR]fwdl 0x1E0 = 0x%x\n", val32);
 
 	val16 = rtw89_read16(rtwdev, R_AX_BOOT_DBG + 2);
 	rtw89_err(rtwdev, "[ERR]fwdl 0x83F2 = 0x%x\n", val16);
 
 	rtw89_fw_prog_cnt_dump(rtwdev);
 }
 
 int rtw89_fw_download(struct rtw89_dev *rtwdev, enum rtw89_fw_type type)
 {
 	struct rtw89_fw_info *fw_info = &rtwdev->fw;
 	struct rtw89_fw_suit *fw_suit = rtw89_fw_suit_get(rtwdev, type);
 	struct rtw89_fw_bin_info info;
 	u8 val;
 	int ret;
 
 	rtw89_mac_disable_cpu(rtwdev);
 	ret = rtw89_mac_enable_cpu(rtwdev, 0, true);
 	if (ret)
 		return ret;
 
 	ret = rtw89_fw_hdr_parser(rtwdev, fw_suit, &info);
 	if (ret) {
 		rtw89_err(rtwdev, "parse fw header fail\n");
 		goto fwdl_err;
 	}
 
 	ret = read_poll_timeout_atomic(rtw89_read8, val, val & B_AX_H2C_PATH_RDY,
 				       1, FWDL_WAIT_CNT, false,
 				       rtwdev, R_AX_WCPU_FW_CTRL);
 	if (ret) {
 		rtw89_err(rtwdev, "[ERR]H2C path ready\n");
 		goto fwdl_err;
 	}
 
 	ret = rtw89_fw_download_hdr(rtwdev, fw_suit->data, info.hdr_len -
 							   info.dynamic_hdr_len);
 	if (ret) {
 		ret = -EBUSY;
 		goto fwdl_err;
 	}
 
 	ret = rtw89_fw_download_main(rtwdev, fw_suit->data, &info);
 	if (ret) {
 		ret = -EBUSY;
 		goto fwdl_err;
 	}
 
 	fw_info->h2c_seq = 0;
 	fw_info->rec_seq = 0;
 	fw_info->h2c_counter = 0;
 	fw_info->c2h_counter = 0;
 	rtwdev->mac.rpwm_seq_num = RPWM_SEQ_NUM_MAX;
 	rtwdev->mac.cpwm_seq_num = CPWM_SEQ_NUM_MAX;
 
 	return ret;
 
 fwdl_err:
 	rtw89_fw_dl_fail_dump(rtwdev);
 	return ret;
 }
 
 int rtw89_wait_firmware_completion(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_fw_info *fw = &rtwdev->fw;
 
 	wait_for_completion(&fw->req.completion);
 	if (!fw->req.firmware)
 		return -EINVAL;
 
 	return 0;
 }
 
 static int rtw89_load_firmware_req(struct rtw89_dev *rtwdev,
 				   struct rtw89_fw_req_info *req,
 				   const char *fw_name, bool nowarn)
 {
 	int ret;
 
 	if (req->firmware) {
 		rtw89_debug(rtwdev, RTW89_DBG_FW,
 			    "full firmware has been early requested\n");
 		complete_all(&req->completion);
 		return 0;
 	}
 
 	if (nowarn)
 		ret = firmware_request_nowarn(&req->firmware, fw_name, rtwdev->dev);
 	else
 		ret = request_firmware(&req->firmware, fw_name, rtwdev->dev);
 
 	complete_all(&req->completion);
 
 	return ret;
 }
 
 void rtw89_load_firmware_work(struct work_struct *work)
 {
 	struct rtw89_dev *rtwdev =
 		container_of(work, struct rtw89_dev, load_firmware_work);
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	char fw_name[64];
 
 	rtw89_fw_get_filename(fw_name, sizeof(fw_name),
 			      chip->fw_basename, rtwdev->fw.fw_format);
 
 	rtw89_load_firmware_req(rtwdev, &rtwdev->fw.req, fw_name, false);
 }
 
 static void rtw89_free_phy_tbl_from_elm(struct rtw89_phy_table *tbl)
 {
 	if (!tbl)
 		return;
 
 	kfree(tbl->regs);
 	kfree(tbl);
 }
 
 static void rtw89_unload_firmware_elements(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_fw_elm_info *elm_info = &rtwdev->fw.elm_info;
 	int i;
 
 	rtw89_free_phy_tbl_from_elm(elm_info->bb_tbl);
 	rtw89_free_phy_tbl_from_elm(elm_info->bb_gain);
 	for (i = 0; i < ARRAY_SIZE(elm_info->rf_radio); i++)
 		rtw89_free_phy_tbl_from_elm(elm_info->rf_radio[i]);
 	rtw89_free_phy_tbl_from_elm(elm_info->rf_nctl);
 }
 
 void rtw89_unload_firmware(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_fw_info *fw = &rtwdev->fw;
 
 	cancel_work_sync(&rtwdev->load_firmware_work);
 
 	if (fw->req.firmware) {
 		release_firmware(fw->req.firmware);
 
 		/* assign NULL back in case rtw89_free_ieee80211_hw()
 		 * try to release the same one again.
 		 */
 		fw->req.firmware = NULL;
 	}
 
 	kfree(fw->log.fmts);
 	rtw89_unload_firmware_elements(rtwdev);
 }
 
 static u32 rtw89_fw_log_get_fmt_idx(struct rtw89_dev *rtwdev, u32 fmt_id)
 {
 	struct rtw89_fw_log *fw_log = &rtwdev->fw.log;
 	u32 i;
 
 	if (fmt_id > fw_log->last_fmt_id)
 		return 0;
 
 	for (i = 0; i < fw_log->fmt_count; i++) {
 		if (le32_to_cpu(fw_log->fmt_ids[i]) == fmt_id)
 			return i;
 	}
 	return 0;
 }
 
 static int rtw89_fw_log_create_fmts_dict(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_fw_log *log = &rtwdev->fw.log;
 	const struct rtw89_fw_logsuit_hdr *suit_hdr;
 	struct rtw89_fw_suit *suit = &log->suit;
 #if defined(__linux__)
 	const void *fmts_ptr, *fmts_end_ptr;
 #elif defined(__FreeBSD__)
 	const u8 *fmts_ptr, *fmts_end_ptr;
 #endif
 	u32 fmt_count;
 	int i;
 
 	suit_hdr = (const struct rtw89_fw_logsuit_hdr *)suit->data;
 	fmt_count = le32_to_cpu(suit_hdr->count);
 	log->fmt_ids = suit_hdr->ids;
 #if defined(__linux__)
 	fmts_ptr = &suit_hdr->ids[fmt_count];
 #elif defined(__FreeBSD__)
 	fmts_ptr = (const u8 *)&suit_hdr->ids[fmt_count];
 #endif
 	fmts_end_ptr = suit->data + suit->size;
 	log->fmts = kcalloc(fmt_count, sizeof(char *), GFP_KERNEL);
 	if (!log->fmts)
 		return -ENOMEM;
 
 	for (i = 0; i < fmt_count; i++) {
 		fmts_ptr = memchr_inv(fmts_ptr, 0, fmts_end_ptr - fmts_ptr);
 		if (!fmts_ptr)
 			break;
 
 		(*log->fmts)[i] = fmts_ptr;
 		log->last_fmt_id = le32_to_cpu(log->fmt_ids[i]);
 		log->fmt_count++;
 		fmts_ptr += strlen(fmts_ptr);
 	}
 
 	return 0;
 }
 
 int rtw89_fw_log_prepare(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_fw_log *log = &rtwdev->fw.log;
 	struct rtw89_fw_suit *suit = &log->suit;
 
 	if (!suit || !suit->data) {
 		rtw89_debug(rtwdev, RTW89_DBG_FW, "no log format file\n");
 		return -EINVAL;
 	}
 	if (log->fmts)
 		return 0;
 
 	return rtw89_fw_log_create_fmts_dict(rtwdev);
 }
 
 static void rtw89_fw_log_dump_data(struct rtw89_dev *rtwdev,
 				   const struct rtw89_fw_c2h_log_fmt *log_fmt,
 				   u32 fmt_idx, u8 para_int, bool raw_data)
 {
 	const char *(*fmts)[] = rtwdev->fw.log.fmts;
 	char str_buf[RTW89_C2H_FW_LOG_STR_BUF_SIZE];
 	u32 args[RTW89_C2H_FW_LOG_MAX_PARA_NUM] = {0};
 	int i;
 
 	if (log_fmt->argc > RTW89_C2H_FW_LOG_MAX_PARA_NUM) {
 		rtw89_warn(rtwdev, "C2H log: Arg count is unexpected %d\n",
 			   log_fmt->argc);
 		return;
 	}
 
 	if (para_int)
 		for (i = 0 ; i < log_fmt->argc; i++)
 			args[i] = le32_to_cpu(log_fmt->u.argv[i]);
 
 	if (raw_data) {
 		if (para_int)
 			snprintf(str_buf, RTW89_C2H_FW_LOG_STR_BUF_SIZE,
 				 "fw_enc(%d, %d, %d) %*ph", le32_to_cpu(log_fmt->fmt_id),
 				 para_int, log_fmt->argc, (int)sizeof(args), args);
 		else
 			snprintf(str_buf, RTW89_C2H_FW_LOG_STR_BUF_SIZE,
 				 "fw_enc(%d, %d, %d, %s)", le32_to_cpu(log_fmt->fmt_id),
 				 para_int, log_fmt->argc, log_fmt->u.raw);
 	} else {
 		snprintf(str_buf, RTW89_C2H_FW_LOG_STR_BUF_SIZE, (*fmts)[fmt_idx],
 			 args[0x0], args[0x1], args[0x2], args[0x3], args[0x4],
 			 args[0x5], args[0x6], args[0x7], args[0x8], args[0x9],
 			 args[0xa], args[0xb], args[0xc], args[0xd], args[0xe],
 			 args[0xf]);
 	}
 
 	rtw89_info(rtwdev, "C2H log: %s", str_buf);
 }
 
 void rtw89_fw_log_dump(struct rtw89_dev *rtwdev, u8 *buf, u32 len)
 {
 	const struct rtw89_fw_c2h_log_fmt *log_fmt;
 	u8 para_int;
 	u32 fmt_idx;
 
 	if (len < RTW89_C2H_HEADER_LEN) {
 		rtw89_err(rtwdev, "c2h log length is wrong!\n");
 		return;
 	}
 
 	buf += RTW89_C2H_HEADER_LEN;
 	len -= RTW89_C2H_HEADER_LEN;
 	log_fmt = (const struct rtw89_fw_c2h_log_fmt *)buf;
 
 	if (len < RTW89_C2H_FW_FORMATTED_LOG_MIN_LEN)
 		goto plain_log;
 
 	if (log_fmt->signature != cpu_to_le16(RTW89_C2H_FW_LOG_SIGNATURE))
 		goto plain_log;
 
 	if (!rtwdev->fw.log.fmts)
 		return;
 
 	para_int = u8_get_bits(log_fmt->feature, RTW89_C2H_FW_LOG_FEATURE_PARA_INT);
 	fmt_idx = rtw89_fw_log_get_fmt_idx(rtwdev, le32_to_cpu(log_fmt->fmt_id));
 
 	if (!para_int && log_fmt->argc != 0 && fmt_idx != 0)
 		rtw89_info(rtwdev, "C2H log: %s%s",
 			   (*rtwdev->fw.log.fmts)[fmt_idx], log_fmt->u.raw);
 	else if (fmt_idx != 0 && para_int)
 		rtw89_fw_log_dump_data(rtwdev, log_fmt, fmt_idx, para_int, false);
 	else
 		rtw89_fw_log_dump_data(rtwdev, log_fmt, fmt_idx, para_int, true);
 	return;
 
 plain_log:
 	rtw89_info(rtwdev, "C2H log: %*s", len, buf);
 
 }
 
 #define H2C_CAM_LEN 60
 int rtw89_fw_h2c_cam(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif,
 		     struct rtw89_sta *rtwsta, const u8 *scan_mac_addr)
 {
 	struct sk_buff *skb;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_CAM_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for fw dl\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_CAM_LEN);
 	rtw89_cam_fill_addr_cam_info(rtwdev, rtwvif, rtwsta, scan_mac_addr, skb->data);
 	rtw89_cam_fill_bssid_cam_info(rtwdev, rtwvif, rtwsta, skb->data);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_MAC_ADDR_CAM_UPDATE,
 			      H2C_FUNC_MAC_ADDR_CAM_UPD, 0, 1,
 			      H2C_CAM_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 #define H2C_DCTL_SEC_CAM_LEN 68
 int rtw89_fw_h2c_dctl_sec_cam_v1(struct rtw89_dev *rtwdev,
 				 struct rtw89_vif *rtwvif,
 				 struct rtw89_sta *rtwsta)
 {
 	struct sk_buff *skb;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_DCTL_SEC_CAM_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for dctl sec cam\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_DCTL_SEC_CAM_LEN);
 
 	rtw89_cam_fill_dctl_sec_cam_info_v1(rtwdev, rtwvif, rtwsta, skb->data);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_MAC_FR_EXCHG,
 			      H2C_FUNC_MAC_DCTLINFO_UD_V1, 0, 0,
 			      H2C_DCTL_SEC_CAM_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 EXPORT_SYMBOL(rtw89_fw_h2c_dctl_sec_cam_v1);
 
 #define H2C_BA_CAM_LEN 8
 int rtw89_fw_h2c_ba_cam(struct rtw89_dev *rtwdev, struct rtw89_sta *rtwsta,
 			bool valid, struct ieee80211_ampdu_params *params)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	struct rtw89_vif *rtwvif = rtwsta->rtwvif;
 	u8 macid = rtwsta->mac_id;
 	struct sk_buff *skb;
 	u8 entry_idx;
 	int ret;
 
 	ret = valid ?
 	      rtw89_core_acquire_sta_ba_entry(rtwdev, rtwsta, params->tid, &entry_idx) :
 	      rtw89_core_release_sta_ba_entry(rtwdev, rtwsta, params->tid, &entry_idx);
 	if (ret) {
 		/* it still works even if we don't have static BA CAM, because
 		 * hardware can create dynamic BA CAM automatically.
 		 */
 		rtw89_debug(rtwdev, RTW89_DBG_TXRX,
 			    "failed to %s entry tid=%d for h2c ba cam\n",
 			    valid ? "alloc" : "free", params->tid);
 		return 0;
 	}
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_BA_CAM_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c ba cam\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_BA_CAM_LEN);
 	SET_BA_CAM_MACID(skb->data, macid);
 	if (chip->bacam_ver == RTW89_BACAM_V0_EXT)
 		SET_BA_CAM_ENTRY_IDX_V1(skb->data, entry_idx);
 	else
 		SET_BA_CAM_ENTRY_IDX(skb->data, entry_idx);
 	if (!valid)
 		goto end;
 	SET_BA_CAM_VALID(skb->data, valid);
 	SET_BA_CAM_TID(skb->data, params->tid);
 	if (params->buf_size > 64)
 		SET_BA_CAM_BMAP_SIZE(skb->data, 4);
 	else
 		SET_BA_CAM_BMAP_SIZE(skb->data, 0);
 	/* If init req is set, hw will set the ssn */
 	SET_BA_CAM_INIT_REQ(skb->data, 1);
 	SET_BA_CAM_SSN(skb->data, params->ssn);
 
 	if (chip->bacam_ver == RTW89_BACAM_V0_EXT) {
 		SET_BA_CAM_STD_EN(skb->data, 1);
 		SET_BA_CAM_BAND(skb->data, rtwvif->mac_idx);
 	}
 
 end:
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_BA_CAM,
 			      H2C_FUNC_MAC_BA_CAM, 0, 1,
 			      H2C_BA_CAM_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 static int rtw89_fw_h2c_init_ba_cam_v0_ext(struct rtw89_dev *rtwdev,
 					   u8 entry_idx, u8 uid)
 {
 	struct sk_buff *skb;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_BA_CAM_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for dynamic h2c ba cam\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_BA_CAM_LEN);
 
 	SET_BA_CAM_VALID(skb->data, 1);
 	SET_BA_CAM_ENTRY_IDX_V1(skb->data, entry_idx);
 	SET_BA_CAM_UID(skb->data, uid);
 	SET_BA_CAM_BAND(skb->data, 0);
 	SET_BA_CAM_STD_EN(skb->data, 0);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_BA_CAM,
 			      H2C_FUNC_MAC_BA_CAM, 0, 1,
 			      H2C_BA_CAM_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 void rtw89_fw_h2c_init_dynamic_ba_cam_v0_ext(struct rtw89_dev *rtwdev)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	u8 entry_idx = chip->bacam_num;
 	u8 uid = 0;
 	int i;
 
 	for (i = 0; i < chip->bacam_dynamic_num; i++) {
 		rtw89_fw_h2c_init_ba_cam_v0_ext(rtwdev, entry_idx, uid);
 		entry_idx++;
 		uid++;
 	}
 }
 
 #define H2C_LOG_CFG_LEN 12
 int rtw89_fw_h2c_fw_log(struct rtw89_dev *rtwdev, bool enable)
 {
 	struct sk_buff *skb;
 	u32 comp = enable ? BIT(RTW89_FW_LOG_COMP_INIT) | BIT(RTW89_FW_LOG_COMP_TASK) |
 			    BIT(RTW89_FW_LOG_COMP_PS) | BIT(RTW89_FW_LOG_COMP_ERROR) : 0;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_LOG_CFG_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for fw log cfg\n");
 		return -ENOMEM;
 	}
 
 	skb_put(skb, H2C_LOG_CFG_LEN);
 	SET_LOG_CFG_LEVEL(skb->data, RTW89_FW_LOG_LEVEL_LOUD);
 	SET_LOG_CFG_PATH(skb->data, BIT(RTW89_FW_LOG_LEVEL_C2H));
 	SET_LOG_CFG_COMP(skb->data, comp);
 	SET_LOG_CFG_COMP_EXT(skb->data, 0);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_FW_INFO,
 			      H2C_FUNC_LOG_CFG, 0, 0,
 			      H2C_LOG_CFG_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 static int rtw89_fw_h2c_add_general_pkt(struct rtw89_dev *rtwdev,
 					struct rtw89_vif *rtwvif,
 					enum rtw89_fw_pkt_ofld_type type,
 					u8 *id)
 {
 	struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif);
 	struct rtw89_pktofld_info *info;
 	struct sk_buff *skb;
 	int ret;
 
 	info = kzalloc(sizeof(*info), GFP_KERNEL);
 	if (!info)
 		return -ENOMEM;
 
 	switch (type) {
 	case RTW89_PKT_OFLD_TYPE_PS_POLL:
 		skb = ieee80211_pspoll_get(rtwdev->hw, vif);
 		break;
 	case RTW89_PKT_OFLD_TYPE_PROBE_RSP:
 		skb = ieee80211_proberesp_get(rtwdev->hw, vif);
 		break;
 	case RTW89_PKT_OFLD_TYPE_NULL_DATA:
 		skb = ieee80211_nullfunc_get(rtwdev->hw, vif, -1, false);
 		break;
 	case RTW89_PKT_OFLD_TYPE_QOS_NULL:
 		skb = ieee80211_nullfunc_get(rtwdev->hw, vif, -1, true);
 		break;
 	default:
 		goto err;
 	}
 
 	if (!skb)
 		goto err;
 
 	ret = rtw89_fw_h2c_add_pkt_offload(rtwdev, &info->id, skb);
 	kfree_skb(skb);
 
 	if (ret)
 		goto err;
 
 	list_add_tail(&info->list, &rtwvif->general_pkt_list);
 	*id = info->id;
 	return 0;
 
 err:
 	kfree(info);
 	return -ENOMEM;
 }
 
 void rtw89_fw_release_general_pkt_list_vif(struct rtw89_dev *rtwdev,
 					   struct rtw89_vif *rtwvif, bool notify_fw)
 {
 	struct list_head *pkt_list = &rtwvif->general_pkt_list;
 	struct rtw89_pktofld_info *info, *tmp;
 
 	list_for_each_entry_safe(info, tmp, pkt_list, list) {
 		if (notify_fw)
 			rtw89_fw_h2c_del_pkt_offload(rtwdev, info->id);
 		else
 			rtw89_core_release_bit_map(rtwdev->pkt_offload, info->id);
 		list_del(&info->list);
 		kfree(info);
 	}
 }
 
 void rtw89_fw_release_general_pkt_list(struct rtw89_dev *rtwdev, bool notify_fw)
 {
 	struct rtw89_vif *rtwvif;
 
 	rtw89_for_each_rtwvif(rtwdev, rtwvif)
 		rtw89_fw_release_general_pkt_list_vif(rtwdev, rtwvif, notify_fw);
 }
 
 #define H2C_GENERAL_PKT_LEN 6
 #define H2C_GENERAL_PKT_ID_UND 0xff
 int rtw89_fw_h2c_general_pkt(struct rtw89_dev *rtwdev,
 			     struct rtw89_vif *rtwvif, u8 macid)
 {
 	u8 pkt_id_ps_poll = H2C_GENERAL_PKT_ID_UND;
 	u8 pkt_id_null = H2C_GENERAL_PKT_ID_UND;
 	u8 pkt_id_qos_null = H2C_GENERAL_PKT_ID_UND;
 	struct sk_buff *skb;
 	int ret;
 
 	rtw89_fw_h2c_add_general_pkt(rtwdev, rtwvif,
 				     RTW89_PKT_OFLD_TYPE_PS_POLL, &pkt_id_ps_poll);
 	rtw89_fw_h2c_add_general_pkt(rtwdev, rtwvif,
 				     RTW89_PKT_OFLD_TYPE_NULL_DATA, &pkt_id_null);
 	rtw89_fw_h2c_add_general_pkt(rtwdev, rtwvif,
 				     RTW89_PKT_OFLD_TYPE_QOS_NULL, &pkt_id_qos_null);
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_GENERAL_PKT_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for fw dl\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_GENERAL_PKT_LEN);
 	SET_GENERAL_PKT_MACID(skb->data, macid);
 	SET_GENERAL_PKT_PROBRSP_ID(skb->data, H2C_GENERAL_PKT_ID_UND);
 	SET_GENERAL_PKT_PSPOLL_ID(skb->data, pkt_id_ps_poll);
 	SET_GENERAL_PKT_NULL_ID(skb->data, pkt_id_null);
 	SET_GENERAL_PKT_QOS_NULL_ID(skb->data, pkt_id_qos_null);
 	SET_GENERAL_PKT_CTS2SELF_ID(skb->data, H2C_GENERAL_PKT_ID_UND);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_FW_INFO,
 			      H2C_FUNC_MAC_GENERAL_PKT, 0, 1,
 			      H2C_GENERAL_PKT_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 #define H2C_LPS_PARM_LEN 8
 int rtw89_fw_h2c_lps_parm(struct rtw89_dev *rtwdev,
 			  struct rtw89_lps_parm *lps_param)
 {
 	struct sk_buff *skb;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_LPS_PARM_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for fw dl\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_LPS_PARM_LEN);
 
 	SET_LPS_PARM_MACID(skb->data, lps_param->macid);
 	SET_LPS_PARM_PSMODE(skb->data, lps_param->psmode);
 	SET_LPS_PARM_LASTRPWM(skb->data, lps_param->lastrpwm);
 	SET_LPS_PARM_RLBM(skb->data, 1);
 	SET_LPS_PARM_SMARTPS(skb->data, 1);
 	SET_LPS_PARM_AWAKEINTERVAL(skb->data, 1);
 	SET_LPS_PARM_VOUAPSD(skb->data, 0);
 	SET_LPS_PARM_VIUAPSD(skb->data, 0);
 	SET_LPS_PARM_BEUAPSD(skb->data, 0);
 	SET_LPS_PARM_BKUAPSD(skb->data, 0);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_MAC_PS,
 			      H2C_FUNC_MAC_LPS_PARM, 0, 1,
 			      H2C_LPS_PARM_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 #define H2C_P2P_ACT_LEN 20
 int rtw89_fw_h2c_p2p_act(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif,
 			 struct ieee80211_p2p_noa_desc *desc,
 			 u8 act, u8 noa_id)
 {
 	struct rtw89_vif *rtwvif = (struct rtw89_vif *)vif->drv_priv;
 	bool p2p_type_gc = rtwvif->wifi_role == RTW89_WIFI_ROLE_P2P_CLIENT;
 	u8 ctwindow_oppps = vif->bss_conf.p2p_noa_attr.oppps_ctwindow;
 	struct sk_buff *skb;
 	u8 *cmd;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_P2P_ACT_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c p2p act\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_P2P_ACT_LEN);
 	cmd = skb->data;
 
 	RTW89_SET_FWCMD_P2P_MACID(cmd, rtwvif->mac_id);
 	RTW89_SET_FWCMD_P2P_P2PID(cmd, 0);
 	RTW89_SET_FWCMD_P2P_NOAID(cmd, noa_id);
 	RTW89_SET_FWCMD_P2P_ACT(cmd, act);
 	RTW89_SET_FWCMD_P2P_TYPE(cmd, p2p_type_gc);
 	RTW89_SET_FWCMD_P2P_ALL_SLEP(cmd, 0);
 	if (desc) {
 		RTW89_SET_FWCMD_NOA_START_TIME(cmd, desc->start_time);
 		RTW89_SET_FWCMD_NOA_INTERVAL(cmd, desc->interval);
 		RTW89_SET_FWCMD_NOA_DURATION(cmd, desc->duration);
 		RTW89_SET_FWCMD_NOA_COUNT(cmd, desc->count);
 		RTW89_SET_FWCMD_NOA_CTWINDOW(cmd, ctwindow_oppps);
 	}
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC, H2C_CL_MAC_PS,
 			      H2C_FUNC_P2P_ACT, 0, 0,
 			      H2C_P2P_ACT_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 static void __rtw89_fw_h2c_set_tx_path(struct rtw89_dev *rtwdev,
 				       struct sk_buff *skb)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	struct rtw89_hal *hal = &rtwdev->hal;
 	u8 ntx_path;
 	u8 map_b;
 
 	if (chip->rf_path_num == 1) {
 		ntx_path = RF_A;
 		map_b = 0;
 	} else {
 		ntx_path = hal->antenna_tx ? hal->antenna_tx : RF_B;
 		map_b = hal->antenna_tx == RF_AB ? 1 : 0;
 	}
 
 	SET_CMC_TBL_NTX_PATH_EN(skb->data, ntx_path);
 	SET_CMC_TBL_PATH_MAP_A(skb->data, 0);
 	SET_CMC_TBL_PATH_MAP_B(skb->data, map_b);
 	SET_CMC_TBL_PATH_MAP_C(skb->data, 0);
 	SET_CMC_TBL_PATH_MAP_D(skb->data, 0);
 }
 
 #define H2C_CMC_TBL_LEN 68
 int rtw89_fw_h2c_default_cmac_tbl(struct rtw89_dev *rtwdev,
 				  struct rtw89_vif *rtwvif)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	struct sk_buff *skb;
 	u8 macid = rtwvif->mac_id;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_CMC_TBL_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for fw dl\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_CMC_TBL_LEN);
 	SET_CTRL_INFO_MACID(skb->data, macid);
 	SET_CTRL_INFO_OPERATION(skb->data, 1);
 	if (chip->h2c_cctl_func_id == H2C_FUNC_MAC_CCTLINFO_UD) {
 		SET_CMC_TBL_TXPWR_MODE(skb->data, 0);
 		__rtw89_fw_h2c_set_tx_path(rtwdev, skb);
 		SET_CMC_TBL_ANTSEL_A(skb->data, 0);
 		SET_CMC_TBL_ANTSEL_B(skb->data, 0);
 		SET_CMC_TBL_ANTSEL_C(skb->data, 0);
 		SET_CMC_TBL_ANTSEL_D(skb->data, 0);
 	}
 	SET_CMC_TBL_DOPPLER_CTRL(skb->data, 0);
 	SET_CMC_TBL_TXPWR_TOLERENCE(skb->data, 0);
 	if (rtwvif->net_type == RTW89_NET_TYPE_AP_MODE)
 		SET_CMC_TBL_DATA_DCM(skb->data, 0);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,
 			      chip->h2c_cctl_func_id, 0, 1,
 			      H2C_CMC_TBL_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 static void __get_sta_he_pkt_padding(struct rtw89_dev *rtwdev,
 				     struct ieee80211_sta *sta, u8 *pads)
 {
 	bool ppe_th;
 	u8 ppe16, ppe8;
 	u8 nss = min(sta->deflink.rx_nss, rtwdev->hal.tx_nss) - 1;
 	u8 ppe_thres_hdr = sta->deflink.he_cap.ppe_thres[0];
 	u8 ru_bitmap;
 	u8 n, idx, sh;
 	u16 ppe;
 	int i;
 
 	if (!sta->deflink.he_cap.has_he)
 		return;
 
 	ppe_th = FIELD_GET(IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
 			   sta->deflink.he_cap.he_cap_elem.phy_cap_info[6]);
 	if (!ppe_th) {
 		u8 pad;
 
 		pad = FIELD_GET(IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_MASK,
 				sta->deflink.he_cap.he_cap_elem.phy_cap_info[9]);
 
 		for (i = 0; i < RTW89_PPE_BW_NUM; i++)
 			pads[i] = pad;
 
 		return;
 	}
 
 	ru_bitmap = FIELD_GET(IEEE80211_PPE_THRES_RU_INDEX_BITMASK_MASK, ppe_thres_hdr);
 	n = hweight8(ru_bitmap);
 	n = 7 + (n * IEEE80211_PPE_THRES_INFO_PPET_SIZE * 2) * nss;
 
 	for (i = 0; i < RTW89_PPE_BW_NUM; i++) {
 		if (!(ru_bitmap & BIT(i))) {
 			pads[i] = 1;
 			continue;
 		}
 
 		idx = n >> 3;
 		sh = n & 7;
 		n += IEEE80211_PPE_THRES_INFO_PPET_SIZE * 2;
 
 		ppe = le16_to_cpu(*((__le16 *)&sta->deflink.he_cap.ppe_thres[idx]));
 		ppe16 = (ppe >> sh) & IEEE80211_PPE_THRES_NSS_MASK;
 		sh += IEEE80211_PPE_THRES_INFO_PPET_SIZE;
 		ppe8 = (ppe >> sh) & IEEE80211_PPE_THRES_NSS_MASK;
 
 		if (ppe16 != 7 && ppe8 == 7)
 			pads[i] = 2;
 		else if (ppe8 != 7)
 			pads[i] = 1;
 		else
 			pads[i] = 0;
 	}
 }
 
 int rtw89_fw_h2c_assoc_cmac_tbl(struct rtw89_dev *rtwdev,
 				struct ieee80211_vif *vif,
 				struct ieee80211_sta *sta)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	struct rtw89_sta *rtwsta = sta_to_rtwsta_safe(sta);
 	struct rtw89_vif *rtwvif = (struct rtw89_vif *)vif->drv_priv;
 	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, RTW89_SUB_ENTITY_0);
 	struct sk_buff *skb;
 	u8 pads[RTW89_PPE_BW_NUM];
 	u8 mac_id = rtwsta ? rtwsta->mac_id : rtwvif->mac_id;
 	u16 lowest_rate;
 	int ret;
 
 	memset(pads, 0, sizeof(pads));
 	if (sta)
 		__get_sta_he_pkt_padding(rtwdev, sta, pads);
 
 	if (vif->p2p)
 		lowest_rate = RTW89_HW_RATE_OFDM6;
 	else if (chan->band_type == RTW89_BAND_2G)
 		lowest_rate = RTW89_HW_RATE_CCK1;
 	else
 		lowest_rate = RTW89_HW_RATE_OFDM6;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_CMC_TBL_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for fw dl\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_CMC_TBL_LEN);
 	SET_CTRL_INFO_MACID(skb->data, mac_id);
 	SET_CTRL_INFO_OPERATION(skb->data, 1);
 	SET_CMC_TBL_DISRTSFB(skb->data, 1);
 	SET_CMC_TBL_DISDATAFB(skb->data, 1);
 	SET_CMC_TBL_RTS_RTY_LOWEST_RATE(skb->data, lowest_rate);
 	SET_CMC_TBL_RTS_TXCNT_LMT_SEL(skb->data, 0);
 	SET_CMC_TBL_DATA_TXCNT_LMT_SEL(skb->data, 0);
 	if (vif->type == NL80211_IFTYPE_STATION)
 		SET_CMC_TBL_ULDL(skb->data, 1);
 	else
 		SET_CMC_TBL_ULDL(skb->data, 0);
 	SET_CMC_TBL_MULTI_PORT_ID(skb->data, rtwvif->port);
 	if (chip->h2c_cctl_func_id == H2C_FUNC_MAC_CCTLINFO_UD_V1) {
 		SET_CMC_TBL_NOMINAL_PKT_PADDING_V1(skb->data, pads[RTW89_CHANNEL_WIDTH_20]);
 		SET_CMC_TBL_NOMINAL_PKT_PADDING40_V1(skb->data, pads[RTW89_CHANNEL_WIDTH_40]);
 		SET_CMC_TBL_NOMINAL_PKT_PADDING80_V1(skb->data, pads[RTW89_CHANNEL_WIDTH_80]);
 		SET_CMC_TBL_NOMINAL_PKT_PADDING160_V1(skb->data, pads[RTW89_CHANNEL_WIDTH_160]);
 	} else if (chip->h2c_cctl_func_id == H2C_FUNC_MAC_CCTLINFO_UD) {
 		SET_CMC_TBL_NOMINAL_PKT_PADDING(skb->data, pads[RTW89_CHANNEL_WIDTH_20]);
 		SET_CMC_TBL_NOMINAL_PKT_PADDING40(skb->data, pads[RTW89_CHANNEL_WIDTH_40]);
 		SET_CMC_TBL_NOMINAL_PKT_PADDING80(skb->data, pads[RTW89_CHANNEL_WIDTH_80]);
 		SET_CMC_TBL_NOMINAL_PKT_PADDING160(skb->data, pads[RTW89_CHANNEL_WIDTH_160]);
 	}
 	if (sta)
 		SET_CMC_TBL_BSR_QUEUE_SIZE_FORMAT(skb->data,
 						  sta->deflink.he_cap.has_he);
 	if (rtwvif->net_type == RTW89_NET_TYPE_AP_MODE)
 		SET_CMC_TBL_DATA_DCM(skb->data, 0);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,
 			      chip->h2c_cctl_func_id, 0, 1,
 			      H2C_CMC_TBL_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 int rtw89_fw_h2c_txtime_cmac_tbl(struct rtw89_dev *rtwdev,
 				 struct rtw89_sta *rtwsta)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	struct sk_buff *skb;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_CMC_TBL_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for fw dl\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_CMC_TBL_LEN);
 	SET_CTRL_INFO_MACID(skb->data, rtwsta->mac_id);
 	SET_CTRL_INFO_OPERATION(skb->data, 1);
 	if (rtwsta->cctl_tx_time) {
 		SET_CMC_TBL_AMPDU_TIME_SEL(skb->data, 1);
 		SET_CMC_TBL_AMPDU_MAX_TIME(skb->data, rtwsta->ampdu_max_time);
 	}
 	if (rtwsta->cctl_tx_retry_limit) {
 		SET_CMC_TBL_DATA_TXCNT_LMT_SEL(skb->data, 1);
 		SET_CMC_TBL_DATA_TX_CNT_LMT(skb->data, rtwsta->data_tx_cnt_lmt);
 	}
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,
 			      chip->h2c_cctl_func_id, 0, 1,
 			      H2C_CMC_TBL_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 int rtw89_fw_h2c_txpath_cmac_tbl(struct rtw89_dev *rtwdev,
 				 struct rtw89_sta *rtwsta)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	struct sk_buff *skb;
 	int ret;
 
 	if (chip->h2c_cctl_func_id != H2C_FUNC_MAC_CCTLINFO_UD)
 		return 0;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_CMC_TBL_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for fw dl\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_CMC_TBL_LEN);
 	SET_CTRL_INFO_MACID(skb->data, rtwsta->mac_id);
 	SET_CTRL_INFO_OPERATION(skb->data, 1);
 
 	__rtw89_fw_h2c_set_tx_path(rtwdev, skb);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,
 			      H2C_FUNC_MAC_CCTLINFO_UD, 0, 1,
 			      H2C_CMC_TBL_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 #define H2C_BCN_BASE_LEN 12
 int rtw89_fw_h2c_update_beacon(struct rtw89_dev *rtwdev,
 			       struct rtw89_vif *rtwvif)
 {
 	struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif);
 	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, RTW89_SUB_ENTITY_0);
 	struct sk_buff *skb;
 	struct sk_buff *skb_beacon;
 	u16 tim_offset;
 	int bcn_total_len;
 	u16 beacon_rate;
 	int ret;
 
 	if (vif->p2p)
 		beacon_rate = RTW89_HW_RATE_OFDM6;
 	else if (chan->band_type == RTW89_BAND_2G)
 		beacon_rate = RTW89_HW_RATE_CCK1;
 	else
 		beacon_rate = RTW89_HW_RATE_OFDM6;
 
 	skb_beacon = ieee80211_beacon_get_tim(rtwdev->hw, vif, &tim_offset,
 					      NULL, 0);
 	if (!skb_beacon) {
 		rtw89_err(rtwdev, "failed to get beacon skb\n");
 		return -ENOMEM;
 	}
 
 	bcn_total_len = H2C_BCN_BASE_LEN + skb_beacon->len;
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, bcn_total_len);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for fw dl\n");
 		dev_kfree_skb_any(skb_beacon);
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_BCN_BASE_LEN);
 
 	SET_BCN_UPD_PORT(skb->data, rtwvif->port);
 	SET_BCN_UPD_MBSSID(skb->data, 0);
 	SET_BCN_UPD_BAND(skb->data, rtwvif->mac_idx);
 	SET_BCN_UPD_GRP_IE_OFST(skb->data, tim_offset);
 	SET_BCN_UPD_MACID(skb->data, rtwvif->mac_id);
 	SET_BCN_UPD_SSN_SEL(skb->data, RTW89_MGMT_HW_SSN_SEL);
 	SET_BCN_UPD_SSN_MODE(skb->data, RTW89_MGMT_HW_SEQ_MODE);
 	SET_BCN_UPD_RATE(skb->data, beacon_rate);
 
 	skb_put_data(skb, skb_beacon->data, skb_beacon->len);
 	dev_kfree_skb_any(skb_beacon);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,
 			      H2C_FUNC_MAC_BCN_UPD, 0, 1,
 			      bcn_total_len);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		dev_kfree_skb_any(skb);
 		return ret;
 	}
 
 	return 0;
 }
 
 #define H2C_ROLE_MAINTAIN_LEN 4
 int rtw89_fw_h2c_role_maintain(struct rtw89_dev *rtwdev,
 			       struct rtw89_vif *rtwvif,
 			       struct rtw89_sta *rtwsta,
 			       enum rtw89_upd_mode upd_mode)
 {
 	struct sk_buff *skb;
 	u8 mac_id = rtwsta ? rtwsta->mac_id : rtwvif->mac_id;
 	u8 self_role;
 	int ret;
 
 	if (rtwvif->net_type == RTW89_NET_TYPE_AP_MODE) {
 		if (rtwsta)
 			self_role = RTW89_SELF_ROLE_AP_CLIENT;
 		else
 			self_role = rtwvif->self_role;
 	} else {
 		self_role = rtwvif->self_role;
 	}
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_ROLE_MAINTAIN_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c join\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_ROLE_MAINTAIN_LEN);
 	SET_FWROLE_MAINTAIN_MACID(skb->data, mac_id);
 	SET_FWROLE_MAINTAIN_SELF_ROLE(skb->data, self_role);
 	SET_FWROLE_MAINTAIN_UPD_MODE(skb->data, upd_mode);
 	SET_FWROLE_MAINTAIN_WIFI_ROLE(skb->data, rtwvif->wifi_role);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC, H2C_CL_MAC_MEDIA_RPT,
 			      H2C_FUNC_MAC_FWROLE_MAINTAIN, 0, 1,
 			      H2C_ROLE_MAINTAIN_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 #define H2C_JOIN_INFO_LEN 4
 int rtw89_fw_h2c_join_info(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif,
 			   struct rtw89_sta *rtwsta, bool dis_conn)
 {
 	struct sk_buff *skb;
 	u8 mac_id = rtwsta ? rtwsta->mac_id : rtwvif->mac_id;
 	u8 self_role = rtwvif->self_role;
 	u8 net_type = rtwvif->net_type;
 	int ret;
 
 	if (net_type == RTW89_NET_TYPE_AP_MODE && rtwsta) {
 		self_role = RTW89_SELF_ROLE_AP_CLIENT;
 		net_type = dis_conn ? RTW89_NET_TYPE_NO_LINK : net_type;
 	}
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_JOIN_INFO_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c join\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_JOIN_INFO_LEN);
 	SET_JOININFO_MACID(skb->data, mac_id);
 	SET_JOININFO_OP(skb->data, dis_conn);
 	SET_JOININFO_BAND(skb->data, rtwvif->mac_idx);
 	SET_JOININFO_WMM(skb->data, rtwvif->wmm);
 	SET_JOININFO_TGR(skb->data, rtwvif->trigger);
 	SET_JOININFO_ISHESTA(skb->data, 0);
 	SET_JOININFO_DLBW(skb->data, 0);
 	SET_JOININFO_TF_MAC_PAD(skb->data, 0);
 	SET_JOININFO_DL_T_PE(skb->data, 0);
 	SET_JOININFO_PORT_ID(skb->data, rtwvif->port);
 	SET_JOININFO_NET_TYPE(skb->data, net_type);
 	SET_JOININFO_WIFI_ROLE(skb->data, rtwvif->wifi_role);
 	SET_JOININFO_SELF_ROLE(skb->data, self_role);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC, H2C_CL_MAC_MEDIA_RPT,
 			      H2C_FUNC_MAC_JOININFO, 0, 1,
 			      H2C_JOIN_INFO_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 int rtw89_fw_h2c_macid_pause(struct rtw89_dev *rtwdev, u8 sh, u8 grp,
 			     bool pause)
 {
 	struct rtw89_fw_macid_pause_grp h2c = {{0}};
 	u8 len = sizeof(struct rtw89_fw_macid_pause_grp);
 	struct sk_buff *skb;
 	int ret;
 
 #if defined(__linux__)
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_JOIN_INFO_LEN);
 #elif defined(__FreeBSD__)
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);
 #endif
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c join\n");
 		return -ENOMEM;
 	}
 	h2c.mask_grp[grp] = cpu_to_le32(BIT(sh));
 	if (pause)
 		h2c.pause_grp[grp] = cpu_to_le32(BIT(sh));
 	skb_put_data(skb, &h2c, len);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,
 			      H2C_FUNC_MAC_MACID_PAUSE, 1, 0,
 			      len);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 #define H2C_EDCA_LEN 12
 int rtw89_fw_h2c_set_edca(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif,
 			  u8 ac, u32 val)
 {
 	struct sk_buff *skb;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_EDCA_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c edca\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_EDCA_LEN);
 	RTW89_SET_EDCA_SEL(skb->data, 0);
 	RTW89_SET_EDCA_BAND(skb->data, rtwvif->mac_idx);
 	RTW89_SET_EDCA_WMM(skb->data, 0);
 	RTW89_SET_EDCA_AC(skb->data, ac);
 	RTW89_SET_EDCA_PARAM(skb->data, val);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,
 			      H2C_FUNC_USR_EDCA, 0, 1,
 			      H2C_EDCA_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 #define H2C_TSF32_TOGL_LEN 4
 int rtw89_fw_h2c_tsf32_toggle(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif,
 			      bool en)
 {
 	struct sk_buff *skb;
 	u16 early_us = en ? 2000 : 0;
 	u8 *cmd;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_TSF32_TOGL_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c p2p act\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_TSF32_TOGL_LEN);
 	cmd = skb->data;
 
