xref: /openbmc/linux/drivers/net/wireless/ath/ath10k/mac.c (revision a06c488d)
1 /*
2  * Copyright (c) 2005-2011 Atheros Communications Inc.
3  * Copyright (c) 2011-2013 Qualcomm Atheros, Inc.
4  *
5  * Permission to use, copy, modify, and/or distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include "mac.h"
19 
20 #include <net/mac80211.h>
21 #include <linux/etherdevice.h>
22 
23 #include "hif.h"
24 #include "core.h"
25 #include "debug.h"
26 #include "wmi.h"
27 #include "htt.h"
28 #include "txrx.h"
29 #include "testmode.h"
30 #include "wmi.h"
31 #include "wmi-tlv.h"
32 #include "wmi-ops.h"
33 #include "wow.h"
34 
35 /*********/
36 /* Rates */
37 /*********/
38 
39 static struct ieee80211_rate ath10k_rates[] = {
40 	{ .bitrate = 10,
41 	  .hw_value = ATH10K_HW_RATE_CCK_LP_1M },
42 	{ .bitrate = 20,
43 	  .hw_value = ATH10K_HW_RATE_CCK_LP_2M,
44 	  .hw_value_short = ATH10K_HW_RATE_CCK_SP_2M,
45 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE },
46 	{ .bitrate = 55,
47 	  .hw_value = ATH10K_HW_RATE_CCK_LP_5_5M,
48 	  .hw_value_short = ATH10K_HW_RATE_CCK_SP_5_5M,
49 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE },
50 	{ .bitrate = 110,
51 	  .hw_value = ATH10K_HW_RATE_CCK_LP_11M,
52 	  .hw_value_short = ATH10K_HW_RATE_CCK_SP_11M,
53 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE },
54 
55 	{ .bitrate = 60, .hw_value = ATH10K_HW_RATE_OFDM_6M },
56 	{ .bitrate = 90, .hw_value = ATH10K_HW_RATE_OFDM_9M },
57 	{ .bitrate = 120, .hw_value = ATH10K_HW_RATE_OFDM_12M },
58 	{ .bitrate = 180, .hw_value = ATH10K_HW_RATE_OFDM_18M },
59 	{ .bitrate = 240, .hw_value = ATH10K_HW_RATE_OFDM_24M },
60 	{ .bitrate = 360, .hw_value = ATH10K_HW_RATE_OFDM_36M },
61 	{ .bitrate = 480, .hw_value = ATH10K_HW_RATE_OFDM_48M },
62 	{ .bitrate = 540, .hw_value = ATH10K_HW_RATE_OFDM_54M },
63 };
64 
65 #define ATH10K_MAC_FIRST_OFDM_RATE_IDX 4
66 
67 #define ath10k_a_rates (ath10k_rates + ATH10K_MAC_FIRST_OFDM_RATE_IDX)
68 #define ath10k_a_rates_size (ARRAY_SIZE(ath10k_rates) - \
69 			     ATH10K_MAC_FIRST_OFDM_RATE_IDX)
70 #define ath10k_g_rates (ath10k_rates + 0)
71 #define ath10k_g_rates_size (ARRAY_SIZE(ath10k_rates))
72 
73 static bool ath10k_mac_bitrate_is_cck(int bitrate)
74 {
75 	switch (bitrate) {
76 	case 10:
77 	case 20:
78 	case 55:
79 	case 110:
80 		return true;
81 	}
82 
83 	return false;
84 }
85 
86 static u8 ath10k_mac_bitrate_to_rate(int bitrate)
87 {
88 	return DIV_ROUND_UP(bitrate, 5) |
89 	       (ath10k_mac_bitrate_is_cck(bitrate) ? BIT(7) : 0);
90 }
91 
92 u8 ath10k_mac_hw_rate_to_idx(const struct ieee80211_supported_band *sband,
93 			     u8 hw_rate, bool cck)
94 {
95 	const struct ieee80211_rate *rate;
96 	int i;
97 
98 	for (i = 0; i < sband->n_bitrates; i++) {
99 		rate = &sband->bitrates[i];
100 
101 		if (ath10k_mac_bitrate_is_cck(rate->bitrate) != cck)
102 			continue;
103 
104 		if (rate->hw_value == hw_rate)
105 			return i;
106 		else if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE &&
107 			 rate->hw_value_short == hw_rate)
108 			return i;
109 	}
110 
111 	return 0;
112 }
113 
114 u8 ath10k_mac_bitrate_to_idx(const struct ieee80211_supported_band *sband,
115 			     u32 bitrate)
116 {
117 	int i;
118 
119 	for (i = 0; i < sband->n_bitrates; i++)
120 		if (sband->bitrates[i].bitrate == bitrate)
121 			return i;
122 
123 	return 0;
124 }
125 
126 static int ath10k_mac_get_max_vht_mcs_map(u16 mcs_map, int nss)
127 {
128 	switch ((mcs_map >> (2 * nss)) & 0x3) {
129 	case IEEE80211_VHT_MCS_SUPPORT_0_7: return BIT(8) - 1;
130 	case IEEE80211_VHT_MCS_SUPPORT_0_8: return BIT(9) - 1;
131 	case IEEE80211_VHT_MCS_SUPPORT_0_9: return BIT(10) - 1;
132 	}
133 	return 0;
134 }
135 
136 static u32
137 ath10k_mac_max_ht_nss(const u8 ht_mcs_mask[IEEE80211_HT_MCS_MASK_LEN])
138 {
139 	int nss;
140 
141 	for (nss = IEEE80211_HT_MCS_MASK_LEN - 1; nss >= 0; nss--)
142 		if (ht_mcs_mask[nss])
143 			return nss + 1;
144 
145 	return 1;
146 }
147 
148 static u32
149 ath10k_mac_max_vht_nss(const u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
150 {
151 	int nss;
152 
153 	for (nss = NL80211_VHT_NSS_MAX - 1; nss >= 0; nss--)
154 		if (vht_mcs_mask[nss])
155 			return nss + 1;
156 
157 	return 1;
158 }
159 
160 /**********/
161 /* Crypto */
162 /**********/
163 
164 static int ath10k_send_key(struct ath10k_vif *arvif,
165 			   struct ieee80211_key_conf *key,
166 			   enum set_key_cmd cmd,
167 			   const u8 *macaddr, u32 flags)
168 {
169 	struct ath10k *ar = arvif->ar;
170 	struct wmi_vdev_install_key_arg arg = {
171 		.vdev_id = arvif->vdev_id,
172 		.key_idx = key->keyidx,
173 		.key_len = key->keylen,
174 		.key_data = key->key,
175 		.key_flags = flags,
176 		.macaddr = macaddr,
177 	};
178 
179 	lockdep_assert_held(&arvif->ar->conf_mutex);
180 
181 	switch (key->cipher) {
182 	case WLAN_CIPHER_SUITE_CCMP:
183 		arg.key_cipher = WMI_CIPHER_AES_CCM;
184 		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV_MGMT;
185 		break;
186 	case WLAN_CIPHER_SUITE_TKIP:
187 		arg.key_cipher = WMI_CIPHER_TKIP;
188 		arg.key_txmic_len = 8;
189 		arg.key_rxmic_len = 8;
190 		break;
191 	case WLAN_CIPHER_SUITE_WEP40:
192 	case WLAN_CIPHER_SUITE_WEP104:
193 		arg.key_cipher = WMI_CIPHER_WEP;
194 		break;
195 	case WLAN_CIPHER_SUITE_AES_CMAC:
196 		WARN_ON(1);
197 		return -EINVAL;
198 	default:
199 		ath10k_warn(ar, "cipher %d is not supported\n", key->cipher);
200 		return -EOPNOTSUPP;
201 	}
202 
203 	if (test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags))
204 		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
205 
206 	if (cmd == DISABLE_KEY) {
207 		arg.key_cipher = WMI_CIPHER_NONE;
208 		arg.key_data = NULL;
209 	}
210 
211 	return ath10k_wmi_vdev_install_key(arvif->ar, &arg);
212 }
213 
214 static int ath10k_install_key(struct ath10k_vif *arvif,
215 			      struct ieee80211_key_conf *key,
216 			      enum set_key_cmd cmd,
217 			      const u8 *macaddr, u32 flags)
218 {
219 	struct ath10k *ar = arvif->ar;
220 	int ret;
221 	unsigned long time_left;
222 
223 	lockdep_assert_held(&ar->conf_mutex);
224 
225 	reinit_completion(&ar->install_key_done);
226 
227 	if (arvif->nohwcrypt)
228 		return 1;
229 
230 	ret = ath10k_send_key(arvif, key, cmd, macaddr, flags);
231 	if (ret)
232 		return ret;
233 
234 	time_left = wait_for_completion_timeout(&ar->install_key_done, 3 * HZ);
235 	if (time_left == 0)
236 		return -ETIMEDOUT;
237 
238 	return 0;
239 }
240 
241 static int ath10k_install_peer_wep_keys(struct ath10k_vif *arvif,
242 					const u8 *addr)
243 {
244 	struct ath10k *ar = arvif->ar;
245 	struct ath10k_peer *peer;
246 	int ret;
247 	int i;
248 	u32 flags;
249 
250 	lockdep_assert_held(&ar->conf_mutex);
251 
252 	if (WARN_ON(arvif->vif->type != NL80211_IFTYPE_AP &&
253 		    arvif->vif->type != NL80211_IFTYPE_ADHOC &&
254 		    arvif->vif->type != NL80211_IFTYPE_MESH_POINT))
255 		return -EINVAL;
256 
257 	spin_lock_bh(&ar->data_lock);
258 	peer = ath10k_peer_find(ar, arvif->vdev_id, addr);
259 	spin_unlock_bh(&ar->data_lock);
260 
261 	if (!peer)
262 		return -ENOENT;
263 
264 	for (i = 0; i < ARRAY_SIZE(arvif->wep_keys); i++) {
265 		if (arvif->wep_keys[i] == NULL)
266 			continue;
267 
268 		switch (arvif->vif->type) {
269 		case NL80211_IFTYPE_AP:
270 			flags = WMI_KEY_PAIRWISE;
271 
272 			if (arvif->def_wep_key_idx == i)
273 				flags |= WMI_KEY_TX_USAGE;
274 
275 			ret = ath10k_install_key(arvif, arvif->wep_keys[i],
276 						 SET_KEY, addr, flags);
277 			if (ret < 0)
278 				return ret;
279 			break;
280 		case NL80211_IFTYPE_ADHOC:
281 			ret = ath10k_install_key(arvif, arvif->wep_keys[i],
282 						 SET_KEY, addr,
283 						 WMI_KEY_PAIRWISE);
284 			if (ret < 0)
285 				return ret;
286 
287 			ret = ath10k_install_key(arvif, arvif->wep_keys[i],
288 						 SET_KEY, addr, WMI_KEY_GROUP);
289 			if (ret < 0)
290 				return ret;
291 			break;
292 		default:
293 			WARN_ON(1);
294 			return -EINVAL;
295 		}
296 
297 		spin_lock_bh(&ar->data_lock);
298 		peer->keys[i] = arvif->wep_keys[i];
299 		spin_unlock_bh(&ar->data_lock);
300 	}
301 
302 	/* In some cases (notably with static WEP IBSS with multiple keys)
303 	 * multicast Tx becomes broken. Both pairwise and groupwise keys are
304 	 * installed already. Using WMI_KEY_TX_USAGE in different combinations
305 	 * didn't seem help. Using def_keyid vdev parameter seems to be
306 	 * effective so use that.
307 	 *
308 	 * FIXME: Revisit. Perhaps this can be done in a less hacky way.
309 	 */
310 	if (arvif->vif->type != NL80211_IFTYPE_ADHOC)
311 		return 0;
312 
313 	if (arvif->def_wep_key_idx == -1)
314 		return 0;
315 
316 	ret = ath10k_wmi_vdev_set_param(arvif->ar,
317 					arvif->vdev_id,
318 					arvif->ar->wmi.vdev_param->def_keyid,
319 					arvif->def_wep_key_idx);
320 	if (ret) {
321 		ath10k_warn(ar, "failed to re-set def wpa key idxon vdev %i: %d\n",
322 			    arvif->vdev_id, ret);
323 		return ret;
324 	}
325 
326 	return 0;
327 }
328 
329 static int ath10k_clear_peer_keys(struct ath10k_vif *arvif,
330 				  const u8 *addr)
331 {
332 	struct ath10k *ar = arvif->ar;
333 	struct ath10k_peer *peer;
334 	int first_errno = 0;
335 	int ret;
336 	int i;
337 	u32 flags = 0;
338 
339 	lockdep_assert_held(&ar->conf_mutex);
340 
341 	spin_lock_bh(&ar->data_lock);
342 	peer = ath10k_peer_find(ar, arvif->vdev_id, addr);
343 	spin_unlock_bh(&ar->data_lock);
344 
345 	if (!peer)
346 		return -ENOENT;
347 
348 	for (i = 0; i < ARRAY_SIZE(peer->keys); i++) {
349 		if (peer->keys[i] == NULL)
350 			continue;
351 
352 		/* key flags are not required to delete the key */
353 		ret = ath10k_install_key(arvif, peer->keys[i],
354 					 DISABLE_KEY, addr, flags);
355 		if (ret < 0 && first_errno == 0)
356 			first_errno = ret;
357 
358 		if (ret < 0)
359 			ath10k_warn(ar, "failed to remove peer wep key %d: %d\n",
360 				    i, ret);
361 
362 		spin_lock_bh(&ar->data_lock);
363 		peer->keys[i] = NULL;
364 		spin_unlock_bh(&ar->data_lock);
365 	}
366 
367 	return first_errno;
368 }
369 
370 bool ath10k_mac_is_peer_wep_key_set(struct ath10k *ar, const u8 *addr,
371 				    u8 keyidx)
372 {
373 	struct ath10k_peer *peer;
374 	int i;
375 
376 	lockdep_assert_held(&ar->data_lock);
377 
378 	/* We don't know which vdev this peer belongs to,
379 	 * since WMI doesn't give us that information.
380 	 *
381 	 * FIXME: multi-bss needs to be handled.
382 	 */
383 	peer = ath10k_peer_find(ar, 0, addr);
384 	if (!peer)
385 		return false;
386 
387 	for (i = 0; i < ARRAY_SIZE(peer->keys); i++) {
388 		if (peer->keys[i] && peer->keys[i]->keyidx == keyidx)
389 			return true;
390 	}
391 
392 	return false;
393 }
394 
395 static int ath10k_clear_vdev_key(struct ath10k_vif *arvif,
396 				 struct ieee80211_key_conf *key)
397 {
398 	struct ath10k *ar = arvif->ar;
399 	struct ath10k_peer *peer;
400 	u8 addr[ETH_ALEN];
401 	int first_errno = 0;
402 	int ret;
403 	int i;
404 	u32 flags = 0;
405 
406 	lockdep_assert_held(&ar->conf_mutex);
407 
408 	for (;;) {
409 		/* since ath10k_install_key we can't hold data_lock all the
410 		 * time, so we try to remove the keys incrementally */
411 		spin_lock_bh(&ar->data_lock);
412 		i = 0;
413 		list_for_each_entry(peer, &ar->peers, list) {
414 			for (i = 0; i < ARRAY_SIZE(peer->keys); i++) {
415 				if (peer->keys[i] == key) {
416 					ether_addr_copy(addr, peer->addr);
417 					peer->keys[i] = NULL;
418 					break;
419 				}
420 			}
421 
422 			if (i < ARRAY_SIZE(peer->keys))
423 				break;
424 		}
425 		spin_unlock_bh(&ar->data_lock);
426 
427 		if (i == ARRAY_SIZE(peer->keys))
428 			break;
429 		/* key flags are not required to delete the key */
430 		ret = ath10k_install_key(arvif, key, DISABLE_KEY, addr, flags);
431 		if (ret < 0 && first_errno == 0)
432 			first_errno = ret;
433 
434 		if (ret)
435 			ath10k_warn(ar, "failed to remove key for %pM: %d\n",
436 				    addr, ret);
437 	}
438 
439 	return first_errno;
440 }
441 
442 static int ath10k_mac_vif_update_wep_key(struct ath10k_vif *arvif,
443 					 struct ieee80211_key_conf *key)
444 {
445 	struct ath10k *ar = arvif->ar;
446 	struct ath10k_peer *peer;
447 	int ret;
448 
449 	lockdep_assert_held(&ar->conf_mutex);
450 
451 	list_for_each_entry(peer, &ar->peers, list) {
452 		if (!memcmp(peer->addr, arvif->vif->addr, ETH_ALEN))
453 			continue;
454 
455 		if (!memcmp(peer->addr, arvif->bssid, ETH_ALEN))
456 			continue;
457 
458 		if (peer->keys[key->keyidx] == key)
459 			continue;
460 
461 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vif vdev %i update key %i needs update\n",
462 			   arvif->vdev_id, key->keyidx);
463 
464 		ret = ath10k_install_peer_wep_keys(arvif, peer->addr);
465 		if (ret) {
466 			ath10k_warn(ar, "failed to update wep keys on vdev %i for peer %pM: %d\n",
467 				    arvif->vdev_id, peer->addr, ret);
468 			return ret;
469 		}
470 	}
471 
472 	return 0;
473 }
474 
475 /*********************/
476 /* General utilities */
477 /*********************/
478 
479 static inline enum wmi_phy_mode
480 chan_to_phymode(const struct cfg80211_chan_def *chandef)
481 {
482 	enum wmi_phy_mode phymode = MODE_UNKNOWN;
483 
484 	switch (chandef->chan->band) {
485 	case IEEE80211_BAND_2GHZ:
486 		switch (chandef->width) {
487 		case NL80211_CHAN_WIDTH_20_NOHT:
488 			if (chandef->chan->flags & IEEE80211_CHAN_NO_OFDM)
489 				phymode = MODE_11B;
490 			else
491 				phymode = MODE_11G;
492 			break;
493 		case NL80211_CHAN_WIDTH_20:
494 			phymode = MODE_11NG_HT20;
495 			break;
496 		case NL80211_CHAN_WIDTH_40:
497 			phymode = MODE_11NG_HT40;
498 			break;
499 		case NL80211_CHAN_WIDTH_5:
500 		case NL80211_CHAN_WIDTH_10:
501 		case NL80211_CHAN_WIDTH_80:
502 		case NL80211_CHAN_WIDTH_80P80:
503 		case NL80211_CHAN_WIDTH_160:
504 			phymode = MODE_UNKNOWN;
505 			break;
506 		}
507 		break;
508 	case IEEE80211_BAND_5GHZ:
509 		switch (chandef->width) {
510 		case NL80211_CHAN_WIDTH_20_NOHT:
511 			phymode = MODE_11A;
512 			break;
513 		case NL80211_CHAN_WIDTH_20:
514 			phymode = MODE_11NA_HT20;
515 			break;
516 		case NL80211_CHAN_WIDTH_40:
517 			phymode = MODE_11NA_HT40;
518 			break;
519 		case NL80211_CHAN_WIDTH_80:
520 			phymode = MODE_11AC_VHT80;
521 			break;
522 		case NL80211_CHAN_WIDTH_5:
523 		case NL80211_CHAN_WIDTH_10:
524 		case NL80211_CHAN_WIDTH_80P80:
525 		case NL80211_CHAN_WIDTH_160:
526 			phymode = MODE_UNKNOWN;
527 			break;
528 		}
529 		break;
530 	default:
531 		break;
532 	}
533 
534 	WARN_ON(phymode == MODE_UNKNOWN);
535 	return phymode;
536 }
537 
538 static u8 ath10k_parse_mpdudensity(u8 mpdudensity)
539 {
540 /*
541  * 802.11n D2.0 defined values for "Minimum MPDU Start Spacing":
542  *   0 for no restriction
543  *   1 for 1/4 us
544  *   2 for 1/2 us
545  *   3 for 1 us
546  *   4 for 2 us
547  *   5 for 4 us
548  *   6 for 8 us
549  *   7 for 16 us
550  */
551 	switch (mpdudensity) {
552 	case 0:
553 		return 0;
554 	case 1:
555 	case 2:
556 	case 3:
557 	/* Our lower layer calculations limit our precision to
558 	   1 microsecond */
559 		return 1;
560 	case 4:
561 		return 2;
562 	case 5:
563 		return 4;
564 	case 6:
565 		return 8;
566 	case 7:
567 		return 16;
568 	default:
569 		return 0;
570 	}
571 }
572 
573 int ath10k_mac_vif_chan(struct ieee80211_vif *vif,
574 			struct cfg80211_chan_def *def)
575 {
576 	struct ieee80211_chanctx_conf *conf;
577 
578 	rcu_read_lock();
579 	conf = rcu_dereference(vif->chanctx_conf);
580 	if (!conf) {
581 		rcu_read_unlock();
582 		return -ENOENT;
583 	}
584 
585 	*def = conf->def;
586 	rcu_read_unlock();
587 
588 	return 0;
589 }
590 
591 static void ath10k_mac_num_chanctxs_iter(struct ieee80211_hw *hw,
592 					 struct ieee80211_chanctx_conf *conf,
593 					 void *data)
594 {
595 	int *num = data;
596 
597 	(*num)++;
598 }
599 
600 static int ath10k_mac_num_chanctxs(struct ath10k *ar)
601 {
602 	int num = 0;
603 
604 	ieee80211_iter_chan_contexts_atomic(ar->hw,
605 					    ath10k_mac_num_chanctxs_iter,
606 					    &num);
607 
608 	return num;
609 }
610 
611 static void
612 ath10k_mac_get_any_chandef_iter(struct ieee80211_hw *hw,
613 				struct ieee80211_chanctx_conf *conf,
614 				void *data)
615 {
616 	struct cfg80211_chan_def **def = data;
617 
618 	*def = &conf->def;
619 }
620 
621 static int ath10k_peer_create(struct ath10k *ar, u32 vdev_id, const u8 *addr,
622 			      enum wmi_peer_type peer_type)
623 {
624 	struct ath10k_vif *arvif;
625 	int num_peers = 0;
626 	int ret;
627 
628 	lockdep_assert_held(&ar->conf_mutex);
629 
630 	num_peers = ar->num_peers;
631 
632 	/* Each vdev consumes a peer entry as well */
633 	list_for_each_entry(arvif, &ar->arvifs, list)
634 		num_peers++;
635 
636 	if (num_peers >= ar->max_num_peers)
637 		return -ENOBUFS;
638 
639 	ret = ath10k_wmi_peer_create(ar, vdev_id, addr, peer_type);
640 	if (ret) {
641 		ath10k_warn(ar, "failed to create wmi peer %pM on vdev %i: %i\n",
642 			    addr, vdev_id, ret);
643 		return ret;
644 	}
645 
646 	ret = ath10k_wait_for_peer_created(ar, vdev_id, addr);
647 	if (ret) {
648 		ath10k_warn(ar, "failed to wait for created wmi peer %pM on vdev %i: %i\n",
649 			    addr, vdev_id, ret);
650 		return ret;
651 	}
652 
653 	ar->num_peers++;
654 
655 	return 0;
656 }
657 
658 static int ath10k_mac_set_kickout(struct ath10k_vif *arvif)
659 {
660 	struct ath10k *ar = arvif->ar;
661 	u32 param;
662 	int ret;
663 
664 	param = ar->wmi.pdev_param->sta_kickout_th;
665 	ret = ath10k_wmi_pdev_set_param(ar, param,
666 					ATH10K_KICKOUT_THRESHOLD);
667 	if (ret) {
668 		ath10k_warn(ar, "failed to set kickout threshold on vdev %i: %d\n",
669 			    arvif->vdev_id, ret);
670 		return ret;
671 	}
672 
673 	param = ar->wmi.vdev_param->ap_keepalive_min_idle_inactive_time_secs;
674 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, param,
675 					ATH10K_KEEPALIVE_MIN_IDLE);
676 	if (ret) {
677 		ath10k_warn(ar, "failed to set keepalive minimum idle time on vdev %i: %d\n",
678 			    arvif->vdev_id, ret);
679 		return ret;
680 	}
681 
682 	param = ar->wmi.vdev_param->ap_keepalive_max_idle_inactive_time_secs;
683 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, param,
684 					ATH10K_KEEPALIVE_MAX_IDLE);
685 	if (ret) {
686 		ath10k_warn(ar, "failed to set keepalive maximum idle time on vdev %i: %d\n",
687 			    arvif->vdev_id, ret);
688 		return ret;
689 	}
690 
691 	param = ar->wmi.vdev_param->ap_keepalive_max_unresponsive_time_secs;
692 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, param,
693 					ATH10K_KEEPALIVE_MAX_UNRESPONSIVE);
694 	if (ret) {
695 		ath10k_warn(ar, "failed to set keepalive maximum unresponsive time on vdev %i: %d\n",
696 			    arvif->vdev_id, ret);
697 		return ret;
698 	}
699 
700 	return 0;
701 }
702 
703 static int ath10k_mac_set_rts(struct ath10k_vif *arvif, u32 value)
704 {
705 	struct ath10k *ar = arvif->ar;
706 	u32 vdev_param;
707 
708 	vdev_param = ar->wmi.vdev_param->rts_threshold;
709 	return ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param, value);
710 }
711 
712 static int ath10k_peer_delete(struct ath10k *ar, u32 vdev_id, const u8 *addr)
713 {
714 	int ret;
715 
716 	lockdep_assert_held(&ar->conf_mutex);
717 
718 	ret = ath10k_wmi_peer_delete(ar, vdev_id, addr);
719 	if (ret)
720 		return ret;
721 
722 	ret = ath10k_wait_for_peer_deleted(ar, vdev_id, addr);
723 	if (ret)
724 		return ret;
725 
726 	ar->num_peers--;
727 
728 	return 0;
729 }
730 
731 static void ath10k_peer_cleanup(struct ath10k *ar, u32 vdev_id)
732 {
733 	struct ath10k_peer *peer, *tmp;
734 
735 	lockdep_assert_held(&ar->conf_mutex);
736 
737 	spin_lock_bh(&ar->data_lock);
738 	list_for_each_entry_safe(peer, tmp, &ar->peers, list) {
739 		if (peer->vdev_id != vdev_id)
740 			continue;
741 
742 		ath10k_warn(ar, "removing stale peer %pM from vdev_id %d\n",
743 			    peer->addr, vdev_id);
744 
745 		list_del(&peer->list);
746 		kfree(peer);
747 		ar->num_peers--;
748 	}
749 	spin_unlock_bh(&ar->data_lock);
750 }
751 
752 static void ath10k_peer_cleanup_all(struct ath10k *ar)
753 {
754 	struct ath10k_peer *peer, *tmp;
755 
756 	lockdep_assert_held(&ar->conf_mutex);
757 
758 	spin_lock_bh(&ar->data_lock);
759 	list_for_each_entry_safe(peer, tmp, &ar->peers, list) {
760 		list_del(&peer->list);
761 		kfree(peer);
762 	}
763 	spin_unlock_bh(&ar->data_lock);
764 
765 	ar->num_peers = 0;
766 	ar->num_stations = 0;
767 }
768 
769 static int ath10k_mac_tdls_peer_update(struct ath10k *ar, u32 vdev_id,
770 				       struct ieee80211_sta *sta,
771 				       enum wmi_tdls_peer_state state)
772 {
773 	int ret;
774 	struct wmi_tdls_peer_update_cmd_arg arg = {};
775 	struct wmi_tdls_peer_capab_arg cap = {};
776 	struct wmi_channel_arg chan_arg = {};
777 
778 	lockdep_assert_held(&ar->conf_mutex);
779 
780 	arg.vdev_id = vdev_id;
781 	arg.peer_state = state;
782 	ether_addr_copy(arg.addr, sta->addr);
783 
784 	cap.peer_max_sp = sta->max_sp;
785 	cap.peer_uapsd_queues = sta->uapsd_queues;
786 
787 	if (state == WMI_TDLS_PEER_STATE_CONNECTED &&
788 	    !sta->tdls_initiator)
789 		cap.is_peer_responder = 1;
790 
791 	ret = ath10k_wmi_tdls_peer_update(ar, &arg, &cap, &chan_arg);
792 	if (ret) {
793 		ath10k_warn(ar, "failed to update tdls peer %pM on vdev %i: %i\n",
794 			    arg.addr, vdev_id, ret);
795 		return ret;
796 	}
797 
798 	return 0;
799 }
800 
801 /************************/
802 /* Interface management */
803 /************************/
804 
805 void ath10k_mac_vif_beacon_free(struct ath10k_vif *arvif)
806 {
807 	struct ath10k *ar = arvif->ar;
808 
809 	lockdep_assert_held(&ar->data_lock);
810 
811 	if (!arvif->beacon)
812 		return;
813 
814 	if (!arvif->beacon_buf)
815 		dma_unmap_single(ar->dev, ATH10K_SKB_CB(arvif->beacon)->paddr,
816 				 arvif->beacon->len, DMA_TO_DEVICE);
817 
818 	if (WARN_ON(arvif->beacon_state != ATH10K_BEACON_SCHEDULED &&
819 		    arvif->beacon_state != ATH10K_BEACON_SENT))
820 		return;
821 
822 	dev_kfree_skb_any(arvif->beacon);
823 
824 	arvif->beacon = NULL;
825 	arvif->beacon_state = ATH10K_BEACON_SCHEDULED;
826 }
827 
828 static void ath10k_mac_vif_beacon_cleanup(struct ath10k_vif *arvif)
829 {
830 	struct ath10k *ar = arvif->ar;
831 
832 	lockdep_assert_held(&ar->data_lock);
833 
834 	ath10k_mac_vif_beacon_free(arvif);
835 
836 	if (arvif->beacon_buf) {
837 		dma_free_coherent(ar->dev, IEEE80211_MAX_FRAME_LEN,
838 				  arvif->beacon_buf, arvif->beacon_paddr);
839 		arvif->beacon_buf = NULL;
840 	}
841 }
842 
843 static inline int ath10k_vdev_setup_sync(struct ath10k *ar)
844 {
845 	unsigned long time_left;
846 
847 	lockdep_assert_held(&ar->conf_mutex);
848 
849 	if (test_bit(ATH10K_FLAG_CRASH_FLUSH, &ar->dev_flags))
850 		return -ESHUTDOWN;
851 
852 	time_left = wait_for_completion_timeout(&ar->vdev_setup_done,
853 						ATH10K_VDEV_SETUP_TIMEOUT_HZ);
854 	if (time_left == 0)
855 		return -ETIMEDOUT;
856 
857 	return 0;
858 }
859 
860 static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
861 {
862 	struct cfg80211_chan_def *chandef = NULL;
863 	struct ieee80211_channel *channel = NULL;
864 	struct wmi_vdev_start_request_arg arg = {};
865 	int ret = 0;
866 
867 	lockdep_assert_held(&ar->conf_mutex);
868 
869 	ieee80211_iter_chan_contexts_atomic(ar->hw,
870 					    ath10k_mac_get_any_chandef_iter,
871 					    &chandef);
872 	if (WARN_ON_ONCE(!chandef))
873 		return -ENOENT;
874 
875 	channel = chandef->chan;
876 
877 	arg.vdev_id = vdev_id;
878 	arg.channel.freq = channel->center_freq;
879 	arg.channel.band_center_freq1 = chandef->center_freq1;
880 
881 	/* TODO setup this dynamically, what in case we
882 	   don't have any vifs? */
883 	arg.channel.mode = chan_to_phymode(chandef);
884 	arg.channel.chan_radar =
885 			!!(channel->flags & IEEE80211_CHAN_RADAR);
886 
887 	arg.channel.min_power = 0;
888 	arg.channel.max_power = channel->max_power * 2;
889 	arg.channel.max_reg_power = channel->max_reg_power * 2;
890 	arg.channel.max_antenna_gain = channel->max_antenna_gain * 2;
891 
892 	reinit_completion(&ar->vdev_setup_done);
893 
894 	ret = ath10k_wmi_vdev_start(ar, &arg);
895 	if (ret) {
896 		ath10k_warn(ar, "failed to request monitor vdev %i start: %d\n",
897 			    vdev_id, ret);
898 		return ret;
899 	}
900 
901 	ret = ath10k_vdev_setup_sync(ar);
902 	if (ret) {
903 		ath10k_warn(ar, "failed to synchronize setup for monitor vdev %i start: %d\n",
904 			    vdev_id, ret);
905 		return ret;
906 	}
907 
908 	ret = ath10k_wmi_vdev_up(ar, vdev_id, 0, ar->mac_addr);
909 	if (ret) {
910 		ath10k_warn(ar, "failed to put up monitor vdev %i: %d\n",
911 			    vdev_id, ret);
912 		goto vdev_stop;
913 	}
914 
915 	ar->monitor_vdev_id = vdev_id;
916 
917 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac monitor vdev %i started\n",
918 		   ar->monitor_vdev_id);
919 	return 0;
920 
921 vdev_stop:
922 	ret = ath10k_wmi_vdev_stop(ar, ar->monitor_vdev_id);
923 	if (ret)
924 		ath10k_warn(ar, "failed to stop monitor vdev %i after start failure: %d\n",
925 			    ar->monitor_vdev_id, ret);
926 
927 	return ret;
928 }
929 
930 static int ath10k_monitor_vdev_stop(struct ath10k *ar)
931 {
932 	int ret = 0;
933 
934 	lockdep_assert_held(&ar->conf_mutex);
935 
936 	ret = ath10k_wmi_vdev_down(ar, ar->monitor_vdev_id);
937 	if (ret)
938 		ath10k_warn(ar, "failed to put down monitor vdev %i: %d\n",
939 			    ar->monitor_vdev_id, ret);
940 
941 	reinit_completion(&ar->vdev_setup_done);
942 
943 	ret = ath10k_wmi_vdev_stop(ar, ar->monitor_vdev_id);
944 	if (ret)
945 		ath10k_warn(ar, "failed to to request monitor vdev %i stop: %d\n",
946 			    ar->monitor_vdev_id, ret);
947 
948 	ret = ath10k_vdev_setup_sync(ar);
949 	if (ret)
950 		ath10k_warn(ar, "failed to synchronize monitor vdev %i stop: %d\n",
951 			    ar->monitor_vdev_id, ret);
952 
953 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac monitor vdev %i stopped\n",
954 		   ar->monitor_vdev_id);
955 	return ret;
956 }
957 
958 static int ath10k_monitor_vdev_create(struct ath10k *ar)
959 {
960 	int bit, ret = 0;
961 
962 	lockdep_assert_held(&ar->conf_mutex);
963 
964 	if (ar->free_vdev_map == 0) {
965 		ath10k_warn(ar, "failed to find free vdev id for monitor vdev\n");
966 		return -ENOMEM;
967 	}
968 
969 	bit = __ffs64(ar->free_vdev_map);
970 
971 	ar->monitor_vdev_id = bit;
972 
973 	ret = ath10k_wmi_vdev_create(ar, ar->monitor_vdev_id,
974 				     WMI_VDEV_TYPE_MONITOR,
975 				     0, ar->mac_addr);
976 	if (ret) {
977 		ath10k_warn(ar, "failed to request monitor vdev %i creation: %d\n",
978 			    ar->monitor_vdev_id, ret);
979 		return ret;
980 	}
981 
982 	ar->free_vdev_map &= ~(1LL << ar->monitor_vdev_id);
983 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac monitor vdev %d created\n",
984 		   ar->monitor_vdev_id);
985 
986 	return 0;
987 }
988 
989 static int ath10k_monitor_vdev_delete(struct ath10k *ar)
990 {
991 	int ret = 0;
992 
993 	lockdep_assert_held(&ar->conf_mutex);
994 
995 	ret = ath10k_wmi_vdev_delete(ar, ar->monitor_vdev_id);
996 	if (ret) {
997 		ath10k_warn(ar, "failed to request wmi monitor vdev %i removal: %d\n",
998 			    ar->monitor_vdev_id, ret);
999 		return ret;
1000 	}
1001 
1002 	ar->free_vdev_map |= 1LL << ar->monitor_vdev_id;
1003 
1004 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac monitor vdev %d deleted\n",
1005 		   ar->monitor_vdev_id);
1006 	return ret;
1007 }
1008 
1009 static int ath10k_monitor_start(struct ath10k *ar)
1010 {
1011 	int ret;
1012 
1013 	lockdep_assert_held(&ar->conf_mutex);
1014 
1015 	ret = ath10k_monitor_vdev_create(ar);
1016 	if (ret) {
1017 		ath10k_warn(ar, "failed to create monitor vdev: %d\n", ret);
1018 		return ret;
1019 	}
1020 
1021 	ret = ath10k_monitor_vdev_start(ar, ar->monitor_vdev_id);
1022 	if (ret) {
1023 		ath10k_warn(ar, "failed to start monitor vdev: %d\n", ret);
1024 		ath10k_monitor_vdev_delete(ar);
1025 		return ret;
1026 	}
1027 
1028 	ar->monitor_started = true;
1029 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac monitor started\n");
1030 
1031 	return 0;
1032 }
1033 
1034 static int ath10k_monitor_stop(struct ath10k *ar)
1035 {
1036 	int ret;
1037 
1038 	lockdep_assert_held(&ar->conf_mutex);
1039 
1040 	ret = ath10k_monitor_vdev_stop(ar);
1041 	if (ret) {
1042 		ath10k_warn(ar, "failed to stop monitor vdev: %d\n", ret);
1043 		return ret;
1044 	}
1045 
1046 	ret = ath10k_monitor_vdev_delete(ar);
1047 	if (ret) {
1048 		ath10k_warn(ar, "failed to delete monitor vdev: %d\n", ret);
1049 		return ret;
1050 	}
1051 
1052 	ar->monitor_started = false;
1053 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac monitor stopped\n");
1054 
1055 	return 0;
1056 }
1057 
1058 static bool ath10k_mac_monitor_vdev_is_needed(struct ath10k *ar)
1059 {
1060 	int num_ctx;
1061 
1062 	/* At least one chanctx is required to derive a channel to start
1063 	 * monitor vdev on.
