xref: /openbmc/linux/drivers/net/wireless/ath/ath10k/mac.c (revision f87deada)
1 /*
2  * Copyright (c) 2005-2011 Atheros Communications Inc.
3  * Copyright (c) 2011-2017 Qualcomm Atheros, Inc.
4  *
5  * Permission to use, copy, modify, and/or distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include "mac.h"
19 
20 #include <net/mac80211.h>
21 #include <linux/etherdevice.h>
22 #include <linux/acpi.h>
23 
24 #include "hif.h"
25 #include "core.h"
26 #include "debug.h"
27 #include "wmi.h"
28 #include "htt.h"
29 #include "txrx.h"
30 #include "testmode.h"
31 #include "wmi.h"
32 #include "wmi-tlv.h"
33 #include "wmi-ops.h"
34 #include "wow.h"
35 
36 /*********/
37 /* Rates */
38 /*********/
39 
40 static struct ieee80211_rate ath10k_rates[] = {
41 	{ .bitrate = 10,
42 	  .hw_value = ATH10K_HW_RATE_CCK_LP_1M },
43 	{ .bitrate = 20,
44 	  .hw_value = ATH10K_HW_RATE_CCK_LP_2M,
45 	  .hw_value_short = ATH10K_HW_RATE_CCK_SP_2M,
46 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE },
47 	{ .bitrate = 55,
48 	  .hw_value = ATH10K_HW_RATE_CCK_LP_5_5M,
49 	  .hw_value_short = ATH10K_HW_RATE_CCK_SP_5_5M,
50 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE },
51 	{ .bitrate = 110,
52 	  .hw_value = ATH10K_HW_RATE_CCK_LP_11M,
53 	  .hw_value_short = ATH10K_HW_RATE_CCK_SP_11M,
54 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE },
55 
56 	{ .bitrate = 60, .hw_value = ATH10K_HW_RATE_OFDM_6M },
57 	{ .bitrate = 90, .hw_value = ATH10K_HW_RATE_OFDM_9M },
58 	{ .bitrate = 120, .hw_value = ATH10K_HW_RATE_OFDM_12M },
59 	{ .bitrate = 180, .hw_value = ATH10K_HW_RATE_OFDM_18M },
60 	{ .bitrate = 240, .hw_value = ATH10K_HW_RATE_OFDM_24M },
61 	{ .bitrate = 360, .hw_value = ATH10K_HW_RATE_OFDM_36M },
62 	{ .bitrate = 480, .hw_value = ATH10K_HW_RATE_OFDM_48M },
63 	{ .bitrate = 540, .hw_value = ATH10K_HW_RATE_OFDM_54M },
64 };
65 
66 static struct ieee80211_rate ath10k_rates_rev2[] = {
67 	{ .bitrate = 10,
68 	  .hw_value = ATH10K_HW_RATE_REV2_CCK_LP_1M },
69 	{ .bitrate = 20,
70 	  .hw_value = ATH10K_HW_RATE_REV2_CCK_LP_2M,
71 	  .hw_value_short = ATH10K_HW_RATE_REV2_CCK_SP_2M,
72 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE },
73 	{ .bitrate = 55,
74 	  .hw_value = ATH10K_HW_RATE_REV2_CCK_LP_5_5M,
75 	  .hw_value_short = ATH10K_HW_RATE_REV2_CCK_SP_5_5M,
76 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE },
77 	{ .bitrate = 110,
78 	  .hw_value = ATH10K_HW_RATE_REV2_CCK_LP_11M,
79 	  .hw_value_short = ATH10K_HW_RATE_REV2_CCK_SP_11M,
80 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE },
81 
82 	{ .bitrate = 60, .hw_value = ATH10K_HW_RATE_OFDM_6M },
83 	{ .bitrate = 90, .hw_value = ATH10K_HW_RATE_OFDM_9M },
84 	{ .bitrate = 120, .hw_value = ATH10K_HW_RATE_OFDM_12M },
85 	{ .bitrate = 180, .hw_value = ATH10K_HW_RATE_OFDM_18M },
86 	{ .bitrate = 240, .hw_value = ATH10K_HW_RATE_OFDM_24M },
87 	{ .bitrate = 360, .hw_value = ATH10K_HW_RATE_OFDM_36M },
88 	{ .bitrate = 480, .hw_value = ATH10K_HW_RATE_OFDM_48M },
89 	{ .bitrate = 540, .hw_value = ATH10K_HW_RATE_OFDM_54M },
90 };
91 
92 #define ATH10K_MAC_FIRST_OFDM_RATE_IDX 4
93 
94 #define ath10k_a_rates (ath10k_rates + ATH10K_MAC_FIRST_OFDM_RATE_IDX)
95 #define ath10k_a_rates_size (ARRAY_SIZE(ath10k_rates) - \
96 			     ATH10K_MAC_FIRST_OFDM_RATE_IDX)
97 #define ath10k_g_rates (ath10k_rates + 0)
98 #define ath10k_g_rates_size (ARRAY_SIZE(ath10k_rates))
99 
100 #define ath10k_g_rates_rev2 (ath10k_rates_rev2 + 0)
101 #define ath10k_g_rates_rev2_size (ARRAY_SIZE(ath10k_rates_rev2))
102 
103 static bool ath10k_mac_bitrate_is_cck(int bitrate)
104 {
105 	switch (bitrate) {