 	RTW89_SET_FWCMD_TSF32_TOGL_BAND(cmd, rtwvif->mac_idx);
 	RTW89_SET_FWCMD_TSF32_TOGL_EN(cmd, en);
 	RTW89_SET_FWCMD_TSF32_TOGL_PORT(cmd, rtwvif->port);
 	RTW89_SET_FWCMD_TSF32_TOGL_EARLY(cmd, early_us);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,
 			      H2C_FUNC_TSF32_TOGL, 0, 0,
 			      H2C_TSF32_TOGL_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 #define H2C_OFLD_CFG_LEN 8
 int rtw89_fw_h2c_set_ofld_cfg(struct rtw89_dev *rtwdev)
 {
 	static const u8 cfg[] = {0x09, 0x00, 0x00, 0x00, 0x5e, 0x00, 0x00, 0x00};
 	struct sk_buff *skb;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_OFLD_CFG_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c ofld\n");
 		return -ENOMEM;
 	}
 	skb_put_data(skb, cfg, H2C_OFLD_CFG_LEN);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,
 			      H2C_FUNC_OFLD_CFG, 0, 1,
 			      H2C_OFLD_CFG_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 int rtw89_fw_h2c_set_bcn_fltr_cfg(struct rtw89_dev *rtwdev,
 				  struct ieee80211_vif *vif,
 				  bool connect)
 {
 	struct rtw89_vif *rtwvif = vif_to_rtwvif_safe(vif);
 	struct ieee80211_bss_conf *bss_conf = vif ? &vif->bss_conf : NULL;
 	struct rtw89_h2c_bcnfltr *h2c;
 	u32 len = sizeof(*h2c);
 	struct sk_buff *skb;
 	int ret;
 
 	if (!RTW89_CHK_FW_FEATURE(BEACON_FILTER, &rtwdev->fw))
 		return -EINVAL;
 
 	if (!rtwvif || !bss_conf || rtwvif->net_type != RTW89_NET_TYPE_INFRA)
 		return -EINVAL;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c bcn filter\n");
 		return -ENOMEM;
 	}
 
 	skb_put(skb, len);
 	h2c = (struct rtw89_h2c_bcnfltr *)skb->data;
 
 	h2c->w0 = le32_encode_bits(connect, RTW89_H2C_BCNFLTR_W0_MON_RSSI) |
 		  le32_encode_bits(connect, RTW89_H2C_BCNFLTR_W0_MON_BCN) |
 		  le32_encode_bits(connect, RTW89_H2C_BCNFLTR_W0_MON_EN) |
 		  le32_encode_bits(RTW89_BCN_FLTR_OFFLOAD_MODE_DEFAULT,
 				   RTW89_H2C_BCNFLTR_W0_MODE) |
 		  le32_encode_bits(RTW89_BCN_LOSS_CNT, RTW89_H2C_BCNFLTR_W0_BCN_LOSS_CNT) |
 		  le32_encode_bits(bss_conf->cqm_rssi_hyst, RTW89_H2C_BCNFLTR_W0_RSSI_HYST) |
 		  le32_encode_bits(bss_conf->cqm_rssi_thold + MAX_RSSI,
 				   RTW89_H2C_BCNFLTR_W0_RSSI_THRESHOLD) |
 		  le32_encode_bits(rtwvif->mac_id, RTW89_H2C_BCNFLTR_W0_MAC_ID);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,
 			      H2C_FUNC_CFG_BCNFLTR, 0, 1, len);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 int rtw89_fw_h2c_rssi_offload(struct rtw89_dev *rtwdev,
 			      struct rtw89_rx_phy_ppdu *phy_ppdu)
 {
 	struct rtw89_h2c_ofld_rssi *h2c;
 	u32 len = sizeof(*h2c);
 	struct sk_buff *skb;
 	s8 rssi;
 	int ret;
 
 	if (!RTW89_CHK_FW_FEATURE(BEACON_FILTER, &rtwdev->fw))
 		return -EINVAL;
 
 	if (!phy_ppdu)
 		return -EINVAL;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c rssi\n");
 		return -ENOMEM;
 	}
 
 	rssi = phy_ppdu->rssi_avg >> RSSI_FACTOR;
 	skb_put(skb, len);
 	h2c = (struct rtw89_h2c_ofld_rssi *)skb->data;
 
 	h2c->w0 = le32_encode_bits(phy_ppdu->mac_id, RTW89_H2C_OFLD_RSSI_W0_MACID) |
 		  le32_encode_bits(1, RTW89_H2C_OFLD_RSSI_W0_NUM);
 	h2c->w1 = le32_encode_bits(rssi, RTW89_H2C_OFLD_RSSI_W1_VAL);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,
 			      H2C_FUNC_OFLD_RSSI, 0, 1, len);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 int rtw89_fw_h2c_tp_offload(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif)
 {
 	struct rtw89_traffic_stats *stats = &rtwvif->stats;
 	struct rtw89_h2c_ofld *h2c;
 	u32 len = sizeof(*h2c);
 	struct sk_buff *skb;
 	int ret;
 
 	if (rtwvif->net_type != RTW89_NET_TYPE_INFRA)
 		return -EINVAL;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c tp\n");
 		return -ENOMEM;
 	}
 
 	skb_put(skb, len);
 	h2c = (struct rtw89_h2c_ofld *)skb->data;
 
 	h2c->w0 = le32_encode_bits(rtwvif->mac_id, RTW89_H2C_OFLD_W0_MAC_ID) |
 		  le32_encode_bits(stats->tx_throughput, RTW89_H2C_OFLD_W0_TX_TP) |
 		  le32_encode_bits(stats->rx_throughput, RTW89_H2C_OFLD_W0_RX_TP);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,
 			      H2C_FUNC_OFLD_TP, 0, 1, len);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 int rtw89_fw_h2c_ra(struct rtw89_dev *rtwdev, struct rtw89_ra_info *ra, bool csi)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	struct rtw89_h2c_ra_v1 *h2c_v1;
 	struct rtw89_h2c_ra *h2c;
 	u32 len = sizeof(*h2c);
 	bool format_v1 = false;
 	struct sk_buff *skb;
 	int ret;
 
 	if (chip->chip_gen == RTW89_CHIP_BE) {
 		len = sizeof(*h2c_v1);
 		format_v1 = true;
 	}
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c join\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, len);
 	h2c = (struct rtw89_h2c_ra *)skb->data;
 	rtw89_debug(rtwdev, RTW89_DBG_RA,
 #if defined(__linux__)
 		    "ra cmd msk: %llx ", ra->ra_mask);
 #elif defined(__FreeBSD__)
 		    "ra cmd msk: %jx ", (uintmax_t)ra->ra_mask);
 #endif
 
 	h2c->w0 = le32_encode_bits(ra->mode_ctrl, RTW89_H2C_RA_W0_MODE) |
 		  le32_encode_bits(ra->bw_cap, RTW89_H2C_RA_W0_BW_CAP) |
 		  le32_encode_bits(ra->macid, RTW89_H2C_RA_W0_MACID) |
 		  le32_encode_bits(ra->dcm_cap, RTW89_H2C_RA_W0_DCM) |
 		  le32_encode_bits(ra->er_cap, RTW89_H2C_RA_W0_ER) |
 		  le32_encode_bits(ra->init_rate_lv, RTW89_H2C_RA_W0_INIT_RATE_LV) |
 		  le32_encode_bits(ra->upd_all, RTW89_H2C_RA_W0_UPD_ALL) |
 		  le32_encode_bits(ra->en_sgi, RTW89_H2C_RA_W0_SGI) |
 		  le32_encode_bits(ra->ldpc_cap, RTW89_H2C_RA_W0_LDPC) |
 		  le32_encode_bits(ra->stbc_cap, RTW89_H2C_RA_W0_STBC) |
 		  le32_encode_bits(ra->ss_num, RTW89_H2C_RA_W0_SS_NUM) |
 		  le32_encode_bits(ra->giltf, RTW89_H2C_RA_W0_GILTF) |
 		  le32_encode_bits(ra->upd_bw_nss_mask, RTW89_H2C_RA_W0_UPD_BW_NSS_MASK) |
 		  le32_encode_bits(ra->upd_mask, RTW89_H2C_RA_W0_UPD_MASK);
 	h2c->w1 = le32_encode_bits(ra->ra_mask, RTW89_H2C_RA_W1_RAMASK_LO32);
 	h2c->w2 = le32_encode_bits(ra->ra_mask >> 32, RTW89_H2C_RA_W2_RAMASK_HI32);
 	h2c->w3 = le32_encode_bits(ra->fix_giltf_en, RTW89_H2C_RA_W3_FIX_GILTF_EN) |
 		  le32_encode_bits(ra->fix_giltf, RTW89_H2C_RA_W3_FIX_GILTF);
 
 	if (!format_v1)
 		goto csi;
 
 	h2c_v1 = (struct rtw89_h2c_ra_v1 *)h2c;
 	h2c_v1->w4 = le32_encode_bits(ra->mode_ctrl, RTW89_H2C_RA_V1_W4_MODE_EHT) |
 		     le32_encode_bits(ra->bw_cap, RTW89_H2C_RA_V1_W4_BW_EHT);
 
 csi:
 	if (!csi)
 		goto done;
 
 	h2c->w2 |= le32_encode_bits(1, RTW89_H2C_RA_W2_BFEE_CSI_CTL);
 	h2c->w3 |= le32_encode_bits(ra->band_num, RTW89_H2C_RA_W3_BAND_NUM) |
 		   le32_encode_bits(ra->cr_tbl_sel, RTW89_H2C_RA_W3_CR_TBL_SEL) |
 		   le32_encode_bits(ra->fixed_csi_rate_en, RTW89_H2C_RA_W3_FIXED_CSI_RATE_EN) |
 		   le32_encode_bits(ra->ra_csi_rate_en, RTW89_H2C_RA_W3_RA_CSI_RATE_EN) |
 		   le32_encode_bits(ra->csi_mcs_ss_idx, RTW89_H2C_RA_W3_FIXED_CSI_MCS_SS_IDX) |
 		   le32_encode_bits(ra->csi_mode, RTW89_H2C_RA_W3_FIXED_CSI_MODE) |
 		   le32_encode_bits(ra->csi_gi_ltf, RTW89_H2C_RA_W3_FIXED_CSI_GI_LTF) |
 		   le32_encode_bits(ra->csi_bw, RTW89_H2C_RA_W3_FIXED_CSI_BW);
 
 done:
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_OUTSRC, H2C_CL_OUTSRC_RA,
 			      H2C_FUNC_OUTSRC_RA_MACIDCFG, 0, 0,
 			      len);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 int rtw89_fw_h2c_cxdrv_init(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_btc *btc = &rtwdev->btc;
 	struct rtw89_btc_dm *dm = &btc->dm;
 	struct rtw89_btc_init_info *init_info = &dm->init_info;
 	struct rtw89_btc_module *module = &init_info->module;
 	struct rtw89_btc_ant_info *ant = &module->ant;
 	struct rtw89_h2c_cxinit *h2c;
 	u32 len = sizeof(*h2c);
 	struct sk_buff *skb;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c cxdrv_init\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, len);
 	h2c = (struct rtw89_h2c_cxinit *)skb->data;
 
 	h2c->hdr.type = CXDRVINFO_INIT;
 	h2c->hdr.len = len - H2C_LEN_CXDRVHDR;
 
 	h2c->ant_type = ant->type;
 	h2c->ant_num = ant->num;
 	h2c->ant_iso = ant->isolation;
 	h2c->ant_info =
 		u8_encode_bits(ant->single_pos, RTW89_H2C_CXINIT_ANT_INFO_POS) |
 		u8_encode_bits(ant->diversity, RTW89_H2C_CXINIT_ANT_INFO_DIVERSITY) |
 		u8_encode_bits(ant->btg_pos, RTW89_H2C_CXINIT_ANT_INFO_BTG_POS) |
 		u8_encode_bits(ant->stream_cnt, RTW89_H2C_CXINIT_ANT_INFO_STREAM_CNT);
 
 	h2c->mod_rfe = module->rfe_type;
 	h2c->mod_cv = module->cv;
 	h2c->mod_info =
 		u8_encode_bits(module->bt_solo, RTW89_H2C_CXINIT_MOD_INFO_BT_SOLO) |
 		u8_encode_bits(module->bt_pos, RTW89_H2C_CXINIT_MOD_INFO_BT_POS) |
 		u8_encode_bits(module->switch_type, RTW89_H2C_CXINIT_MOD_INFO_SW_TYPE) |
 		u8_encode_bits(module->wa_type, RTW89_H2C_CXINIT_MOD_INFO_WA_TYPE);
 	h2c->mod_adie_kt = module->kt_ver_adie;
 	h2c->wl_gch = init_info->wl_guard_ch;
 
 	h2c->info =
 		u8_encode_bits(init_info->wl_only, RTW89_H2C_CXINIT_INFO_WL_ONLY) |
 		u8_encode_bits(init_info->wl_init_ok, RTW89_H2C_CXINIT_INFO_WL_INITOK) |
 		u8_encode_bits(init_info->dbcc_en, RTW89_H2C_CXINIT_INFO_DBCC_EN) |
 		u8_encode_bits(init_info->cx_other, RTW89_H2C_CXINIT_INFO_CX_OTHER) |
 		u8_encode_bits(init_info->bt_only, RTW89_H2C_CXINIT_INFO_BT_ONLY);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_OUTSRC, BTFC_SET,
 			      SET_DRV_INFO, 0, 0,
 			      len);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 #define PORT_DATA_OFFSET 4
 #define H2C_LEN_CXDRVINFO_ROLE_DBCC_LEN 12
 #define H2C_LEN_CXDRVINFO_ROLE_SIZE(max_role_num) \
 	(4 + 12 * (max_role_num) + H2C_LEN_CXDRVHDR)
 
 int rtw89_fw_h2c_cxdrv_role(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_btc *btc = &rtwdev->btc;
 	const struct rtw89_btc_ver *ver = btc->ver;
 	struct rtw89_btc_wl_info *wl = &btc->cx.wl;
 	struct rtw89_btc_wl_role_info *role_info = &wl->role_info;
 	struct rtw89_btc_wl_role_info_bpos *bpos = &role_info->role_map.role;
 	struct rtw89_btc_wl_active_role *active = role_info->active_role;
 	struct sk_buff *skb;
 	u32 len;
 	u8 offset = 0;
 	u8 *cmd;
 	int ret;
 	int i;
 
 	len = H2C_LEN_CXDRVINFO_ROLE_SIZE(ver->max_role_num);
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c cxdrv_role\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, len);
 	cmd = skb->data;
 
 	RTW89_SET_FWCMD_CXHDR_TYPE(cmd, CXDRVINFO_ROLE);
 	RTW89_SET_FWCMD_CXHDR_LEN(cmd, len - H2C_LEN_CXDRVHDR);
 
 	RTW89_SET_FWCMD_CXROLE_CONNECT_CNT(cmd, role_info->connect_cnt);
 	RTW89_SET_FWCMD_CXROLE_LINK_MODE(cmd, role_info->link_mode);
 
 	RTW89_SET_FWCMD_CXROLE_ROLE_NONE(cmd, bpos->none);
 	RTW89_SET_FWCMD_CXROLE_ROLE_STA(cmd, bpos->station);
 	RTW89_SET_FWCMD_CXROLE_ROLE_AP(cmd, bpos->ap);
 	RTW89_SET_FWCMD_CXROLE_ROLE_VAP(cmd, bpos->vap);
 	RTW89_SET_FWCMD_CXROLE_ROLE_ADHOC(cmd, bpos->adhoc);
 	RTW89_SET_FWCMD_CXROLE_ROLE_ADHOC_MASTER(cmd, bpos->adhoc_master);
 	RTW89_SET_FWCMD_CXROLE_ROLE_MESH(cmd, bpos->mesh);
 	RTW89_SET_FWCMD_CXROLE_ROLE_MONITOR(cmd, bpos->moniter);
 	RTW89_SET_FWCMD_CXROLE_ROLE_P2P_DEV(cmd, bpos->p2p_device);
 	RTW89_SET_FWCMD_CXROLE_ROLE_P2P_GC(cmd, bpos->p2p_gc);
 	RTW89_SET_FWCMD_CXROLE_ROLE_P2P_GO(cmd, bpos->p2p_go);
 	RTW89_SET_FWCMD_CXROLE_ROLE_NAN(cmd, bpos->nan);
 
 	for (i = 0; i < RTW89_PORT_NUM; i++, active++) {
 		RTW89_SET_FWCMD_CXROLE_ACT_CONNECTED(cmd, active->connected, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_PID(cmd, active->pid, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_PHY(cmd, active->phy, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_NOA(cmd, active->noa, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_BAND(cmd, active->band, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_CLIENT_PS(cmd, active->client_ps, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_BW(cmd, active->bw, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_ROLE(cmd, active->role, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_CH(cmd, active->ch, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_TX_LVL(cmd, active->tx_lvl, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_RX_LVL(cmd, active->rx_lvl, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_TX_RATE(cmd, active->tx_rate, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_RX_RATE(cmd, active->rx_rate, i, offset);
 	}
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_OUTSRC, BTFC_SET,
 			      SET_DRV_INFO, 0, 0,
 			      len);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 #define H2C_LEN_CXDRVINFO_ROLE_SIZE_V1(max_role_num) \
 	(4 + 16 * (max_role_num) + H2C_LEN_CXDRVINFO_ROLE_DBCC_LEN + H2C_LEN_CXDRVHDR)
 
 int rtw89_fw_h2c_cxdrv_role_v1(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_btc *btc = &rtwdev->btc;
 	const struct rtw89_btc_ver *ver = btc->ver;
 	struct rtw89_btc_wl_info *wl = &btc->cx.wl;
 	struct rtw89_btc_wl_role_info_v1 *role_info = &wl->role_info_v1;
 	struct rtw89_btc_wl_role_info_bpos *bpos = &role_info->role_map.role;
 	struct rtw89_btc_wl_active_role_v1 *active = role_info->active_role_v1;
 	struct sk_buff *skb;
 	u32 len;
 	u8 *cmd, offset;
 	int ret;
 	int i;
 
 	len = H2C_LEN_CXDRVINFO_ROLE_SIZE_V1(ver->max_role_num);
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c cxdrv_role\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, len);
 	cmd = skb->data;
 
 	RTW89_SET_FWCMD_CXHDR_TYPE(cmd, CXDRVINFO_ROLE);
 	RTW89_SET_FWCMD_CXHDR_LEN(cmd, len - H2C_LEN_CXDRVHDR);
 
 	RTW89_SET_FWCMD_CXROLE_CONNECT_CNT(cmd, role_info->connect_cnt);
 	RTW89_SET_FWCMD_CXROLE_LINK_MODE(cmd, role_info->link_mode);
 
 	RTW89_SET_FWCMD_CXROLE_ROLE_NONE(cmd, bpos->none);
 	RTW89_SET_FWCMD_CXROLE_ROLE_STA(cmd, bpos->station);
 	RTW89_SET_FWCMD_CXROLE_ROLE_AP(cmd, bpos->ap);
 	RTW89_SET_FWCMD_CXROLE_ROLE_VAP(cmd, bpos->vap);
 	RTW89_SET_FWCMD_CXROLE_ROLE_ADHOC(cmd, bpos->adhoc);
 	RTW89_SET_FWCMD_CXROLE_ROLE_ADHOC_MASTER(cmd, bpos->adhoc_master);
 	RTW89_SET_FWCMD_CXROLE_ROLE_MESH(cmd, bpos->mesh);
 	RTW89_SET_FWCMD_CXROLE_ROLE_MONITOR(cmd, bpos->moniter);
 	RTW89_SET_FWCMD_CXROLE_ROLE_P2P_DEV(cmd, bpos->p2p_device);
 	RTW89_SET_FWCMD_CXROLE_ROLE_P2P_GC(cmd, bpos->p2p_gc);
 	RTW89_SET_FWCMD_CXROLE_ROLE_P2P_GO(cmd, bpos->p2p_go);
 	RTW89_SET_FWCMD_CXROLE_ROLE_NAN(cmd, bpos->nan);
 
 	offset = PORT_DATA_OFFSET;
 	for (i = 0; i < RTW89_PORT_NUM; i++, active++) {
 		RTW89_SET_FWCMD_CXROLE_ACT_CONNECTED(cmd, active->connected, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_PID(cmd, active->pid, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_PHY(cmd, active->phy, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_NOA(cmd, active->noa, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_BAND(cmd, active->band, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_CLIENT_PS(cmd, active->client_ps, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_BW(cmd, active->bw, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_ROLE(cmd, active->role, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_CH(cmd, active->ch, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_TX_LVL(cmd, active->tx_lvl, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_RX_LVL(cmd, active->rx_lvl, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_TX_RATE(cmd, active->tx_rate, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_RX_RATE(cmd, active->rx_rate, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_NOA_DUR(cmd, active->noa_duration, i, offset);
 	}
 
 	offset = len - H2C_LEN_CXDRVINFO_ROLE_DBCC_LEN;
 	RTW89_SET_FWCMD_CXROLE_MROLE_TYPE(cmd, role_info->mrole_type, offset);
 	RTW89_SET_FWCMD_CXROLE_MROLE_NOA(cmd, role_info->mrole_noa_duration, offset);
 	RTW89_SET_FWCMD_CXROLE_DBCC_EN(cmd, role_info->dbcc_en, offset);
 	RTW89_SET_FWCMD_CXROLE_DBCC_CHG(cmd, role_info->dbcc_chg, offset);
 	RTW89_SET_FWCMD_CXROLE_DBCC_2G_PHY(cmd, role_info->dbcc_2g_phy, offset);
 	RTW89_SET_FWCMD_CXROLE_LINK_MODE_CHG(cmd, role_info->link_mode_chg, offset);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_OUTSRC, BTFC_SET,
 			      SET_DRV_INFO, 0, 0,
 			      len);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 #define H2C_LEN_CXDRVINFO_ROLE_SIZE_V2(max_role_num) \
 	(4 + 8 * (max_role_num) + H2C_LEN_CXDRVINFO_ROLE_DBCC_LEN + H2C_LEN_CXDRVHDR)
 
 int rtw89_fw_h2c_cxdrv_role_v2(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_btc *btc = &rtwdev->btc;
 	const struct rtw89_btc_ver *ver = btc->ver;
 	struct rtw89_btc_wl_info *wl = &btc->cx.wl;
 	struct rtw89_btc_wl_role_info_v2 *role_info = &wl->role_info_v2;
 	struct rtw89_btc_wl_role_info_bpos *bpos = &role_info->role_map.role;
 	struct rtw89_btc_wl_active_role_v2 *active = role_info->active_role_v2;
 	struct sk_buff *skb;
 	u32 len;
 	u8 *cmd, offset;
 	int ret;
 	int i;
 
 	len = H2C_LEN_CXDRVINFO_ROLE_SIZE_V2(ver->max_role_num);
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c cxdrv_role\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, len);
 	cmd = skb->data;
 
 	RTW89_SET_FWCMD_CXHDR_TYPE(cmd, CXDRVINFO_ROLE);
 	RTW89_SET_FWCMD_CXHDR_LEN(cmd, len - H2C_LEN_CXDRVHDR);
 
 	RTW89_SET_FWCMD_CXROLE_CONNECT_CNT(cmd, role_info->connect_cnt);
 	RTW89_SET_FWCMD_CXROLE_LINK_MODE(cmd, role_info->link_mode);
 
 	RTW89_SET_FWCMD_CXROLE_ROLE_NONE(cmd, bpos->none);
 	RTW89_SET_FWCMD_CXROLE_ROLE_STA(cmd, bpos->station);
 	RTW89_SET_FWCMD_CXROLE_ROLE_AP(cmd, bpos->ap);
 	RTW89_SET_FWCMD_CXROLE_ROLE_VAP(cmd, bpos->vap);
 	RTW89_SET_FWCMD_CXROLE_ROLE_ADHOC(cmd, bpos->adhoc);
 	RTW89_SET_FWCMD_CXROLE_ROLE_ADHOC_MASTER(cmd, bpos->adhoc_master);
 	RTW89_SET_FWCMD_CXROLE_ROLE_MESH(cmd, bpos->mesh);
 	RTW89_SET_FWCMD_CXROLE_ROLE_MONITOR(cmd, bpos->moniter);
 	RTW89_SET_FWCMD_CXROLE_ROLE_P2P_DEV(cmd, bpos->p2p_device);
 	RTW89_SET_FWCMD_CXROLE_ROLE_P2P_GC(cmd, bpos->p2p_gc);
 	RTW89_SET_FWCMD_CXROLE_ROLE_P2P_GO(cmd, bpos->p2p_go);
 	RTW89_SET_FWCMD_CXROLE_ROLE_NAN(cmd, bpos->nan);
 
 	offset = PORT_DATA_OFFSET;
 	for (i = 0; i < RTW89_PORT_NUM; i++, active++) {
 		RTW89_SET_FWCMD_CXROLE_ACT_CONNECTED_V2(cmd, active->connected, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_PID_V2(cmd, active->pid, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_PHY_V2(cmd, active->phy, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_NOA_V2(cmd, active->noa, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_BAND_V2(cmd, active->band, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_CLIENT_PS_V2(cmd, active->client_ps, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_BW_V2(cmd, active->bw, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_ROLE_V2(cmd, active->role, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_CH_V2(cmd, active->ch, i, offset);
 		RTW89_SET_FWCMD_CXROLE_ACT_NOA_DUR_V2(cmd, active->noa_duration, i, offset);
 	}
 
 	offset = len - H2C_LEN_CXDRVINFO_ROLE_DBCC_LEN;
 	RTW89_SET_FWCMD_CXROLE_MROLE_TYPE(cmd, role_info->mrole_type, offset);
 	RTW89_SET_FWCMD_CXROLE_MROLE_NOA(cmd, role_info->mrole_noa_duration, offset);
 	RTW89_SET_FWCMD_CXROLE_DBCC_EN(cmd, role_info->dbcc_en, offset);
 	RTW89_SET_FWCMD_CXROLE_DBCC_CHG(cmd, role_info->dbcc_chg, offset);
 	RTW89_SET_FWCMD_CXROLE_DBCC_2G_PHY(cmd, role_info->dbcc_2g_phy, offset);
 	RTW89_SET_FWCMD_CXROLE_LINK_MODE_CHG(cmd, role_info->link_mode_chg, offset);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_OUTSRC, BTFC_SET,
 			      SET_DRV_INFO, 0, 0,
 			      len);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 #define H2C_LEN_CXDRVINFO_CTRL (4 + H2C_LEN_CXDRVHDR)
 int rtw89_fw_h2c_cxdrv_ctrl(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_btc *btc = &rtwdev->btc;
 	const struct rtw89_btc_ver *ver = btc->ver;
 	struct rtw89_btc_ctrl *ctrl = &btc->ctrl;
 	struct sk_buff *skb;
 	u8 *cmd;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_LEN_CXDRVINFO_CTRL);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c cxdrv_ctrl\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_LEN_CXDRVINFO_CTRL);
 	cmd = skb->data;
 
 	RTW89_SET_FWCMD_CXHDR_TYPE(cmd, CXDRVINFO_CTRL);
 	RTW89_SET_FWCMD_CXHDR_LEN(cmd, H2C_LEN_CXDRVINFO_CTRL - H2C_LEN_CXDRVHDR);
 
 	RTW89_SET_FWCMD_CXCTRL_MANUAL(cmd, ctrl->manual);
 	RTW89_SET_FWCMD_CXCTRL_IGNORE_BT(cmd, ctrl->igno_bt);
 	RTW89_SET_FWCMD_CXCTRL_ALWAYS_FREERUN(cmd, ctrl->always_freerun);
 	if (ver->fcxctrl == 0)
 		RTW89_SET_FWCMD_CXCTRL_TRACE_STEP(cmd, ctrl->trace_step);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_OUTSRC, BTFC_SET,
 			      SET_DRV_INFO, 0, 0,
 			      H2C_LEN_CXDRVINFO_CTRL);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 #define H2C_LEN_CXDRVINFO_TRX (28 + H2C_LEN_CXDRVHDR)
 int rtw89_fw_h2c_cxdrv_trx(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_btc *btc = &rtwdev->btc;
 	struct rtw89_btc_trx_info *trx = &btc->dm.trx_info;
 	struct sk_buff *skb;
 	u8 *cmd;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_LEN_CXDRVINFO_TRX);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c cxdrv_trx\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_LEN_CXDRVINFO_TRX);
 	cmd = skb->data;
 
 	RTW89_SET_FWCMD_CXHDR_TYPE(cmd, CXDRVINFO_TRX);
 	RTW89_SET_FWCMD_CXHDR_LEN(cmd, H2C_LEN_CXDRVINFO_TRX - H2C_LEN_CXDRVHDR);
 
 	RTW89_SET_FWCMD_CXTRX_TXLV(cmd, trx->tx_lvl);
 	RTW89_SET_FWCMD_CXTRX_RXLV(cmd, trx->rx_lvl);
 	RTW89_SET_FWCMD_CXTRX_WLRSSI(cmd, trx->wl_rssi);
 	RTW89_SET_FWCMD_CXTRX_BTRSSI(cmd, trx->bt_rssi);
 	RTW89_SET_FWCMD_CXTRX_TXPWR(cmd, trx->tx_power);
 	RTW89_SET_FWCMD_CXTRX_RXGAIN(cmd, trx->rx_gain);
 	RTW89_SET_FWCMD_CXTRX_BTTXPWR(cmd, trx->bt_tx_power);
 	RTW89_SET_FWCMD_CXTRX_BTRXGAIN(cmd, trx->bt_rx_gain);
 	RTW89_SET_FWCMD_CXTRX_CN(cmd, trx->cn);
 	RTW89_SET_FWCMD_CXTRX_NHM(cmd, trx->nhm);
 	RTW89_SET_FWCMD_CXTRX_BTPROFILE(cmd, trx->bt_profile);
 	RTW89_SET_FWCMD_CXTRX_RSVD2(cmd, trx->rsvd2);
 	RTW89_SET_FWCMD_CXTRX_TXRATE(cmd, trx->tx_rate);
 	RTW89_SET_FWCMD_CXTRX_RXRATE(cmd, trx->rx_rate);
 	RTW89_SET_FWCMD_CXTRX_TXTP(cmd, trx->tx_tp);
 	RTW89_SET_FWCMD_CXTRX_RXTP(cmd, trx->rx_tp);
 	RTW89_SET_FWCMD_CXTRX_RXERRRA(cmd, trx->rx_err_ratio);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_OUTSRC, BTFC_SET,
 			      SET_DRV_INFO, 0, 0,
 			      H2C_LEN_CXDRVINFO_TRX);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 #define H2C_LEN_CXDRVINFO_RFK (4 + H2C_LEN_CXDRVHDR)
 int rtw89_fw_h2c_cxdrv_rfk(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_btc *btc = &rtwdev->btc;
 	struct rtw89_btc_wl_info *wl = &btc->cx.wl;
 	struct rtw89_btc_wl_rfk_info *rfk_info = &wl->rfk_info;
 	struct sk_buff *skb;
 	u8 *cmd;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_LEN_CXDRVINFO_RFK);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c cxdrv_ctrl\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_LEN_CXDRVINFO_RFK);
 	cmd = skb->data;
 
 	RTW89_SET_FWCMD_CXHDR_TYPE(cmd, CXDRVINFO_RFK);
 	RTW89_SET_FWCMD_CXHDR_LEN(cmd, H2C_LEN_CXDRVINFO_RFK - H2C_LEN_CXDRVHDR);
 
 	RTW89_SET_FWCMD_CXRFK_STATE(cmd, rfk_info->state);
 	RTW89_SET_FWCMD_CXRFK_PATH_MAP(cmd, rfk_info->path_map);
 	RTW89_SET_FWCMD_CXRFK_PHY_MAP(cmd, rfk_info->phy_map);
 	RTW89_SET_FWCMD_CXRFK_BAND(cmd, rfk_info->band);
 	RTW89_SET_FWCMD_CXRFK_TYPE(cmd, rfk_info->type);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_OUTSRC, BTFC_SET,
 			      SET_DRV_INFO, 0, 0,
 			      H2C_LEN_CXDRVINFO_RFK);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 #define H2C_LEN_PKT_OFLD 4
 int rtw89_fw_h2c_del_pkt_offload(struct rtw89_dev *rtwdev, u8 id)
 {
 	struct rtw89_wait_info *wait = &rtwdev->mac.fw_ofld_wait;
 	struct sk_buff *skb;
 	unsigned int cond;
 	u8 *cmd;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_LEN_PKT_OFLD);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c pkt offload\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_LEN_PKT_OFLD);
 	cmd = skb->data;
 
 	RTW89_SET_FWCMD_PACKET_OFLD_PKT_IDX(cmd, id);
 	RTW89_SET_FWCMD_PACKET_OFLD_PKT_OP(cmd, RTW89_PKT_OFLD_OP_DEL);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,
 			      H2C_FUNC_PACKET_OFLD, 1, 1,
 			      H2C_LEN_PKT_OFLD);
 
 	cond = RTW89_FW_OFLD_WAIT_COND_PKT_OFLD(id, RTW89_PKT_OFLD_OP_DEL);
 
 	ret = rtw89_h2c_tx_and_wait(rtwdev, skb, wait, cond);
 	if (ret < 0) {
 		rtw89_debug(rtwdev, RTW89_DBG_FW,
 			    "failed to del pkt ofld: id %d, ret %d\n",
 			    id, ret);
 		return ret;
 	}
 
 	rtw89_core_release_bit_map(rtwdev->pkt_offload, id);
 	return 0;
 }
 
 int rtw89_fw_h2c_add_pkt_offload(struct rtw89_dev *rtwdev, u8 *id,
 				 struct sk_buff *skb_ofld)
 {
 	struct rtw89_wait_info *wait = &rtwdev->mac.fw_ofld_wait;
 	struct sk_buff *skb;
 	unsigned int cond;
 	u8 *cmd;
 	u8 alloc_id;
 	int ret;
 
 	alloc_id = rtw89_core_acquire_bit_map(rtwdev->pkt_offload,
 					      RTW89_MAX_PKT_OFLD_NUM);
 	if (alloc_id == RTW89_MAX_PKT_OFLD_NUM)
 		return -ENOSPC;
 
 	*id = alloc_id;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_LEN_PKT_OFLD + skb_ofld->len);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c pkt offload\n");
 		rtw89_core_release_bit_map(rtwdev->pkt_offload, alloc_id);
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_LEN_PKT_OFLD);
 	cmd = skb->data;
 
 	RTW89_SET_FWCMD_PACKET_OFLD_PKT_IDX(cmd, alloc_id);
 	RTW89_SET_FWCMD_PACKET_OFLD_PKT_OP(cmd, RTW89_PKT_OFLD_OP_ADD);
 	RTW89_SET_FWCMD_PACKET_OFLD_PKT_LENGTH(cmd, skb_ofld->len);
 	skb_put_data(skb, skb_ofld->data, skb_ofld->len);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,
 			      H2C_FUNC_PACKET_OFLD, 1, 1,
 			      H2C_LEN_PKT_OFLD + skb_ofld->len);
 
 	cond = RTW89_FW_OFLD_WAIT_COND_PKT_OFLD(alloc_id, RTW89_PKT_OFLD_OP_ADD);
 
 	ret = rtw89_h2c_tx_and_wait(rtwdev, skb, wait, cond);
 	if (ret < 0) {
 		rtw89_debug(rtwdev, RTW89_DBG_FW,
 			    "failed to add pkt ofld: id %d, ret %d\n",
 			    alloc_id, ret);
 		rtw89_core_release_bit_map(rtwdev->pkt_offload, alloc_id);
 		return ret;
 	}
 
 	return 0;
 }
 
 #define H2C_LEN_SCAN_LIST_OFFLOAD 4
 int rtw89_fw_h2c_scan_list_offload(struct rtw89_dev *rtwdev, int len,
 				   struct list_head *chan_list)
 {
 	struct rtw89_wait_info *wait = &rtwdev->mac.fw_ofld_wait;
 	struct rtw89_mac_chinfo *ch_info;
 	struct sk_buff *skb;
 	int skb_len = H2C_LEN_SCAN_LIST_OFFLOAD + len * RTW89_MAC_CHINFO_SIZE;
 	unsigned int cond;
 	u8 *cmd;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, skb_len);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c scan list\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, H2C_LEN_SCAN_LIST_OFFLOAD);
 	cmd = skb->data;
 
 	RTW89_SET_FWCMD_SCANOFLD_CH_NUM(cmd, len);
 	/* in unit of 4 bytes */
 	RTW89_SET_FWCMD_SCANOFLD_CH_SIZE(cmd, RTW89_MAC_CHINFO_SIZE / 4);
 
 	list_for_each_entry(ch_info, chan_list, list) {
 		cmd = skb_put(skb, RTW89_MAC_CHINFO_SIZE);
 
 		RTW89_SET_FWCMD_CHINFO_PERIOD(cmd, ch_info->period);
 		RTW89_SET_FWCMD_CHINFO_DWELL(cmd, ch_info->dwell_time);
 		RTW89_SET_FWCMD_CHINFO_CENTER_CH(cmd, ch_info->central_ch);
 		RTW89_SET_FWCMD_CHINFO_PRI_CH(cmd, ch_info->pri_ch);
 		RTW89_SET_FWCMD_CHINFO_BW(cmd, ch_info->bw);
 		RTW89_SET_FWCMD_CHINFO_ACTION(cmd, ch_info->notify_action);
 		RTW89_SET_FWCMD_CHINFO_NUM_PKT(cmd, ch_info->num_pkt);
 		RTW89_SET_FWCMD_CHINFO_TX(cmd, ch_info->tx_pkt);
 		RTW89_SET_FWCMD_CHINFO_PAUSE_DATA(cmd, ch_info->pause_data);
 		RTW89_SET_FWCMD_CHINFO_BAND(cmd, ch_info->ch_band);
 		RTW89_SET_FWCMD_CHINFO_PKT_ID(cmd, ch_info->probe_id);
 		RTW89_SET_FWCMD_CHINFO_DFS(cmd, ch_info->dfs_ch);
 		RTW89_SET_FWCMD_CHINFO_TX_NULL(cmd, ch_info->tx_null);
 		RTW89_SET_FWCMD_CHINFO_RANDOM(cmd, ch_info->rand_seq_num);
 		RTW89_SET_FWCMD_CHINFO_PKT0(cmd, ch_info->pkt_id[0]);
 		RTW89_SET_FWCMD_CHINFO_PKT1(cmd, ch_info->pkt_id[1]);
 		RTW89_SET_FWCMD_CHINFO_PKT2(cmd, ch_info->pkt_id[2]);
 		RTW89_SET_FWCMD_CHINFO_PKT3(cmd, ch_info->pkt_id[3]);
 		RTW89_SET_FWCMD_CHINFO_PKT4(cmd, ch_info->pkt_id[4]);
 		RTW89_SET_FWCMD_CHINFO_PKT5(cmd, ch_info->pkt_id[5]);
 		RTW89_SET_FWCMD_CHINFO_PKT6(cmd, ch_info->pkt_id[6]);
 		RTW89_SET_FWCMD_CHINFO_PKT7(cmd, ch_info->pkt_id[7]);
 	}
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,
 			      H2C_FUNC_ADD_SCANOFLD_CH, 1, 1, skb_len);
 
 	cond = RTW89_FW_OFLD_WAIT_COND(0, H2C_FUNC_ADD_SCANOFLD_CH);
 
 	ret = rtw89_h2c_tx_and_wait(rtwdev, skb, wait, cond);
 	if (ret) {
 		rtw89_debug(rtwdev, RTW89_DBG_FW, "failed to add scan ofld ch\n");
 		return ret;
 	}
 
 	return 0;
 }
 
 int rtw89_fw_h2c_scan_offload(struct rtw89_dev *rtwdev,
 			      struct rtw89_scan_option *option,
 			      struct rtw89_vif *rtwvif)
 {
 	struct rtw89_wait_info *wait = &rtwdev->mac.fw_ofld_wait;
 	struct rtw89_chan *op = &rtwdev->scan_info.op_chan;
 	struct rtw89_h2c_scanofld *h2c;
 	u32 len = sizeof(*h2c);
 	struct sk_buff *skb;
 	unsigned int cond;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c scan offload\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, len);
 	h2c = (struct rtw89_h2c_scanofld *)skb->data;
 
 	h2c->w0 = le32_encode_bits(rtwvif->mac_id, RTW89_H2C_SCANOFLD_W0_MACID) |
 		  le32_encode_bits(rtwvif->port, RTW89_H2C_SCANOFLD_W0_PORT_ID) |
 		  le32_encode_bits(RTW89_PHY_0, RTW89_H2C_SCANOFLD_W0_BAND) |
 		  le32_encode_bits(option->enable, RTW89_H2C_SCANOFLD_W0_OPERATION);
 
 	h2c->w1 = le32_encode_bits(true, RTW89_H2C_SCANOFLD_W1_NOTIFY_END) |
 		  le32_encode_bits(option->target_ch_mode,
 				   RTW89_H2C_SCANOFLD_W1_TARGET_CH_MODE) |
 		  le32_encode_bits(RTW89_SCAN_IMMEDIATE,
 				   RTW89_H2C_SCANOFLD_W1_START_MODE) |
 		  le32_encode_bits(RTW89_SCAN_ONCE, RTW89_H2C_SCANOFLD_W1_SCAN_TYPE);
 
 	if (option->target_ch_mode) {
 		h2c->w1 |= le32_encode_bits(op->band_width,
 					    RTW89_H2C_SCANOFLD_W1_TARGET_CH_BW) |
 			   le32_encode_bits(op->primary_channel,
 					    RTW89_H2C_SCANOFLD_W1_TARGET_PRI_CH) |
 			   le32_encode_bits(op->channel,
 					    RTW89_H2C_SCANOFLD_W1_TARGET_CENTRAL_CH);
 		h2c->w0 |= le32_encode_bits(op->band_type,
 					    RTW89_H2C_SCANOFLD_W0_TARGET_CH_BAND);
 	}
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,
 			      H2C_FUNC_SCANOFLD, 1, 1,
 			      len);
 
 	cond = RTW89_FW_OFLD_WAIT_COND(0, H2C_FUNC_SCANOFLD);
 
 	ret = rtw89_h2c_tx_and_wait(rtwdev, skb, wait, cond);
 	if (ret) {
 		rtw89_debug(rtwdev, RTW89_DBG_FW, "failed to scan ofld\n");
 		return ret;
 	}
 
 	return 0;
 }
 
 int rtw89_fw_h2c_rf_reg(struct rtw89_dev *rtwdev,
 			struct rtw89_fw_h2c_rf_reg_info *info,
 			u16 len, u8 page)
 {
 	struct sk_buff *skb;
 	u8 class = info->rf_path == RF_PATH_A ?
 		   H2C_CL_OUTSRC_RF_REG_A : H2C_CL_OUTSRC_RF_REG_B;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c rf reg\n");
 		return -ENOMEM;
 	}
 	skb_put_data(skb, info->rtw89_phy_config_rf_h2c[page], len);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_OUTSRC, class, page, 0, 0,
 			      len);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 int rtw89_fw_h2c_rf_ntfy_mcc(struct rtw89_dev *rtwdev)
 {
 	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, RTW89_SUB_ENTITY_0);
 	struct rtw89_rfk_mcc_info *rfk_mcc = &rtwdev->rfk_mcc;
 	struct rtw89_fw_h2c_rf_get_mccch *mccch;
 	struct sk_buff *skb;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, sizeof(*mccch));
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c cxdrv_ctrl\n");
 		return -ENOMEM;
 	}
 	skb_put(skb, sizeof(*mccch));
 	mccch = (struct rtw89_fw_h2c_rf_get_mccch *)skb->data;
 
 	mccch->ch_0 = cpu_to_le32(rfk_mcc->ch[0]);
 	mccch->ch_1 = cpu_to_le32(rfk_mcc->ch[1]);
 	mccch->band_0 = cpu_to_le32(rfk_mcc->band[0]);
 	mccch->band_1 = cpu_to_le32(rfk_mcc->band[1]);
 	mccch->current_channel = cpu_to_le32(chan->channel);
 	mccch->current_band_type = cpu_to_le32(chan->band_type);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_OUTSRC, H2C_CL_OUTSRC_RF_FW_NOTIFY,
 			      H2C_FUNC_OUTSRC_RF_GET_MCCCH, 0, 0,
 			      sizeof(*mccch));
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 EXPORT_SYMBOL(rtw89_fw_h2c_rf_ntfy_mcc);
 
 int rtw89_fw_h2c_raw_with_hdr(struct rtw89_dev *rtwdev,
 			      u8 h2c_class, u8 h2c_func, u8 *buf, u16 len,
 			      bool rack, bool dack)
 {
 	struct sk_buff *skb;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for raw with hdr\n");
 		return -ENOMEM;
 	}
 	skb_put_data(skb, buf, len);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_OUTSRC, h2c_class, h2c_func, rack, dack,
 			      len);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 int rtw89_fw_h2c_raw(struct rtw89_dev *rtwdev, const u8 *buf, u16 len)
 {
 	struct sk_buff *skb;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_no_hdr(rtwdev, len);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c raw\n");
 		return -ENOMEM;
 	}
 	skb_put_data(skb, buf, len);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 void rtw89_fw_send_all_early_h2c(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_early_h2c *early_h2c;
 
 	lockdep_assert_held(&rtwdev->mutex);
 
 	list_for_each_entry(early_h2c, &rtwdev->early_h2c_list, list) {
 		rtw89_fw_h2c_raw(rtwdev, early_h2c->h2c, early_h2c->h2c_len);
 	}
 }
 
 void rtw89_fw_free_all_early_h2c(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_early_h2c *early_h2c, *tmp;
 
 	mutex_lock(&rtwdev->mutex);
 	list_for_each_entry_safe(early_h2c, tmp, &rtwdev->early_h2c_list, list) {
 		list_del(&early_h2c->list);
 		kfree(early_h2c->h2c);
 		kfree(early_h2c);
 	}
 	mutex_unlock(&rtwdev->mutex);
 }
 