1064 	 */
1065 	num_ctx = ath10k_mac_num_chanctxs(ar);
1066 	if (num_ctx == 0)
1067 		return false;
1068 
1069 	/* If there's already an existing special monitor interface then don't
1070 	 * bother creating another monitor vdev.
1071 	 */
1072 	if (ar->monitor_arvif)
1073 		return false;
1074 
1075 	return ar->monitor ||
1076 	       ar->filter_flags & FIF_OTHER_BSS ||
1077 	       test_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
1078 }
1079 
1080 static bool ath10k_mac_monitor_vdev_is_allowed(struct ath10k *ar)
1081 {
1082 	int num_ctx;
1083 
1084 	num_ctx = ath10k_mac_num_chanctxs(ar);
1085 
1086 	/* FIXME: Current interface combinations and cfg80211/mac80211 code
1087 	 * shouldn't allow this but make sure to prevent handling the following
1088 	 * case anyway since multi-channel DFS hasn't been tested at all.
1089 	 */
1090 	if (test_bit(ATH10K_CAC_RUNNING, &ar->dev_flags) && num_ctx > 1)
1091 		return false;
1092 
1093 	return true;
1094 }
1095 
1096 static int ath10k_monitor_recalc(struct ath10k *ar)
1097 {
1098 	bool needed;
1099 	bool allowed;
1100 	int ret;
1101 
1102 	lockdep_assert_held(&ar->conf_mutex);
1103 
1104 	needed = ath10k_mac_monitor_vdev_is_needed(ar);
1105 	allowed = ath10k_mac_monitor_vdev_is_allowed(ar);
1106 
1107 	ath10k_dbg(ar, ATH10K_DBG_MAC,
1108 		   "mac monitor recalc started? %d needed? %d allowed? %d\n",
1109 		   ar->monitor_started, needed, allowed);
1110 
1111 	if (WARN_ON(needed && !allowed)) {
1112 		if (ar->monitor_started) {
1113 			ath10k_dbg(ar, ATH10K_DBG_MAC, "mac monitor stopping disallowed monitor\n");
1114 
1115 			ret = ath10k_monitor_stop(ar);
1116 			if (ret)
1117 				ath10k_warn(ar, "failed to stop disallowed monitor: %d\n",
1118 					    ret);
1119 				/* not serious */
1120 		}
1121 
1122 		return -EPERM;
1123 	}
1124 
1125 	if (needed == ar->monitor_started)
1126 		return 0;
1127 
1128 	if (needed)
1129 		return ath10k_monitor_start(ar);
1130 	else
1131 		return ath10k_monitor_stop(ar);
1132 }
1133 
1134 static int ath10k_recalc_rtscts_prot(struct ath10k_vif *arvif)
1135 {
1136 	struct ath10k *ar = arvif->ar;
1137 	u32 vdev_param, rts_cts = 0;
1138 
1139 	lockdep_assert_held(&ar->conf_mutex);
1140 
1141 	vdev_param = ar->wmi.vdev_param->enable_rtscts;
1142 
1143 	rts_cts |= SM(WMI_RTSCTS_ENABLED, WMI_RTSCTS_SET);
1144 
1145 	if (arvif->num_legacy_stations > 0)
1146 		rts_cts |= SM(WMI_RTSCTS_ACROSS_SW_RETRIES,
1147 			      WMI_RTSCTS_PROFILE);
1148 	else
1149 		rts_cts |= SM(WMI_RTSCTS_FOR_SECOND_RATESERIES,
1150 			      WMI_RTSCTS_PROFILE);
1151 
1152 	return ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
1153 					 rts_cts);
1154 }
1155 
1156 static int ath10k_start_cac(struct ath10k *ar)
1157 {
1158 	int ret;
1159 
1160 	lockdep_assert_held(&ar->conf_mutex);
1161 
1162 	set_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
1163 
1164 	ret = ath10k_monitor_recalc(ar);
1165 	if (ret) {
1166 		ath10k_warn(ar, "failed to start monitor (cac): %d\n", ret);
1167 		clear_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
1168 		return ret;
1169 	}
1170 
1171 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac cac start monitor vdev %d\n",
1172 		   ar->monitor_vdev_id);
1173 
1174 	return 0;
1175 }
1176 
1177 static int ath10k_stop_cac(struct ath10k *ar)
1178 {
1179 	lockdep_assert_held(&ar->conf_mutex);
1180 
1181 	/* CAC is not running - do nothing */
1182 	if (!test_bit(ATH10K_CAC_RUNNING, &ar->dev_flags))
1183 		return 0;
1184 
1185 	clear_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
1186 	ath10k_monitor_stop(ar);
1187 
1188 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac cac finished\n");
1189 
1190 	return 0;
1191 }
1192 
1193 static void ath10k_mac_has_radar_iter(struct ieee80211_hw *hw,
1194 				      struct ieee80211_chanctx_conf *conf,
1195 				      void *data)
1196 {
1197 	bool *ret = data;
1198 
1199 	if (!*ret && conf->radar_enabled)
1200 		*ret = true;
1201 }
1202 
1203 static bool ath10k_mac_has_radar_enabled(struct ath10k *ar)
1204 {
1205 	bool has_radar = false;
1206 
1207 	ieee80211_iter_chan_contexts_atomic(ar->hw,
1208 					    ath10k_mac_has_radar_iter,
1209 					    &has_radar);
1210 
1211 	return has_radar;
1212 }
1213 
1214 static void ath10k_recalc_radar_detection(struct ath10k *ar)
1215 {
1216 	int ret;
1217 
1218 	lockdep_assert_held(&ar->conf_mutex);
1219 
1220 	ath10k_stop_cac(ar);
1221 
1222 	if (!ath10k_mac_has_radar_enabled(ar))
1223 		return;
1224 
1225 	if (ar->num_started_vdevs > 0)
1226 		return;
1227 
1228 	ret = ath10k_start_cac(ar);
1229 	if (ret) {
1230 		/*
1231 		 * Not possible to start CAC on current channel so starting
1232 		 * radiation is not allowed, make this channel DFS_UNAVAILABLE
1233 		 * by indicating that radar was detected.
1234 		 */
1235 		ath10k_warn(ar, "failed to start CAC: %d\n", ret);
1236 		ieee80211_radar_detected(ar->hw);
1237 	}
1238 }
1239 
1240 static int ath10k_vdev_stop(struct ath10k_vif *arvif)
1241 {
1242 	struct ath10k *ar = arvif->ar;
1243 	int ret;
1244 
1245 	lockdep_assert_held(&ar->conf_mutex);
1246 
1247 	reinit_completion(&ar->vdev_setup_done);
1248 
1249 	ret = ath10k_wmi_vdev_stop(ar, arvif->vdev_id);
1250 	if (ret) {
1251 		ath10k_warn(ar, "failed to stop WMI vdev %i: %d\n",
1252 			    arvif->vdev_id, ret);
1253 		return ret;
1254 	}
1255 
1256 	ret = ath10k_vdev_setup_sync(ar);
1257 	if (ret) {
1258 		ath10k_warn(ar, "failed to syncronise setup for vdev %i: %d\n",
1259 			    arvif->vdev_id, ret);
1260 		return ret;
1261 	}
1262 
1263 	WARN_ON(ar->num_started_vdevs == 0);
1264 
1265 	if (ar->num_started_vdevs != 0) {
1266 		ar->num_started_vdevs--;
1267 		ath10k_recalc_radar_detection(ar);
1268 	}
1269 
1270 	return ret;
1271 }
1272 
1273 static int ath10k_vdev_start_restart(struct ath10k_vif *arvif,
1274 				     const struct cfg80211_chan_def *chandef,
1275 				     bool restart)
1276 {
1277 	struct ath10k *ar = arvif->ar;
1278 	struct wmi_vdev_start_request_arg arg = {};
1279 	int ret = 0;
1280 
1281 	lockdep_assert_held(&ar->conf_mutex);
1282 
1283 	reinit_completion(&ar->vdev_setup_done);
1284 
1285 	arg.vdev_id = arvif->vdev_id;
1286 	arg.dtim_period = arvif->dtim_period;
1287 	arg.bcn_intval = arvif->beacon_interval;
1288 
1289 	arg.channel.freq = chandef->chan->center_freq;
1290 	arg.channel.band_center_freq1 = chandef->center_freq1;
1291 	arg.channel.mode = chan_to_phymode(chandef);
1292 
1293 	arg.channel.min_power = 0;
1294 	arg.channel.max_power = chandef->chan->max_power * 2;
1295 	arg.channel.max_reg_power = chandef->chan->max_reg_power * 2;
1296 	arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain * 2;
1297 
1298 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
1299 		arg.ssid = arvif->u.ap.ssid;
1300 		arg.ssid_len = arvif->u.ap.ssid_len;
1301 		arg.hidden_ssid = arvif->u.ap.hidden_ssid;
1302 
1303 		/* For now allow DFS for AP mode */
1304 		arg.channel.chan_radar =
1305 			!!(chandef->chan->flags & IEEE80211_CHAN_RADAR);
1306 	} else if (arvif->vdev_type == WMI_VDEV_TYPE_IBSS) {
1307 		arg.ssid = arvif->vif->bss_conf.ssid;
1308 		arg.ssid_len = arvif->vif->bss_conf.ssid_len;
1309 	}
1310 
1311 	ath10k_dbg(ar, ATH10K_DBG_MAC,
1312 		   "mac vdev %d start center_freq %d phymode %s\n",
1313 		   arg.vdev_id, arg.channel.freq,
1314 		   ath10k_wmi_phymode_str(arg.channel.mode));
1315 
1316 	if (restart)
1317 		ret = ath10k_wmi_vdev_restart(ar, &arg);
1318 	else
1319 		ret = ath10k_wmi_vdev_start(ar, &arg);
1320 
1321 	if (ret) {
1322 		ath10k_warn(ar, "failed to start WMI vdev %i: %d\n",
1323 			    arg.vdev_id, ret);
1324 		return ret;
1325 	}
1326 
1327 	ret = ath10k_vdev_setup_sync(ar);
1328 	if (ret) {
1329 		ath10k_warn(ar,
1330 			    "failed to synchronize setup for vdev %i restart %d: %d\n",
1331 			    arg.vdev_id, restart, ret);
1332 		return ret;
1333 	}
1334 
1335 	ar->num_started_vdevs++;
1336 	ath10k_recalc_radar_detection(ar);
1337 
1338 	return ret;
1339 }
1340 
1341 static int ath10k_vdev_start(struct ath10k_vif *arvif,
1342 			     const struct cfg80211_chan_def *def)
1343 {
1344 	return ath10k_vdev_start_restart(arvif, def, false);
1345 }
1346 
1347 static int ath10k_vdev_restart(struct ath10k_vif *arvif,
1348 			       const struct cfg80211_chan_def *def)
1349 {
1350 	return ath10k_vdev_start_restart(arvif, def, true);
1351 }
1352 
1353 static int ath10k_mac_setup_bcn_p2p_ie(struct ath10k_vif *arvif,
1354 				       struct sk_buff *bcn)
1355 {
1356 	struct ath10k *ar = arvif->ar;
1357 	struct ieee80211_mgmt *mgmt;
1358 	const u8 *p2p_ie;
1359 	int ret;
1360 
1361 	if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
1362 		return 0;
1363 
1364 	if (arvif->vdev_subtype != WMI_VDEV_SUBTYPE_P2P_GO)
1365 		return 0;
1366 
1367 	mgmt = (void *)bcn->data;
1368 	p2p_ie = cfg80211_find_vendor_ie(WLAN_OUI_WFA, WLAN_OUI_TYPE_WFA_P2P,
1369 					 mgmt->u.beacon.variable,
1370 					 bcn->len - (mgmt->u.beacon.variable -
1371 						     bcn->data));
1372 	if (!p2p_ie)
1373 		return -ENOENT;
1374 
1375 	ret = ath10k_wmi_p2p_go_bcn_ie(ar, arvif->vdev_id, p2p_ie);
1376 	if (ret) {
1377 		ath10k_warn(ar, "failed to submit p2p go bcn ie for vdev %i: %d\n",
1378 			    arvif->vdev_id, ret);
1379 		return ret;
1380 	}
1381 
1382 	return 0;
1383 }
1384 
1385 static int ath10k_mac_remove_vendor_ie(struct sk_buff *skb, unsigned int oui,
1386 				       u8 oui_type, size_t ie_offset)
1387 {
1388 	size_t len;
1389 	const u8 *next;
1390 	const u8 *end;
1391 	u8 *ie;
1392 
1393 	if (WARN_ON(skb->len < ie_offset))
1394 		return -EINVAL;
1395 
1396 	ie = (u8 *)cfg80211_find_vendor_ie(oui, oui_type,
1397 					   skb->data + ie_offset,
1398 					   skb->len - ie_offset);
1399 	if (!ie)
1400 		return -ENOENT;
1401 
1402 	len = ie[1] + 2;
1403 	end = skb->data + skb->len;
1404 	next = ie + len;
1405 
1406 	if (WARN_ON(next > end))
1407 		return -EINVAL;
1408 
1409 	memmove(ie, next, end - next);
1410 	skb_trim(skb, skb->len - len);
1411 
1412 	return 0;
1413 }
1414 
1415 static int ath10k_mac_setup_bcn_tmpl(struct ath10k_vif *arvif)
1416 {
1417 	struct ath10k *ar = arvif->ar;
1418 	struct ieee80211_hw *hw = ar->hw;
1419 	struct ieee80211_vif *vif = arvif->vif;
1420 	struct ieee80211_mutable_offsets offs = {};
1421 	struct sk_buff *bcn;
1422 	int ret;
1423 
1424 	if (!test_bit(WMI_SERVICE_BEACON_OFFLOAD, ar->wmi.svc_map))
1425 		return 0;
1426 
1427 	if (arvif->vdev_type != WMI_VDEV_TYPE_AP &&
1428 	    arvif->vdev_type != WMI_VDEV_TYPE_IBSS)
1429 		return 0;
1430 
1431 	bcn = ieee80211_beacon_get_template(hw, vif, &offs);
1432 	if (!bcn) {
1433 		ath10k_warn(ar, "failed to get beacon template from mac80211\n");
1434 		return -EPERM;
1435 	}
1436 
1437 	ret = ath10k_mac_setup_bcn_p2p_ie(arvif, bcn);
1438 	if (ret) {
1439 		ath10k_warn(ar, "failed to setup p2p go bcn ie: %d\n", ret);
1440 		kfree_skb(bcn);
1441 		return ret;
1442 	}
1443 
1444 	/* P2P IE is inserted by firmware automatically (as configured above)
1445 	 * so remove it from the base beacon template to avoid duplicate P2P
1446 	 * IEs in beacon frames.
1447 	 */
1448 	ath10k_mac_remove_vendor_ie(bcn, WLAN_OUI_WFA, WLAN_OUI_TYPE_WFA_P2P,
1449 				    offsetof(struct ieee80211_mgmt,
1450 					     u.beacon.variable));
1451 
1452 	ret = ath10k_wmi_bcn_tmpl(ar, arvif->vdev_id, offs.tim_offset, bcn, 0,
1453 				  0, NULL, 0);
1454 	kfree_skb(bcn);
1455 
1456 	if (ret) {
1457 		ath10k_warn(ar, "failed to submit beacon template command: %d\n",
1458 			    ret);
1459 		return ret;
1460 	}
1461 
1462 	return 0;
1463 }
1464 
1465 static int ath10k_mac_setup_prb_tmpl(struct ath10k_vif *arvif)
1466 {
1467 	struct ath10k *ar = arvif->ar;
1468 	struct ieee80211_hw *hw = ar->hw;
1469 	struct ieee80211_vif *vif = arvif->vif;
1470 	struct sk_buff *prb;
1471 	int ret;
1472 
1473 	if (!test_bit(WMI_SERVICE_BEACON_OFFLOAD, ar->wmi.svc_map))
1474 		return 0;
1475 
1476 	if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
1477 		return 0;
1478 
1479 	prb = ieee80211_proberesp_get(hw, vif);
1480 	if (!prb) {
1481 		ath10k_warn(ar, "failed to get probe resp template from mac80211\n");
1482 		return -EPERM;
1483 	}
1484 
1485 	ret = ath10k_wmi_prb_tmpl(ar, arvif->vdev_id, prb);
1486 	kfree_skb(prb);
1487 
1488 	if (ret) {
1489 		ath10k_warn(ar, "failed to submit probe resp template command: %d\n",
1490 			    ret);
1491 		return ret;
1492 	}
1493 
1494 	return 0;
1495 }
1496 
1497 static int ath10k_mac_vif_fix_hidden_ssid(struct ath10k_vif *arvif)
1498 {
1499 	struct ath10k *ar = arvif->ar;
1500 	struct cfg80211_chan_def def;
1501 	int ret;
1502 
1503 	/* When originally vdev is started during assign_vif_chanctx() some
1504 	 * information is missing, notably SSID. Firmware revisions with beacon
1505 	 * offloading require the SSID to be provided during vdev (re)start to
1506 	 * handle hidden SSID properly.
1507 	 *
1508 	 * Vdev restart must be done after vdev has been both started and
1509 	 * upped. Otherwise some firmware revisions (at least 10.2) fail to
1510 	 * deliver vdev restart response event causing timeouts during vdev
1511 	 * syncing in ath10k.
1512 	 *
1513 	 * Note: The vdev down/up and template reinstallation could be skipped
1514 	 * since only wmi-tlv firmware are known to have beacon offload and
1515 	 * wmi-tlv doesn't seem to misbehave like 10.2 wrt vdev restart
1516 	 * response delivery. It's probably more robust to keep it as is.
1517 	 */
1518 	if (!test_bit(WMI_SERVICE_BEACON_OFFLOAD, ar->wmi.svc_map))
1519 		return 0;
1520 
1521 	if (WARN_ON(!arvif->is_started))
1522 		return -EINVAL;
1523 
1524 	if (WARN_ON(!arvif->is_up))
1525 		return -EINVAL;
1526 
1527 	if (WARN_ON(ath10k_mac_vif_chan(arvif->vif, &def)))
1528 		return -EINVAL;
1529 
1530 	ret = ath10k_wmi_vdev_down(ar, arvif->vdev_id);
1531 	if (ret) {
1532 		ath10k_warn(ar, "failed to bring down ap vdev %i: %d\n",
1533 			    arvif->vdev_id, ret);
1534 		return ret;
1535 	}
1536 
1537 	/* Vdev down reset beacon & presp templates. Reinstall them. Otherwise
1538 	 * firmware will crash upon vdev up.
1539 	 */
1540 
1541 	ret = ath10k_mac_setup_bcn_tmpl(arvif);
1542 	if (ret) {
1543 		ath10k_warn(ar, "failed to update beacon template: %d\n", ret);
1544 		return ret;
1545 	}
1546 
1547 	ret = ath10k_mac_setup_prb_tmpl(arvif);
1548 	if (ret) {
1549 		ath10k_warn(ar, "failed to update presp template: %d\n", ret);
1550 		return ret;
1551 	}
1552 
1553 	ret = ath10k_vdev_restart(arvif, &def);
1554 	if (ret) {
1555 		ath10k_warn(ar, "failed to restart ap vdev %i: %d\n",
1556 			    arvif->vdev_id, ret);
1557 		return ret;
1558 	}
1559 
1560 	ret = ath10k_wmi_vdev_up(arvif->ar, arvif->vdev_id, arvif->aid,
1561 				 arvif->bssid);
1562 	if (ret) {
1563 		ath10k_warn(ar, "failed to bring up ap vdev %i: %d\n",
1564 			    arvif->vdev_id, ret);
1565 		return ret;
1566 	}
1567 
1568 	return 0;
1569 }
1570 
1571 static void ath10k_control_beaconing(struct ath10k_vif *arvif,
1572 				     struct ieee80211_bss_conf *info)
1573 {
1574 	struct ath10k *ar = arvif->ar;
1575 	int ret = 0;
1576 
1577 	lockdep_assert_held(&arvif->ar->conf_mutex);
1578 
1579 	if (!info->enable_beacon) {
1580 		ret = ath10k_wmi_vdev_down(ar, arvif->vdev_id);
1581 		if (ret)
1582 			ath10k_warn(ar, "failed to down vdev_id %i: %d\n",
1583 				    arvif->vdev_id, ret);
1584 
1585 		arvif->is_up = false;
1586 
1587 		spin_lock_bh(&arvif->ar->data_lock);
1588 		ath10k_mac_vif_beacon_free(arvif);
1589 		spin_unlock_bh(&arvif->ar->data_lock);
1590 
1591 		return;
1592 	}
1593 
1594 	arvif->tx_seq_no = 0x1000;
1595 
1596 	arvif->aid = 0;
1597 	ether_addr_copy(arvif->bssid, info->bssid);
1598 
1599 	ret = ath10k_wmi_vdev_up(arvif->ar, arvif->vdev_id, arvif->aid,
1600 				 arvif->bssid);
1601 	if (ret) {
1602 		ath10k_warn(ar, "failed to bring up vdev %d: %i\n",
1603 			    arvif->vdev_id, ret);
1604 		return;
1605 	}
1606 
1607 	arvif->is_up = true;
1608 
1609 	ret = ath10k_mac_vif_fix_hidden_ssid(arvif);
1610 	if (ret) {
1611 		ath10k_warn(ar, "failed to fix hidden ssid for vdev %i, expect trouble: %d\n",
1612 			    arvif->vdev_id, ret);
1613 		return;
1614 	}
1615 
1616 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d up\n", arvif->vdev_id);
1617 }
1618 
1619 static void ath10k_control_ibss(struct ath10k_vif *arvif,
1620 				struct ieee80211_bss_conf *info,
1621 				const u8 self_peer[ETH_ALEN])
1622 {
1623 	struct ath10k *ar = arvif->ar;
1624 	u32 vdev_param;
1625 	int ret = 0;
1626 
1627 	lockdep_assert_held(&arvif->ar->conf_mutex);
1628 
1629 	if (!info->ibss_joined) {
1630 		if (is_zero_ether_addr(arvif->bssid))
1631 			return;
1632 
1633 		eth_zero_addr(arvif->bssid);
1634 
1635 		return;
1636 	}
1637 
1638 	vdev_param = arvif->ar->wmi.vdev_param->atim_window;
1639 	ret = ath10k_wmi_vdev_set_param(arvif->ar, arvif->vdev_id, vdev_param,
1640 					ATH10K_DEFAULT_ATIM);
1641 	if (ret)
1642 		ath10k_warn(ar, "failed to set IBSS ATIM for vdev %d: %d\n",
1643 			    arvif->vdev_id, ret);
1644 }
1645 
1646 static int ath10k_mac_vif_recalc_ps_wake_threshold(struct ath10k_vif *arvif)
1647 {
1648 	struct ath10k *ar = arvif->ar;
1649 	u32 param;
1650 	u32 value;
1651 	int ret;
1652 
1653 	lockdep_assert_held(&arvif->ar->conf_mutex);
1654 
1655 	if (arvif->u.sta.uapsd)
1656 		value = WMI_STA_PS_TX_WAKE_THRESHOLD_NEVER;
1657 	else
1658 		value = WMI_STA_PS_TX_WAKE_THRESHOLD_ALWAYS;
1659 
1660 	param = WMI_STA_PS_PARAM_TX_WAKE_THRESHOLD;
1661 	ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id, param, value);
1662 	if (ret) {
1663 		ath10k_warn(ar, "failed to submit ps wake threshold %u on vdev %i: %d\n",
1664 			    value, arvif->vdev_id, ret);
1665 		return ret;
1666 	}
1667 
1668 	return 0;
1669 }
1670 
1671 static int ath10k_mac_vif_recalc_ps_poll_count(struct ath10k_vif *arvif)
1672 {
1673 	struct ath10k *ar = arvif->ar;
1674 	u32 param;
1675 	u32 value;
1676 	int ret;
1677 
1678 	lockdep_assert_held(&arvif->ar->conf_mutex);
1679 
1680 	if (arvif->u.sta.uapsd)
1681 		value = WMI_STA_PS_PSPOLL_COUNT_UAPSD;
1682 	else
1683 		value = WMI_STA_PS_PSPOLL_COUNT_NO_MAX;
1684 
1685 	param = WMI_STA_PS_PARAM_PSPOLL_COUNT;
1686 	ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
1687 					  param, value);
1688 	if (ret) {
1689 		ath10k_warn(ar, "failed to submit ps poll count %u on vdev %i: %d\n",
1690 			    value, arvif->vdev_id, ret);
1691 		return ret;
1692 	}
1693 
1694 	return 0;
1695 }
1696 
1697 static int ath10k_mac_num_vifs_started(struct ath10k *ar)
1698 {
1699 	struct ath10k_vif *arvif;
1700 	int num = 0;
1701 
1702 	lockdep_assert_held(&ar->conf_mutex);
1703 
1704 	list_for_each_entry(arvif, &ar->arvifs, list)
1705 		if (arvif->is_started)
1706 			num++;
1707 
1708 	return num;
1709 }
1710 
1711 static int ath10k_mac_vif_setup_ps(struct ath10k_vif *arvif)
1712 {
1713 	struct ath10k *ar = arvif->ar;
1714 	struct ieee80211_vif *vif = arvif->vif;
1715 	struct ieee80211_conf *conf = &ar->hw->conf;
1716 	enum wmi_sta_powersave_param param;
1717 	enum wmi_sta_ps_mode psmode;
1718 	int ret;
1719 	int ps_timeout;
1720 	bool enable_ps;
1721 
1722 	lockdep_assert_held(&arvif->ar->conf_mutex);
1723 
1724 	if (arvif->vif->type != NL80211_IFTYPE_STATION)
1725 		return 0;
1726 
1727 	enable_ps = arvif->ps;
1728 
1729 	if (enable_ps && ath10k_mac_num_vifs_started(ar) > 1 &&
1730 	    !test_bit(ATH10K_FW_FEATURE_MULTI_VIF_PS_SUPPORT,
1731 		      ar->fw_features)) {
1732 		ath10k_warn(ar, "refusing to enable ps on vdev %i: not supported by fw\n",
1733 			    arvif->vdev_id);
1734 		enable_ps = false;
1735 	}
1736 
1737 	if (!arvif->is_started) {
1738 		/* mac80211 can update vif powersave state while disconnected.
1739 		 * Firmware doesn't behave nicely and consumes more power than
1740 		 * necessary if PS is disabled on a non-started vdev. Hence
1741 		 * force-enable PS for non-running vdevs.
1742 		 */
1743 		psmode = WMI_STA_PS_MODE_ENABLED;
1744 	} else if (enable_ps) {
1745 		psmode = WMI_STA_PS_MODE_ENABLED;
1746 		param = WMI_STA_PS_PARAM_INACTIVITY_TIME;
1747 
1748 		ps_timeout = conf->dynamic_ps_timeout;
1749 		if (ps_timeout == 0) {
1750 			/* Firmware doesn't like 0 */
1751 			ps_timeout = ieee80211_tu_to_usec(
1752 				vif->bss_conf.beacon_int) / 1000;
1753 		}
1754 
1755 		ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id, param,
1756 						  ps_timeout);
1757 		if (ret) {
1758 			ath10k_warn(ar, "failed to set inactivity time for vdev %d: %i\n",
1759 				    arvif->vdev_id, ret);
1760 			return ret;
1761 		}
1762 	} else {
1763 		psmode = WMI_STA_PS_MODE_DISABLED;
1764 	}
1765 
1766 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d psmode %s\n",
1767 		   arvif->vdev_id, psmode ? "enable" : "disable");
1768 
1769 	ret = ath10k_wmi_set_psmode(ar, arvif->vdev_id, psmode);
1770 	if (ret) {
1771 		ath10k_warn(ar, "failed to set PS Mode %d for vdev %d: %d\n",
1772 			    psmode, arvif->vdev_id, ret);
1773 		return ret;
1774 	}
1775 
1776 	return 0;
1777 }
1778 
1779 static int ath10k_mac_vif_disable_keepalive(struct ath10k_vif *arvif)
1780 {
1781 	struct ath10k *ar = arvif->ar;
1782 	struct wmi_sta_keepalive_arg arg = {};
1783 	int ret;
1784 
1785 	lockdep_assert_held(&arvif->ar->conf_mutex);
1786 
1787 	if (arvif->vdev_type != WMI_VDEV_TYPE_STA)
1788 		return 0;
1789 
1790 	if (!test_bit(WMI_SERVICE_STA_KEEP_ALIVE, ar->wmi.svc_map))
1791 		return 0;
1792 
1793 	/* Some firmware revisions have a bug and ignore the `enabled` field.
1794 	 * Instead use the interval to disable the keepalive.
1795 	 */
1796 	arg.vdev_id = arvif->vdev_id;
1797 	arg.enabled = 1;
1798 	arg.method = WMI_STA_KEEPALIVE_METHOD_NULL_FRAME;
1799 	arg.interval = WMI_STA_KEEPALIVE_INTERVAL_DISABLE;
1800 
1801 	ret = ath10k_wmi_sta_keepalive(ar, &arg);
1802 	if (ret) {
1803 		ath10k_warn(ar, "failed to submit keepalive on vdev %i: %d\n",
1804 			    arvif->vdev_id, ret);
1805 		return ret;
1806 	}
1807 
1808 	return 0;
1809 }
1810 
1811 static void ath10k_mac_vif_ap_csa_count_down(struct ath10k_vif *arvif)
1812 {
1813 	struct ath10k *ar = arvif->ar;
1814 	struct ieee80211_vif *vif = arvif->vif;
1815 	int ret;
1816 
1817 	lockdep_assert_held(&arvif->ar->conf_mutex);
1818 
1819 	if (WARN_ON(!test_bit(WMI_SERVICE_BEACON_OFFLOAD, ar->wmi.svc_map)))
1820 		return;
1821 
1822 	if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
1823 		return;
1824 
1825 	if (!vif->csa_active)
1826 		return;
1827 
1828 	if (!arvif->is_up)
1829 		return;
1830 
1831 	if (!ieee80211_csa_is_complete(vif)) {
1832 		ieee80211_csa_update_counter(vif);
1833 
1834 		ret = ath10k_mac_setup_bcn_tmpl(arvif);
1835 		if (ret)
1836 			ath10k_warn(ar, "failed to update bcn tmpl during csa: %d\n",
1837 				    ret);
1838 
1839 		ret = ath10k_mac_setup_prb_tmpl(arvif);
1840 		if (ret)
1841 			ath10k_warn(ar, "failed to update prb tmpl during csa: %d\n",
1842 				    ret);
1843 	} else {
1844 		ieee80211_csa_finish(vif);
1845 	}
1846 }
1847 
1848 static void ath10k_mac_vif_ap_csa_work(struct work_struct *work)
1849 {
1850 	struct ath10k_vif *arvif = container_of(work, struct ath10k_vif,
1851 						ap_csa_work);
1852 	struct ath10k *ar = arvif->ar;
1853 
1854 	mutex_lock(&ar->conf_mutex);
1855 	ath10k_mac_vif_ap_csa_count_down(arvif);
1856 	mutex_unlock(&ar->conf_mutex);
1857 }
1858 
1859 static void ath10k_mac_handle_beacon_iter(void *data, u8 *mac,
1860 					  struct ieee80211_vif *vif)
1861 {
1862 	struct sk_buff *skb = data;
1863 	struct ieee80211_mgmt *mgmt = (void *)skb->data;
1864 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
1865 
1866 	if (vif->type != NL80211_IFTYPE_STATION)
1867 		return;
1868 
1869 	if (!ether_addr_equal(mgmt->bssid, vif->bss_conf.bssid))
1870 		return;
1871 
1872 	cancel_delayed_work(&arvif->connection_loss_work);
1873 }
1874 
1875 void ath10k_mac_handle_beacon(struct ath10k *ar, struct sk_buff *skb)
1876 {
1877 	ieee80211_iterate_active_interfaces_atomic(ar->hw,
1878 						   IEEE80211_IFACE_ITER_NORMAL,
1879 						   ath10k_mac_handle_beacon_iter,
1880 						   skb);
1881 }
1882 
1883 static void ath10k_mac_handle_beacon_miss_iter(void *data, u8 *mac,
1884 					       struct ieee80211_vif *vif)
1885 {
1886 	u32 *vdev_id = data;
1887 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
1888 	struct ath10k *ar = arvif->ar;
1889 	struct ieee80211_hw *hw = ar->hw;
1890 
1891 	if (arvif->vdev_id != *vdev_id)
1892 		return;
1893 
1894 	if (!arvif->is_up)
1895 		return;
1896 
1897 	ieee80211_beacon_loss(vif);
1898 
1899 	/* Firmware doesn't report beacon loss events repeatedly. If AP probe
1900 	 * (done by mac80211) succeeds but beacons do not resume then it
1901 	 * doesn't make sense to continue operation. Queue connection loss work
1902 	 * which can be cancelled when beacon is received.
1903 	 */
1904 	ieee80211_queue_delayed_work(hw, &arvif->connection_loss_work,
1905 				     ATH10K_CONNECTION_LOSS_HZ);
1906 }
1907 
1908 void ath10k_mac_handle_beacon_miss(struct ath10k *ar, u32 vdev_id)
1909 {
1910 	ieee80211_iterate_active_interfaces_atomic(ar->hw,
1911 						   IEEE80211_IFACE_ITER_NORMAL,
1912 						   ath10k_mac_handle_beacon_miss_iter,
1913 						   &vdev_id);
1914 }
1915 
1916 static void ath10k_mac_vif_sta_connection_loss_work(struct work_struct *work)
1917 {
1918 	struct ath10k_vif *arvif = container_of(work, struct ath10k_vif,
1919 						connection_loss_work.work);
1920 	struct ieee80211_vif *vif = arvif->vif;
1921 
1922 	if (!arvif->is_up)
1923 		return;
1924 
1925 	ieee80211_connection_loss(vif);
1926 }
1927 
1928 /**********************/
1929 /* Station management */
1930 /**********************/
1931 
1932 static u32 ath10k_peer_assoc_h_listen_intval(struct ath10k *ar,
1933 					     struct ieee80211_vif *vif)
1934 {
1935 	/* Some firmware revisions have unstable STA powersave when listen
1936 	 * interval is set too high (e.g. 5). The symptoms are firmware doesn't
1937 	 * generate NullFunc frames properly even if buffered frames have been
1938 	 * indicated in Beacon TIM. Firmware would seldom wake up to pull
1939 	 * buffered frames. Often pinging the device from AP would simply fail.
1940 	 *
1941 	 * As a workaround set it to 1.