106 	case 10:
107 	case 20:
108 	case 55:
109 	case 110:
110 		return true;
111 	}
112 
113 	return false;
114 }
115 
116 static u8 ath10k_mac_bitrate_to_rate(int bitrate)
117 {
118 	return DIV_ROUND_UP(bitrate, 5) |
119 	       (ath10k_mac_bitrate_is_cck(bitrate) ? BIT(7) : 0);
120 }
121 
122 u8 ath10k_mac_hw_rate_to_idx(const struct ieee80211_supported_band *sband,
123 			     u8 hw_rate, bool cck)
124 {
125 	const struct ieee80211_rate *rate;
126 	int i;
127 
128 	for (i = 0; i < sband->n_bitrates; i++) {
129 		rate = &sband->bitrates[i];
130 
131 		if (ath10k_mac_bitrate_is_cck(rate->bitrate) != cck)
132 			continue;
133 
134 		if (rate->hw_value == hw_rate)
135 			return i;
136 		else if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE &&
137 			 rate->hw_value_short == hw_rate)
138 			return i;
139 	}
140 
141 	return 0;
142 }
143 
144 u8 ath10k_mac_bitrate_to_idx(const struct ieee80211_supported_band *sband,
145 			     u32 bitrate)
146 {
147 	int i;
148 
149 	for (i = 0; i < sband->n_bitrates; i++)
150 		if (sband->bitrates[i].bitrate == bitrate)
151 			return i;
152 
153 	return 0;
154 }
155 
156 static int ath10k_mac_get_max_vht_mcs_map(u16 mcs_map, int nss)
157 {
158 	switch ((mcs_map >> (2 * nss)) & 0x3) {
159 	case IEEE80211_VHT_MCS_SUPPORT_0_7: return BIT(8) - 1;
160 	case IEEE80211_VHT_MCS_SUPPORT_0_8: return BIT(9) - 1;
161 	case IEEE80211_VHT_MCS_SUPPORT_0_9: return BIT(10) - 1;
162 	}
163 	return 0;
164 }
165 
166 static u32
167 ath10k_mac_max_ht_nss(const u8 ht_mcs_mask[IEEE80211_HT_MCS_MASK_LEN])
168 {
169 	int nss;
170 
171 	for (nss = IEEE80211_HT_MCS_MASK_LEN - 1; nss >= 0; nss--)
172 		if (ht_mcs_mask[nss])
173 			return nss + 1;
174 
175 	return 1;
176 }
177 
178 static u32
179 ath10k_mac_max_vht_nss(const u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
180 {
181 	int nss;
182 
183 	for (nss = NL80211_VHT_NSS_MAX - 1; nss >= 0; nss--)
184 		if (vht_mcs_mask[nss])
185 			return nss + 1;
186 
187 	return 1;
188 }
189 
190 int ath10k_mac_ext_resource_config(struct ath10k *ar, u32 val)
191 {
192 	enum wmi_host_platform_type platform_type;
193 	int ret;
194 
195 	if (test_bit(WMI_SERVICE_TX_MODE_DYNAMIC, ar->wmi.svc_map))
196 		platform_type = WMI_HOST_PLATFORM_LOW_PERF;
197 	else
198 		platform_type = WMI_HOST_PLATFORM_HIGH_PERF;
199 
200 	ret = ath10k_wmi_ext_resource_config(ar, platform_type, val);
201 
202 	if (ret && ret != -EOPNOTSUPP) {
203 		ath10k_warn(ar, "failed to configure ext resource: %d\n", ret);
204 		return ret;
205 	}
206 
207 	return 0;
208 }
209 
210 /**********/
211 /* Crypto */
212 /**********/
213 
214 static int ath10k_send_key(struct ath10k_vif *arvif,
215 			   struct ieee80211_key_conf *key,
216 			   enum set_key_cmd cmd,
217 			   const u8 *macaddr, u32 flags)
218 {
219 	struct ath10k *ar = arvif->ar;
220 	struct wmi_vdev_install_key_arg arg = {
221 		.vdev_id = arvif->vdev_id,
222 		.key_idx = key->keyidx,
223 		.key_len = key->keylen,
224 		.key_data = key->key,
225 		.key_flags = flags,
226 		.macaddr = macaddr,
227 	};
228 
229 	lockdep_assert_held(&arvif->ar->conf_mutex);
230 
231 	switch (key->cipher) {
232 	case WLAN_CIPHER_SUITE_CCMP:
233 		arg.key_cipher = WMI_CIPHER_AES_CCM;
234 		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV_MGMT;
235 		break;
236 	case WLAN_CIPHER_SUITE_TKIP:
237 		arg.key_cipher = WMI_CIPHER_TKIP;
238 		arg.key_txmic_len = 8;
239 		arg.key_rxmic_len = 8;
240 		break;
241 	case WLAN_CIPHER_SUITE_WEP40:
242 	case WLAN_CIPHER_SUITE_WEP104:
243 		arg.key_cipher = WMI_CIPHER_WEP;
244 		break;
245 	case WLAN_CIPHER_SUITE_CCMP_256:
246 		arg.key_cipher = WMI_CIPHER_AES_CCM;
247 		break;
248 	case WLAN_CIPHER_SUITE_GCMP:
249 	case WLAN_CIPHER_SUITE_GCMP_256:
250 		arg.key_cipher = WMI_CIPHER_AES_GCM;
251 		break;
252 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
253 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
254 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
255 	case WLAN_CIPHER_SUITE_AES_CMAC:
256 		WARN_ON(1);
257 		return -EINVAL;
258 	default:
259 		ath10k_warn(ar, "cipher %d is not supported\n", key->cipher);
260 		return -EOPNOTSUPP;
261 	}
262 
263 	if (test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags))
264 		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
265 
266 	if (cmd == DISABLE_KEY) {
267 		arg.key_cipher = WMI_CIPHER_NONE;
268 		arg.key_data = NULL;
269 	}
270 
271 	return ath10k_wmi_vdev_install_key(arvif->ar, &arg);
272 }
273 
274 static int ath10k_install_key(struct ath10k_vif *arvif,
275 			      struct ieee80211_key_conf *key,
276 			      enum set_key_cmd cmd,
277 			      const u8 *macaddr, u32 flags)
278 {
279 	struct ath10k *ar = arvif->ar;
280 	int ret;
281 	unsigned long time_left;
282 
283 	lockdep_assert_held(&ar->conf_mutex);
284 
285 	reinit_completion(&ar->install_key_done);
286 
287 	if (arvif->nohwcrypt)
288 		return 1;
289 
290 	ret = ath10k_send_key(arvif, key, cmd, macaddr, flags);
291 	if (ret)
292 		return ret;
293 
294 	time_left = wait_for_completion_timeout(&ar->install_key_done, 3 * HZ);
295 	if (time_left == 0)
296 		return -ETIMEDOUT;
297 
298 	return 0;
299 }
300 
301 static int ath10k_install_peer_wep_keys(struct ath10k_vif *arvif,
302 					const u8 *addr)
303 {
304 	struct ath10k *ar = arvif->ar;
305 	struct ath10k_peer *peer;
306 	int ret;
307 	int i;
308 	u32 flags;
309 
310 	lockdep_assert_held(&ar->conf_mutex);
311 
312 	if (WARN_ON(arvif->vif->type != NL80211_IFTYPE_AP &&
313 		    arvif->vif->type != NL80211_IFTYPE_ADHOC &&
314 		    arvif->vif->type != NL80211_IFTYPE_MESH_POINT))
315 		return -EINVAL;
316 
317 	spin_lock_bh(&ar->data_lock);
318 	peer = ath10k_peer_find(ar, arvif->vdev_id, addr);
319 	spin_unlock_bh(&ar->data_lock);
320 
321 	if (!peer)
322 		return -ENOENT;
323 
324 	for (i = 0; i < ARRAY_SIZE(arvif->wep_keys); i++) {
325 		if (arvif->wep_keys[i] == NULL)
326 			continue;
327 
328 		switch (arvif->vif->type) {
329 		case NL80211_IFTYPE_AP:
330 			flags = WMI_KEY_PAIRWISE;
331 
332 			if (arvif->def_wep_key_idx == i)
333 				flags |= WMI_KEY_TX_USAGE;
334 
335 			ret = ath10k_install_key(arvif, arvif->wep_keys[i],
336 						 SET_KEY, addr, flags);
337 			if (ret < 0)
338 				return ret;
339 			break;
340 		case NL80211_IFTYPE_ADHOC:
341 			ret = ath10k_install_key(arvif, arvif->wep_keys[i],
342 						 SET_KEY, addr,
343 						 WMI_KEY_PAIRWISE);
344 			if (ret < 0)
345 				return ret;
346 
347 			ret = ath10k_install_key(arvif, arvif->wep_keys[i],
348 						 SET_KEY, addr, WMI_KEY_GROUP);
349 			if (ret < 0)
350 				return ret;
351 			break;
352 		default:
353 			WARN_ON(1);
354 			return -EINVAL;
355 		}
356 
357 		spin_lock_bh(&ar->data_lock);
358 		peer->keys[i] = arvif->wep_keys[i];
359 		spin_unlock_bh(&ar->data_lock);
360 	}
361 
362 	/* In some cases (notably with static WEP IBSS with multiple keys)
363 	 * multicast Tx becomes broken. Both pairwise and groupwise keys are
364 	 * installed already. Using WMI_KEY_TX_USAGE in different combinations
365 	 * didn't seem help. Using def_keyid vdev parameter seems to be
366 	 * effective so use that.
367 	 *
368 	 * FIXME: Revisit. Perhaps this can be done in a less hacky way.