 static void rtw89_fw_c2h_parse_attr(struct sk_buff *c2h)
 {
 	const struct rtw89_c2h_hdr *hdr = (const struct rtw89_c2h_hdr *)c2h->data;
 	struct rtw89_fw_c2h_attr *attr = RTW89_SKB_C2H_CB(c2h);
 
 	attr->category = le32_get_bits(hdr->w0, RTW89_C2H_HDR_W0_CATEGORY);
 	attr->class = le32_get_bits(hdr->w0, RTW89_C2H_HDR_W0_CLASS);
 	attr->func = le32_get_bits(hdr->w0, RTW89_C2H_HDR_W0_FUNC);
 	attr->len = le32_get_bits(hdr->w1, RTW89_C2H_HDR_W1_LEN);
 }
 
 static bool rtw89_fw_c2h_chk_atomic(struct rtw89_dev *rtwdev,
 				    struct sk_buff *c2h)
 {
 	struct rtw89_fw_c2h_attr *attr = RTW89_SKB_C2H_CB(c2h);
 	u8 category = attr->category;
 	u8 class = attr->class;
 	u8 func = attr->func;
 
 	switch (category) {
 	default:
 		return false;
 	case RTW89_C2H_CAT_MAC:
 		return rtw89_mac_c2h_chk_atomic(rtwdev, class, func);
 	}
 }
 
 void rtw89_fw_c2h_irqsafe(struct rtw89_dev *rtwdev, struct sk_buff *c2h)
 {
 	rtw89_fw_c2h_parse_attr(c2h);
 	if (!rtw89_fw_c2h_chk_atomic(rtwdev, c2h))
 		goto enqueue;
 
 	rtw89_fw_c2h_cmd_handle(rtwdev, c2h);
 	dev_kfree_skb_any(c2h);
 	return;
 
 enqueue:
 	skb_queue_tail(&rtwdev->c2h_queue, c2h);
 	ieee80211_queue_work(rtwdev->hw, &rtwdev->c2h_work);
 }
 
 static void rtw89_fw_c2h_cmd_handle(struct rtw89_dev *rtwdev,
 				    struct sk_buff *skb)
 {
 	struct rtw89_fw_c2h_attr *attr = RTW89_SKB_C2H_CB(skb);
 	u8 category = attr->category;
 	u8 class = attr->class;
 	u8 func = attr->func;
 	u16 len = attr->len;
 	bool dump = true;
 
 	if (!test_bit(RTW89_FLAG_RUNNING, rtwdev->flags))
 		return;
 
 	switch (category) {
 	case RTW89_C2H_CAT_TEST:
 		break;
 	case RTW89_C2H_CAT_MAC:
 		rtw89_mac_c2h_handle(rtwdev, skb, len, class, func);
 		if (class == RTW89_MAC_C2H_CLASS_INFO &&
 		    func == RTW89_MAC_C2H_FUNC_C2H_LOG)
 			dump = false;
 		break;
 	case RTW89_C2H_CAT_OUTSRC:
 		if (class >= RTW89_PHY_C2H_CLASS_BTC_MIN &&
 		    class <= RTW89_PHY_C2H_CLASS_BTC_MAX)
 			rtw89_btc_c2h_handle(rtwdev, skb, len, class, func);
 		else
 			rtw89_phy_c2h_handle(rtwdev, skb, len, class, func);
 		break;
 	}
 
 	if (dump)
 		rtw89_hex_dump(rtwdev, RTW89_DBG_FW, "C2H: ", skb->data, skb->len);
 }
 
 void rtw89_fw_c2h_work(struct work_struct *work)
 {
 	struct rtw89_dev *rtwdev = container_of(work, struct rtw89_dev,
 						c2h_work);
 	struct sk_buff *skb, *tmp;
 
 	skb_queue_walk_safe(&rtwdev->c2h_queue, skb, tmp) {
 		skb_unlink(skb, &rtwdev->c2h_queue);
 		mutex_lock(&rtwdev->mutex);
 		rtw89_fw_c2h_cmd_handle(rtwdev, skb);
 		mutex_unlock(&rtwdev->mutex);
 		dev_kfree_skb_any(skb);
 	}
 }
 
 static int rtw89_fw_write_h2c_reg(struct rtw89_dev *rtwdev,
 				  struct rtw89_mac_h2c_info *info)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	struct rtw89_fw_info *fw_info = &rtwdev->fw;
 	const u32 *h2c_reg = chip->h2c_regs;
 	u8 i, val, len;
 	int ret;
 
 	ret = read_poll_timeout(rtw89_read8, val, val == 0, 1000, 5000, false,
 				rtwdev, chip->h2c_ctrl_reg);
 	if (ret) {
 		rtw89_warn(rtwdev, "FW does not process h2c registers\n");
 		return ret;
 	}
 
 	len = DIV_ROUND_UP(info->content_len + RTW89_H2CREG_HDR_LEN,
 			   sizeof(info->u.h2creg[0]));
 
 	u32p_replace_bits(&info->u.hdr.w0, info->id, RTW89_H2CREG_HDR_FUNC_MASK);
 	u32p_replace_bits(&info->u.hdr.w0, len, RTW89_H2CREG_HDR_LEN_MASK);
 
 	for (i = 0; i < RTW89_H2CREG_MAX; i++)
 		rtw89_write32(rtwdev, h2c_reg[i], info->u.h2creg[i]);
 
 	fw_info->h2c_counter++;
 	rtw89_write8_mask(rtwdev, chip->h2c_counter_reg.addr,
 			  chip->h2c_counter_reg.mask, fw_info->h2c_counter);
 	rtw89_write8(rtwdev, chip->h2c_ctrl_reg, B_AX_H2CREG_TRIGGER);
 
 	return 0;
 }
 
 static int rtw89_fw_read_c2h_reg(struct rtw89_dev *rtwdev,
 				 struct rtw89_mac_c2h_info *info)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	struct rtw89_fw_info *fw_info = &rtwdev->fw;
 	const u32 *c2h_reg = chip->c2h_regs;
 	u32 ret;
 	u8 i, val;
 
 	info->id = RTW89_FWCMD_C2HREG_FUNC_NULL;
 
 	ret = read_poll_timeout_atomic(rtw89_read8, val, val, 1,
 				       RTW89_C2H_TIMEOUT, false, rtwdev,
 				       chip->c2h_ctrl_reg);
 	if (ret) {
 		rtw89_warn(rtwdev, "c2h reg timeout\n");
 		return ret;
 	}
 
 	for (i = 0; i < RTW89_C2HREG_MAX; i++)
 		info->u.c2hreg[i] = rtw89_read32(rtwdev, c2h_reg[i]);
 
 	rtw89_write8(rtwdev, chip->c2h_ctrl_reg, 0);
 
 	info->id = u32_get_bits(info->u.hdr.w0, RTW89_C2HREG_HDR_FUNC_MASK);
 	info->content_len =
 		(u32_get_bits(info->u.hdr.w0, RTW89_C2HREG_HDR_LEN_MASK) << 2) -
 		RTW89_C2HREG_HDR_LEN;
 
 	fw_info->c2h_counter++;
 	rtw89_write8_mask(rtwdev, chip->c2h_counter_reg.addr,
 			  chip->c2h_counter_reg.mask, fw_info->c2h_counter);
 
 	return 0;
 }
 
 int rtw89_fw_msg_reg(struct rtw89_dev *rtwdev,
 		     struct rtw89_mac_h2c_info *h2c_info,
 		     struct rtw89_mac_c2h_info *c2h_info)
 {
 	u32 ret;
 
 	if (h2c_info && h2c_info->id != RTW89_FWCMD_H2CREG_FUNC_GET_FEATURE)
 		lockdep_assert_held(&rtwdev->mutex);
 
 	if (!h2c_info && !c2h_info)
 		return -EINVAL;
 
 	if (!h2c_info)
 		goto recv_c2h;
 
 	ret = rtw89_fw_write_h2c_reg(rtwdev, h2c_info);
 	if (ret)
 		return ret;
 
 recv_c2h:
 	if (!c2h_info)
 		return 0;
 
 	ret = rtw89_fw_read_c2h_reg(rtwdev, c2h_info);
 	if (ret)
 		return ret;
 
 	return 0;
 }
 
 void rtw89_fw_st_dbg_dump(struct rtw89_dev *rtwdev)
 {
 	if (!test_bit(RTW89_FLAG_POWERON, rtwdev->flags)) {
 		rtw89_err(rtwdev, "[ERR]pwr is off\n");
 		return;
 	}
 
 	rtw89_info(rtwdev, "FW status = 0x%x\n", rtw89_read32(rtwdev, R_AX_UDM0));
 	rtw89_info(rtwdev, "FW BADADDR = 0x%x\n", rtw89_read32(rtwdev, R_AX_UDM1));
 	rtw89_info(rtwdev, "FW EPC/RA = 0x%x\n", rtw89_read32(rtwdev, R_AX_UDM2));
 	rtw89_info(rtwdev, "FW MISC = 0x%x\n", rtw89_read32(rtwdev, R_AX_UDM3));
 	rtw89_info(rtwdev, "R_AX_HALT_C2H = 0x%x\n",
 		   rtw89_read32(rtwdev, R_AX_HALT_C2H));
 	rtw89_info(rtwdev, "R_AX_SER_DBG_INFO = 0x%x\n",
 		   rtw89_read32(rtwdev, R_AX_SER_DBG_INFO));
 
 	rtw89_fw_prog_cnt_dump(rtwdev);
 }
 
 static void rtw89_release_pkt_list(struct rtw89_dev *rtwdev)
 {
 	struct list_head *pkt_list = rtwdev->scan_info.pkt_list;
 	struct rtw89_pktofld_info *info, *tmp;
 	u8 idx;
 
 	for (idx = NL80211_BAND_2GHZ; idx < NUM_NL80211_BANDS; idx++) {
 		if (!(rtwdev->chip->support_bands & BIT(idx)))
 			continue;
 
 		list_for_each_entry_safe(info, tmp, &pkt_list[idx], list) {
 			if (test_bit(info->id, rtwdev->pkt_offload))
 				rtw89_fw_h2c_del_pkt_offload(rtwdev, info->id);
 			list_del(&info->list);
 			kfree(info);
 		}
 	}
 }
 
 static bool rtw89_is_6ghz_wildcard_probe_req(struct rtw89_dev *rtwdev,
 					     struct rtw89_vif *rtwvif,
 					     struct rtw89_pktofld_info *info,
 					     enum nl80211_band band, u8 ssid_idx)
 {
 	struct cfg80211_scan_request *req = rtwvif->scan_req;
 
 	if (band != NL80211_BAND_6GHZ)
 		return false;
 
 	if (req->ssids[ssid_idx].ssid_len) {
 		memcpy(info->ssid, req->ssids[ssid_idx].ssid,
 		       req->ssids[ssid_idx].ssid_len);
 		info->ssid_len = req->ssids[ssid_idx].ssid_len;
 		return false;
 	} else {
 		return true;
 	}
 }
 
 static int rtw89_append_probe_req_ie(struct rtw89_dev *rtwdev,
 				     struct rtw89_vif *rtwvif,
 				     struct sk_buff *skb, u8 ssid_idx)
 {
 	struct rtw89_hw_scan_info *scan_info = &rtwdev->scan_info;
 	struct ieee80211_scan_ies *ies = rtwvif->scan_ies;
 	struct rtw89_pktofld_info *info;
 	struct sk_buff *new;
 	int ret = 0;
 	u8 band;
 
 	for (band = NL80211_BAND_2GHZ; band < NUM_NL80211_BANDS; band++) {
 		if (!(rtwdev->chip->support_bands & BIT(band)))
 			continue;
 
 		new = skb_copy(skb, GFP_KERNEL);
 		if (!new) {
 			ret = -ENOMEM;
 			goto out;
 		}
 		skb_put_data(new, ies->ies[band], ies->len[band]);
 		skb_put_data(new, ies->common_ies, ies->common_ie_len);
 
 		info = kzalloc(sizeof(*info), GFP_KERNEL);
 		if (!info) {
 			ret = -ENOMEM;
 			kfree_skb(new);
 			goto out;
 		}
 
 		if (rtw89_is_6ghz_wildcard_probe_req(rtwdev, rtwvif, info, band,
 						     ssid_idx)) {
 			kfree_skb(new);
 			kfree(info);
 			goto out;
 		}
 
 		ret = rtw89_fw_h2c_add_pkt_offload(rtwdev, &info->id, new);
 		if (ret) {
 			kfree_skb(new);
 			kfree(info);
 			goto out;
 		}
 
 		list_add_tail(&info->list, &scan_info->pkt_list[band]);
 		kfree_skb(new);
 	}
 out:
 	return ret;
 }
 
 static int rtw89_hw_scan_update_probe_req(struct rtw89_dev *rtwdev,
 					  struct rtw89_vif *rtwvif)
 {
 	struct cfg80211_scan_request *req = rtwvif->scan_req;
 	struct sk_buff *skb;
 	u8 num = req->n_ssids, i;
 	int ret;
 
 	for (i = 0; i < num; i++) {
 		skb = ieee80211_probereq_get(rtwdev->hw, rtwvif->mac_addr,
 					     req->ssids[i].ssid,
 					     req->ssids[i].ssid_len,
 					     req->ie_len);
 		if (!skb)
 			return -ENOMEM;
 
 		ret = rtw89_append_probe_req_ie(rtwdev, rtwvif, skb, i);
 		kfree_skb(skb);
 
 		if (ret)
 			return ret;
 	}
 
 	return 0;
 }
 
 static int rtw89_update_6ghz_rnr_chan(struct rtw89_dev *rtwdev,
 				      struct cfg80211_scan_request *req,
 				      struct rtw89_mac_chinfo *ch_info)
 {
 	struct ieee80211_vif *vif = rtwdev->scan_info.scanning_vif;
 	struct list_head *pkt_list = rtwdev->scan_info.pkt_list;
 	struct rtw89_vif *rtwvif = vif_to_rtwvif_safe(vif);
 	struct ieee80211_scan_ies *ies = rtwvif->scan_ies;
 	struct cfg80211_scan_6ghz_params *params;
 	struct rtw89_pktofld_info *info, *tmp;
 	struct ieee80211_hdr *hdr;
 	struct sk_buff *skb;
 	bool found;
 	int ret = 0;
 	u8 i;
 
 	if (!req->n_6ghz_params)
 		return 0;
 
 	for (i = 0; i < req->n_6ghz_params; i++) {
 		params = &req->scan_6ghz_params[i];
 
 		if (req->channels[params->channel_idx]->hw_value !=
 		    ch_info->pri_ch)
 			continue;
 
 		found = false;
 		list_for_each_entry(tmp, &pkt_list[NL80211_BAND_6GHZ], list) {
 			if (ether_addr_equal(tmp->bssid, params->bssid)) {
 				found = true;
 				break;
 			}
 		}
 		if (found)
 			continue;
 
 		skb = ieee80211_probereq_get(rtwdev->hw, rtwvif->mac_addr,
 					     NULL, 0, req->ie_len);
 		skb_put_data(skb, ies->ies[NL80211_BAND_6GHZ], ies->len[NL80211_BAND_6GHZ]);
 		skb_put_data(skb, ies->common_ies, ies->common_ie_len);
 		hdr = (struct ieee80211_hdr *)skb->data;
 		ether_addr_copy(hdr->addr3, params->bssid);
 
 		info = kzalloc(sizeof(*info), GFP_KERNEL);
 		if (!info) {
 			ret = -ENOMEM;
 			kfree_skb(skb);
 			goto out;
 		}
 
 		ret = rtw89_fw_h2c_add_pkt_offload(rtwdev, &info->id, skb);
 		if (ret) {
 			kfree_skb(skb);
 			kfree(info);
 			goto out;
 		}
 
 		ether_addr_copy(info->bssid, params->bssid);
 		info->channel_6ghz = req->channels[params->channel_idx]->hw_value;
 		list_add_tail(&info->list, &rtwdev->scan_info.pkt_list[NL80211_BAND_6GHZ]);
 
 		ch_info->tx_pkt = true;
 		ch_info->period = RTW89_CHANNEL_TIME_6G + RTW89_DWELL_TIME_6G;
 
 		kfree_skb(skb);
 	}
 
 out:
 	return ret;
 }
 
 static void rtw89_hw_scan_add_chan(struct rtw89_dev *rtwdev, int chan_type,
 				   int ssid_num,
 				   struct rtw89_mac_chinfo *ch_info)
 {
 	struct rtw89_hw_scan_info *scan_info = &rtwdev->scan_info;
 	struct ieee80211_vif *vif = rtwdev->scan_info.scanning_vif;
 	struct rtw89_vif *rtwvif = (struct rtw89_vif *)vif->drv_priv;
 	struct cfg80211_scan_request *req = rtwvif->scan_req;
 	struct rtw89_chan *op = &rtwdev->scan_info.op_chan;
 	struct rtw89_pktofld_info *info;
 	u8 band, probe_count = 0;
 	int ret;
 
 	ch_info->notify_action = RTW89_SCANOFLD_DEBUG_MASK;
 	ch_info->dfs_ch = chan_type == RTW89_CHAN_DFS;
 	ch_info->bw = RTW89_SCAN_WIDTH;
 	ch_info->tx_pkt = true;
 	ch_info->cfg_tx_pwr = false;
 	ch_info->tx_pwr_idx = 0;
 	ch_info->tx_null = false;
 	ch_info->pause_data = false;
 	ch_info->probe_id = RTW89_SCANOFLD_PKT_NONE;
 
 	if (ch_info->ch_band == RTW89_BAND_6G) {
 		if ((ssid_num == 1 && req->ssids[0].ssid_len == 0) ||
 		    !ch_info->is_psc) {
 			ch_info->tx_pkt = false;
 			if (!req->duration_mandatory)
 				ch_info->period -= RTW89_DWELL_TIME_6G;
 		}
 	}
 
 	ret = rtw89_update_6ghz_rnr_chan(rtwdev, req, ch_info);
 	if (ret)
 		rtw89_warn(rtwdev, "RNR fails: %d\n", ret);
 
 	if (ssid_num) {
 		band = rtw89_hw_to_nl80211_band(ch_info->ch_band);
 
 		list_for_each_entry(info, &scan_info->pkt_list[band], list) {
 			if (info->channel_6ghz &&
 			    ch_info->pri_ch != info->channel_6ghz)
 				continue;
 			ch_info->pkt_id[probe_count++] = info->id;
 			if (probe_count >= RTW89_SCANOFLD_MAX_SSID)
 				break;
 		}
 		ch_info->num_pkt = probe_count;
 	}
 
 	switch (chan_type) {
 	case RTW89_CHAN_OPERATE:
 		ch_info->central_ch = op->channel;
 		ch_info->pri_ch = op->primary_channel;
 		ch_info->ch_band = op->band_type;
 		ch_info->bw = op->band_width;
 		ch_info->tx_null = true;
 		ch_info->num_pkt = 0;
 		break;
 	case RTW89_CHAN_DFS:
 		if (ch_info->ch_band != RTW89_BAND_6G)
 			ch_info->period = max_t(u8, ch_info->period,
 						RTW89_DFS_CHAN_TIME);
 		ch_info->dwell_time = RTW89_DWELL_TIME;
 		break;
 	case RTW89_CHAN_ACTIVE:
 		break;
 	default:
 		rtw89_err(rtwdev, "Channel type out of bound\n");
 	}
 }
 
 static int rtw89_hw_scan_add_chan_list(struct rtw89_dev *rtwdev,
 				       struct rtw89_vif *rtwvif, bool connected)
 {
 	struct cfg80211_scan_request *req = rtwvif->scan_req;
 	struct rtw89_mac_chinfo	*ch_info, *tmp;
 	struct ieee80211_channel *channel;
 	struct list_head chan_list;
 	bool random_seq = req->flags & NL80211_SCAN_FLAG_RANDOM_SN;
 	int list_len, off_chan_time = 0;
 	enum rtw89_chan_type type;
 	int ret = 0;
 	u32 idx;
 
 	INIT_LIST_HEAD(&chan_list);
 	for (idx = rtwdev->scan_info.last_chan_idx, list_len = 0;
 	     idx < req->n_channels && list_len < RTW89_SCAN_LIST_LIMIT;
 	     idx++, list_len++) {
 		channel = req->channels[idx];
 		ch_info = kzalloc(sizeof(*ch_info), GFP_KERNEL);
 		if (!ch_info) {
 			ret = -ENOMEM;
 			goto out;
 		}
 
 		if (req->duration_mandatory)
 			ch_info->period = req->duration;
 		else if (channel->band == NL80211_BAND_6GHZ)
 			ch_info->period = RTW89_CHANNEL_TIME_6G +
 					  RTW89_DWELL_TIME_6G;
 		else
 			ch_info->period = RTW89_CHANNEL_TIME;
 
 		ch_info->ch_band = rtw89_nl80211_to_hw_band(channel->band);
 		ch_info->central_ch = channel->hw_value;
 		ch_info->pri_ch = channel->hw_value;
 		ch_info->rand_seq_num = random_seq;
 		ch_info->is_psc = cfg80211_channel_is_psc(channel);
 
 		if (channel->flags &
 		    (IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IR))
 			type = RTW89_CHAN_DFS;
 		else
 			type = RTW89_CHAN_ACTIVE;
 		rtw89_hw_scan_add_chan(rtwdev, type, req->n_ssids, ch_info);
 
 		if (connected &&
 		    off_chan_time + ch_info->period > RTW89_OFF_CHAN_TIME) {
 			tmp = kzalloc(sizeof(*tmp), GFP_KERNEL);
 			if (!tmp) {
 				ret = -ENOMEM;
 				kfree(ch_info);
 				goto out;
 			}
 
 			type = RTW89_CHAN_OPERATE;
 			tmp->period = req->duration_mandatory ?
 				      req->duration : RTW89_CHANNEL_TIME;
 			rtw89_hw_scan_add_chan(rtwdev, type, 0, tmp);
 			list_add_tail(&tmp->list, &chan_list);
 			off_chan_time = 0;
 			list_len++;
 		}
 		list_add_tail(&ch_info->list, &chan_list);
 		off_chan_time += ch_info->period;
 	}
 	rtwdev->scan_info.last_chan_idx = idx;
 	ret = rtw89_fw_h2c_scan_list_offload(rtwdev, list_len, &chan_list);
 
 out:
 	list_for_each_entry_safe(ch_info, tmp, &chan_list, list) {
 		list_del(&ch_info->list);
 		kfree(ch_info);
 	}
 
 	return ret;
 }
 
 static int rtw89_hw_scan_prehandle(struct rtw89_dev *rtwdev,
 				   struct rtw89_vif *rtwvif, bool connected)
 {
 	int ret;
 
 	ret = rtw89_hw_scan_update_probe_req(rtwdev, rtwvif);
 	if (ret) {
+#if defined(__linux__)
 		rtw89_err(rtwdev, "Update probe request failed\n");
+#elif defined(__FreeBSD__)
+		rtw89_err(rtwdev, "Update probe request failed: ret %d\n", ret);
+#endif
 		goto out;
 	}
 	ret = rtw89_hw_scan_add_chan_list(rtwdev, rtwvif, connected);
 out:
 	return ret;
 }
 
 void rtw89_hw_scan_start(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif,
 			 struct ieee80211_scan_request *scan_req)
 {
 	struct rtw89_vif *rtwvif = (struct rtw89_vif *)vif->drv_priv;
 	struct cfg80211_scan_request *req = &scan_req->req;
 	u32 rx_fltr = rtwdev->hal.rx_fltr;
 	u8 mac_addr[ETH_ALEN];
 
 	rtw89_get_channel(rtwdev, rtwvif, &rtwdev->scan_info.op_chan);
 	rtwdev->scan_info.scanning_vif = vif;
 	rtwdev->scan_info.last_chan_idx = 0;
 	rtwvif->scan_ies = &scan_req->ies;
 	rtwvif->scan_req = req;
 	ieee80211_stop_queues(rtwdev->hw);
 
 	if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
 		get_random_mask_addr(mac_addr, req->mac_addr,
 				     req->mac_addr_mask);
 	else
 		ether_addr_copy(mac_addr, vif->addr);
 	rtw89_core_scan_start(rtwdev, rtwvif, mac_addr, true);
 
 	rx_fltr &= ~B_AX_A_BCN_CHK_EN;
 	rx_fltr &= ~B_AX_A_BC;
 	rx_fltr &= ~B_AX_A_A1_MATCH;
 	rtw89_write32_mask(rtwdev,
 			   rtw89_mac_reg_by_idx(R_AX_RX_FLTR_OPT, RTW89_MAC_0),
 			   B_AX_RX_FLTR_CFG_MASK,
 			   rx_fltr);
 }
 
 void rtw89_hw_scan_complete(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif,
 			    bool aborted)
 {
 	struct rtw89_hw_scan_info *scan_info = &rtwdev->scan_info;
 	struct cfg80211_scan_info info = {
 		.aborted = aborted,
 	};
 	struct rtw89_vif *rtwvif;
 
 	if (!vif)
 		return;
 
 	rtw89_write32_mask(rtwdev,
 			   rtw89_mac_reg_by_idx(R_AX_RX_FLTR_OPT, RTW89_MAC_0),
 			   B_AX_RX_FLTR_CFG_MASK,
 			   rtwdev->hal.rx_fltr);
 
 	rtw89_core_scan_complete(rtwdev, vif, true);
 	ieee80211_scan_completed(rtwdev->hw, &info);
 	ieee80211_wake_queues(rtwdev->hw);
 
 	rtw89_release_pkt_list(rtwdev);
 	rtwvif = (struct rtw89_vif *)vif->drv_priv;
 	rtwvif->scan_req = NULL;
 	rtwvif->scan_ies = NULL;
 	scan_info->last_chan_idx = 0;
 	scan_info->scanning_vif = NULL;
 
 	rtw89_set_channel(rtwdev);
 }
 
 void rtw89_hw_scan_abort(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif)
 {
 	rtw89_hw_scan_offload(rtwdev, vif, false);
 	rtw89_hw_scan_complete(rtwdev, vif, true);
 }
 
 int rtw89_hw_scan_offload(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif,
 			  bool enable)
 {
 	struct rtw89_scan_option opt = {0};
 	struct rtw89_vif *rtwvif;
 	bool connected;
 	int ret = 0;
 
 	rtwvif = vif ? (struct rtw89_vif *)vif->drv_priv : NULL;
 	if (!rtwvif)
 		return -EINVAL;
 
 	/* This variable implies connected or during attempt to connect */
 	connected = !is_zero_ether_addr(rtwvif->bssid);
 	opt.enable = enable;
 	opt.target_ch_mode = connected;
 	if (enable) {
 		ret = rtw89_hw_scan_prehandle(rtwdev, rtwvif, connected);
 		if (ret)
 			goto out;
 	}
 	ret = rtw89_fw_h2c_scan_offload(rtwdev, &opt, rtwvif);
 out:
 	return ret;
 }
 
 #define H2C_FW_CPU_EXCEPTION_LEN 4
 #define H2C_FW_CPU_EXCEPTION_TYPE_DEF 0x5566
 int rtw89_fw_h2c_trigger_cpu_exception(struct rtw89_dev *rtwdev)
 {
 	struct sk_buff *skb;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_FW_CPU_EXCEPTION_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev,
 			  "failed to alloc skb for fw cpu exception\n");
 		return -ENOMEM;
 	}
 
 	skb_put(skb, H2C_FW_CPU_EXCEPTION_LEN);
 	RTW89_SET_FWCMD_CPU_EXCEPTION_TYPE(skb->data,
 					   H2C_FW_CPU_EXCEPTION_TYPE_DEF);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_TEST,
 			      H2C_CL_FW_STATUS_TEST,
 			      H2C_FUNC_CPU_EXCEPTION, 0, 0,
 			      H2C_FW_CPU_EXCEPTION_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 
 fail:
 	dev_kfree_skb_any(skb);
 	return ret;
 }
 
 #define H2C_PKT_DROP_LEN 24
 int rtw89_fw_h2c_pkt_drop(struct rtw89_dev *rtwdev,
 			  const struct rtw89_pkt_drop_params *params)
 {
 	struct sk_buff *skb;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_PKT_DROP_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev,
 			  "failed to alloc skb for packet drop\n");
 		return -ENOMEM;
 	}
 
 	switch (params->sel) {
 	case RTW89_PKT_DROP_SEL_MACID_BE_ONCE:
 	case RTW89_PKT_DROP_SEL_MACID_BK_ONCE:
 	case RTW89_PKT_DROP_SEL_MACID_VI_ONCE:
 	case RTW89_PKT_DROP_SEL_MACID_VO_ONCE:
 	case RTW89_PKT_DROP_SEL_BAND_ONCE:
 		break;
 	default:
 		rtw89_debug(rtwdev, RTW89_DBG_FW,
 			    "H2C of pkt drop might not fully support sel: %d yet\n",
 			    params->sel);
 		break;
 	}
 
 	skb_put(skb, H2C_PKT_DROP_LEN);
 	RTW89_SET_FWCMD_PKT_DROP_SEL(skb->data, params->sel);
 	RTW89_SET_FWCMD_PKT_DROP_MACID(skb->data, params->macid);
 	RTW89_SET_FWCMD_PKT_DROP_BAND(skb->data, params->mac_band);
 	RTW89_SET_FWCMD_PKT_DROP_PORT(skb->data, params->port);
 	RTW89_SET_FWCMD_PKT_DROP_MBSSID(skb->data, params->mbssid);
 	RTW89_SET_FWCMD_PKT_DROP_ROLE_A_INFO_TF_TRS(skb->data, params->tf_trs);
 	RTW89_SET_FWCMD_PKT_DROP_MACID_BAND_SEL_0(skb->data,
 						  params->macid_band_sel[0]);
 	RTW89_SET_FWCMD_PKT_DROP_MACID_BAND_SEL_1(skb->data,
 						  params->macid_band_sel[1]);
 	RTW89_SET_FWCMD_PKT_DROP_MACID_BAND_SEL_2(skb->data,
 						  params->macid_band_sel[2]);
 	RTW89_SET_FWCMD_PKT_DROP_MACID_BAND_SEL_3(skb->data,
 						  params->macid_band_sel[3]);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_MAC_FW_OFLD,
 			      H2C_FUNC_PKT_DROP, 0, 0,
 			      H2C_PKT_DROP_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 
 fail:
 	dev_kfree_skb_any(skb);
 	return ret;
 }
 
 #define H2C_KEEP_ALIVE_LEN 4
 int rtw89_fw_h2c_keep_alive(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif,
 			    bool enable)
 {
 	struct sk_buff *skb;
 	u8 pkt_id = 0;
 	int ret;
 
 	if (enable) {
 		ret = rtw89_fw_h2c_add_general_pkt(rtwdev, rtwvif,
 						   RTW89_PKT_OFLD_TYPE_NULL_DATA,
 						   &pkt_id);
 		if (ret)
 			return -EPERM;
 	}
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_KEEP_ALIVE_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for keep alive\n");
 		return -ENOMEM;
 	}
 
 	skb_put(skb, H2C_KEEP_ALIVE_LEN);
 
 	RTW89_SET_KEEP_ALIVE_ENABLE(skb->data, enable);
 	RTW89_SET_KEEP_ALIVE_PKT_NULL_ID(skb->data, pkt_id);
 	RTW89_SET_KEEP_ALIVE_PERIOD(skb->data, 5);
 	RTW89_SET_KEEP_ALIVE_MACID(skb->data, rtwvif->mac_id);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_MAC_WOW,
 			      H2C_FUNC_KEEP_ALIVE, 0, 1,
 			      H2C_KEEP_ALIVE_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 #define H2C_DISCONNECT_DETECT_LEN 8
 int rtw89_fw_h2c_disconnect_detect(struct rtw89_dev *rtwdev,
 				   struct rtw89_vif *rtwvif, bool enable)
 {
 	struct rtw89_wow_param *rtw_wow = &rtwdev->wow;
 	struct sk_buff *skb;
 	u8 macid = rtwvif->mac_id;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_DISCONNECT_DETECT_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for keep alive\n");
 		return -ENOMEM;
 	}
 
 	skb_put(skb, H2C_DISCONNECT_DETECT_LEN);
 
 	if (test_bit(RTW89_WOW_FLAG_EN_DISCONNECT, rtw_wow->flags)) {
 		RTW89_SET_DISCONNECT_DETECT_ENABLE(skb->data, enable);
 		RTW89_SET_DISCONNECT_DETECT_DISCONNECT(skb->data, !enable);
 		RTW89_SET_DISCONNECT_DETECT_MAC_ID(skb->data, macid);
 		RTW89_SET_DISCONNECT_DETECT_CHECK_PERIOD(skb->data, 100);
 		RTW89_SET_DISCONNECT_DETECT_TRY_PKT_COUNT(skb->data, 5);
 	}
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_MAC_WOW,
 			      H2C_FUNC_DISCONNECT_DETECT, 0, 1,
 			      H2C_DISCONNECT_DETECT_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 #define H2C_WOW_GLOBAL_LEN 8
 int rtw89_fw_h2c_wow_global(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif,
 			    bool enable)
 {
 	struct sk_buff *skb;
 	u8 macid = rtwvif->mac_id;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_WOW_GLOBAL_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for keep alive\n");
 		return -ENOMEM;
 	}
 
 	skb_put(skb, H2C_WOW_GLOBAL_LEN);
 
 	RTW89_SET_WOW_GLOBAL_ENABLE(skb->data, enable);
 	RTW89_SET_WOW_GLOBAL_MAC_ID(skb->data, macid);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_MAC_WOW,
 			      H2C_FUNC_WOW_GLOBAL, 0, 1,
 			      H2C_WOW_GLOBAL_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 #define H2C_WAKEUP_CTRL_LEN 4
 int rtw89_fw_h2c_wow_wakeup_ctrl(struct rtw89_dev *rtwdev,
 				 struct rtw89_vif *rtwvif,
 				 bool enable)
 {
 	struct rtw89_wow_param *rtw_wow = &rtwdev->wow;
 	struct sk_buff *skb;
 	u8 macid = rtwvif->mac_id;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_WAKEUP_CTRL_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for keep alive\n");
 		return -ENOMEM;
 	}
 
 	skb_put(skb, H2C_WAKEUP_CTRL_LEN);
 
 	if (rtw_wow->pattern_cnt)
 		RTW89_SET_WOW_WAKEUP_CTRL_PATTERN_MATCH_ENABLE(skb->data, enable);
 	if (test_bit(RTW89_WOW_FLAG_EN_MAGIC_PKT, rtw_wow->flags))
 		RTW89_SET_WOW_WAKEUP_CTRL_MAGIC_ENABLE(skb->data, enable);
 	if (test_bit(RTW89_WOW_FLAG_EN_DISCONNECT, rtw_wow->flags))
 		RTW89_SET_WOW_WAKEUP_CTRL_DEAUTH_ENABLE(skb->data, enable);
 
 	RTW89_SET_WOW_WAKEUP_CTRL_MAC_ID(skb->data, macid);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_MAC_WOW,
 			      H2C_FUNC_WAKEUP_CTRL, 0, 1,
 			      H2C_WAKEUP_CTRL_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 #define H2C_WOW_CAM_UPD_LEN 24
 int rtw89_fw_wow_cam_update(struct rtw89_dev *rtwdev,
 			    struct rtw89_wow_cam_info *cam_info)
 {
 	struct sk_buff *skb;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_WOW_CAM_UPD_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for keep alive\n");
 		return -ENOMEM;
 	}
 
 	skb_put(skb, H2C_WOW_CAM_UPD_LEN);
 
 	RTW89_SET_WOW_CAM_UPD_R_W(skb->data, cam_info->r_w);
 	RTW89_SET_WOW_CAM_UPD_IDX(skb->data, cam_info->idx);
 	if (cam_info->valid) {
 		RTW89_SET_WOW_CAM_UPD_WKFM1(skb->data, cam_info->mask[0]);
 		RTW89_SET_WOW_CAM_UPD_WKFM2(skb->data, cam_info->mask[1]);
 		RTW89_SET_WOW_CAM_UPD_WKFM3(skb->data, cam_info->mask[2]);
 		RTW89_SET_WOW_CAM_UPD_WKFM4(skb->data, cam_info->mask[3]);
 		RTW89_SET_WOW_CAM_UPD_CRC(skb->data, cam_info->crc);
 		RTW89_SET_WOW_CAM_UPD_NEGATIVE_PATTERN_MATCH(skb->data,
 							     cam_info->negative_pattern_match);
 		RTW89_SET_WOW_CAM_UPD_SKIP_MAC_HDR(skb->data,
 						   cam_info->skip_mac_hdr);
 		RTW89_SET_WOW_CAM_UPD_UC(skb->data, cam_info->uc);
 		RTW89_SET_WOW_CAM_UPD_MC(skb->data, cam_info->mc);
 		RTW89_SET_WOW_CAM_UPD_BC(skb->data, cam_info->bc);
 	}
 	RTW89_SET_WOW_CAM_UPD_VALID(skb->data, cam_info->valid);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_MAC_WOW,
 			      H2C_FUNC_WOW_CAM_UPD, 0, 1,
 			      H2C_WOW_CAM_UPD_LEN);
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		goto fail;
 	}
 
 	return 0;
 fail:
 	dev_kfree_skb_any(skb);
 
 	return ret;
 }
 
 /* Return < 0, if failures happen during waiting for the condition.
  * Return 0, when waiting for the condition succeeds.
  * Return > 0, if the wait is considered unreachable due to driver/FW design,
  * where 1 means during SER.
  */
 static int rtw89_h2c_tx_and_wait(struct rtw89_dev *rtwdev, struct sk_buff *skb,
 				 struct rtw89_wait_info *wait, unsigned int cond)
 {
 	int ret;
 
 	ret = rtw89_h2c_tx(rtwdev, skb, false);
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send h2c\n");
 		dev_kfree_skb_any(skb);
 		return -EBUSY;
 	}
 
 	if (test_bit(RTW89_FLAG_SER_HANDLING, rtwdev->flags))
 		return 1;
 
 	return rtw89_wait_for_cond(wait, cond);
 }
 
 #define H2C_ADD_MCC_LEN 16
 int rtw89_fw_h2c_add_mcc(struct rtw89_dev *rtwdev,
 			 const struct rtw89_fw_mcc_add_req *p)
 {
 	struct rtw89_wait_info *wait = &rtwdev->mcc.wait;
 	struct sk_buff *skb;
 	unsigned int cond;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_ADD_MCC_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev,
 			  "failed to alloc skb for add mcc\n");
 		return -ENOMEM;
 	}
 
 	skb_put(skb, H2C_ADD_MCC_LEN);
 	RTW89_SET_FWCMD_ADD_MCC_MACID(skb->data, p->macid);
 	RTW89_SET_FWCMD_ADD_MCC_CENTRAL_CH_SEG0(skb->data, p->central_ch_seg0);
 	RTW89_SET_FWCMD_ADD_MCC_CENTRAL_CH_SEG1(skb->data, p->central_ch_seg1);
 	RTW89_SET_FWCMD_ADD_MCC_PRIMARY_CH(skb->data, p->primary_ch);
 	RTW89_SET_FWCMD_ADD_MCC_BANDWIDTH(skb->data, p->bandwidth);
 	RTW89_SET_FWCMD_ADD_MCC_GROUP(skb->data, p->group);
 	RTW89_SET_FWCMD_ADD_MCC_C2H_RPT(skb->data, p->c2h_rpt);
 	RTW89_SET_FWCMD_ADD_MCC_DIS_TX_NULL(skb->data, p->dis_tx_null);
 	RTW89_SET_FWCMD_ADD_MCC_DIS_SW_RETRY(skb->data, p->dis_sw_retry);
 	RTW89_SET_FWCMD_ADD_MCC_IN_CURR_CH(skb->data, p->in_curr_ch);
 	RTW89_SET_FWCMD_ADD_MCC_SW_RETRY_COUNT(skb->data, p->sw_retry_count);
 	RTW89_SET_FWCMD_ADD_MCC_TX_NULL_EARLY(skb->data, p->tx_null_early);
 	RTW89_SET_FWCMD_ADD_MCC_BTC_IN_2G(skb->data, p->btc_in_2g);
 	RTW89_SET_FWCMD_ADD_MCC_PTA_EN(skb->data, p->pta_en);
 	RTW89_SET_FWCMD_ADD_MCC_RFK_BY_PASS(skb->data, p->rfk_by_pass);
 	RTW89_SET_FWCMD_ADD_MCC_CH_BAND_TYPE(skb->data, p->ch_band_type);
 	RTW89_SET_FWCMD_ADD_MCC_DURATION(skb->data, p->duration);
 	RTW89_SET_FWCMD_ADD_MCC_COURTESY_EN(skb->data, p->courtesy_en);
 	RTW89_SET_FWCMD_ADD_MCC_COURTESY_NUM(skb->data, p->courtesy_num);
 	RTW89_SET_FWCMD_ADD_MCC_COURTESY_TARGET(skb->data, p->courtesy_target);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_MCC,
 			      H2C_FUNC_ADD_MCC, 0, 0,
 			      H2C_ADD_MCC_LEN);
 
 	cond = RTW89_MCC_WAIT_COND(p->group, H2C_FUNC_ADD_MCC);
 	return rtw89_h2c_tx_and_wait(rtwdev, skb, wait, cond);
 }
 
 #define H2C_START_MCC_LEN 12
 int rtw89_fw_h2c_start_mcc(struct rtw89_dev *rtwdev,
 			   const struct rtw89_fw_mcc_start_req *p)
 {
 	struct rtw89_wait_info *wait = &rtwdev->mcc.wait;
 	struct sk_buff *skb;
 	unsigned int cond;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_START_MCC_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev,
 			  "failed to alloc skb for start mcc\n");
 		return -ENOMEM;
 	}
 
 	skb_put(skb, H2C_START_MCC_LEN);
 	RTW89_SET_FWCMD_START_MCC_GROUP(skb->data, p->group);
 	RTW89_SET_FWCMD_START_MCC_BTC_IN_GROUP(skb->data, p->btc_in_group);
 	RTW89_SET_FWCMD_START_MCC_OLD_GROUP_ACTION(skb->data, p->old_group_action);
 	RTW89_SET_FWCMD_START_MCC_OLD_GROUP(skb->data, p->old_group);
 	RTW89_SET_FWCMD_START_MCC_NOTIFY_CNT(skb->data, p->notify_cnt);
 	RTW89_SET_FWCMD_START_MCC_NOTIFY_RXDBG_EN(skb->data, p->notify_rxdbg_en);
 	RTW89_SET_FWCMD_START_MCC_MACID(skb->data, p->macid);
 	RTW89_SET_FWCMD_START_MCC_TSF_LOW(skb->data, p->tsf_low);
 	RTW89_SET_FWCMD_START_MCC_TSF_HIGH(skb->data, p->tsf_high);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_MCC,
 			      H2C_FUNC_START_MCC, 0, 0,
 			      H2C_START_MCC_LEN);
 
 	cond = RTW89_MCC_WAIT_COND(p->group, H2C_FUNC_START_MCC);
 	return rtw89_h2c_tx_and_wait(rtwdev, skb, wait, cond);
 }
 
 #define H2C_STOP_MCC_LEN 4
 int rtw89_fw_h2c_stop_mcc(struct rtw89_dev *rtwdev, u8 group, u8 macid,
 			  bool prev_groups)
 {
 	struct rtw89_wait_info *wait = &rtwdev->mcc.wait;
 	struct sk_buff *skb;
 	unsigned int cond;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_STOP_MCC_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev,
 			  "failed to alloc skb for stop mcc\n");
 		return -ENOMEM;
 	}
 
 	skb_put(skb, H2C_STOP_MCC_LEN);
 	RTW89_SET_FWCMD_STOP_MCC_MACID(skb->data, macid);
 	RTW89_SET_FWCMD_STOP_MCC_GROUP(skb->data, group);
 	RTW89_SET_FWCMD_STOP_MCC_PREV_GROUPS(skb->data, prev_groups);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_MCC,
 			      H2C_FUNC_STOP_MCC, 0, 0,
 			      H2C_STOP_MCC_LEN);
 
 	cond = RTW89_MCC_WAIT_COND(group, H2C_FUNC_STOP_MCC);
 	return rtw89_h2c_tx_and_wait(rtwdev, skb, wait, cond);
 }
 