1942 	 */
1943 	if (vif->type == NL80211_IFTYPE_STATION)
1944 		return 1;
1945 
1946 	return ar->hw->conf.listen_interval;
1947 }
1948 
1949 static void ath10k_peer_assoc_h_basic(struct ath10k *ar,
1950 				      struct ieee80211_vif *vif,
1951 				      struct ieee80211_sta *sta,
1952 				      struct wmi_peer_assoc_complete_arg *arg)
1953 {
1954 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
1955 	u32 aid;
1956 
1957 	lockdep_assert_held(&ar->conf_mutex);
1958 
1959 	if (vif->type == NL80211_IFTYPE_STATION)
1960 		aid = vif->bss_conf.aid;
1961 	else
1962 		aid = sta->aid;
1963 
1964 	ether_addr_copy(arg->addr, sta->addr);
1965 	arg->vdev_id = arvif->vdev_id;
1966 	arg->peer_aid = aid;
1967 	arg->peer_flags |= arvif->ar->wmi.peer_flags->auth;
1968 	arg->peer_listen_intval = ath10k_peer_assoc_h_listen_intval(ar, vif);
1969 	arg->peer_num_spatial_streams = 1;
1970 	arg->peer_caps = vif->bss_conf.assoc_capability;
1971 }
1972 
1973 static void ath10k_peer_assoc_h_crypto(struct ath10k *ar,
1974 				       struct ieee80211_vif *vif,
1975 				       struct ieee80211_sta *sta,
1976 				       struct wmi_peer_assoc_complete_arg *arg)
1977 {
1978 	struct ieee80211_bss_conf *info = &vif->bss_conf;
1979 	struct cfg80211_chan_def def;
1980 	struct cfg80211_bss *bss;
1981 	const u8 *rsnie = NULL;
1982 	const u8 *wpaie = NULL;
1983 
1984 	lockdep_assert_held(&ar->conf_mutex);
1985 
1986 	if (WARN_ON(ath10k_mac_vif_chan(vif, &def)))
1987 		return;
1988 
1989 	bss = cfg80211_get_bss(ar->hw->wiphy, def.chan, info->bssid, NULL, 0,
1990 			       IEEE80211_BSS_TYPE_ANY, IEEE80211_PRIVACY_ANY);
1991 	if (bss) {
1992 		const struct cfg80211_bss_ies *ies;
1993 
1994 		rcu_read_lock();
1995 		rsnie = ieee80211_bss_get_ie(bss, WLAN_EID_RSN);
1996 
1997 		ies = rcu_dereference(bss->ies);
1998 
1999 		wpaie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
2000 						WLAN_OUI_TYPE_MICROSOFT_WPA,
2001 						ies->data,
2002 						ies->len);
2003 		rcu_read_unlock();
2004 		cfg80211_put_bss(ar->hw->wiphy, bss);
2005 	}
2006 
2007 	/* FIXME: base on RSN IE/WPA IE is a correct idea? */
2008 	if (rsnie || wpaie) {
2009 		ath10k_dbg(ar, ATH10K_DBG_WMI, "%s: rsn ie found\n", __func__);
2010 		arg->peer_flags |= ar->wmi.peer_flags->need_ptk_4_way;
2011 	}
2012 
2013 	if (wpaie) {
2014 		ath10k_dbg(ar, ATH10K_DBG_WMI, "%s: wpa ie found\n", __func__);
2015 		arg->peer_flags |= ar->wmi.peer_flags->need_gtk_2_way;
2016 	}
2017 
2018 	if (sta->mfp &&
2019 	    test_bit(ATH10K_FW_FEATURE_MFP_SUPPORT, ar->fw_features)) {
2020 		arg->peer_flags |= ar->wmi.peer_flags->pmf;
2021 	}
2022 }
2023 
2024 static void ath10k_peer_assoc_h_rates(struct ath10k *ar,
2025 				      struct ieee80211_vif *vif,
2026 				      struct ieee80211_sta *sta,
2027 				      struct wmi_peer_assoc_complete_arg *arg)
2028 {
2029 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
2030 	struct wmi_rate_set_arg *rateset = &arg->peer_legacy_rates;
2031 	struct cfg80211_chan_def def;
2032 	const struct ieee80211_supported_band *sband;
2033 	const struct ieee80211_rate *rates;
2034 	enum ieee80211_band band;
2035 	u32 ratemask;
2036 	u8 rate;
2037 	int i;
2038 
2039 	lockdep_assert_held(&ar->conf_mutex);
2040 
2041 	if (WARN_ON(ath10k_mac_vif_chan(vif, &def)))
2042 		return;
2043 
2044 	band = def.chan->band;
2045 	sband = ar->hw->wiphy->bands[band];
2046 	ratemask = sta->supp_rates[band];
2047 	ratemask &= arvif->bitrate_mask.control[band].legacy;
2048 	rates = sband->bitrates;
2049 
2050 	rateset->num_rates = 0;
2051 
2052 	for (i = 0; i < 32; i++, ratemask >>= 1, rates++) {
2053 		if (!(ratemask & 1))
2054 			continue;
2055 
2056 		rate = ath10k_mac_bitrate_to_rate(rates->bitrate);
2057 		rateset->rates[rateset->num_rates] = rate;
2058 		rateset->num_rates++;
2059 	}
2060 }
2061 
2062 static bool
2063 ath10k_peer_assoc_h_ht_masked(const u8 ht_mcs_mask[IEEE80211_HT_MCS_MASK_LEN])
2064 {
2065 	int nss;
2066 
2067 	for (nss = 0; nss < IEEE80211_HT_MCS_MASK_LEN; nss++)
2068 		if (ht_mcs_mask[nss])
2069 			return false;
2070 
2071 	return true;
2072 }
2073 
2074 static bool
2075 ath10k_peer_assoc_h_vht_masked(const u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
2076 {
2077 	int nss;
2078 
2079 	for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++)
2080 		if (vht_mcs_mask[nss])
2081 			return false;
2082 
2083 	return true;
2084 }
2085 
2086 static void ath10k_peer_assoc_h_ht(struct ath10k *ar,
2087 				   struct ieee80211_vif *vif,
2088 				   struct ieee80211_sta *sta,
2089 				   struct wmi_peer_assoc_complete_arg *arg)
2090 {
2091 	const struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
2092 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
2093 	struct cfg80211_chan_def def;
2094 	enum ieee80211_band band;
2095 	const u8 *ht_mcs_mask;
2096 	const u16 *vht_mcs_mask;
2097 	int i, n;
2098 	u8 max_nss;
2099 	u32 stbc;
2100 
2101 	lockdep_assert_held(&ar->conf_mutex);
2102 
2103 	if (WARN_ON(ath10k_mac_vif_chan(vif, &def)))
2104 		return;
2105 
2106 	if (!ht_cap->ht_supported)
2107 		return;
2108 
2109 	band = def.chan->band;
2110 	ht_mcs_mask = arvif->bitrate_mask.control[band].ht_mcs;
2111 	vht_mcs_mask = arvif->bitrate_mask.control[band].vht_mcs;
2112 
2113 	if (ath10k_peer_assoc_h_ht_masked(ht_mcs_mask) &&
2114 	    ath10k_peer_assoc_h_vht_masked(vht_mcs_mask))
2115 		return;
2116 
2117 	arg->peer_flags |= ar->wmi.peer_flags->ht;
2118 	arg->peer_max_mpdu = (1 << (IEEE80211_HT_MAX_AMPDU_FACTOR +
2119 				    ht_cap->ampdu_factor)) - 1;
2120 
2121 	arg->peer_mpdu_density =
2122 		ath10k_parse_mpdudensity(ht_cap->ampdu_density);
2123 
2124 	arg->peer_ht_caps = ht_cap->cap;
2125 	arg->peer_rate_caps |= WMI_RC_HT_FLAG;
2126 
2127 	if (ht_cap->cap & IEEE80211_HT_CAP_LDPC_CODING)
2128 		arg->peer_flags |= ar->wmi.peer_flags->ldbc;
2129 
2130 	if (sta->bandwidth >= IEEE80211_STA_RX_BW_40) {
2131 		arg->peer_flags |= ar->wmi.peer_flags->bw40;
2132 		arg->peer_rate_caps |= WMI_RC_CW40_FLAG;
2133 	}
2134 
2135 	if (arvif->bitrate_mask.control[band].gi != NL80211_TXRATE_FORCE_LGI) {
2136 		if (ht_cap->cap & IEEE80211_HT_CAP_SGI_20)
2137 			arg->peer_rate_caps |= WMI_RC_SGI_FLAG;
2138 
2139 		if (ht_cap->cap & IEEE80211_HT_CAP_SGI_40)
2140 			arg->peer_rate_caps |= WMI_RC_SGI_FLAG;
2141 	}
2142 
2143 	if (ht_cap->cap & IEEE80211_HT_CAP_TX_STBC) {
2144 		arg->peer_rate_caps |= WMI_RC_TX_STBC_FLAG;
2145 		arg->peer_flags |= ar->wmi.peer_flags->stbc;
2146 	}
2147 
2148 	if (ht_cap->cap & IEEE80211_HT_CAP_RX_STBC) {
2149 		stbc = ht_cap->cap & IEEE80211_HT_CAP_RX_STBC;
2150 		stbc = stbc >> IEEE80211_HT_CAP_RX_STBC_SHIFT;
2151 		stbc = stbc << WMI_RC_RX_STBC_FLAG_S;
2152 		arg->peer_rate_caps |= stbc;
2153 		arg->peer_flags |= ar->wmi.peer_flags->stbc;
2154 	}
2155 
2156 	if (ht_cap->mcs.rx_mask[1] && ht_cap->mcs.rx_mask[2])
2157 		arg->peer_rate_caps |= WMI_RC_TS_FLAG;
2158 	else if (ht_cap->mcs.rx_mask[1])
2159 		arg->peer_rate_caps |= WMI_RC_DS_FLAG;
2160 
2161 	for (i = 0, n = 0, max_nss = 0; i < IEEE80211_HT_MCS_MASK_LEN * 8; i++)
2162 		if ((ht_cap->mcs.rx_mask[i / 8] & BIT(i % 8)) &&
2163 		    (ht_mcs_mask[i / 8] & BIT(i % 8))) {
2164 			max_nss = (i / 8) + 1;
2165 			arg->peer_ht_rates.rates[n++] = i;
2166 		}
2167 
2168 	/*
2169 	 * This is a workaround for HT-enabled STAs which break the spec
2170 	 * and have no HT capabilities RX mask (no HT RX MCS map).
2171 	 *
2172 	 * As per spec, in section 20.3.5 Modulation and coding scheme (MCS),
2173 	 * MCS 0 through 7 are mandatory in 20MHz with 800 ns GI at all STAs.
2174 	 *
2175 	 * Firmware asserts if such situation occurs.
2176 	 */
2177 	if (n == 0) {
2178 		arg->peer_ht_rates.num_rates = 8;
2179 		for (i = 0; i < arg->peer_ht_rates.num_rates; i++)
2180 			arg->peer_ht_rates.rates[i] = i;
2181 	} else {
2182 		arg->peer_ht_rates.num_rates = n;
2183 		arg->peer_num_spatial_streams = min(sta->rx_nss, max_nss);
2184 	}
2185 
2186 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac ht peer %pM mcs cnt %d nss %d\n",
2187 		   arg->addr,
2188 		   arg->peer_ht_rates.num_rates,
2189 		   arg->peer_num_spatial_streams);
2190 }
2191 
2192 static int ath10k_peer_assoc_qos_ap(struct ath10k *ar,
2193 				    struct ath10k_vif *arvif,
2194 				    struct ieee80211_sta *sta)
2195 {
2196 	u32 uapsd = 0;
2197 	u32 max_sp = 0;
2198 	int ret = 0;
2199 
2200 	lockdep_assert_held(&ar->conf_mutex);
2201 
2202 	if (sta->wme && sta->uapsd_queues) {
2203 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac uapsd_queues 0x%x max_sp %d\n",
2204 			   sta->uapsd_queues, sta->max_sp);
2205 
2206 		if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
2207 			uapsd |= WMI_AP_PS_UAPSD_AC3_DELIVERY_EN |
2208 				 WMI_AP_PS_UAPSD_AC3_TRIGGER_EN;
2209 		if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
2210 			uapsd |= WMI_AP_PS_UAPSD_AC2_DELIVERY_EN |
2211 				 WMI_AP_PS_UAPSD_AC2_TRIGGER_EN;
2212 		if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
2213 			uapsd |= WMI_AP_PS_UAPSD_AC1_DELIVERY_EN |
2214 				 WMI_AP_PS_UAPSD_AC1_TRIGGER_EN;
2215 		if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
2216 			uapsd |= WMI_AP_PS_UAPSD_AC0_DELIVERY_EN |
2217 				 WMI_AP_PS_UAPSD_AC0_TRIGGER_EN;
2218 
2219 		if (sta->max_sp < MAX_WMI_AP_PS_PEER_PARAM_MAX_SP)
2220 			max_sp = sta->max_sp;
2221 
2222 		ret = ath10k_wmi_set_ap_ps_param(ar, arvif->vdev_id,
2223 						 sta->addr,
2224 						 WMI_AP_PS_PEER_PARAM_UAPSD,
2225 						 uapsd);
2226 		if (ret) {
2227 			ath10k_warn(ar, "failed to set ap ps peer param uapsd for vdev %i: %d\n",
2228 				    arvif->vdev_id, ret);
2229 			return ret;
2230 		}
2231 
2232 		ret = ath10k_wmi_set_ap_ps_param(ar, arvif->vdev_id,
2233 						 sta->addr,
2234 						 WMI_AP_PS_PEER_PARAM_MAX_SP,
2235 						 max_sp);
2236 		if (ret) {
2237 			ath10k_warn(ar, "failed to set ap ps peer param max sp for vdev %i: %d\n",
2238 				    arvif->vdev_id, ret);
2239 			return ret;
2240 		}
2241 
2242 		/* TODO setup this based on STA listen interval and
2243 		   beacon interval. Currently we don't know
2244 		   sta->listen_interval - mac80211 patch required.
2245 		   Currently use 10 seconds */
2246 		ret = ath10k_wmi_set_ap_ps_param(ar, arvif->vdev_id, sta->addr,
2247 						 WMI_AP_PS_PEER_PARAM_AGEOUT_TIME,
2248 						 10);
2249 		if (ret) {
2250 			ath10k_warn(ar, "failed to set ap ps peer param ageout time for vdev %i: %d\n",
2251 				    arvif->vdev_id, ret);
2252 			return ret;
2253 		}
2254 	}
2255 
2256 	return 0;
2257 }
2258 
2259 static u16
2260 ath10k_peer_assoc_h_vht_limit(u16 tx_mcs_set,
2261 			      const u16 vht_mcs_limit[NL80211_VHT_NSS_MAX])
2262 {
2263 	int idx_limit;
2264 	int nss;
2265 	u16 mcs_map;
2266 	u16 mcs;
2267 
2268 	for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
2269 		mcs_map = ath10k_mac_get_max_vht_mcs_map(tx_mcs_set, nss) &
2270 			  vht_mcs_limit[nss];
2271 
2272 		if (mcs_map)
2273 			idx_limit = fls(mcs_map) - 1;
2274 		else
2275 			idx_limit = -1;
2276 
2277 		switch (idx_limit) {
2278 		case 0: /* fall through */
2279 		case 1: /* fall through */
2280 		case 2: /* fall through */
2281 		case 3: /* fall through */
2282 		case 4: /* fall through */
2283 		case 5: /* fall through */
2284 		case 6: /* fall through */
2285 		default:
2286 			/* see ath10k_mac_can_set_bitrate_mask() */
2287 			WARN_ON(1);
2288 			/* fall through */
2289 		case -1:
2290 			mcs = IEEE80211_VHT_MCS_NOT_SUPPORTED;
2291 			break;
2292 		case 7:
2293 			mcs = IEEE80211_VHT_MCS_SUPPORT_0_7;
2294 			break;
2295 		case 8:
2296 			mcs = IEEE80211_VHT_MCS_SUPPORT_0_8;
2297 			break;
2298 		case 9:
2299 			mcs = IEEE80211_VHT_MCS_SUPPORT_0_9;
2300 			break;
2301 		}
2302 
2303 		tx_mcs_set &= ~(0x3 << (nss * 2));
2304 		tx_mcs_set |= mcs << (nss * 2);
2305 	}
2306 
2307 	return tx_mcs_set;
2308 }
2309 
2310 static void ath10k_peer_assoc_h_vht(struct ath10k *ar,
2311 				    struct ieee80211_vif *vif,
2312 				    struct ieee80211_sta *sta,
2313 				    struct wmi_peer_assoc_complete_arg *arg)
2314 {
2315 	const struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
2316 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
2317 	struct cfg80211_chan_def def;
2318 	enum ieee80211_band band;
2319 	const u16 *vht_mcs_mask;
2320 	u8 ampdu_factor;
2321 
2322 	if (WARN_ON(ath10k_mac_vif_chan(vif, &def)))
2323 		return;
2324 
2325 	if (!vht_cap->vht_supported)
2326 		return;
2327 
2328 	band = def.chan->band;
2329 	vht_mcs_mask = arvif->bitrate_mask.control[band].vht_mcs;
2330 
2331 	if (ath10k_peer_assoc_h_vht_masked(vht_mcs_mask))
2332 		return;
2333 
2334 	arg->peer_flags |= ar->wmi.peer_flags->vht;
2335 
2336 	if (def.chan->band == IEEE80211_BAND_2GHZ)
2337 		arg->peer_flags |= ar->wmi.peer_flags->vht_2g;
2338 
2339 	arg->peer_vht_caps = vht_cap->cap;
2340 
2341 	ampdu_factor = (vht_cap->cap &
2342 			IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK) >>
2343 		       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
2344 
2345 	/* Workaround: Some Netgear/Linksys 11ac APs set Rx A-MPDU factor to
2346 	 * zero in VHT IE. Using it would result in degraded throughput.
2347 	 * arg->peer_max_mpdu at this point contains HT max_mpdu so keep
2348 	 * it if VHT max_mpdu is smaller. */
2349 	arg->peer_max_mpdu = max(arg->peer_max_mpdu,
2350 				 (1U << (IEEE80211_HT_MAX_AMPDU_FACTOR +
2351 					ampdu_factor)) - 1);
2352 
2353 	if (sta->bandwidth == IEEE80211_STA_RX_BW_80)
2354 		arg->peer_flags |= ar->wmi.peer_flags->bw80;
2355 
2356 	arg->peer_vht_rates.rx_max_rate =
2357 		__le16_to_cpu(vht_cap->vht_mcs.rx_highest);
2358 	arg->peer_vht_rates.rx_mcs_set =
2359 		__le16_to_cpu(vht_cap->vht_mcs.rx_mcs_map);
2360 	arg->peer_vht_rates.tx_max_rate =
2361 		__le16_to_cpu(vht_cap->vht_mcs.tx_highest);
2362 	arg->peer_vht_rates.tx_mcs_set = ath10k_peer_assoc_h_vht_limit(
2363 		__le16_to_cpu(vht_cap->vht_mcs.tx_mcs_map), vht_mcs_mask);
2364 
2365 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vht peer %pM max_mpdu %d flags 0x%x\n",
2366 		   sta->addr, arg->peer_max_mpdu, arg->peer_flags);
2367 }
2368 
2369 static void ath10k_peer_assoc_h_qos(struct ath10k *ar,
2370 				    struct ieee80211_vif *vif,
2371 				    struct ieee80211_sta *sta,
2372 				    struct wmi_peer_assoc_complete_arg *arg)
2373 {
2374 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
2375 
2376 	switch (arvif->vdev_type) {
2377 	case WMI_VDEV_TYPE_AP:
2378 		if (sta->wme)
2379 			arg->peer_flags |= arvif->ar->wmi.peer_flags->qos;
2380 
2381 		if (sta->wme && sta->uapsd_queues) {
2382 			arg->peer_flags |= arvif->ar->wmi.peer_flags->apsd;
2383 			arg->peer_rate_caps |= WMI_RC_UAPSD_FLAG;
2384 		}
2385 		break;
2386 	case WMI_VDEV_TYPE_STA:
2387 		if (vif->bss_conf.qos)
2388 			arg->peer_flags |= arvif->ar->wmi.peer_flags->qos;
2389 		break;
2390 	case WMI_VDEV_TYPE_IBSS:
2391 		if (sta->wme)
2392 			arg->peer_flags |= arvif->ar->wmi.peer_flags->qos;
2393 		break;
2394 	default:
2395 		break;
2396 	}
2397 
2398 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac peer %pM qos %d\n",
2399 		   sta->addr, !!(arg->peer_flags &
2400 		   arvif->ar->wmi.peer_flags->qos));
2401 }
2402 
2403 static bool ath10k_mac_sta_has_ofdm_only(struct ieee80211_sta *sta)
2404 {
2405 	return sta->supp_rates[IEEE80211_BAND_2GHZ] >>
2406 	       ATH10K_MAC_FIRST_OFDM_RATE_IDX;
2407 }
2408 
2409 static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
2410 					struct ieee80211_vif *vif,
2411 					struct ieee80211_sta *sta,
2412 					struct wmi_peer_assoc_complete_arg *arg)
2413 {
2414 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
2415 	struct cfg80211_chan_def def;
2416 	enum ieee80211_band band;
2417 	const u8 *ht_mcs_mask;
2418 	const u16 *vht_mcs_mask;
2419 	enum wmi_phy_mode phymode = MODE_UNKNOWN;
2420 
2421 	if (WARN_ON(ath10k_mac_vif_chan(vif, &def)))
2422 		return;
2423 
2424 	band = def.chan->band;
2425 	ht_mcs_mask = arvif->bitrate_mask.control[band].ht_mcs;
2426 	vht_mcs_mask = arvif->bitrate_mask.control[band].vht_mcs;
2427 
2428 	switch (band) {
2429 	case IEEE80211_BAND_2GHZ:
2430 		if (sta->vht_cap.vht_supported &&
2431 		    !ath10k_peer_assoc_h_vht_masked(vht_mcs_mask)) {
2432 			if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
2433 				phymode = MODE_11AC_VHT40;
2434 			else
2435 				phymode = MODE_11AC_VHT20;
2436 		} else if (sta->ht_cap.ht_supported &&
2437 			   !ath10k_peer_assoc_h_ht_masked(ht_mcs_mask)) {
2438 			if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
2439 				phymode = MODE_11NG_HT40;
2440 			else
2441 				phymode = MODE_11NG_HT20;
2442 		} else if (ath10k_mac_sta_has_ofdm_only(sta)) {
2443 			phymode = MODE_11G;
2444 		} else {
2445 			phymode = MODE_11B;
2446 		}
2447 
2448 		break;
2449 	case IEEE80211_BAND_5GHZ:
2450 		/*
2451 		 * Check VHT first.
2452 		 */
2453 		if (sta->vht_cap.vht_supported &&
2454 		    !ath10k_peer_assoc_h_vht_masked(vht_mcs_mask)) {
2455 			if (sta->bandwidth == IEEE80211_STA_RX_BW_80)
2456 				phymode = MODE_11AC_VHT80;
2457 			else if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
2458 				phymode = MODE_11AC_VHT40;
2459 			else if (sta->bandwidth == IEEE80211_STA_RX_BW_20)
2460 				phymode = MODE_11AC_VHT20;
2461 		} else if (sta->ht_cap.ht_supported &&
2462 			   !ath10k_peer_assoc_h_ht_masked(ht_mcs_mask)) {
2463 			if (sta->bandwidth >= IEEE80211_STA_RX_BW_40)
2464 				phymode = MODE_11NA_HT40;
2465 			else
2466 				phymode = MODE_11NA_HT20;
2467 		} else {
2468 			phymode = MODE_11A;
2469 		}
2470 
2471 		break;
2472 	default:
2473 		break;
2474 	}
2475 
2476 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac peer %pM phymode %s\n",
2477 		   sta->addr, ath10k_wmi_phymode_str(phymode));
2478 
2479 	arg->peer_phymode = phymode;
2480 	WARN_ON(phymode == MODE_UNKNOWN);
2481 }
2482 
2483 static int ath10k_peer_assoc_prepare(struct ath10k *ar,
2484 				     struct ieee80211_vif *vif,
2485 				     struct ieee80211_sta *sta,
2486 				     struct wmi_peer_assoc_complete_arg *arg)
2487 {
2488 	lockdep_assert_held(&ar->conf_mutex);
2489 
2490 	memset(arg, 0, sizeof(*arg));
2491 
2492 	ath10k_peer_assoc_h_basic(ar, vif, sta, arg);
2493 	ath10k_peer_assoc_h_crypto(ar, vif, sta, arg);
2494 	ath10k_peer_assoc_h_rates(ar, vif, sta, arg);
2495 	ath10k_peer_assoc_h_ht(ar, vif, sta, arg);
2496 	ath10k_peer_assoc_h_vht(ar, vif, sta, arg);
2497 	ath10k_peer_assoc_h_qos(ar, vif, sta, arg);
2498 	ath10k_peer_assoc_h_phymode(ar, vif, sta, arg);
2499 
2500 	return 0;
2501 }
2502 
2503 static const u32 ath10k_smps_map[] = {
2504 	[WLAN_HT_CAP_SM_PS_STATIC] = WMI_PEER_SMPS_STATIC,
2505 	[WLAN_HT_CAP_SM_PS_DYNAMIC] = WMI_PEER_SMPS_DYNAMIC,
2506 	[WLAN_HT_CAP_SM_PS_INVALID] = WMI_PEER_SMPS_PS_NONE,
2507 	[WLAN_HT_CAP_SM_PS_DISABLED] = WMI_PEER_SMPS_PS_NONE,
2508 };
2509 
2510 static int ath10k_setup_peer_smps(struct ath10k *ar, struct ath10k_vif *arvif,
2511 				  const u8 *addr,
2512 				  const struct ieee80211_sta_ht_cap *ht_cap)
2513 {
2514 	int smps;
2515 
2516 	if (!ht_cap->ht_supported)
2517 		return 0;
2518 
2519 	smps = ht_cap->cap & IEEE80211_HT_CAP_SM_PS;
2520 	smps >>= IEEE80211_HT_CAP_SM_PS_SHIFT;
2521 
2522 	if (smps >= ARRAY_SIZE(ath10k_smps_map))
2523 		return -EINVAL;
2524 
2525 	return ath10k_wmi_peer_set_param(ar, arvif->vdev_id, addr,
2526 					 WMI_PEER_SMPS_STATE,
2527 					 ath10k_smps_map[smps]);
2528 }
2529 
2530 static int ath10k_mac_vif_recalc_txbf(struct ath10k *ar,
2531 				      struct ieee80211_vif *vif,
2532 				      struct ieee80211_sta_vht_cap vht_cap)
2533 {
2534 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
2535 	int ret;
2536 	u32 param;
2537 	u32 value;
2538 
2539 	if (ath10k_wmi_get_txbf_conf_scheme(ar) != WMI_TXBF_CONF_AFTER_ASSOC)
2540 		return 0;
2541 
2542 	if (!(ar->vht_cap_info &
2543 	      (IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
2544 	       IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE |
2545 	       IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
2546 	       IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
2547 		return 0;
2548 
2549 	param = ar->wmi.vdev_param->txbf;
2550 	value = 0;
2551 
2552 	if (WARN_ON(param == WMI_VDEV_PARAM_UNSUPPORTED))
2553 		return 0;
2554 
2555 	/* The following logic is correct. If a remote STA advertises support
2556 	 * for being a beamformer then we should enable us being a beamformee.
2557 	 */
2558 
2559 	if (ar->vht_cap_info &
2560 	    (IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
2561 	     IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE)) {
2562 		if (vht_cap.cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)
2563 			value |= WMI_VDEV_PARAM_TXBF_SU_TX_BFEE;
2564 
2565 		if (vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)
2566 			value |= WMI_VDEV_PARAM_TXBF_MU_TX_BFEE;
2567 	}
2568 
2569 	if (ar->vht_cap_info &
2570 	    (IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
2571 	     IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)) {
2572 		if (vht_cap.cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE)
2573 			value |= WMI_VDEV_PARAM_TXBF_SU_TX_BFER;
2574 
2575 		if (vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE)
2576 			value |= WMI_VDEV_PARAM_TXBF_MU_TX_BFER;
2577 	}
2578 
2579 	if (value & WMI_VDEV_PARAM_TXBF_MU_TX_BFEE)
2580 		value |= WMI_VDEV_PARAM_TXBF_SU_TX_BFEE;
2581 
2582 	if (value & WMI_VDEV_PARAM_TXBF_MU_TX_BFER)
2583 		value |= WMI_VDEV_PARAM_TXBF_SU_TX_BFER;
2584 
2585 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, param, value);
2586 	if (ret) {
2587 		ath10k_warn(ar, "failed to submit vdev param txbf 0x%x: %d\n",
2588 			    value, ret);
2589 		return ret;
2590 	}
2591 
2592 	return 0;
2593 }
2594 
2595 /* can be called only in mac80211 callbacks due to `key_count` usage */
2596 static void ath10k_bss_assoc(struct ieee80211_hw *hw,
2597 			     struct ieee80211_vif *vif,
2598 			     struct ieee80211_bss_conf *bss_conf)
2599 {
2600 	struct ath10k *ar = hw->priv;
2601 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
2602 	struct ieee80211_sta_ht_cap ht_cap;
2603 	struct ieee80211_sta_vht_cap vht_cap;
2604 	struct wmi_peer_assoc_complete_arg peer_arg;
2605 	struct ieee80211_sta *ap_sta;
2606 	int ret;
2607 
2608 	lockdep_assert_held(&ar->conf_mutex);
2609 
2610 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %i assoc bssid %pM aid %d\n",
2611 		   arvif->vdev_id, arvif->bssid, arvif->aid);
2612 
2613 	rcu_read_lock();
2614 
2615 	ap_sta = ieee80211_find_sta(vif, bss_conf->bssid);
2616 	if (!ap_sta) {
2617 		ath10k_warn(ar, "failed to find station entry for bss %pM vdev %i\n",
2618 			    bss_conf->bssid, arvif->vdev_id);
2619 		rcu_read_unlock();
2620 		return;
2621 	}
2622 
2623 	/* ap_sta must be accessed only within rcu section which must be left
2624 	 * before calling ath10k_setup_peer_smps() which might sleep. */
2625 	ht_cap = ap_sta->ht_cap;
2626 	vht_cap = ap_sta->vht_cap;
2627 
2628 	ret = ath10k_peer_assoc_prepare(ar, vif, ap_sta, &peer_arg);
2629 	if (ret) {
2630 		ath10k_warn(ar, "failed to prepare peer assoc for %pM vdev %i: %d\n",
2631 			    bss_conf->bssid, arvif->vdev_id, ret);
2632 		rcu_read_unlock();
2633 		return;
2634 	}
2635 
2636 	rcu_read_unlock();
2637 
2638 	ret = ath10k_wmi_peer_assoc(ar, &peer_arg);
2639 	if (ret) {
2640 		ath10k_warn(ar, "failed to run peer assoc for %pM vdev %i: %d\n",
2641 			    bss_conf->bssid, arvif->vdev_id, ret);
2642 		return;
2643 	}
2644 
2645 	ret = ath10k_setup_peer_smps(ar, arvif, bss_conf->bssid, &ht_cap);
2646 	if (ret) {
2647 		ath10k_warn(ar, "failed to setup peer SMPS for vdev %i: %d\n",
2648 			    arvif->vdev_id, ret);
2649 		return;
2650 	}
2651 
2652 	ret = ath10k_mac_vif_recalc_txbf(ar, vif, vht_cap);
2653 	if (ret) {
2654 		ath10k_warn(ar, "failed to recalc txbf for vdev %i on bss %pM: %d\n",
2655 			    arvif->vdev_id, bss_conf->bssid, ret);
2656 		return;
2657 	}
2658 
2659 	ath10k_dbg(ar, ATH10K_DBG_MAC,
2660 		   "mac vdev %d up (associated) bssid %pM aid %d\n",
2661 		   arvif->vdev_id, bss_conf->bssid, bss_conf->aid);
2662 
2663 	WARN_ON(arvif->is_up);
2664 
2665 	arvif->aid = bss_conf->aid;
2666 	ether_addr_copy(arvif->bssid, bss_conf->bssid);
2667 
2668 	ret = ath10k_wmi_vdev_up(ar, arvif->vdev_id, arvif->aid, arvif->bssid);
2669 	if (ret) {
2670 		ath10k_warn(ar, "failed to set vdev %d up: %d\n",
2671 			    arvif->vdev_id, ret);
2672 		return;
2673 	}
2674 
2675 	arvif->is_up = true;
2676 
2677 	/* Workaround: Some firmware revisions (tested with qca6174
2678 	 * WLAN.RM.2.0-00073) have buggy powersave state machine and must be
2679 	 * poked with peer param command.
2680 	 */
2681 	ret = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, arvif->bssid,
2682 					WMI_PEER_DUMMY_VAR, 1);
2683 	if (ret) {
2684 		ath10k_warn(ar, "failed to poke peer %pM param for ps workaround on vdev %i: %d\n",
2685 			    arvif->bssid, arvif->vdev_id, ret);
2686 		return;
2687 	}
2688 }
2689 
2690 static void ath10k_bss_disassoc(struct ieee80211_hw *hw,
2691 				struct ieee80211_vif *vif)
2692 {
2693 	struct ath10k *ar = hw->priv;
2694 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
2695 	struct ieee80211_sta_vht_cap vht_cap = {};
2696 	int ret;
2697 
2698 	lockdep_assert_held(&ar->conf_mutex);
2699 
2700 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %i disassoc bssid %pM\n",
2701 		   arvif->vdev_id, arvif->bssid);
2702 
2703 	ret = ath10k_wmi_vdev_down(ar, arvif->vdev_id);
2704 	if (ret)
2705 		ath10k_warn(ar, "faield to down vdev %i: %d\n",
2706 			    arvif->vdev_id, ret);
2707 
2708 	arvif->def_wep_key_idx = -1;
2709 
2710 	ret = ath10k_mac_vif_recalc_txbf(ar, vif, vht_cap);
2711 	if (ret) {
2712 		ath10k_warn(ar, "failed to recalc txbf for vdev %i: %d\n",
2713 			    arvif->vdev_id, ret);
2714 		return;
2715 	}
2716 
2717 	arvif->is_up = false;
2718 
2719 	cancel_delayed_work_sync(&arvif->connection_loss_work);
2720 }
2721 
2722 static int ath10k_station_assoc(struct ath10k *ar,
2723 				struct ieee80211_vif *vif,
2724 				struct ieee80211_sta *sta,
2725 				bool reassoc)
2726 {
2727 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
2728 	struct wmi_peer_assoc_complete_arg peer_arg;
2729 	int ret = 0;
2730 
2731 	lockdep_assert_held(&ar->conf_mutex);
2732 
2733 	ret = ath10k_peer_assoc_prepare(ar, vif, sta, &peer_arg);
2734 	if (ret) {
2735 		ath10k_warn(ar, "failed to prepare WMI peer assoc for %pM vdev %i: %i\n",
2736 			    sta->addr, arvif->vdev_id, ret);
2737 		return ret;
2738 	}
2739 
2740 	ret = ath10k_wmi_peer_assoc(ar, &peer_arg);
2741 	if (ret) {
2742 		ath10k_warn(ar, "failed to run peer assoc for STA %pM vdev %i: %d\n",
2743 			    sta->addr, arvif->vdev_id, ret);
2744 		return ret;
2745 	}
2746 
2747 	/* Re-assoc is run only to update supported rates for given station. It
2748 	 * doesn't make much sense to reconfigure the peer completely.