369 	 */
370 	if (arvif->vif->type != NL80211_IFTYPE_ADHOC)
371 		return 0;
372 
373 	if (arvif->def_wep_key_idx == -1)
374 		return 0;
375 
376 	ret = ath10k_wmi_vdev_set_param(arvif->ar,
377 					arvif->vdev_id,
378 					arvif->ar->wmi.vdev_param->def_keyid,
379 					arvif->def_wep_key_idx);
380 	if (ret) {
381 		ath10k_warn(ar, "failed to re-set def wpa key idxon vdev %i: %d\n",
382 			    arvif->vdev_id, ret);
383 		return ret;
384 	}
385 
386 	return 0;
387 }
388 
389 static int ath10k_clear_peer_keys(struct ath10k_vif *arvif,
390 				  const u8 *addr)
391 {
392 	struct ath10k *ar = arvif->ar;
393 	struct ath10k_peer *peer;
394 	int first_errno = 0;
395 	int ret;
396 	int i;
397 	u32 flags = 0;
398 
399 	lockdep_assert_held(&ar->conf_mutex);
400 
401 	spin_lock_bh(&ar->data_lock);
402 	peer = ath10k_peer_find(ar, arvif->vdev_id, addr);
403 	spin_unlock_bh(&ar->data_lock);
404 
405 	if (!peer)
406 		return -ENOENT;
407 
408 	for (i = 0; i < ARRAY_SIZE(peer->keys); i++) {
409 		if (peer->keys[i] == NULL)
410 			continue;
411 
412 		/* key flags are not required to delete the key */
413 		ret = ath10k_install_key(arvif, peer->keys[i],
414 					 DISABLE_KEY, addr, flags);
415 		if (ret < 0 && first_errno == 0)
416 			first_errno = ret;
417 
418 		if (ret < 0)
419 			ath10k_warn(ar, "failed to remove peer wep key %d: %d\n",
420 				    i, ret);
421 
422 		spin_lock_bh(&ar->data_lock);
423 		peer->keys[i] = NULL;
424 		spin_unlock_bh(&ar->data_lock);
425 	}
426 
427 	return first_errno;
428 }
429 
430 bool ath10k_mac_is_peer_wep_key_set(struct ath10k *ar, const u8 *addr,
431 				    u8 keyidx)
432 {
433 	struct ath10k_peer *peer;
434 	int i;
435 
436 	lockdep_assert_held(&ar->data_lock);
437 
438 	/* We don't know which vdev this peer belongs to,
439 	 * since WMI doesn't give us that information.
440 	 *
441 	 * FIXME: multi-bss needs to be handled.
442 	 */
443 	peer = ath10k_peer_find(ar, 0, addr);
444 	if (!peer)
445 		return false;
446 
447 	for (i = 0; i < ARRAY_SIZE(peer->keys); i++) {
448 		if (peer->keys[i] && peer->keys[i]->keyidx == keyidx)
449 			return true;
450 	}
451 
452 	return false;
453 }
454 
455 static int ath10k_clear_vdev_key(struct ath10k_vif *arvif,
456 				 struct ieee80211_key_conf *key)
457 {
458 	struct ath10k *ar = arvif->ar;
459 	struct ath10k_peer *peer;
460 	u8 addr[ETH_ALEN];
461 	int first_errno = 0;
462 	int ret;
463 	int i;
464 	u32 flags = 0;
465 
466 	lockdep_assert_held(&ar->conf_mutex);
467 
468 	for (;;) {
469 		/* since ath10k_install_key we can't hold data_lock all the
470 		 * time, so we try to remove the keys incrementally
471 		 */
472 		spin_lock_bh(&ar->data_lock);
473 		i = 0;
474 		list_for_each_entry(peer, &ar->peers, list) {
475 			for (i = 0; i < ARRAY_SIZE(peer->keys); i++) {
476 				if (peer->keys[i] == key) {
477 					ether_addr_copy(addr, peer->addr);
478 					peer->keys[i] = NULL;
479 					break;
480 				}
481 			}
482 
483 			if (i < ARRAY_SIZE(peer->keys))
484 				break;
485 		}
486 		spin_unlock_bh(&ar->data_lock);
487 
488 		if (i == ARRAY_SIZE(peer->keys))
489 			break;
490 		/* key flags are not required to delete the key */
491 		ret = ath10k_install_key(arvif, key, DISABLE_KEY, addr, flags);
492 		if (ret < 0 && first_errno == 0)
493 			first_errno = ret;
494 
495 		if (ret)
496 			ath10k_warn(ar, "failed to remove key for %pM: %d\n",
497 				    addr, ret);
498 	}
499 
500 	return first_errno;
501 }
502 
503 static int ath10k_mac_vif_update_wep_key(struct ath10k_vif *arvif,
504 					 struct ieee80211_key_conf *key)
505 {
506 	struct ath10k *ar = arvif->ar;
507 	struct ath10k_peer *peer;
508 	int ret;
509 
510 	lockdep_assert_held(&ar->conf_mutex);
511 
512 	list_for_each_entry(peer, &ar->peers, list) {
513 		if (ether_addr_equal(peer->addr, arvif->vif->addr))