 #define H2C_DEL_MCC_GROUP_LEN 4
 int rtw89_fw_h2c_del_mcc_group(struct rtw89_dev *rtwdev, u8 group,
 			       bool prev_groups)
 {
 	struct rtw89_wait_info *wait = &rtwdev->mcc.wait;
 	struct sk_buff *skb;
 	unsigned int cond;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_DEL_MCC_GROUP_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev,
 			  "failed to alloc skb for del mcc group\n");
 		return -ENOMEM;
 	}
 
 	skb_put(skb, H2C_DEL_MCC_GROUP_LEN);
 	RTW89_SET_FWCMD_DEL_MCC_GROUP_GROUP(skb->data, group);
 	RTW89_SET_FWCMD_DEL_MCC_GROUP_PREV_GROUPS(skb->data, prev_groups);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_MCC,
 			      H2C_FUNC_DEL_MCC_GROUP, 0, 0,
 			      H2C_DEL_MCC_GROUP_LEN);
 
 	cond = RTW89_MCC_WAIT_COND(group, H2C_FUNC_DEL_MCC_GROUP);
 	return rtw89_h2c_tx_and_wait(rtwdev, skb, wait, cond);
 }
 
 #define H2C_RESET_MCC_GROUP_LEN 4
 int rtw89_fw_h2c_reset_mcc_group(struct rtw89_dev *rtwdev, u8 group)
 {
 	struct rtw89_wait_info *wait = &rtwdev->mcc.wait;
 	struct sk_buff *skb;
 	unsigned int cond;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_RESET_MCC_GROUP_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev,
 			  "failed to alloc skb for reset mcc group\n");
 		return -ENOMEM;
 	}
 
 	skb_put(skb, H2C_RESET_MCC_GROUP_LEN);
 	RTW89_SET_FWCMD_RESET_MCC_GROUP_GROUP(skb->data, group);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_MCC,
 			      H2C_FUNC_RESET_MCC_GROUP, 0, 0,
 			      H2C_RESET_MCC_GROUP_LEN);
 
 	cond = RTW89_MCC_WAIT_COND(group, H2C_FUNC_RESET_MCC_GROUP);
 	return rtw89_h2c_tx_and_wait(rtwdev, skb, wait, cond);
 }
 
 #define H2C_MCC_REQ_TSF_LEN 4
 int rtw89_fw_h2c_mcc_req_tsf(struct rtw89_dev *rtwdev,
 			     const struct rtw89_fw_mcc_tsf_req *req,
 			     struct rtw89_mac_mcc_tsf_rpt *rpt)
 {
 	struct rtw89_wait_info *wait = &rtwdev->mcc.wait;
 	struct rtw89_mac_mcc_tsf_rpt *tmp;
 	struct sk_buff *skb;
 	unsigned int cond;
 	int ret;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_MCC_REQ_TSF_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev,
 			  "failed to alloc skb for mcc req tsf\n");
 		return -ENOMEM;
 	}
 
 	skb_put(skb, H2C_MCC_REQ_TSF_LEN);
 	RTW89_SET_FWCMD_MCC_REQ_TSF_GROUP(skb->data, req->group);
 	RTW89_SET_FWCMD_MCC_REQ_TSF_MACID_X(skb->data, req->macid_x);
 	RTW89_SET_FWCMD_MCC_REQ_TSF_MACID_Y(skb->data, req->macid_y);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_MCC,
 			      H2C_FUNC_MCC_REQ_TSF, 0, 0,
 			      H2C_MCC_REQ_TSF_LEN);
 
 	cond = RTW89_MCC_WAIT_COND(req->group, H2C_FUNC_MCC_REQ_TSF);
 	ret = rtw89_h2c_tx_and_wait(rtwdev, skb, wait, cond);
 	if (ret)
 		return ret;
 
 	tmp = (struct rtw89_mac_mcc_tsf_rpt *)wait->data.buf;
 	*rpt = *tmp;
 
 	return 0;
 }
 
 #define H2C_MCC_MACID_BITMAP_DSC_LEN 4
 int rtw89_fw_h2c_mcc_macid_bitamp(struct rtw89_dev *rtwdev, u8 group, u8 macid,
 				  u8 *bitmap)
 {
 	struct rtw89_wait_info *wait = &rtwdev->mcc.wait;
 	struct sk_buff *skb;
 	unsigned int cond;
 	u8 map_len;
 	u8 h2c_len;
 
 	BUILD_BUG_ON(RTW89_MAX_MAC_ID_NUM % 8);
 	map_len = RTW89_MAX_MAC_ID_NUM / 8;
 	h2c_len = H2C_MCC_MACID_BITMAP_DSC_LEN + map_len;
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, h2c_len);
 	if (!skb) {
 		rtw89_err(rtwdev,
 			  "failed to alloc skb for mcc macid bitmap\n");
 		return -ENOMEM;
 	}
 
 	skb_put(skb, h2c_len);
 	RTW89_SET_FWCMD_MCC_MACID_BITMAP_GROUP(skb->data, group);
 	RTW89_SET_FWCMD_MCC_MACID_BITMAP_MACID(skb->data, macid);
 	RTW89_SET_FWCMD_MCC_MACID_BITMAP_BITMAP_LENGTH(skb->data, map_len);
 	RTW89_SET_FWCMD_MCC_MACID_BITMAP_BITMAP(skb->data, bitmap, map_len);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_MCC,
 			      H2C_FUNC_MCC_MACID_BITMAP, 0, 0,
 			      h2c_len);
 
 	cond = RTW89_MCC_WAIT_COND(group, H2C_FUNC_MCC_MACID_BITMAP);
 	return rtw89_h2c_tx_and_wait(rtwdev, skb, wait, cond);
 }
 
 #define H2C_MCC_SYNC_LEN 4
 int rtw89_fw_h2c_mcc_sync(struct rtw89_dev *rtwdev, u8 group, u8 source,
 			  u8 target, u8 offset)
 {
 	struct rtw89_wait_info *wait = &rtwdev->mcc.wait;
 	struct sk_buff *skb;
 	unsigned int cond;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_MCC_SYNC_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev,
 			  "failed to alloc skb for mcc sync\n");
 		return -ENOMEM;
 	}
 
 	skb_put(skb, H2C_MCC_SYNC_LEN);
 	RTW89_SET_FWCMD_MCC_SYNC_GROUP(skb->data, group);
 	RTW89_SET_FWCMD_MCC_SYNC_MACID_SOURCE(skb->data, source);
 	RTW89_SET_FWCMD_MCC_SYNC_MACID_TARGET(skb->data, target);
 	RTW89_SET_FWCMD_MCC_SYNC_SYNC_OFFSET(skb->data, offset);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_MCC,
 			      H2C_FUNC_MCC_SYNC, 0, 0,
 			      H2C_MCC_SYNC_LEN);
 
 	cond = RTW89_MCC_WAIT_COND(group, H2C_FUNC_MCC_SYNC);
 	return rtw89_h2c_tx_and_wait(rtwdev, skb, wait, cond);
 }
 
 #define H2C_MCC_SET_DURATION_LEN 20
 int rtw89_fw_h2c_mcc_set_duration(struct rtw89_dev *rtwdev,
 				  const struct rtw89_fw_mcc_duration *p)
 {
 	struct rtw89_wait_info *wait = &rtwdev->mcc.wait;
 	struct sk_buff *skb;
 	unsigned int cond;
 
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_MCC_SET_DURATION_LEN);
 	if (!skb) {
 		rtw89_err(rtwdev,
 			  "failed to alloc skb for mcc set duration\n");
 		return -ENOMEM;
 	}
 
 	skb_put(skb, H2C_MCC_SET_DURATION_LEN);
 	RTW89_SET_FWCMD_MCC_SET_DURATION_GROUP(skb->data, p->group);
 	RTW89_SET_FWCMD_MCC_SET_DURATION_BTC_IN_GROUP(skb->data, p->btc_in_group);
 	RTW89_SET_FWCMD_MCC_SET_DURATION_START_MACID(skb->data, p->start_macid);
 	RTW89_SET_FWCMD_MCC_SET_DURATION_MACID_X(skb->data, p->macid_x);
 	RTW89_SET_FWCMD_MCC_SET_DURATION_MACID_Y(skb->data, p->macid_y);
 	RTW89_SET_FWCMD_MCC_SET_DURATION_START_TSF_LOW(skb->data,
 						       p->start_tsf_low);
 	RTW89_SET_FWCMD_MCC_SET_DURATION_START_TSF_HIGH(skb->data,
 							p->start_tsf_high);
 	RTW89_SET_FWCMD_MCC_SET_DURATION_DURATION_X(skb->data, p->duration_x);
 	RTW89_SET_FWCMD_MCC_SET_DURATION_DURATION_Y(skb->data, p->duration_y);
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC,
 			      H2C_CL_MCC,
 			      H2C_FUNC_MCC_SET_DURATION, 0, 0,
 			      H2C_MCC_SET_DURATION_LEN);
 
 	cond = RTW89_MCC_WAIT_COND(p->group, H2C_FUNC_MCC_SET_DURATION);
 	return rtw89_h2c_tx_and_wait(rtwdev, skb, wait, cond);
 }
diff --git a/sys/contrib/dev/rtw89/phy.c b/sys/contrib/dev/rtw89/phy.c
index e2b8303d3f63..138788b2ed05 100644
--- a/sys/contrib/dev/rtw89/phy.c
+++ b/sys/contrib/dev/rtw89/phy.c
@@ -1,4742 +1,4746 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /* Copyright(c) 2019-2020  Realtek Corporation
  */
 
 #include "coex.h"
 #include "debug.h"
 #include "fw.h"
 #include "mac.h"
 #include "phy.h"
 #include "ps.h"
 #include "reg.h"
 #include "sar.h"
 #include "txrx.h"
 #include "util.h"
 
 static u16 get_max_amsdu_len(struct rtw89_dev *rtwdev,
 			     const struct rtw89_ra_report *report)
 {
 	u32 bit_rate = report->bit_rate;
 
 	/* lower than ofdm, do not aggregate */
 	if (bit_rate < 550)
 		return 1;
 
 	/* avoid AMSDU for legacy rate */
 	if (report->might_fallback_legacy)
 		return 1;
 
 	/* lower than 20M vht 2ss mcs8, make it small */
 	if (bit_rate < 1800)
 		return 1200;
 
 	/* lower than 40M vht 2ss mcs9, make it medium */
 	if (bit_rate < 4000)
 		return 2600;
 
 	/* not yet 80M vht 2ss mcs8/9, make it twice regular packet size */
 	if (bit_rate < 7000)
 		return 3500;
 
 	return rtwdev->chip->max_amsdu_limit;
 }
 
 static u64 get_mcs_ra_mask(u16 mcs_map, u8 highest_mcs, u8 gap)
 {
 	u64 ra_mask = 0;
 	u8 mcs_cap;
 	int i, nss;
 
 	for (i = 0, nss = 12; i < 4; i++, mcs_map >>= 2, nss += 12) {
 		mcs_cap = mcs_map & 0x3;
 		switch (mcs_cap) {
 		case 2:
 			ra_mask |= GENMASK_ULL(highest_mcs, 0) << nss;
 			break;
 		case 1:
 			ra_mask |= GENMASK_ULL(highest_mcs - gap, 0) << nss;
 			break;
 		case 0:
 			ra_mask |= GENMASK_ULL(highest_mcs - gap * 2, 0) << nss;
 			break;
 		default:
 			break;
 		}
 	}
 
 	return ra_mask;
 }
 
 static u64 get_he_ra_mask(struct ieee80211_sta *sta)
 {
 	struct ieee80211_sta_he_cap cap = sta->deflink.he_cap;
 	u16 mcs_map;
 
 	switch (sta->deflink.bandwidth) {
 	case IEEE80211_STA_RX_BW_160:
 		if (cap.he_cap_elem.phy_cap_info[0] &
 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
 			mcs_map = le16_to_cpu(cap.he_mcs_nss_supp.rx_mcs_80p80);
 		else
 			mcs_map = le16_to_cpu(cap.he_mcs_nss_supp.rx_mcs_160);
 		break;
 	default:
 		mcs_map = le16_to_cpu(cap.he_mcs_nss_supp.rx_mcs_80);
 	}
 
 	/* MCS11, MCS9, MCS7 */
 	return get_mcs_ra_mask(mcs_map, 11, 2);
 }
 
 #define RA_FLOOR_TABLE_SIZE	7
 #define RA_FLOOR_UP_GAP		3
 static u64 rtw89_phy_ra_mask_rssi(struct rtw89_dev *rtwdev, u8 rssi,
 				  u8 ratr_state)
 {
 	u8 rssi_lv_t[RA_FLOOR_TABLE_SIZE] = {30, 44, 48, 52, 56, 60, 100};
 	u8 rssi_lv = 0;
 	u8 i;
 
 	rssi >>= 1;
 	for (i = 0; i < RA_FLOOR_TABLE_SIZE; i++) {
 		if (i >= ratr_state)
 			rssi_lv_t[i] += RA_FLOOR_UP_GAP;
 		if (rssi < rssi_lv_t[i]) {
 			rssi_lv = i;
 			break;
 		}
 	}
 	if (rssi_lv == 0)
 		return 0xffffffffffffffffULL;
 	else if (rssi_lv == 1)
 		return 0xfffffffffffffff0ULL;
 	else if (rssi_lv == 2)
 		return 0xffffffffffffefe0ULL;
 	else if (rssi_lv == 3)
 		return 0xffffffffffffcfc0ULL;
 	else if (rssi_lv == 4)
 		return 0xffffffffffff8f80ULL;
 	else if (rssi_lv >= 5)
 		return 0xffffffffffff0f00ULL;
 
 	return 0xffffffffffffffffULL;
 }
 
 static u64 rtw89_phy_ra_mask_recover(u64 ra_mask, u64 ra_mask_bak)
 {
 	if ((ra_mask & ~(RA_MASK_CCK_RATES | RA_MASK_OFDM_RATES)) == 0)
 		ra_mask |= (ra_mask_bak & ~(RA_MASK_CCK_RATES | RA_MASK_OFDM_RATES));
 
 	if (ra_mask == 0)
 		ra_mask |= (ra_mask_bak & (RA_MASK_CCK_RATES | RA_MASK_OFDM_RATES));
 
 	return ra_mask;
 }
 
 static u64 rtw89_phy_ra_mask_cfg(struct rtw89_dev *rtwdev, struct rtw89_sta *rtwsta)
 {
 	struct ieee80211_sta *sta = rtwsta_to_sta(rtwsta);
 	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, RTW89_SUB_ENTITY_0);
 	struct cfg80211_bitrate_mask *mask = &rtwsta->mask;
 	enum nl80211_band band;
 	u64 cfg_mask;
 
 	if (!rtwsta->use_cfg_mask)
 		return -1;
 
 	switch (chan->band_type) {
 	case RTW89_BAND_2G:
 		band = NL80211_BAND_2GHZ;
 		cfg_mask = u64_encode_bits(mask->control[NL80211_BAND_2GHZ].legacy,
 					   RA_MASK_CCK_RATES | RA_MASK_OFDM_RATES);
 		break;
 	case RTW89_BAND_5G:
 		band = NL80211_BAND_5GHZ;
 		cfg_mask = u64_encode_bits(mask->control[NL80211_BAND_5GHZ].legacy,
 					   RA_MASK_OFDM_RATES);
 		break;
 	case RTW89_BAND_6G:
 		band = NL80211_BAND_6GHZ;
 		cfg_mask = u64_encode_bits(mask->control[NL80211_BAND_6GHZ].legacy,
 					   RA_MASK_OFDM_RATES);
 		break;
 	default:
 		rtw89_warn(rtwdev, "unhandled band type %d\n", chan->band_type);
 		return -1;
 	}
 
 	if (sta->deflink.he_cap.has_he) {
 		cfg_mask |= u64_encode_bits(mask->control[band].he_mcs[0],
 					    RA_MASK_HE_1SS_RATES);
 		cfg_mask |= u64_encode_bits(mask->control[band].he_mcs[1],
 					    RA_MASK_HE_2SS_RATES);
 	} else if (sta->deflink.vht_cap.vht_supported) {
 		cfg_mask |= u64_encode_bits(mask->control[band].vht_mcs[0],
 					    RA_MASK_VHT_1SS_RATES);
 		cfg_mask |= u64_encode_bits(mask->control[band].vht_mcs[1],
 					    RA_MASK_VHT_2SS_RATES);
 	} else if (sta->deflink.ht_cap.ht_supported) {
 		cfg_mask |= u64_encode_bits(mask->control[band].ht_mcs[0],
 					    RA_MASK_HT_1SS_RATES);
 		cfg_mask |= u64_encode_bits(mask->control[band].ht_mcs[1],
 					    RA_MASK_HT_2SS_RATES);
 	}
 
 	return cfg_mask;
 }
 
 static const u64
 rtw89_ra_mask_ht_rates[4] = {RA_MASK_HT_1SS_RATES, RA_MASK_HT_2SS_RATES,
 			     RA_MASK_HT_3SS_RATES, RA_MASK_HT_4SS_RATES};
 static const u64
 rtw89_ra_mask_vht_rates[4] = {RA_MASK_VHT_1SS_RATES, RA_MASK_VHT_2SS_RATES,
 			      RA_MASK_VHT_3SS_RATES, RA_MASK_VHT_4SS_RATES};
 static const u64
 rtw89_ra_mask_he_rates[4] = {RA_MASK_HE_1SS_RATES, RA_MASK_HE_2SS_RATES,
 			     RA_MASK_HE_3SS_RATES, RA_MASK_HE_4SS_RATES};
 
 static void rtw89_phy_ra_gi_ltf(struct rtw89_dev *rtwdev,
 				struct rtw89_sta *rtwsta,
 				bool *fix_giltf_en, u8 *fix_giltf)
 {
 	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, RTW89_SUB_ENTITY_0);
 	struct cfg80211_bitrate_mask *mask = &rtwsta->mask;
 	u8 band = chan->band_type;
 	enum nl80211_band nl_band = rtw89_hw_to_nl80211_band(band);
 	u8 he_gi = mask->control[nl_band].he_gi;
 	u8 he_ltf = mask->control[nl_band].he_ltf;
 
 	if (!rtwsta->use_cfg_mask)
 		return;
 
 	if (he_ltf == 2 && he_gi == 2) {
 		*fix_giltf = RTW89_GILTF_LGI_4XHE32;
 	} else if (he_ltf == 2 && he_gi == 0) {
 		*fix_giltf = RTW89_GILTF_SGI_4XHE08;
 	} else if (he_ltf == 1 && he_gi == 1) {
 		*fix_giltf = RTW89_GILTF_2XHE16;
 	} else if (he_ltf == 1 && he_gi == 0) {
 		*fix_giltf = RTW89_GILTF_2XHE08;
 	} else if (he_ltf == 0 && he_gi == 1) {
 		*fix_giltf = RTW89_GILTF_1XHE16;
 	} else if (he_ltf == 0 && he_gi == 0) {
 		*fix_giltf = RTW89_GILTF_1XHE08;
 	} else {
 		*fix_giltf_en = false;
 		return;
 	}
 
 	*fix_giltf_en = true;
 }
 
 static void rtw89_phy_ra_sta_update(struct rtw89_dev *rtwdev,
 				    struct ieee80211_sta *sta, bool csi)
 {
 	struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv;
 	struct rtw89_vif *rtwvif = rtwsta->rtwvif;
 	struct rtw89_phy_rate_pattern *rate_pattern = &rtwvif->rate_pattern;
 	struct rtw89_ra_info *ra = &rtwsta->ra;
 	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, RTW89_SUB_ENTITY_0);
 	struct ieee80211_vif *vif = rtwvif_to_vif(rtwsta->rtwvif);
 	const u64 *high_rate_masks = rtw89_ra_mask_ht_rates;
 	u8 rssi = ewma_rssi_read(&rtwsta->avg_rssi);
 	u64 ra_mask = 0;
 	u64 ra_mask_bak;
 	u8 mode = 0;
 	u8 csi_mode = RTW89_RA_RPT_MODE_LEGACY;
 	u8 bw_mode = 0;
 	u8 stbc_en = 0;
 	u8 ldpc_en = 0;
 	u8 fix_giltf = 0;
 	u8 i;
 	bool sgi = false;
 	bool fix_giltf_en = false;
 
 	memset(ra, 0, sizeof(*ra));
 	/* Set the ra mask from sta's capability */
 	if (sta->deflink.he_cap.has_he) {
 		mode |= RTW89_RA_MODE_HE;
 		csi_mode = RTW89_RA_RPT_MODE_HE;
 		ra_mask |= get_he_ra_mask(sta);
 		high_rate_masks = rtw89_ra_mask_he_rates;
 		if (sta->deflink.he_cap.he_cap_elem.phy_cap_info[2] &
 		    IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ)
 			stbc_en = 1;
 		if (sta->deflink.he_cap.he_cap_elem.phy_cap_info[1] &
 		    IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD)
 			ldpc_en = 1;
 		rtw89_phy_ra_gi_ltf(rtwdev, rtwsta, &fix_giltf_en, &fix_giltf);
 	} else if (sta->deflink.vht_cap.vht_supported) {
 		u16 mcs_map = le16_to_cpu(sta->deflink.vht_cap.vht_mcs.rx_mcs_map);
 
 		mode |= RTW89_RA_MODE_VHT;
 		csi_mode = RTW89_RA_RPT_MODE_VHT;
 		/* MCS9, MCS8, MCS7 */
 		ra_mask |= get_mcs_ra_mask(mcs_map, 9, 1);
 		high_rate_masks = rtw89_ra_mask_vht_rates;
 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_MASK)
 			stbc_en = 1;
 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC)
 			ldpc_en = 1;
 	} else if (sta->deflink.ht_cap.ht_supported) {
 		mode |= RTW89_RA_MODE_HT;
 		csi_mode = RTW89_RA_RPT_MODE_HT;
 		ra_mask |= ((u64)sta->deflink.ht_cap.mcs.rx_mask[3] << 48) |
 			   ((u64)sta->deflink.ht_cap.mcs.rx_mask[2] << 36) |
 			   (sta->deflink.ht_cap.mcs.rx_mask[1] << 24) |
 			   (sta->deflink.ht_cap.mcs.rx_mask[0] << 12);
 		high_rate_masks = rtw89_ra_mask_ht_rates;
 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
 			stbc_en = 1;
 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING)
 			ldpc_en = 1;
 	}
 
 	switch (chan->band_type) {
 	case RTW89_BAND_2G:
 		ra_mask |= sta->deflink.supp_rates[NL80211_BAND_2GHZ];
 		if (sta->deflink.supp_rates[NL80211_BAND_2GHZ] & 0xf)
 			mode |= RTW89_RA_MODE_CCK;
 		if (sta->deflink.supp_rates[NL80211_BAND_2GHZ] & 0xff0)
 			mode |= RTW89_RA_MODE_OFDM;
 		break;
 	case RTW89_BAND_5G:
 		ra_mask |= (u64)sta->deflink.supp_rates[NL80211_BAND_5GHZ] << 4;
 		mode |= RTW89_RA_MODE_OFDM;
 		break;
 	case RTW89_BAND_6G:
 		ra_mask |= (u64)sta->deflink.supp_rates[NL80211_BAND_6GHZ] << 4;
 		mode |= RTW89_RA_MODE_OFDM;
 		break;
 	default:
 		rtw89_err(rtwdev, "Unknown band type\n");
 		break;
 	}
 
 	ra_mask_bak = ra_mask;
 
 	if (mode >= RTW89_RA_MODE_HT) {
 		u64 mask = 0;
 		for (i = 0; i < rtwdev->hal.tx_nss; i++)
 			mask |= high_rate_masks[i];
 		if (mode & RTW89_RA_MODE_OFDM)
 			mask |= RA_MASK_SUBOFDM_RATES;
 		if (mode & RTW89_RA_MODE_CCK)
 			mask |= RA_MASK_SUBCCK_RATES;
 		ra_mask &= mask;
 	} else if (mode & RTW89_RA_MODE_OFDM) {
 		ra_mask &= (RA_MASK_OFDM_RATES | RA_MASK_SUBCCK_RATES);
 	}
 
 	if (mode != RTW89_RA_MODE_CCK)
 		ra_mask &= rtw89_phy_ra_mask_rssi(rtwdev, rssi, 0);
 
 	ra_mask = rtw89_phy_ra_mask_recover(ra_mask, ra_mask_bak);
 	ra_mask &= rtw89_phy_ra_mask_cfg(rtwdev, rtwsta);
 
 	switch (sta->deflink.bandwidth) {
 	case IEEE80211_STA_RX_BW_160:
 		bw_mode = RTW89_CHANNEL_WIDTH_160;
 		sgi = sta->deflink.vht_cap.vht_supported &&
 		      (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160);
 		break;
 	case IEEE80211_STA_RX_BW_80:
 		bw_mode = RTW89_CHANNEL_WIDTH_80;
 		sgi = sta->deflink.vht_cap.vht_supported &&
 		      (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80);
 		break;
 	case IEEE80211_STA_RX_BW_40:
 		bw_mode = RTW89_CHANNEL_WIDTH_40;
 		sgi = sta->deflink.ht_cap.ht_supported &&
 		      (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40);
 		break;
 	default:
 		bw_mode = RTW89_CHANNEL_WIDTH_20;
 		sgi = sta->deflink.ht_cap.ht_supported &&
 		      (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20);
 		break;
 	}
 
 	if (sta->deflink.he_cap.he_cap_elem.phy_cap_info[3] &
 	    IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_16_QAM)
 		ra->dcm_cap = 1;
 
 	if (rate_pattern->enable && !vif->p2p) {
 		ra_mask = rtw89_phy_ra_mask_cfg(rtwdev, rtwsta);
 		ra_mask &= rate_pattern->ra_mask;
 		mode = rate_pattern->ra_mode;
 	}
 
 	ra->bw_cap = bw_mode;
 	ra->er_cap = rtwsta->er_cap;
 	ra->mode_ctrl = mode;
 	ra->macid = rtwsta->mac_id;
 	ra->stbc_cap = stbc_en;
 	ra->ldpc_cap = ldpc_en;
 	ra->ss_num = min(sta->deflink.rx_nss, rtwdev->hal.tx_nss) - 1;
 	ra->en_sgi = sgi;
 	ra->ra_mask = ra_mask;
 	ra->fix_giltf_en = fix_giltf_en;
 	ra->fix_giltf = fix_giltf;
 
 	if (!csi)
 		return;
 
 	ra->fixed_csi_rate_en = false;
 	ra->ra_csi_rate_en = true;
 	ra->cr_tbl_sel = false;
 	ra->band_num = rtwvif->phy_idx;
 	ra->csi_bw = bw_mode;
 	ra->csi_gi_ltf = RTW89_GILTF_LGI_4XHE32;
 	ra->csi_mcs_ss_idx = 5;
 	ra->csi_mode = csi_mode;
 }
 
 void rtw89_phy_ra_updata_sta(struct rtw89_dev *rtwdev, struct ieee80211_sta *sta,
 			     u32 changed)
 {
 	struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv;
 	struct rtw89_ra_info *ra = &rtwsta->ra;
 
 	rtw89_phy_ra_sta_update(rtwdev, sta, false);
 
 	if (changed & IEEE80211_RC_SUPP_RATES_CHANGED)
 		ra->upd_mask = 1;
 	if (changed & (IEEE80211_RC_BW_CHANGED | IEEE80211_RC_NSS_CHANGED))
 		ra->upd_bw_nss_mask = 1;
 
 	rtw89_debug(rtwdev, RTW89_DBG_RA,
 		    "ra updat: macid = %d, bw = %d, nss = %d, gi = %d %d",
 		    ra->macid,
 		    ra->bw_cap,
 		    ra->ss_num,
 		    ra->en_sgi,
 		    ra->giltf);
 
 	rtw89_fw_h2c_ra(rtwdev, ra, false);
 }
 
 static bool __check_rate_pattern(struct rtw89_phy_rate_pattern *next,
 				 u16 rate_base, u64 ra_mask, u8 ra_mode,
 				 u32 rate_ctrl, u32 ctrl_skip, bool force)
 {
 	u8 n, c;
 
 	if (rate_ctrl == ctrl_skip)
 		return true;
 
 	n = hweight32(rate_ctrl);
 	if (n == 0)
 		return true;
 
 	if (force && n != 1)
 		return false;
 
 	if (next->enable)
 		return false;
 
 	c = __fls(rate_ctrl);
 	next->rate = rate_base + c;
 	next->ra_mode = ra_mode;
 	next->ra_mask = ra_mask;
 	next->enable = true;
 
 	return true;
 }
 
 #define RTW89_HW_RATE_BY_CHIP_GEN(rate) \
 	{ \
 		[RTW89_CHIP_AX] = RTW89_HW_RATE_ ## rate, \
 		[RTW89_CHIP_BE] = RTW89_HW_RATE_V1_ ## rate, \
 	}
 
 void rtw89_phy_rate_pattern_vif(struct rtw89_dev *rtwdev,
 				struct ieee80211_vif *vif,
 				const struct cfg80211_bitrate_mask *mask)
 {
 	struct ieee80211_supported_band *sband;
 	struct rtw89_vif *rtwvif = (struct rtw89_vif *)vif->drv_priv;
 	struct rtw89_phy_rate_pattern next_pattern = {0};
 	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, RTW89_SUB_ENTITY_0);
 	static const u16 hw_rate_he[][RTW89_CHIP_GEN_NUM] = {
 		RTW89_HW_RATE_BY_CHIP_GEN(HE_NSS1_MCS0),
 		RTW89_HW_RATE_BY_CHIP_GEN(HE_NSS2_MCS0),
 		RTW89_HW_RATE_BY_CHIP_GEN(HE_NSS3_MCS0),
 		RTW89_HW_RATE_BY_CHIP_GEN(HE_NSS4_MCS0),
 	};
 	static const u16 hw_rate_vht[][RTW89_CHIP_GEN_NUM] = {
 		RTW89_HW_RATE_BY_CHIP_GEN(VHT_NSS1_MCS0),
 		RTW89_HW_RATE_BY_CHIP_GEN(VHT_NSS2_MCS0),
 		RTW89_HW_RATE_BY_CHIP_GEN(VHT_NSS3_MCS0),
 		RTW89_HW_RATE_BY_CHIP_GEN(VHT_NSS4_MCS0),
 	};
 	static const u16 hw_rate_ht[][RTW89_CHIP_GEN_NUM] = {
 		RTW89_HW_RATE_BY_CHIP_GEN(MCS0),
 		RTW89_HW_RATE_BY_CHIP_GEN(MCS8),
 		RTW89_HW_RATE_BY_CHIP_GEN(MCS16),
 		RTW89_HW_RATE_BY_CHIP_GEN(MCS24),
 	};
 	u8 band = chan->band_type;
 	enum nl80211_band nl_band = rtw89_hw_to_nl80211_band(band);
 	enum rtw89_chip_gen chip_gen = rtwdev->chip->chip_gen;
 	u8 tx_nss = rtwdev->hal.tx_nss;
 	u8 i;
 
 	for (i = 0; i < tx_nss; i++)
 		if (!__check_rate_pattern(&next_pattern, hw_rate_he[i][chip_gen],
 					  RA_MASK_HE_RATES, RTW89_RA_MODE_HE,
 					  mask->control[nl_band].he_mcs[i],
 					  0, true))
 			goto out;
 
 	for (i = 0; i < tx_nss; i++)
 		if (!__check_rate_pattern(&next_pattern, hw_rate_vht[i][chip_gen],
 					  RA_MASK_VHT_RATES, RTW89_RA_MODE_VHT,
 					  mask->control[nl_band].vht_mcs[i],
 					  0, true))
 			goto out;
 
 	for (i = 0; i < tx_nss; i++)
 		if (!__check_rate_pattern(&next_pattern, hw_rate_ht[i][chip_gen],
 					  RA_MASK_HT_RATES, RTW89_RA_MODE_HT,
 					  mask->control[nl_band].ht_mcs[i],
 					  0, true))
 			goto out;
 
 	/* lagacy cannot be empty for nl80211_parse_tx_bitrate_mask, and
 	 * require at least one basic rate for ieee80211_set_bitrate_mask,
 	 * so the decision just depends on if all bitrates are set or not.
 	 */
 	sband = rtwdev->hw->wiphy->bands[nl_band];
 	if (band == RTW89_BAND_2G) {
 		if (!__check_rate_pattern(&next_pattern, RTW89_HW_RATE_CCK1,
 					  RA_MASK_CCK_RATES | RA_MASK_OFDM_RATES,
 					  RTW89_RA_MODE_CCK | RTW89_RA_MODE_OFDM,
 					  mask->control[nl_band].legacy,
 					  BIT(sband->n_bitrates) - 1, false))
 			goto out;
 	} else {
 		if (!__check_rate_pattern(&next_pattern, RTW89_HW_RATE_OFDM6,
 					  RA_MASK_OFDM_RATES, RTW89_RA_MODE_OFDM,
 					  mask->control[nl_band].legacy,
 					  BIT(sband->n_bitrates) - 1, false))
 			goto out;
 	}
 
 	if (!next_pattern.enable)
 		goto out;
 
 	rtwvif->rate_pattern = next_pattern;
 	rtw89_debug(rtwdev, RTW89_DBG_RA,
 #if defined(__linux__)
 		    "configure pattern: rate 0x%x, mask 0x%llx, mode 0x%x\n",
 #elif defined(__FreeBSD__)
 		    "configure pattern: rate 0x%x, mask 0x%jx, mode 0x%x\n",
 #endif
 		    next_pattern.rate,
 #if defined(__FreeBSD__)
 		    (uintmax_t)
 #endif
 		    next_pattern.ra_mask,
 		    next_pattern.ra_mode);
 	return;
 
 out:
 	rtwvif->rate_pattern.enable = false;
 	rtw89_debug(rtwdev, RTW89_DBG_RA, "unset rate pattern\n");
 }
 
 static void rtw89_phy_ra_updata_sta_iter(void *data, struct ieee80211_sta *sta)
 {
 	struct rtw89_dev *rtwdev = (struct rtw89_dev *)data;
 
 	rtw89_phy_ra_updata_sta(rtwdev, sta, IEEE80211_RC_SUPP_RATES_CHANGED);
 }
 
 void rtw89_phy_ra_update(struct rtw89_dev *rtwdev)
 {
 	ieee80211_iterate_stations_atomic(rtwdev->hw,
 					  rtw89_phy_ra_updata_sta_iter,
 					  rtwdev);
 }
 
 void rtw89_phy_ra_assoc(struct rtw89_dev *rtwdev, struct ieee80211_sta *sta)
 {
 	struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv;
 	struct rtw89_ra_info *ra = &rtwsta->ra;
 	u8 rssi = ewma_rssi_read(&rtwsta->avg_rssi) >> RSSI_FACTOR;
 	bool csi = rtw89_sta_has_beamformer_cap(sta);
 
 	rtw89_phy_ra_sta_update(rtwdev, sta, csi);
 
 	if (rssi > 40)
 		ra->init_rate_lv = 1;
 	else if (rssi > 20)
 		ra->init_rate_lv = 2;
 	else if (rssi > 1)
 		ra->init_rate_lv = 3;
 	else
 		ra->init_rate_lv = 0;
 	ra->upd_all = 1;
 	rtw89_debug(rtwdev, RTW89_DBG_RA,
 		    "ra assoc: macid = %d, mode = %d, bw = %d, nss = %d, lv = %d",
 		    ra->macid,
 		    ra->mode_ctrl,
 		    ra->bw_cap,
 		    ra->ss_num,
 		    ra->init_rate_lv);
 	rtw89_debug(rtwdev, RTW89_DBG_RA,
 		    "ra assoc: dcm = %d, er = %d, ldpc = %d, stbc = %d, gi = %d %d",
 		    ra->dcm_cap,
 		    ra->er_cap,
 		    ra->ldpc_cap,
 		    ra->stbc_cap,
 		    ra->en_sgi,
 		    ra->giltf);
 
 	rtw89_fw_h2c_ra(rtwdev, ra, csi);
 }
 
 u8 rtw89_phy_get_txsc(struct rtw89_dev *rtwdev,
 		      const struct rtw89_chan *chan,
 		      enum rtw89_bandwidth dbw)
 {
 	enum rtw89_bandwidth cbw = chan->band_width;
 	u8 pri_ch = chan->primary_channel;
 	u8 central_ch = chan->channel;
 	u8 txsc_idx = 0;
 	u8 tmp = 0;
 
 	if (cbw == dbw || cbw == RTW89_CHANNEL_WIDTH_20)
 		return txsc_idx;
 
 	switch (cbw) {
 	case RTW89_CHANNEL_WIDTH_40:
 		txsc_idx = pri_ch > central_ch ? 1 : 2;
 		break;
 	case RTW89_CHANNEL_WIDTH_80:
 		if (dbw == RTW89_CHANNEL_WIDTH_20) {
 			if (pri_ch > central_ch)
 				txsc_idx = (pri_ch - central_ch) >> 1;
 			else
 				txsc_idx = ((central_ch - pri_ch) >> 1) + 1;
 		} else {
 			txsc_idx = pri_ch > central_ch ? 9 : 10;
 		}
 		break;
 	case RTW89_CHANNEL_WIDTH_160:
 		if (pri_ch > central_ch)
 			tmp = (pri_ch - central_ch) >> 1;
 		else
 			tmp = ((central_ch - pri_ch) >> 1) + 1;
 
 		if (dbw == RTW89_CHANNEL_WIDTH_20) {
 			txsc_idx = tmp;
 		} else if (dbw == RTW89_CHANNEL_WIDTH_40) {
 			if (tmp == 1 || tmp == 3)
 				txsc_idx = 9;
 			else if (tmp == 5 || tmp == 7)
 				txsc_idx = 11;
 			else if (tmp == 2 || tmp == 4)
 				txsc_idx = 10;
 			else if (tmp == 6 || tmp == 8)
 				txsc_idx = 12;
 			else
 				return 0xff;
 		} else {
 			txsc_idx = pri_ch > central_ch ? 13 : 14;
 		}
 		break;
 	case RTW89_CHANNEL_WIDTH_80_80:
 		if (dbw == RTW89_CHANNEL_WIDTH_20) {
 			if (pri_ch > central_ch)
 				txsc_idx = (10 - (pri_ch - central_ch)) >> 1;
 			else
 				txsc_idx = ((central_ch - pri_ch) >> 1) + 5;
 		} else if (dbw == RTW89_CHANNEL_WIDTH_40) {
 			txsc_idx = pri_ch > central_ch ? 10 : 12;
 		} else {
 			txsc_idx = 14;
 		}
 		break;
 	default:
 		break;
 	}
 
 	return txsc_idx;
 }
 EXPORT_SYMBOL(rtw89_phy_get_txsc);
 
 static bool rtw89_phy_check_swsi_busy(struct rtw89_dev *rtwdev)
 {
 	return !!rtw89_phy_read32_mask(rtwdev, R_SWSI_V1, B_SWSI_W_BUSY_V1) ||
 	       !!rtw89_phy_read32_mask(rtwdev, R_SWSI_V1, B_SWSI_R_BUSY_V1);
 }
 
 u32 rtw89_phy_read_rf(struct rtw89_dev *rtwdev, enum rtw89_rf_path rf_path,
 		      u32 addr, u32 mask)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	const u32 *base_addr = chip->rf_base_addr;
 	u32 val, direct_addr;
 
 	if (rf_path >= rtwdev->chip->rf_path_num) {
 		rtw89_err(rtwdev, "unsupported rf path (%d)\n", rf_path);
 		return INV_RF_DATA;
 	}
 
 	addr &= 0xff;
 	direct_addr = base_addr[rf_path] + (addr << 2);
 	mask &= RFREG_MASK;
 
 	val = rtw89_phy_read32_mask(rtwdev, direct_addr, mask);
 
 	return val;
 }
 EXPORT_SYMBOL(rtw89_phy_read_rf);
 
 static u32 rtw89_phy_read_rf_a(struct rtw89_dev *rtwdev,
 			       enum rtw89_rf_path rf_path, u32 addr, u32 mask)
 {
 	bool busy;
 	bool done;
 	u32 val;
 	int ret;
 
 	ret = read_poll_timeout_atomic(rtw89_phy_check_swsi_busy, busy, !busy,
 				       1, 30, false, rtwdev);
 	if (ret) {
 		rtw89_err(rtwdev, "read rf busy swsi\n");
 		return INV_RF_DATA;
 	}
 
 	mask &= RFREG_MASK;
 
 	val = FIELD_PREP(B_SWSI_READ_ADDR_PATH_V1, rf_path) |
 	      FIELD_PREP(B_SWSI_READ_ADDR_ADDR_V1, addr);
 	rtw89_phy_write32_mask(rtwdev, R_SWSI_READ_ADDR_V1, B_SWSI_READ_ADDR_V1, val);
 	udelay(2);
 
 	ret = read_poll_timeout_atomic(rtw89_phy_read32_mask, done, done, 1,
 				       30, false, rtwdev, R_SWSI_V1,
 				       B_SWSI_R_DATA_DONE_V1);
 	if (ret) {
 		rtw89_err(rtwdev, "read swsi busy\n");
 		return INV_RF_DATA;
 	}
 
 	return rtw89_phy_read32_mask(rtwdev, R_SWSI_V1, mask);
 }
 
 u32 rtw89_phy_read_rf_v1(struct rtw89_dev *rtwdev, enum rtw89_rf_path rf_path,
 			 u32 addr, u32 mask)
 {
 	bool ad_sel = FIELD_GET(RTW89_RF_ADDR_ADSEL_MASK, addr);
 
 	if (rf_path >= rtwdev->chip->rf_path_num) {
 		rtw89_err(rtwdev, "unsupported rf path (%d)\n", rf_path);
 		return INV_RF_DATA;
 	}
 
 	if (ad_sel)
 		return rtw89_phy_read_rf(rtwdev, rf_path, addr, mask);
 	else
 		return rtw89_phy_read_rf_a(rtwdev, rf_path, addr, mask);
 }
 EXPORT_SYMBOL(rtw89_phy_read_rf_v1);
 
 bool rtw89_phy_write_rf(struct rtw89_dev *rtwdev, enum rtw89_rf_path rf_path,
 			u32 addr, u32 mask, u32 data)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	const u32 *base_addr = chip->rf_base_addr;
 	u32 direct_addr;
 
 	if (rf_path >= rtwdev->chip->rf_path_num) {
 		rtw89_err(rtwdev, "unsupported rf path (%d)\n", rf_path);
 		return false;
 	}
 
 	addr &= 0xff;
 	direct_addr = base_addr[rf_path] + (addr << 2);
 	mask &= RFREG_MASK;
 
 	rtw89_phy_write32_mask(rtwdev, direct_addr, mask, data);
 