2749 	 */
2750 	if (!reassoc) {
2751 		ret = ath10k_setup_peer_smps(ar, arvif, sta->addr,
2752 					     &sta->ht_cap);
2753 		if (ret) {
2754 			ath10k_warn(ar, "failed to setup peer SMPS for vdev %d: %d\n",
2755 				    arvif->vdev_id, ret);
2756 			return ret;
2757 		}
2758 
2759 		ret = ath10k_peer_assoc_qos_ap(ar, arvif, sta);
2760 		if (ret) {
2761 			ath10k_warn(ar, "failed to set qos params for STA %pM for vdev %i: %d\n",
2762 				    sta->addr, arvif->vdev_id, ret);
2763 			return ret;
2764 		}
2765 
2766 		if (!sta->wme) {
2767 			arvif->num_legacy_stations++;
2768 			ret  = ath10k_recalc_rtscts_prot(arvif);
2769 			if (ret) {
2770 				ath10k_warn(ar, "failed to recalculate rts/cts prot for vdev %d: %d\n",
2771 					    arvif->vdev_id, ret);
2772 				return ret;
2773 			}
2774 		}
2775 
2776 		/* Plumb cached keys only for static WEP */
2777 		if (arvif->def_wep_key_idx != -1) {
2778 			ret = ath10k_install_peer_wep_keys(arvif, sta->addr);
2779 			if (ret) {
2780 				ath10k_warn(ar, "failed to install peer wep keys for vdev %i: %d\n",
2781 					    arvif->vdev_id, ret);
2782 				return ret;
2783 			}
2784 		}
2785 	}
2786 
2787 	return ret;
2788 }
2789 
2790 static int ath10k_station_disassoc(struct ath10k *ar,
2791 				   struct ieee80211_vif *vif,
2792 				   struct ieee80211_sta *sta)
2793 {
2794 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
2795 	int ret = 0;
2796 
2797 	lockdep_assert_held(&ar->conf_mutex);
2798 
2799 	if (!sta->wme) {
2800 		arvif->num_legacy_stations--;
2801 		ret = ath10k_recalc_rtscts_prot(arvif);
2802 		if (ret) {
2803 			ath10k_warn(ar, "failed to recalculate rts/cts prot for vdev %d: %d\n",
2804 				    arvif->vdev_id, ret);
2805 			return ret;
2806 		}
2807 	}
2808 
2809 	ret = ath10k_clear_peer_keys(arvif, sta->addr);
2810 	if (ret) {
2811 		ath10k_warn(ar, "failed to clear all peer wep keys for vdev %i: %d\n",
2812 			    arvif->vdev_id, ret);
2813 		return ret;
2814 	}
2815 
2816 	return ret;
2817 }
2818 
2819 /**************/
2820 /* Regulatory */
2821 /**************/
2822 
2823 static int ath10k_update_channel_list(struct ath10k *ar)
2824 {
2825 	struct ieee80211_hw *hw = ar->hw;
2826 	struct ieee80211_supported_band **bands;
2827 	enum ieee80211_band band;
2828 	struct ieee80211_channel *channel;
2829 	struct wmi_scan_chan_list_arg arg = {0};
2830 	struct wmi_channel_arg *ch;
2831 	bool passive;
2832 	int len;
2833 	int ret;
2834 	int i;
2835 
2836 	lockdep_assert_held(&ar->conf_mutex);
2837 
2838 	bands = hw->wiphy->bands;
2839 	for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2840 		if (!bands[band])
2841 			continue;
2842 
2843 		for (i = 0; i < bands[band]->n_channels; i++) {
2844 			if (bands[band]->channels[i].flags &
2845 			    IEEE80211_CHAN_DISABLED)
2846 				continue;
2847 
2848 			arg.n_channels++;
2849 		}
2850 	}
2851 
2852 	len = sizeof(struct wmi_channel_arg) * arg.n_channels;
2853 	arg.channels = kzalloc(len, GFP_KERNEL);
2854 	if (!arg.channels)
2855 		return -ENOMEM;
2856 
2857 	ch = arg.channels;
2858 	for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2859 		if (!bands[band])
2860 			continue;
2861 
2862 		for (i = 0; i < bands[band]->n_channels; i++) {
2863 			channel = &bands[band]->channels[i];
2864 
2865 			if (channel->flags & IEEE80211_CHAN_DISABLED)
2866 				continue;
2867 
2868 			ch->allow_ht   = true;
2869 
2870 			/* FIXME: when should we really allow VHT? */
2871 			ch->allow_vht = true;
2872 
2873 			ch->allow_ibss =
2874 				!(channel->flags & IEEE80211_CHAN_NO_IR);
2875 
2876 			ch->ht40plus =
2877 				!(channel->flags & IEEE80211_CHAN_NO_HT40PLUS);
2878 
2879 			ch->chan_radar =
2880 				!!(channel->flags & IEEE80211_CHAN_RADAR);
2881 
2882 			passive = channel->flags & IEEE80211_CHAN_NO_IR;
2883 			ch->passive = passive;
2884 
2885 			ch->freq = channel->center_freq;
2886 			ch->band_center_freq1 = channel->center_freq;
2887 			ch->min_power = 0;
2888 			ch->max_power = channel->max_power * 2;
2889 			ch->max_reg_power = channel->max_reg_power * 2;
2890 			ch->max_antenna_gain = channel->max_antenna_gain * 2;
2891 			ch->reg_class_id = 0; /* FIXME */
2892 
2893 			/* FIXME: why use only legacy modes, why not any
2894 			 * HT/VHT modes? Would that even make any
2895 			 * difference? */
2896 			if (channel->band == IEEE80211_BAND_2GHZ)
2897 				ch->mode = MODE_11G;
2898 			else
2899 				ch->mode = MODE_11A;
2900 
2901 			if (WARN_ON_ONCE(ch->mode == MODE_UNKNOWN))
2902 				continue;
2903 
2904 			ath10k_dbg(ar, ATH10K_DBG_WMI,
2905 				   "mac channel [%zd/%d] freq %d maxpower %d regpower %d antenna %d mode %d\n",
2906 				    ch - arg.channels, arg.n_channels,
2907 				   ch->freq, ch->max_power, ch->max_reg_power,
2908 				   ch->max_antenna_gain, ch->mode);
2909 
2910 			ch++;
2911 		}
2912 	}
2913 
2914 	ret = ath10k_wmi_scan_chan_list(ar, &arg);
2915 	kfree(arg.channels);
2916 
2917 	return ret;
2918 }
2919 
2920 static enum wmi_dfs_region
2921 ath10k_mac_get_dfs_region(enum nl80211_dfs_regions dfs_region)
2922 {
2923 	switch (dfs_region) {
2924 	case NL80211_DFS_UNSET:
2925 		return WMI_UNINIT_DFS_DOMAIN;
2926 	case NL80211_DFS_FCC:
2927 		return WMI_FCC_DFS_DOMAIN;
2928 	case NL80211_DFS_ETSI:
2929 		return WMI_ETSI_DFS_DOMAIN;
2930 	case NL80211_DFS_JP:
2931 		return WMI_MKK4_DFS_DOMAIN;
2932 	}
2933 	return WMI_UNINIT_DFS_DOMAIN;
2934 }
2935 
2936 static void ath10k_regd_update(struct ath10k *ar)
2937 {
2938 	struct reg_dmn_pair_mapping *regpair;
2939 	int ret;
2940 	enum wmi_dfs_region wmi_dfs_reg;
2941 	enum nl80211_dfs_regions nl_dfs_reg;
2942 
2943 	lockdep_assert_held(&ar->conf_mutex);
2944 
2945 	ret = ath10k_update_channel_list(ar);
2946 	if (ret)
2947 		ath10k_warn(ar, "failed to update channel list: %d\n", ret);
2948 
2949 	regpair = ar->ath_common.regulatory.regpair;
2950 
2951 	if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED) && ar->dfs_detector) {
2952 		nl_dfs_reg = ar->dfs_detector->region;
2953 		wmi_dfs_reg = ath10k_mac_get_dfs_region(nl_dfs_reg);
2954 	} else {
2955 		wmi_dfs_reg = WMI_UNINIT_DFS_DOMAIN;
2956 	}
2957 
2958 	/* Target allows setting up per-band regdomain but ath_common provides
2959 	 * a combined one only */
2960 	ret = ath10k_wmi_pdev_set_regdomain(ar,
2961 					    regpair->reg_domain,
2962 					    regpair->reg_domain, /* 2ghz */
2963 					    regpair->reg_domain, /* 5ghz */
2964 					    regpair->reg_2ghz_ctl,
2965 					    regpair->reg_5ghz_ctl,
2966 					    wmi_dfs_reg);
2967 	if (ret)
2968 		ath10k_warn(ar, "failed to set pdev regdomain: %d\n", ret);
2969 }
2970 
2971 static void ath10k_reg_notifier(struct wiphy *wiphy,
2972 				struct regulatory_request *request)
2973 {
2974 	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
2975 	struct ath10k *ar = hw->priv;
2976 	bool result;
2977 
2978 	ath_reg_notifier_apply(wiphy, request, &ar->ath_common.regulatory);
2979 
2980 	if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED) && ar->dfs_detector) {
2981 		ath10k_dbg(ar, ATH10K_DBG_REGULATORY, "dfs region 0x%x\n",
2982 			   request->dfs_region);
2983 		result = ar->dfs_detector->set_dfs_domain(ar->dfs_detector,
2984 							  request->dfs_region);
2985 		if (!result)
2986 			ath10k_warn(ar, "DFS region 0x%X not supported, will trigger radar for every pulse\n",
2987 				    request->dfs_region);
2988 	}
2989 
2990 	mutex_lock(&ar->conf_mutex);
2991 	if (ar->state == ATH10K_STATE_ON)
2992 		ath10k_regd_update(ar);
2993 	mutex_unlock(&ar->conf_mutex);
2994 }
2995 
2996 /***************/
2997 /* TX handlers */
2998 /***************/
2999 
3000 void ath10k_mac_tx_lock(struct ath10k *ar, int reason)
3001 {
3002 	lockdep_assert_held(&ar->htt.tx_lock);
3003 
3004 	WARN_ON(reason >= ATH10K_TX_PAUSE_MAX);
3005 	ar->tx_paused |= BIT(reason);
3006 	ieee80211_stop_queues(ar->hw);
3007 }
3008 
3009 static void ath10k_mac_tx_unlock_iter(void *data, u8 *mac,
3010 				      struct ieee80211_vif *vif)
3011 {
3012 	struct ath10k *ar = data;
3013 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
3014 
3015 	if (arvif->tx_paused)
3016 		return;
3017 
3018 	ieee80211_wake_queue(ar->hw, arvif->vdev_id);
3019 }
3020 
3021 void ath10k_mac_tx_unlock(struct ath10k *ar, int reason)
3022 {
3023 	lockdep_assert_held(&ar->htt.tx_lock);
3024 
3025 	WARN_ON(reason >= ATH10K_TX_PAUSE_MAX);
3026 	ar->tx_paused &= ~BIT(reason);
3027 
3028 	if (ar->tx_paused)
3029 		return;
3030 
3031 	ieee80211_iterate_active_interfaces_atomic(ar->hw,
3032 						   IEEE80211_IFACE_ITER_RESUME_ALL,
3033 						   ath10k_mac_tx_unlock_iter,
3034 						   ar);
3035 
3036 	ieee80211_wake_queue(ar->hw, ar->hw->offchannel_tx_hw_queue);
3037 }
3038 
3039 void ath10k_mac_vif_tx_lock(struct ath10k_vif *arvif, int reason)
3040 {
3041 	struct ath10k *ar = arvif->ar;
3042 
3043 	lockdep_assert_held(&ar->htt.tx_lock);
3044 
3045 	WARN_ON(reason >= BITS_PER_LONG);
3046 	arvif->tx_paused |= BIT(reason);
3047 	ieee80211_stop_queue(ar->hw, arvif->vdev_id);
3048 }
3049 
3050 void ath10k_mac_vif_tx_unlock(struct ath10k_vif *arvif, int reason)
3051 {
3052 	struct ath10k *ar = arvif->ar;
3053 
3054 	lockdep_assert_held(&ar->htt.tx_lock);
3055 
3056 	WARN_ON(reason >= BITS_PER_LONG);
3057 	arvif->tx_paused &= ~BIT(reason);
3058 
3059 	if (ar->tx_paused)
3060 		return;
3061 
3062 	if (arvif->tx_paused)
3063 		return;
3064 
3065 	ieee80211_wake_queue(ar->hw, arvif->vdev_id);
3066 }
3067 
3068 static void ath10k_mac_vif_handle_tx_pause(struct ath10k_vif *arvif,
3069 					   enum wmi_tlv_tx_pause_id pause_id,
3070 					   enum wmi_tlv_tx_pause_action action)
3071 {
3072 	struct ath10k *ar = arvif->ar;
3073 
3074 	lockdep_assert_held(&ar->htt.tx_lock);
3075 
3076 	switch (action) {
3077 	case WMI_TLV_TX_PAUSE_ACTION_STOP:
3078 		ath10k_mac_vif_tx_lock(arvif, pause_id);
3079 		break;
3080 	case WMI_TLV_TX_PAUSE_ACTION_WAKE:
3081 		ath10k_mac_vif_tx_unlock(arvif, pause_id);
3082 		break;
3083 	default:
3084 		ath10k_warn(ar, "received unknown tx pause action %d on vdev %i, ignoring\n",
3085 			    action, arvif->vdev_id);
3086 		break;
3087 	}
3088 }
3089 
3090 struct ath10k_mac_tx_pause {
3091 	u32 vdev_id;
3092 	enum wmi_tlv_tx_pause_id pause_id;
3093 	enum wmi_tlv_tx_pause_action action;
3094 };
3095 
3096 static void ath10k_mac_handle_tx_pause_iter(void *data, u8 *mac,
3097 					    struct ieee80211_vif *vif)
3098 {
3099 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
3100 	struct ath10k_mac_tx_pause *arg = data;
3101 
3102 	if (arvif->vdev_id != arg->vdev_id)
3103 		return;
3104 
3105 	ath10k_mac_vif_handle_tx_pause(arvif, arg->pause_id, arg->action);
3106 }
3107 
3108 void ath10k_mac_handle_tx_pause_vdev(struct ath10k *ar, u32 vdev_id,
3109 				     enum wmi_tlv_tx_pause_id pause_id,
3110 				     enum wmi_tlv_tx_pause_action action)
3111 {
3112 	struct ath10k_mac_tx_pause arg = {
3113 		.vdev_id = vdev_id,
3114 		.pause_id = pause_id,
3115 		.action = action,
3116 	};
3117 
3118 	spin_lock_bh(&ar->htt.tx_lock);
3119 	ieee80211_iterate_active_interfaces_atomic(ar->hw,
3120 						   IEEE80211_IFACE_ITER_RESUME_ALL,
3121 						   ath10k_mac_handle_tx_pause_iter,
3122 						   &arg);
3123 	spin_unlock_bh(&ar->htt.tx_lock);
3124 }
3125 
3126 static enum ath10k_hw_txrx_mode
3127 ath10k_mac_tx_h_get_txmode(struct ath10k *ar,
3128 			   struct ieee80211_vif *vif,
3129 			   struct ieee80211_sta *sta,
3130 			   struct sk_buff *skb)
3131 {
3132 	const struct ieee80211_hdr *hdr = (void *)skb->data;
3133 	__le16 fc = hdr->frame_control;
3134 
3135 	if (!vif || vif->type == NL80211_IFTYPE_MONITOR)
3136 		return ATH10K_HW_TXRX_RAW;
3137 
3138 	if (ieee80211_is_mgmt(fc))
3139 		return ATH10K_HW_TXRX_MGMT;
3140 
3141 	/* Workaround:
3142 	 *
3143 	 * NullFunc frames are mostly used to ping if a client or AP are still
3144 	 * reachable and responsive. This implies tx status reports must be
3145 	 * accurate - otherwise either mac80211 or userspace (e.g. hostapd) can
3146 	 * come to a conclusion that the other end disappeared and tear down
3147 	 * BSS connection or it can never disconnect from BSS/client (which is
3148 	 * the case).
3149 	 *
3150 	 * Firmware with HTT older than 3.0 delivers incorrect tx status for
3151 	 * NullFunc frames to driver. However there's a HTT Mgmt Tx command
3152 	 * which seems to deliver correct tx reports for NullFunc frames. The
3153 	 * downside of using it is it ignores client powersave state so it can
3154 	 * end up disconnecting sleeping clients in AP mode. It should fix STA
3155 	 * mode though because AP don't sleep.
3156 	 */
3157 	if (ar->htt.target_version_major < 3 &&
3158 	    (ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc)) &&
3159 	    !test_bit(ATH10K_FW_FEATURE_HAS_WMI_MGMT_TX, ar->fw_features))
3160 		return ATH10K_HW_TXRX_MGMT;
3161 
3162 	/* Workaround:
3163 	 *
3164 	 * Some wmi-tlv firmwares for qca6174 have broken Tx key selection for
3165 	 * NativeWifi txmode - it selects AP key instead of peer key. It seems
3166 	 * to work with Ethernet txmode so use it.
3167 	 *
3168 	 * FIXME: Check if raw mode works with TDLS.
3169 	 */
3170 	if (ieee80211_is_data_present(fc) && sta && sta->tdls)
3171 		return ATH10K_HW_TXRX_ETHERNET;
3172 
3173 	if (test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags))
3174 		return ATH10K_HW_TXRX_RAW;
3175 
3176 	return ATH10K_HW_TXRX_NATIVE_WIFI;
3177 }
3178 
3179 static bool ath10k_tx_h_use_hwcrypto(struct ieee80211_vif *vif,
3180 				     struct sk_buff *skb)
3181 {
3182 	const struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
3183 	const struct ieee80211_hdr *hdr = (void *)skb->data;
3184 	const u32 mask = IEEE80211_TX_INTFL_DONT_ENCRYPT |
3185 			 IEEE80211_TX_CTL_INJECTED;
3186 
3187 	if (!ieee80211_has_protected(hdr->frame_control))
3188 		return false;
3189 
3190 	if ((info->flags & mask) == mask)
3191 		return false;
3192 
3193 	if (vif)
3194 		return !ath10k_vif_to_arvif(vif)->nohwcrypt;
3195 
3196 	return true;
3197 }
3198 
3199 /* HTT Tx uses Native Wifi tx mode which expects 802.11 frames without QoS
3200  * Control in the header.
3201  */
3202 static void ath10k_tx_h_nwifi(struct ieee80211_hw *hw, struct sk_buff *skb)
3203 {
3204 	struct ieee80211_hdr *hdr = (void *)skb->data;
3205 	struct ath10k_skb_cb *cb = ATH10K_SKB_CB(skb);
3206 	u8 *qos_ctl;
3207 
3208 	if (!ieee80211_is_data_qos(hdr->frame_control))
3209 		return;
3210 
3211 	qos_ctl = ieee80211_get_qos_ctl(hdr);
3212 	memmove(skb->data + IEEE80211_QOS_CTL_LEN,
3213 		skb->data, (void *)qos_ctl - (void *)skb->data);
3214 	skb_pull(skb, IEEE80211_QOS_CTL_LEN);
3215 
3216 	/* Some firmware revisions don't handle sending QoS NullFunc well.
3217 	 * These frames are mainly used for CQM purposes so it doesn't really
3218 	 * matter whether QoS NullFunc or NullFunc are sent.
3219 	 */
3220 	hdr = (void *)skb->data;
3221 	if (ieee80211_is_qos_nullfunc(hdr->frame_control))
3222 		cb->flags &= ~ATH10K_SKB_F_QOS;
3223 
3224 	hdr->frame_control &= ~__cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
3225 }
3226 
3227 static void ath10k_tx_h_8023(struct sk_buff *skb)
3228 {
3229 	struct ieee80211_hdr *hdr;
3230 	struct rfc1042_hdr *rfc1042;
3231 	struct ethhdr *eth;
3232 	size_t hdrlen;
3233 	u8 da[ETH_ALEN];
3234 	u8 sa[ETH_ALEN];
3235 	__be16 type;
3236 
3237 	hdr = (void *)skb->data;
3238 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
3239 	rfc1042 = (void *)skb->data + hdrlen;
3240 
3241 	ether_addr_copy(da, ieee80211_get_DA(hdr));
3242 	ether_addr_copy(sa, ieee80211_get_SA(hdr));
3243 	type = rfc1042->snap_type;
3244 
3245 	skb_pull(skb, hdrlen + sizeof(*rfc1042));
3246 	skb_push(skb, sizeof(*eth));
3247 
3248 	eth = (void *)skb->data;
3249 	ether_addr_copy(eth->h_dest, da);
3250 	ether_addr_copy(eth->h_source, sa);
3251 	eth->h_proto = type;
3252 }
3253 
3254 static void ath10k_tx_h_add_p2p_noa_ie(struct ath10k *ar,
3255 				       struct ieee80211_vif *vif,
3256 				       struct sk_buff *skb)
3257 {
3258 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
3259 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
3260 
3261 	/* This is case only for P2P_GO */
3262 	if (arvif->vdev_type != WMI_VDEV_TYPE_AP ||
3263 	    arvif->vdev_subtype != WMI_VDEV_SUBTYPE_P2P_GO)
3264 		return;
3265 
3266 	if (unlikely(ieee80211_is_probe_resp(hdr->frame_control))) {
3267 		spin_lock_bh(&ar->data_lock);
3268 		if (arvif->u.ap.noa_data)
3269 			if (!pskb_expand_head(skb, 0, arvif->u.ap.noa_len,
3270 					      GFP_ATOMIC))
3271 				memcpy(skb_put(skb, arvif->u.ap.noa_len),
3272 				       arvif->u.ap.noa_data,
3273 				       arvif->u.ap.noa_len);
3274 		spin_unlock_bh(&ar->data_lock);
3275 	}
3276 }
3277 
3278 bool ath10k_mac_tx_frm_has_freq(struct ath10k *ar)
3279 {
3280 	/* FIXME: Not really sure since when the behaviour changed. At some
3281 	 * point new firmware stopped requiring creation of peer entries for
3282 	 * offchannel tx (and actually creating them causes issues with wmi-htc
3283 	 * tx credit replenishment and reliability). Assuming it's at least 3.4
3284 	 * because that's when the `freq` was introduced to TX_FRM HTT command.
3285 	 */
3286 	return (ar->htt.target_version_major >= 3 &&
3287 		ar->htt.target_version_minor >= 4 &&
3288 		ar->htt.op_version == ATH10K_FW_HTT_OP_VERSION_TLV);
3289 }
3290 
3291 static int ath10k_mac_tx_wmi_mgmt(struct ath10k *ar, struct sk_buff *skb)
3292 {
3293 	struct sk_buff_head *q = &ar->wmi_mgmt_tx_queue;
3294 	int ret = 0;
3295 
3296 	spin_lock_bh(&ar->data_lock);
3297 
3298 	if (skb_queue_len(q) == ATH10K_MAX_NUM_MGMT_PENDING) {
3299 		ath10k_warn(ar, "wmi mgmt tx queue is full\n");
3300 		ret = -ENOSPC;
3301 		goto unlock;
3302 	}
3303 
3304 	__skb_queue_tail(q, skb);
3305 	ieee80211_queue_work(ar->hw, &ar->wmi_mgmt_tx_work);
3306 
3307 unlock:
3308 	spin_unlock_bh(&ar->data_lock);
3309 
3310 	return ret;
3311 }
3312 
3313 static void ath10k_mac_tx(struct ath10k *ar, enum ath10k_hw_txrx_mode txmode,
3314 			  struct sk_buff *skb)
3315 {
3316 	struct ath10k_htt *htt = &ar->htt;
3317 	int ret = 0;
3318 
3319 	switch (txmode) {
3320 	case ATH10K_HW_TXRX_RAW:
3321 	case ATH10K_HW_TXRX_NATIVE_WIFI:
3322 	case ATH10K_HW_TXRX_ETHERNET:
3323 		ret = ath10k_htt_tx(htt, txmode, skb);
3324 		break;
3325 	case ATH10K_HW_TXRX_MGMT:
3326 		if (test_bit(ATH10K_FW_FEATURE_HAS_WMI_MGMT_TX,
3327 			     ar->fw_features))
3328 			ret = ath10k_mac_tx_wmi_mgmt(ar, skb);
3329 		else if (ar->htt.target_version_major >= 3)
3330 			ret = ath10k_htt_tx(htt, txmode, skb);
3331 		else
3332 			ret = ath10k_htt_mgmt_tx(htt, skb);
3333 		break;
3334 	}
3335 
3336 	if (ret) {
3337 		ath10k_warn(ar, "failed to transmit packet, dropping: %d\n",
3338 			    ret);
3339 		ieee80211_free_txskb(ar->hw, skb);
3340 	}
3341 }
3342 
3343 void ath10k_offchan_tx_purge(struct ath10k *ar)
3344 {
3345 	struct sk_buff *skb;
3346 
3347 	for (;;) {
3348 		skb = skb_dequeue(&ar->offchan_tx_queue);
3349 		if (!skb)
3350 			break;
3351 
3352 		ieee80211_free_txskb(ar->hw, skb);
3353 	}
3354 }
3355 
3356 void ath10k_offchan_tx_work(struct work_struct *work)
3357 {
3358 	struct ath10k *ar = container_of(work, struct ath10k, offchan_tx_work);
3359 	struct ath10k_peer *peer;
3360 	struct ath10k_vif *arvif;
3361 	struct ieee80211_hdr *hdr;
3362 	struct ieee80211_vif *vif;
3363 	struct ieee80211_sta *sta;
3364 	struct sk_buff *skb;
3365 	const u8 *peer_addr;
3366 	enum ath10k_hw_txrx_mode txmode;
3367 	int vdev_id;
3368 	int ret;
3369 	unsigned long time_left;
3370 	bool tmp_peer_created = false;
3371 
3372 	/* FW requirement: We must create a peer before FW will send out
3373 	 * an offchannel frame. Otherwise the frame will be stuck and
3374 	 * never transmitted. We delete the peer upon tx completion.
3375 	 * It is unlikely that a peer for offchannel tx will already be
3376 	 * present. However it may be in some rare cases so account for that.
3377 	 * Otherwise we might remove a legitimate peer and break stuff. */
3378 
3379 	for (;;) {
3380 		skb = skb_dequeue(&ar->offchan_tx_queue);
3381 		if (!skb)
3382 			break;
3383 
3384 		mutex_lock(&ar->conf_mutex);
3385 
3386 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac offchannel skb %p\n",
3387 			   skb);
3388 
3389 		hdr = (struct ieee80211_hdr *)skb->data;
3390 		peer_addr = ieee80211_get_DA(hdr);
3391 
3392 		spin_lock_bh(&ar->data_lock);
3393 		vdev_id = ar->scan.vdev_id;
3394 		peer = ath10k_peer_find(ar, vdev_id, peer_addr);
3395 		spin_unlock_bh(&ar->data_lock);
3396 
3397 		if (peer)
3398 			/* FIXME: should this use ath10k_warn()? */
3399 			ath10k_dbg(ar, ATH10K_DBG_MAC, "peer %pM on vdev %d already present\n",
3400 				   peer_addr, vdev_id);
3401 
3402 		if (!peer) {
3403 			ret = ath10k_peer_create(ar, vdev_id, peer_addr,
3404 						 WMI_PEER_TYPE_DEFAULT);
3405 			if (ret)
3406 				ath10k_warn(ar, "failed to create peer %pM on vdev %d: %d\n",
3407 					    peer_addr, vdev_id, ret);
3408 			tmp_peer_created = (ret == 0);
3409 		}
3410 
3411 		spin_lock_bh(&ar->data_lock);
3412 		reinit_completion(&ar->offchan_tx_completed);
3413 		ar->offchan_tx_skb = skb;
3414 		spin_unlock_bh(&ar->data_lock);
3415 
3416 		/* It's safe to access vif and sta - conf_mutex guarantees that
3417 		 * sta_state() and remove_interface() are locked exclusively
3418 		 * out wrt to this offchannel worker.
3419 		 */
3420 		arvif = ath10k_get_arvif(ar, vdev_id);
3421 		if (arvif) {
3422 			vif = arvif->vif;
3423 			sta = ieee80211_find_sta(vif, peer_addr);
3424 		} else {
3425 			vif = NULL;
3426 			sta = NULL;
3427 		}
3428 
3429 		txmode = ath10k_mac_tx_h_get_txmode(ar, vif, sta, skb);
3430 
3431 		ath10k_mac_tx(ar, txmode, skb);
3432 
3433 		time_left =
3434 		wait_for_completion_timeout(&ar->offchan_tx_completed, 3 * HZ);
3435 		if (time_left == 0)
3436 			ath10k_warn(ar, "timed out waiting for offchannel skb %p\n",
3437 				    skb);
3438 
3439 		if (!peer && tmp_peer_created) {
3440 			ret = ath10k_peer_delete(ar, vdev_id, peer_addr);
3441 			if (ret)
3442 				ath10k_warn(ar, "failed to delete peer %pM on vdev %d: %d\n",
3443 					    peer_addr, vdev_id, ret);
3444 		}
3445 
3446 		mutex_unlock(&ar->conf_mutex);
3447 	}
3448 }
3449 
3450 void ath10k_mgmt_over_wmi_tx_purge(struct ath10k *ar)
3451 {
3452 	struct sk_buff *skb;
3453 
3454 	for (;;) {
3455 		skb = skb_dequeue(&ar->wmi_mgmt_tx_queue);
3456 		if (!skb)
3457 			break;
3458 
3459 		ieee80211_free_txskb(ar->hw, skb);
3460 	}
3461 }
3462 
3463 void ath10k_mgmt_over_wmi_tx_work(struct work_struct *work)
3464 {
3465 	struct ath10k *ar = container_of(work, struct ath10k, wmi_mgmt_tx_work);
3466 	struct sk_buff *skb;
3467 	int ret;
3468 
3469 	for (;;) {
3470 		skb = skb_dequeue(&ar->wmi_mgmt_tx_queue);
3471 		if (!skb)
3472 			break;
3473 
3474 		ret = ath10k_wmi_mgmt_tx(ar, skb);
3475 		if (ret) {
3476 			ath10k_warn(ar, "failed to transmit management frame via WMI: %d\n",
3477 				    ret);
3478 			ieee80211_free_txskb(ar->hw, skb);
3479 		}
3480 	}
3481 }
3482 
3483 /************/
3484 /* Scanning */
3485 /************/
3486 
3487 void __ath10k_scan_finish(struct ath10k *ar)
3488 {
3489 	lockdep_assert_held(&ar->data_lock);
3490 
3491 	switch (ar->scan.state) {
3492 	case ATH10K_SCAN_IDLE:
3493 		break;
3494 	case ATH10K_SCAN_RUNNING:
3495 	case ATH10K_SCAN_ABORTING:
3496 		if (!ar->scan.is_roc)
3497 			ieee80211_scan_completed(ar->hw,
3498 						 (ar->scan.state ==
3499 						  ATH10K_SCAN_ABORTING));
3500 		else if (ar->scan.roc_notify)
3501 			ieee80211_remain_on_channel_expired(ar->hw);
3502 		/* fall through */
3503 	case ATH10K_SCAN_STARTING:
3504 		ar->scan.state = ATH10K_SCAN_IDLE;
3505 		ar->scan_channel = NULL;
3506 		ar->scan.roc_freq = 0;
3507 		ath10k_offchan_tx_purge(ar);
3508 		cancel_delayed_work(&ar->scan.timeout);
3509 		complete_all(&ar->scan.completed);
3510 		break;
3511 	}
3512 }
3513 
3514 void ath10k_scan_finish(struct ath10k *ar)
3515 {
3516 	spin_lock_bh(&ar->data_lock);
3517 	__ath10k_scan_finish(ar);
3518 	spin_unlock_bh(&ar->data_lock);
3519 }
3520 
3521 static int ath10k_scan_stop(struct ath10k *ar)
3522 {
3523 	struct wmi_stop_scan_arg arg = {
3524 		.req_id = 1, /* FIXME */
3525 		.req_type = WMI_SCAN_STOP_ONE,
3526 		.u.scan_id = ATH10K_SCAN_ID,
3527 	};
3528 	int ret;
3529 
3530 	lockdep_assert_held(&ar->conf_mutex);
3531 
3532 	ret = ath10k_wmi_stop_scan(ar, &arg);
3533 	if (ret) {
3534 		ath10k_warn(ar, "failed to stop wmi scan: %d\n", ret);
3535 		goto out;
3536 	}
3537 
3538 	ret = wait_for_completion_timeout(&ar->scan.completed, 3*HZ);
3539 	if (ret == 0) {
3540 		ath10k_warn(ar, "failed to receive scan abortion completion: timed out\n");
3541 		ret = -ETIMEDOUT;
3542 	} else if (ret > 0) {
3543 		ret = 0;
3544 	}
3545 
3546 out:
3547 	/* Scan state should be updated upon scan completion but in case
3548 	 * firmware fails to deliver the event (for whatever reason) it is
3549 	 * desired to clean up scan state anyway. Firmware may have just
3550 	 * dropped the scan completion event delivery due to transport pipe
3551 	 * being overflown with data and/or it can recover on its own before
3552 	 * next scan request is submitted.
3553 	 */
3554 	spin_lock_bh(&ar->data_lock);
3555 	if (ar->scan.state != ATH10K_SCAN_IDLE)
3556 		__ath10k_scan_finish(ar);
3557 	spin_unlock_bh(&ar->data_lock);
3558 
3559 	return ret;
3560 }
3561 
3562 static void ath10k_scan_abort(struct ath10k *ar)
3563 {
3564 	int ret;
3565 
3566 	lockdep_assert_held(&ar->conf_mutex);
3567 
3568 	spin_lock_bh(&ar->data_lock);
3569 
3570 	switch (ar->scan.state) {
3571 	case ATH10K_SCAN_IDLE:
3572 		/* This can happen if timeout worker kicked in and called
3573 		 * abortion while scan completion was being processed.
3574 		 */
3575 		break;
3576 	case ATH10K_SCAN_STARTING:
3577 	case ATH10K_SCAN_ABORTING:
3578 		ath10k_warn(ar, "refusing scan abortion due to invalid scan state: %s (%d)\n",
3579 			    ath10k_scan_state_str(ar->scan.state),
3580 			    ar->scan.state);
3581 		break;
3582 	case ATH10K_SCAN_RUNNING:
3583 		ar->scan.state = ATH10K_SCAN_ABORTING;
3584 		spin_unlock_bh(&ar->data_lock);
3585 
3586 		ret = ath10k_scan_stop(ar);
3587 		if (ret)
3588 			ath10k_warn(ar, "failed to abort scan: %d\n", ret);
3589 
3590 		spin_lock_bh(&ar->data_lock);
3591 		break;
3592 	}
3593 
3594 	spin_unlock_bh(&ar->data_lock);
3595 }
3596 
3597 void ath10k_scan_timeout_work(struct work_struct *work)
3598 {
3599 	struct ath10k *ar = container_of(work, struct ath10k,
3600 					 scan.timeout.work);
3601 
3602 	mutex_lock(&ar->conf_mutex);
3603 	ath10k_scan_abort(ar);
3604 	mutex_unlock(&ar->conf_mutex);
3605 }
3606 
3607 static int ath10k_start_scan(struct ath10k *ar,
3608 			     const struct wmi_start_scan_arg *arg)
3609 {
3610 	int ret;
3611 
3612 	lockdep_assert_held(&ar->conf_mutex);
3613 
3614 	ret = ath10k_wmi_start_scan(ar, arg);
3615 	if (ret)
3616 		return ret;
3617 
3618 	ret = wait_for_completion_timeout(&ar->scan.started, 1*HZ);
3619 	if (ret == 0) {
3620 		ret = ath10k_scan_stop(ar);
3621 		if (ret)
3622 			ath10k_warn(ar, "failed to stop scan: %d\n", ret);
3623 
3624 		return -ETIMEDOUT;
3625 	}
3626 
3627 	/* If we failed to start the scan, return error code at
3628 	 * this point.  This is probably due to some issue in the
3629 	 * firmware, but no need to wedge the driver due to that...
3630 	 */
3631 	spin_lock_bh(&ar->data_lock);
3632 	if (ar->scan.state == ATH10K_SCAN_IDLE) {
3633 		spin_unlock_bh(&ar->data_lock);
3634 		return -EINVAL;
3635 	}
3636 	spin_unlock_bh(&ar->data_lock);
3637 
3638 	return 0;
3639 }
3640 
3641 /**********************/
3642 /* mac80211 callbacks */
3643 /**********************/
3644 
3645 static void ath10k_tx(struct ieee80211_hw *hw,
3646 		      struct ieee80211_tx_control *control,
3647 		      struct sk_buff *skb)
3648 {
3649 	struct ath10k *ar = hw->priv;
3650 	struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(skb);
3651 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
3652 	struct ieee80211_vif *vif = info->control.vif;
3653 	struct ieee80211_sta *sta = control->sta;
3654 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
3655 	enum ath10k_hw_txrx_mode txmode;
3656 
3657 	/* We should disable CCK RATE due to P2P */
3658 	if (info->flags & IEEE80211_TX_CTL_NO_CCK_RATE)
3659 		ath10k_dbg(ar, ATH10K_DBG_MAC, "IEEE80211_TX_CTL_NO_CCK_RATE\n");
3660 
3661 	txmode = ath10k_mac_tx_h_get_txmode(ar, vif, sta, skb);
3662 
3663 	skb_cb->flags = 0;
3664 	if (!ath10k_tx_h_use_hwcrypto(vif, skb))
3665 		skb_cb->flags |= ATH10K_SKB_F_NO_HWCRYPT;
3666 
3667 	if (ieee80211_is_mgmt(hdr->frame_control))
3668 		skb_cb->flags |= ATH10K_SKB_F_MGMT;
3669 
3670 	if (ieee80211_is_data_qos(hdr->frame_control))
3671 		skb_cb->flags |= ATH10K_SKB_F_QOS;
3672 
3673 	skb_cb->vif = vif;
3674 
3675 	switch (txmode) {
3676 	case ATH10K_HW_TXRX_MGMT:
3677 	case ATH10K_HW_TXRX_NATIVE_WIFI:
3678 		ath10k_tx_h_nwifi(hw, skb);
3679 		ath10k_tx_h_add_p2p_noa_ie(ar, vif, skb);
3680 		ath10k_tx_h_seq_no(vif, skb);
3681 		break;
3682 	case ATH10K_HW_TXRX_ETHERNET:
3683 		ath10k_tx_h_8023(skb);
3684 		break;
3685 	case ATH10K_HW_TXRX_RAW:
3686 		if (!test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags)) {
3687 			WARN_ON_ONCE(1);
3688 			ieee80211_free_txskb(hw, skb);
3689 			return;
3690 		}
3691 	}
3692 
3693 	if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) {
3694 		if (!ath10k_mac_tx_frm_has_freq(ar)) {
3695 			ath10k_dbg(ar, ATH10K_DBG_MAC, "queued offchannel skb %p\n",
3696 				   skb);
3697 
3698 			skb_queue_tail(&ar->offchan_tx_queue, skb);
3699 			ieee80211_queue_work(hw, &ar->offchan_tx_work);
3700 			return;
3701 		}
3702 	}
3703 
3704 	ath10k_mac_tx(ar, txmode, skb);
3705 }
3706 
3707 /* Must not be called with conf_mutex held as workers can use that also. */
3708 void ath10k_drain_tx(struct ath10k *ar)
3709 {
3710 	/* make sure rcu-protected mac80211 tx path itself is drained */
3711 	synchronize_net();
3712 
3713 	ath10k_offchan_tx_purge(ar);
3714 	ath10k_mgmt_over_wmi_tx_purge(ar);
3715 
3716 	cancel_work_sync(&ar->offchan_tx_work);
3717 	cancel_work_sync(&ar->wmi_mgmt_tx_work);
3718 }
3719 
3720 void ath10k_halt(struct ath10k *ar)
3721 {
3722 	struct ath10k_vif *arvif;
3723 
3724 	lockdep_assert_held(&ar->conf_mutex);
3725 
3726 	clear_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
3727 	ar->filter_flags = 0;
3728 	ar->monitor = false;
3729 	ar->monitor_arvif = NULL;
3730 
3731 	if (ar->monitor_started)
3732 		ath10k_monitor_stop(ar);
3733 
3734 	ar->monitor_started = false;
3735 	ar->tx_paused = 0;
3736 
3737 	ath10k_scan_finish(ar);
3738 	ath10k_peer_cleanup_all(ar);
3739 	ath10k_core_stop(ar);
3740 	ath10k_hif_power_down(ar);
3741 
3742 	spin_lock_bh(&ar->data_lock);
3743 	list_for_each_entry(arvif, &ar->arvifs, list)
3744 		ath10k_mac_vif_beacon_cleanup(arvif);
3745 	spin_unlock_bh(&ar->data_lock);
3746 }
3747 
3748 static int ath10k_get_antenna(struct ieee80211_hw *hw, u32 *tx_ant, u32 *rx_ant)
3749 {
3750 	struct ath10k *ar = hw->priv;
3751 
3752 	mutex_lock(&ar->conf_mutex);
3753 
3754 	*tx_ant = ar->cfg_tx_chainmask;
3755 	*rx_ant = ar->cfg_rx_chainmask;
3756 
3757 	mutex_unlock(&ar->conf_mutex);
3758 
3759 	return 0;
3760 }
3761 
3762 static void ath10k_check_chain_mask(struct ath10k *ar, u32 cm, const char *dbg)
3763 {
3764 	/* It is not clear that allowing gaps in chainmask
3765 	 * is helpful.  Probably it will not do what user
3766 	 * is hoping for, so warn in that case.