514 			continue;
515 
516 		if (ether_addr_equal(peer->addr, arvif->bssid))
517 			continue;
518 
519 		if (peer->keys[key->keyidx] == key)
520 			continue;
521 
522 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vif vdev %i update key %i needs update\n",
523 			   arvif->vdev_id, key->keyidx);
524 
525 		ret = ath10k_install_peer_wep_keys(arvif, peer->addr);
526 		if (ret) {
527 			ath10k_warn(ar, "failed to update wep keys on vdev %i for peer %pM: %d\n",
528 				    arvif->vdev_id, peer->addr, ret);
529 			return ret;
530 		}
531 	}
532 
533 	return 0;
534 }
535 
536 /*********************/
537 /* General utilities */
538 /*********************/
539 
540 static inline enum wmi_phy_mode
541 chan_to_phymode(const struct cfg80211_chan_def *chandef)
542 {
543 	enum wmi_phy_mode phymode = MODE_UNKNOWN;
544 
545 	switch (chandef->chan->band) {
546 	case NL80211_BAND_2GHZ:
547 		switch (chandef->width) {
548 		case NL80211_CHAN_WIDTH_20_NOHT:
549 			if (chandef->chan->flags & IEEE80211_CHAN_NO_OFDM)
550 				phymode = MODE_11B;
551 			else
552 				phymode = MODE_11G;
553 			break;
554 		case NL80211_CHAN_WIDTH_20:
555 			phymode = MODE_11NG_HT20;
556 			break;
557 		case NL80211_CHAN_WIDTH_40:
558 			phymode = MODE_11NG_HT40;
559 			break;
560 		case NL80211_CHAN_WIDTH_5:
561 		case NL80211_CHAN_WIDTH_10:
562 		case NL80211_CHAN_WIDTH_80:
563 		case NL80211_CHAN_WIDTH_80P80:
564 		case NL80211_CHAN_WIDTH_160:
565 			phymode = MODE_UNKNOWN;
566 			break;
567 		}
568 		break;
569 	case NL80211_BAND_5GHZ:
570 		switch (chandef->width) {
571 		case NL80211_CHAN_WIDTH_20_NOHT:
572 			phymode = MODE_11A;
573 			break;
574 		case NL80211_CHAN_WIDTH_20:
575 			phymode = MODE_11NA_HT20;
576 			break;
577 		case NL80211_CHAN_WIDTH_40:
578 			phymode = MODE_11NA_HT40;
579 			break;
580 		case NL80211_CHAN_WIDTH_80:
581 			phymode = MODE_11AC_VHT80;
582 			break;
583 		case NL80211_CHAN_WIDTH_160:
584 			phymode = MODE_11AC_VHT160;
585 			break;
586 		case NL80211_CHAN_WIDTH_80P80:
587 			phymode = MODE_11AC_VHT80_80;
588 			break;
589 		case NL80211_CHAN_WIDTH_5:
590 		case NL80211_CHAN_WIDTH_10:
591 			phymode = MODE_UNKNOWN;
592 			break;
593 		}
594 		break;
595 	default:
596 		break;
597 	}
598 
599 	WARN_ON(phymode == MODE_UNKNOWN);
600 	return phymode;
601 }
602 
603 static u8 ath10k_parse_mpdudensity(u8 mpdudensity)
604 {
605 /*
606  * 802.11n D2.0 defined values for "Minimum MPDU Start Spacing":
607  *   0 for no restriction
608  *   1 for 1/4 us
609  *   2 for 1/2 us
610  *   3 for 1 us
611  *   4 for 2 us
612  *   5 for 4 us
613  *   6 for 8 us
614  *   7 for 16 us
615  */
616 	switch (mpdudensity) {
617 	case 0:
618 		return 0;
619 	case 1:
620 	case 2:
621 	case 3:
622 	/* Our lower layer calculations limit our precision to
623 	 * 1 microsecond
624 	 */
625 		return 1;
626 	case 4:
627 		return 2;
628 	case 5:
629 		return 4;
630 	case 6:
631 		return 8;
632 	case 7:
633 		return 16;
634 	default:
635 		return 0;
636 	}
637 }
638 
639 int ath10k_mac_vif_chan(struct ieee80211_vif *vif,
640 			struct cfg80211_chan_def *def)
641 {
642 	struct ieee80211_chanctx_conf *conf;
643 
644 	rcu_read_lock();
645 	conf = rcu_dereference(vif->chanctx_conf);
646 	if (!conf) {
647 		rcu_read_unlock();
648 		return -ENOENT;
649 	}
650 
651 	*def = conf->def;
652 	rcu_read_unlock();
653 
654 	return 0;
655 }
656 
657 static void ath10k_mac_num_chanctxs_iter(struct ieee80211_hw *hw,
658 					 struct ieee80211_chanctx_conf *conf,
659 					 void *data)
660 {
661 	int *num = data;
662 
663 	(*num)++;
664 }
665 
666 static int ath10k_mac_num_chanctxs(struct ath10k *ar)
667 {
668 	int num = 0;
669 
670 	ieee80211_iter_chan_contexts_atomic(ar->hw,
671 					    ath10k_mac_num_chanctxs_iter,
672 					    &num);
673 
674 	return num;
675 }
676 