 	/* delay to ensure writing properly */
 	udelay(1);
 
 	return true;
 }
 EXPORT_SYMBOL(rtw89_phy_write_rf);
 
 static bool rtw89_phy_write_rf_a(struct rtw89_dev *rtwdev,
 				 enum rtw89_rf_path rf_path, u32 addr, u32 mask,
 				 u32 data)
 {
 	u8 bit_shift;
 	u32 val;
 	bool busy, b_msk_en = false;
 	int ret;
 
 	ret = read_poll_timeout_atomic(rtw89_phy_check_swsi_busy, busy, !busy,
 				       1, 30, false, rtwdev);
 	if (ret) {
 		rtw89_err(rtwdev, "write rf busy swsi\n");
 		return false;
 	}
 
 	data &= RFREG_MASK;
 	mask &= RFREG_MASK;
 
 	if (mask != RFREG_MASK) {
 		b_msk_en = true;
 		rtw89_phy_write32_mask(rtwdev, R_SWSI_BIT_MASK_V1, RFREG_MASK,
 				       mask);
 		bit_shift = __ffs(mask);
 		data = (data << bit_shift) & RFREG_MASK;
 	}
 
 	val = FIELD_PREP(B_SWSI_DATA_BIT_MASK_EN_V1, b_msk_en) |
 	      FIELD_PREP(B_SWSI_DATA_PATH_V1, rf_path) |
 	      FIELD_PREP(B_SWSI_DATA_ADDR_V1, addr) |
 	      FIELD_PREP(B_SWSI_DATA_VAL_V1, data);
 
 	rtw89_phy_write32_mask(rtwdev, R_SWSI_DATA_V1, MASKDWORD, val);
 
 	return true;
 }
 
 bool rtw89_phy_write_rf_v1(struct rtw89_dev *rtwdev, enum rtw89_rf_path rf_path,
 			   u32 addr, u32 mask, u32 data)
 {
 	bool ad_sel = FIELD_GET(RTW89_RF_ADDR_ADSEL_MASK, addr);
 
 	if (rf_path >= rtwdev->chip->rf_path_num) {
 		rtw89_err(rtwdev, "unsupported rf path (%d)\n", rf_path);
 		return false;
 	}
 
 	if (ad_sel)
 		return rtw89_phy_write_rf(rtwdev, rf_path, addr, mask, data);
 	else
 		return rtw89_phy_write_rf_a(rtwdev, rf_path, addr, mask, data);
 }
 EXPORT_SYMBOL(rtw89_phy_write_rf_v1);
 
 static bool rtw89_chip_rf_v1(struct rtw89_dev *rtwdev)
 {
 	return rtwdev->chip->ops->write_rf == rtw89_phy_write_rf_v1;
 }
 
 static void rtw89_phy_bb_reset(struct rtw89_dev *rtwdev,
 			       enum rtw89_phy_idx phy_idx)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 
 	chip->ops->bb_reset(rtwdev, phy_idx);
 }
 
 static void rtw89_phy_config_bb_reg(struct rtw89_dev *rtwdev,
 				    const struct rtw89_reg2_def *reg,
 				    enum rtw89_rf_path rf_path,
 				    void *extra_data)
 {
 	if (reg->addr == 0xfe)
 		mdelay(50);
 	else if (reg->addr == 0xfd)
 		mdelay(5);
 	else if (reg->addr == 0xfc)
 		mdelay(1);
 	else if (reg->addr == 0xfb)
 		udelay(50);
 	else if (reg->addr == 0xfa)
 		udelay(5);
 	else if (reg->addr == 0xf9)
 		udelay(1);
 	else
 		rtw89_phy_write32(rtwdev, reg->addr, reg->data);
 }
 
 union rtw89_phy_bb_gain_arg {
 	u32 addr;
 	struct {
 		union {
 			u8 type;
 			struct {
 				u8 rxsc_start:4;
 				u8 bw:4;
 			};
 		};
 		u8 path;
 		u8 gain_band;
 		u8 cfg_type;
 	};
 } __packed;
 
 static void
 rtw89_phy_cfg_bb_gain_error(struct rtw89_dev *rtwdev,
 			    union rtw89_phy_bb_gain_arg arg, u32 data)
 {
 	struct rtw89_phy_bb_gain_info *gain = &rtwdev->bb_gain;
 	u8 type = arg.type;
 	u8 path = arg.path;
 	u8 gband = arg.gain_band;
 	int i;
 
 	switch (type) {
 	case 0:
 		for (i = 0; i < 4; i++, data >>= 8)
 			gain->lna_gain[gband][path][i] = data & 0xff;
 		break;
 	case 1:
 		for (i = 4; i < 7; i++, data >>= 8)
 			gain->lna_gain[gband][path][i] = data & 0xff;
 		break;
 	case 2:
 		for (i = 0; i < 2; i++, data >>= 8)
 			gain->tia_gain[gband][path][i] = data & 0xff;
 		break;
 	default:
 		rtw89_warn(rtwdev,
 			   "bb gain error {0x%x:0x%x} with unknown type: %d\n",
 			   arg.addr, data, type);
 		break;
 	}
 }
 
 enum rtw89_phy_bb_rxsc_start_idx {
 	RTW89_BB_RXSC_START_IDX_FULL = 0,
 	RTW89_BB_RXSC_START_IDX_20 = 1,
 	RTW89_BB_RXSC_START_IDX_20_1 = 5,
 	RTW89_BB_RXSC_START_IDX_40 = 9,
 	RTW89_BB_RXSC_START_IDX_80 = 13,
 };
 
 static void
 rtw89_phy_cfg_bb_rpl_ofst(struct rtw89_dev *rtwdev,
 			  union rtw89_phy_bb_gain_arg arg, u32 data)
 {
 	struct rtw89_phy_bb_gain_info *gain = &rtwdev->bb_gain;
 	u8 rxsc_start = arg.rxsc_start;
 	u8 bw = arg.bw;
 	u8 path = arg.path;
 	u8 gband = arg.gain_band;
 	u8 rxsc;
 	s8 ofst;
 	int i;
 
 	switch (bw) {
 	case RTW89_CHANNEL_WIDTH_20:
 		gain->rpl_ofst_20[gband][path] = (s8)data;
 		break;
 	case RTW89_CHANNEL_WIDTH_40:
 		if (rxsc_start == RTW89_BB_RXSC_START_IDX_FULL) {
 			gain->rpl_ofst_40[gband][path][0] = (s8)data;
 		} else if (rxsc_start == RTW89_BB_RXSC_START_IDX_20) {
 			for (i = 0; i < 2; i++, data >>= 8) {
 				rxsc = RTW89_BB_RXSC_START_IDX_20 + i;
 				ofst = (s8)(data & 0xff);
 				gain->rpl_ofst_40[gband][path][rxsc] = ofst;
 			}
 		}
 		break;
 	case RTW89_CHANNEL_WIDTH_80:
 		if (rxsc_start == RTW89_BB_RXSC_START_IDX_FULL) {
 			gain->rpl_ofst_80[gband][path][0] = (s8)data;
 		} else if (rxsc_start == RTW89_BB_RXSC_START_IDX_20) {
 			for (i = 0; i < 4; i++, data >>= 8) {
 				rxsc = RTW89_BB_RXSC_START_IDX_20 + i;
 				ofst = (s8)(data & 0xff);
 				gain->rpl_ofst_80[gband][path][rxsc] = ofst;
 			}
 		} else if (rxsc_start == RTW89_BB_RXSC_START_IDX_40) {
 			for (i = 0; i < 2; i++, data >>= 8) {
 				rxsc = RTW89_BB_RXSC_START_IDX_40 + i;
 				ofst = (s8)(data & 0xff);
 				gain->rpl_ofst_80[gband][path][rxsc] = ofst;
 			}
 		}
 		break;
 	case RTW89_CHANNEL_WIDTH_160:
 		if (rxsc_start == RTW89_BB_RXSC_START_IDX_FULL) {
 			gain->rpl_ofst_160[gband][path][0] = (s8)data;
 		} else if (rxsc_start == RTW89_BB_RXSC_START_IDX_20) {
 			for (i = 0; i < 4; i++, data >>= 8) {
 				rxsc = RTW89_BB_RXSC_START_IDX_20 + i;
 				ofst = (s8)(data & 0xff);
 				gain->rpl_ofst_160[gband][path][rxsc] = ofst;
 			}
 		} else if (rxsc_start == RTW89_BB_RXSC_START_IDX_20_1) {
 			for (i = 0; i < 4; i++, data >>= 8) {
 				rxsc = RTW89_BB_RXSC_START_IDX_20_1 + i;
 				ofst = (s8)(data & 0xff);
 				gain->rpl_ofst_160[gband][path][rxsc] = ofst;
 			}
 		} else if (rxsc_start == RTW89_BB_RXSC_START_IDX_40) {
 			for (i = 0; i < 4; i++, data >>= 8) {
 				rxsc = RTW89_BB_RXSC_START_IDX_40 + i;
 				ofst = (s8)(data & 0xff);
 				gain->rpl_ofst_160[gband][path][rxsc] = ofst;
 			}
 		} else if (rxsc_start == RTW89_BB_RXSC_START_IDX_80) {
 			for (i = 0; i < 2; i++, data >>= 8) {
 				rxsc = RTW89_BB_RXSC_START_IDX_80 + i;
 				ofst = (s8)(data & 0xff);
 				gain->rpl_ofst_160[gband][path][rxsc] = ofst;
 			}
 		}
 		break;
 	default:
 		rtw89_warn(rtwdev,
 			   "bb rpl ofst {0x%x:0x%x} with unknown bw: %d\n",
 			   arg.addr, data, bw);
 		break;
 	}
 }
 
 static void
 rtw89_phy_cfg_bb_gain_bypass(struct rtw89_dev *rtwdev,
 			     union rtw89_phy_bb_gain_arg arg, u32 data)
 {
 	struct rtw89_phy_bb_gain_info *gain = &rtwdev->bb_gain;
 	u8 type = arg.type;
 	u8 path = arg.path;
 	u8 gband = arg.gain_band;
 	int i;
 
 	switch (type) {
 	case 0:
 		for (i = 0; i < 4; i++, data >>= 8)
 			gain->lna_gain_bypass[gband][path][i] = data & 0xff;
 		break;
 	case 1:
 		for (i = 4; i < 7; i++, data >>= 8)
 			gain->lna_gain_bypass[gband][path][i] = data & 0xff;
 		break;
 	default:
 		rtw89_warn(rtwdev,
 			   "bb gain bypass {0x%x:0x%x} with unknown type: %d\n",
 			   arg.addr, data, type);
 		break;
 	}
 }
 
 static void
 rtw89_phy_cfg_bb_gain_op1db(struct rtw89_dev *rtwdev,
 			    union rtw89_phy_bb_gain_arg arg, u32 data)
 {
 	struct rtw89_phy_bb_gain_info *gain = &rtwdev->bb_gain;
 	u8 type = arg.type;
 	u8 path = arg.path;
 	u8 gband = arg.gain_band;
 	int i;
 
 	switch (type) {
 	case 0:
 		for (i = 0; i < 4; i++, data >>= 8)
 			gain->lna_op1db[gband][path][i] = data & 0xff;
 		break;
 	case 1:
 		for (i = 4; i < 7; i++, data >>= 8)
 			gain->lna_op1db[gband][path][i] = data & 0xff;
 		break;
 	case 2:
 		for (i = 0; i < 4; i++, data >>= 8)
 			gain->tia_lna_op1db[gband][path][i] = data & 0xff;
 		break;
 	case 3:
 		for (i = 4; i < 8; i++, data >>= 8)
 			gain->tia_lna_op1db[gband][path][i] = data & 0xff;
 		break;
 	default:
 		rtw89_warn(rtwdev,
 			   "bb gain op1db {0x%x:0x%x} with unknown type: %d\n",
 			   arg.addr, data, type);
 		break;
 	}
 }
 
 static void rtw89_phy_config_bb_gain(struct rtw89_dev *rtwdev,
 				     const struct rtw89_reg2_def *reg,
 				     enum rtw89_rf_path rf_path,
 				     void *extra_data)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	union rtw89_phy_bb_gain_arg arg = { .addr = reg->addr };
 	struct rtw89_efuse *efuse = &rtwdev->efuse;
 
 	if (arg.gain_band >= RTW89_BB_GAIN_BAND_NR)
 		return;
 
 	if (arg.path >= chip->rf_path_num)
 		return;
 
 	if (arg.addr >= 0xf9 && arg.addr <= 0xfe) {
 		rtw89_warn(rtwdev, "bb gain table with flow ctrl\n");
 		return;
 	}
 
 	switch (arg.cfg_type) {
 	case 0:
 		rtw89_phy_cfg_bb_gain_error(rtwdev, arg, reg->data);
 		break;
 	case 1:
 		rtw89_phy_cfg_bb_rpl_ofst(rtwdev, arg, reg->data);
 		break;
 	case 2:
 		rtw89_phy_cfg_bb_gain_bypass(rtwdev, arg, reg->data);
 		break;
 	case 3:
 		rtw89_phy_cfg_bb_gain_op1db(rtwdev, arg, reg->data);
 		break;
 	case 4:
 		/* This cfg_type is only used by rfe_type >= 50 with eFEM */
 		if (efuse->rfe_type < 50)
 			break;
 		fallthrough;
 	default:
 		rtw89_warn(rtwdev,
 			   "bb gain {0x%x:0x%x} with unknown cfg type: %d\n",
 			   arg.addr, reg->data, arg.cfg_type);
 		break;
 	}
 }
 
 static void
 rtw89_phy_cofig_rf_reg_store(struct rtw89_dev *rtwdev,
 			     const struct rtw89_reg2_def *reg,
 			     enum rtw89_rf_path rf_path,
 			     struct rtw89_fw_h2c_rf_reg_info *info)
 {
 	u16 idx = info->curr_idx % RTW89_H2C_RF_PAGE_SIZE;
 	u8 page = info->curr_idx / RTW89_H2C_RF_PAGE_SIZE;
 
 	if (page >= RTW89_H2C_RF_PAGE_NUM) {
 		rtw89_warn(rtwdev, "RF parameters exceed size. path=%d, idx=%d",
 			   rf_path, info->curr_idx);
 		return;
 	}
 
 	info->rtw89_phy_config_rf_h2c[page][idx] =
 		cpu_to_le32((reg->addr << 20) | reg->data);
 	info->curr_idx++;
 }
 
 static int rtw89_phy_config_rf_reg_fw(struct rtw89_dev *rtwdev,
 				      struct rtw89_fw_h2c_rf_reg_info *info)
 {
 	u16 remain = info->curr_idx;
 	u16 len = 0;
 	u8 i;
 	int ret = 0;
 
 	if (remain > RTW89_H2C_RF_PAGE_NUM * RTW89_H2C_RF_PAGE_SIZE) {
 		rtw89_warn(rtwdev,
 			   "rf reg h2c total len %d larger than %d\n",
 			   remain, RTW89_H2C_RF_PAGE_NUM * RTW89_H2C_RF_PAGE_SIZE);
 		ret = -EINVAL;
 		goto out;
 	}
 
 	for (i = 0; i < RTW89_H2C_RF_PAGE_NUM && remain; i++, remain -= len) {
 		len = remain > RTW89_H2C_RF_PAGE_SIZE ? RTW89_H2C_RF_PAGE_SIZE : remain;
 		ret = rtw89_fw_h2c_rf_reg(rtwdev, info, len * 4, i);
 		if (ret)
 			goto out;
 	}
 out:
 	info->curr_idx = 0;
 
 	return ret;
 }
 
 static void rtw89_phy_config_rf_reg_noio(struct rtw89_dev *rtwdev,
 					 const struct rtw89_reg2_def *reg,
 					 enum rtw89_rf_path rf_path,
 					 void *extra_data)
 {
 	u32 addr = reg->addr;
 
 	if (addr == 0xfe || addr == 0xfd || addr == 0xfc || addr == 0xfb ||
 	    addr == 0xfa || addr == 0xf9)
 		return;
 
 	if (rtw89_chip_rf_v1(rtwdev) && addr < 0x100)
 		return;
 
 	rtw89_phy_cofig_rf_reg_store(rtwdev, reg, rf_path,
 				     (struct rtw89_fw_h2c_rf_reg_info *)extra_data);
 }
 
 static void rtw89_phy_config_rf_reg(struct rtw89_dev *rtwdev,
 				    const struct rtw89_reg2_def *reg,
 				    enum rtw89_rf_path rf_path,
 				    void *extra_data)
 {
 	if (reg->addr == 0xfe) {
 		mdelay(50);
 	} else if (reg->addr == 0xfd) {
 		mdelay(5);
 	} else if (reg->addr == 0xfc) {
 		mdelay(1);
 	} else if (reg->addr == 0xfb) {
 		udelay(50);
 	} else if (reg->addr == 0xfa) {
 		udelay(5);
 	} else if (reg->addr == 0xf9) {
 		udelay(1);
 	} else {
 		rtw89_write_rf(rtwdev, rf_path, reg->addr, 0xfffff, reg->data);
 		rtw89_phy_cofig_rf_reg_store(rtwdev, reg, rf_path,
 					     (struct rtw89_fw_h2c_rf_reg_info *)extra_data);
 	}
 }
 
 void rtw89_phy_config_rf_reg_v1(struct rtw89_dev *rtwdev,
 				const struct rtw89_reg2_def *reg,
 				enum rtw89_rf_path rf_path,
 				void *extra_data)
 {
 	rtw89_write_rf(rtwdev, rf_path, reg->addr, RFREG_MASK, reg->data);
 
 	if (reg->addr < 0x100)
 		return;
 
 	rtw89_phy_cofig_rf_reg_store(rtwdev, reg, rf_path,
 				     (struct rtw89_fw_h2c_rf_reg_info *)extra_data);
 }
 EXPORT_SYMBOL(rtw89_phy_config_rf_reg_v1);
 
 static int rtw89_phy_sel_headline(struct rtw89_dev *rtwdev,
 				  const struct rtw89_phy_table *table,
 				  u32 *headline_size, u32 *headline_idx,
 				  u8 rfe, u8 cv)
 {
 	const struct rtw89_reg2_def *reg;
 	u32 headline;
 	u32 compare, target;
 	u8 rfe_para, cv_para;
 	u8 cv_max = 0;
 	bool case_matched = false;
 	u32 i;
 
 	for (i = 0; i < table->n_regs; i++) {
 		reg = &table->regs[i];
 		headline = get_phy_headline(reg->addr);
 		if (headline != PHY_HEADLINE_VALID)
 			break;
 	}
 	*headline_size = i;
 	if (*headline_size == 0)
 		return 0;
 
 	/* case 1: RFE match, CV match */
 	compare = get_phy_compare(rfe, cv);
 	for (i = 0; i < *headline_size; i++) {
 		reg = &table->regs[i];
 		target = get_phy_target(reg->addr);
 		if (target == compare) {
 			*headline_idx = i;
 			return 0;
 		}
 	}
 
 	/* case 2: RFE match, CV don't care */
 	compare = get_phy_compare(rfe, PHY_COND_DONT_CARE);
 	for (i = 0; i < *headline_size; i++) {
 		reg = &table->regs[i];
 		target = get_phy_target(reg->addr);
 		if (target == compare) {
 			*headline_idx = i;
 			return 0;
 		}
 	}
 
 	/* case 3: RFE match, CV max in table */
 	for (i = 0; i < *headline_size; i++) {
 		reg = &table->regs[i];
 		rfe_para = get_phy_cond_rfe(reg->addr);
 		cv_para = get_phy_cond_cv(reg->addr);
 		if (rfe_para == rfe) {
 			if (cv_para >= cv_max) {
 				cv_max = cv_para;
 				*headline_idx = i;
 				case_matched = true;
 			}
 		}
 	}
 
 	if (case_matched)
 		return 0;
 
 	/* case 4: RFE don't care, CV max in table */
 	for (i = 0; i < *headline_size; i++) {
 		reg = &table->regs[i];
 		rfe_para = get_phy_cond_rfe(reg->addr);
 		cv_para = get_phy_cond_cv(reg->addr);
 		if (rfe_para == PHY_COND_DONT_CARE) {
 			if (cv_para >= cv_max) {
 				cv_max = cv_para;
 				*headline_idx = i;
 				case_matched = true;
 			}
 		}
 	}
 
 	if (case_matched)
 		return 0;
 
 	return -EINVAL;
 }
 
 static void rtw89_phy_init_reg(struct rtw89_dev *rtwdev,
 			       const struct rtw89_phy_table *table,
 			       void (*config)(struct rtw89_dev *rtwdev,
 					      const struct rtw89_reg2_def *reg,
 					      enum rtw89_rf_path rf_path,
 					      void *data),
 			       void *extra_data)
 {
 	const struct rtw89_reg2_def *reg;
 	enum rtw89_rf_path rf_path = table->rf_path;
 	u8 rfe = rtwdev->efuse.rfe_type;
 	u8 cv = rtwdev->hal.cv;
 	u32 i;
 	u32 headline_size = 0, headline_idx = 0;
 	u32 target = 0, cfg_target;
 	u8 cond;
 	bool is_matched = true;
 	bool target_found = false;
 	int ret;
 
 	ret = rtw89_phy_sel_headline(rtwdev, table, &headline_size,
 				     &headline_idx, rfe, cv);
 	if (ret) {
 		rtw89_err(rtwdev, "invalid PHY package: %d/%d\n", rfe, cv);
 		return;
 	}
 
 	cfg_target = get_phy_target(table->regs[headline_idx].addr);
 	for (i = headline_size; i < table->n_regs; i++) {
 		reg = &table->regs[i];
 		cond = get_phy_cond(reg->addr);
 		switch (cond) {
 		case PHY_COND_BRANCH_IF:
 		case PHY_COND_BRANCH_ELIF:
 			target = get_phy_target(reg->addr);
 			break;
 		case PHY_COND_BRANCH_ELSE:
 			is_matched = false;
 			if (!target_found) {
 				rtw89_warn(rtwdev, "failed to load CR %x/%x\n",
 					   reg->addr, reg->data);
 				return;
 			}
 			break;
 		case PHY_COND_BRANCH_END:
 			is_matched = true;
 			target_found = false;
 			break;
 		case PHY_COND_CHECK:
 			if (target_found) {
 				is_matched = false;
 				break;
 			}
 
 			if (target == cfg_target) {
 				is_matched = true;
 				target_found = true;
 			} else {
 				is_matched = false;
 				target_found = false;
 			}
 			break;
 		default:
 			if (is_matched)
 				config(rtwdev, reg, rf_path, extra_data);
 			break;
 		}
 	}
 }
 
 void rtw89_phy_init_bb_reg(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_fw_elm_info *elm_info = &rtwdev->fw.elm_info;
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	const struct rtw89_phy_table *bb_table;
 	const struct rtw89_phy_table *bb_gain_table;
 
 	bb_table = elm_info->bb_tbl ? elm_info->bb_tbl : chip->bb_table;
 	rtw89_phy_init_reg(rtwdev, bb_table, rtw89_phy_config_bb_reg, NULL);
 	rtw89_chip_init_txpwr_unit(rtwdev, RTW89_PHY_0);
 
 	bb_gain_table = elm_info->bb_gain ? elm_info->bb_gain : chip->bb_gain_table;
 	if (bb_gain_table)
 		rtw89_phy_init_reg(rtwdev, bb_gain_table,
 				   rtw89_phy_config_bb_gain, NULL);
 	rtw89_phy_bb_reset(rtwdev, RTW89_PHY_0);
 }
 
 static u32 rtw89_phy_nctl_poll(struct rtw89_dev *rtwdev)
 {
 	rtw89_phy_write32(rtwdev, 0x8080, 0x4);
 	udelay(1);
 	return rtw89_phy_read32(rtwdev, 0x8080);
 }
 
 void rtw89_phy_init_rf_reg(struct rtw89_dev *rtwdev, bool noio)
 {
 	void (*config)(struct rtw89_dev *rtwdev, const struct rtw89_reg2_def *reg,
 		       enum rtw89_rf_path rf_path, void *data);
 	struct rtw89_fw_elm_info *elm_info = &rtwdev->fw.elm_info;
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	const struct rtw89_phy_table *rf_table;
 	struct rtw89_fw_h2c_rf_reg_info *rf_reg_info;
 	u8 path;
 
 	rf_reg_info = kzalloc(sizeof(*rf_reg_info), GFP_KERNEL);
 	if (!rf_reg_info)
 		return;
 
 	for (path = RF_PATH_A; path < chip->rf_path_num; path++) {
 		rf_table = elm_info->rf_radio[path] ?
 			   elm_info->rf_radio[path] : chip->rf_table[path];
 		rf_reg_info->rf_path = rf_table->rf_path;
 		if (noio)
 			config = rtw89_phy_config_rf_reg_noio;
 		else
 			config = rf_table->config ? rf_table->config :
 				 rtw89_phy_config_rf_reg;
 		rtw89_phy_init_reg(rtwdev, rf_table, config, (void *)rf_reg_info);
 		if (rtw89_phy_config_rf_reg_fw(rtwdev, rf_reg_info))
 			rtw89_warn(rtwdev, "rf path %d reg h2c config failed\n",
 				   rf_reg_info->rf_path);
 	}
 	kfree(rf_reg_info);
 }
 
 static void rtw89_phy_init_rf_nctl(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_fw_elm_info *elm_info = &rtwdev->fw.elm_info;
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	const struct rtw89_phy_table *nctl_table;
 	u32 val;
 	int ret;
 
 	/* IQK/DPK clock & reset */
 	rtw89_phy_write32_set(rtwdev, R_IOQ_IQK_DPK, 0x3);
 	rtw89_phy_write32_set(rtwdev, R_GNT_BT_WGT_EN, 0x1);
 	rtw89_phy_write32_set(rtwdev, R_P0_PATH_RST, 0x8000000);
 	if (chip->chip_id != RTL8851B)
 		rtw89_phy_write32_set(rtwdev, R_P1_PATH_RST, 0x8000000);
 	if (chip->chip_id == RTL8852B)
 		rtw89_phy_write32_set(rtwdev, R_IOQ_IQK_DPK, 0x2);
 
 	/* check 0x8080 */
 	rtw89_phy_write32(rtwdev, R_NCTL_CFG, 0x8);
 
 	ret = read_poll_timeout(rtw89_phy_nctl_poll, val, val == 0x4, 10,
 				1000, false, rtwdev);
 	if (ret)
+#if defined(__linux__)
 		rtw89_err(rtwdev, "failed to poll nctl block\n");
+#elif defined(__FreeBSD__)
+		rtw89_err(rtwdev, "failed to poll nctl block: ret %d val %#06x\n", ret, val);
+#endif
 
 	nctl_table = elm_info->rf_nctl ? elm_info->rf_nctl : chip->nctl_table;
 	rtw89_phy_init_reg(rtwdev, nctl_table, rtw89_phy_config_bb_reg, NULL);
 
 	if (chip->nctl_post_table)
 		rtw89_rfk_parser(rtwdev, chip->nctl_post_table);
 }
 
 static u32 rtw89_phy0_phy1_offset(struct rtw89_dev *rtwdev, u32 addr)
 {
 	u32 phy_page = addr >> 8;
 	u32 ofst = 0;
 
 	switch (phy_page) {
 	case 0x6:
 	case 0x7:
 	case 0x8:
 	case 0x9:
 	case 0xa:
 	case 0xb:
 	case 0xc:
 	case 0xd:
 	case 0x19:
 	case 0x1a:
 	case 0x1b:
 		ofst = 0x2000;
 		break;
 	default:
 		/* warning case */
 		ofst = 0;
 		break;
 	}
 
 	if (phy_page >= 0x40 && phy_page <= 0x4f)
 		ofst = 0x2000;
 
 	return ofst;
 }
 
 void rtw89_phy_write32_idx(struct rtw89_dev *rtwdev, u32 addr, u32 mask,
 			   u32 data, enum rtw89_phy_idx phy_idx)
 {
 	if (rtwdev->dbcc_en && phy_idx == RTW89_PHY_1)
 		addr += rtw89_phy0_phy1_offset(rtwdev, addr);
 	rtw89_phy_write32_mask(rtwdev, addr, mask, data);
 }
 EXPORT_SYMBOL(rtw89_phy_write32_idx);
 
 u32 rtw89_phy_read32_idx(struct rtw89_dev *rtwdev, u32 addr, u32 mask,
 			 enum rtw89_phy_idx phy_idx)
 {
 	if (rtwdev->dbcc_en && phy_idx == RTW89_PHY_1)
 		addr += rtw89_phy0_phy1_offset(rtwdev, addr);
 	return rtw89_phy_read32_mask(rtwdev, addr, mask);
 }
 EXPORT_SYMBOL(rtw89_phy_read32_idx);
 
 void rtw89_phy_set_phy_regs(struct rtw89_dev *rtwdev, u32 addr, u32 mask,
 			    u32 val)
 {
 	rtw89_phy_write32_idx(rtwdev, addr, mask, val, RTW89_PHY_0);
 
 	if (!rtwdev->dbcc_en)
 		return;
 
 	rtw89_phy_write32_idx(rtwdev, addr, mask, val, RTW89_PHY_1);
 }
 
 void rtw89_phy_write_reg3_tbl(struct rtw89_dev *rtwdev,
 			      const struct rtw89_phy_reg3_tbl *tbl)
 {
 	const struct rtw89_reg3_def *reg3;
 	int i;
 
 	for (i = 0; i < tbl->size; i++) {
 		reg3 = &tbl->reg3[i];
 		rtw89_phy_write32_mask(rtwdev, reg3->addr, reg3->mask, reg3->data);
 	}
 }
 EXPORT_SYMBOL(rtw89_phy_write_reg3_tbl);
 
 static const u8 rtw89_rs_idx_num[] = {
 	[RTW89_RS_CCK] = RTW89_RATE_CCK_NUM,
 	[RTW89_RS_OFDM] = RTW89_RATE_OFDM_NUM,
 	[RTW89_RS_MCS] = RTW89_RATE_MCS_NUM,
 	[RTW89_RS_HEDCM] = RTW89_RATE_HEDCM_NUM,
 	[RTW89_RS_OFFSET] = RTW89_RATE_OFFSET_NUM,
 };
 
 static const u8 rtw89_rs_nss_num[] = {
 	[RTW89_RS_CCK] = 1,
 	[RTW89_RS_OFDM] = 1,
 	[RTW89_RS_MCS] = RTW89_NSS_NUM,
 	[RTW89_RS_HEDCM] = RTW89_NSS_HEDCM_NUM,
 	[RTW89_RS_OFFSET] = 1,
 };
 
 static const u8 _byr_of_rs[] = {
 	[RTW89_RS_CCK] = offsetof(struct rtw89_txpwr_byrate, cck),
 	[RTW89_RS_OFDM] = offsetof(struct rtw89_txpwr_byrate, ofdm),
 	[RTW89_RS_MCS] = offsetof(struct rtw89_txpwr_byrate, mcs),
 	[RTW89_RS_HEDCM] = offsetof(struct rtw89_txpwr_byrate, hedcm),
 	[RTW89_RS_OFFSET] = offsetof(struct rtw89_txpwr_byrate, offset),
 };
 
 #define _byr_seek(rs, raw) ((s8 *)(raw) + _byr_of_rs[rs])
 #define _byr_idx(rs, nss, idx) ((nss) * rtw89_rs_idx_num[rs] + (idx))
 #define _byr_chk(rs, nss, idx) \
 	((nss) < rtw89_rs_nss_num[rs] && (idx) < rtw89_rs_idx_num[rs])
 
 void rtw89_phy_load_txpwr_byrate(struct rtw89_dev *rtwdev,
 				 const struct rtw89_txpwr_table *tbl)
 {
 	const struct rtw89_txpwr_byrate_cfg *cfg = tbl->data;
 	const struct rtw89_txpwr_byrate_cfg *end = cfg + tbl->size;
 	s8 *byr;
 	u32 data;
 	u8 i, idx;
 
 	for (; cfg < end; cfg++) {
 		byr = _byr_seek(cfg->rs, &rtwdev->byr[cfg->band]);
 		data = cfg->data;
 
 		for (i = 0; i < cfg->len; i++, data >>= 8) {
 			idx = _byr_idx(cfg->rs, cfg->nss, (cfg->shf + i));
 			byr[idx] = (s8)(data & 0xff);
 		}
 	}
 }
 EXPORT_SYMBOL(rtw89_phy_load_txpwr_byrate);
 
 #define _phy_txpwr_rf_to_mac(rtwdev, txpwr_rf)				\
 ({									\
 	const struct rtw89_chip_info *__c = (rtwdev)->chip;		\
 	(txpwr_rf) >> (__c->txpwr_factor_rf - __c->txpwr_factor_mac);	\
 })
 
 static
 s8 rtw89_phy_read_txpwr_byrate(struct rtw89_dev *rtwdev, u8 band,
 			       const struct rtw89_rate_desc *rate_desc)
 {
 	s8 *byr;
 	u8 idx;
 
 	if (rate_desc->rs == RTW89_RS_CCK)
 		band = RTW89_BAND_2G;
 
 	if (!_byr_chk(rate_desc->rs, rate_desc->nss, rate_desc->idx)) {
 		rtw89_debug(rtwdev, RTW89_DBG_TXPWR,
 			    "[TXPWR] unknown byrate desc rs=%d nss=%d idx=%d\n",
 			    rate_desc->rs, rate_desc->nss, rate_desc->idx);
 
 		return 0;
 	}
 
 	byr = _byr_seek(rate_desc->rs, &rtwdev->byr[band]);
 	idx = _byr_idx(rate_desc->rs, rate_desc->nss, rate_desc->idx);
 
 	return _phy_txpwr_rf_to_mac(rtwdev, byr[idx]);
 }
 
 static u8 rtw89_channel_6g_to_idx(struct rtw89_dev *rtwdev, u8 channel_6g)
 {
 	switch (channel_6g) {
 	case 1 ... 29:
 		return (channel_6g - 1) / 2;
 	case 33 ... 61:
 		return (channel_6g - 3) / 2;
 	case 65 ... 93:
 		return (channel_6g - 5) / 2;
 	case 97 ... 125:
 		return (channel_6g - 7) / 2;
 	case 129 ... 157:
 		return (channel_6g - 9) / 2;
 	case 161 ... 189:
 		return (channel_6g - 11) / 2;
 	case 193 ... 221:
 		return (channel_6g - 13) / 2;
 	case 225 ... 253:
 		return (channel_6g - 15) / 2;
 	default:
 		rtw89_warn(rtwdev, "unknown 6g channel: %d\n", channel_6g);
 		return 0;
 	}
 }
 
 static u8 rtw89_channel_to_idx(struct rtw89_dev *rtwdev, u8 band, u8 channel)
 {
 	if (band == RTW89_BAND_6G)
 		return rtw89_channel_6g_to_idx(rtwdev, channel);
 
 	switch (channel) {
 	case 1 ... 14:
 		return channel - 1;
 	case 36 ... 64:
 		return (channel - 36) / 2;
 	case 100 ... 144:
 		return ((channel - 100) / 2) + 15;
 	case 149 ... 177:
 		return ((channel - 149) / 2) + 38;
 	default:
 		rtw89_warn(rtwdev, "unknown channel: %d\n", channel);
 		return 0;
 	}
 }
 
 s8 rtw89_phy_read_txpwr_limit(struct rtw89_dev *rtwdev, u8 band,
 			      u8 bw, u8 ntx, u8 rs, u8 bf, u8 ch)
 {
 	const struct rtw89_rfe_parms *rfe_parms = rtwdev->rfe_parms;
 	const struct rtw89_txpwr_rule_2ghz *rule_2ghz = &rfe_parms->rule_2ghz;
 	const struct rtw89_txpwr_rule_5ghz *rule_5ghz = &rfe_parms->rule_5ghz;
 	const struct rtw89_txpwr_rule_6ghz *rule_6ghz = &rfe_parms->rule_6ghz;
 	struct rtw89_regulatory_info *regulatory = &rtwdev->regulatory;
 	u8 ch_idx = rtw89_channel_to_idx(rtwdev, band, ch);
 	u8 regd = rtw89_regd_get(rtwdev, band);
 	u8 reg6 = regulatory->reg_6ghz_power;
 	s8 lmt = 0, sar;
 
 	switch (band) {
 	case RTW89_BAND_2G:
 		lmt = (*rule_2ghz->lmt)[bw][ntx][rs][bf][regd][ch_idx];
 		if (lmt)
 			break;
 
 		lmt = (*rule_2ghz->lmt)[bw][ntx][rs][bf][RTW89_WW][ch_idx];
 		break;
 	case RTW89_BAND_5G:
 		lmt = (*rule_5ghz->lmt)[bw][ntx][rs][bf][regd][ch_idx];
 		if (lmt)
 			break;
 
 		lmt = (*rule_5ghz->lmt)[bw][ntx][rs][bf][RTW89_WW][ch_idx];
 		break;
 	case RTW89_BAND_6G:
 		lmt = (*rule_6ghz->lmt)[bw][ntx][rs][bf][regd][reg6][ch_idx];
 		if (lmt)
 			break;
 
 		lmt = (*rule_6ghz->lmt)[bw][ntx][rs][bf][RTW89_WW]
 				       [RTW89_REG_6GHZ_POWER_DFLT]
 				       [ch_idx];
 		break;
 	default:
 		rtw89_warn(rtwdev, "unknown band type: %d\n", band);
 		return 0;
 	}
 
 	lmt = _phy_txpwr_rf_to_mac(rtwdev, lmt);
 	sar = rtw89_query_sar(rtwdev);
 
 	return min(lmt, sar);
 }
 EXPORT_SYMBOL(rtw89_phy_read_txpwr_limit);
 
 #define __fill_txpwr_limit_nonbf_bf(ptr, band, bw, ntx, rs, ch)		\
 	do {								\
 		u8 __i;							\
 		for (__i = 0; __i < RTW89_BF_NUM; __i++)		\
 			ptr[__i] = rtw89_phy_read_txpwr_limit(rtwdev,	\
 							      band,	\
 							      bw, ntx,	\
 							      rs, __i,	\
 							      (ch));	\
 	} while (0)
 
 static void rtw89_phy_fill_txpwr_limit_20m(struct rtw89_dev *rtwdev,
 					   struct rtw89_txpwr_limit *lmt,
 					   u8 band, u8 ntx, u8 ch)
 {
 	__fill_txpwr_limit_nonbf_bf(lmt->cck_20m, band, RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_CCK, ch);
 	__fill_txpwr_limit_nonbf_bf(lmt->cck_40m, band, RTW89_CHANNEL_WIDTH_40,
 				    ntx, RTW89_RS_CCK, ch);
 	__fill_txpwr_limit_nonbf_bf(lmt->ofdm, band, RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_OFDM, ch);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_20m[0], band,
 				    RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_MCS, ch);
 }
 
 static void rtw89_phy_fill_txpwr_limit_40m(struct rtw89_dev *rtwdev,
 					   struct rtw89_txpwr_limit *lmt,
 					   u8 band, u8 ntx, u8 ch, u8 pri_ch)
 {
 	__fill_txpwr_limit_nonbf_bf(lmt->cck_20m, band, RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_CCK, ch - 2);
 	__fill_txpwr_limit_nonbf_bf(lmt->cck_40m, band, RTW89_CHANNEL_WIDTH_40,
 				    ntx, RTW89_RS_CCK, ch);
 	__fill_txpwr_limit_nonbf_bf(lmt->ofdm, band, RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_OFDM, pri_ch);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_20m[0], band,
 				    RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_MCS, ch - 2);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_20m[1], band,
 				    RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_MCS, ch + 2);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_40m[0], band,
 				    RTW89_CHANNEL_WIDTH_40,
 				    ntx, RTW89_RS_MCS, ch);
 }
 
 static void rtw89_phy_fill_txpwr_limit_80m(struct rtw89_dev *rtwdev,
 					   struct rtw89_txpwr_limit *lmt,
 					   u8 band, u8 ntx, u8 ch, u8 pri_ch)
 {
 	s8 val_0p5_n[RTW89_BF_NUM];
 	s8 val_0p5_p[RTW89_BF_NUM];
 	u8 i;
 
 	__fill_txpwr_limit_nonbf_bf(lmt->ofdm, band, RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_OFDM, pri_ch);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_20m[0], band,
 				    RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_MCS, ch - 6);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_20m[1], band,
 				    RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_MCS, ch - 2);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_20m[2], band,
 				    RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_MCS, ch + 2);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_20m[3], band,
 				    RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_MCS, ch + 6);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_40m[0], band,
 				    RTW89_CHANNEL_WIDTH_40,
 				    ntx, RTW89_RS_MCS, ch - 4);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_40m[1], band,
 				    RTW89_CHANNEL_WIDTH_40,
 				    ntx, RTW89_RS_MCS, ch + 4);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_80m[0], band,
 				    RTW89_CHANNEL_WIDTH_80,
 				    ntx, RTW89_RS_MCS, ch);
 
 	__fill_txpwr_limit_nonbf_bf(val_0p5_n, band, RTW89_CHANNEL_WIDTH_40,
 				    ntx, RTW89_RS_MCS, ch - 4);
 	__fill_txpwr_limit_nonbf_bf(val_0p5_p, band, RTW89_CHANNEL_WIDTH_40,
 				    ntx, RTW89_RS_MCS, ch + 4);
 
 	for (i = 0; i < RTW89_BF_NUM; i++)
 		lmt->mcs_40m_0p5[i] = min_t(s8, val_0p5_n[i], val_0p5_p[i]);
 }
 
 static void rtw89_phy_fill_txpwr_limit_160m(struct rtw89_dev *rtwdev,
 					    struct rtw89_txpwr_limit *lmt,
 					    u8 band, u8 ntx, u8 ch, u8 pri_ch)
 {
 	s8 val_0p5_n[RTW89_BF_NUM];
 	s8 val_0p5_p[RTW89_BF_NUM];
 	s8 val_2p5_n[RTW89_BF_NUM];
 	s8 val_2p5_p[RTW89_BF_NUM];
 	u8 i;
 
 	/* fill ofdm section */
 	__fill_txpwr_limit_nonbf_bf(lmt->ofdm, band, RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_OFDM, pri_ch);
 
 	/* fill mcs 20m section */
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_20m[0], band,
 				    RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_MCS, ch - 14);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_20m[1], band,
 				    RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_MCS, ch - 10);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_20m[2], band,
 				    RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_MCS, ch - 6);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_20m[3], band,
 				    RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_MCS, ch - 2);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_20m[4], band,
 				    RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_MCS, ch + 2);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_20m[5], band,
 				    RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_MCS, ch + 6);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_20m[6], band,
 				    RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_MCS, ch + 10);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_20m[7], band,
 				    RTW89_CHANNEL_WIDTH_20,
 				    ntx, RTW89_RS_MCS, ch + 14);
 
 	/* fill mcs 40m section */
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_40m[0], band,
 				    RTW89_CHANNEL_WIDTH_40,
 				    ntx, RTW89_RS_MCS, ch - 12);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_40m[1], band,
 				    RTW89_CHANNEL_WIDTH_40,
 				    ntx, RTW89_RS_MCS, ch - 4);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_40m[2], band,
 				    RTW89_CHANNEL_WIDTH_40,
 				    ntx, RTW89_RS_MCS, ch + 4);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_40m[3], band,
 				    RTW89_CHANNEL_WIDTH_40,
 				    ntx, RTW89_RS_MCS, ch + 12);
 
 	/* fill mcs 80m section */
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_80m[0], band,
 				    RTW89_CHANNEL_WIDTH_80,
 				    ntx, RTW89_RS_MCS, ch - 8);
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_80m[1], band,
 				    RTW89_CHANNEL_WIDTH_80,
 				    ntx, RTW89_RS_MCS, ch + 8);
 
 	/* fill mcs 160m section */
 	__fill_txpwr_limit_nonbf_bf(lmt->mcs_160m, band,
 				    RTW89_CHANNEL_WIDTH_160,
 				    ntx, RTW89_RS_MCS, ch);
 
 	/* fill mcs 40m 0p5 section */
 	__fill_txpwr_limit_nonbf_bf(val_0p5_n, band, RTW89_CHANNEL_WIDTH_40,
 				    ntx, RTW89_RS_MCS, ch - 4);
 	__fill_txpwr_limit_nonbf_bf(val_0p5_p, band, RTW89_CHANNEL_WIDTH_40,
 				    ntx, RTW89_RS_MCS, ch + 4);
 
 	for (i = 0; i < RTW89_BF_NUM; i++)
 		lmt->mcs_40m_0p5[i] = min_t(s8, val_0p5_n[i], val_0p5_p[i]);
 