3767 	 */
3768 	if (cm == 15 || cm == 7 || cm == 3 || cm == 1 || cm == 0)
3769 		return;
3770 
3771 	ath10k_warn(ar, "mac %s antenna chainmask may be invalid: 0x%x.  Suggested values: 15, 7, 3, 1 or 0.\n",
3772 		    dbg, cm);
3773 }
3774 
3775 static int ath10k_mac_get_vht_cap_bf_sts(struct ath10k *ar)
3776 {
3777 	int nsts = ar->vht_cap_info;
3778 
3779 	nsts &= IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
3780 	nsts >>= IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT;
3781 
3782 	/* If firmware does not deliver to host number of space-time
3783 	 * streams supported, assume it support up to 4 BF STS and return
3784 	 * the value for VHT CAP: nsts-1)
3785 	 */
3786 	if (nsts == 0)
3787 		return 3;
3788 
3789 	return nsts;
3790 }
3791 
3792 static int ath10k_mac_get_vht_cap_bf_sound_dim(struct ath10k *ar)
3793 {
3794 	int sound_dim = ar->vht_cap_info;
3795 
3796 	sound_dim &= IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK;
3797 	sound_dim >>= IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT;
3798 
3799 	/* If the sounding dimension is not advertised by the firmware,
3800 	 * let's use a default value of 1
3801 	 */
3802 	if (sound_dim == 0)
3803 		return 1;
3804 
3805 	return sound_dim;
3806 }
3807 
3808 static struct ieee80211_sta_vht_cap ath10k_create_vht_cap(struct ath10k *ar)
3809 {
3810 	struct ieee80211_sta_vht_cap vht_cap = {0};
3811 	u16 mcs_map;
3812 	u32 val;
3813 	int i;
3814 
3815 	vht_cap.vht_supported = 1;
3816 	vht_cap.cap = ar->vht_cap_info;
3817 
3818 	if (ar->vht_cap_info & (IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
3819 				IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE)) {
3820 		val = ath10k_mac_get_vht_cap_bf_sts(ar);
3821 		val <<= IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT;
3822 		val &= IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
3823 
3824 		vht_cap.cap |= val;
3825 	}
3826 
3827 	if (ar->vht_cap_info & (IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
3828 				IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)) {
3829 		val = ath10k_mac_get_vht_cap_bf_sound_dim(ar);
3830 		val <<= IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT;
3831 		val &= IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK;
3832 
3833 		vht_cap.cap |= val;
3834 	}
3835 
3836 	mcs_map = 0;
3837 	for (i = 0; i < 8; i++) {
3838 		if ((i < ar->num_rf_chains) && (ar->cfg_tx_chainmask & BIT(i)))
3839 			mcs_map |= IEEE80211_VHT_MCS_SUPPORT_0_9 << (i * 2);
3840 		else
3841 			mcs_map |= IEEE80211_VHT_MCS_NOT_SUPPORTED << (i * 2);
3842 	}
3843 
3844 	vht_cap.vht_mcs.rx_mcs_map = cpu_to_le16(mcs_map);
3845 	vht_cap.vht_mcs.tx_mcs_map = cpu_to_le16(mcs_map);
3846 
3847 	return vht_cap;
3848 }
3849 
3850 static struct ieee80211_sta_ht_cap ath10k_get_ht_cap(struct ath10k *ar)
3851 {
3852 	int i;
3853 	struct ieee80211_sta_ht_cap ht_cap = {0};
3854 
3855 	if (!(ar->ht_cap_info & WMI_HT_CAP_ENABLED))
3856 		return ht_cap;
3857 
3858 	ht_cap.ht_supported = 1;
3859 	ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
3860 	ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_8;
3861 	ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
3862 	ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
3863 	ht_cap.cap |=
3864 		WLAN_HT_CAP_SM_PS_DISABLED << IEEE80211_HT_CAP_SM_PS_SHIFT;
3865 
3866 	if (ar->ht_cap_info & WMI_HT_CAP_HT20_SGI)
3867 		ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
3868 
3869 	if (ar->ht_cap_info & WMI_HT_CAP_HT40_SGI)
3870 		ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
3871 
3872 	if (ar->ht_cap_info & WMI_HT_CAP_DYNAMIC_SMPS) {
3873 		u32 smps;
3874 
3875 		smps   = WLAN_HT_CAP_SM_PS_DYNAMIC;
3876 		smps <<= IEEE80211_HT_CAP_SM_PS_SHIFT;
3877 
3878 		ht_cap.cap |= smps;
3879 	}
3880 
3881 	if (ar->ht_cap_info & WMI_HT_CAP_TX_STBC)
3882 		ht_cap.cap |= IEEE80211_HT_CAP_TX_STBC;
3883 
3884 	if (ar->ht_cap_info & WMI_HT_CAP_RX_STBC) {
3885 		u32 stbc;
3886 
3887 		stbc   = ar->ht_cap_info;
3888 		stbc  &= WMI_HT_CAP_RX_STBC;
3889 		stbc >>= WMI_HT_CAP_RX_STBC_MASK_SHIFT;
3890 		stbc <<= IEEE80211_HT_CAP_RX_STBC_SHIFT;
3891 		stbc  &= IEEE80211_HT_CAP_RX_STBC;
3892 
3893 		ht_cap.cap |= stbc;
3894 	}
3895 
3896 	if (ar->ht_cap_info & WMI_HT_CAP_LDPC)
3897 		ht_cap.cap |= IEEE80211_HT_CAP_LDPC_CODING;
3898 
3899 	if (ar->ht_cap_info & WMI_HT_CAP_L_SIG_TXOP_PROT)
3900 		ht_cap.cap |= IEEE80211_HT_CAP_LSIG_TXOP_PROT;
3901 
3902 	/* max AMSDU is implicitly taken from vht_cap_info */
3903 	if (ar->vht_cap_info & WMI_VHT_CAP_MAX_MPDU_LEN_MASK)
3904 		ht_cap.cap |= IEEE80211_HT_CAP_MAX_AMSDU;
3905 
3906 	for (i = 0; i < ar->num_rf_chains; i++) {
3907 		if (ar->cfg_rx_chainmask & BIT(i))
3908 			ht_cap.mcs.rx_mask[i] = 0xFF;
3909 	}
3910 
3911 	ht_cap.mcs.tx_params |= IEEE80211_HT_MCS_TX_DEFINED;
3912 
3913 	return ht_cap;
3914 }
3915 
3916 static void ath10k_mac_setup_ht_vht_cap(struct ath10k *ar)
3917 {
3918 	struct ieee80211_supported_band *band;
3919 	struct ieee80211_sta_vht_cap vht_cap;
3920 	struct ieee80211_sta_ht_cap ht_cap;
3921 
3922 	ht_cap = ath10k_get_ht_cap(ar);
3923 	vht_cap = ath10k_create_vht_cap(ar);
3924 
3925 	if (ar->phy_capability & WHAL_WLAN_11G_CAPABILITY) {
3926 		band = &ar->mac.sbands[IEEE80211_BAND_2GHZ];
3927 		band->ht_cap = ht_cap;
3928 
3929 		/* Enable the VHT support at 2.4 GHz */
3930 		band->vht_cap = vht_cap;
3931 	}
3932 	if (ar->phy_capability & WHAL_WLAN_11A_CAPABILITY) {
3933 		band = &ar->mac.sbands[IEEE80211_BAND_5GHZ];
3934 		band->ht_cap = ht_cap;
3935 		band->vht_cap = vht_cap;
3936 	}
3937 }
3938 
3939 static int __ath10k_set_antenna(struct ath10k *ar, u32 tx_ant, u32 rx_ant)
3940 {
3941 	int ret;
3942 
3943 	lockdep_assert_held(&ar->conf_mutex);
3944 
3945 	ath10k_check_chain_mask(ar, tx_ant, "tx");
3946 	ath10k_check_chain_mask(ar, rx_ant, "rx");
3947 
3948 	ar->cfg_tx_chainmask = tx_ant;
3949 	ar->cfg_rx_chainmask = rx_ant;
3950 
3951 	if ((ar->state != ATH10K_STATE_ON) &&
3952 	    (ar->state != ATH10K_STATE_RESTARTED))
3953 		return 0;
3954 
3955 	ret = ath10k_wmi_pdev_set_param(ar, ar->wmi.pdev_param->tx_chain_mask,
3956 					tx_ant);
3957 	if (ret) {
3958 		ath10k_warn(ar, "failed to set tx-chainmask: %d, req 0x%x\n",
3959 			    ret, tx_ant);
3960 		return ret;
3961 	}
3962 
3963 	ret = ath10k_wmi_pdev_set_param(ar, ar->wmi.pdev_param->rx_chain_mask,
3964 					rx_ant);
3965 	if (ret) {
3966 		ath10k_warn(ar, "failed to set rx-chainmask: %d, req 0x%x\n",
3967 			    ret, rx_ant);
3968 		return ret;
3969 	}
3970 
3971 	/* Reload HT/VHT capability */
3972 	ath10k_mac_setup_ht_vht_cap(ar);
3973 
3974 	return 0;
3975 }
3976 
3977 static int ath10k_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
3978 {
3979 	struct ath10k *ar = hw->priv;
3980 	int ret;
3981 
3982 	mutex_lock(&ar->conf_mutex);
3983 	ret = __ath10k_set_antenna(ar, tx_ant, rx_ant);
3984 	mutex_unlock(&ar->conf_mutex);
3985 	return ret;
3986 }
3987 
3988 static int ath10k_start(struct ieee80211_hw *hw)
3989 {
3990 	struct ath10k *ar = hw->priv;
3991 	u32 burst_enable;
3992 	int ret = 0;
3993 
3994 	/*
3995 	 * This makes sense only when restarting hw. It is harmless to call
3996 	 * uncoditionally. This is necessary to make sure no HTT/WMI tx
3997 	 * commands will be submitted while restarting.
3998 	 */
3999 	ath10k_drain_tx(ar);
4000 
4001 	mutex_lock(&ar->conf_mutex);
4002 
4003 	switch (ar->state) {
4004 	case ATH10K_STATE_OFF:
4005 		ar->state = ATH10K_STATE_ON;
4006 		break;
4007 	case ATH10K_STATE_RESTARTING:
4008 		ath10k_halt(ar);
4009 		ar->state = ATH10K_STATE_RESTARTED;
4010 		break;
4011 	case ATH10K_STATE_ON:
4012 	case ATH10K_STATE_RESTARTED:
4013 	case ATH10K_STATE_WEDGED:
4014 		WARN_ON(1);
4015 		ret = -EINVAL;
4016 		goto err;
4017 	case ATH10K_STATE_UTF:
4018 		ret = -EBUSY;
4019 		goto err;
4020 	}
4021 
4022 	ret = ath10k_hif_power_up(ar);
4023 	if (ret) {
4024 		ath10k_err(ar, "Could not init hif: %d\n", ret);
4025 		goto err_off;
4026 	}
4027 
4028 	ret = ath10k_core_start(ar, ATH10K_FIRMWARE_MODE_NORMAL);
4029 	if (ret) {
4030 		ath10k_err(ar, "Could not init core: %d\n", ret);
4031 		goto err_power_down;
4032 	}
4033 
4034 	ret = ath10k_wmi_pdev_set_param(ar, ar->wmi.pdev_param->pmf_qos, 1);
4035 	if (ret) {
4036 		ath10k_warn(ar, "failed to enable PMF QOS: %d\n", ret);
4037 		goto err_core_stop;
4038 	}
4039 
4040 	ret = ath10k_wmi_pdev_set_param(ar, ar->wmi.pdev_param->dynamic_bw, 1);
4041 	if (ret) {
4042 		ath10k_warn(ar, "failed to enable dynamic BW: %d\n", ret);
4043 		goto err_core_stop;
4044 	}
4045 
4046 	if (test_bit(WMI_SERVICE_ADAPTIVE_OCS, ar->wmi.svc_map)) {
4047 		ret = ath10k_wmi_adaptive_qcs(ar, true);
4048 		if (ret) {
4049 			ath10k_warn(ar, "failed to enable adaptive qcs: %d\n",
4050 				    ret);
4051 			goto err_core_stop;
4052 		}
4053 	}
4054 
4055 	if (test_bit(WMI_SERVICE_BURST, ar->wmi.svc_map)) {
4056 		burst_enable = ar->wmi.pdev_param->burst_enable;
4057 		ret = ath10k_wmi_pdev_set_param(ar, burst_enable, 0);
4058 		if (ret) {
4059 			ath10k_warn(ar, "failed to disable burst: %d\n", ret);
4060 			goto err_core_stop;
4061 		}
4062 	}
4063 
4064 	__ath10k_set_antenna(ar, ar->cfg_tx_chainmask, ar->cfg_rx_chainmask);
4065 
4066 	/*
4067 	 * By default FW set ARP frames ac to voice (6). In that case ARP
4068 	 * exchange is not working properly for UAPSD enabled AP. ARP requests
4069 	 * which arrives with access category 0 are processed by network stack
4070 	 * and send back with access category 0, but FW changes access category
4071 	 * to 6. Set ARP frames access category to best effort (0) solves
4072 	 * this problem.
4073 	 */
4074 
4075 	ret = ath10k_wmi_pdev_set_param(ar,
4076 					ar->wmi.pdev_param->arp_ac_override, 0);
4077 	if (ret) {
4078 		ath10k_warn(ar, "failed to set arp ac override parameter: %d\n",
4079 			    ret);
4080 		goto err_core_stop;
4081 	}
4082 
4083 	if (test_bit(ATH10K_FW_FEATURE_SUPPORTS_ADAPTIVE_CCA,
4084 		     ar->fw_features)) {
4085 		ret = ath10k_wmi_pdev_enable_adaptive_cca(ar, 1,
4086 							  WMI_CCA_DETECT_LEVEL_AUTO,
4087 							  WMI_CCA_DETECT_MARGIN_AUTO);
4088 		if (ret) {
4089 			ath10k_warn(ar, "failed to enable adaptive cca: %d\n",
4090 				    ret);
4091 			goto err_core_stop;
4092 		}
4093 	}
4094 
4095 	ret = ath10k_wmi_pdev_set_param(ar,
4096 					ar->wmi.pdev_param->ani_enable, 1);
4097 	if (ret) {
4098 		ath10k_warn(ar, "failed to enable ani by default: %d\n",
4099 			    ret);
4100 		goto err_core_stop;
4101 	}
4102 
4103 	ar->ani_enabled = true;
4104 
4105 	ar->num_started_vdevs = 0;
4106 	ath10k_regd_update(ar);
4107 
4108 	ath10k_spectral_start(ar);
4109 	ath10k_thermal_set_throttling(ar);
4110 
4111 	mutex_unlock(&ar->conf_mutex);
4112 	return 0;
4113 
4114 err_core_stop:
4115 	ath10k_core_stop(ar);
4116 
4117 err_power_down:
4118 	ath10k_hif_power_down(ar);
4119 
4120 err_off:
4121 	ar->state = ATH10K_STATE_OFF;
4122 
4123 err:
4124 	mutex_unlock(&ar->conf_mutex);
4125 	return ret;
4126 }
4127 
4128 static void ath10k_stop(struct ieee80211_hw *hw)
4129 {
4130 	struct ath10k *ar = hw->priv;
4131 
4132 	ath10k_drain_tx(ar);
4133 
4134 	mutex_lock(&ar->conf_mutex);
4135 	if (ar->state != ATH10K_STATE_OFF) {
4136 		ath10k_halt(ar);
4137 		ar->state = ATH10K_STATE_OFF;
4138 	}
4139 	mutex_unlock(&ar->conf_mutex);
4140 
4141 	cancel_delayed_work_sync(&ar->scan.timeout);
4142 	cancel_work_sync(&ar->restart_work);
4143 }
4144 
4145 static int ath10k_config_ps(struct ath10k *ar)
4146 {
4147 	struct ath10k_vif *arvif;
4148 	int ret = 0;
4149 
4150 	lockdep_assert_held(&ar->conf_mutex);
4151 
4152 	list_for_each_entry(arvif, &ar->arvifs, list) {
4153 		ret = ath10k_mac_vif_setup_ps(arvif);
4154 		if (ret) {
4155 			ath10k_warn(ar, "failed to setup powersave: %d\n", ret);
4156 			break;
4157 		}
4158 	}
4159 
4160 	return ret;
4161 }
4162 
4163 static int ath10k_mac_txpower_setup(struct ath10k *ar, int txpower)
4164 {
4165 	int ret;
4166 	u32 param;
4167 
4168 	lockdep_assert_held(&ar->conf_mutex);
4169 
4170 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac txpower %d\n", txpower);
4171 
4172 	param = ar->wmi.pdev_param->txpower_limit2g;
4173 	ret = ath10k_wmi_pdev_set_param(ar, param, txpower * 2);
4174 	if (ret) {
4175 		ath10k_warn(ar, "failed to set 2g txpower %d: %d\n",
4176 			    txpower, ret);
4177 		return ret;
4178 	}
4179 
4180 	param = ar->wmi.pdev_param->txpower_limit5g;
4181 	ret = ath10k_wmi_pdev_set_param(ar, param, txpower * 2);
4182 	if (ret) {
4183 		ath10k_warn(ar, "failed to set 5g txpower %d: %d\n",
4184 			    txpower, ret);
4185 		return ret;
4186 	}
4187 
4188 	return 0;
4189 }
4190 
4191 static int ath10k_mac_txpower_recalc(struct ath10k *ar)
4192 {
4193 	struct ath10k_vif *arvif;
4194 	int ret, txpower = -1;
4195 
4196 	lockdep_assert_held(&ar->conf_mutex);
4197 
4198 	list_for_each_entry(arvif, &ar->arvifs, list) {
4199 		WARN_ON(arvif->txpower < 0);
4200 
4201 		if (txpower == -1)
4202 			txpower = arvif->txpower;
4203 		else
4204 			txpower = min(txpower, arvif->txpower);
4205 	}
4206 
4207 	if (WARN_ON(txpower == -1))
4208 		return -EINVAL;
4209 
4210 	ret = ath10k_mac_txpower_setup(ar, txpower);
4211 	if (ret) {
4212 		ath10k_warn(ar, "failed to setup tx power %d: %d\n",
4213 			    txpower, ret);
4214 		return ret;
4215 	}
4216 
4217 	return 0;
4218 }
4219 
4220 static int ath10k_config(struct ieee80211_hw *hw, u32 changed)
4221 {
4222 	struct ath10k *ar = hw->priv;
4223 	struct ieee80211_conf *conf = &hw->conf;
4224 	int ret = 0;
4225 
4226 	mutex_lock(&ar->conf_mutex);
4227 
4228 	if (changed & IEEE80211_CONF_CHANGE_PS)
4229 		ath10k_config_ps(ar);
4230 
4231 	if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
4232 		ar->monitor = conf->flags & IEEE80211_CONF_MONITOR;
4233 		ret = ath10k_monitor_recalc(ar);
4234 		if (ret)
4235 			ath10k_warn(ar, "failed to recalc monitor: %d\n", ret);
4236 	}
4237 
4238 	mutex_unlock(&ar->conf_mutex);
4239 	return ret;
4240 }
4241 
4242 static u32 get_nss_from_chainmask(u16 chain_mask)
4243 {
4244 	if ((chain_mask & 0xf) == 0xf)
4245 		return 4;
4246 	else if ((chain_mask & 0x7) == 0x7)
4247 		return 3;
4248 	else if ((chain_mask & 0x3) == 0x3)
4249 		return 2;
4250 	return 1;
4251 }
4252 
4253 static int ath10k_mac_set_txbf_conf(struct ath10k_vif *arvif)
4254 {
4255 	u32 value = 0;
4256 	struct ath10k *ar = arvif->ar;
4257 	int nsts;
4258 	int sound_dim;
4259 
4260 	if (ath10k_wmi_get_txbf_conf_scheme(ar) != WMI_TXBF_CONF_BEFORE_ASSOC)
4261 		return 0;
4262 
4263 	nsts = ath10k_mac_get_vht_cap_bf_sts(ar);
4264 	if (ar->vht_cap_info & (IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
4265 				IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE))
4266 		value |= SM(nsts, WMI_TXBF_STS_CAP_OFFSET);
4267 
4268 	sound_dim = ath10k_mac_get_vht_cap_bf_sound_dim(ar);
4269 	if (ar->vht_cap_info & (IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
4270 				IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE))
4271 		value |= SM(sound_dim, WMI_BF_SOUND_DIM_OFFSET);
4272 
4273 	if (!value)
4274 		return 0;
4275 
4276 	if (ar->vht_cap_info & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)
4277 		value |= WMI_VDEV_PARAM_TXBF_SU_TX_BFER;
4278 
4279 	if (ar->vht_cap_info & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)
4280 		value |= (WMI_VDEV_PARAM_TXBF_MU_TX_BFER |
4281 			  WMI_VDEV_PARAM_TXBF_SU_TX_BFER);
4282 
4283 	if (ar->vht_cap_info & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE)
4284 		value |= WMI_VDEV_PARAM_TXBF_SU_TX_BFEE;
4285 
4286 	if (ar->vht_cap_info & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE)
4287 		value |= (WMI_VDEV_PARAM_TXBF_MU_TX_BFEE |
4288 			  WMI_VDEV_PARAM_TXBF_SU_TX_BFEE);
4289 
4290 	return ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
4291 					 ar->wmi.vdev_param->txbf, value);
4292 }
4293 
4294 /*
4295  * TODO:
4296  * Figure out how to handle WMI_VDEV_SUBTYPE_P2P_DEVICE,
4297  * because we will send mgmt frames without CCK. This requirement
4298  * for P2P_FIND/GO_NEG should be handled by checking CCK flag
4299  * in the TX packet.
4300  */
4301 static int ath10k_add_interface(struct ieee80211_hw *hw,
4302 				struct ieee80211_vif *vif)
4303 {
4304 	struct ath10k *ar = hw->priv;
4305 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
4306 	enum wmi_sta_powersave_param param;
4307 	int ret = 0;
4308 	u32 value;
4309 	int bit;
4310 	int i;
4311 	u32 vdev_param;
4312 
4313 	vif->driver_flags |= IEEE80211_VIF_SUPPORTS_UAPSD;
4314 
4315 	mutex_lock(&ar->conf_mutex);
4316 
4317 	memset(arvif, 0, sizeof(*arvif));
4318 
4319 	arvif->ar = ar;
4320 	arvif->vif = vif;
4321 
4322 	INIT_LIST_HEAD(&arvif->list);
4323 	INIT_WORK(&arvif->ap_csa_work, ath10k_mac_vif_ap_csa_work);
4324 	INIT_DELAYED_WORK(&arvif->connection_loss_work,
4325 			  ath10k_mac_vif_sta_connection_loss_work);
4326 
4327 	for (i = 0; i < ARRAY_SIZE(arvif->bitrate_mask.control); i++) {
4328 		arvif->bitrate_mask.control[i].legacy = 0xffffffff;
4329 		memset(arvif->bitrate_mask.control[i].ht_mcs, 0xff,
4330 		       sizeof(arvif->bitrate_mask.control[i].ht_mcs));
4331 		memset(arvif->bitrate_mask.control[i].vht_mcs, 0xff,
4332 		       sizeof(arvif->bitrate_mask.control[i].vht_mcs));
4333 	}
4334 
4335 	if (ar->num_peers >= ar->max_num_peers) {
4336 		ath10k_warn(ar, "refusing vdev creation due to insufficient peer entry resources in firmware\n");
4337 		ret = -ENOBUFS;
4338 		goto err;
4339 	}
4340 
4341 	if (ar->free_vdev_map == 0) {
4342 		ath10k_warn(ar, "Free vdev map is empty, no more interfaces allowed.\n");
4343 		ret = -EBUSY;
4344 		goto err;
4345 	}
4346 	bit = __ffs64(ar->free_vdev_map);
4347 
4348 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac create vdev %i map %llx\n",
4349 		   bit, ar->free_vdev_map);
4350 
4351 	arvif->vdev_id = bit;
4352 	arvif->vdev_subtype = WMI_VDEV_SUBTYPE_NONE;
4353 
4354 	switch (vif->type) {
4355 	case NL80211_IFTYPE_P2P_DEVICE:
4356 		arvif->vdev_type = WMI_VDEV_TYPE_STA;
4357 		arvif->vdev_subtype = WMI_VDEV_SUBTYPE_P2P_DEVICE;
4358 		break;
4359 	case NL80211_IFTYPE_UNSPECIFIED:
4360 	case NL80211_IFTYPE_STATION:
4361 		arvif->vdev_type = WMI_VDEV_TYPE_STA;
4362 		if (vif->p2p)
4363 			arvif->vdev_subtype = WMI_VDEV_SUBTYPE_P2P_CLIENT;
4364 		break;
4365 	case NL80211_IFTYPE_ADHOC:
4366 		arvif->vdev_type = WMI_VDEV_TYPE_IBSS;
4367 		break;
4368 	case NL80211_IFTYPE_MESH_POINT:
4369 		if (test_bit(WMI_SERVICE_MESH, ar->wmi.svc_map)) {
4370 			arvif->vdev_subtype = WMI_VDEV_SUBTYPE_MESH;
4371 		} else if (!test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags)) {
4372 			ret = -EINVAL;
4373 			ath10k_warn(ar, "must load driver with rawmode=1 to add mesh interfaces\n");
4374 			goto err;
4375 		}
4376 		arvif->vdev_type = WMI_VDEV_TYPE_AP;
4377 		break;
4378 	case NL80211_IFTYPE_AP:
4379 		arvif->vdev_type = WMI_VDEV_TYPE_AP;
4380 
4381 		if (vif->p2p)
4382 			arvif->vdev_subtype = WMI_VDEV_SUBTYPE_P2P_GO;
4383 		break;
4384 	case NL80211_IFTYPE_MONITOR:
4385 		arvif->vdev_type = WMI_VDEV_TYPE_MONITOR;
4386 		break;
4387 	default:
4388 		WARN_ON(1);
4389 		break;
4390 	}
4391 
4392 	/* Using vdev_id as queue number will make it very easy to do per-vif
4393 	 * tx queue locking. This shouldn't wrap due to interface combinations
4394 	 * but do a modulo for correctness sake and prevent using offchannel tx
4395 	 * queues for regular vif tx.
4396 	 */
4397 	vif->cab_queue = arvif->vdev_id % (IEEE80211_MAX_QUEUES - 1);
4398 	for (i = 0; i < ARRAY_SIZE(vif->hw_queue); i++)
4399 		vif->hw_queue[i] = arvif->vdev_id % (IEEE80211_MAX_QUEUES - 1);
4400 
4401 	/* Some firmware revisions don't wait for beacon tx completion before
4402 	 * sending another SWBA event. This could lead to hardware using old
4403 	 * (freed) beacon data in some cases, e.g. tx credit starvation
4404 	 * combined with missed TBTT. This is very very rare.
4405 	 *
4406 	 * On non-IOMMU-enabled hosts this could be a possible security issue
4407 	 * because hw could beacon some random data on the air.  On
4408 	 * IOMMU-enabled hosts DMAR faults would occur in most cases and target
4409 	 * device would crash.
4410 	 *
4411 	 * Since there are no beacon tx completions (implicit nor explicit)
4412 	 * propagated to host the only workaround for this is to allocate a
4413 	 * DMA-coherent buffer for a lifetime of a vif and use it for all
4414 	 * beacon tx commands. Worst case for this approach is some beacons may
4415 	 * become corrupted, e.g. have garbled IEs or out-of-date TIM bitmap.
4416 	 */
4417 	if (vif->type == NL80211_IFTYPE_ADHOC ||
4418 	    vif->type == NL80211_IFTYPE_MESH_POINT ||
4419 	    vif->type == NL80211_IFTYPE_AP) {
4420 		arvif->beacon_buf = dma_zalloc_coherent(ar->dev,
4421 							IEEE80211_MAX_FRAME_LEN,
4422 							&arvif->beacon_paddr,
4423 							GFP_ATOMIC);
4424 		if (!arvif->beacon_buf) {
4425 			ret = -ENOMEM;
4426 			ath10k_warn(ar, "failed to allocate beacon buffer: %d\n",
4427 				    ret);
4428 			goto err;
4429 		}
4430 	}
4431 	if (test_bit(ATH10K_FLAG_HW_CRYPTO_DISABLED, &ar->dev_flags))
4432 		arvif->nohwcrypt = true;
4433 
4434 	if (arvif->nohwcrypt &&
4435 	    !test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags)) {
4436 		ath10k_warn(ar, "cryptmode module param needed for sw crypto\n");
4437 		goto err;
4438 	}
4439 
4440 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev create %d (add interface) type %d subtype %d bcnmode %s\n",
4441 		   arvif->vdev_id, arvif->vdev_type, arvif->vdev_subtype,
4442 		   arvif->beacon_buf ? "single-buf" : "per-skb");
4443 
4444 	ret = ath10k_wmi_vdev_create(ar, arvif->vdev_id, arvif->vdev_type,
4445 				     arvif->vdev_subtype, vif->addr);
4446 	if (ret) {
4447 		ath10k_warn(ar, "failed to create WMI vdev %i: %d\n",
4448 			    arvif->vdev_id, ret);
4449 		goto err;
4450 	}
4451 
4452 	ar->free_vdev_map &= ~(1LL << arvif->vdev_id);
4453 	list_add(&arvif->list, &ar->arvifs);
4454 
4455 	/* It makes no sense to have firmware do keepalives. mac80211 already
4456 	 * takes care of this with idle connection polling.
4457 	 */
4458 	ret = ath10k_mac_vif_disable_keepalive(arvif);
4459 	if (ret) {
4460 		ath10k_warn(ar, "failed to disable keepalive on vdev %i: %d\n",
4461 			    arvif->vdev_id, ret);
4462 		goto err_vdev_delete;
4463 	}
4464 
4465 	arvif->def_wep_key_idx = -1;
4466 
4467 	vdev_param = ar->wmi.vdev_param->tx_encap_type;
4468 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
4469 					ATH10K_HW_TXRX_NATIVE_WIFI);
4470 	/* 10.X firmware does not support this VDEV parameter. Do not warn */
4471 	if (ret && ret != -EOPNOTSUPP) {
4472 		ath10k_warn(ar, "failed to set vdev %i TX encapsulation: %d\n",
4473 			    arvif->vdev_id, ret);
4474 		goto err_vdev_delete;
4475 	}
4476 
4477 	if (ar->cfg_tx_chainmask) {
4478 		u16 nss = get_nss_from_chainmask(ar->cfg_tx_chainmask);
4479 
4480 		vdev_param = ar->wmi.vdev_param->nss;
4481 		ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
4482 						nss);
4483 		if (ret) {
4484 			ath10k_warn(ar, "failed to set vdev %i chainmask 0x%x, nss %i: %d\n",
4485 				    arvif->vdev_id, ar->cfg_tx_chainmask, nss,
4486 				    ret);
4487 			goto err_vdev_delete;
4488 		}
4489 	}
4490 
4491 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP ||
4492 	    arvif->vdev_type == WMI_VDEV_TYPE_IBSS) {
4493 		ret = ath10k_peer_create(ar, arvif->vdev_id, vif->addr,
4494 					 WMI_PEER_TYPE_DEFAULT);
4495 		if (ret) {
4496 			ath10k_warn(ar, "failed to create vdev %i peer for AP/IBSS: %d\n",
4497 				    arvif->vdev_id, ret);
4498 			goto err_vdev_delete;
4499 		}
4500 	}
4501 
4502 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
4503 		ret = ath10k_mac_set_kickout(arvif);
4504 		if (ret) {
4505 			ath10k_warn(ar, "failed to set vdev %i kickout parameters: %d\n",
4506 				    arvif->vdev_id, ret);
4507 			goto err_peer_delete;
4508 		}
4509 	}
4510 
4511 	if (arvif->vdev_type == WMI_VDEV_TYPE_STA) {
4512 		param = WMI_STA_PS_PARAM_RX_WAKE_POLICY;
4513 		value = WMI_STA_PS_RX_WAKE_POLICY_WAKE;
4514 		ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
4515 						  param, value);
4516 		if (ret) {
4517 			ath10k_warn(ar, "failed to set vdev %i RX wake policy: %d\n",
4518 				    arvif->vdev_id, ret);
4519 			goto err_peer_delete;
4520 		}
4521 
4522 		ret = ath10k_mac_vif_recalc_ps_wake_threshold(arvif);
4523 		if (ret) {
4524 			ath10k_warn(ar, "failed to recalc ps wake threshold on vdev %i: %d\n",
4525 				    arvif->vdev_id, ret);
4526 			goto err_peer_delete;
4527 		}
4528 
4529 		ret = ath10k_mac_vif_recalc_ps_poll_count(arvif);
4530 		if (ret) {
4531 			ath10k_warn(ar, "failed to recalc ps poll count on vdev %i: %d\n",
4532 				    arvif->vdev_id, ret);
4533 			goto err_peer_delete;
4534 		}
4535 	}
4536 
4537 	ret = ath10k_mac_set_txbf_conf(arvif);
4538 	if (ret) {
4539 		ath10k_warn(ar, "failed to set txbf for vdev %d: %d\n",
4540 			    arvif->vdev_id, ret);
4541 		goto err_peer_delete;
4542 	}
4543 
4544 	ret = ath10k_mac_set_rts(arvif, ar->hw->wiphy->rts_threshold);
4545 	if (ret) {
4546 		ath10k_warn(ar, "failed to set rts threshold for vdev %d: %d\n",
4547 			    arvif->vdev_id, ret);
4548 		goto err_peer_delete;
4549 	}
4550 
4551 	arvif->txpower = vif->bss_conf.txpower;
4552 	ret = ath10k_mac_txpower_recalc(ar);
4553 	if (ret) {
4554 		ath10k_warn(ar, "failed to recalc tx power: %d\n", ret);
4555 		goto err_peer_delete;
4556 	}
4557 
4558 	if (vif->type == NL80211_IFTYPE_MONITOR) {
4559 		ar->monitor_arvif = arvif;
4560 		ret = ath10k_monitor_recalc(ar);
4561 		if (ret) {
4562 			ath10k_warn(ar, "failed to recalc monitor: %d\n", ret);
4563 			goto err_peer_delete;
4564 		}
4565 	}
4566 
4567 	spin_lock_bh(&ar->htt.tx_lock);
4568 	if (!ar->tx_paused)
4569 		ieee80211_wake_queue(ar->hw, arvif->vdev_id);
4570 	spin_unlock_bh(&ar->htt.tx_lock);
4571 
4572 	mutex_unlock(&ar->conf_mutex);
4573 	return 0;
4574 
4575 err_peer_delete:
4576 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP ||
4577 	    arvif->vdev_type == WMI_VDEV_TYPE_IBSS)
4578 		ath10k_wmi_peer_delete(ar, arvif->vdev_id, vif->addr);
4579 
4580 err_vdev_delete:
4581 	ath10k_wmi_vdev_delete(ar, arvif->vdev_id);
4582 	ar->free_vdev_map |= 1LL << arvif->vdev_id;
4583 	list_del(&arvif->list);
4584 
4585 err:
4586 	if (arvif->beacon_buf) {
4587 		dma_free_coherent(ar->dev, IEEE80211_MAX_FRAME_LEN,
4588 				  arvif->beacon_buf, arvif->beacon_paddr);
4589 		arvif->beacon_buf = NULL;
4590 	}
4591 
4592 	mutex_unlock(&ar->conf_mutex);
4593 
4594 	return ret;
4595 }
4596 
4597 static void ath10k_mac_vif_tx_unlock_all(struct ath10k_vif *arvif)
4598 {
4599 	int i;
4600 
4601 	for (i = 0; i < BITS_PER_LONG; i++)
4602 		ath10k_mac_vif_tx_unlock(arvif, i);
4603 }
4604 
4605 static void ath10k_remove_interface(struct ieee80211_hw *hw,
4606 				    struct ieee80211_vif *vif)
4607 {
4608 	struct ath10k *ar = hw->priv;
4609 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
4610 	int ret;
4611 
4612 	cancel_work_sync(&arvif->ap_csa_work);
4613 	cancel_delayed_work_sync(&arvif->connection_loss_work);
4614 
4615 	mutex_lock(&ar->conf_mutex);
4616 
4617 	spin_lock_bh(&ar->data_lock);
4618 	ath10k_mac_vif_beacon_cleanup(arvif);
4619 	spin_unlock_bh(&ar->data_lock);
4620 
4621 	ret = ath10k_spectral_vif_stop(arvif);
4622 	if (ret)
4623 		ath10k_warn(ar, "failed to stop spectral for vdev %i: %d\n",
4624 			    arvif->vdev_id, ret);
4625 
4626 	ar->free_vdev_map |= 1LL << arvif->vdev_id;
4627 	list_del(&arvif->list);
4628 
4629 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP ||
4630 	    arvif->vdev_type == WMI_VDEV_TYPE_IBSS) {
4631 		ret = ath10k_wmi_peer_delete(arvif->ar, arvif->vdev_id,
4632 					     vif->addr);
4633 		if (ret)
4634 			ath10k_warn(ar, "failed to submit AP/IBSS self-peer removal on vdev %i: %d\n",
4635 				    arvif->vdev_id, ret);
4636 
4637 		kfree(arvif->u.ap.noa_data);
4638 	}
4639 
4640 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %i delete (remove interface)\n",
4641 		   arvif->vdev_id);
4642 
4643 	ret = ath10k_wmi_vdev_delete(ar, arvif->vdev_id);
4644 	if (ret)
4645 		ath10k_warn(ar, "failed to delete WMI vdev %i: %d\n",
4646 			    arvif->vdev_id, ret);
4647 
4648 	/* Some firmware revisions don't notify host about self-peer removal
4649 	 * until after associated vdev is deleted.
4650 	 */
4651 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP ||
4652 	    arvif->vdev_type == WMI_VDEV_TYPE_IBSS) {
4653 		ret = ath10k_wait_for_peer_deleted(ar, arvif->vdev_id,
4654 						   vif->addr);
4655 		if (ret)
4656 			ath10k_warn(ar, "failed to remove AP self-peer on vdev %i: %d\n",
4657 				    arvif->vdev_id, ret);
4658 
4659 		spin_lock_bh(&ar->data_lock);
4660 		ar->num_peers--;
4661 		spin_unlock_bh(&ar->data_lock);
4662 	}
4663 
4664 	ath10k_peer_cleanup(ar, arvif->vdev_id);
4665 
4666 	if (vif->type == NL80211_IFTYPE_MONITOR) {
4667 		ar->monitor_arvif = NULL;
4668 		ret = ath10k_monitor_recalc(ar);
4669 		if (ret)
4670 			ath10k_warn(ar, "failed to recalc monitor: %d\n", ret);
4671 	}
4672 
4673 	spin_lock_bh(&ar->htt.tx_lock);
4674 	ath10k_mac_vif_tx_unlock_all(arvif);
4675 	spin_unlock_bh(&ar->htt.tx_lock);
4676 
4677 	mutex_unlock(&ar->conf_mutex);
4678 }
4679 
4680 /*
4681  * FIXME: Has to be verified.