677 static void
678 ath10k_mac_get_any_chandef_iter(struct ieee80211_hw *hw,
679 				struct ieee80211_chanctx_conf *conf,
680 				void *data)
681 {
682 	struct cfg80211_chan_def **def = data;
683 
684 	*def = &conf->def;
685 }
686 
687 static int ath10k_peer_create(struct ath10k *ar,
688 			      struct ieee80211_vif *vif,
689 			      struct ieee80211_sta *sta,
690 			      u32 vdev_id,
691 			      const u8 *addr,
692 			      enum wmi_peer_type peer_type)
693 {
694 	struct ath10k_vif *arvif;
695 	struct ath10k_peer *peer;
696 	int num_peers = 0;
697 	int ret;
698 
699 	lockdep_assert_held(&ar->conf_mutex);
700 
701 	num_peers = ar->num_peers;
702 
703 	/* Each vdev consumes a peer entry as well */
704 	list_for_each_entry(arvif, &ar->arvifs, list)
705 		num_peers++;
706 
707 	if (num_peers >= ar->max_num_peers)
708 		return -ENOBUFS;
709 
710 	ret = ath10k_wmi_peer_create(ar, vdev_id, addr, peer_type);
711 	if (ret) {
712 		ath10k_warn(ar, "failed to create wmi peer %pM on vdev %i: %i\n",
713 			    addr, vdev_id, ret);
714 		return ret;
715 	}
716 
717 	ret = ath10k_wait_for_peer_created(ar, vdev_id, addr);
718 	if (ret) {
719 		ath10k_warn(ar, "failed to wait for created wmi peer %pM on vdev %i: %i\n",
720 			    addr, vdev_id, ret);
721 		return ret;
722 	}
723 
724 	spin_lock_bh(&ar->data_lock);
725 
726 	peer = ath10k_peer_find(ar, vdev_id, addr);
727 	if (!peer) {
728 		spin_unlock_bh(&ar->data_lock);
729 		ath10k_warn(ar, "failed to find peer %pM on vdev %i after creation\n",
730 			    addr, vdev_id);
731 		ath10k_wmi_peer_delete(ar, vdev_id, addr);
732 		return -ENOENT;
733 	}
734 
735 	peer->vif = vif;
736 	peer->sta = sta;
737 
738 	spin_unlock_bh(&ar->data_lock);
739 
740 	ar->num_peers++;
741 
742 	return 0;
743 }
744 
745 static int ath10k_mac_set_kickout(struct ath10k_vif *arvif)
746 {
747 	struct ath10k *ar = arvif->ar;
748 	u32 param;
749 	int ret;
750 
751 	param = ar->wmi.pdev_param->sta_kickout_th;
752 	ret = ath10k_wmi_pdev_set_param(ar, param,
753 					ATH10K_KICKOUT_THRESHOLD);
754 	if (ret) {
755 		ath10k_warn(ar, "failed to set kickout threshold on vdev %i: %d\n",
756 			    arvif->vdev_id, ret);
757 		return ret;
758 	}
759 
760 	param = ar->wmi.vdev_param->ap_keepalive_min_idle_inactive_time_secs;
761 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, param,
762 					ATH10K_KEEPALIVE_MIN_IDLE);
763 	if (ret) {
764 		ath10k_warn(ar, "failed to set keepalive minimum idle time on vdev %i: %d\n",
765 			    arvif->vdev_id, ret);
766 		return ret;
767 	}
768 
769 	param = ar->wmi.vdev_param->ap_keepalive_max_idle_inactive_time_secs;
770 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, param,
771 					ATH10K_KEEPALIVE_MAX_IDLE);
772 	if (ret) {
773 		ath10k_warn(ar, "failed to set keepalive maximum idle time on vdev %i: %d\n",
774 			    arvif->vdev_id, ret);
775 		return ret;
776 	}
777 
778 	param = ar->wmi.vdev_param->ap_keepalive_max_unresponsive_time_secs;
779 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, param,
780 					ATH10K_KEEPALIVE_MAX_UNRESPONSIVE);
781 	if (ret) {
782 		ath10k_warn(ar, "failed to set keepalive maximum unresponsive time on vdev %i: %d\n",
783 			    arvif->vdev_id, ret);
784 		return ret;
785 	}
786 
787 	return 0;
788 }
789 
790 static int ath10k_mac_set_rts(struct ath10k_vif *arvif, u32 value)
791 {
792 	struct ath10k *ar = arvif->ar;
793 	u32 vdev_param;
794 
795 	vdev_param = ar->wmi.vdev_param->rts_threshold;
796 	return ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param, value);
797 }
798 
799 static int ath10k_peer_delete(struct ath10k *ar, u32 vdev_id, const u8 *addr)
800 {
801 	int ret;
802 
803 	lockdep_assert_held(&ar->conf_mutex);
804 
805 	ret = ath10k_wmi_peer_delete(ar, vdev_id, addr);
806 	if (ret)
807 		return ret;
808 