 	/* fill mcs 40m 2p5 section */
 	__fill_txpwr_limit_nonbf_bf(val_2p5_n, band, RTW89_CHANNEL_WIDTH_40,
 				    ntx, RTW89_RS_MCS, ch - 8);
 	__fill_txpwr_limit_nonbf_bf(val_2p5_p, band, RTW89_CHANNEL_WIDTH_40,
 				    ntx, RTW89_RS_MCS, ch + 8);
 
 	for (i = 0; i < RTW89_BF_NUM; i++)
 		lmt->mcs_40m_2p5[i] = min_t(s8, val_2p5_n[i], val_2p5_p[i]);
 }
 
 static
 void rtw89_phy_fill_txpwr_limit(struct rtw89_dev *rtwdev,
 				const struct rtw89_chan *chan,
 				struct rtw89_txpwr_limit *lmt,
 				u8 ntx)
 {
 	u8 band = chan->band_type;
 	u8 pri_ch = chan->primary_channel;
 	u8 ch = chan->channel;
 	u8 bw = chan->band_width;
 
 	memset(lmt, 0, sizeof(*lmt));
 
 	switch (bw) {
 	case RTW89_CHANNEL_WIDTH_20:
 		rtw89_phy_fill_txpwr_limit_20m(rtwdev, lmt, band, ntx, ch);
 		break;
 	case RTW89_CHANNEL_WIDTH_40:
 		rtw89_phy_fill_txpwr_limit_40m(rtwdev, lmt, band, ntx, ch,
 					       pri_ch);
 		break;
 	case RTW89_CHANNEL_WIDTH_80:
 		rtw89_phy_fill_txpwr_limit_80m(rtwdev, lmt, band, ntx, ch,
 					       pri_ch);
 		break;
 	case RTW89_CHANNEL_WIDTH_160:
 		rtw89_phy_fill_txpwr_limit_160m(rtwdev, lmt, band, ntx, ch,
 						pri_ch);
 		break;
 	}
 }
 
 static s8 rtw89_phy_read_txpwr_limit_ru(struct rtw89_dev *rtwdev, u8 band,
 					u8 ru, u8 ntx, u8 ch)
 {
 	const struct rtw89_rfe_parms *rfe_parms = rtwdev->rfe_parms;
 	const struct rtw89_txpwr_rule_2ghz *rule_2ghz = &rfe_parms->rule_2ghz;
 	const struct rtw89_txpwr_rule_5ghz *rule_5ghz = &rfe_parms->rule_5ghz;
 	const struct rtw89_txpwr_rule_6ghz *rule_6ghz = &rfe_parms->rule_6ghz;
 	struct rtw89_regulatory_info *regulatory = &rtwdev->regulatory;
 	u8 ch_idx = rtw89_channel_to_idx(rtwdev, band, ch);
 	u8 regd = rtw89_regd_get(rtwdev, band);
 	u8 reg6 = regulatory->reg_6ghz_power;
 	s8 lmt_ru = 0, sar;
 
 	switch (band) {
 	case RTW89_BAND_2G:
 		lmt_ru = (*rule_2ghz->lmt_ru)[ru][ntx][regd][ch_idx];
 		if (lmt_ru)
 			break;
 
 		lmt_ru = (*rule_2ghz->lmt_ru)[ru][ntx][RTW89_WW][ch_idx];
 		break;
 	case RTW89_BAND_5G:
 		lmt_ru = (*rule_5ghz->lmt_ru)[ru][ntx][regd][ch_idx];
 		if (lmt_ru)
 			break;
 
 		lmt_ru = (*rule_5ghz->lmt_ru)[ru][ntx][RTW89_WW][ch_idx];
 		break;
 	case RTW89_BAND_6G:
 		lmt_ru = (*rule_6ghz->lmt_ru)[ru][ntx][regd][reg6][ch_idx];
 		if (lmt_ru)
 			break;
 
 		lmt_ru = (*rule_6ghz->lmt_ru)[ru][ntx][RTW89_WW]
 					     [RTW89_REG_6GHZ_POWER_DFLT]
 					     [ch_idx];
 		break;
 	default:
 		rtw89_warn(rtwdev, "unknown band type: %d\n", band);
 		return 0;
 	}
 
 	lmt_ru = _phy_txpwr_rf_to_mac(rtwdev, lmt_ru);
 	sar = rtw89_query_sar(rtwdev);
 
 	return min(lmt_ru, sar);
 }
 
 static void
 rtw89_phy_fill_txpwr_limit_ru_20m(struct rtw89_dev *rtwdev,
 				  struct rtw89_txpwr_limit_ru *lmt_ru,
 				  u8 band, u8 ntx, u8 ch)
 {
 	lmt_ru->ru26[0] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							RTW89_RU26,
 							ntx, ch);
 	lmt_ru->ru52[0] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							RTW89_RU52,
 							ntx, ch);
 	lmt_ru->ru106[0] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							 RTW89_RU106,
 							 ntx, ch);
 }
 
 static void
 rtw89_phy_fill_txpwr_limit_ru_40m(struct rtw89_dev *rtwdev,
 				  struct rtw89_txpwr_limit_ru *lmt_ru,
 				  u8 band, u8 ntx, u8 ch)
 {
 	lmt_ru->ru26[0] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							RTW89_RU26,
 							ntx, ch - 2);
 	lmt_ru->ru26[1] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							RTW89_RU26,
 							ntx, ch + 2);
 	lmt_ru->ru52[0] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							RTW89_RU52,
 							ntx, ch - 2);
 	lmt_ru->ru52[1] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							RTW89_RU52,
 							ntx, ch + 2);
 	lmt_ru->ru106[0] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							 RTW89_RU106,
 							 ntx, ch - 2);
 	lmt_ru->ru106[1] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							 RTW89_RU106,
 							 ntx, ch + 2);
 }
 
 static void
 rtw89_phy_fill_txpwr_limit_ru_80m(struct rtw89_dev *rtwdev,
 				  struct rtw89_txpwr_limit_ru *lmt_ru,
 				  u8 band, u8 ntx, u8 ch)
 {
 	lmt_ru->ru26[0] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							RTW89_RU26,
 							ntx, ch - 6);
 	lmt_ru->ru26[1] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							RTW89_RU26,
 							ntx, ch - 2);
 	lmt_ru->ru26[2] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							RTW89_RU26,
 							ntx, ch + 2);
 	lmt_ru->ru26[3] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							RTW89_RU26,
 							ntx, ch + 6);
 	lmt_ru->ru52[0] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							RTW89_RU52,
 							ntx, ch - 6);
 	lmt_ru->ru52[1] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							RTW89_RU52,
 							ntx, ch - 2);
 	lmt_ru->ru52[2] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							RTW89_RU52,
 							ntx, ch + 2);
 	lmt_ru->ru52[3] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							RTW89_RU52,
 							ntx, ch + 6);
 	lmt_ru->ru106[0] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							 RTW89_RU106,
 							 ntx, ch - 6);
 	lmt_ru->ru106[1] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							 RTW89_RU106,
 							 ntx, ch - 2);
 	lmt_ru->ru106[2] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							 RTW89_RU106,
 							 ntx, ch + 2);
 	lmt_ru->ru106[3] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 							 RTW89_RU106,
 							 ntx, ch + 6);
 }
 
 static void
 rtw89_phy_fill_txpwr_limit_ru_160m(struct rtw89_dev *rtwdev,
 				   struct rtw89_txpwr_limit_ru *lmt_ru,
 				   u8 band, u8 ntx, u8 ch)
 {
 	static const int ofst[] = { -14, -10, -6, -2, 2, 6, 10, 14 };
 	int i;
 
 #if defined(__linux__)
 	static_assert(ARRAY_SIZE(ofst) == RTW89_RU_SEC_NUM);
 #elif defined(__FreeBSD__)
 	rtw89_static_assert(ARRAY_SIZE(ofst) == RTW89_RU_SEC_NUM);
 #endif
 	for (i = 0; i < RTW89_RU_SEC_NUM; i++) {
 		lmt_ru->ru26[i] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 								RTW89_RU26,
 								ntx,
 								ch + ofst[i]);
 		lmt_ru->ru52[i] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 								RTW89_RU52,
 								ntx,
 								ch + ofst[i]);
 		lmt_ru->ru106[i] = rtw89_phy_read_txpwr_limit_ru(rtwdev, band,
 								 RTW89_RU106,
 								 ntx,
 								 ch + ofst[i]);
 	}
 }
 
 static
 void rtw89_phy_fill_txpwr_limit_ru(struct rtw89_dev *rtwdev,
 				   const struct rtw89_chan *chan,
 				   struct rtw89_txpwr_limit_ru *lmt_ru,
 				   u8 ntx)
 {
 	u8 band = chan->band_type;
 	u8 ch = chan->channel;
 	u8 bw = chan->band_width;
 
 	memset(lmt_ru, 0, sizeof(*lmt_ru));
 
 	switch (bw) {
 	case RTW89_CHANNEL_WIDTH_20:
 		rtw89_phy_fill_txpwr_limit_ru_20m(rtwdev, lmt_ru, band, ntx,
 						  ch);
 		break;
 	case RTW89_CHANNEL_WIDTH_40:
 		rtw89_phy_fill_txpwr_limit_ru_40m(rtwdev, lmt_ru, band, ntx,
 						  ch);
 		break;
 	case RTW89_CHANNEL_WIDTH_80:
 		rtw89_phy_fill_txpwr_limit_ru_80m(rtwdev, lmt_ru, band, ntx,
 						  ch);
 		break;
 	case RTW89_CHANNEL_WIDTH_160:
 		rtw89_phy_fill_txpwr_limit_ru_160m(rtwdev, lmt_ru, band, ntx,
 						   ch);
 		break;
 	}
 }
 
 void rtw89_phy_set_txpwr_byrate(struct rtw89_dev *rtwdev,
 				const struct rtw89_chan *chan,
 				enum rtw89_phy_idx phy_idx)
 {
 	u8 max_nss_num = rtwdev->chip->rf_path_num;
 	static const u8 rs[] = {
 		RTW89_RS_CCK,
 		RTW89_RS_OFDM,
 		RTW89_RS_MCS,
 		RTW89_RS_HEDCM,
 	};
 	struct rtw89_rate_desc cur;
 	u8 band = chan->band_type;
 	u8 ch = chan->channel;
 	u32 addr, val;
 	s8 v[4] = {};
 	u8 i;
 
 	rtw89_debug(rtwdev, RTW89_DBG_TXPWR,
 		    "[TXPWR] set txpwr byrate with ch=%d\n", ch);
 
 	BUILD_BUG_ON(rtw89_rs_idx_num[RTW89_RS_CCK] % 4);
 	BUILD_BUG_ON(rtw89_rs_idx_num[RTW89_RS_OFDM] % 4);
 	BUILD_BUG_ON(rtw89_rs_idx_num[RTW89_RS_MCS] % 4);
 	BUILD_BUG_ON(rtw89_rs_idx_num[RTW89_RS_HEDCM] % 4);
 
 	addr = R_AX_PWR_BY_RATE;
 	for (cur.nss = 0; cur.nss < max_nss_num; cur.nss++) {
 		for (i = 0; i < ARRAY_SIZE(rs); i++) {
 			if (cur.nss >= rtw89_rs_nss_num[rs[i]])
 				continue;
 
 			cur.rs = rs[i];
 			for (cur.idx = 0; cur.idx < rtw89_rs_idx_num[rs[i]];
 			     cur.idx++) {
 				v[cur.idx % 4] =
 					rtw89_phy_read_txpwr_byrate(rtwdev,
 								    band,
 								    &cur);
 
 				if ((cur.idx + 1) % 4)
 					continue;
 
 				val = FIELD_PREP(GENMASK(7, 0), v[0]) |
 				      FIELD_PREP(GENMASK(15, 8), v[1]) |
 				      FIELD_PREP(GENMASK(23, 16), v[2]) |
 				      FIELD_PREP(GENMASK(31, 24), v[3]);
 
 				rtw89_mac_txpwr_write32(rtwdev, phy_idx, addr,
 							val);
 				addr += 4;
 			}
 		}
 	}
 }
 EXPORT_SYMBOL(rtw89_phy_set_txpwr_byrate);
 
 void rtw89_phy_set_txpwr_offset(struct rtw89_dev *rtwdev,
 				const struct rtw89_chan *chan,
 				enum rtw89_phy_idx phy_idx)
 {
 	struct rtw89_rate_desc desc = {
 		.nss = RTW89_NSS_1,
 		.rs = RTW89_RS_OFFSET,
 	};
 	u8 band = chan->band_type;
 	s8 v[RTW89_RATE_OFFSET_NUM] = {};
 	u32 val;
 
 	rtw89_debug(rtwdev, RTW89_DBG_TXPWR, "[TXPWR] set txpwr offset\n");
 
 	for (desc.idx = 0; desc.idx < RTW89_RATE_OFFSET_NUM; desc.idx++)
 		v[desc.idx] = rtw89_phy_read_txpwr_byrate(rtwdev, band, &desc);
 
 	BUILD_BUG_ON(RTW89_RATE_OFFSET_NUM != 5);
 	val = FIELD_PREP(GENMASK(3, 0), v[0]) |
 	      FIELD_PREP(GENMASK(7, 4), v[1]) |
 	      FIELD_PREP(GENMASK(11, 8), v[2]) |
 	      FIELD_PREP(GENMASK(15, 12), v[3]) |
 	      FIELD_PREP(GENMASK(19, 16), v[4]);
 
 	rtw89_mac_txpwr_write32_mask(rtwdev, phy_idx, R_AX_PWR_RATE_OFST_CTRL,
 				     GENMASK(19, 0), val);
 }
 EXPORT_SYMBOL(rtw89_phy_set_txpwr_offset);
 
 void rtw89_phy_set_txpwr_limit(struct rtw89_dev *rtwdev,
 			       const struct rtw89_chan *chan,
 			       enum rtw89_phy_idx phy_idx)
 {
 	u8 max_ntx_num = rtwdev->chip->rf_path_num;
 	struct rtw89_txpwr_limit lmt;
 	u8 ch = chan->channel;
 	u8 bw = chan->band_width;
 	const s8 *ptr;
 	u32 addr, val;
 	u8 i, j;
 
 	rtw89_debug(rtwdev, RTW89_DBG_TXPWR,
 		    "[TXPWR] set txpwr limit with ch=%d bw=%d\n", ch, bw);
 
 	BUILD_BUG_ON(sizeof(struct rtw89_txpwr_limit) !=
 		     RTW89_TXPWR_LMT_PAGE_SIZE);
 
 	addr = R_AX_PWR_LMT;
 	for (i = 0; i < max_ntx_num; i++) {
 		rtw89_phy_fill_txpwr_limit(rtwdev, chan, &lmt, i);
 
 		ptr = (s8 *)&lmt;
 		for (j = 0; j < RTW89_TXPWR_LMT_PAGE_SIZE;
 		     j += 4, addr += 4, ptr += 4) {
 			val = FIELD_PREP(GENMASK(7, 0), ptr[0]) |
 			      FIELD_PREP(GENMASK(15, 8), ptr[1]) |
 			      FIELD_PREP(GENMASK(23, 16), ptr[2]) |
 			      FIELD_PREP(GENMASK(31, 24), ptr[3]);
 
 			rtw89_mac_txpwr_write32(rtwdev, phy_idx, addr, val);
 		}
 	}
 }
 EXPORT_SYMBOL(rtw89_phy_set_txpwr_limit);
 
 void rtw89_phy_set_txpwr_limit_ru(struct rtw89_dev *rtwdev,
 				  const struct rtw89_chan *chan,
 				  enum rtw89_phy_idx phy_idx)
 {
 	u8 max_ntx_num = rtwdev->chip->rf_path_num;
 	struct rtw89_txpwr_limit_ru lmt_ru;
 	u8 ch = chan->channel;
 	u8 bw = chan->band_width;
 	const s8 *ptr;
 	u32 addr, val;
 	u8 i, j;
 
 	rtw89_debug(rtwdev, RTW89_DBG_TXPWR,
 		    "[TXPWR] set txpwr limit ru with ch=%d bw=%d\n", ch, bw);
 
 	BUILD_BUG_ON(sizeof(struct rtw89_txpwr_limit_ru) !=
 		     RTW89_TXPWR_LMT_RU_PAGE_SIZE);
 
 	addr = R_AX_PWR_RU_LMT;
 	for (i = 0; i < max_ntx_num; i++) {
 		rtw89_phy_fill_txpwr_limit_ru(rtwdev, chan, &lmt_ru, i);
 
 		ptr = (s8 *)&lmt_ru;
 		for (j = 0; j < RTW89_TXPWR_LMT_RU_PAGE_SIZE;
 		     j += 4, addr += 4, ptr += 4) {
 			val = FIELD_PREP(GENMASK(7, 0), ptr[0]) |
 			      FIELD_PREP(GENMASK(15, 8), ptr[1]) |
 			      FIELD_PREP(GENMASK(23, 16), ptr[2]) |
 			      FIELD_PREP(GENMASK(31, 24), ptr[3]);
 
 			rtw89_mac_txpwr_write32(rtwdev, phy_idx, addr, val);
 		}
 	}
 }
 EXPORT_SYMBOL(rtw89_phy_set_txpwr_limit_ru);
 
 struct rtw89_phy_iter_ra_data {
 	struct rtw89_dev *rtwdev;
 	struct sk_buff *c2h;
 };
 
 static void rtw89_phy_c2h_ra_rpt_iter(void *data, struct ieee80211_sta *sta)
 {
 	struct rtw89_phy_iter_ra_data *ra_data = (struct rtw89_phy_iter_ra_data *)data;
 	struct rtw89_dev *rtwdev = ra_data->rtwdev;
 	struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv;
 	const struct rtw89_c2h_ra_rpt *c2h =
 		(const struct rtw89_c2h_ra_rpt *)ra_data->c2h->data;
 	struct rtw89_ra_report *ra_report = &rtwsta->ra_report;
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	bool format_v1 = chip->chip_gen == RTW89_CHIP_BE;
 	u8 mode, rate, bw, giltf, mac_id;
 	u16 legacy_bitrate;
 	bool valid;
 	u8 mcs = 0;
 	u8 t;
 
 	mac_id = le32_get_bits(c2h->w2, RTW89_C2H_RA_RPT_W2_MACID);
 	if (mac_id != rtwsta->mac_id)
 		return;
 
 	rate = le32_get_bits(c2h->w3, RTW89_C2H_RA_RPT_W3_MCSNSS);
 	bw = le32_get_bits(c2h->w3, RTW89_C2H_RA_RPT_W3_BW);
 	giltf = le32_get_bits(c2h->w3, RTW89_C2H_RA_RPT_W3_GILTF);
 	mode = le32_get_bits(c2h->w3, RTW89_C2H_RA_RPT_W3_MD_SEL);
 
 	if (format_v1) {
 		t = le32_get_bits(c2h->w2, RTW89_C2H_RA_RPT_W2_MCSNSS_B7);
 		rate |= u8_encode_bits(t, BIT(7));
 		t = le32_get_bits(c2h->w3, RTW89_C2H_RA_RPT_W3_BW_B2);
 		bw |= u8_encode_bits(t, BIT(2));
 		t = le32_get_bits(c2h->w3, RTW89_C2H_RA_RPT_W3_MD_SEL_B2);
 		mode |= u8_encode_bits(t, BIT(2));
 	}
 
 	if (mode == RTW89_RA_RPT_MODE_LEGACY) {
 		valid = rtw89_ra_report_to_bitrate(rtwdev, rate, &legacy_bitrate);
 		if (!valid)
 			return;
 	}
 
 	memset(&ra_report->txrate, 0, sizeof(ra_report->txrate));
 
 	switch (mode) {
 	case RTW89_RA_RPT_MODE_LEGACY:
 		ra_report->txrate.legacy = legacy_bitrate;
 		break;
 	case RTW89_RA_RPT_MODE_HT:
 		ra_report->txrate.flags |= RATE_INFO_FLAGS_MCS;
 		if (RTW89_CHK_FW_FEATURE(OLD_HT_RA_FORMAT, &rtwdev->fw))
 			rate = RTW89_MK_HT_RATE(FIELD_GET(RTW89_RA_RATE_MASK_NSS, rate),
 						FIELD_GET(RTW89_RA_RATE_MASK_MCS, rate));
 		else
 			rate = FIELD_GET(RTW89_RA_RATE_MASK_HT_MCS, rate);
 		ra_report->txrate.mcs = rate;
 		if (giltf)
 			ra_report->txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
 		mcs = ra_report->txrate.mcs & 0x07;
 		break;
 	case RTW89_RA_RPT_MODE_VHT:
 		ra_report->txrate.flags |= RATE_INFO_FLAGS_VHT_MCS;
 		ra_report->txrate.mcs = format_v1 ?
 			u8_get_bits(rate, RTW89_RA_RATE_MASK_MCS_V1) :
 			u8_get_bits(rate, RTW89_RA_RATE_MASK_MCS);
 		ra_report->txrate.nss = format_v1 ?
 			u8_get_bits(rate, RTW89_RA_RATE_MASK_NSS_V1) + 1 :
 			u8_get_bits(rate, RTW89_RA_RATE_MASK_NSS) + 1;
 		if (giltf)
 			ra_report->txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
 		mcs = ra_report->txrate.mcs;
 		break;
 	case RTW89_RA_RPT_MODE_HE:
 		ra_report->txrate.flags |= RATE_INFO_FLAGS_HE_MCS;
 		ra_report->txrate.mcs = format_v1 ?
 			u8_get_bits(rate, RTW89_RA_RATE_MASK_MCS_V1) :
 			u8_get_bits(rate, RTW89_RA_RATE_MASK_MCS);
 		ra_report->txrate.nss  = format_v1 ?
 			u8_get_bits(rate, RTW89_RA_RATE_MASK_NSS_V1) + 1 :
 			u8_get_bits(rate, RTW89_RA_RATE_MASK_NSS) + 1;
 		if (giltf == RTW89_GILTF_2XHE08 || giltf == RTW89_GILTF_1XHE08)
 			ra_report->txrate.he_gi = NL80211_RATE_INFO_HE_GI_0_8;
 		else if (giltf == RTW89_GILTF_2XHE16 || giltf == RTW89_GILTF_1XHE16)
 			ra_report->txrate.he_gi = NL80211_RATE_INFO_HE_GI_1_6;
 		else
 			ra_report->txrate.he_gi = NL80211_RATE_INFO_HE_GI_3_2;
 		mcs = ra_report->txrate.mcs;
 		break;
 	}
 
 	ra_report->txrate.bw = rtw89_hw_to_rate_info_bw(bw);
 	ra_report->bit_rate = cfg80211_calculate_bitrate(&ra_report->txrate);
 	ra_report->hw_rate = format_v1 ?
 			     u16_encode_bits(mode, RTW89_HW_RATE_V1_MASK_MOD) |
 			     u16_encode_bits(rate, RTW89_HW_RATE_V1_MASK_VAL) :
 			     u16_encode_bits(mode, RTW89_HW_RATE_MASK_MOD) |
 			     u16_encode_bits(rate, RTW89_HW_RATE_MASK_VAL);
 	ra_report->might_fallback_legacy = mcs <= 2;
 	sta->deflink.agg.max_rc_amsdu_len = get_max_amsdu_len(rtwdev, ra_report);
 	rtwsta->max_agg_wait = sta->deflink.agg.max_rc_amsdu_len / 1500 - 1;
 }
 
 static void
 rtw89_phy_c2h_ra_rpt(struct rtw89_dev *rtwdev, struct sk_buff *c2h, u32 len)
 {
 	struct rtw89_phy_iter_ra_data ra_data;
 
 	ra_data.rtwdev = rtwdev;
 	ra_data.c2h = c2h;
 	ieee80211_iterate_stations_atomic(rtwdev->hw,
 					  rtw89_phy_c2h_ra_rpt_iter,
 					  &ra_data);
 }
 
 static
 void (* const rtw89_phy_c2h_ra_handler[])(struct rtw89_dev *rtwdev,
 					  struct sk_buff *c2h, u32 len) = {
 	[RTW89_PHY_C2H_FUNC_STS_RPT] = rtw89_phy_c2h_ra_rpt,
 	[RTW89_PHY_C2H_FUNC_MU_GPTBL_RPT] = NULL,
 	[RTW89_PHY_C2H_FUNC_TXSTS] = NULL,
 };
 
 void rtw89_phy_c2h_handle(struct rtw89_dev *rtwdev, struct sk_buff *skb,
 			  u32 len, u8 class, u8 func)
 {
 	void (*handler)(struct rtw89_dev *rtwdev,
 			struct sk_buff *c2h, u32 len) = NULL;
 
 	switch (class) {
 	case RTW89_PHY_C2H_CLASS_RA:
 		if (func < RTW89_PHY_C2H_FUNC_RA_MAX)
 			handler = rtw89_phy_c2h_ra_handler[func];
 		break;
 	case RTW89_PHY_C2H_CLASS_DM:
 		if (func == RTW89_PHY_C2H_DM_FUNC_LOWRT_RTY)
 			return;
 		fallthrough;
 	default:
 		rtw89_info(rtwdev, "c2h class %d not support\n", class);
 		return;
 	}
 	if (!handler) {
 		rtw89_info(rtwdev, "c2h class %d func %d not support\n", class,
 			   func);
 		return;
 	}
 	handler(rtwdev, skb, len);
 }
 
 static u8 rtw89_phy_cfo_get_xcap_reg(struct rtw89_dev *rtwdev, bool sc_xo)
 {
 	const struct rtw89_xtal_info *xtal = rtwdev->chip->xtal_info;
 	u32 reg_mask;
 
 	if (sc_xo)
 		reg_mask = xtal->sc_xo_mask;
 	else
 		reg_mask = xtal->sc_xi_mask;
 
 	return (u8)rtw89_read32_mask(rtwdev, xtal->xcap_reg, reg_mask);
 }
 
 static void rtw89_phy_cfo_set_xcap_reg(struct rtw89_dev *rtwdev, bool sc_xo,
 				       u8 val)
 {
 	const struct rtw89_xtal_info *xtal = rtwdev->chip->xtal_info;
 	u32 reg_mask;
 
 	if (sc_xo)
 		reg_mask = xtal->sc_xo_mask;
 	else
 		reg_mask = xtal->sc_xi_mask;
 
 	rtw89_write32_mask(rtwdev, xtal->xcap_reg, reg_mask, val);
 }
 
 static void rtw89_phy_cfo_set_crystal_cap(struct rtw89_dev *rtwdev,
 					  u8 crystal_cap, bool force)
 {
 	struct rtw89_cfo_tracking_info *cfo = &rtwdev->cfo_tracking;
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	u8 sc_xi_val, sc_xo_val;
 
 	if (!force && cfo->crystal_cap == crystal_cap)
 		return;
 	crystal_cap = clamp_t(u8, crystal_cap, 0, 127);
 	if (chip->chip_id == RTL8852A || chip->chip_id == RTL8851B) {
 		rtw89_phy_cfo_set_xcap_reg(rtwdev, true, crystal_cap);
 		rtw89_phy_cfo_set_xcap_reg(rtwdev, false, crystal_cap);
 		sc_xo_val = rtw89_phy_cfo_get_xcap_reg(rtwdev, true);
 		sc_xi_val = rtw89_phy_cfo_get_xcap_reg(rtwdev, false);
 	} else {
 		rtw89_mac_write_xtal_si(rtwdev, XTAL_SI_XTAL_SC_XO,
 					crystal_cap, XTAL_SC_XO_MASK);
 		rtw89_mac_write_xtal_si(rtwdev, XTAL_SI_XTAL_SC_XI,
 					crystal_cap, XTAL_SC_XI_MASK);
 		rtw89_mac_read_xtal_si(rtwdev, XTAL_SI_XTAL_SC_XO, &sc_xo_val);
 		rtw89_mac_read_xtal_si(rtwdev, XTAL_SI_XTAL_SC_XI, &sc_xi_val);
 	}
 	cfo->crystal_cap = sc_xi_val;
 	cfo->x_cap_ofst = (s8)((int)cfo->crystal_cap - cfo->def_x_cap);
 
 	rtw89_debug(rtwdev, RTW89_DBG_CFO, "Set sc_xi=0x%x\n", sc_xi_val);
 	rtw89_debug(rtwdev, RTW89_DBG_CFO, "Set sc_xo=0x%x\n", sc_xo_val);
 	rtw89_debug(rtwdev, RTW89_DBG_CFO, "Get xcap_ofst=%d\n",
 		    cfo->x_cap_ofst);
 	rtw89_debug(rtwdev, RTW89_DBG_CFO, "Set xcap OK\n");
 }
 
 static void rtw89_phy_cfo_reset(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_cfo_tracking_info *cfo = &rtwdev->cfo_tracking;
 	u8 cap;
 
 	cfo->def_x_cap = cfo->crystal_cap_default & B_AX_XTAL_SC_MASK;
 	cfo->is_adjust = false;
 	if (cfo->crystal_cap == cfo->def_x_cap)
 		return;
 	cap = cfo->crystal_cap;
 	cap += (cap > cfo->def_x_cap ? -1 : 1);
 	rtw89_phy_cfo_set_crystal_cap(rtwdev, cap, false);
 	rtw89_debug(rtwdev, RTW89_DBG_CFO,
 		    "(0x%x) approach to dflt_val=(0x%x)\n", cfo->crystal_cap,
 		    cfo->def_x_cap);
 }
 
 static void rtw89_dcfo_comp(struct rtw89_dev *rtwdev, s32 curr_cfo)
 {
 	const struct rtw89_reg_def *dcfo_comp = rtwdev->chip->dcfo_comp;
 	bool is_linked = rtwdev->total_sta_assoc > 0;
 	s32 cfo_avg_312;
 	s32 dcfo_comp_val;
 	int sign;
 
 	if (!is_linked) {
 		rtw89_debug(rtwdev, RTW89_DBG_CFO, "DCFO: is_linked=%d\n",
 			    is_linked);
 		return;
 	}
 	rtw89_debug(rtwdev, RTW89_DBG_CFO, "DCFO: curr_cfo=%d\n", curr_cfo);
 	if (curr_cfo == 0)
 		return;
 	dcfo_comp_val = rtw89_phy_read32_mask(rtwdev, R_DCFO, B_DCFO);
 	sign = curr_cfo > 0 ? 1 : -1;
 	cfo_avg_312 = curr_cfo / 625 + sign * dcfo_comp_val;
 	rtw89_debug(rtwdev, RTW89_DBG_CFO, "avg_cfo_312=%d step\n", cfo_avg_312);
 	if (rtwdev->chip->chip_id == RTL8852A && rtwdev->hal.cv == CHIP_CBV)
 		cfo_avg_312 = -cfo_avg_312;
 	rtw89_phy_set_phy_regs(rtwdev, dcfo_comp->addr, dcfo_comp->mask,
 			       cfo_avg_312);
 }
 
 static void rtw89_dcfo_comp_init(struct rtw89_dev *rtwdev)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 
 	rtw89_phy_set_phy_regs(rtwdev, R_DCFO_OPT, B_DCFO_OPT_EN, 1);
 	rtw89_phy_set_phy_regs(rtwdev, R_DCFO_WEIGHT, B_DCFO_WEIGHT_MSK, 8);
 
 	if (chip->cfo_hw_comp)
 		rtw89_write32_mask(rtwdev, R_AX_PWR_UL_CTRL2,
 				   B_AX_PWR_UL_CFO_MASK, 0x6);
 	else
 		rtw89_write32_clr(rtwdev, R_AX_PWR_UL_CTRL2, B_AX_PWR_UL_CFO_MASK);
 }
 
 static void rtw89_phy_cfo_init(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_cfo_tracking_info *cfo = &rtwdev->cfo_tracking;
 	struct rtw89_efuse *efuse = &rtwdev->efuse;
 
 	cfo->crystal_cap_default = efuse->xtal_cap & B_AX_XTAL_SC_MASK;
 	cfo->crystal_cap = cfo->crystal_cap_default;
 	cfo->def_x_cap = cfo->crystal_cap;
 	cfo->x_cap_ub = min_t(int, cfo->def_x_cap + CFO_BOUND, 0x7f);
 	cfo->x_cap_lb = max_t(int, cfo->def_x_cap - CFO_BOUND, 0x1);
 	cfo->is_adjust = false;
 	cfo->divergence_lock_en = false;
 	cfo->x_cap_ofst = 0;
 	cfo->lock_cnt = 0;
 	cfo->rtw89_multi_cfo_mode = RTW89_TP_BASED_AVG_MODE;
 	cfo->apply_compensation = false;
 	cfo->residual_cfo_acc = 0;
 	rtw89_debug(rtwdev, RTW89_DBG_CFO, "Default xcap=%0x\n",
 		    cfo->crystal_cap_default);
 	rtw89_phy_cfo_set_crystal_cap(rtwdev, cfo->crystal_cap_default, true);
 	rtw89_phy_set_phy_regs(rtwdev, R_DCFO, B_DCFO, 1);
 	rtw89_dcfo_comp_init(rtwdev);
 	cfo->cfo_timer_ms = 2000;
 	cfo->cfo_trig_by_timer_en = false;
 	cfo->phy_cfo_trk_cnt = 0;
 	cfo->phy_cfo_status = RTW89_PHY_DCFO_STATE_NORMAL;
 	cfo->cfo_ul_ofdma_acc_mode = RTW89_CFO_UL_OFDMA_ACC_ENABLE;
 }
 
 static void rtw89_phy_cfo_crystal_cap_adjust(struct rtw89_dev *rtwdev,
 					     s32 curr_cfo)
 {
 	struct rtw89_cfo_tracking_info *cfo = &rtwdev->cfo_tracking;
 	s8 crystal_cap = cfo->crystal_cap;
 	s32 cfo_abs = abs(curr_cfo);
 	int sign;
 
 	if (!cfo->is_adjust) {
 		if (cfo_abs > CFO_TRK_ENABLE_TH)
 			cfo->is_adjust = true;
 	} else {
 		if (cfo_abs < CFO_TRK_STOP_TH)
 			cfo->is_adjust = false;
 	}
 	if (!cfo->is_adjust) {
 		rtw89_debug(rtwdev, RTW89_DBG_CFO, "Stop CFO tracking\n");
 		return;
 	}
 	sign = curr_cfo > 0 ? 1 : -1;
 	if (cfo_abs > CFO_TRK_STOP_TH_4)
 		crystal_cap += 7 * sign;
 	else if (cfo_abs > CFO_TRK_STOP_TH_3)
 		crystal_cap += 5 * sign;
 	else if (cfo_abs > CFO_TRK_STOP_TH_2)
 		crystal_cap += 3 * sign;
 	else if (cfo_abs > CFO_TRK_STOP_TH_1)
 		crystal_cap += 1 * sign;
 	else
 		return;
 	rtw89_phy_cfo_set_crystal_cap(rtwdev, (u8)crystal_cap, false);
 	rtw89_debug(rtwdev, RTW89_DBG_CFO,
 		    "X_cap{Curr,Default}={0x%x,0x%x}\n",
 		    cfo->crystal_cap, cfo->def_x_cap);
 }
 
 static s32 rtw89_phy_average_cfo_calc(struct rtw89_dev *rtwdev)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	struct rtw89_cfo_tracking_info *cfo = &rtwdev->cfo_tracking;
 	s32 cfo_khz_all = 0;
 	s32 cfo_cnt_all = 0;
 	s32 cfo_all_avg = 0;
 	u8 i;
 
 	if (rtwdev->total_sta_assoc != 1)
 		return 0;
 	rtw89_debug(rtwdev, RTW89_DBG_CFO, "one_entry_only\n");
 	for (i = 0; i < CFO_TRACK_MAX_USER; i++) {
 		if (cfo->cfo_cnt[i] == 0)
 			continue;
 		cfo_khz_all += cfo->cfo_tail[i];
 		cfo_cnt_all += cfo->cfo_cnt[i];
 		cfo_all_avg = phy_div(cfo_khz_all, cfo_cnt_all);
 		cfo->pre_cfo_avg[i] = cfo->cfo_avg[i];
 		cfo->dcfo_avg = phy_div(cfo_khz_all << chip->dcfo_comp_sft,
 					cfo_cnt_all);
 	}
 	rtw89_debug(rtwdev, RTW89_DBG_CFO,
 		    "CFO track for macid = %d\n", i);
 	rtw89_debug(rtwdev, RTW89_DBG_CFO,
 		    "Total cfo=%dK, pkt_cnt=%d, avg_cfo=%dK\n",
 		    cfo_khz_all, cfo_cnt_all, cfo_all_avg);
 	return cfo_all_avg;
 }
 
 static s32 rtw89_phy_multi_sta_cfo_calc(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_cfo_tracking_info *cfo = &rtwdev->cfo_tracking;
 	struct rtw89_traffic_stats *stats = &rtwdev->stats;
 	s32 target_cfo = 0;
 	s32 cfo_khz_all = 0;
 	s32 cfo_khz_all_tp_wgt = 0;
 	s32 cfo_avg = 0;
 	s32 max_cfo_lb = BIT(31);
 	s32 min_cfo_ub = GENMASK(30, 0);
 	u16 cfo_cnt_all = 0;
 	u8 active_entry_cnt = 0;
 	u8 sta_cnt = 0;
 	u32 tp_all = 0;
 	u8 i;
 	u8 cfo_tol = 0;
 
 	rtw89_debug(rtwdev, RTW89_DBG_CFO, "Multi entry cfo_trk\n");
 	if (cfo->rtw89_multi_cfo_mode == RTW89_PKT_BASED_AVG_MODE) {
 		rtw89_debug(rtwdev, RTW89_DBG_CFO, "Pkt based avg mode\n");
 		for (i = 0; i < CFO_TRACK_MAX_USER; i++) {
 			if (cfo->cfo_cnt[i] == 0)
 				continue;
 			cfo_khz_all += cfo->cfo_tail[i];
 			cfo_cnt_all += cfo->cfo_cnt[i];
 			cfo_avg = phy_div(cfo_khz_all, (s32)cfo_cnt_all);
 			rtw89_debug(rtwdev, RTW89_DBG_CFO,
 				    "Msta cfo=%d, pkt_cnt=%d, avg_cfo=%d\n",
 				    cfo_khz_all, cfo_cnt_all, cfo_avg);
 			target_cfo = cfo_avg;
 		}
 	} else if (cfo->rtw89_multi_cfo_mode == RTW89_ENTRY_BASED_AVG_MODE) {
 		rtw89_debug(rtwdev, RTW89_DBG_CFO, "Entry based avg mode\n");
 		for (i = 0; i < CFO_TRACK_MAX_USER; i++) {
 			if (cfo->cfo_cnt[i] == 0)
 				continue;
 			cfo->cfo_avg[i] = phy_div(cfo->cfo_tail[i],
 						  (s32)cfo->cfo_cnt[i]);
 			cfo_khz_all += cfo->cfo_avg[i];
 			rtw89_debug(rtwdev, RTW89_DBG_CFO,
 				    "Macid=%d, cfo_avg=%d\n", i,
 				    cfo->cfo_avg[i]);
 		}
 		sta_cnt = rtwdev->total_sta_assoc;
 		cfo_avg = phy_div(cfo_khz_all, (s32)sta_cnt);
 		rtw89_debug(rtwdev, RTW89_DBG_CFO,
 			    "Msta cfo_acc=%d, ent_cnt=%d, avg_cfo=%d\n",
 			    cfo_khz_all, sta_cnt, cfo_avg);
 		target_cfo = cfo_avg;
 	} else if (cfo->rtw89_multi_cfo_mode == RTW89_TP_BASED_AVG_MODE) {
 		rtw89_debug(rtwdev, RTW89_DBG_CFO, "TP based avg mode\n");
 		cfo_tol = cfo->sta_cfo_tolerance;
 		for (i = 0; i < CFO_TRACK_MAX_USER; i++) {
 			sta_cnt++;
 			if (cfo->cfo_cnt[i] != 0) {
 				cfo->cfo_avg[i] = phy_div(cfo->cfo_tail[i],
 							  (s32)cfo->cfo_cnt[i]);
 				active_entry_cnt++;
 			} else {
 				cfo->cfo_avg[i] = cfo->pre_cfo_avg[i];
 			}
 			max_cfo_lb = max(cfo->cfo_avg[i] - cfo_tol, max_cfo_lb);
 			min_cfo_ub = min(cfo->cfo_avg[i] + cfo_tol, min_cfo_ub);
 			cfo_khz_all += cfo->cfo_avg[i];
 			/* need tp for each entry */
 			rtw89_debug(rtwdev, RTW89_DBG_CFO,
 				    "[%d] cfo_avg=%d, tp=tbd\n",
 				    i, cfo->cfo_avg[i]);
 			if (sta_cnt >= rtwdev->total_sta_assoc)
 				break;
 		}
 		tp_all = stats->rx_throughput; /* need tp for each entry */
 		cfo_avg =  phy_div(cfo_khz_all_tp_wgt, (s32)tp_all);
 
 		rtw89_debug(rtwdev, RTW89_DBG_CFO, "Assoc sta cnt=%d\n",
 			    sta_cnt);
 		rtw89_debug(rtwdev, RTW89_DBG_CFO, "Active sta cnt=%d\n",
 			    active_entry_cnt);
 		rtw89_debug(rtwdev, RTW89_DBG_CFO,
 			    "Msta cfo with tp_wgt=%d, avg_cfo=%d\n",
 			    cfo_khz_all_tp_wgt, cfo_avg);
 		rtw89_debug(rtwdev, RTW89_DBG_CFO, "cfo_lb=%d,cfo_ub=%d\n",
 			    max_cfo_lb, min_cfo_ub);
 		if (max_cfo_lb <= min_cfo_ub) {
 			rtw89_debug(rtwdev, RTW89_DBG_CFO,
 				    "cfo win_size=%d\n",
 				    min_cfo_ub - max_cfo_lb);
 			target_cfo = clamp(cfo_avg, max_cfo_lb, min_cfo_ub);
 		} else {
 			rtw89_debug(rtwdev, RTW89_DBG_CFO,
 				    "No intersection of cfo tolerance windows\n");
 			target_cfo = phy_div(cfo_khz_all, (s32)sta_cnt);
 		}
 		for (i = 0; i < CFO_TRACK_MAX_USER; i++)
 			cfo->pre_cfo_avg[i] = cfo->cfo_avg[i];
 	}
 	rtw89_debug(rtwdev, RTW89_DBG_CFO, "Target cfo=%d\n", target_cfo);
 	return target_cfo;
 }
 
 static void rtw89_phy_cfo_statistics_reset(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_cfo_tracking_info *cfo = &rtwdev->cfo_tracking;
 
 	memset(&cfo->cfo_tail, 0, sizeof(cfo->cfo_tail));
 	memset(&cfo->cfo_cnt, 0, sizeof(cfo->cfo_cnt));
 	cfo->packet_count = 0;
 	cfo->packet_count_pre = 0;
 	cfo->cfo_avg_pre = 0;
 }
 
 static void rtw89_phy_cfo_dm(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_cfo_tracking_info *cfo = &rtwdev->cfo_tracking;
 	s32 new_cfo = 0;
 	bool x_cap_update = false;
 	u8 pre_x_cap = cfo->crystal_cap;
 	u8 dcfo_comp_sft = rtwdev->chip->dcfo_comp_sft;
 
 	cfo->dcfo_avg = 0;
 	rtw89_debug(rtwdev, RTW89_DBG_CFO, "CFO:total_sta_assoc=%d\n",
 		    rtwdev->total_sta_assoc);
 	if (rtwdev->total_sta_assoc == 0) {
 		rtw89_phy_cfo_reset(rtwdev);
 		return;
 	}
 	if (cfo->packet_count == 0) {
 		rtw89_debug(rtwdev, RTW89_DBG_CFO, "Pkt cnt = 0\n");
 		return;
 	}
 	if (cfo->packet_count == cfo->packet_count_pre) {
 		rtw89_debug(rtwdev, RTW89_DBG_CFO, "Pkt cnt doesn't change\n");
 		return;
 	}
 	if (rtwdev->total_sta_assoc == 1)
 		new_cfo = rtw89_phy_average_cfo_calc(rtwdev);
 	else
 		new_cfo = rtw89_phy_multi_sta_cfo_calc(rtwdev);
 	if (new_cfo == 0) {
 		rtw89_debug(rtwdev, RTW89_DBG_CFO, "curr_cfo=0\n");
 		return;
 	}
 	if (cfo->divergence_lock_en) {
 		cfo->lock_cnt++;
 		if (cfo->lock_cnt > CFO_PERIOD_CNT) {
 			cfo->divergence_lock_en = false;
 			cfo->lock_cnt = 0;
 		} else {
 			rtw89_phy_cfo_reset(rtwdev);
 		}
 		return;
 	}
 	if (cfo->crystal_cap >= cfo->x_cap_ub ||
 	    cfo->crystal_cap <= cfo->x_cap_lb) {
 		cfo->divergence_lock_en = true;
 		rtw89_phy_cfo_reset(rtwdev);
 		return;
 	}
 
 	rtw89_phy_cfo_crystal_cap_adjust(rtwdev, new_cfo);
 	cfo->cfo_avg_pre = new_cfo;
 	cfo->dcfo_avg_pre = cfo->dcfo_avg;
 	x_cap_update =  cfo->crystal_cap != pre_x_cap;
 	rtw89_debug(rtwdev, RTW89_DBG_CFO, "Xcap_up=%d\n", x_cap_update);
 	rtw89_debug(rtwdev, RTW89_DBG_CFO, "Xcap: D:%x C:%x->%x, ofst=%d\n",
 		    cfo->def_x_cap, pre_x_cap, cfo->crystal_cap,
 		    cfo->x_cap_ofst);
 	if (x_cap_update) {
 		if (cfo->dcfo_avg > 0)
 			cfo->dcfo_avg -= CFO_SW_COMP_FINE_TUNE << dcfo_comp_sft;
 		else
 			cfo->dcfo_avg += CFO_SW_COMP_FINE_TUNE << dcfo_comp_sft;
 	}
 	rtw89_dcfo_comp(rtwdev, cfo->dcfo_avg);
 	rtw89_phy_cfo_statistics_reset(rtwdev);
 }
 
 void rtw89_phy_cfo_track_work(struct work_struct *work)
 {
 	struct rtw89_dev *rtwdev = container_of(work, struct rtw89_dev,
 						cfo_track_work.work);
 	struct rtw89_cfo_tracking_info *cfo = &rtwdev->cfo_tracking;
 
 	mutex_lock(&rtwdev->mutex);
 	if (!cfo->cfo_trig_by_timer_en)
 		goto out;
 	rtw89_leave_ps_mode(rtwdev);
 	rtw89_phy_cfo_dm(rtwdev);
 	ieee80211_queue_delayed_work(rtwdev->hw, &rtwdev->cfo_track_work,
 				     msecs_to_jiffies(cfo->cfo_timer_ms));
 out:
 	mutex_unlock(&rtwdev->mutex);
 }
 
 static void rtw89_phy_cfo_start_work(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_cfo_tracking_info *cfo = &rtwdev->cfo_tracking;
 
 	ieee80211_queue_delayed_work(rtwdev->hw, &rtwdev->cfo_track_work,
 				     msecs_to_jiffies(cfo->cfo_timer_ms));
 }
 
 void rtw89_phy_cfo_track(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_cfo_tracking_info *cfo = &rtwdev->cfo_tracking;
 	struct rtw89_traffic_stats *stats = &rtwdev->stats;
 	bool is_ul_ofdma = false, ofdma_acc_en = false;
 
 	if (stats->rx_tf_periodic > CFO_TF_CNT_TH)
 		is_ul_ofdma = true;
 	if (cfo->cfo_ul_ofdma_acc_mode == RTW89_CFO_UL_OFDMA_ACC_ENABLE &&
 	    is_ul_ofdma)
 		ofdma_acc_en = true;
 