4682  */
4683 #define SUPPORTED_FILTERS			\
4684 	(FIF_ALLMULTI |				\
4685 	FIF_CONTROL |				\
4686 	FIF_PSPOLL |				\
4687 	FIF_OTHER_BSS |				\
4688 	FIF_BCN_PRBRESP_PROMISC |		\
4689 	FIF_PROBE_REQ |				\
4690 	FIF_FCSFAIL)
4691 
4692 static void ath10k_configure_filter(struct ieee80211_hw *hw,
4693 				    unsigned int changed_flags,
4694 				    unsigned int *total_flags,
4695 				    u64 multicast)
4696 {
4697 	struct ath10k *ar = hw->priv;
4698 	int ret;
4699 
4700 	mutex_lock(&ar->conf_mutex);
4701 
4702 	changed_flags &= SUPPORTED_FILTERS;
4703 	*total_flags &= SUPPORTED_FILTERS;
4704 	ar->filter_flags = *total_flags;
4705 
4706 	ret = ath10k_monitor_recalc(ar);
4707 	if (ret)
4708 		ath10k_warn(ar, "failed to recalc montior: %d\n", ret);
4709 
4710 	mutex_unlock(&ar->conf_mutex);
4711 }
4712 
4713 static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
4714 				    struct ieee80211_vif *vif,
4715 				    struct ieee80211_bss_conf *info,
4716 				    u32 changed)
4717 {
4718 	struct ath10k *ar = hw->priv;
4719 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
4720 	int ret = 0;
4721 	u32 vdev_param, pdev_param, slottime, preamble;
4722 
4723 	mutex_lock(&ar->conf_mutex);
4724 
4725 	if (changed & BSS_CHANGED_IBSS)
4726 		ath10k_control_ibss(arvif, info, vif->addr);
4727 
4728 	if (changed & BSS_CHANGED_BEACON_INT) {
4729 		arvif->beacon_interval = info->beacon_int;
4730 		vdev_param = ar->wmi.vdev_param->beacon_interval;
4731 		ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
4732 						arvif->beacon_interval);
4733 		ath10k_dbg(ar, ATH10K_DBG_MAC,
4734 			   "mac vdev %d beacon_interval %d\n",
4735 			   arvif->vdev_id, arvif->beacon_interval);
4736 
4737 		if (ret)
4738 			ath10k_warn(ar, "failed to set beacon interval for vdev %d: %i\n",
4739 				    arvif->vdev_id, ret);
4740 	}
4741 
4742 	if (changed & BSS_CHANGED_BEACON) {
4743 		ath10k_dbg(ar, ATH10K_DBG_MAC,
4744 			   "vdev %d set beacon tx mode to staggered\n",
4745 			   arvif->vdev_id);
4746 
4747 		pdev_param = ar->wmi.pdev_param->beacon_tx_mode;
4748 		ret = ath10k_wmi_pdev_set_param(ar, pdev_param,
4749 						WMI_BEACON_STAGGERED_MODE);
4750 		if (ret)
4751 			ath10k_warn(ar, "failed to set beacon mode for vdev %d: %i\n",
4752 				    arvif->vdev_id, ret);
4753 
4754 		ret = ath10k_mac_setup_bcn_tmpl(arvif);
4755 		if (ret)
4756 			ath10k_warn(ar, "failed to update beacon template: %d\n",
4757 				    ret);
4758 
4759 		if (ieee80211_vif_is_mesh(vif)) {
4760 			/* mesh doesn't use SSID but firmware needs it */
4761 			strncpy(arvif->u.ap.ssid, "mesh",
4762 				sizeof(arvif->u.ap.ssid));
4763 			arvif->u.ap.ssid_len = 4;
4764 		}
4765 	}
4766 
4767 	if (changed & BSS_CHANGED_AP_PROBE_RESP) {
4768 		ret = ath10k_mac_setup_prb_tmpl(arvif);
4769 		if (ret)
4770 			ath10k_warn(ar, "failed to setup probe resp template on vdev %i: %d\n",
4771 				    arvif->vdev_id, ret);
4772 	}
4773 
4774 	if (changed & (BSS_CHANGED_BEACON_INFO | BSS_CHANGED_BEACON)) {
4775 		arvif->dtim_period = info->dtim_period;
4776 
4777 		ath10k_dbg(ar, ATH10K_DBG_MAC,
4778 			   "mac vdev %d dtim_period %d\n",
4779 			   arvif->vdev_id, arvif->dtim_period);
4780 
4781 		vdev_param = ar->wmi.vdev_param->dtim_period;
4782 		ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
4783 						arvif->dtim_period);
4784 		if (ret)
4785 			ath10k_warn(ar, "failed to set dtim period for vdev %d: %i\n",
4786 				    arvif->vdev_id, ret);
4787 	}
4788 
4789 	if (changed & BSS_CHANGED_SSID &&
4790 	    vif->type == NL80211_IFTYPE_AP) {
4791 		arvif->u.ap.ssid_len = info->ssid_len;
4792 		if (info->ssid_len)
4793 			memcpy(arvif->u.ap.ssid, info->ssid, info->ssid_len);
4794 		arvif->u.ap.hidden_ssid = info->hidden_ssid;
4795 	}
4796 
4797 	if (changed & BSS_CHANGED_BSSID && !is_zero_ether_addr(info->bssid))
4798 		ether_addr_copy(arvif->bssid, info->bssid);
4799 
4800 	if (changed & BSS_CHANGED_BEACON_ENABLED)
4801 		ath10k_control_beaconing(arvif, info);
4802 
4803 	if (changed & BSS_CHANGED_ERP_CTS_PROT) {
4804 		arvif->use_cts_prot = info->use_cts_prot;
4805 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d cts_prot %d\n",
4806 			   arvif->vdev_id, info->use_cts_prot);
4807 
4808 		ret = ath10k_recalc_rtscts_prot(arvif);
4809 		if (ret)
4810 			ath10k_warn(ar, "failed to recalculate rts/cts prot for vdev %d: %d\n",
4811 				    arvif->vdev_id, ret);
4812 
4813 		vdev_param = ar->wmi.vdev_param->protection_mode;
4814 		ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
4815 						info->use_cts_prot ? 1 : 0);
4816 		if (ret)
4817 			ath10k_warn(ar, "failed to set protection mode %d on vdev %i: %d\n",
4818 				    info->use_cts_prot, arvif->vdev_id, ret);
4819 	}
4820 
4821 	if (changed & BSS_CHANGED_ERP_SLOT) {
4822 		if (info->use_short_slot)
4823 			slottime = WMI_VDEV_SLOT_TIME_SHORT; /* 9us */
4824 
4825 		else
4826 			slottime = WMI_VDEV_SLOT_TIME_LONG; /* 20us */
4827 
4828 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d slot_time %d\n",
4829 			   arvif->vdev_id, slottime);
4830 
4831 		vdev_param = ar->wmi.vdev_param->slot_time;
4832 		ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
4833 						slottime);
4834 		if (ret)
4835 			ath10k_warn(ar, "failed to set erp slot for vdev %d: %i\n",
4836 				    arvif->vdev_id, ret);
4837 	}
4838 
4839 	if (changed & BSS_CHANGED_ERP_PREAMBLE) {
4840 		if (info->use_short_preamble)
4841 			preamble = WMI_VDEV_PREAMBLE_SHORT;
4842 		else
4843 			preamble = WMI_VDEV_PREAMBLE_LONG;
4844 
4845 		ath10k_dbg(ar, ATH10K_DBG_MAC,
4846 			   "mac vdev %d preamble %dn",
4847 			   arvif->vdev_id, preamble);
4848 
4849 		vdev_param = ar->wmi.vdev_param->preamble;
4850 		ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
4851 						preamble);
4852 		if (ret)
4853 			ath10k_warn(ar, "failed to set preamble for vdev %d: %i\n",
4854 				    arvif->vdev_id, ret);
4855 	}
4856 
4857 	if (changed & BSS_CHANGED_ASSOC) {
4858 		if (info->assoc) {
4859 			/* Workaround: Make sure monitor vdev is not running
4860 			 * when associating to prevent some firmware revisions
4861 			 * (e.g. 10.1 and 10.2) from crashing.
4862 			 */
4863 			if (ar->monitor_started)
4864 				ath10k_monitor_stop(ar);
4865 			ath10k_bss_assoc(hw, vif, info);
4866 			ath10k_monitor_recalc(ar);
4867 		} else {
4868 			ath10k_bss_disassoc(hw, vif);
4869 		}
4870 	}
4871 
4872 	if (changed & BSS_CHANGED_TXPOWER) {
4873 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev_id %i txpower %d\n",
4874 			   arvif->vdev_id, info->txpower);
4875 
4876 		arvif->txpower = info->txpower;
4877 		ret = ath10k_mac_txpower_recalc(ar);
4878 		if (ret)
4879 			ath10k_warn(ar, "failed to recalc tx power: %d\n", ret);
4880 	}
4881 
4882 	if (changed & BSS_CHANGED_PS) {
4883 		arvif->ps = vif->bss_conf.ps;
4884 
4885 		ret = ath10k_config_ps(ar);
4886 		if (ret)
4887 			ath10k_warn(ar, "failed to setup ps on vdev %i: %d\n",
4888 				    arvif->vdev_id, ret);
4889 	}
4890 
4891 	mutex_unlock(&ar->conf_mutex);
4892 }
4893 
4894 static int ath10k_hw_scan(struct ieee80211_hw *hw,
4895 			  struct ieee80211_vif *vif,
4896 			  struct ieee80211_scan_request *hw_req)
4897 {
4898 	struct ath10k *ar = hw->priv;
4899 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
4900 	struct cfg80211_scan_request *req = &hw_req->req;
4901 	struct wmi_start_scan_arg arg;
4902 	int ret = 0;
4903 	int i;
4904 
4905 	mutex_lock(&ar->conf_mutex);
4906 
4907 	spin_lock_bh(&ar->data_lock);
4908 	switch (ar->scan.state) {
4909 	case ATH10K_SCAN_IDLE:
4910 		reinit_completion(&ar->scan.started);
4911 		reinit_completion(&ar->scan.completed);
4912 		ar->scan.state = ATH10K_SCAN_STARTING;
4913 		ar->scan.is_roc = false;
4914 		ar->scan.vdev_id = arvif->vdev_id;
4915 		ret = 0;
4916 		break;
4917 	case ATH10K_SCAN_STARTING:
4918 	case ATH10K_SCAN_RUNNING:
4919 	case ATH10K_SCAN_ABORTING:
4920 		ret = -EBUSY;
4921 		break;
4922 	}
4923 	spin_unlock_bh(&ar->data_lock);
4924 
4925 	if (ret)
4926 		goto exit;
4927 
4928 	memset(&arg, 0, sizeof(arg));
4929 	ath10k_wmi_start_scan_init(ar, &arg);
4930 	arg.vdev_id = arvif->vdev_id;
4931 	arg.scan_id = ATH10K_SCAN_ID;
4932 
4933 	if (req->ie_len) {
4934 		arg.ie_len = req->ie_len;
4935 		memcpy(arg.ie, req->ie, arg.ie_len);
4936 	}
4937 
4938 	if (req->n_ssids) {
4939 		arg.n_ssids = req->n_ssids;
4940 		for (i = 0; i < arg.n_ssids; i++) {
4941 			arg.ssids[i].len  = req->ssids[i].ssid_len;
4942 			arg.ssids[i].ssid = req->ssids[i].ssid;
4943 		}
4944 	} else {
4945 		arg.scan_ctrl_flags |= WMI_SCAN_FLAG_PASSIVE;
4946 	}
4947 
4948 	if (req->n_channels) {
4949 		arg.n_channels = req->n_channels;
4950 		for (i = 0; i < arg.n_channels; i++)
4951 			arg.channels[i] = req->channels[i]->center_freq;
4952 	}
4953 
4954 	ret = ath10k_start_scan(ar, &arg);
4955 	if (ret) {
4956 		ath10k_warn(ar, "failed to start hw scan: %d\n", ret);
4957 		spin_lock_bh(&ar->data_lock);
4958 		ar->scan.state = ATH10K_SCAN_IDLE;
4959 		spin_unlock_bh(&ar->data_lock);
4960 	}
4961 
4962 	/* Add a 200ms margin to account for event/command processing */
4963 	ieee80211_queue_delayed_work(ar->hw, &ar->scan.timeout,
4964 				     msecs_to_jiffies(arg.max_scan_time +
4965 						      200));
4966 
4967 exit:
4968 	mutex_unlock(&ar->conf_mutex);
4969 	return ret;
4970 }
4971 
4972 static void ath10k_cancel_hw_scan(struct ieee80211_hw *hw,
4973 				  struct ieee80211_vif *vif)
4974 {
4975 	struct ath10k *ar = hw->priv;
4976 
4977 	mutex_lock(&ar->conf_mutex);
4978 	ath10k_scan_abort(ar);
4979 	mutex_unlock(&ar->conf_mutex);
4980 
4981 	cancel_delayed_work_sync(&ar->scan.timeout);
4982 }
4983 
4984 static void ath10k_set_key_h_def_keyidx(struct ath10k *ar,
4985 					struct ath10k_vif *arvif,
4986 					enum set_key_cmd cmd,
4987 					struct ieee80211_key_conf *key)
4988 {
4989 	u32 vdev_param = arvif->ar->wmi.vdev_param->def_keyid;
4990 	int ret;
4991 
4992 	/* 10.1 firmware branch requires default key index to be set to group
4993 	 * key index after installing it. Otherwise FW/HW Txes corrupted
4994 	 * frames with multi-vif APs. This is not required for main firmware
4995 	 * branch (e.g. 636).
4996 	 *
4997 	 * This is also needed for 636 fw for IBSS-RSN to work more reliably.
4998 	 *
4999 	 * FIXME: It remains unknown if this is required for multi-vif STA
5000 	 * interfaces on 10.1.
5001 	 */
5002 
5003 	if (arvif->vdev_type != WMI_VDEV_TYPE_AP &&
5004 	    arvif->vdev_type != WMI_VDEV_TYPE_IBSS)
5005 		return;
5006 
5007 	if (key->cipher == WLAN_CIPHER_SUITE_WEP40)
5008 		return;
5009 
5010 	if (key->cipher == WLAN_CIPHER_SUITE_WEP104)
5011 		return;
5012 
5013 	if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
5014 		return;
5015 
5016 	if (cmd != SET_KEY)
5017 		return;
5018 
5019 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
5020 					key->keyidx);
5021 	if (ret)
5022 		ath10k_warn(ar, "failed to set vdev %i group key as default key: %d\n",
5023 			    arvif->vdev_id, ret);
5024 }
5025 
5026 static int ath10k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
5027 			  struct ieee80211_vif *vif, struct ieee80211_sta *sta,
5028 			  struct ieee80211_key_conf *key)
5029 {
5030 	struct ath10k *ar = hw->priv;
5031 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
5032 	struct ath10k_peer *peer;
5033 	const u8 *peer_addr;
5034 	bool is_wep = key->cipher == WLAN_CIPHER_SUITE_WEP40 ||
5035 		      key->cipher == WLAN_CIPHER_SUITE_WEP104;
5036 	int ret = 0;
5037 	int ret2;
5038 	u32 flags = 0;
5039 	u32 flags2;
5040 
5041 	/* this one needs to be done in software */
5042 	if (key->cipher == WLAN_CIPHER_SUITE_AES_CMAC)
5043 		return 1;
5044 
5045 	if (arvif->nohwcrypt)
5046 		return 1;
5047 
5048 	if (key->keyidx > WMI_MAX_KEY_INDEX)
5049 		return -ENOSPC;
5050 
5051 	mutex_lock(&ar->conf_mutex);
5052 
5053 	if (sta)
5054 		peer_addr = sta->addr;
5055 	else if (arvif->vdev_type == WMI_VDEV_TYPE_STA)
5056 		peer_addr = vif->bss_conf.bssid;
5057 	else
5058 		peer_addr = vif->addr;
5059 
5060 	key->hw_key_idx = key->keyidx;
5061 
5062 	if (is_wep) {
5063 		if (cmd == SET_KEY)
5064 			arvif->wep_keys[key->keyidx] = key;
5065 		else
5066 			arvif->wep_keys[key->keyidx] = NULL;
5067 	}
5068 
5069 	/* the peer should not disappear in mid-way (unless FW goes awry) since
5070 	 * we already hold conf_mutex. we just make sure its there now. */
5071 	spin_lock_bh(&ar->data_lock);
5072 	peer = ath10k_peer_find(ar, arvif->vdev_id, peer_addr);
5073 	spin_unlock_bh(&ar->data_lock);
5074 
5075 	if (!peer) {
5076 		if (cmd == SET_KEY) {
5077 			ath10k_warn(ar, "failed to install key for non-existent peer %pM\n",
5078 				    peer_addr);
5079 			ret = -EOPNOTSUPP;
5080 			goto exit;
5081 		} else {
5082 			/* if the peer doesn't exist there is no key to disable
5083 			 * anymore */
5084 			goto exit;
5085 		}
5086 	}
5087 
5088 	if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
5089 		flags |= WMI_KEY_PAIRWISE;
5090 	else
5091 		flags |= WMI_KEY_GROUP;
5092 
5093 	if (is_wep) {
5094 		if (cmd == DISABLE_KEY)
5095 			ath10k_clear_vdev_key(arvif, key);
5096 
5097 		/* When WEP keys are uploaded it's possible that there are
5098 		 * stations associated already (e.g. when merging) without any
5099 		 * keys. Static WEP needs an explicit per-peer key upload.
5100 		 */
5101 		if (vif->type == NL80211_IFTYPE_ADHOC &&
5102 		    cmd == SET_KEY)
5103 			ath10k_mac_vif_update_wep_key(arvif, key);
5104 
5105 		/* 802.1x never sets the def_wep_key_idx so each set_key()
5106 		 * call changes default tx key.
5107 		 *
5108 		 * Static WEP sets def_wep_key_idx via .set_default_unicast_key
5109 		 * after first set_key().
5110 		 */
5111 		if (cmd == SET_KEY && arvif->def_wep_key_idx == -1)
5112 			flags |= WMI_KEY_TX_USAGE;
5113 	}
5114 
5115 	ret = ath10k_install_key(arvif, key, cmd, peer_addr, flags);
5116 	if (ret) {
5117 		WARN_ON(ret > 0);
5118 		ath10k_warn(ar, "failed to install key for vdev %i peer %pM: %d\n",
5119 			    arvif->vdev_id, peer_addr, ret);
5120 		goto exit;
5121 	}
5122 
5123 	/* mac80211 sets static WEP keys as groupwise while firmware requires
5124 	 * them to be installed twice as both pairwise and groupwise.
5125 	 */
5126 	if (is_wep && !sta && vif->type == NL80211_IFTYPE_STATION) {
5127 		flags2 = flags;
5128 		flags2 &= ~WMI_KEY_GROUP;
5129 		flags2 |= WMI_KEY_PAIRWISE;
5130 
5131 		ret = ath10k_install_key(arvif, key, cmd, peer_addr, flags2);
5132 		if (ret) {
5133 			WARN_ON(ret > 0);
5134 			ath10k_warn(ar, "failed to install (ucast) key for vdev %i peer %pM: %d\n",
5135 				    arvif->vdev_id, peer_addr, ret);
5136 			ret2 = ath10k_install_key(arvif, key, DISABLE_KEY,
5137 						  peer_addr, flags);
5138 			if (ret2) {
5139 				WARN_ON(ret2 > 0);
5140 				ath10k_warn(ar, "failed to disable (mcast) key for vdev %i peer %pM: %d\n",
5141 					    arvif->vdev_id, peer_addr, ret2);
5142 			}
5143 			goto exit;
5144 		}
5145 	}
5146 
5147 	ath10k_set_key_h_def_keyidx(ar, arvif, cmd, key);
5148 
5149 	spin_lock_bh(&ar->data_lock);
5150 	peer = ath10k_peer_find(ar, arvif->vdev_id, peer_addr);
5151 	if (peer && cmd == SET_KEY)
5152 		peer->keys[key->keyidx] = key;
5153 	else if (peer && cmd == DISABLE_KEY)
5154 		peer->keys[key->keyidx] = NULL;
5155 	else if (peer == NULL)
5156 		/* impossible unless FW goes crazy */
5157 		ath10k_warn(ar, "Peer %pM disappeared!\n", peer_addr);
5158 	spin_unlock_bh(&ar->data_lock);
5159 
5160 exit:
5161 	mutex_unlock(&ar->conf_mutex);
5162 	return ret;
5163 }
5164 
5165 static void ath10k_set_default_unicast_key(struct ieee80211_hw *hw,
5166 					   struct ieee80211_vif *vif,
5167 					   int keyidx)
5168 {
5169 	struct ath10k *ar = hw->priv;
5170 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
5171 	int ret;
5172 
5173 	mutex_lock(&arvif->ar->conf_mutex);
5174 
5175 	if (arvif->ar->state != ATH10K_STATE_ON)
5176 		goto unlock;
5177 
5178 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d set keyidx %d\n",
5179 		   arvif->vdev_id, keyidx);
5180 
5181 	ret = ath10k_wmi_vdev_set_param(arvif->ar,
5182 					arvif->vdev_id,
5183 					arvif->ar->wmi.vdev_param->def_keyid,
5184 					keyidx);
5185 
5186 	if (ret) {
5187 		ath10k_warn(ar, "failed to update wep key index for vdev %d: %d\n",
5188 			    arvif->vdev_id,
5189 			    ret);
5190 		goto unlock;
5191 	}
5192 
5193 	arvif->def_wep_key_idx = keyidx;
5194 
5195 unlock:
5196 	mutex_unlock(&arvif->ar->conf_mutex);
5197 }
5198 
5199 static void ath10k_sta_rc_update_wk(struct work_struct *wk)
5200 {
5201 	struct ath10k *ar;
5202 	struct ath10k_vif *arvif;
5203 	struct ath10k_sta *arsta;
5204 	struct ieee80211_sta *sta;
5205 	struct cfg80211_chan_def def;
5206 	enum ieee80211_band band;
5207 	const u8 *ht_mcs_mask;
5208 	const u16 *vht_mcs_mask;
5209 	u32 changed, bw, nss, smps;
5210 	int err;
5211 
5212 	arsta = container_of(wk, struct ath10k_sta, update_wk);
5213 	sta = container_of((void *)arsta, struct ieee80211_sta, drv_priv);
5214 	arvif = arsta->arvif;
5215 	ar = arvif->ar;
5216 
5217 	if (WARN_ON(ath10k_mac_vif_chan(arvif->vif, &def)))
5218 		return;
5219 
5220 	band = def.chan->band;
5221 	ht_mcs_mask = arvif->bitrate_mask.control[band].ht_mcs;
5222 	vht_mcs_mask = arvif->bitrate_mask.control[band].vht_mcs;
5223 
5224 	spin_lock_bh(&ar->data_lock);
5225 
5226 	changed = arsta->changed;
5227 	arsta->changed = 0;
5228 
5229 	bw = arsta->bw;
5230 	nss = arsta->nss;
5231 	smps = arsta->smps;
5232 
5233 	spin_unlock_bh(&ar->data_lock);
5234 
5235 	mutex_lock(&ar->conf_mutex);
5236 
5237 	nss = max_t(u32, 1, nss);
5238 	nss = min(nss, max(ath10k_mac_max_ht_nss(ht_mcs_mask),
5239 			   ath10k_mac_max_vht_nss(vht_mcs_mask)));
5240 
5241 	if (changed & IEEE80211_RC_BW_CHANGED) {
5242 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM peer bw %d\n",
5243 			   sta->addr, bw);
5244 
5245 		err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr,
5246 						WMI_PEER_CHAN_WIDTH, bw);
5247 		if (err)
5248 			ath10k_warn(ar, "failed to update STA %pM peer bw %d: %d\n",
5249 				    sta->addr, bw, err);
5250 	}
5251 
5252 	if (changed & IEEE80211_RC_NSS_CHANGED) {
5253 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM nss %d\n",
5254 			   sta->addr, nss);
5255 
5256 		err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr,
5257 						WMI_PEER_NSS, nss);
5258 		if (err)
5259 			ath10k_warn(ar, "failed to update STA %pM nss %d: %d\n",
5260 				    sta->addr, nss, err);
5261 	}
5262 
5263 	if (changed & IEEE80211_RC_SMPS_CHANGED) {
5264 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM smps %d\n",
5265 			   sta->addr, smps);
5266 
5267 		err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr,
5268 						WMI_PEER_SMPS_STATE, smps);
5269 		if (err)
5270 			ath10k_warn(ar, "failed to update STA %pM smps %d: %d\n",
5271 				    sta->addr, smps, err);
5272 	}
5273 
5274 	if (changed & IEEE80211_RC_SUPP_RATES_CHANGED ||
5275 	    changed & IEEE80211_RC_NSS_CHANGED) {
5276 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM supp rates/nss\n",
5277 			   sta->addr);
5278 
5279 		err = ath10k_station_assoc(ar, arvif->vif, sta, true);
5280 		if (err)
5281 			ath10k_warn(ar, "failed to reassociate station: %pM\n",
5282 				    sta->addr);
5283 	}
5284 
5285 	mutex_unlock(&ar->conf_mutex);
5286 }
5287 
5288 static int ath10k_mac_inc_num_stations(struct ath10k_vif *arvif,
5289 				       struct ieee80211_sta *sta)
5290 {
5291 	struct ath10k *ar = arvif->ar;
5292 
5293 	lockdep_assert_held(&ar->conf_mutex);
5294 
5295 	if (arvif->vdev_type == WMI_VDEV_TYPE_STA && !sta->tdls)
5296 		return 0;
5297 
5298 	if (ar->num_stations >= ar->max_num_stations)
5299 		return -ENOBUFS;
5300 
5301 	ar->num_stations++;
5302 
5303 	return 0;
5304 }
5305 
5306 static void ath10k_mac_dec_num_stations(struct ath10k_vif *arvif,
5307 					struct ieee80211_sta *sta)
5308 {
5309 	struct ath10k *ar = arvif->ar;
5310 
5311 	lockdep_assert_held(&ar->conf_mutex);
5312 
5313 	if (arvif->vdev_type == WMI_VDEV_TYPE_STA && !sta->tdls)
5314 		return;
5315 
5316 	ar->num_stations--;
5317 }
5318 
5319 struct ath10k_mac_tdls_iter_data {
5320 	u32 num_tdls_stations;
5321 	struct ieee80211_vif *curr_vif;
5322 };
5323 
5324 static void ath10k_mac_tdls_vif_stations_count_iter(void *data,
5325 						    struct ieee80211_sta *sta)
5326 {
5327 	struct ath10k_mac_tdls_iter_data *iter_data = data;
5328 	struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
5329 	struct ieee80211_vif *sta_vif = arsta->arvif->vif;
5330 
5331 	if (sta->tdls && sta_vif == iter_data->curr_vif)
5332 		iter_data->num_tdls_stations++;
5333 }
5334 
5335 static int ath10k_mac_tdls_vif_stations_count(struct ieee80211_hw *hw,
5336 					      struct ieee80211_vif *vif)
5337 {
5338 	struct ath10k_mac_tdls_iter_data data = {};
5339 
5340 	data.curr_vif = vif;
5341 
5342 	ieee80211_iterate_stations_atomic(hw,
5343 					  ath10k_mac_tdls_vif_stations_count_iter,
5344 					  &data);
5345 	return data.num_tdls_stations;
5346 }
5347 
5348 static void ath10k_mac_tdls_vifs_count_iter(void *data, u8 *mac,
5349 					    struct ieee80211_vif *vif)
5350 {
5351 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
5352 	int *num_tdls_vifs = data;
5353 
5354 	if (vif->type != NL80211_IFTYPE_STATION)
5355 		return;
5356 
5357 	if (ath10k_mac_tdls_vif_stations_count(arvif->ar->hw, vif) > 0)
5358 		(*num_tdls_vifs)++;
5359 }
5360 
5361 static int ath10k_mac_tdls_vifs_count(struct ieee80211_hw *hw)
5362 {
5363 	int num_tdls_vifs = 0;
5364 
5365 	ieee80211_iterate_active_interfaces_atomic(hw,
5366 						   IEEE80211_IFACE_ITER_NORMAL,
5367 						   ath10k_mac_tdls_vifs_count_iter,
5368 						   &num_tdls_vifs);
5369 	return num_tdls_vifs;
5370 }
5371 
5372 static int ath10k_sta_state(struct ieee80211_hw *hw,
5373 			    struct ieee80211_vif *vif,
5374 			    struct ieee80211_sta *sta,
5375 			    enum ieee80211_sta_state old_state,
5376 			    enum ieee80211_sta_state new_state)
5377 {
5378 	struct ath10k *ar = hw->priv;
5379 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
5380 	struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
5381 	int ret = 0;
5382 
5383 	if (old_state == IEEE80211_STA_NOTEXIST &&
5384 	    new_state == IEEE80211_STA_NONE) {
5385 		memset(arsta, 0, sizeof(*arsta));
5386 		arsta->arvif = arvif;
5387 		INIT_WORK(&arsta->update_wk, ath10k_sta_rc_update_wk);
5388 	}
5389 
5390 	/* cancel must be done outside the mutex to avoid deadlock */
5391 	if ((old_state == IEEE80211_STA_NONE &&
5392 	     new_state == IEEE80211_STA_NOTEXIST))
5393 		cancel_work_sync(&arsta->update_wk);
5394 
5395 	mutex_lock(&ar->conf_mutex);
5396 
5397 	if (old_state == IEEE80211_STA_NOTEXIST &&
5398 	    new_state == IEEE80211_STA_NONE) {
5399 		/*
5400 		 * New station addition.
5401 		 */
5402 		enum wmi_peer_type peer_type = WMI_PEER_TYPE_DEFAULT;
5403 		u32 num_tdls_stations;
5404 		u32 num_tdls_vifs;
5405 
5406 		ath10k_dbg(ar, ATH10K_DBG_MAC,
5407 			   "mac vdev %d peer create %pM (new sta) sta %d / %d peer %d / %d\n",
5408 			   arvif->vdev_id, sta->addr,
5409 			   ar->num_stations + 1, ar->max_num_stations,
5410 			   ar->num_peers + 1, ar->max_num_peers);
5411 
5412 		ret = ath10k_mac_inc_num_stations(arvif, sta);
5413 		if (ret) {
5414 			ath10k_warn(ar, "refusing to associate station: too many connected already (%d)\n",
5415 				    ar->max_num_stations);
5416 			goto exit;
5417 		}
5418 
5419 		if (sta->tdls)
5420 			peer_type = WMI_PEER_TYPE_TDLS;
5421 
5422 		ret = ath10k_peer_create(ar, arvif->vdev_id, sta->addr,
5423 					 peer_type);
5424 		if (ret) {
5425 			ath10k_warn(ar, "failed to add peer %pM for vdev %d when adding a new sta: %i\n",
5426 				    sta->addr, arvif->vdev_id, ret);
5427 			ath10k_mac_dec_num_stations(arvif, sta);
5428 			goto exit;
5429 		}
5430 
5431 		if (!sta->tdls)
5432 			goto exit;
5433 
5434 		num_tdls_stations = ath10k_mac_tdls_vif_stations_count(hw, vif);
5435 		num_tdls_vifs = ath10k_mac_tdls_vifs_count(hw);
5436 
5437 		if (num_tdls_vifs >= ar->max_num_tdls_vdevs &&
5438 		    num_tdls_stations == 0) {
5439 			ath10k_warn(ar, "vdev %i exceeded maximum number of tdls vdevs %i\n",
5440 				    arvif->vdev_id, ar->max_num_tdls_vdevs);
5441 			ath10k_peer_delete(ar, arvif->vdev_id, sta->addr);
5442 			ath10k_mac_dec_num_stations(arvif, sta);
5443 			ret = -ENOBUFS;
5444 			goto exit;
5445 		}
5446 
5447 		if (num_tdls_stations == 0) {
5448 			/* This is the first tdls peer in current vif */
5449 			enum wmi_tdls_state state = WMI_TDLS_ENABLE_ACTIVE;
5450 
5451 			ret = ath10k_wmi_update_fw_tdls_state(ar, arvif->vdev_id,
5452 							      state);
5453 			if (ret) {
5454 				ath10k_warn(ar, "failed to update fw tdls state on vdev %i: %i\n",
5455 					    arvif->vdev_id, ret);
5456 				ath10k_peer_delete(ar, arvif->vdev_id,
5457 						   sta->addr);
5458 				ath10k_mac_dec_num_stations(arvif, sta);
5459 				goto exit;
5460 			}
5461 		}
5462 
5463 		ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id, sta,
5464 						  WMI_TDLS_PEER_STATE_PEERING);
5465 		if (ret) {
5466 			ath10k_warn(ar,
5467 				    "failed to update tdls peer %pM for vdev %d when adding a new sta: %i\n",
5468 				    sta->addr, arvif->vdev_id, ret);
5469 			ath10k_peer_delete(ar, arvif->vdev_id, sta->addr);
5470 			ath10k_mac_dec_num_stations(arvif, sta);
5471 
5472 			if (num_tdls_stations != 0)
5473 				goto exit;
5474 			ath10k_wmi_update_fw_tdls_state(ar, arvif->vdev_id,
5475 							WMI_TDLS_DISABLE);
5476 		}
5477 	} else if ((old_state == IEEE80211_STA_NONE &&
5478 		    new_state == IEEE80211_STA_NOTEXIST)) {
5479 		/*
5480 		 * Existing station deletion.
5481 		 */
5482 		ath10k_dbg(ar, ATH10K_DBG_MAC,
5483 			   "mac vdev %d peer delete %pM (sta gone)\n",
5484 			   arvif->vdev_id, sta->addr);
5485 
5486 		ret = ath10k_peer_delete(ar, arvif->vdev_id, sta->addr);
5487 		if (ret)
5488 			ath10k_warn(ar, "failed to delete peer %pM for vdev %d: %i\n",
5489 				    sta->addr, arvif->vdev_id, ret);
5490 
5491 		ath10k_mac_dec_num_stations(arvif, sta);
5492 
5493 		if (!sta->tdls)
5494 			goto exit;
5495 
5496 		if (ath10k_mac_tdls_vif_stations_count(hw, vif))
5497 			goto exit;
5498 
5499 		/* This was the last tdls peer in current vif */
5500 		ret = ath10k_wmi_update_fw_tdls_state(ar, arvif->vdev_id,
5501 						      WMI_TDLS_DISABLE);
5502 		if (ret) {
5503 			ath10k_warn(ar, "failed to update fw tdls state on vdev %i: %i\n",
5504 				    arvif->vdev_id, ret);
5505 		}
5506 	} else if (old_state == IEEE80211_STA_AUTH &&
5507 		   new_state == IEEE80211_STA_ASSOC &&
5508 		   (vif->type == NL80211_IFTYPE_AP ||
5509 		    vif->type == NL80211_IFTYPE_MESH_POINT ||
5510 		    vif->type == NL80211_IFTYPE_ADHOC)) {
5511 		/*
5512 		 * New association.
5513 		 */
5514 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac sta %pM associated\n",
5515 			   sta->addr);
5516 
5517 		ret = ath10k_station_assoc(ar, vif, sta, false);
5518 		if (ret)
5519 			ath10k_warn(ar, "failed to associate station %pM for vdev %i: %i\n",
5520 				    sta->addr, arvif->vdev_id, ret);
5521 	} else if (old_state == IEEE80211_STA_ASSOC &&
5522 		   new_state == IEEE80211_STA_AUTHORIZED &&
5523 		   sta->tdls) {
5524 		/*
5525 		 * Tdls station authorized.
5526 		 */
5527 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac tdls sta %pM authorized\n",
5528 			   sta->addr);
5529 
5530 		ret = ath10k_station_assoc(ar, vif, sta, false);
5531 		if (ret) {
5532 			ath10k_warn(ar, "failed to associate tdls station %pM for vdev %i: %i\n",
5533 				    sta->addr, arvif->vdev_id, ret);
5534 			goto exit;
5535 		}
5536 
5537 		ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id, sta,
5538 						  WMI_TDLS_PEER_STATE_CONNECTED);
5539 		if (ret)
5540 			ath10k_warn(ar, "failed to update tdls peer %pM for vdev %i: %i\n",
5541 				    sta->addr, arvif->vdev_id, ret);
5542 	} else if (old_state == IEEE80211_STA_ASSOC &&
5543 		    new_state == IEEE80211_STA_AUTH &&
5544 		    (vif->type == NL80211_IFTYPE_AP ||
5545 		     vif->type == NL80211_IFTYPE_MESH_POINT ||
5546 		     vif->type == NL80211_IFTYPE_ADHOC)) {
5547 		/*
5548 		 * Disassociation.