809 	ret = ath10k_wait_for_peer_deleted(ar, vdev_id, addr);
810 	if (ret)
811 		return ret;
812 
813 	ar->num_peers--;
814 
815 	return 0;
816 }
817 
818 static void ath10k_peer_cleanup(struct ath10k *ar, u32 vdev_id)
819 {
820 	struct ath10k_peer *peer, *tmp;
821 	int peer_id;
822 	int i;
823 
824 	lockdep_assert_held(&ar->conf_mutex);
825 
826 	spin_lock_bh(&ar->data_lock);
827 	list_for_each_entry_safe(peer, tmp, &ar->peers, list) {
828 		if (peer->vdev_id != vdev_id)
829 			continue;
830 
831 		ath10k_warn(ar, "removing stale peer %pM from vdev_id %d\n",
832 			    peer->addr, vdev_id);
833 
834 		for_each_set_bit(peer_id, peer->peer_ids,
835 				 ATH10K_MAX_NUM_PEER_IDS) {
836 			ar->peer_map[peer_id] = NULL;
837 		}
838 
839 		/* Double check that peer is properly un-referenced from
840 		 * the peer_map
841 		 */
842 		for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++) {
843 			if (ar->peer_map[i] == peer) {
844 				ath10k_warn(ar, "removing stale peer_map entry for %pM (ptr %pK idx %d)\n",
845 					    peer->addr, peer, i);
846 				ar->peer_map[i] = NULL;
847 			}
848 		}
849 
850 		list_del(&peer->list);
851 		kfree(peer);
852 		ar->num_peers--;
853 	}
854 	spin_unlock_bh(&ar->data_lock);
855 }
856 
857 static void ath10k_peer_cleanup_all(struct ath10k *ar)
858 {
859 	struct ath10k_peer *peer, *tmp;
860 	int i;
861 
862 	lockdep_assert_held(&ar->conf_mutex);
863 
864 	spin_lock_bh(&ar->data_lock);
865 	list_for_each_entry_safe(peer, tmp, &ar->peers, list) {
866 		list_del(&peer->list);
867 		kfree(peer);
868 	}
869 
870 	for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++)
871 		ar->peer_map[i] = NULL;
872 
873 	spin_unlock_bh(&ar->data_lock);
874 
875 	ar->num_peers = 0;
876 	ar->num_stations = 0;
877 }
878 
879 static int ath10k_mac_tdls_peer_update(struct ath10k *ar, u32 vdev_id,
880 				       struct ieee80211_sta *sta,
881 				       enum wmi_tdls_peer_state state)
882 {
883 	int ret;
884 	struct wmi_tdls_peer_update_cmd_arg arg = {};
885 	struct wmi_tdls_peer_capab_arg cap = {};
886 	struct wmi_channel_arg chan_arg = {};
887 
888 	lockdep_assert_held(&ar->conf_mutex);
889 
890 	arg.vdev_id = vdev_id;
891 	arg.peer_state = state;
892 	ether_addr_copy(arg.addr, sta->addr);
893 
894 	cap.peer_max_sp = sta->max_sp;
895 	cap.peer_uapsd_queues = sta->uapsd_queues;
896 
897 	if (state == WMI_TDLS_PEER_STATE_CONNECTED &&
898 	    !sta->tdls_initiator)
899 		cap.is_peer_responder = 1;
900 
901 	ret = ath10k_wmi_tdls_peer_update(ar, &arg, &cap, &chan_arg);
902 	if (ret) {
903 		ath10k_warn(ar, "failed to update tdls peer %pM on vdev %i: %i\n",
904 			    arg.addr, vdev_id, ret);
905 		return ret;
906 	}
907 
908 	return 0;
909 }
910 
911 /************************/
912 /* Interface management */
913 /************************/
914 
915 void ath10k_mac_vif_beacon_free(struct ath10k_vif *arvif)
916 {
917 	struct ath10k *ar = arvif->ar;
918 
919 	lockdep_assert_held(&ar->data_lock);
920 
921 	if (!arvif->beacon)
922 		return;
923 
924 	if (!arvif->beacon_buf)
925 		dma_unmap_single(ar->dev, ATH10K_SKB_CB(arvif->beacon)->paddr,
926 				 arvif->beacon->len, DMA_TO_DEVICE);
927 
928 	if (WARN_ON(arvif->beacon_state != ATH10K_BEACON_SCHEDULED &&
929 		    arvif->beacon_state != ATH10K_BEACON_SENT))
930 		return;
931 
932 	dev_kfree_skb_any(arvif->beacon);
933 
934 	arvif->beacon = NULL;
935 	arvif->beacon_state = ATH10K_BEACON_SCHEDULED;
936 }
937 
938 static void ath10k_mac_vif_beacon_cleanup(struct ath10k_vif *arvif)
939 {
940 	struct ath10k *ar = arvif->ar;
941 
942 	lockdep_assert_held(&ar->data_lock);
943 
944 	ath10k_mac_vif_beacon_free(arvif);
945 
946 	if (arvif->beacon_buf) {
947 		dma_free_coherent(ar->dev, IEEE80211_MAX_FRAME_LEN,
948 				  arvif->beacon_buf, arvif->beacon_paddr);
949 		arvif->beacon_buf = NULL;