 	switch (cfo->phy_cfo_status) {
 	case RTW89_PHY_DCFO_STATE_NORMAL:
 		if (stats->tx_throughput >= CFO_TP_UPPER) {
 			cfo->phy_cfo_status = RTW89_PHY_DCFO_STATE_ENHANCE;
 			cfo->cfo_trig_by_timer_en = true;
 			cfo->cfo_timer_ms = CFO_COMP_PERIOD;
 			rtw89_phy_cfo_start_work(rtwdev);
 		}
 		break;
 	case RTW89_PHY_DCFO_STATE_ENHANCE:
 		if (stats->tx_throughput <= CFO_TP_LOWER)
 			cfo->phy_cfo_status = RTW89_PHY_DCFO_STATE_NORMAL;
 		else if (ofdma_acc_en &&
 			 cfo->phy_cfo_trk_cnt >= CFO_PERIOD_CNT)
 			cfo->phy_cfo_status = RTW89_PHY_DCFO_STATE_HOLD;
 		else
 			cfo->phy_cfo_trk_cnt++;
 
 		if (cfo->phy_cfo_status == RTW89_PHY_DCFO_STATE_NORMAL) {
 			cfo->phy_cfo_trk_cnt = 0;
 			cfo->cfo_trig_by_timer_en = false;
 		}
 		break;
 	case RTW89_PHY_DCFO_STATE_HOLD:
 		if (stats->tx_throughput <= CFO_TP_LOWER) {
 			cfo->phy_cfo_status = RTW89_PHY_DCFO_STATE_NORMAL;
 			cfo->phy_cfo_trk_cnt = 0;
 			cfo->cfo_trig_by_timer_en = false;
 		} else {
 			cfo->phy_cfo_trk_cnt++;
 		}
 		break;
 	default:
 		cfo->phy_cfo_status = RTW89_PHY_DCFO_STATE_NORMAL;
 		cfo->phy_cfo_trk_cnt = 0;
 		break;
 	}
 	rtw89_debug(rtwdev, RTW89_DBG_CFO,
 		    "[CFO]WatchDog tp=%d,state=%d,timer_en=%d,trk_cnt=%d,thermal=%ld\n",
 		    stats->tx_throughput, cfo->phy_cfo_status,
 		    cfo->cfo_trig_by_timer_en, cfo->phy_cfo_trk_cnt,
 		    ewma_thermal_read(&rtwdev->phystat.avg_thermal[0]));
 	if (cfo->cfo_trig_by_timer_en)
 		return;
 	rtw89_phy_cfo_dm(rtwdev);
 }
 
 void rtw89_phy_cfo_parse(struct rtw89_dev *rtwdev, s16 cfo_val,
 			 struct rtw89_rx_phy_ppdu *phy_ppdu)
 {
 	struct rtw89_cfo_tracking_info *cfo = &rtwdev->cfo_tracking;
 	u8 macid = phy_ppdu->mac_id;
 
 	if (macid >= CFO_TRACK_MAX_USER) {
 		rtw89_warn(rtwdev, "mac_id %d is out of range\n", macid);
 		return;
 	}
 
 	cfo->cfo_tail[macid] += cfo_val;
 	cfo->cfo_cnt[macid]++;
 	cfo->packet_count++;
 }
 
 void rtw89_phy_ul_tb_assoc(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, RTW89_SUB_ENTITY_0);
 	struct rtw89_phy_ul_tb_info *ul_tb_info = &rtwdev->ul_tb_info;
 
 	if (!chip->support_ul_tb_ctrl)
 		return;
 
 	rtwvif->def_tri_idx =
 		rtw89_phy_read32_mask(rtwdev, R_DCFO_OPT, B_TXSHAPE_TRIANGULAR_CFG);
 
 	if (chip->chip_id == RTL8852B && rtwdev->hal.cv > CHIP_CBV)
 		rtwvif->dyn_tb_bedge_en = false;
 	else if (chan->band_type >= RTW89_BAND_5G &&
 		 chan->band_width >= RTW89_CHANNEL_WIDTH_40)
 		rtwvif->dyn_tb_bedge_en = true;
 	else
 		rtwvif->dyn_tb_bedge_en = false;
 
 	rtw89_debug(rtwdev, RTW89_DBG_UL_TB,
 		    "[ULTB] def_if_bandedge=%d, def_tri_idx=%d\n",
 		    ul_tb_info->def_if_bandedge, rtwvif->def_tri_idx);
 	rtw89_debug(rtwdev, RTW89_DBG_UL_TB,
 		    "[ULTB] dyn_tb_begde_en=%d, dyn_tb_tri_en=%d\n",
 		    rtwvif->dyn_tb_bedge_en, ul_tb_info->dyn_tb_tri_en);
 }
 
 struct rtw89_phy_ul_tb_check_data {
 	bool valid;
 	bool high_tf_client;
 	bool low_tf_client;
 	bool dyn_tb_bedge_en;
 	u8 def_tri_idx;
 };
 
 static
 void rtw89_phy_ul_tb_ctrl_check(struct rtw89_dev *rtwdev,
 				struct rtw89_vif *rtwvif,
 				struct rtw89_phy_ul_tb_check_data *ul_tb_data)
 {
 	struct rtw89_traffic_stats *stats = &rtwdev->stats;
 	struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif);
 
 	if (rtwvif->wifi_role != RTW89_WIFI_ROLE_STATION)
 		return;
 
 	if (!vif->cfg.assoc)
 		return;
 
 	if (stats->rx_tf_periodic > UL_TB_TF_CNT_L2H_TH)
 		ul_tb_data->high_tf_client = true;
 	else if (stats->rx_tf_periodic < UL_TB_TF_CNT_H2L_TH)
 		ul_tb_data->low_tf_client = true;
 
 	ul_tb_data->valid = true;
 	ul_tb_data->def_tri_idx = rtwvif->def_tri_idx;
 	ul_tb_data->dyn_tb_bedge_en = rtwvif->dyn_tb_bedge_en;
 }
 
 void rtw89_phy_ul_tb_ctrl_track(struct rtw89_dev *rtwdev)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	struct rtw89_phy_ul_tb_info *ul_tb_info = &rtwdev->ul_tb_info;
 	struct rtw89_phy_ul_tb_check_data ul_tb_data = {};
 	struct rtw89_vif *rtwvif;
 
 	if (!chip->support_ul_tb_ctrl)
 		return;
 
 	if (rtwdev->total_sta_assoc != 1)
 		return;
 
 	rtw89_for_each_rtwvif(rtwdev, rtwvif)
 		rtw89_phy_ul_tb_ctrl_check(rtwdev, rtwvif, &ul_tb_data);
 
 	if (!ul_tb_data.valid)
 		return;
 
 	if (ul_tb_data.dyn_tb_bedge_en) {
 		if (ul_tb_data.high_tf_client) {
 			rtw89_phy_write32_mask(rtwdev, R_BANDEDGE, B_BANDEDGE_EN, 0);
 			rtw89_debug(rtwdev, RTW89_DBG_UL_TB,
 				    "[ULTB] Turn off if_bandedge\n");
 		} else if (ul_tb_data.low_tf_client) {
 			rtw89_phy_write32_mask(rtwdev, R_BANDEDGE, B_BANDEDGE_EN,
 					       ul_tb_info->def_if_bandedge);
 			rtw89_debug(rtwdev, RTW89_DBG_UL_TB,
 				    "[ULTB] Set to default if_bandedge = %d\n",
 				    ul_tb_info->def_if_bandedge);
 		}
 	}
 
 	if (ul_tb_info->dyn_tb_tri_en) {
 		if (ul_tb_data.high_tf_client) {
 			rtw89_phy_write32_mask(rtwdev, R_DCFO_OPT,
 					       B_TXSHAPE_TRIANGULAR_CFG, 0);
 			rtw89_debug(rtwdev, RTW89_DBG_UL_TB,
 				    "[ULTB] Turn off Tx triangle\n");
 		} else if (ul_tb_data.low_tf_client) {
 			rtw89_phy_write32_mask(rtwdev, R_DCFO_OPT,
 					       B_TXSHAPE_TRIANGULAR_CFG,
 					       ul_tb_data.def_tri_idx);
 			rtw89_debug(rtwdev, RTW89_DBG_UL_TB,
 				    "[ULTB] Set to default tx_shap_idx = %d\n",
 				    ul_tb_data.def_tri_idx);
 		}
 	}
 }
 
 static void rtw89_phy_ul_tb_info_init(struct rtw89_dev *rtwdev)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	struct rtw89_phy_ul_tb_info *ul_tb_info = &rtwdev->ul_tb_info;
 
 	if (!chip->support_ul_tb_ctrl)
 		return;
 
 	ul_tb_info->dyn_tb_tri_en = true;
 	ul_tb_info->def_if_bandedge =
 		rtw89_phy_read32_mask(rtwdev, R_BANDEDGE, B_BANDEDGE_EN);
 }
 
 static
 void rtw89_phy_antdiv_sts_instance_reset(struct rtw89_antdiv_stats *antdiv_sts)
 {
 	ewma_rssi_init(&antdiv_sts->cck_rssi_avg);
 	ewma_rssi_init(&antdiv_sts->ofdm_rssi_avg);
 	ewma_rssi_init(&antdiv_sts->non_legacy_rssi_avg);
 	antdiv_sts->pkt_cnt_cck = 0;
 	antdiv_sts->pkt_cnt_ofdm = 0;
 	antdiv_sts->pkt_cnt_non_legacy = 0;
 	antdiv_sts->evm = 0;
 }
 
 static void rtw89_phy_antdiv_sts_instance_add(struct rtw89_dev *rtwdev,
 					      struct rtw89_rx_phy_ppdu *phy_ppdu,
 					      struct rtw89_antdiv_stats *stats)
 {
 	if (rtw89_get_data_rate_mode(rtwdev, phy_ppdu->rate) == DATA_RATE_MODE_NON_HT) {
 		if (phy_ppdu->rate < RTW89_HW_RATE_OFDM6) {
 			ewma_rssi_add(&stats->cck_rssi_avg, phy_ppdu->rssi_avg);
 			stats->pkt_cnt_cck++;
 		} else {
 			ewma_rssi_add(&stats->ofdm_rssi_avg, phy_ppdu->rssi_avg);
 			stats->pkt_cnt_ofdm++;
 			stats->evm += phy_ppdu->ofdm.evm_min;
 		}
 	} else {
 		ewma_rssi_add(&stats->non_legacy_rssi_avg, phy_ppdu->rssi_avg);
 		stats->pkt_cnt_non_legacy++;
 		stats->evm += phy_ppdu->ofdm.evm_min;
 	}
 }
 
 static u8 rtw89_phy_antdiv_sts_instance_get_rssi(struct rtw89_antdiv_stats *stats)
 {
 	if (stats->pkt_cnt_non_legacy >= stats->pkt_cnt_cck &&
 	    stats->pkt_cnt_non_legacy >= stats->pkt_cnt_ofdm)
 		return ewma_rssi_read(&stats->non_legacy_rssi_avg);
 	else if (stats->pkt_cnt_ofdm >= stats->pkt_cnt_cck &&
 		 stats->pkt_cnt_ofdm >= stats->pkt_cnt_non_legacy)
 		return ewma_rssi_read(&stats->ofdm_rssi_avg);
 	else
 		return ewma_rssi_read(&stats->cck_rssi_avg);
 }
 
 static u8 rtw89_phy_antdiv_sts_instance_get_evm(struct rtw89_antdiv_stats *stats)
 {
 	return phy_div(stats->evm, stats->pkt_cnt_non_legacy + stats->pkt_cnt_ofdm);
 }
 
 void rtw89_phy_antdiv_parse(struct rtw89_dev *rtwdev,
 			    struct rtw89_rx_phy_ppdu *phy_ppdu)
 {
 	struct rtw89_antdiv_info *antdiv = &rtwdev->antdiv;
 	struct rtw89_hal *hal = &rtwdev->hal;
 
 	if (!hal->ant_diversity || hal->ant_diversity_fixed)
 		return;
 
 	rtw89_phy_antdiv_sts_instance_add(rtwdev, phy_ppdu, &antdiv->target_stats);
 
 	if (!antdiv->get_stats)
 		return;
 
 	if (hal->antenna_rx == RF_A)
 		rtw89_phy_antdiv_sts_instance_add(rtwdev, phy_ppdu, &antdiv->main_stats);
 	else if (hal->antenna_rx == RF_B)
 		rtw89_phy_antdiv_sts_instance_add(rtwdev, phy_ppdu, &antdiv->aux_stats);
 }
 
 static void rtw89_phy_antdiv_reg_init(struct rtw89_dev *rtwdev)
 {
 	rtw89_phy_write32_idx(rtwdev, R_P0_TRSW, B_P0_ANT_TRAIN_EN,
 			      0x0, RTW89_PHY_0);
 	rtw89_phy_write32_idx(rtwdev, R_P0_TRSW, B_P0_TX_ANT_SEL,
 			      0x0, RTW89_PHY_0);
 
 	rtw89_phy_write32_idx(rtwdev, R_P0_ANT_SW, B_P0_TRSW_TX_EXTEND,
 			      0x0, RTW89_PHY_0);
 	rtw89_phy_write32_idx(rtwdev, R_P0_ANT_SW, B_P0_HW_ANTSW_DIS_BY_GNT_BT,
 			      0x0, RTW89_PHY_0);
 
 	rtw89_phy_write32_idx(rtwdev, R_P0_TRSW, B_P0_BT_FORCE_ANTIDX_EN,
 			      0x0, RTW89_PHY_0);
 
 	rtw89_phy_write32_idx(rtwdev, R_RFSW_CTRL_ANT0_BASE, B_RFSW_CTRL_ANT_MAPPING,
 			      0x0100, RTW89_PHY_0);
 
 	rtw89_phy_write32_idx(rtwdev, R_P0_ANTSEL, B_P0_ANTSEL_BTG_TRX,
 			      0x1, RTW89_PHY_0);
 	rtw89_phy_write32_idx(rtwdev, R_P0_ANTSEL, B_P0_ANTSEL_HW_CTRL,
 			      0x0, RTW89_PHY_0);
 	rtw89_phy_write32_idx(rtwdev, R_P0_ANTSEL, B_P0_ANTSEL_SW_2G,
 			      0x0, RTW89_PHY_0);
 	rtw89_phy_write32_idx(rtwdev, R_P0_ANTSEL, B_P0_ANTSEL_SW_5G,
 			      0x0, RTW89_PHY_0);
 }
 
 static void rtw89_phy_antdiv_sts_reset(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_antdiv_info *antdiv = &rtwdev->antdiv;
 
 	rtw89_phy_antdiv_sts_instance_reset(&antdiv->target_stats);
 	rtw89_phy_antdiv_sts_instance_reset(&antdiv->main_stats);
 	rtw89_phy_antdiv_sts_instance_reset(&antdiv->aux_stats);
 }
 
 static void rtw89_phy_antdiv_init(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_antdiv_info *antdiv = &rtwdev->antdiv;
 	struct rtw89_hal *hal = &rtwdev->hal;
 
 	if (!hal->ant_diversity)
 		return;
 
 	antdiv->get_stats = false;
 	antdiv->rssi_pre = 0;
 	rtw89_phy_antdiv_sts_reset(rtwdev);
 	rtw89_phy_antdiv_reg_init(rtwdev);
 }
 
 static void rtw89_phy_stat_thermal_update(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_phy_stat *phystat = &rtwdev->phystat;
 	int i;
 	u8 th;
 
 	for (i = 0; i < rtwdev->chip->rf_path_num; i++) {
 		th = rtw89_chip_get_thermal(rtwdev, i);
 		if (th)
 			ewma_thermal_add(&phystat->avg_thermal[i], th);
 
 		rtw89_debug(rtwdev, RTW89_DBG_RFK_TRACK,
 			    "path(%d) thermal cur=%u avg=%ld", i, th,
 			    ewma_thermal_read(&phystat->avg_thermal[i]));
 	}
 }
 
 struct rtw89_phy_iter_rssi_data {
 	struct rtw89_dev *rtwdev;
 	struct rtw89_phy_ch_info *ch_info;
 	bool rssi_changed;
 };
 
 static void rtw89_phy_stat_rssi_update_iter(void *data,
 					    struct ieee80211_sta *sta)
 {
 	struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv;
 	struct rtw89_phy_iter_rssi_data *rssi_data =
 					(struct rtw89_phy_iter_rssi_data *)data;
 	struct rtw89_phy_ch_info *ch_info = rssi_data->ch_info;
 	unsigned long rssi_curr;
 
 	rssi_curr = ewma_rssi_read(&rtwsta->avg_rssi);
 
 	if (rssi_curr < ch_info->rssi_min) {
 		ch_info->rssi_min = rssi_curr;
 		ch_info->rssi_min_macid = rtwsta->mac_id;
 	}
 
 	if (rtwsta->prev_rssi == 0) {
 		rtwsta->prev_rssi = rssi_curr;
 	} else if (abs((int)rtwsta->prev_rssi - (int)rssi_curr) > (3 << RSSI_FACTOR)) {
 		rtwsta->prev_rssi = rssi_curr;
 		rssi_data->rssi_changed = true;
 	}
 }
 
 static void rtw89_phy_stat_rssi_update(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_phy_iter_rssi_data rssi_data = {0};
 
 	rssi_data.rtwdev = rtwdev;
 	rssi_data.ch_info = &rtwdev->ch_info;
 	rssi_data.ch_info->rssi_min = U8_MAX;
 	ieee80211_iterate_stations_atomic(rtwdev->hw,
 					  rtw89_phy_stat_rssi_update_iter,
 					  &rssi_data);
 	if (rssi_data.rssi_changed)
 		rtw89_btc_ntfy_wl_sta(rtwdev);
 }
 
 static void rtw89_phy_stat_init(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_phy_stat *phystat = &rtwdev->phystat;
 	int i;
 
 	for (i = 0; i < rtwdev->chip->rf_path_num; i++)
 		ewma_thermal_init(&phystat->avg_thermal[i]);
 
 	rtw89_phy_stat_thermal_update(rtwdev);
 
 	memset(&phystat->cur_pkt_stat, 0, sizeof(phystat->cur_pkt_stat));
 	memset(&phystat->last_pkt_stat, 0, sizeof(phystat->last_pkt_stat));
 }
 
 void rtw89_phy_stat_track(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_phy_stat *phystat = &rtwdev->phystat;
 
 	rtw89_phy_stat_thermal_update(rtwdev);
 	rtw89_phy_stat_rssi_update(rtwdev);
 
 	phystat->last_pkt_stat = phystat->cur_pkt_stat;
 	memset(&phystat->cur_pkt_stat, 0, sizeof(phystat->cur_pkt_stat));
 }
 
 static u16 rtw89_phy_ccx_us_to_idx(struct rtw89_dev *rtwdev, u32 time_us)
 {
 	struct rtw89_env_monitor_info *env = &rtwdev->env_monitor;
 
 	return time_us >> (ilog2(CCX_US_BASE_RATIO) + env->ccx_unit_idx);
 }
 
 static u32 rtw89_phy_ccx_idx_to_us(struct rtw89_dev *rtwdev, u16 idx)
 {
 	struct rtw89_env_monitor_info *env = &rtwdev->env_monitor;
 
 	return idx << (ilog2(CCX_US_BASE_RATIO) + env->ccx_unit_idx);
 }
 
 static void rtw89_phy_ccx_top_setting_init(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_env_monitor_info *env = &rtwdev->env_monitor;
 
 	env->ccx_manual_ctrl = false;
 	env->ccx_ongoing = false;
 	env->ccx_rac_lv = RTW89_RAC_RELEASE;
 	env->ccx_period = 0;
 	env->ccx_unit_idx = RTW89_CCX_32_US;
 
 	rtw89_phy_set_phy_regs(rtwdev, R_CCX, B_CCX_EN_MSK, 1);
 	rtw89_phy_set_phy_regs(rtwdev, R_CCX, B_CCX_TRIG_OPT_MSK, 1);
 	rtw89_phy_set_phy_regs(rtwdev, R_CCX, B_MEASUREMENT_TRIG_MSK, 1);
 	rtw89_phy_set_phy_regs(rtwdev, R_CCX, B_CCX_EDCCA_OPT_MSK,
 			       RTW89_CCX_EDCCA_BW20_0);
 }
 
 static u16 rtw89_phy_ccx_get_report(struct rtw89_dev *rtwdev, u16 report,
 				    u16 score)
 {
 	struct rtw89_env_monitor_info *env = &rtwdev->env_monitor;
 	u32 numer = 0;
 	u16 ret = 0;
 
 	numer = report * score + (env->ccx_period >> 1);
 	if (env->ccx_period)
 		ret = numer / env->ccx_period;
 
 	return ret >= score ? score - 1 : ret;
 }
 
 static void rtw89_phy_ccx_ms_to_period_unit(struct rtw89_dev *rtwdev,
 					    u16 time_ms, u32 *period,
 					    u32 *unit_idx)
 {
 	u32 idx;
 	u8 quotient;
 
 	if (time_ms >= CCX_MAX_PERIOD)
 		time_ms = CCX_MAX_PERIOD;
 
 	quotient = CCX_MAX_PERIOD_UNIT * time_ms / CCX_MAX_PERIOD;
 
 	if (quotient < 4)
 		idx = RTW89_CCX_4_US;
 	else if (quotient < 8)
 		idx = RTW89_CCX_8_US;
 	else if (quotient < 16)
 		idx = RTW89_CCX_16_US;
 	else
 		idx = RTW89_CCX_32_US;
 
 	*unit_idx = idx;
 	*period = (time_ms * MS_TO_4US_RATIO) >> idx;
 
 	rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK,
 		    "[Trigger Time] period:%d, unit_idx:%d\n",
 		    *period, *unit_idx);
 }
 
 static void rtw89_phy_ccx_racing_release(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_env_monitor_info *env = &rtwdev->env_monitor;
 
 	rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK,
 		    "lv:(%d)->(0)\n", env->ccx_rac_lv);
 
 	env->ccx_ongoing = false;
 	env->ccx_rac_lv = RTW89_RAC_RELEASE;
 	env->ifs_clm_app = RTW89_IFS_CLM_BACKGROUND;
 }
 
 static bool rtw89_phy_ifs_clm_th_update_check(struct rtw89_dev *rtwdev,
 					      struct rtw89_ccx_para_info *para)
 {
 	struct rtw89_env_monitor_info *env = &rtwdev->env_monitor;
 	bool is_update = env->ifs_clm_app != para->ifs_clm_app;
 	u8 i = 0;
 	u16 *ifs_th_l = env->ifs_clm_th_l;
 	u16 *ifs_th_h = env->ifs_clm_th_h;
 	u32 ifs_th0_us = 0, ifs_th_times = 0;
 	u32 ifs_th_h_us[RTW89_IFS_CLM_NUM] = {0};
 
 	if (!is_update)
 		goto ifs_update_finished;
 
 	switch (para->ifs_clm_app) {
 	case RTW89_IFS_CLM_INIT:
 	case RTW89_IFS_CLM_BACKGROUND:
 	case RTW89_IFS_CLM_ACS:
 	case RTW89_IFS_CLM_DBG:
 	case RTW89_IFS_CLM_DIG:
 	case RTW89_IFS_CLM_TDMA_DIG:
 		ifs_th0_us = IFS_CLM_TH0_UPPER;
 		ifs_th_times = IFS_CLM_TH_MUL;
 		break;
 	case RTW89_IFS_CLM_DBG_MANUAL:
 		ifs_th0_us = para->ifs_clm_manual_th0;
 		ifs_th_times = para->ifs_clm_manual_th_times;
 		break;
 	default:
 		break;
 	}
 
 	/* Set sampling threshold for 4 different regions, unit in idx_cnt.
 	 * low[i] = high[i-1] + 1
 	 * high[i] = high[i-1] * ifs_th_times
 	 */
 	ifs_th_l[IFS_CLM_TH_START_IDX] = 0;
 	ifs_th_h_us[IFS_CLM_TH_START_IDX] = ifs_th0_us;
 	ifs_th_h[IFS_CLM_TH_START_IDX] = rtw89_phy_ccx_us_to_idx(rtwdev,
 								 ifs_th0_us);
 	for (i = 1; i < RTW89_IFS_CLM_NUM; i++) {
 		ifs_th_l[i] = ifs_th_h[i - 1] + 1;
 		ifs_th_h_us[i] = ifs_th_h_us[i - 1] * ifs_th_times;
 		ifs_th_h[i] = rtw89_phy_ccx_us_to_idx(rtwdev, ifs_th_h_us[i]);
 	}
 
 ifs_update_finished:
 	if (!is_update)
 		rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK,
 			    "No need to update IFS_TH\n");
 
 	return is_update;
 }
 
 static void rtw89_phy_ifs_clm_set_th_reg(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_env_monitor_info *env = &rtwdev->env_monitor;
 	u8 i = 0;
 
 	rtw89_phy_set_phy_regs(rtwdev, R_IFS_T1, B_IFS_T1_TH_LOW_MSK,
 			       env->ifs_clm_th_l[0]);
 	rtw89_phy_set_phy_regs(rtwdev, R_IFS_T2, B_IFS_T2_TH_LOW_MSK,
 			       env->ifs_clm_th_l[1]);
 	rtw89_phy_set_phy_regs(rtwdev, R_IFS_T3, B_IFS_T3_TH_LOW_MSK,
 			       env->ifs_clm_th_l[2]);
 	rtw89_phy_set_phy_regs(rtwdev, R_IFS_T4, B_IFS_T4_TH_LOW_MSK,
 			       env->ifs_clm_th_l[3]);
 
 	rtw89_phy_set_phy_regs(rtwdev, R_IFS_T1, B_IFS_T1_TH_HIGH_MSK,
 			       env->ifs_clm_th_h[0]);
 	rtw89_phy_set_phy_regs(rtwdev, R_IFS_T2, B_IFS_T2_TH_HIGH_MSK,
 			       env->ifs_clm_th_h[1]);
 	rtw89_phy_set_phy_regs(rtwdev, R_IFS_T3, B_IFS_T3_TH_HIGH_MSK,
 			       env->ifs_clm_th_h[2]);
 	rtw89_phy_set_phy_regs(rtwdev, R_IFS_T4, B_IFS_T4_TH_HIGH_MSK,
 			       env->ifs_clm_th_h[3]);
 
 	for (i = 0; i < RTW89_IFS_CLM_NUM; i++)
 		rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK,
 			    "Update IFS_T%d_th{low, high} : {%d, %d}\n",
 			    i + 1, env->ifs_clm_th_l[i], env->ifs_clm_th_h[i]);
 }
 
 static void rtw89_phy_ifs_clm_setting_init(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_env_monitor_info *env = &rtwdev->env_monitor;
 	struct rtw89_ccx_para_info para = {0};
 
 	env->ifs_clm_app = RTW89_IFS_CLM_BACKGROUND;
 	env->ifs_clm_mntr_time = 0;
 
 	para.ifs_clm_app = RTW89_IFS_CLM_INIT;
 	if (rtw89_phy_ifs_clm_th_update_check(rtwdev, &para))
 		rtw89_phy_ifs_clm_set_th_reg(rtwdev);
 
 	rtw89_phy_set_phy_regs(rtwdev, R_IFS_COUNTER, B_IFS_COLLECT_EN,
 			       true);
 	rtw89_phy_set_phy_regs(rtwdev, R_IFS_T1, B_IFS_T1_EN_MSK, true);
 	rtw89_phy_set_phy_regs(rtwdev, R_IFS_T2, B_IFS_T2_EN_MSK, true);
 	rtw89_phy_set_phy_regs(rtwdev, R_IFS_T3, B_IFS_T3_EN_MSK, true);
 	rtw89_phy_set_phy_regs(rtwdev, R_IFS_T4, B_IFS_T4_EN_MSK, true);
 }
 
 static int rtw89_phy_ccx_racing_ctrl(struct rtw89_dev *rtwdev,
 				     enum rtw89_env_racing_lv level)
 {
 	struct rtw89_env_monitor_info *env = &rtwdev->env_monitor;
 	int ret = 0;
 
 	if (level >= RTW89_RAC_MAX_NUM) {
 		rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK,
 			    "[WARNING] Wrong LV=%d\n", level);
 		return -EINVAL;
 	}
 
 	rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK,
 		    "ccx_ongoing=%d, level:(%d)->(%d)\n", env->ccx_ongoing,
 		    env->ccx_rac_lv, level);
 
 	if (env->ccx_ongoing) {
 		if (level <= env->ccx_rac_lv)
 			ret = -EINVAL;
 		else
 			env->ccx_ongoing = false;
 	}
 
 	if (ret == 0)
 		env->ccx_rac_lv = level;
 
 	rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK, "ccx racing success=%d\n",
 		    !ret);
 
 	return ret;
 }
 
 static void rtw89_phy_ccx_trigger(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_env_monitor_info *env = &rtwdev->env_monitor;
 
 	rtw89_phy_set_phy_regs(rtwdev, R_IFS_COUNTER, B_IFS_COUNTER_CLR_MSK, 0);
 	rtw89_phy_set_phy_regs(rtwdev, R_CCX, B_MEASUREMENT_TRIG_MSK, 0);
 	rtw89_phy_set_phy_regs(rtwdev, R_IFS_COUNTER, B_IFS_COUNTER_CLR_MSK, 1);
 	rtw89_phy_set_phy_regs(rtwdev, R_CCX, B_MEASUREMENT_TRIG_MSK, 1);
 
 	env->ccx_ongoing = true;
 }
 
 static void rtw89_phy_ifs_clm_get_utility(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_env_monitor_info *env = &rtwdev->env_monitor;
 	u8 i = 0;
 	u32 res = 0;
 
 	env->ifs_clm_tx_ratio =
 		rtw89_phy_ccx_get_report(rtwdev, env->ifs_clm_tx, PERCENT);
 	env->ifs_clm_edcca_excl_cca_ratio =
 		rtw89_phy_ccx_get_report(rtwdev, env->ifs_clm_edcca_excl_cca,
 					 PERCENT);
 	env->ifs_clm_cck_fa_ratio =
 		rtw89_phy_ccx_get_report(rtwdev, env->ifs_clm_cckfa, PERCENT);
 	env->ifs_clm_ofdm_fa_ratio =
 		rtw89_phy_ccx_get_report(rtwdev, env->ifs_clm_ofdmfa, PERCENT);
 	env->ifs_clm_cck_cca_excl_fa_ratio =
 		rtw89_phy_ccx_get_report(rtwdev, env->ifs_clm_cckcca_excl_fa,
 					 PERCENT);
 	env->ifs_clm_ofdm_cca_excl_fa_ratio =
 		rtw89_phy_ccx_get_report(rtwdev, env->ifs_clm_ofdmcca_excl_fa,
 					 PERCENT);
 	env->ifs_clm_cck_fa_permil =
 		rtw89_phy_ccx_get_report(rtwdev, env->ifs_clm_cckfa, PERMIL);
 	env->ifs_clm_ofdm_fa_permil =
 		rtw89_phy_ccx_get_report(rtwdev, env->ifs_clm_ofdmfa, PERMIL);
 
 	for (i = 0; i < RTW89_IFS_CLM_NUM; i++) {
 		if (env->ifs_clm_his[i] > ENV_MNTR_IFSCLM_HIS_MAX) {
 			env->ifs_clm_ifs_avg[i] = ENV_MNTR_FAIL_DWORD;
 		} else {
 			env->ifs_clm_ifs_avg[i] =
 				rtw89_phy_ccx_idx_to_us(rtwdev,
 							env->ifs_clm_avg[i]);
 		}
 
 		res = rtw89_phy_ccx_idx_to_us(rtwdev, env->ifs_clm_cca[i]);
 		res += env->ifs_clm_his[i] >> 1;
 		if (env->ifs_clm_his[i])
 			res /= env->ifs_clm_his[i];
 		else
 			res = 0;
 		env->ifs_clm_cca_avg[i] = res;
 	}
 
 	rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK,
 		    "IFS-CLM ratio {Tx, EDCCA_exclu_cca} = {%d, %d}\n",
 		    env->ifs_clm_tx_ratio, env->ifs_clm_edcca_excl_cca_ratio);
 	rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK,
 		    "IFS-CLM FA ratio {CCK, OFDM} = {%d, %d}\n",
 		    env->ifs_clm_cck_fa_ratio, env->ifs_clm_ofdm_fa_ratio);
 	rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK,
 		    "IFS-CLM FA permil {CCK, OFDM} = {%d, %d}\n",
 		    env->ifs_clm_cck_fa_permil, env->ifs_clm_ofdm_fa_permil);
 	rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK,
 		    "IFS-CLM CCA_exclu_FA ratio {CCK, OFDM} = {%d, %d}\n",
 		    env->ifs_clm_cck_cca_excl_fa_ratio,
 		    env->ifs_clm_ofdm_cca_excl_fa_ratio);
 	rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK,
 		    "Time:[his, ifs_avg(us), cca_avg(us)]\n");
 	for (i = 0; i < RTW89_IFS_CLM_NUM; i++)
 		rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK, "T%d:[%d, %d, %d]\n",
 			    i + 1, env->ifs_clm_his[i], env->ifs_clm_ifs_avg[i],
 			    env->ifs_clm_cca_avg[i]);
 }
 
 static bool rtw89_phy_ifs_clm_get_result(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_env_monitor_info *env = &rtwdev->env_monitor;
 	u8 i = 0;
 
 	if (rtw89_phy_read32_mask(rtwdev, R_IFSCNT, B_IFSCNT_DONE_MSK) == 0) {
 		rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK,
 			    "Get IFS_CLM report Fail\n");
 		return false;
 	}
 
 	env->ifs_clm_tx =
 		rtw89_phy_read32_mask(rtwdev, R_IFS_CLM_TX_CNT,
 				      B_IFS_CLM_TX_CNT_MSK);
 	env->ifs_clm_edcca_excl_cca =
 		rtw89_phy_read32_mask(rtwdev, R_IFS_CLM_TX_CNT,
 				      B_IFS_CLM_EDCCA_EXCLUDE_CCA_FA_MSK);
 	env->ifs_clm_cckcca_excl_fa =
 		rtw89_phy_read32_mask(rtwdev, R_IFS_CLM_CCA,
 				      B_IFS_CLM_CCKCCA_EXCLUDE_FA_MSK);
 	env->ifs_clm_ofdmcca_excl_fa =
 		rtw89_phy_read32_mask(rtwdev, R_IFS_CLM_CCA,
 				      B_IFS_CLM_OFDMCCA_EXCLUDE_FA_MSK);
 	env->ifs_clm_cckfa =
 		rtw89_phy_read32_mask(rtwdev, R_IFS_CLM_FA,
 				      B_IFS_CLM_CCK_FA_MSK);
 	env->ifs_clm_ofdmfa =
 		rtw89_phy_read32_mask(rtwdev, R_IFS_CLM_FA,
 				      B_IFS_CLM_OFDM_FA_MSK);
 
 	env->ifs_clm_his[0] =
 		rtw89_phy_read32_mask(rtwdev, R_IFS_HIS, B_IFS_T1_HIS_MSK);
 	env->ifs_clm_his[1] =
 		rtw89_phy_read32_mask(rtwdev, R_IFS_HIS, B_IFS_T2_HIS_MSK);
 	env->ifs_clm_his[2] =
 		rtw89_phy_read32_mask(rtwdev, R_IFS_HIS, B_IFS_T3_HIS_MSK);
 	env->ifs_clm_his[3] =
 		rtw89_phy_read32_mask(rtwdev, R_IFS_HIS, B_IFS_T4_HIS_MSK);
 
 	env->ifs_clm_avg[0] =
 		rtw89_phy_read32_mask(rtwdev, R_IFS_AVG_L, B_IFS_T1_AVG_MSK);
 	env->ifs_clm_avg[1] =
 		rtw89_phy_read32_mask(rtwdev, R_IFS_AVG_L, B_IFS_T2_AVG_MSK);
 	env->ifs_clm_avg[2] =
 		rtw89_phy_read32_mask(rtwdev, R_IFS_AVG_H, B_IFS_T3_AVG_MSK);
 	env->ifs_clm_avg[3] =
 		rtw89_phy_read32_mask(rtwdev, R_IFS_AVG_H, B_IFS_T4_AVG_MSK);
 
 	env->ifs_clm_cca[0] =
 		rtw89_phy_read32_mask(rtwdev, R_IFS_CCA_L, B_IFS_T1_CCA_MSK);
 	env->ifs_clm_cca[1] =
 		rtw89_phy_read32_mask(rtwdev, R_IFS_CCA_L, B_IFS_T2_CCA_MSK);
 	env->ifs_clm_cca[2] =
 		rtw89_phy_read32_mask(rtwdev, R_IFS_CCA_H, B_IFS_T3_CCA_MSK);
 	env->ifs_clm_cca[3] =
 		rtw89_phy_read32_mask(rtwdev, R_IFS_CCA_H, B_IFS_T4_CCA_MSK);
 
 	env->ifs_clm_total_ifs =
 		rtw89_phy_read32_mask(rtwdev, R_IFSCNT, B_IFSCNT_TOTAL_CNT_MSK);
 
 	rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK, "IFS-CLM total_ifs = %d\n",
 		    env->ifs_clm_total_ifs);
 	rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK,
 		    "{Tx, EDCCA_exclu_cca} = {%d, %d}\n",
 		    env->ifs_clm_tx, env->ifs_clm_edcca_excl_cca);
 	rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK,
 		    "IFS-CLM FA{CCK, OFDM} = {%d, %d}\n",
 		    env->ifs_clm_cckfa, env->ifs_clm_ofdmfa);
 	rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK,
 		    "IFS-CLM CCA_exclu_FA{CCK, OFDM} = {%d, %d}\n",
 		    env->ifs_clm_cckcca_excl_fa, env->ifs_clm_ofdmcca_excl_fa);
 
 	rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK, "Time:[his, avg, cca]\n");
 	for (i = 0; i < RTW89_IFS_CLM_NUM; i++)
 		rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK,
 			    "T%d:[%d, %d, %d]\n", i + 1, env->ifs_clm_his[i],
 			    env->ifs_clm_avg[i], env->ifs_clm_cca[i]);
 
 	rtw89_phy_ifs_clm_get_utility(rtwdev);
 
 	return true;
 }
 
 static int rtw89_phy_ifs_clm_set(struct rtw89_dev *rtwdev,
 				 struct rtw89_ccx_para_info *para)
 {
 	struct rtw89_env_monitor_info *env = &rtwdev->env_monitor;
 	u32 period = 0;
 	u32 unit_idx = 0;
 
 	if (para->mntr_time == 0) {
 		rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK,
 			    "[WARN] MNTR_TIME is 0\n");
 		return -EINVAL;
 	}
 
 	if (rtw89_phy_ccx_racing_ctrl(rtwdev, para->rac_lv))
 		return -EINVAL;
 
 	if (para->mntr_time != env->ifs_clm_mntr_time) {
 		rtw89_phy_ccx_ms_to_period_unit(rtwdev, para->mntr_time,
 						&period, &unit_idx);
 		rtw89_phy_set_phy_regs(rtwdev, R_IFS_COUNTER,
 				       B_IFS_CLM_PERIOD_MSK, period);
 		rtw89_phy_set_phy_regs(rtwdev, R_IFS_COUNTER,
 				       B_IFS_CLM_COUNTER_UNIT_MSK, unit_idx);
 
 		rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK,
 			    "Update IFS-CLM time ((%d)) -> ((%d))\n",
 			    env->ifs_clm_mntr_time, para->mntr_time);
 
 		env->ifs_clm_mntr_time = para->mntr_time;
 		env->ccx_period = (u16)period;
 		env->ccx_unit_idx = (u8)unit_idx;
 	}
 
 	if (rtw89_phy_ifs_clm_th_update_check(rtwdev, para)) {
 		env->ifs_clm_app = para->ifs_clm_app;
 		rtw89_phy_ifs_clm_set_th_reg(rtwdev);
 	}
 
 	return 0;
 }
 
 void rtw89_phy_env_monitor_track(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_env_monitor_info *env = &rtwdev->env_monitor;
 	struct rtw89_ccx_para_info para = {0};
 	u8 chk_result = RTW89_PHY_ENV_MON_CCX_FAIL;
 
 	env->ccx_watchdog_result = RTW89_PHY_ENV_MON_CCX_FAIL;
 	if (env->ccx_manual_ctrl) {
 		rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK,
 			    "CCX in manual ctrl\n");
 		return;
 	}
 
 	/* only ifs_clm for now */
 	if (rtw89_phy_ifs_clm_get_result(rtwdev))
 		env->ccx_watchdog_result |= RTW89_PHY_ENV_MON_IFS_CLM;
 
 	rtw89_phy_ccx_racing_release(rtwdev);
 	para.mntr_time = 1900;
 	para.rac_lv = RTW89_RAC_LV_1;
 	para.ifs_clm_app = RTW89_IFS_CLM_BACKGROUND;
 
 	if (rtw89_phy_ifs_clm_set(rtwdev, &para) == 0)
 		chk_result |= RTW89_PHY_ENV_MON_IFS_CLM;
 	if (chk_result)
 		rtw89_phy_ccx_trigger(rtwdev);
 
 	rtw89_debug(rtwdev, RTW89_DBG_PHY_TRACK,
 		    "get_result=0x%x, chk_result:0x%x\n",
 		    env->ccx_watchdog_result, chk_result);
 }
 
 static bool rtw89_physts_ie_page_valid(enum rtw89_phy_status_bitmap *ie_page)
 {
 	if (*ie_page >= RTW89_PHYSTS_BITMAP_NUM ||
 	    *ie_page == RTW89_RSVD_9)
 		return false;
 	else if (*ie_page > RTW89_RSVD_9)
 		*ie_page -= 1;
 
 	return true;
 }
 
 static u32 rtw89_phy_get_ie_bitmap_addr(enum rtw89_phy_status_bitmap ie_page)
 {
 	static const u8 ie_page_shift = 2;
 
 	return R_PHY_STS_BITMAP_ADDR_START + (ie_page << ie_page_shift);
 }
 
 static u32 rtw89_physts_get_ie_bitmap(struct rtw89_dev *rtwdev,
 				      enum rtw89_phy_status_bitmap ie_page)
 {
 	u32 addr;
 
 	if (!rtw89_physts_ie_page_valid(&ie_page))
 		return 0;
 
 	addr = rtw89_phy_get_ie_bitmap_addr(ie_page);
 
 	return rtw89_phy_read32(rtwdev, addr);
 }
 
 static void rtw89_physts_set_ie_bitmap(struct rtw89_dev *rtwdev,
 				       enum rtw89_phy_status_bitmap ie_page,
 				       u32 val)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	u32 addr;
 
 	if (!rtw89_physts_ie_page_valid(&ie_page))
 		return;
 
 	if (chip->chip_id == RTL8852A)
 		val &= B_PHY_STS_BITMAP_MSK_52A;
 
 	addr = rtw89_phy_get_ie_bitmap_addr(ie_page);
 	rtw89_phy_write32(rtwdev, addr, val);
 }
 
 static void rtw89_physts_enable_ie_bitmap(struct rtw89_dev *rtwdev,
 					  enum rtw89_phy_status_bitmap bitmap,
 					  enum rtw89_phy_status_ie_type ie,
 					  bool enable)
 {
 	u32 val = rtw89_physts_get_ie_bitmap(rtwdev, bitmap);
 
 	if (enable)
 		val |= BIT(ie);
 	else
 		val &= ~BIT(ie);
 
 	rtw89_physts_set_ie_bitmap(rtwdev, bitmap, val);
 }
 
 static void rtw89_physts_enable_fail_report(struct rtw89_dev *rtwdev,
 					    bool enable,
 					    enum rtw89_phy_idx phy_idx)
 {
 	if (enable) {
 		rtw89_phy_write32_clr(rtwdev, R_PLCP_HISTOGRAM,
 				      B_STS_DIS_TRIG_BY_FAIL);
 		rtw89_phy_write32_clr(rtwdev, R_PLCP_HISTOGRAM,
 				      B_STS_DIS_TRIG_BY_BRK);
 	} else {
 		rtw89_phy_write32_set(rtwdev, R_PLCP_HISTOGRAM,
 				      B_STS_DIS_TRIG_BY_FAIL);
 		rtw89_phy_write32_set(rtwdev, R_PLCP_HISTOGRAM,
 				      B_STS_DIS_TRIG_BY_BRK);
 	}
 }
 
 static void rtw89_physts_parsing_init(struct rtw89_dev *rtwdev)
 {
 	u8 i;
 
 	rtw89_physts_enable_fail_report(rtwdev, false, RTW89_PHY_0);
 
 	for (i = 0; i < RTW89_PHYSTS_BITMAP_NUM; i++) {
 		if (i >= RTW89_CCK_PKT)
 			rtw89_physts_enable_ie_bitmap(rtwdev, i,
 						      RTW89_PHYSTS_IE09_FTR_0,
 						      true);
 		if ((i >= RTW89_CCK_BRK && i <= RTW89_VHT_MU) ||
 		    (i >= RTW89_RSVD_9 && i <= RTW89_CCK_PKT))
 			continue;
 		rtw89_physts_enable_ie_bitmap(rtwdev, i,
 					      RTW89_PHYSTS_IE24_OFDM_TD_PATH_A,
 					      true);
 	}
 	rtw89_physts_enable_ie_bitmap(rtwdev, RTW89_VHT_PKT,
 				      RTW89_PHYSTS_IE13_DL_MU_DEF, true);
 	rtw89_physts_enable_ie_bitmap(rtwdev, RTW89_HE_PKT,
 				      RTW89_PHYSTS_IE13_DL_MU_DEF, true);
 