5549 		 */
5550 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac sta %pM disassociated\n",
5551 			   sta->addr);
5552 
5553 		ret = ath10k_station_disassoc(ar, vif, sta);
5554 		if (ret)
5555 			ath10k_warn(ar, "failed to disassociate station: %pM vdev %i: %i\n",
5556 				    sta->addr, arvif->vdev_id, ret);
5557 	}
5558 exit:
5559 	mutex_unlock(&ar->conf_mutex);
5560 	return ret;
5561 }
5562 
5563 static int ath10k_conf_tx_uapsd(struct ath10k *ar, struct ieee80211_vif *vif,
5564 				u16 ac, bool enable)
5565 {
5566 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
5567 	struct wmi_sta_uapsd_auto_trig_arg arg = {};
5568 	u32 prio = 0, acc = 0;
5569 	u32 value = 0;
5570 	int ret = 0;
5571 
5572 	lockdep_assert_held(&ar->conf_mutex);
5573 
5574 	if (arvif->vdev_type != WMI_VDEV_TYPE_STA)
5575 		return 0;
5576 
5577 	switch (ac) {
5578 	case IEEE80211_AC_VO:
5579 		value = WMI_STA_PS_UAPSD_AC3_DELIVERY_EN |
5580 			WMI_STA_PS_UAPSD_AC3_TRIGGER_EN;
5581 		prio = 7;
5582 		acc = 3;
5583 		break;
5584 	case IEEE80211_AC_VI:
5585 		value = WMI_STA_PS_UAPSD_AC2_DELIVERY_EN |
5586 			WMI_STA_PS_UAPSD_AC2_TRIGGER_EN;
5587 		prio = 5;
5588 		acc = 2;
5589 		break;
5590 	case IEEE80211_AC_BE:
5591 		value = WMI_STA_PS_UAPSD_AC1_DELIVERY_EN |
5592 			WMI_STA_PS_UAPSD_AC1_TRIGGER_EN;
5593 		prio = 2;
5594 		acc = 1;
5595 		break;
5596 	case IEEE80211_AC_BK:
5597 		value = WMI_STA_PS_UAPSD_AC0_DELIVERY_EN |
5598 			WMI_STA_PS_UAPSD_AC0_TRIGGER_EN;
5599 		prio = 0;
5600 		acc = 0;
5601 		break;
5602 	}
5603 
5604 	if (enable)
5605 		arvif->u.sta.uapsd |= value;
5606 	else
5607 		arvif->u.sta.uapsd &= ~value;
5608 
5609 	ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
5610 					  WMI_STA_PS_PARAM_UAPSD,
5611 					  arvif->u.sta.uapsd);
5612 	if (ret) {
5613 		ath10k_warn(ar, "failed to set uapsd params: %d\n", ret);
5614 		goto exit;
5615 	}
5616 
5617 	if (arvif->u.sta.uapsd)
5618 		value = WMI_STA_PS_RX_WAKE_POLICY_POLL_UAPSD;
5619 	else
5620 		value = WMI_STA_PS_RX_WAKE_POLICY_WAKE;
5621 
5622 	ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
5623 					  WMI_STA_PS_PARAM_RX_WAKE_POLICY,
5624 					  value);
5625 	if (ret)
5626 		ath10k_warn(ar, "failed to set rx wake param: %d\n", ret);
5627 
5628 	ret = ath10k_mac_vif_recalc_ps_wake_threshold(arvif);
5629 	if (ret) {
5630 		ath10k_warn(ar, "failed to recalc ps wake threshold on vdev %i: %d\n",
5631 			    arvif->vdev_id, ret);
5632 		return ret;
5633 	}
5634 
5635 	ret = ath10k_mac_vif_recalc_ps_poll_count(arvif);
5636 	if (ret) {
5637 		ath10k_warn(ar, "failed to recalc ps poll count on vdev %i: %d\n",
5638 			    arvif->vdev_id, ret);
5639 		return ret;
5640 	}
5641 
5642 	if (test_bit(WMI_SERVICE_STA_UAPSD_BASIC_AUTO_TRIG, ar->wmi.svc_map) ||
5643 	    test_bit(WMI_SERVICE_STA_UAPSD_VAR_AUTO_TRIG, ar->wmi.svc_map)) {
5644 		/* Only userspace can make an educated decision when to send
5645 		 * trigger frame. The following effectively disables u-UAPSD
5646 		 * autotrigger in firmware (which is enabled by default
5647 		 * provided the autotrigger service is available).
5648 		 */
5649 
5650 		arg.wmm_ac = acc;
5651 		arg.user_priority = prio;
5652 		arg.service_interval = 0;
5653 		arg.suspend_interval = WMI_STA_UAPSD_MAX_INTERVAL_MSEC;
5654 		arg.delay_interval = WMI_STA_UAPSD_MAX_INTERVAL_MSEC;
5655 
5656 		ret = ath10k_wmi_vdev_sta_uapsd(ar, arvif->vdev_id,
5657 						arvif->bssid, &arg, 1);
5658 		if (ret) {
5659 			ath10k_warn(ar, "failed to set uapsd auto trigger %d\n",
5660 				    ret);
5661 			return ret;
5662 		}
5663 	}
5664 
5665 exit:
5666 	return ret;
5667 }
5668 
5669 static int ath10k_conf_tx(struct ieee80211_hw *hw,
5670 			  struct ieee80211_vif *vif, u16 ac,
5671 			  const struct ieee80211_tx_queue_params *params)
5672 {
5673 	struct ath10k *ar = hw->priv;
5674 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
5675 	struct wmi_wmm_params_arg *p = NULL;
5676 	int ret;
5677 
5678 	mutex_lock(&ar->conf_mutex);
5679 
5680 	switch (ac) {
5681 	case IEEE80211_AC_VO:
5682 		p = &arvif->wmm_params.ac_vo;
5683 		break;
5684 	case IEEE80211_AC_VI:
5685 		p = &arvif->wmm_params.ac_vi;
5686 		break;
5687 	case IEEE80211_AC_BE:
5688 		p = &arvif->wmm_params.ac_be;
5689 		break;
5690 	case IEEE80211_AC_BK:
5691 		p = &arvif->wmm_params.ac_bk;
5692 		break;
5693 	}
5694 
5695 	if (WARN_ON(!p)) {
5696 		ret = -EINVAL;
5697 		goto exit;
5698 	}
5699 
5700 	p->cwmin = params->cw_min;
5701 	p->cwmax = params->cw_max;
5702 	p->aifs = params->aifs;
5703 
5704 	/*
5705 	 * The channel time duration programmed in the HW is in absolute
5706 	 * microseconds, while mac80211 gives the txop in units of
5707 	 * 32 microseconds.
5708 	 */
5709 	p->txop = params->txop * 32;
5710 
5711 	if (ar->wmi.ops->gen_vdev_wmm_conf) {
5712 		ret = ath10k_wmi_vdev_wmm_conf(ar, arvif->vdev_id,
5713 					       &arvif->wmm_params);
5714 		if (ret) {
5715 			ath10k_warn(ar, "failed to set vdev wmm params on vdev %i: %d\n",
5716 				    arvif->vdev_id, ret);
5717 			goto exit;
5718 		}
5719 	} else {
5720 		/* This won't work well with multi-interface cases but it's
5721 		 * better than nothing.
5722 		 */
5723 		ret = ath10k_wmi_pdev_set_wmm_params(ar, &arvif->wmm_params);
5724 		if (ret) {
5725 			ath10k_warn(ar, "failed to set wmm params: %d\n", ret);
5726 			goto exit;
5727 		}
5728 	}
5729 
5730 	ret = ath10k_conf_tx_uapsd(ar, vif, ac, params->uapsd);
5731 	if (ret)
5732 		ath10k_warn(ar, "failed to set sta uapsd: %d\n", ret);
5733 
5734 exit:
5735 	mutex_unlock(&ar->conf_mutex);
5736 	return ret;
5737 }
5738 
5739 #define ATH10K_ROC_TIMEOUT_HZ (2*HZ)
5740 
5741 static int ath10k_remain_on_channel(struct ieee80211_hw *hw,
5742 				    struct ieee80211_vif *vif,
5743 				    struct ieee80211_channel *chan,
5744 				    int duration,
5745 				    enum ieee80211_roc_type type)
5746 {
5747 	struct ath10k *ar = hw->priv;
5748 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
5749 	struct wmi_start_scan_arg arg;
5750 	int ret = 0;
5751 	u32 scan_time_msec;
5752 
5753 	mutex_lock(&ar->conf_mutex);
5754 
5755 	spin_lock_bh(&ar->data_lock);
5756 	switch (ar->scan.state) {
5757 	case ATH10K_SCAN_IDLE:
5758 		reinit_completion(&ar->scan.started);
5759 		reinit_completion(&ar->scan.completed);
5760 		reinit_completion(&ar->scan.on_channel);
5761 		ar->scan.state = ATH10K_SCAN_STARTING;
5762 		ar->scan.is_roc = true;
5763 		ar->scan.vdev_id = arvif->vdev_id;
5764 		ar->scan.roc_freq = chan->center_freq;
5765 		ar->scan.roc_notify = true;
5766 		ret = 0;
5767 		break;
5768 	case ATH10K_SCAN_STARTING:
5769 	case ATH10K_SCAN_RUNNING:
5770 	case ATH10K_SCAN_ABORTING:
5771 		ret = -EBUSY;
5772 		break;
5773 	}
5774 	spin_unlock_bh(&ar->data_lock);
5775 
5776 	if (ret)
5777 		goto exit;
5778 
5779 	scan_time_msec = ar->hw->wiphy->max_remain_on_channel_duration * 2;
5780 
5781 	memset(&arg, 0, sizeof(arg));
5782 	ath10k_wmi_start_scan_init(ar, &arg);
5783 	arg.vdev_id = arvif->vdev_id;
5784 	arg.scan_id = ATH10K_SCAN_ID;
5785 	arg.n_channels = 1;
5786 	arg.channels[0] = chan->center_freq;
5787 	arg.dwell_time_active = scan_time_msec;
5788 	arg.dwell_time_passive = scan_time_msec;
5789 	arg.max_scan_time = scan_time_msec;
5790 	arg.scan_ctrl_flags |= WMI_SCAN_FLAG_PASSIVE;
5791 	arg.scan_ctrl_flags |= WMI_SCAN_FILTER_PROBE_REQ;
5792 	arg.burst_duration_ms = duration;
5793 
5794 	ret = ath10k_start_scan(ar, &arg);
5795 	if (ret) {
5796 		ath10k_warn(ar, "failed to start roc scan: %d\n", ret);
5797 		spin_lock_bh(&ar->data_lock);
5798 		ar->scan.state = ATH10K_SCAN_IDLE;
5799 		spin_unlock_bh(&ar->data_lock);
5800 		goto exit;
5801 	}
5802 
5803 	ret = wait_for_completion_timeout(&ar->scan.on_channel, 3*HZ);
5804 	if (ret == 0) {
5805 		ath10k_warn(ar, "failed to switch to channel for roc scan\n");
5806 
5807 		ret = ath10k_scan_stop(ar);
5808 		if (ret)
5809 			ath10k_warn(ar, "failed to stop scan: %d\n", ret);
5810 
5811 		ret = -ETIMEDOUT;
5812 		goto exit;
5813 	}
5814 
5815 	ieee80211_queue_delayed_work(ar->hw, &ar->scan.timeout,
5816 				     msecs_to_jiffies(duration));
5817 
5818 	ret = 0;
5819 exit:
5820 	mutex_unlock(&ar->conf_mutex);
5821 	return ret;
5822 }
5823 
5824 static int ath10k_cancel_remain_on_channel(struct ieee80211_hw *hw)
5825 {
5826 	struct ath10k *ar = hw->priv;
5827 
5828 	mutex_lock(&ar->conf_mutex);
5829 
5830 	spin_lock_bh(&ar->data_lock);
5831 	ar->scan.roc_notify = false;
5832 	spin_unlock_bh(&ar->data_lock);
5833 
5834 	ath10k_scan_abort(ar);
5835 
5836 	mutex_unlock(&ar->conf_mutex);
5837 
5838 	cancel_delayed_work_sync(&ar->scan.timeout);
5839 
5840 	return 0;
5841 }
5842 
5843 /*
5844  * Both RTS and Fragmentation threshold are interface-specific
5845  * in ath10k, but device-specific in mac80211.
5846  */
5847 
5848 static int ath10k_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
5849 {
5850 	struct ath10k *ar = hw->priv;
5851 	struct ath10k_vif *arvif;
5852 	int ret = 0;
5853 
5854 	mutex_lock(&ar->conf_mutex);
5855 	list_for_each_entry(arvif, &ar->arvifs, list) {
5856 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d rts threshold %d\n",
5857 			   arvif->vdev_id, value);
5858 
5859 		ret = ath10k_mac_set_rts(arvif, value);
5860 		if (ret) {
5861 			ath10k_warn(ar, "failed to set rts threshold for vdev %d: %d\n",
5862 				    arvif->vdev_id, ret);
5863 			break;
5864 		}
5865 	}
5866 	mutex_unlock(&ar->conf_mutex);
5867 
5868 	return ret;
5869 }
5870 
5871 static int ath10k_mac_op_set_frag_threshold(struct ieee80211_hw *hw, u32 value)
5872 {
5873 	/* Even though there's a WMI enum for fragmentation threshold no known
5874 	 * firmware actually implements it. Moreover it is not possible to rely
5875 	 * frame fragmentation to mac80211 because firmware clears the "more
5876 	 * fragments" bit in frame control making it impossible for remote
5877 	 * devices to reassemble frames.
5878 	 *
5879 	 * Hence implement a dummy callback just to say fragmentation isn't
5880 	 * supported. This effectively prevents mac80211 from doing frame
5881 	 * fragmentation in software.
5882 	 */
5883 	return -EOPNOTSUPP;
5884 }
5885 
5886 static void ath10k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
5887 			 u32 queues, bool drop)
5888 {
5889 	struct ath10k *ar = hw->priv;
5890 	bool skip;
5891 	long time_left;
5892 
5893 	/* mac80211 doesn't care if we really xmit queued frames or not
5894 	 * we'll collect those frames either way if we stop/delete vdevs */
5895 	if (drop)
5896 		return;
5897 
5898 	mutex_lock(&ar->conf_mutex);
5899 
5900 	if (ar->state == ATH10K_STATE_WEDGED)
5901 		goto skip;
5902 
5903 	time_left = wait_event_timeout(ar->htt.empty_tx_wq, ({
5904 			bool empty;
5905 
5906 			spin_lock_bh(&ar->htt.tx_lock);
5907 			empty = (ar->htt.num_pending_tx == 0);
5908 			spin_unlock_bh(&ar->htt.tx_lock);
5909 
5910 			skip = (ar->state == ATH10K_STATE_WEDGED) ||
5911 			       test_bit(ATH10K_FLAG_CRASH_FLUSH,
5912 					&ar->dev_flags);
5913 
5914 			(empty || skip);
5915 		}), ATH10K_FLUSH_TIMEOUT_HZ);
5916 
5917 	if (time_left == 0 || skip)
5918 		ath10k_warn(ar, "failed to flush transmit queue (skip %i ar-state %i): %ld\n",
5919 			    skip, ar->state, time_left);
5920 
5921 skip:
5922 	mutex_unlock(&ar->conf_mutex);
5923 }
5924 
5925 /* TODO: Implement this function properly
5926  * For now it is needed to reply to Probe Requests in IBSS mode.
5927  * Propably we need this information from FW.
5928  */
5929 static int ath10k_tx_last_beacon(struct ieee80211_hw *hw)
5930 {
5931 	return 1;
5932 }
5933 
5934 static void ath10k_reconfig_complete(struct ieee80211_hw *hw,
5935 				     enum ieee80211_reconfig_type reconfig_type)
5936 {
5937 	struct ath10k *ar = hw->priv;
5938 
5939 	if (reconfig_type != IEEE80211_RECONFIG_TYPE_RESTART)
5940 		return;
5941 
5942 	mutex_lock(&ar->conf_mutex);
5943 
5944 	/* If device failed to restart it will be in a different state, e.g.
5945 	 * ATH10K_STATE_WEDGED */
5946 	if (ar->state == ATH10K_STATE_RESTARTED) {
5947 		ath10k_info(ar, "device successfully recovered\n");
5948 		ar->state = ATH10K_STATE_ON;
5949 		ieee80211_wake_queues(ar->hw);
5950 	}
5951 
5952 	mutex_unlock(&ar->conf_mutex);
5953 }
5954 
5955 static int ath10k_get_survey(struct ieee80211_hw *hw, int idx,
5956 			     struct survey_info *survey)
5957 {
5958 	struct ath10k *ar = hw->priv;
5959 	struct ieee80211_supported_band *sband;
5960 	struct survey_info *ar_survey = &ar->survey[idx];
5961 	int ret = 0;
5962 
5963 	mutex_lock(&ar->conf_mutex);
5964 
5965 	sband = hw->wiphy->bands[IEEE80211_BAND_2GHZ];
5966 	if (sband && idx >= sband->n_channels) {
5967 		idx -= sband->n_channels;
5968 		sband = NULL;
5969 	}
5970 
5971 	if (!sband)
5972 		sband = hw->wiphy->bands[IEEE80211_BAND_5GHZ];
5973 
5974 	if (!sband || idx >= sband->n_channels) {
5975 		ret = -ENOENT;
5976 		goto exit;
5977 	}
5978 
5979 	spin_lock_bh(&ar->data_lock);
5980 	memcpy(survey, ar_survey, sizeof(*survey));
5981 	spin_unlock_bh(&ar->data_lock);
5982 
5983 	survey->channel = &sband->channels[idx];
5984 
5985 	if (ar->rx_channel == survey->channel)
5986 		survey->filled |= SURVEY_INFO_IN_USE;
5987 
5988 exit:
5989 	mutex_unlock(&ar->conf_mutex);
5990 	return ret;
5991 }
5992 
5993 static bool
5994 ath10k_mac_bitrate_mask_has_single_rate(struct ath10k *ar,
5995 					enum ieee80211_band band,
5996 					const struct cfg80211_bitrate_mask *mask)
5997 {
5998 	int num_rates = 0;
5999 	int i;
6000 
6001 	num_rates += hweight32(mask->control[band].legacy);
6002 
6003 	for (i = 0; i < ARRAY_SIZE(mask->control[band].ht_mcs); i++)
6004 		num_rates += hweight8(mask->control[band].ht_mcs[i]);
6005 
6006 	for (i = 0; i < ARRAY_SIZE(mask->control[band].vht_mcs); i++)
6007 		num_rates += hweight16(mask->control[band].vht_mcs[i]);
6008 
6009 	return num_rates == 1;
6010 }
6011 
6012 static bool
6013 ath10k_mac_bitrate_mask_get_single_nss(struct ath10k *ar,
6014 				       enum ieee80211_band band,
6015 				       const struct cfg80211_bitrate_mask *mask,
6016 				       int *nss)
6017 {
6018 	struct ieee80211_supported_band *sband = &ar->mac.sbands[band];
6019 	u16 vht_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
6020 	u8 ht_nss_mask = 0;
6021 	u8 vht_nss_mask = 0;
6022 	int i;
6023 
6024 	if (mask->control[band].legacy)
6025 		return false;
6026 
6027 	for (i = 0; i < ARRAY_SIZE(mask->control[band].ht_mcs); i++) {
6028 		if (mask->control[band].ht_mcs[i] == 0)
6029 			continue;
6030 		else if (mask->control[band].ht_mcs[i] ==
6031 			 sband->ht_cap.mcs.rx_mask[i])
6032 			ht_nss_mask |= BIT(i);
6033 		else
6034 			return false;
6035 	}
6036 
6037 	for (i = 0; i < ARRAY_SIZE(mask->control[band].vht_mcs); i++) {
6038 		if (mask->control[band].vht_mcs[i] == 0)
6039 			continue;
6040 		else if (mask->control[band].vht_mcs[i] ==
6041 			 ath10k_mac_get_max_vht_mcs_map(vht_mcs_map, i))
6042 			vht_nss_mask |= BIT(i);
6043 		else
6044 			return false;
6045 	}
6046 
6047 	if (ht_nss_mask != vht_nss_mask)
6048 		return false;
6049 
6050 	if (ht_nss_mask == 0)
6051 		return false;
6052 
6053 	if (BIT(fls(ht_nss_mask)) - 1 != ht_nss_mask)
6054 		return false;
6055 
6056 	*nss = fls(ht_nss_mask);
6057 
6058 	return true;
6059 }
6060 
6061 static int
6062 ath10k_mac_bitrate_mask_get_single_rate(struct ath10k *ar,
6063 					enum ieee80211_band band,
6064 					const struct cfg80211_bitrate_mask *mask,
6065 					u8 *rate, u8 *nss)
6066 {
6067 	struct ieee80211_supported_band *sband = &ar->mac.sbands[band];
6068 	int rate_idx;
6069 	int i;
6070 	u16 bitrate;
6071 	u8 preamble;
6072 	u8 hw_rate;
6073 
6074 	if (hweight32(mask->control[band].legacy) == 1) {
6075 		rate_idx = ffs(mask->control[band].legacy) - 1;
6076 
6077 		hw_rate = sband->bitrates[rate_idx].hw_value;
6078 		bitrate = sband->bitrates[rate_idx].bitrate;
6079 
6080 		if (ath10k_mac_bitrate_is_cck(bitrate))
6081 			preamble = WMI_RATE_PREAMBLE_CCK;
6082 		else
6083 			preamble = WMI_RATE_PREAMBLE_OFDM;
6084 
6085 		*nss = 1;
6086 		*rate = preamble << 6 |
6087 			(*nss - 1) << 4 |
6088 			hw_rate << 0;
6089 
6090 		return 0;
6091 	}
6092 
6093 	for (i = 0; i < ARRAY_SIZE(mask->control[band].ht_mcs); i++) {
6094 		if (hweight8(mask->control[band].ht_mcs[i]) == 1) {
6095 			*nss = i + 1;
6096 			*rate = WMI_RATE_PREAMBLE_HT << 6 |
6097 				(*nss - 1) << 4 |
6098 				(ffs(mask->control[band].ht_mcs[i]) - 1);
6099 
6100 			return 0;
6101 		}
6102 	}
6103 
6104 	for (i = 0; i < ARRAY_SIZE(mask->control[band].vht_mcs); i++) {
6105 		if (hweight16(mask->control[band].vht_mcs[i]) == 1) {
6106 			*nss = i + 1;
6107 			*rate = WMI_RATE_PREAMBLE_VHT << 6 |
6108 				(*nss - 1) << 4 |
6109 				(ffs(mask->control[band].vht_mcs[i]) - 1);
6110 
6111 			return 0;
6112 		}
6113 	}
6114 
6115 	return -EINVAL;
6116 }
6117 
6118 static int ath10k_mac_set_fixed_rate_params(struct ath10k_vif *arvif,
6119 					    u8 rate, u8 nss, u8 sgi, u8 ldpc)
6120 {
6121 	struct ath10k *ar = arvif->ar;
6122 	u32 vdev_param;
6123 	int ret;
6124 
6125 	lockdep_assert_held(&ar->conf_mutex);
6126 
6127 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac set fixed rate params vdev %i rate 0x%02hhx nss %hhu sgi %hhu\n",
6128 		   arvif->vdev_id, rate, nss, sgi);
6129 
6130 	vdev_param = ar->wmi.vdev_param->fixed_rate;
6131 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param, rate);
6132 	if (ret) {
6133 		ath10k_warn(ar, "failed to set fixed rate param 0x%02x: %d\n",
6134 			    rate, ret);
6135 		return ret;
6136 	}
6137 
6138 	vdev_param = ar->wmi.vdev_param->nss;
6139 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param, nss);
6140 	if (ret) {
6141 		ath10k_warn(ar, "failed to set nss param %d: %d\n", nss, ret);
6142 		return ret;
6143 	}
6144 
6145 	vdev_param = ar->wmi.vdev_param->sgi;
6146 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param, sgi);
6147 	if (ret) {
6148 		ath10k_warn(ar, "failed to set sgi param %d: %d\n", sgi, ret);
6149 		return ret;
6150 	}
6151 
6152 	vdev_param = ar->wmi.vdev_param->ldpc;
6153 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param, ldpc);
6154 	if (ret) {
6155 		ath10k_warn(ar, "failed to set ldpc param %d: %d\n", ldpc, ret);
6156 		return ret;
6157 	}
6158 
6159 	return 0;
6160 }
6161 
6162 static bool
6163 ath10k_mac_can_set_bitrate_mask(struct ath10k *ar,
6164 				enum ieee80211_band band,
6165 				const struct cfg80211_bitrate_mask *mask)
6166 {
6167 	int i;
6168 	u16 vht_mcs;
6169 
6170 	/* Due to firmware limitation in WMI_PEER_ASSOC_CMDID it is impossible
6171 	 * to express all VHT MCS rate masks. Effectively only the following
6172 	 * ranges can be used: none, 0-7, 0-8 and 0-9.
6173 	 */
6174 	for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
6175 		vht_mcs = mask->control[band].vht_mcs[i];
6176 
6177 		switch (vht_mcs) {
6178 		case 0:
6179 		case BIT(8) - 1:
6180 		case BIT(9) - 1:
6181 		case BIT(10) - 1:
6182 			break;
6183 		default:
6184 			ath10k_warn(ar, "refusing bitrate mask with missing 0-7 VHT MCS rates\n");
6185 			return false;
6186 		}
6187 	}
6188 
6189 	return true;
6190 }
6191 
6192 static void ath10k_mac_set_bitrate_mask_iter(void *data,
6193 					     struct ieee80211_sta *sta)
6194 {
6195 	struct ath10k_vif *arvif = data;
6196 	struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
6197 	struct ath10k *ar = arvif->ar;
6198 
6199 	if (arsta->arvif != arvif)
6200 		return;
6201 
6202 	spin_lock_bh(&ar->data_lock);
6203 	arsta->changed |= IEEE80211_RC_SUPP_RATES_CHANGED;
6204 	spin_unlock_bh(&ar->data_lock);
6205 
6206 	ieee80211_queue_work(ar->hw, &arsta->update_wk);
6207 }
6208 
6209 static int ath10k_mac_op_set_bitrate_mask(struct ieee80211_hw *hw,
6210 					  struct ieee80211_vif *vif,
6211 					  const struct cfg80211_bitrate_mask *mask)
6212 {
6213 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
6214 	struct cfg80211_chan_def def;
6215 	struct ath10k *ar = arvif->ar;
6216 	enum ieee80211_band band;
6217 	const u8 *ht_mcs_mask;
6218 	const u16 *vht_mcs_mask;
6219 	u8 rate;
6220 	u8 nss;
6221 	u8 sgi;
6222 	u8 ldpc;
6223 	int single_nss;
6224 	int ret;
6225 
6226 	if (ath10k_mac_vif_chan(vif, &def))
6227 		return -EPERM;
6228 
6229 	band = def.chan->band;
6230 	ht_mcs_mask = mask->control[band].ht_mcs;
6231 	vht_mcs_mask = mask->control[band].vht_mcs;
6232 	ldpc = !!(ar->ht_cap_info & WMI_HT_CAP_LDPC);
6233 
6234 	sgi = mask->control[band].gi;
6235 	if (sgi == NL80211_TXRATE_FORCE_LGI)
6236 		return -EINVAL;
6237 
6238 	if (ath10k_mac_bitrate_mask_has_single_rate(ar, band, mask)) {
6239 		ret = ath10k_mac_bitrate_mask_get_single_rate(ar, band, mask,
6240 							      &rate, &nss);
6241 		if (ret) {
6242 			ath10k_warn(ar, "failed to get single rate for vdev %i: %d\n",
6243 				    arvif->vdev_id, ret);
6244 			return ret;
6245 		}
6246 	} else if (ath10k_mac_bitrate_mask_get_single_nss(ar, band, mask,
6247 							  &single_nss)) {
6248 		rate = WMI_FIXED_RATE_NONE;
6249 		nss = single_nss;
6250 	} else {
6251 		rate = WMI_FIXED_RATE_NONE;
6252 		nss = min(ar->num_rf_chains,
6253 			  max(ath10k_mac_max_ht_nss(ht_mcs_mask),
6254 			      ath10k_mac_max_vht_nss(vht_mcs_mask)));
6255 
6256 		if (!ath10k_mac_can_set_bitrate_mask(ar, band, mask))
6257 			return -EINVAL;
6258 
6259 		mutex_lock(&ar->conf_mutex);
6260 
6261 		arvif->bitrate_mask = *mask;
6262 		ieee80211_iterate_stations_atomic(ar->hw,
6263 						  ath10k_mac_set_bitrate_mask_iter,
6264 						  arvif);
6265 
6266 		mutex_unlock(&ar->conf_mutex);
6267 	}
6268 
6269 	mutex_lock(&ar->conf_mutex);
6270 
6271 	ret = ath10k_mac_set_fixed_rate_params(arvif, rate, nss, sgi, ldpc);
6272 	if (ret) {
6273 		ath10k_warn(ar, "failed to set fixed rate params on vdev %i: %d\n",
6274 			    arvif->vdev_id, ret);
6275 		goto exit;
6276 	}
6277 
6278 exit:
6279 	mutex_unlock(&ar->conf_mutex);
6280 
6281 	return ret;
6282 }
6283 
6284 static void ath10k_sta_rc_update(struct ieee80211_hw *hw,
6285 				 struct ieee80211_vif *vif,
6286 				 struct ieee80211_sta *sta,
6287 				 u32 changed)
6288 {
6289 	struct ath10k *ar = hw->priv;
6290 	struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
6291 	u32 bw, smps;
6292 
6293 	spin_lock_bh(&ar->data_lock);
6294 
6295 	ath10k_dbg(ar, ATH10K_DBG_MAC,
6296 		   "mac sta rc update for %pM changed %08x bw %d nss %d smps %d\n",
6297 		   sta->addr, changed, sta->bandwidth, sta->rx_nss,
6298 		   sta->smps_mode);
6299 
6300 	if (changed & IEEE80211_RC_BW_CHANGED) {
6301 		bw = WMI_PEER_CHWIDTH_20MHZ;
6302 
6303 		switch (sta->bandwidth) {
6304 		case IEEE80211_STA_RX_BW_20:
6305 			bw = WMI_PEER_CHWIDTH_20MHZ;
6306 			break;
6307 		case IEEE80211_STA_RX_BW_40:
6308 			bw = WMI_PEER_CHWIDTH_40MHZ;
6309 			break;
6310 		case IEEE80211_STA_RX_BW_80:
6311 			bw = WMI_PEER_CHWIDTH_80MHZ;
6312 			break;
6313 		case IEEE80211_STA_RX_BW_160:
6314 			ath10k_warn(ar, "Invalid bandwidth %d in rc update for %pM\n",
6315 				    sta->bandwidth, sta->addr);
6316 			bw = WMI_PEER_CHWIDTH_20MHZ;
6317 			break;
6318 		}
6319 
6320 		arsta->bw = bw;
6321 	}
6322 
6323 	if (changed & IEEE80211_RC_NSS_CHANGED)
6324 		arsta->nss = sta->rx_nss;
6325 
6326 	if (changed & IEEE80211_RC_SMPS_CHANGED) {
6327 		smps = WMI_PEER_SMPS_PS_NONE;
6328 
6329 		switch (sta->smps_mode) {
6330 		case IEEE80211_SMPS_AUTOMATIC:
6331 		case IEEE80211_SMPS_OFF:
6332 			smps = WMI_PEER_SMPS_PS_NONE;
6333 			break;
6334 		case IEEE80211_SMPS_STATIC:
6335 			smps = WMI_PEER_SMPS_STATIC;
6336 			break;
6337 		case IEEE80211_SMPS_DYNAMIC:
6338 			smps = WMI_PEER_SMPS_DYNAMIC;
6339 			break;
6340 		case IEEE80211_SMPS_NUM_MODES:
6341 			ath10k_warn(ar, "Invalid smps %d in sta rc update for %pM\n",
6342 				    sta->smps_mode, sta->addr);
6343 			smps = WMI_PEER_SMPS_PS_NONE;
6344 			break;
6345 		}
6346 
6347 		arsta->smps = smps;
6348 	}
6349 
6350 	arsta->changed |= changed;
6351 
6352 	spin_unlock_bh(&ar->data_lock);
6353 
6354 	ieee80211_queue_work(hw, &arsta->update_wk);
6355 }
6356 
6357 static u64 ath10k_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
6358 {
6359 	/*
6360 	 * FIXME: Return 0 for time being. Need to figure out whether FW
6361 	 * has the API to fetch 64-bit local TSF
6362 	 */
6363 
6364 	return 0;
6365 }
6366 
6367 static int ath10k_ampdu_action(struct ieee80211_hw *hw,
6368 			       struct ieee80211_vif *vif,
6369 			       enum ieee80211_ampdu_mlme_action action,
6370 			       struct ieee80211_sta *sta, u16 tid, u16 *ssn,
6371 			       u8 buf_size, bool amsdu)
6372 {
6373 	struct ath10k *ar = hw->priv;
6374 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
6375 
6376 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac ampdu vdev_id %i sta %pM tid %hu action %d\n",
6377 		   arvif->vdev_id, sta->addr, tid, action);
6378 
6379 	switch (action) {
6380 	case IEEE80211_AMPDU_RX_START:
6381 	case IEEE80211_AMPDU_RX_STOP:
6382 		/* HTT AddBa/DelBa events trigger mac80211 Rx BA session
6383 		 * creation/removal. Do we need to verify this?
6384 		 */
6385 		return 0;
6386 	case IEEE80211_AMPDU_TX_START:
6387 	case IEEE80211_AMPDU_TX_STOP_CONT:
6388 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
6389 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
6390 	case IEEE80211_AMPDU_TX_OPERATIONAL:
6391 		/* Firmware offloads Tx aggregation entirely so deny mac80211
6392 		 * Tx aggregation requests.
6393 		 */
6394 		return -EOPNOTSUPP;
6395 	}
6396 
6397 	return -EINVAL;
6398 }
6399 
6400 static void
6401 ath10k_mac_update_rx_channel(struct ath10k *ar,
6402 			     struct ieee80211_chanctx_conf *ctx,
6403 			     struct ieee80211_vif_chanctx_switch *vifs,
6404 			     int n_vifs)
6405 {
6406 	struct cfg80211_chan_def *def = NULL;
6407 
6408 	/* Both locks are required because ar->rx_channel is modified. This
6409 	 * allows readers to hold either lock.
6410 	 */
6411 	lockdep_assert_held(&ar->conf_mutex);
6412 	lockdep_assert_held(&ar->data_lock);
6413 
6414 	WARN_ON(ctx && vifs);
6415 	WARN_ON(vifs && n_vifs != 1);
6416 
6417 	/* FIXME: Sort of an optimization and a workaround. Peers and vifs are
6418 	 * on a linked list now. Doing a lookup peer -> vif -> chanctx for each
6419 	 * ppdu on Rx may reduce performance on low-end systems. It should be
6420 	 * possible to make tables/hashmaps to speed the lookup up (be vary of
6421 	 * cpu data cache lines though regarding sizes) but to keep the initial
6422 	 * implementation simple and less intrusive fallback to the slow lookup
6423 	 * only for multi-channel cases. Single-channel cases will remain to
6424 	 * use the old channel derival and thus performance should not be
6425 	 * affected much.
6426 	 */
6427 	rcu_read_lock();
6428 	if (!ctx && ath10k_mac_num_chanctxs(ar) == 1) {
6429 		ieee80211_iter_chan_contexts_atomic(ar->hw,
6430 						    ath10k_mac_get_any_chandef_iter,
6431 						    &def);
6432 
6433 		if (vifs)
6434 			def = &vifs[0].new_ctx->def;
6435 
6436 		ar->rx_channel = def->chan;
6437 	} else if (ctx && ath10k_mac_num_chanctxs(ar) == 0) {
6438 		ar->rx_channel = ctx->def.chan;
6439 	} else {
6440 		ar->rx_channel = NULL;
6441 	}
6442 	rcu_read_unlock();
6443 }
6444 
6445 static void
6446 ath10k_mac_update_vif_chan(struct ath10k *ar,
6447 			   struct ieee80211_vif_chanctx_switch *vifs,
6448 			   int n_vifs)
6449 {
6450 	struct ath10k_vif *arvif;
6451 	int ret;
6452 	int i;
6453 
6454 	lockdep_assert_held(&ar->conf_mutex);
6455 
6456 	/* First stop monitor interface. Some FW versions crash if there's a
6457 	 * lone monitor interface.
6458 	 */
6459 	if (ar->monitor_started)
6460 		ath10k_monitor_stop(ar);
6461 
6462 	for (i = 0; i < n_vifs; i++) {
6463 		arvif = ath10k_vif_to_arvif(vifs[i].vif);
6464 
6465 		ath10k_dbg(ar, ATH10K_DBG_MAC,
6466 			   "mac chanctx switch vdev_id %i freq %hu->%hu width %d->%d\n",
6467 			   arvif->vdev_id,
6468 			   vifs[i].old_ctx->def.chan->center_freq,
6469 			   vifs[i].new_ctx->def.chan->center_freq,
6470 			   vifs[i].old_ctx->def.width,
6471 			   vifs[i].new_ctx->def.width);
6472 
6473 		if (WARN_ON(!arvif->is_started))
6474 			continue;
6475 
6476 		if (WARN_ON(!arvif->is_up))
6477 			continue;
6478 
6479 		ret = ath10k_wmi_vdev_down(ar, arvif->vdev_id);
6480 		if (ret) {
6481 			ath10k_warn(ar, "failed to down vdev %d: %d\n",
6482 				    arvif->vdev_id, ret);
6483 			continue;
6484 		}
6485 	}
6486 
6487 	/* All relevant vdevs are downed and associated channel resources
6488 	 * should be available for the channel switch now.