 	/* force IE01 for channel index, only channel field is valid */
 	rtw89_physts_enable_ie_bitmap(rtwdev, RTW89_CCK_PKT,
 				      RTW89_PHYSTS_IE01_CMN_OFDM, true);
 }
 
 static void rtw89_phy_dig_read_gain_table(struct rtw89_dev *rtwdev, int type)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	struct rtw89_dig_info *dig = &rtwdev->dig;
 	const struct rtw89_phy_dig_gain_cfg *cfg;
 	const char *msg;
 	u8 i;
 	s8 gain_base;
 	s8 *gain_arr;
 	u32 tmp;
 
 	switch (type) {
 	case RTW89_DIG_GAIN_LNA_G:
 		gain_arr = dig->lna_gain_g;
 		gain_base = LNA0_GAIN;
 		cfg = chip->dig_table->cfg_lna_g;
 		msg = "lna_gain_g";
 		break;
 	case RTW89_DIG_GAIN_TIA_G:
 		gain_arr = dig->tia_gain_g;
 		gain_base = TIA0_GAIN_G;
 		cfg = chip->dig_table->cfg_tia_g;
 		msg = "tia_gain_g";
 		break;
 	case RTW89_DIG_GAIN_LNA_A:
 		gain_arr = dig->lna_gain_a;
 		gain_base = LNA0_GAIN;
 		cfg = chip->dig_table->cfg_lna_a;
 		msg = "lna_gain_a";
 		break;
 	case RTW89_DIG_GAIN_TIA_A:
 		gain_arr = dig->tia_gain_a;
 		gain_base = TIA0_GAIN_A;
 		cfg = chip->dig_table->cfg_tia_a;
 		msg = "tia_gain_a";
 		break;
 	default:
 		return;
 	}
 
 	for (i = 0; i < cfg->size; i++) {
 		tmp = rtw89_phy_read32_mask(rtwdev, cfg->table[i].addr,
 					    cfg->table[i].mask);
 		tmp >>= DIG_GAIN_SHIFT;
 		gain_arr[i] = sign_extend32(tmp, U4_MAX_BIT) + gain_base;
 		gain_base += DIG_GAIN;
 
 		rtw89_debug(rtwdev, RTW89_DBG_DIG, "%s[%d]=%d\n",
 			    msg, i, gain_arr[i]);
 	}
 }
 
 static void rtw89_phy_dig_update_gain_para(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_dig_info *dig = &rtwdev->dig;
 	u32 tmp;
 	u8 i;
 
 	if (!rtwdev->hal.support_igi)
 		return;
 
 	tmp = rtw89_phy_read32_mask(rtwdev, R_PATH0_IB_PKPW,
 				    B_PATH0_IB_PKPW_MSK);
 	dig->ib_pkpwr = sign_extend32(tmp >> DIG_GAIN_SHIFT, U8_MAX_BIT);
 	dig->ib_pbk = rtw89_phy_read32_mask(rtwdev, R_PATH0_IB_PBK,
 					    B_PATH0_IB_PBK_MSK);
 	rtw89_debug(rtwdev, RTW89_DBG_DIG, "ib_pkpwr=%d, ib_pbk=%d\n",
 		    dig->ib_pkpwr, dig->ib_pbk);
 
 	for (i = RTW89_DIG_GAIN_LNA_G; i < RTW89_DIG_GAIN_MAX; i++)
 		rtw89_phy_dig_read_gain_table(rtwdev, i);
 }
 
 static const u8 rssi_nolink = 22;
 static const u8 igi_rssi_th[IGI_RSSI_TH_NUM] = {68, 84, 90, 98, 104};
 static const u16 fa_th_2g[FA_TH_NUM] = {22, 44, 66, 88};
 static const u16 fa_th_5g[FA_TH_NUM] = {4, 8, 12, 16};
 static const u16 fa_th_nolink[FA_TH_NUM] = {196, 352, 440, 528};
 
 static void rtw89_phy_dig_update_rssi_info(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_phy_ch_info *ch_info = &rtwdev->ch_info;
 	struct rtw89_dig_info *dig = &rtwdev->dig;
 	bool is_linked = rtwdev->total_sta_assoc > 0;
 
 	if (is_linked) {
 		dig->igi_rssi = ch_info->rssi_min >> 1;
 	} else {
 		rtw89_debug(rtwdev, RTW89_DBG_DIG, "RSSI update : NO Link\n");
 		dig->igi_rssi = rssi_nolink;
 	}
 }
 
 static void rtw89_phy_dig_update_para(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_dig_info *dig = &rtwdev->dig;
 	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, RTW89_SUB_ENTITY_0);
 	bool is_linked = rtwdev->total_sta_assoc > 0;
 	const u16 *fa_th_src = NULL;
 
 	switch (chan->band_type) {
 	case RTW89_BAND_2G:
 		dig->lna_gain = dig->lna_gain_g;
 		dig->tia_gain = dig->tia_gain_g;
 		fa_th_src = is_linked ? fa_th_2g : fa_th_nolink;
 		dig->force_gaincode_idx_en = false;
 		dig->dyn_pd_th_en = true;
 		break;
 	case RTW89_BAND_5G:
 	default:
 		dig->lna_gain = dig->lna_gain_a;
 		dig->tia_gain = dig->tia_gain_a;
 		fa_th_src = is_linked ? fa_th_5g : fa_th_nolink;
 		dig->force_gaincode_idx_en = true;
 		dig->dyn_pd_th_en = true;
 		break;
 	}
 	memcpy(dig->fa_th, fa_th_src, sizeof(dig->fa_th));
 	memcpy(dig->igi_rssi_th, igi_rssi_th, sizeof(dig->igi_rssi_th));
 }
 
 static const u8 pd_low_th_offset = 20, dynamic_igi_min = 0x20;
 static const u8 igi_max_performance_mode = 0x5a;
 static const u8 dynamic_pd_threshold_max;
 
 static void rtw89_phy_dig_para_reset(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_dig_info *dig = &rtwdev->dig;
 
 	dig->cur_gaincode.lna_idx = LNA_IDX_MAX;
 	dig->cur_gaincode.tia_idx = TIA_IDX_MAX;
 	dig->cur_gaincode.rxb_idx = RXB_IDX_MAX;
 	dig->force_gaincode.lna_idx = LNA_IDX_MAX;
 	dig->force_gaincode.tia_idx = TIA_IDX_MAX;
 	dig->force_gaincode.rxb_idx = RXB_IDX_MAX;
 
 	dig->dyn_igi_max = igi_max_performance_mode;
 	dig->dyn_igi_min = dynamic_igi_min;
 	dig->dyn_pd_th_max = dynamic_pd_threshold_max;
 	dig->pd_low_th_ofst = pd_low_th_offset;
 	dig->is_linked_pre = false;
 }
 
 static void rtw89_phy_dig_init(struct rtw89_dev *rtwdev)
 {
 	rtw89_phy_dig_update_gain_para(rtwdev);
 	rtw89_phy_dig_reset(rtwdev);
 }
 
 static u8 rtw89_phy_dig_lna_idx_by_rssi(struct rtw89_dev *rtwdev, u8 rssi)
 {
 	struct rtw89_dig_info *dig = &rtwdev->dig;
 	u8 lna_idx;
 
 	if (rssi < dig->igi_rssi_th[0])
 		lna_idx = RTW89_DIG_GAIN_LNA_IDX6;
 	else if (rssi < dig->igi_rssi_th[1])
 		lna_idx = RTW89_DIG_GAIN_LNA_IDX5;
 	else if (rssi < dig->igi_rssi_th[2])
 		lna_idx = RTW89_DIG_GAIN_LNA_IDX4;
 	else if (rssi < dig->igi_rssi_th[3])
 		lna_idx = RTW89_DIG_GAIN_LNA_IDX3;
 	else if (rssi < dig->igi_rssi_th[4])
 		lna_idx = RTW89_DIG_GAIN_LNA_IDX2;
 	else
 		lna_idx = RTW89_DIG_GAIN_LNA_IDX1;
 
 	return lna_idx;
 }
 
 static u8 rtw89_phy_dig_tia_idx_by_rssi(struct rtw89_dev *rtwdev, u8 rssi)
 {
 	struct rtw89_dig_info *dig = &rtwdev->dig;
 	u8 tia_idx;
 
 	if (rssi < dig->igi_rssi_th[0])
 		tia_idx = RTW89_DIG_GAIN_TIA_IDX1;
 	else
 		tia_idx = RTW89_DIG_GAIN_TIA_IDX0;
 
 	return tia_idx;
 }
 
 #define IB_PBK_BASE 110
 #define WB_RSSI_BASE 10
 static u8 rtw89_phy_dig_rxb_idx_by_rssi(struct rtw89_dev *rtwdev, u8 rssi,
 					struct rtw89_agc_gaincode_set *set)
 {
 	struct rtw89_dig_info *dig = &rtwdev->dig;
 	s8 lna_gain = dig->lna_gain[set->lna_idx];
 	s8 tia_gain = dig->tia_gain[set->tia_idx];
 	s32 wb_rssi = rssi + lna_gain + tia_gain;
 	s32 rxb_idx_tmp = IB_PBK_BASE + WB_RSSI_BASE;
 	u8 rxb_idx;
 
 	rxb_idx_tmp += dig->ib_pkpwr - dig->ib_pbk - wb_rssi;
 	rxb_idx = clamp_t(s32, rxb_idx_tmp, RXB_IDX_MIN, RXB_IDX_MAX);
 
 	rtw89_debug(rtwdev, RTW89_DBG_DIG, "wb_rssi=%03d, rxb_idx_tmp=%03d\n",
 		    wb_rssi, rxb_idx_tmp);
 
 	return rxb_idx;
 }
 
 static void rtw89_phy_dig_gaincode_by_rssi(struct rtw89_dev *rtwdev, u8 rssi,
 					   struct rtw89_agc_gaincode_set *set)
 {
 	set->lna_idx = rtw89_phy_dig_lna_idx_by_rssi(rtwdev, rssi);
 	set->tia_idx = rtw89_phy_dig_tia_idx_by_rssi(rtwdev, rssi);
 	set->rxb_idx = rtw89_phy_dig_rxb_idx_by_rssi(rtwdev, rssi, set);
 
 	rtw89_debug(rtwdev, RTW89_DBG_DIG,
 		    "final_rssi=%03d, (lna,tia,rab)=(%d,%d,%02d)\n",
 		    rssi, set->lna_idx, set->tia_idx, set->rxb_idx);
 }
 
 #define IGI_OFFSET_MAX 25
 #define IGI_OFFSET_MUL 2
 static void rtw89_phy_dig_igi_offset_by_env(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_dig_info *dig = &rtwdev->dig;
 	struct rtw89_env_monitor_info *env = &rtwdev->env_monitor;
 	enum rtw89_dig_noisy_level noisy_lv;
 	u8 igi_offset = dig->fa_rssi_ofst;
 	u16 fa_ratio = 0;
 
 	fa_ratio = env->ifs_clm_cck_fa_permil + env->ifs_clm_ofdm_fa_permil;
 
 	if (fa_ratio < dig->fa_th[0])
 		noisy_lv = RTW89_DIG_NOISY_LEVEL0;
 	else if (fa_ratio < dig->fa_th[1])
 		noisy_lv = RTW89_DIG_NOISY_LEVEL1;
 	else if (fa_ratio < dig->fa_th[2])
 		noisy_lv = RTW89_DIG_NOISY_LEVEL2;
 	else if (fa_ratio < dig->fa_th[3])
 		noisy_lv = RTW89_DIG_NOISY_LEVEL3;
 	else
 		noisy_lv = RTW89_DIG_NOISY_LEVEL_MAX;
 
 	if (noisy_lv == RTW89_DIG_NOISY_LEVEL0 && igi_offset < 2)
 		igi_offset = 0;
 	else
 		igi_offset += noisy_lv * IGI_OFFSET_MUL;
 
 	igi_offset = min_t(u8, igi_offset, IGI_OFFSET_MAX);
 	dig->fa_rssi_ofst = igi_offset;
 
 	rtw89_debug(rtwdev, RTW89_DBG_DIG,
 		    "fa_th: [+6 (%d) +4 (%d) +2 (%d) 0 (%d) -2 ]\n",
 		    dig->fa_th[3], dig->fa_th[2], dig->fa_th[1], dig->fa_th[0]);
 
 	rtw89_debug(rtwdev, RTW89_DBG_DIG,
 		    "fa(CCK,OFDM,ALL)=(%d,%d,%d)%%, noisy_lv=%d, ofst=%d\n",
 		    env->ifs_clm_cck_fa_permil, env->ifs_clm_ofdm_fa_permil,
 		    env->ifs_clm_cck_fa_permil + env->ifs_clm_ofdm_fa_permil,
 		    noisy_lv, igi_offset);
 }
 
 static void rtw89_phy_dig_set_lna_idx(struct rtw89_dev *rtwdev, u8 lna_idx)
 {
 	const struct rtw89_dig_regs *dig_regs = rtwdev->chip->dig_regs;
 
 	rtw89_phy_write32_mask(rtwdev, dig_regs->p0_lna_init.addr,
 			       dig_regs->p0_lna_init.mask, lna_idx);
 	rtw89_phy_write32_mask(rtwdev, dig_regs->p1_lna_init.addr,
 			       dig_regs->p1_lna_init.mask, lna_idx);
 }
 
 static void rtw89_phy_dig_set_tia_idx(struct rtw89_dev *rtwdev, u8 tia_idx)
 {
 	const struct rtw89_dig_regs *dig_regs = rtwdev->chip->dig_regs;
 
 	rtw89_phy_write32_mask(rtwdev, dig_regs->p0_tia_init.addr,
 			       dig_regs->p0_tia_init.mask, tia_idx);
 	rtw89_phy_write32_mask(rtwdev, dig_regs->p1_tia_init.addr,
 			       dig_regs->p1_tia_init.mask, tia_idx);
 }
 
 static void rtw89_phy_dig_set_rxb_idx(struct rtw89_dev *rtwdev, u8 rxb_idx)
 {
 	const struct rtw89_dig_regs *dig_regs = rtwdev->chip->dig_regs;
 
 	rtw89_phy_write32_mask(rtwdev, dig_regs->p0_rxb_init.addr,
 			       dig_regs->p0_rxb_init.mask, rxb_idx);
 	rtw89_phy_write32_mask(rtwdev, dig_regs->p1_rxb_init.addr,
 			       dig_regs->p1_rxb_init.mask, rxb_idx);
 }
 
 static void rtw89_phy_dig_set_igi_cr(struct rtw89_dev *rtwdev,
 				     const struct rtw89_agc_gaincode_set set)
 {
 	rtw89_phy_dig_set_lna_idx(rtwdev, set.lna_idx);
 	rtw89_phy_dig_set_tia_idx(rtwdev, set.tia_idx);
 	rtw89_phy_dig_set_rxb_idx(rtwdev, set.rxb_idx);
 
 	rtw89_debug(rtwdev, RTW89_DBG_DIG, "Set (lna,tia,rxb)=((%d,%d,%02d))\n",
 		    set.lna_idx, set.tia_idx, set.rxb_idx);
 }
 
 static void rtw89_phy_dig_sdagc_follow_pagc_config(struct rtw89_dev *rtwdev,
 						   bool enable)
 {
 	const struct rtw89_dig_regs *dig_regs = rtwdev->chip->dig_regs;
 
 	rtw89_phy_write32_mask(rtwdev, dig_regs->p0_p20_pagcugc_en.addr,
 			       dig_regs->p0_p20_pagcugc_en.mask, enable);
 	rtw89_phy_write32_mask(rtwdev, dig_regs->p0_s20_pagcugc_en.addr,
 			       dig_regs->p0_s20_pagcugc_en.mask, enable);
 	rtw89_phy_write32_mask(rtwdev, dig_regs->p1_p20_pagcugc_en.addr,
 			       dig_regs->p1_p20_pagcugc_en.mask, enable);
 	rtw89_phy_write32_mask(rtwdev, dig_regs->p1_s20_pagcugc_en.addr,
 			       dig_regs->p1_s20_pagcugc_en.mask, enable);
 
 	rtw89_debug(rtwdev, RTW89_DBG_DIG, "sdagc_follow_pagc=%d\n", enable);
 }
 
 static void rtw89_phy_dig_config_igi(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_dig_info *dig = &rtwdev->dig;
 
 	if (!rtwdev->hal.support_igi)
 		return;
 
 	if (dig->force_gaincode_idx_en) {
 		rtw89_phy_dig_set_igi_cr(rtwdev, dig->force_gaincode);
 		rtw89_debug(rtwdev, RTW89_DBG_DIG,
 			    "Force gaincode index enabled.\n");
 	} else {
 		rtw89_phy_dig_gaincode_by_rssi(rtwdev, dig->igi_fa_rssi,
 					       &dig->cur_gaincode);
 		rtw89_phy_dig_set_igi_cr(rtwdev, dig->cur_gaincode);
 	}
 }
 
 static void rtw89_phy_dig_dyn_pd_th(struct rtw89_dev *rtwdev, u8 rssi,
 				    bool enable)
 {
 	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, RTW89_SUB_ENTITY_0);
 	const struct rtw89_dig_regs *dig_regs = rtwdev->chip->dig_regs;
 	enum rtw89_bandwidth cbw = chan->band_width;
 	struct rtw89_dig_info *dig = &rtwdev->dig;
 	u8 final_rssi = 0, under_region = dig->pd_low_th_ofst;
 	u8 ofdm_cca_th;
 	s8 cck_cca_th;
 	u32 pd_val = 0;
 
 	under_region += PD_TH_SB_FLTR_CMP_VAL;
 
 	switch (cbw) {
 	case RTW89_CHANNEL_WIDTH_40:
 		under_region += PD_TH_BW40_CMP_VAL;
 		break;
 	case RTW89_CHANNEL_WIDTH_80:
 		under_region += PD_TH_BW80_CMP_VAL;
 		break;
 	case RTW89_CHANNEL_WIDTH_160:
 		under_region += PD_TH_BW160_CMP_VAL;
 		break;
 	case RTW89_CHANNEL_WIDTH_20:
 		fallthrough;
 	default:
 		under_region += PD_TH_BW20_CMP_VAL;
 		break;
 	}
 
 	dig->dyn_pd_th_max = dig->igi_rssi;
 
 	final_rssi = min_t(u8, rssi, dig->igi_rssi);
 	ofdm_cca_th = clamp_t(u8, final_rssi, PD_TH_MIN_RSSI + under_region,
 			      PD_TH_MAX_RSSI + under_region);
 
 	if (enable) {
 		pd_val = (ofdm_cca_th - under_region - PD_TH_MIN_RSSI) >> 1;
 		rtw89_debug(rtwdev, RTW89_DBG_DIG,
 			    "igi=%d, ofdm_ccaTH=%d, backoff=%d, PD_low=%d\n",
 			    final_rssi, ofdm_cca_th, under_region, pd_val);
 	} else {
 		rtw89_debug(rtwdev, RTW89_DBG_DIG,
 			    "Dynamic PD th disabled, Set PD_low_bd=0\n");
 	}
 
 	rtw89_phy_write32_mask(rtwdev, dig_regs->seg0_pd_reg,
 			       dig_regs->pd_lower_bound_mask, pd_val);
 	rtw89_phy_write32_mask(rtwdev, dig_regs->seg0_pd_reg,
 			       dig_regs->pd_spatial_reuse_en, enable);
 
 	if (!rtwdev->hal.support_cckpd)
 		return;
 
 	cck_cca_th = max_t(s8, final_rssi - under_region, CCKPD_TH_MIN_RSSI);
 	pd_val = (u32)(cck_cca_th - IGI_RSSI_MAX);
 
 	rtw89_debug(rtwdev, RTW89_DBG_DIG,
 		    "igi=%d, cck_ccaTH=%d, backoff=%d, cck_PD_low=((%d))dB\n",
 		    final_rssi, cck_cca_th, under_region, pd_val);
 
 	rtw89_phy_write32_mask(rtwdev, R_BMODE_PDTH_EN_V1,
 			       B_BMODE_PDTH_LIMIT_EN_MSK_V1, enable);
 	rtw89_phy_write32_mask(rtwdev, R_BMODE_PDTH_V1,
 			       B_BMODE_PDTH_LOWER_BOUND_MSK_V1, pd_val);
 }
 
 void rtw89_phy_dig_reset(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_dig_info *dig = &rtwdev->dig;
 
 	dig->bypass_dig = false;
 	rtw89_phy_dig_para_reset(rtwdev);
 	rtw89_phy_dig_set_igi_cr(rtwdev, dig->force_gaincode);
 	rtw89_phy_dig_dyn_pd_th(rtwdev, rssi_nolink, false);
 	rtw89_phy_dig_sdagc_follow_pagc_config(rtwdev, false);
 	rtw89_phy_dig_update_para(rtwdev);
 }
 
 #define IGI_RSSI_MIN 10
 void rtw89_phy_dig(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_dig_info *dig = &rtwdev->dig;
 	bool is_linked = rtwdev->total_sta_assoc > 0;
 
 	if (unlikely(dig->bypass_dig)) {
 		dig->bypass_dig = false;
 		return;
 	}
 
 	if (!dig->is_linked_pre && is_linked) {
 		rtw89_debug(rtwdev, RTW89_DBG_DIG, "First connected\n");
 		rtw89_phy_dig_update_para(rtwdev);
 	} else if (dig->is_linked_pre && !is_linked) {
 		rtw89_debug(rtwdev, RTW89_DBG_DIG, "First disconnected\n");
 		rtw89_phy_dig_update_para(rtwdev);
 	}
 	dig->is_linked_pre = is_linked;
 
 	rtw89_phy_dig_igi_offset_by_env(rtwdev);
 	rtw89_phy_dig_update_rssi_info(rtwdev);
 
 	dig->dyn_igi_min = (dig->igi_rssi > IGI_RSSI_MIN) ?
 			    dig->igi_rssi - IGI_RSSI_MIN : 0;
 	dig->dyn_igi_max = dig->dyn_igi_min + IGI_OFFSET_MAX;
 	dig->igi_fa_rssi = dig->dyn_igi_min + dig->fa_rssi_ofst;
 
 	dig->igi_fa_rssi = clamp(dig->igi_fa_rssi, dig->dyn_igi_min,
 				 dig->dyn_igi_max);
 
 	rtw89_debug(rtwdev, RTW89_DBG_DIG,
 		    "rssi=%03d, dyn(max,min)=(%d,%d), final_rssi=%d\n",
 		    dig->igi_rssi, dig->dyn_igi_max, dig->dyn_igi_min,
 		    dig->igi_fa_rssi);
 
 	rtw89_phy_dig_config_igi(rtwdev);
 
 	rtw89_phy_dig_dyn_pd_th(rtwdev, dig->igi_fa_rssi, dig->dyn_pd_th_en);
 
 	if (dig->dyn_pd_th_en && dig->igi_fa_rssi > dig->dyn_pd_th_max)
 		rtw89_phy_dig_sdagc_follow_pagc_config(rtwdev, true);
 	else
 		rtw89_phy_dig_sdagc_follow_pagc_config(rtwdev, false);
 }
 
 static void rtw89_phy_tx_path_div_sta_iter(void *data, struct ieee80211_sta *sta)
 {
 	struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv;
 	struct rtw89_dev *rtwdev = rtwsta->rtwdev;
 	struct rtw89_vif *rtwvif = rtwsta->rtwvif;
 	struct rtw89_hal *hal = &rtwdev->hal;
 	bool *done = data;
 	u8 rssi_a, rssi_b;
 	u32 candidate;
 
 	if (rtwvif->wifi_role != RTW89_WIFI_ROLE_STATION || sta->tdls)
 		return;
 
 	if (*done)
 		return;
 
 	*done = true;
 
 	rssi_a = ewma_rssi_read(&rtwsta->rssi[RF_PATH_A]);
 	rssi_b = ewma_rssi_read(&rtwsta->rssi[RF_PATH_B]);
 
 	if (rssi_a > rssi_b + RTW89_TX_DIV_RSSI_RAW_TH)
 		candidate = RF_A;
 	else if (rssi_b > rssi_a + RTW89_TX_DIV_RSSI_RAW_TH)
 		candidate = RF_B;
 	else
 		return;
 
 	if (hal->antenna_tx == candidate)
 		return;
 
 	hal->antenna_tx = candidate;
 	rtw89_fw_h2c_txpath_cmac_tbl(rtwdev, rtwsta);
 
 	if (hal->antenna_tx == RF_A) {
 		rtw89_phy_write32_mask(rtwdev, R_P0_RFMODE, B_P0_RFMODE_MUX, 0x12);
 		rtw89_phy_write32_mask(rtwdev, R_P1_RFMODE, B_P1_RFMODE_MUX, 0x11);
 	} else if (hal->antenna_tx == RF_B) {
 		rtw89_phy_write32_mask(rtwdev, R_P0_RFMODE, B_P0_RFMODE_MUX, 0x11);
 		rtw89_phy_write32_mask(rtwdev, R_P1_RFMODE, B_P1_RFMODE_MUX, 0x12);
 	}
 }
 
 void rtw89_phy_tx_path_div_track(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_hal *hal = &rtwdev->hal;
 	bool done = false;
 
 	if (!hal->tx_path_diversity)
 		return;
 
 	ieee80211_iterate_stations_atomic(rtwdev->hw,
 					  rtw89_phy_tx_path_div_sta_iter,
 					  &done);
 }
 
 #define ANTDIV_MAIN 0
 #define ANTDIV_AUX 1
 
 static void rtw89_phy_antdiv_set_ant(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_hal *hal = &rtwdev->hal;
 	u8 default_ant, optional_ant;
 
 	if (!hal->ant_diversity || hal->antenna_tx == 0)
 		return;
 
 	if (hal->antenna_tx == RF_B) {
 		default_ant = ANTDIV_AUX;
 		optional_ant = ANTDIV_MAIN;
 	} else {
 		default_ant = ANTDIV_MAIN;
 		optional_ant = ANTDIV_AUX;
 	}
 
 	rtw89_phy_write32_idx(rtwdev, R_P0_ANTSEL, B_P0_ANTSEL_CGCS_CTRL,
 			      default_ant, RTW89_PHY_0);
 	rtw89_phy_write32_idx(rtwdev, R_P0_ANTSEL, B_P0_ANTSEL_RX_ORI,
 			      default_ant, RTW89_PHY_0);
 	rtw89_phy_write32_idx(rtwdev, R_P0_ANTSEL, B_P0_ANTSEL_RX_ALT,
 			      optional_ant, RTW89_PHY_0);
 	rtw89_phy_write32_idx(rtwdev, R_P0_ANTSEL, B_P0_ANTSEL_TX_ORI,
 			      default_ant, RTW89_PHY_0);
 }
 
 static void rtw89_phy_swap_hal_antenna(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_hal *hal = &rtwdev->hal;
 
 	hal->antenna_rx = hal->antenna_rx == RF_A ? RF_B : RF_A;
 	hal->antenna_tx = hal->antenna_rx;
 }
 
 static void rtw89_phy_antdiv_decision_state(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_antdiv_info *antdiv = &rtwdev->antdiv;
 	struct rtw89_hal *hal = &rtwdev->hal;
 	bool no_change = false;
 	u8 main_rssi, aux_rssi;
 	u8 main_evm, aux_evm;
 	u32 candidate;
 
 	antdiv->get_stats = false;
 	antdiv->training_count = 0;
 
 	main_rssi = rtw89_phy_antdiv_sts_instance_get_rssi(&antdiv->main_stats);
 	main_evm = rtw89_phy_antdiv_sts_instance_get_evm(&antdiv->main_stats);
 	aux_rssi = rtw89_phy_antdiv_sts_instance_get_rssi(&antdiv->aux_stats);
 	aux_evm = rtw89_phy_antdiv_sts_instance_get_evm(&antdiv->aux_stats);
 
 	if (main_evm > aux_evm + ANTDIV_EVM_DIFF_TH)
 		candidate = RF_A;
 	else if (aux_evm > main_evm + ANTDIV_EVM_DIFF_TH)
 		candidate = RF_B;
 	else if (main_rssi > aux_rssi + RTW89_TX_DIV_RSSI_RAW_TH)
 		candidate = RF_A;
 	else if (aux_rssi > main_rssi + RTW89_TX_DIV_RSSI_RAW_TH)
 		candidate = RF_B;
 	else
 		no_change = true;
 
 	if (no_change) {
 		/* swap back from training antenna to original */
 		rtw89_phy_swap_hal_antenna(rtwdev);
 		return;
 	}
 
 	hal->antenna_tx = candidate;
 	hal->antenna_rx = candidate;
 }
 
 static void rtw89_phy_antdiv_training_state(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_antdiv_info *antdiv = &rtwdev->antdiv;
 	u64 state_period;
 
 	if (antdiv->training_count % 2 == 0) {
 		if (antdiv->training_count == 0)
 			rtw89_phy_antdiv_sts_reset(rtwdev);
 
 		antdiv->get_stats = true;
 		state_period = msecs_to_jiffies(ANTDIV_TRAINNING_INTVL);
 	} else {
 		antdiv->get_stats = false;
 		state_period = msecs_to_jiffies(ANTDIV_DELAY);
 
 		rtw89_phy_swap_hal_antenna(rtwdev);
 		rtw89_phy_antdiv_set_ant(rtwdev);
 	}
 
 	antdiv->training_count++;
 	ieee80211_queue_delayed_work(rtwdev->hw, &rtwdev->antdiv_work,
 				     state_period);
 }
 
 void rtw89_phy_antdiv_work(struct work_struct *work)
 {
 	struct rtw89_dev *rtwdev = container_of(work, struct rtw89_dev,
 						antdiv_work.work);
 	struct rtw89_antdiv_info *antdiv = &rtwdev->antdiv;
 
 	mutex_lock(&rtwdev->mutex);
 
 	if (antdiv->training_count <= ANTDIV_TRAINNING_CNT) {
 		rtw89_phy_antdiv_training_state(rtwdev);
 	} else {
 		rtw89_phy_antdiv_decision_state(rtwdev);
 		rtw89_phy_antdiv_set_ant(rtwdev);
 	}
 
 	mutex_unlock(&rtwdev->mutex);
 }
 
 void rtw89_phy_antdiv_track(struct rtw89_dev *rtwdev)
 {
 	struct rtw89_antdiv_info *antdiv = &rtwdev->antdiv;
 	struct rtw89_hal *hal = &rtwdev->hal;
 	u8 rssi, rssi_pre;
 
 	if (!hal->ant_diversity || hal->ant_diversity_fixed)
 		return;
 
 	rssi = rtw89_phy_antdiv_sts_instance_get_rssi(&antdiv->target_stats);
 	rssi_pre = antdiv->rssi_pre;
 	antdiv->rssi_pre = rssi;
 	rtw89_phy_antdiv_sts_instance_reset(&antdiv->target_stats);
 
 	if (abs((int)rssi - (int)rssi_pre) < ANTDIV_RSSI_DIFF_TH)
 		return;
 
 	antdiv->training_count = 0;
 	ieee80211_queue_delayed_work(rtwdev->hw, &rtwdev->antdiv_work, 0);
 }
 
 static void rtw89_phy_env_monitor_init(struct rtw89_dev *rtwdev)
 {
 	rtw89_phy_ccx_top_setting_init(rtwdev);
 	rtw89_phy_ifs_clm_setting_init(rtwdev);
 }
 
 void rtw89_phy_dm_init(struct rtw89_dev *rtwdev)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 
 	rtw89_phy_stat_init(rtwdev);
 
 	rtw89_chip_bb_sethw(rtwdev);
 
 	rtw89_phy_env_monitor_init(rtwdev);
 	rtw89_physts_parsing_init(rtwdev);
 	rtw89_phy_dig_init(rtwdev);
 	rtw89_phy_cfo_init(rtwdev);
 	rtw89_phy_ul_tb_info_init(rtwdev);
 	rtw89_phy_antdiv_init(rtwdev);
 	rtw89_chip_rfe_gpio(rtwdev);
 	rtw89_phy_antdiv_set_ant(rtwdev);
 
 	rtw89_phy_init_rf_nctl(rtwdev);
 	rtw89_chip_rfk_init(rtwdev);
 	rtw89_load_txpwr_table(rtwdev, chip->byr_table);
 	rtw89_chip_set_txpwr_ctrl(rtwdev);
 	rtw89_chip_power_trim(rtwdev);
 	rtw89_chip_cfg_txrx_path(rtwdev);
 }
 
 void rtw89_phy_set_bss_color(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	enum rtw89_phy_idx phy_idx = RTW89_PHY_0;
 	u8 bss_color;
 
 	if (!vif->bss_conf.he_support || !vif->cfg.assoc)
 		return;
 
 	bss_color = vif->bss_conf.he_bss_color.color;
 
 	rtw89_phy_write32_idx(rtwdev, chip->bss_clr_map_reg, B_BSS_CLR_MAP_VLD0, 0x1,
 			      phy_idx);
 	rtw89_phy_write32_idx(rtwdev, chip->bss_clr_map_reg, B_BSS_CLR_MAP_TGT,
 			      bss_color, phy_idx);
 	rtw89_phy_write32_idx(rtwdev, chip->bss_clr_map_reg, B_BSS_CLR_MAP_STAID,
 			      vif->cfg.aid, phy_idx);
 }
 
 static void
 _rfk_write_rf(struct rtw89_dev *rtwdev, const struct rtw89_reg5_def *def)
 {
 	rtw89_write_rf(rtwdev, def->path, def->addr, def->mask, def->data);
 }
 
 static void
 _rfk_write32_mask(struct rtw89_dev *rtwdev, const struct rtw89_reg5_def *def)
 {
 	rtw89_phy_write32_mask(rtwdev, def->addr, def->mask, def->data);
 }
 
 static void
 _rfk_write32_set(struct rtw89_dev *rtwdev, const struct rtw89_reg5_def *def)
 {
 	rtw89_phy_write32_set(rtwdev, def->addr, def->mask);
 }
 
 static void
 _rfk_write32_clr(struct rtw89_dev *rtwdev, const struct rtw89_reg5_def *def)
 {
 	rtw89_phy_write32_clr(rtwdev, def->addr, def->mask);
 }
 
 static void
 _rfk_delay(struct rtw89_dev *rtwdev, const struct rtw89_reg5_def *def)
 {
 	udelay(def->data);
 }
 
 static void
 (*_rfk_handler[])(struct rtw89_dev *rtwdev, const struct rtw89_reg5_def *def) = {
 	[RTW89_RFK_F_WRF] = _rfk_write_rf,
 	[RTW89_RFK_F_WM] = _rfk_write32_mask,
 	[RTW89_RFK_F_WS] = _rfk_write32_set,
 	[RTW89_RFK_F_WC] = _rfk_write32_clr,
 	[RTW89_RFK_F_DELAY] = _rfk_delay,
 };
 
 #if defined(__linux__)
 static_assert(ARRAY_SIZE(_rfk_handler) == RTW89_RFK_F_NUM);
 #elif defined(__FreeBSD__)
 rtw89_static_assert(ARRAY_SIZE(_rfk_handler) == RTW89_RFK_F_NUM);
 #endif
 
 void
 rtw89_rfk_parser(struct rtw89_dev *rtwdev, const struct rtw89_rfk_tbl *tbl)
 {
 	const struct rtw89_reg5_def *p = tbl->defs;
 	const struct rtw89_reg5_def *end = tbl->defs + tbl->size;
 
 	for (; p < end; p++)
 		_rfk_handler[p->flag](rtwdev, p);
 }
 EXPORT_SYMBOL(rtw89_rfk_parser);
 
 #define RTW89_TSSI_FAST_MODE_NUM 4
 
 static const struct rtw89_reg_def rtw89_tssi_fastmode_regs_flat[RTW89_TSSI_FAST_MODE_NUM] = {
 	{0xD934, 0xff0000},
 	{0xD934, 0xff000000},
 	{0xD938, 0xff},
 	{0xD934, 0xff00},
 };
 
 static const struct rtw89_reg_def rtw89_tssi_fastmode_regs_level[RTW89_TSSI_FAST_MODE_NUM] = {
 	{0xD930, 0xff0000},
 	{0xD930, 0xff000000},
 	{0xD934, 0xff},
 	{0xD930, 0xff00},
 };
 
 static
 void rtw89_phy_tssi_ctrl_set_fast_mode_cfg(struct rtw89_dev *rtwdev,
 					   enum rtw89_mac_idx mac_idx,
 					   enum rtw89_tssi_bandedge_cfg bandedge_cfg,
 					   u32 val)
 {
 	const struct rtw89_reg_def *regs;
 	u32 reg;
 	int i;
 
 	if (bandedge_cfg == RTW89_TSSI_BANDEDGE_FLAT)
 		regs = rtw89_tssi_fastmode_regs_flat;
 	else
 		regs = rtw89_tssi_fastmode_regs_level;
 
 	for (i = 0; i < RTW89_TSSI_FAST_MODE_NUM; i++) {
 		reg = rtw89_mac_reg_by_idx(regs[i].addr, mac_idx);
 		rtw89_write32_mask(rtwdev, reg, regs[i].mask, val);
 	}
 }
 
 static const struct rtw89_reg_def rtw89_tssi_bandedge_regs_flat[RTW89_TSSI_SBW_NUM] = {
 	{0xD91C, 0xff000000},
 	{0xD920, 0xff},
 	{0xD920, 0xff00},
 	{0xD920, 0xff0000},
 	{0xD920, 0xff000000},
 	{0xD924, 0xff},
 	{0xD924, 0xff00},
 	{0xD914, 0xff000000},
 	{0xD918, 0xff},
 	{0xD918, 0xff00},
 	{0xD918, 0xff0000},
 	{0xD918, 0xff000000},
 	{0xD91C, 0xff},
 	{0xD91C, 0xff00},
 	{0xD91C, 0xff0000},
 };
 
 static const struct rtw89_reg_def rtw89_tssi_bandedge_regs_level[RTW89_TSSI_SBW_NUM] = {
 	{0xD910, 0xff},
 	{0xD910, 0xff00},
 	{0xD910, 0xff0000},
 	{0xD910, 0xff000000},
 	{0xD914, 0xff},
 	{0xD914, 0xff00},
 	{0xD914, 0xff0000},
 	{0xD908, 0xff},
 	{0xD908, 0xff00},
 	{0xD908, 0xff0000},
 	{0xD908, 0xff000000},
 	{0xD90C, 0xff},
 	{0xD90C, 0xff00},
 	{0xD90C, 0xff0000},
 	{0xD90C, 0xff000000},
 };
 
 void rtw89_phy_tssi_ctrl_set_bandedge_cfg(struct rtw89_dev *rtwdev,
 					  enum rtw89_mac_idx mac_idx,
 					  enum rtw89_tssi_bandedge_cfg bandedge_cfg)
 {
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	const struct rtw89_reg_def *regs;
 	const u32 *data;
 	u32 reg;
 	int i;
 
 	if (bandedge_cfg >= RTW89_TSSI_CFG_NUM)
 		return;
 
 	if (bandedge_cfg == RTW89_TSSI_BANDEDGE_FLAT)
 		regs = rtw89_tssi_bandedge_regs_flat;
 	else
 		regs = rtw89_tssi_bandedge_regs_level;
 
 	data = chip->tssi_dbw_table->data[bandedge_cfg];
 
 	for (i = 0; i < RTW89_TSSI_SBW_NUM; i++) {
 		reg = rtw89_mac_reg_by_idx(regs[i].addr, mac_idx);
 		rtw89_write32_mask(rtwdev, reg, regs[i].mask, data[i]);
 	}
 
 	reg = rtw89_mac_reg_by_idx(R_AX_BANDEDGE_CFG, mac_idx);
 	rtw89_write32_mask(rtwdev, reg, B_AX_BANDEDGE_CFG_IDX_MASK, bandedge_cfg);
 
 	rtw89_phy_tssi_ctrl_set_fast_mode_cfg(rtwdev, mac_idx, bandedge_cfg,
 					      data[RTW89_TSSI_SBW20]);
 }
 EXPORT_SYMBOL(rtw89_phy_tssi_ctrl_set_bandedge_cfg);
 
 static
 const u8 rtw89_ch_base_table[16] = {1, 0xff,
 				    36, 100, 132, 149, 0xff,
 				    1, 33, 65, 97, 129, 161, 193, 225, 0xff};
 #define RTW89_CH_BASE_IDX_2G		0
 #define RTW89_CH_BASE_IDX_5G_FIRST	2
 #define RTW89_CH_BASE_IDX_5G_LAST	5
 #define RTW89_CH_BASE_IDX_6G_FIRST	7
 #define RTW89_CH_BASE_IDX_6G_LAST	14
 
 #define RTW89_CH_BASE_IDX_MASK		GENMASK(7, 4)
 #define RTW89_CH_OFFSET_MASK		GENMASK(3, 0)
 
 u8 rtw89_encode_chan_idx(struct rtw89_dev *rtwdev, u8 central_ch, u8 band)
 {
 	u8 chan_idx;
 	u8 last, first;
 	u8 idx;
 
 	switch (band) {
 	case RTW89_BAND_2G:
 		chan_idx = FIELD_PREP(RTW89_CH_BASE_IDX_MASK, RTW89_CH_BASE_IDX_2G) |
 			   FIELD_PREP(RTW89_CH_OFFSET_MASK, central_ch);
 		return chan_idx;
 	case RTW89_BAND_5G:
 		first = RTW89_CH_BASE_IDX_5G_FIRST;
 		last = RTW89_CH_BASE_IDX_5G_LAST;
 		break;
 	case RTW89_BAND_6G:
 		first = RTW89_CH_BASE_IDX_6G_FIRST;
 		last = RTW89_CH_BASE_IDX_6G_LAST;
 		break;
 	default:
 		rtw89_warn(rtwdev, "Unsupported band %d\n", band);
 		return 0;
 	}
 
 	for (idx = last; idx >= first; idx--)
 		if (central_ch >= rtw89_ch_base_table[idx])
 			break;
 
 	if (idx < first) {
 		rtw89_warn(rtwdev, "Unknown band %d channel %d\n", band, central_ch);
 		return 0;
 	}
 
 	chan_idx = FIELD_PREP(RTW89_CH_BASE_IDX_MASK, idx) |
 		   FIELD_PREP(RTW89_CH_OFFSET_MASK,
 			      (central_ch - rtw89_ch_base_table[idx]) >> 1);
 	return chan_idx;
 }
 EXPORT_SYMBOL(rtw89_encode_chan_idx);
 
 void rtw89_decode_chan_idx(struct rtw89_dev *rtwdev, u8 chan_idx,
 			   u8 *ch, enum nl80211_band *band)
 {
 	u8 idx, offset;
 
 	idx = FIELD_GET(RTW89_CH_BASE_IDX_MASK, chan_idx);
 	offset = FIELD_GET(RTW89_CH_OFFSET_MASK, chan_idx);
 
 	if (idx == RTW89_CH_BASE_IDX_2G) {
 		*band = NL80211_BAND_2GHZ;
 		*ch = offset;
 		return;
 	}
 
 	*band = idx <= RTW89_CH_BASE_IDX_5G_LAST ? NL80211_BAND_5GHZ : NL80211_BAND_6GHZ;
 	*ch = rtw89_ch_base_table[idx] + (offset << 1);
 }
 EXPORT_SYMBOL(rtw89_decode_chan_idx);
 
 #define EDCCA_DEFAULT 249
 void rtw89_phy_config_edcca(struct rtw89_dev *rtwdev, bool scan)
 {
 	u32 reg = rtwdev->chip->edcca_lvl_reg;
 	struct rtw89_hal *hal = &rtwdev->hal;
 	u32 val;
 
 	if (scan) {
 		hal->edcca_bak = rtw89_phy_read32(rtwdev, reg);
 		val = hal->edcca_bak;
 		u32p_replace_bits(&val, EDCCA_DEFAULT, B_SEG0R_EDCCA_LVL_A_MSK);
 		u32p_replace_bits(&val, EDCCA_DEFAULT, B_SEG0R_EDCCA_LVL_P_MSK);
 		u32p_replace_bits(&val, EDCCA_DEFAULT, B_SEG0R_PPDU_LVL_MSK);
 		rtw89_phy_write32(rtwdev, reg, val);
 	} else {
 		rtw89_phy_write32(rtwdev, reg, hal->edcca_bak);
 	}
 }