6489 	 */
6490 
6491 	spin_lock_bh(&ar->data_lock);
6492 	ath10k_mac_update_rx_channel(ar, NULL, vifs, n_vifs);
6493 	spin_unlock_bh(&ar->data_lock);
6494 
6495 	for (i = 0; i < n_vifs; i++) {
6496 		arvif = ath10k_vif_to_arvif(vifs[i].vif);
6497 
6498 		if (WARN_ON(!arvif->is_started))
6499 			continue;
6500 
6501 		if (WARN_ON(!arvif->is_up))
6502 			continue;
6503 
6504 		ret = ath10k_mac_setup_bcn_tmpl(arvif);
6505 		if (ret)
6506 			ath10k_warn(ar, "failed to update bcn tmpl during csa: %d\n",
6507 				    ret);
6508 
6509 		ret = ath10k_mac_setup_prb_tmpl(arvif);
6510 		if (ret)
6511 			ath10k_warn(ar, "failed to update prb tmpl during csa: %d\n",
6512 				    ret);
6513 
6514 		ret = ath10k_vdev_restart(arvif, &vifs[i].new_ctx->def);
6515 		if (ret) {
6516 			ath10k_warn(ar, "failed to restart vdev %d: %d\n",
6517 				    arvif->vdev_id, ret);
6518 			continue;
6519 		}
6520 
6521 		ret = ath10k_wmi_vdev_up(arvif->ar, arvif->vdev_id, arvif->aid,
6522 					 arvif->bssid);
6523 		if (ret) {
6524 			ath10k_warn(ar, "failed to bring vdev up %d: %d\n",
6525 				    arvif->vdev_id, ret);
6526 			continue;
6527 		}
6528 	}
6529 
6530 	ath10k_monitor_recalc(ar);
6531 }
6532 
6533 static int
6534 ath10k_mac_op_add_chanctx(struct ieee80211_hw *hw,
6535 			  struct ieee80211_chanctx_conf *ctx)
6536 {
6537 	struct ath10k *ar = hw->priv;
6538 
6539 	ath10k_dbg(ar, ATH10K_DBG_MAC,
6540 		   "mac chanctx add freq %hu width %d ptr %p\n",
6541 		   ctx->def.chan->center_freq, ctx->def.width, ctx);
6542 
6543 	mutex_lock(&ar->conf_mutex);
6544 
6545 	spin_lock_bh(&ar->data_lock);
6546 	ath10k_mac_update_rx_channel(ar, ctx, NULL, 0);
6547 	spin_unlock_bh(&ar->data_lock);
6548 
6549 	ath10k_recalc_radar_detection(ar);
6550 	ath10k_monitor_recalc(ar);
6551 
6552 	mutex_unlock(&ar->conf_mutex);
6553 
6554 	return 0;
6555 }
6556 
6557 static void
6558 ath10k_mac_op_remove_chanctx(struct ieee80211_hw *hw,
6559 			     struct ieee80211_chanctx_conf *ctx)
6560 {
6561 	struct ath10k *ar = hw->priv;
6562 
6563 	ath10k_dbg(ar, ATH10K_DBG_MAC,
6564 		   "mac chanctx remove freq %hu width %d ptr %p\n",
6565 		   ctx->def.chan->center_freq, ctx->def.width, ctx);
6566 
6567 	mutex_lock(&ar->conf_mutex);
6568 
6569 	spin_lock_bh(&ar->data_lock);
6570 	ath10k_mac_update_rx_channel(ar, NULL, NULL, 0);
6571 	spin_unlock_bh(&ar->data_lock);
6572 
6573 	ath10k_recalc_radar_detection(ar);
6574 	ath10k_monitor_recalc(ar);
6575 
6576 	mutex_unlock(&ar->conf_mutex);
6577 }
6578 
6579 struct ath10k_mac_change_chanctx_arg {
6580 	struct ieee80211_chanctx_conf *ctx;
6581 	struct ieee80211_vif_chanctx_switch *vifs;
6582 	int n_vifs;
6583 	int next_vif;
6584 };
6585 
6586 static void
6587 ath10k_mac_change_chanctx_cnt_iter(void *data, u8 *mac,
6588 				   struct ieee80211_vif *vif)
6589 {
6590 	struct ath10k_mac_change_chanctx_arg *arg = data;
6591 
6592 	if (rcu_access_pointer(vif->chanctx_conf) != arg->ctx)
6593 		return;
6594 
6595 	arg->n_vifs++;
6596 }
6597 
6598 static void
6599 ath10k_mac_change_chanctx_fill_iter(void *data, u8 *mac,
6600 				    struct ieee80211_vif *vif)
6601 {
6602 	struct ath10k_mac_change_chanctx_arg *arg = data;
6603 	struct ieee80211_chanctx_conf *ctx;
6604 
6605 	ctx = rcu_access_pointer(vif->chanctx_conf);
6606 	if (ctx != arg->ctx)
6607 		return;
6608 
6609 	if (WARN_ON(arg->next_vif == arg->n_vifs))
6610 		return;
6611 
6612 	arg->vifs[arg->next_vif].vif = vif;
6613 	arg->vifs[arg->next_vif].old_ctx = ctx;
6614 	arg->vifs[arg->next_vif].new_ctx = ctx;
6615 	arg->next_vif++;
6616 }
6617 
6618 static void
6619 ath10k_mac_op_change_chanctx(struct ieee80211_hw *hw,
6620 			     struct ieee80211_chanctx_conf *ctx,
6621 			     u32 changed)
6622 {
6623 	struct ath10k *ar = hw->priv;
6624 	struct ath10k_mac_change_chanctx_arg arg = { .ctx = ctx };
6625 
6626 	mutex_lock(&ar->conf_mutex);
6627 
6628 	ath10k_dbg(ar, ATH10K_DBG_MAC,
6629 		   "mac chanctx change freq %hu width %d ptr %p changed %x\n",
6630 		   ctx->def.chan->center_freq, ctx->def.width, ctx, changed);
6631 
6632 	/* This shouldn't really happen because channel switching should use
6633 	 * switch_vif_chanctx().
6634 	 */
6635 	if (WARN_ON(changed & IEEE80211_CHANCTX_CHANGE_CHANNEL))
6636 		goto unlock;
6637 
6638 	if (changed & IEEE80211_CHANCTX_CHANGE_WIDTH) {
6639 		ieee80211_iterate_active_interfaces_atomic(
6640 					hw,
6641 					IEEE80211_IFACE_ITER_NORMAL,
6642 					ath10k_mac_change_chanctx_cnt_iter,
6643 					&arg);
6644 		if (arg.n_vifs == 0)
6645 			goto radar;
6646 
6647 		arg.vifs = kcalloc(arg.n_vifs, sizeof(arg.vifs[0]),
6648 				   GFP_KERNEL);
6649 		if (!arg.vifs)
6650 			goto radar;
6651 
6652 		ieee80211_iterate_active_interfaces_atomic(
6653 					hw,
6654 					IEEE80211_IFACE_ITER_NORMAL,
6655 					ath10k_mac_change_chanctx_fill_iter,
6656 					&arg);
6657 		ath10k_mac_update_vif_chan(ar, arg.vifs, arg.n_vifs);
6658 		kfree(arg.vifs);
6659 	}
6660 
6661 radar:
6662 	ath10k_recalc_radar_detection(ar);
6663 
6664 	/* FIXME: How to configure Rx chains properly? */
6665 
6666 	/* No other actions are actually necessary. Firmware maintains channel
6667 	 * definitions per vdev internally and there's no host-side channel
6668 	 * context abstraction to configure, e.g. channel width.
6669 	 */
6670 
6671 unlock:
6672 	mutex_unlock(&ar->conf_mutex);
6673 }
6674 
6675 static int
6676 ath10k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
6677 				 struct ieee80211_vif *vif,
6678 				 struct ieee80211_chanctx_conf *ctx)
6679 {
6680 	struct ath10k *ar = hw->priv;
6681 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
6682 	int ret;
6683 
6684 	mutex_lock(&ar->conf_mutex);
6685 
6686 	ath10k_dbg(ar, ATH10K_DBG_MAC,
6687 		   "mac chanctx assign ptr %p vdev_id %i\n",
6688 		   ctx, arvif->vdev_id);
6689 
6690 	if (WARN_ON(arvif->is_started)) {
6691 		mutex_unlock(&ar->conf_mutex);
6692 		return -EBUSY;
6693 	}
6694 
6695 	ret = ath10k_vdev_start(arvif, &ctx->def);
6696 	if (ret) {
6697 		ath10k_warn(ar, "failed to start vdev %i addr %pM on freq %d: %d\n",
6698 			    arvif->vdev_id, vif->addr,
6699 			    ctx->def.chan->center_freq, ret);
6700 		goto err;
6701 	}
6702 
6703 	arvif->is_started = true;
6704 
6705 	ret = ath10k_mac_vif_setup_ps(arvif);
6706 	if (ret) {
6707 		ath10k_warn(ar, "failed to update vdev %i ps: %d\n",
6708 			    arvif->vdev_id, ret);
6709 		goto err_stop;
6710 	}
6711 
6712 	if (vif->type == NL80211_IFTYPE_MONITOR) {
6713 		ret = ath10k_wmi_vdev_up(ar, arvif->vdev_id, 0, vif->addr);
6714 		if (ret) {
6715 			ath10k_warn(ar, "failed to up monitor vdev %i: %d\n",
6716 				    arvif->vdev_id, ret);
6717 			goto err_stop;
6718 		}
6719 
6720 		arvif->is_up = true;
6721 	}
6722 
6723 	mutex_unlock(&ar->conf_mutex);
6724 	return 0;
6725 
6726 err_stop:
6727 	ath10k_vdev_stop(arvif);
6728 	arvif->is_started = false;
6729 	ath10k_mac_vif_setup_ps(arvif);
6730 
6731 err:
6732 	mutex_unlock(&ar->conf_mutex);
6733 	return ret;
6734 }
6735 
6736 static void
6737 ath10k_mac_op_unassign_vif_chanctx(struct ieee80211_hw *hw,
6738 				   struct ieee80211_vif *vif,
6739 				   struct ieee80211_chanctx_conf *ctx)
6740 {
6741 	struct ath10k *ar = hw->priv;
6742 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
6743 	int ret;
6744 
6745 	mutex_lock(&ar->conf_mutex);
6746 
6747 	ath10k_dbg(ar, ATH10K_DBG_MAC,
6748 		   "mac chanctx unassign ptr %p vdev_id %i\n",
6749 		   ctx, arvif->vdev_id);
6750 
6751 	WARN_ON(!arvif->is_started);
6752 
6753 	if (vif->type == NL80211_IFTYPE_MONITOR) {
6754 		WARN_ON(!arvif->is_up);
6755 
6756 		ret = ath10k_wmi_vdev_down(ar, arvif->vdev_id);
6757 		if (ret)
6758 			ath10k_warn(ar, "failed to down monitor vdev %i: %d\n",
6759 				    arvif->vdev_id, ret);
6760 
6761 		arvif->is_up = false;
6762 	}
6763 
6764 	ret = ath10k_vdev_stop(arvif);
6765 	if (ret)
6766 		ath10k_warn(ar, "failed to stop vdev %i: %d\n",
6767 			    arvif->vdev_id, ret);
6768 
6769 	arvif->is_started = false;
6770 
6771 	mutex_unlock(&ar->conf_mutex);
6772 }
6773 
6774 static int
6775 ath10k_mac_op_switch_vif_chanctx(struct ieee80211_hw *hw,
6776 				 struct ieee80211_vif_chanctx_switch *vifs,
6777 				 int n_vifs,
6778 				 enum ieee80211_chanctx_switch_mode mode)
6779 {
6780 	struct ath10k *ar = hw->priv;
6781 
6782 	mutex_lock(&ar->conf_mutex);
6783 
6784 	ath10k_dbg(ar, ATH10K_DBG_MAC,
6785 		   "mac chanctx switch n_vifs %d mode %d\n",
6786 		   n_vifs, mode);
6787 	ath10k_mac_update_vif_chan(ar, vifs, n_vifs);
6788 
6789 	mutex_unlock(&ar->conf_mutex);
6790 	return 0;
6791 }
6792 
6793 static const struct ieee80211_ops ath10k_ops = {
6794 	.tx				= ath10k_tx,
6795 	.start				= ath10k_start,
6796 	.stop				= ath10k_stop,
6797 	.config				= ath10k_config,
6798 	.add_interface			= ath10k_add_interface,
6799 	.remove_interface		= ath10k_remove_interface,
6800 	.configure_filter		= ath10k_configure_filter,
6801 	.bss_info_changed		= ath10k_bss_info_changed,
6802 	.hw_scan			= ath10k_hw_scan,
6803 	.cancel_hw_scan			= ath10k_cancel_hw_scan,
6804 	.set_key			= ath10k_set_key,
6805 	.set_default_unicast_key        = ath10k_set_default_unicast_key,
6806 	.sta_state			= ath10k_sta_state,
6807 	.conf_tx			= ath10k_conf_tx,
6808 	.remain_on_channel		= ath10k_remain_on_channel,
6809 	.cancel_remain_on_channel	= ath10k_cancel_remain_on_channel,
6810 	.set_rts_threshold		= ath10k_set_rts_threshold,
6811 	.set_frag_threshold		= ath10k_mac_op_set_frag_threshold,
6812 	.flush				= ath10k_flush,
6813 	.tx_last_beacon			= ath10k_tx_last_beacon,
6814 	.set_antenna			= ath10k_set_antenna,
6815 	.get_antenna			= ath10k_get_antenna,
6816 	.reconfig_complete		= ath10k_reconfig_complete,
6817 	.get_survey			= ath10k_get_survey,
6818 	.set_bitrate_mask		= ath10k_mac_op_set_bitrate_mask,
6819 	.sta_rc_update			= ath10k_sta_rc_update,
6820 	.get_tsf			= ath10k_get_tsf,
6821 	.ampdu_action			= ath10k_ampdu_action,
6822 	.get_et_sset_count		= ath10k_debug_get_et_sset_count,
6823 	.get_et_stats			= ath10k_debug_get_et_stats,
6824 	.get_et_strings			= ath10k_debug_get_et_strings,
6825 	.add_chanctx			= ath10k_mac_op_add_chanctx,
6826 	.remove_chanctx			= ath10k_mac_op_remove_chanctx,
6827 	.change_chanctx			= ath10k_mac_op_change_chanctx,
6828 	.assign_vif_chanctx		= ath10k_mac_op_assign_vif_chanctx,
6829 	.unassign_vif_chanctx		= ath10k_mac_op_unassign_vif_chanctx,
6830 	.switch_vif_chanctx		= ath10k_mac_op_switch_vif_chanctx,
6831 
6832 	CFG80211_TESTMODE_CMD(ath10k_tm_cmd)
6833 
6834 #ifdef CONFIG_PM
6835 	.suspend			= ath10k_wow_op_suspend,
6836 	.resume				= ath10k_wow_op_resume,
6837 #endif
6838 #ifdef CONFIG_MAC80211_DEBUGFS
6839 	.sta_add_debugfs		= ath10k_sta_add_debugfs,
6840 #endif
6841 };
6842 
6843 #define CHAN2G(_channel, _freq, _flags) { \
6844 	.band			= IEEE80211_BAND_2GHZ, \
6845 	.hw_value		= (_channel), \
6846 	.center_freq		= (_freq), \
6847 	.flags			= (_flags), \
6848 	.max_antenna_gain	= 0, \
6849 	.max_power		= 30, \
6850 }
6851 
6852 #define CHAN5G(_channel, _freq, _flags) { \
6853 	.band			= IEEE80211_BAND_5GHZ, \
6854 	.hw_value		= (_channel), \
6855 	.center_freq		= (_freq), \
6856 	.flags			= (_flags), \
6857 	.max_antenna_gain	= 0, \
6858 	.max_power		= 30, \
6859 }
6860 
6861 static const struct ieee80211_channel ath10k_2ghz_channels[] = {
6862 	CHAN2G(1, 2412, 0),
6863 	CHAN2G(2, 2417, 0),
6864 	CHAN2G(3, 2422, 0),
6865 	CHAN2G(4, 2427, 0),
6866 	CHAN2G(5, 2432, 0),
6867 	CHAN2G(6, 2437, 0),
6868 	CHAN2G(7, 2442, 0),
6869 	CHAN2G(8, 2447, 0),
6870 	CHAN2G(9, 2452, 0),
6871 	CHAN2G(10, 2457, 0),
6872 	CHAN2G(11, 2462, 0),
6873 	CHAN2G(12, 2467, 0),
6874 	CHAN2G(13, 2472, 0),
6875 	CHAN2G(14, 2484, 0),
6876 };
6877 
6878 static const struct ieee80211_channel ath10k_5ghz_channels[] = {
6879 	CHAN5G(36, 5180, 0),
6880 	CHAN5G(40, 5200, 0),
6881 	CHAN5G(44, 5220, 0),
6882 	CHAN5G(48, 5240, 0),
6883 	CHAN5G(52, 5260, 0),
6884 	CHAN5G(56, 5280, 0),
6885 	CHAN5G(60, 5300, 0),
6886 	CHAN5G(64, 5320, 0),
6887 	CHAN5G(100, 5500, 0),
6888 	CHAN5G(104, 5520, 0),
6889 	CHAN5G(108, 5540, 0),
6890 	CHAN5G(112, 5560, 0),
6891 	CHAN5G(116, 5580, 0),
6892 	CHAN5G(120, 5600, 0),
6893 	CHAN5G(124, 5620, 0),
6894 	CHAN5G(128, 5640, 0),
6895 	CHAN5G(132, 5660, 0),
6896 	CHAN5G(136, 5680, 0),
6897 	CHAN5G(140, 5700, 0),
6898 	CHAN5G(144, 5720, 0),
6899 	CHAN5G(149, 5745, 0),
6900 	CHAN5G(153, 5765, 0),
6901 	CHAN5G(157, 5785, 0),
6902 	CHAN5G(161, 5805, 0),
6903 	CHAN5G(165, 5825, 0),
6904 };
6905 
6906 struct ath10k *ath10k_mac_create(size_t priv_size)
6907 {
6908 	struct ieee80211_hw *hw;
6909 	struct ath10k *ar;
6910 
6911 	hw = ieee80211_alloc_hw(sizeof(struct ath10k) + priv_size, &ath10k_ops);
6912 	if (!hw)
6913 		return NULL;
6914 
6915 	ar = hw->priv;
6916 	ar->hw = hw;
6917 
6918 	return ar;
6919 }
6920 
6921 void ath10k_mac_destroy(struct ath10k *ar)
6922 {
6923 	ieee80211_free_hw(ar->hw);
6924 }
6925 
6926 static const struct ieee80211_iface_limit ath10k_if_limits[] = {
6927 	{
6928 		.max	= 8,
6929 		.types	= BIT(NL80211_IFTYPE_STATION)
6930 			| BIT(NL80211_IFTYPE_P2P_CLIENT)
6931 	},
6932 	{
6933 		.max	= 3,
6934 		.types	= BIT(NL80211_IFTYPE_P2P_GO)
6935 	},
6936 	{
6937 		.max	= 1,
6938 		.types	= BIT(NL80211_IFTYPE_P2P_DEVICE)
6939 	},
6940 	{
6941 		.max	= 7,
6942 		.types	= BIT(NL80211_IFTYPE_AP)
6943 #ifdef CONFIG_MAC80211_MESH
6944 			| BIT(NL80211_IFTYPE_MESH_POINT)
6945 #endif
6946 	},
6947 };
6948 
6949 static const struct ieee80211_iface_limit ath10k_10x_if_limits[] = {
6950 	{
6951 		.max	= 8,
6952 		.types	= BIT(NL80211_IFTYPE_AP)
6953 #ifdef CONFIG_MAC80211_MESH
6954 			| BIT(NL80211_IFTYPE_MESH_POINT)
6955 #endif
6956 	},
6957 	{
6958 		.max	= 1,
6959 		.types	= BIT(NL80211_IFTYPE_STATION)
6960 	},
6961 };
6962 
6963 static const struct ieee80211_iface_combination ath10k_if_comb[] = {
6964 	{
6965 		.limits = ath10k_if_limits,
6966 		.n_limits = ARRAY_SIZE(ath10k_if_limits),
6967 		.max_interfaces = 8,
6968 		.num_different_channels = 1,
6969 		.beacon_int_infra_match = true,
6970 	},
6971 };
6972 
6973 static const struct ieee80211_iface_combination ath10k_10x_if_comb[] = {
6974 	{
6975 		.limits = ath10k_10x_if_limits,
6976 		.n_limits = ARRAY_SIZE(ath10k_10x_if_limits),
6977 		.max_interfaces = 8,
6978 		.num_different_channels = 1,
6979 		.beacon_int_infra_match = true,
6980 #ifdef CONFIG_ATH10K_DFS_CERTIFIED
6981 		.radar_detect_widths =	BIT(NL80211_CHAN_WIDTH_20_NOHT) |
6982 					BIT(NL80211_CHAN_WIDTH_20) |
6983 					BIT(NL80211_CHAN_WIDTH_40) |
6984 					BIT(NL80211_CHAN_WIDTH_80),
6985 #endif
6986 	},
6987 };
6988 
6989 static const struct ieee80211_iface_limit ath10k_tlv_if_limit[] = {
6990 	{
6991 		.max = 2,
6992 		.types = BIT(NL80211_IFTYPE_STATION),
6993 	},
6994 	{
6995 		.max = 2,
6996 		.types = BIT(NL80211_IFTYPE_AP) |
6997 #ifdef CONFIG_MAC80211_MESH
6998 			 BIT(NL80211_IFTYPE_MESH_POINT) |
6999 #endif
7000 			 BIT(NL80211_IFTYPE_P2P_CLIENT) |
7001 			 BIT(NL80211_IFTYPE_P2P_GO),
7002 	},
7003 	{
7004 		.max = 1,
7005 		.types = BIT(NL80211_IFTYPE_P2P_DEVICE),
7006 	},
7007 };
7008 
7009 static const struct ieee80211_iface_limit ath10k_tlv_qcs_if_limit[] = {
7010 	{
7011 		.max = 2,
7012 		.types = BIT(NL80211_IFTYPE_STATION),
7013 	},
7014 	{
7015 		.max = 2,
7016 		.types = BIT(NL80211_IFTYPE_P2P_CLIENT),
7017 	},
7018 	{
7019 		.max = 1,
7020 		.types = BIT(NL80211_IFTYPE_AP) |
7021 #ifdef CONFIG_MAC80211_MESH
7022 			 BIT(NL80211_IFTYPE_MESH_POINT) |
7023 #endif
7024 			 BIT(NL80211_IFTYPE_P2P_GO),
7025 	},
7026 	{
7027 		.max = 1,
7028 		.types = BIT(NL80211_IFTYPE_P2P_DEVICE),
7029 	},
7030 };
7031 
7032 static const struct ieee80211_iface_limit ath10k_tlv_if_limit_ibss[] = {
7033 	{
7034 		.max = 1,
7035 		.types = BIT(NL80211_IFTYPE_STATION),
7036 	},
7037 	{
7038 		.max = 1,
7039 		.types = BIT(NL80211_IFTYPE_ADHOC),
7040 	},
7041 };
7042 
7043 /* FIXME: This is not thouroughly tested. These combinations may over- or
7044  * underestimate hw/fw capabilities.
7045  */
7046 static struct ieee80211_iface_combination ath10k_tlv_if_comb[] = {
7047 	{
7048 		.limits = ath10k_tlv_if_limit,
7049 		.num_different_channels = 1,
7050 		.max_interfaces = 4,
7051 		.n_limits = ARRAY_SIZE(ath10k_tlv_if_limit),
7052 	},
7053 	{
7054 		.limits = ath10k_tlv_if_limit_ibss,
7055 		.num_different_channels = 1,
7056 		.max_interfaces = 2,
7057 		.n_limits = ARRAY_SIZE(ath10k_tlv_if_limit_ibss),
7058 	},
7059 };
7060 
7061 static struct ieee80211_iface_combination ath10k_tlv_qcs_if_comb[] = {
7062 	{
7063 		.limits = ath10k_tlv_if_limit,
7064 		.num_different_channels = 1,
7065 		.max_interfaces = 4,
7066 		.n_limits = ARRAY_SIZE(ath10k_tlv_if_limit),
7067 	},
7068 	{
7069 		.limits = ath10k_tlv_qcs_if_limit,
7070 		.num_different_channels = 2,
7071 		.max_interfaces = 4,
7072 		.n_limits = ARRAY_SIZE(ath10k_tlv_qcs_if_limit),
7073 	},
7074 	{
7075 		.limits = ath10k_tlv_if_limit_ibss,
7076 		.num_different_channels = 1,
7077 		.max_interfaces = 2,
7078 		.n_limits = ARRAY_SIZE(ath10k_tlv_if_limit_ibss),
7079 	},
7080 };
7081 
7082 static const struct ieee80211_iface_limit ath10k_10_4_if_limits[] = {
7083 	{
7084 		.max = 1,
7085 		.types = BIT(NL80211_IFTYPE_STATION),
7086 	},
7087 	{
7088 		.max	= 16,
7089 		.types	= BIT(NL80211_IFTYPE_AP)
7090 #ifdef CONFIG_MAC80211_MESH
7091 			| BIT(NL80211_IFTYPE_MESH_POINT)
7092 #endif
7093 	},
7094 };
7095 
7096 static const struct ieee80211_iface_combination ath10k_10_4_if_comb[] = {
7097 	{
7098 		.limits = ath10k_10_4_if_limits,
7099 		.n_limits = ARRAY_SIZE(ath10k_10_4_if_limits),
7100 		.max_interfaces = 16,
7101 		.num_different_channels = 1,
7102 		.beacon_int_infra_match = true,
7103 #ifdef CONFIG_ATH10K_DFS_CERTIFIED
7104 		.radar_detect_widths =	BIT(NL80211_CHAN_WIDTH_20_NOHT) |
7105 					BIT(NL80211_CHAN_WIDTH_20) |
7106 					BIT(NL80211_CHAN_WIDTH_40) |
7107 					BIT(NL80211_CHAN_WIDTH_80),
7108 #endif
7109 	},
7110 };
7111 
7112 static void ath10k_get_arvif_iter(void *data, u8 *mac,
7113 				  struct ieee80211_vif *vif)
7114 {
7115 	struct ath10k_vif_iter *arvif_iter = data;
7116 	struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
7117 
7118 	if (arvif->vdev_id == arvif_iter->vdev_id)
7119 		arvif_iter->arvif = arvif;
7120 }
7121 
7122 struct ath10k_vif *ath10k_get_arvif(struct ath10k *ar, u32 vdev_id)
7123 {
7124 	struct ath10k_vif_iter arvif_iter;
7125 	u32 flags;
7126 
7127 	memset(&arvif_iter, 0, sizeof(struct ath10k_vif_iter));
7128 	arvif_iter.vdev_id = vdev_id;
7129 
7130 	flags = IEEE80211_IFACE_ITER_RESUME_ALL;
7131 	ieee80211_iterate_active_interfaces_atomic(ar->hw,
7132 						   flags,
7133 						   ath10k_get_arvif_iter,
7134 						   &arvif_iter);
7135 	if (!arvif_iter.arvif) {
7136 		ath10k_warn(ar, "No VIF found for vdev %d\n", vdev_id);
7137 		return NULL;
7138 	}
7139 
7140 	return arvif_iter.arvif;
7141 }
7142 
7143 int ath10k_mac_register(struct ath10k *ar)
7144 {
7145 	static const u32 cipher_suites[] = {
7146 		WLAN_CIPHER_SUITE_WEP40,
7147 		WLAN_CIPHER_SUITE_WEP104,
7148 		WLAN_CIPHER_SUITE_TKIP,
7149 		WLAN_CIPHER_SUITE_CCMP,
7150 		WLAN_CIPHER_SUITE_AES_CMAC,
7151 	};
7152 	struct ieee80211_supported_band *band;
7153 	void *channels;
7154 	int ret;
7155 
7156 	SET_IEEE80211_PERM_ADDR(ar->hw, ar->mac_addr);
7157 
7158 	SET_IEEE80211_DEV(ar->hw, ar->dev);
7159 
7160 	BUILD_BUG_ON((ARRAY_SIZE(ath10k_2ghz_channels) +
7161 		      ARRAY_SIZE(ath10k_5ghz_channels)) !=
7162 		     ATH10K_NUM_CHANS);
7163 
7164 	if (ar->phy_capability & WHAL_WLAN_11G_CAPABILITY) {
7165 		channels = kmemdup(ath10k_2ghz_channels,
7166 				   sizeof(ath10k_2ghz_channels),
7167 				   GFP_KERNEL);
7168 		if (!channels) {
7169 			ret = -ENOMEM;
7170 			goto err_free;
7171 		}
7172 
7173 		band = &ar->mac.sbands[IEEE80211_BAND_2GHZ];
7174 		band->n_channels = ARRAY_SIZE(ath10k_2ghz_channels);
7175 		band->channels = channels;
7176 		band->n_bitrates = ath10k_g_rates_size;
7177 		band->bitrates = ath10k_g_rates;
7178 
7179 		ar->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = band;
7180 	}
7181 
7182 	if (ar->phy_capability & WHAL_WLAN_11A_CAPABILITY) {
7183 		channels = kmemdup(ath10k_5ghz_channels,
7184 				   sizeof(ath10k_5ghz_channels),
7185 				   GFP_KERNEL);
7186 		if (!channels) {
7187 			ret = -ENOMEM;
7188 			goto err_free;
7189 		}
7190 
7191 		band = &ar->mac.sbands[IEEE80211_BAND_5GHZ];
7192 		band->n_channels = ARRAY_SIZE(ath10k_5ghz_channels);
7193 		band->channels = channels;
7194 		band->n_bitrates = ath10k_a_rates_size;
7195 		band->bitrates = ath10k_a_rates;
7196 		ar->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = band;
7197 	}
7198 
7199 	ath10k_mac_setup_ht_vht_cap(ar);
7200 
7201 	ar->hw->wiphy->interface_modes =
7202 		BIT(NL80211_IFTYPE_STATION) |
7203 		BIT(NL80211_IFTYPE_AP) |
7204 		BIT(NL80211_IFTYPE_MESH_POINT);
7205 
7206 	ar->hw->wiphy->available_antennas_rx = ar->cfg_rx_chainmask;
7207 	ar->hw->wiphy->available_antennas_tx = ar->cfg_tx_chainmask;
7208 
7209 	if (!test_bit(ATH10K_FW_FEATURE_NO_P2P, ar->fw_features))
7210 		ar->hw->wiphy->interface_modes |=
7211 			BIT(NL80211_IFTYPE_P2P_DEVICE) |
7212 			BIT(NL80211_IFTYPE_P2P_CLIENT) |
7213 			BIT(NL80211_IFTYPE_P2P_GO);
7214 
7215 	ieee80211_hw_set(ar->hw, SIGNAL_DBM);
7216 	ieee80211_hw_set(ar->hw, SUPPORTS_PS);
7217 	ieee80211_hw_set(ar->hw, SUPPORTS_DYNAMIC_PS);
7218 	ieee80211_hw_set(ar->hw, MFP_CAPABLE);
7219 	ieee80211_hw_set(ar->hw, REPORTS_TX_ACK_STATUS);
7220 	ieee80211_hw_set(ar->hw, HAS_RATE_CONTROL);
7221 	ieee80211_hw_set(ar->hw, AP_LINK_PS);
7222 	ieee80211_hw_set(ar->hw, SPECTRUM_MGMT);
7223 	ieee80211_hw_set(ar->hw, SUPPORT_FAST_XMIT);
7224 	ieee80211_hw_set(ar->hw, CONNECTION_MONITOR);
7225 	ieee80211_hw_set(ar->hw, SUPPORTS_PER_STA_GTK);
7226 	ieee80211_hw_set(ar->hw, WANT_MONITOR_VIF);
7227 	ieee80211_hw_set(ar->hw, CHANCTX_STA_CSA);
7228 	ieee80211_hw_set(ar->hw, QUEUE_CONTROL);
7229 
7230 	if (!test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags))
7231 		ieee80211_hw_set(ar->hw, SW_CRYPTO_CONTROL);
7232 
7233 	ar->hw->wiphy->features |= NL80211_FEATURE_STATIC_SMPS;
7234 	ar->hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
7235 
7236 	if (ar->ht_cap_info & WMI_HT_CAP_DYNAMIC_SMPS)
7237 		ar->hw->wiphy->features |= NL80211_FEATURE_DYNAMIC_SMPS;
7238 
7239 	if (ar->ht_cap_info & WMI_HT_CAP_ENABLED) {
7240 		ieee80211_hw_set(ar->hw, AMPDU_AGGREGATION);
7241 		ieee80211_hw_set(ar->hw, TX_AMPDU_SETUP_IN_HW);
7242 	}
7243 
7244 	ar->hw->wiphy->max_scan_ssids = WLAN_SCAN_PARAMS_MAX_SSID;
7245 	ar->hw->wiphy->max_scan_ie_len = WLAN_SCAN_PARAMS_MAX_IE_LEN;
7246 
7247 	ar->hw->vif_data_size = sizeof(struct ath10k_vif);
7248 	ar->hw->sta_data_size = sizeof(struct ath10k_sta);
7249 
7250 	ar->hw->max_listen_interval = ATH10K_MAX_HW_LISTEN_INTERVAL;
7251 
7252 	if (test_bit(WMI_SERVICE_BEACON_OFFLOAD, ar->wmi.svc_map)) {
7253 		ar->hw->wiphy->flags |= WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
7254 
7255 		/* Firmware delivers WPS/P2P Probe Requests frames to driver so
7256 		 * that userspace (e.g. wpa_supplicant/hostapd) can generate
7257 		 * correct Probe Responses. This is more of a hack advert..
7258 		 */
7259 		ar->hw->wiphy->probe_resp_offload |=
7260 			NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS |
7261 			NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2 |
7262 			NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P;
7263 	}
7264 
7265 	if (test_bit(WMI_SERVICE_TDLS, ar->wmi.svc_map))
7266 		ar->hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
7267 
7268 	ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
7269 	ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
7270 	ar->hw->wiphy->max_remain_on_channel_duration = 5000;
7271 
7272 	ar->hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
7273 	ar->hw->wiphy->features |= NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE;
7274 
7275 	ar->hw->wiphy->max_ap_assoc_sta = ar->max_num_stations;
7276 
7277 	ret = ath10k_wow_init(ar);
7278 	if (ret) {
7279 		ath10k_warn(ar, "failed to init wow: %d\n", ret);
7280 		goto err_free;
7281 	}
7282 
7283 	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
7284 
7285 	/*
7286 	 * on LL hardware queues are managed entirely by the FW
7287 	 * so we only advertise to mac we can do the queues thing
7288 	 */
7289 	ar->hw->queues = IEEE80211_MAX_QUEUES;
7290 
7291 	/* vdev_ids are used as hw queue numbers. Make sure offchan tx queue is
7292 	 * something that vdev_ids can't reach so that we don't stop the queue
7293 	 * accidentally.
7294 	 */
7295 	ar->hw->offchannel_tx_hw_queue = IEEE80211_MAX_QUEUES - 1;
7296 
7297 	switch (ar->wmi.op_version) {
7298 	case ATH10K_FW_WMI_OP_VERSION_MAIN:
7299 		ar->hw->wiphy->iface_combinations = ath10k_if_comb;
7300 		ar->hw->wiphy->n_iface_combinations =
7301 			ARRAY_SIZE(ath10k_if_comb);
7302 		ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
7303 		break;
7304 	case ATH10K_FW_WMI_OP_VERSION_TLV:
7305 		if (test_bit(WMI_SERVICE_ADAPTIVE_OCS, ar->wmi.svc_map)) {
7306 			ar->hw->wiphy->iface_combinations =
7307 				ath10k_tlv_qcs_if_comb;
7308 			ar->hw->wiphy->n_iface_combinations =
7309 				ARRAY_SIZE(ath10k_tlv_qcs_if_comb);
7310 		} else {
7311 			ar->hw->wiphy->iface_combinations = ath10k_tlv_if_comb;
7312 			ar->hw->wiphy->n_iface_combinations =
7313 				ARRAY_SIZE(ath10k_tlv_if_comb);
7314 		}
7315 		ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
7316 		break;
7317 	case ATH10K_FW_WMI_OP_VERSION_10_1:
7318 	case ATH10K_FW_WMI_OP_VERSION_10_2:
7319 	case ATH10K_FW_WMI_OP_VERSION_10_2_4:
7320 		ar->hw->wiphy->iface_combinations = ath10k_10x_if_comb;
7321 		ar->hw->wiphy->n_iface_combinations =
7322 			ARRAY_SIZE(ath10k_10x_if_comb);
7323 		break;
7324 	case ATH10K_FW_WMI_OP_VERSION_10_4:
7325 		ar->hw->wiphy->iface_combinations = ath10k_10_4_if_comb;
7326 		ar->hw->wiphy->n_iface_combinations =
7327 			ARRAY_SIZE(ath10k_10_4_if_comb);
7328 		break;
7329 	case ATH10K_FW_WMI_OP_VERSION_UNSET:
7330 	case ATH10K_FW_WMI_OP_VERSION_MAX:
7331 		WARN_ON(1);
7332 		ret = -EINVAL;
7333 		goto err_free;
7334 	}
7335 
7336 	if (!test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags))
7337 		ar->hw->netdev_features = NETIF_F_HW_CSUM;
7338 
7339 	if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED)) {
7340 		/* Init ath dfs pattern detector */
7341 		ar->ath_common.debug_mask = ATH_DBG_DFS;
7342 		ar->dfs_detector = dfs_pattern_detector_init(&ar->ath_common,
7343 							     NL80211_DFS_UNSET);
7344 
7345 		if (!ar->dfs_detector)
7346 			ath10k_warn(ar, "failed to initialise DFS pattern detector\n");
7347 	}
7348 
7349 	ret = ath_regd_init(&ar->ath_common.regulatory, ar->hw->wiphy,
7350 			    ath10k_reg_notifier);
7351 	if (ret) {
7352 		ath10k_err(ar, "failed to initialise regulatory: %i\n", ret);
7353 		goto err_dfs_detector_exit;
7354 	}
7355 
7356 	ar->hw->wiphy->cipher_suites = cipher_suites;
7357 	ar->hw->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
7358 
7359 	ret = ieee80211_register_hw(ar->hw);
7360 	if (ret) {
7361 		ath10k_err(ar, "failed to register ieee80211: %d\n", ret);
7362 		goto err_dfs_detector_exit;
7363 	}
7364 
7365 	if (!ath_is_world_regd(&ar->ath_common.regulatory)) {
7366 		ret = regulatory_hint(ar->hw->wiphy,
7367 				      ar->ath_common.regulatory.alpha2);
7368 		if (ret)
7369 			goto err_unregister;
7370 	}
7371 
7372 	return 0;
7373 
7374 err_unregister:
7375 	ieee80211_unregister_hw(ar->hw);
7376 
7377 err_dfs_detector_exit:
7378 	if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED) && ar->dfs_detector)
7379 		ar->dfs_detector->exit(ar->dfs_detector);
7380 
7381 err_free:
7382 	kfree(ar->mac.sbands[IEEE80211_BAND_2GHZ].channels);
7383 	kfree(ar->mac.sbands[IEEE80211_BAND_5GHZ].channels);
7384 
7385 	SET_IEEE80211_DEV(ar->hw, NULL);
7386 	return ret;
7387 }
7388 
7389 void ath10k_mac_unregister(struct ath10k *ar)
7390 {
7391 	ieee80211_unregister_hw(ar->hw);
7392 
7393 	if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED) && ar->dfs_detector)
7394 		ar->dfs_detector->exit(ar->dfs_detector);
7395 
7396 	kfree(ar->mac.sbands[IEEE80211_BAND_2GHZ].channels);
7397 	kfree(ar->mac.sbands[IEEE80211_BAND_5GHZ].channels);
7398 
7399 	SET_IEEE80211_DEV(ar->hw, NULL);
7400 }
7401