950 	}
951 }
952 
953 static inline int ath10k_vdev_setup_sync(struct ath10k *ar)
954 {
955 	unsigned long time_left;
956 
957 	lockdep_assert_held(&ar->conf_mutex);
958 
959 	if (test_bit(ATH10K_FLAG_CRASH_FLUSH, &ar->dev_flags))
960 		return -ESHUTDOWN;
961 
962 	time_left = wait_for_completion_timeout(&ar->vdev_setup_done,
963 						ATH10K_VDEV_SETUP_TIMEOUT_HZ);
964 	if (time_left == 0)
965 		return -ETIMEDOUT;
966 
967 	return 0;
968 }
969 
970 static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
971 {
972 	struct cfg80211_chan_def *chandef = NULL;
973 	struct ieee80211_channel *channel = NULL;
974 	struct wmi_vdev_start_request_arg arg = {};
975 	int ret = 0;
976 
977 	lockdep_assert_held(&ar->conf_mutex);
978 
979 	ieee80211_iter_chan_contexts_atomic(ar->hw,
980 					    ath10k_mac_get_any_chandef_iter,
981 					    &chandef);
982 	if (WARN_ON_ONCE(!chandef))
983 		return -ENOENT;
984 
985 	channel = chandef->chan;
986 
987 	arg.vdev_id = vdev_id;
988 	arg.channel.freq = channel->center_freq;
989 	arg.channel.band_center_freq1 = chandef->center_freq1;
990 	arg.channel.band_center_freq2 = chandef->center_freq2;
991 
992 	/* TODO setup this dynamically, what in case we
993 	 * don't have any vifs?
994 	 */
995 	arg.channel.mode = chan_to_phymode(chandef);
996 	arg.channel.chan_radar =
997 			!!(channel->flags & IEEE80211_CHAN_RADAR);
998 
999 	arg.channel.min_power = 0;
1000 	arg.channel.max_power = channel->max_power * 2;
1001 	arg.channel.max_reg_power = channel->max_reg_power * 2;
1002 	arg.channel.max_antenna_gain = channel->max_antenna_gain * 2;
1003 
1004 	reinit_completion(&ar->vdev_setup_done);
1005 
1006 	ret = ath10k_wmi_vdev_start(ar, &arg);
1007 	if (ret) {
1008 		ath10k_warn(ar, "failed to request monitor vdev %i start: %d\n",
1009 			    vdev_id, ret);
1010 		return ret;
1011 	}
1012 
1013 	ret = ath10k_vdev_setup_sync(ar);
1014 	if (ret) {
1015 		ath10k_warn(ar, "failed to synchronize setup for monitor vdev %i start: %d\n",
1016 			    vdev_id, ret);
1017 		return ret;
1018 	}
1019 
1020 	ret = ath10k_wmi_vdev_up(ar, vdev_id, 0, ar->mac_addr);
1021 	if (ret) {
1022 		ath10k_warn(ar, "failed to put up monitor vdev %i: %d\n",
1023 			    vdev_id, ret);
1024 		goto vdev_stop;
1025 	}
1026 
1027 	ar->monitor_vdev_id = vdev_id;
1028 
1029 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac monitor vdev %i started\n",
1030 		   ar->monitor_vdev_id);
1031 	return 0;
1032 
1033 vdev_stop:
1034 	ret = ath10k_wmi_vdev_stop(ar, ar->monitor_vdev_id);
1035 	if (ret)
1036 		ath10k_warn(ar, "failed to stop monitor vdev %i after start failure: %d\n",
1037 			    ar->monitor_vdev_id, ret);
1038 
1039 	return ret;
1040 }
1041 
1042 static int ath10k_monitor_vdev_stop(struct ath10k *ar)
1043 {
1044 	int ret = 0;
1045 
1046 	lockdep_assert_held(&ar->conf_mutex);
1047 
1048 	ret = ath10k_wmi_vdev_down(ar, ar->monitor_vdev_id);
1049 	if (ret)
1050 		ath10k_warn(ar, "failed to put down monitor vdev %i: %d\n",
1051 			    ar->monitor_vdev_id, ret);
1052 
1053 	reinit_completion(&ar->vdev_setup_done);
1054 
1055 	ret = ath10k_wmi_vdev_stop(ar, ar->monitor_vdev_id);
1056 	if (ret)
1057 		ath10k_warn(ar, "failed to to request monitor vdev %i stop: %d\n",
1058 			    ar->monitor_vdev_id, ret);
1059 
1060 	ret = ath10k_vdev_setup_sync(ar);
1061 	if (ret)
1062 		ath10k_warn(ar, "failed to synchronize monitor vdev %i stop: %d\n",
1063 			    ar->monitor_vdev_id, ret);
1064 
1065 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac monitor vdev %i stopped\n",
1066 		   ar->monitor_vdev_id);
1067 	return ret;
1068 }
1069 
1070 static int ath10k_monitor_vdev_create(struct ath10k *ar)
1071 {
1072 	int bit, ret = 0;
1073 
1074 	lockdep_assert_held(&ar->conf_mutex);
1075 
1076 	if (ar->free_vdev_map == 0) {
1077 		ath10k_warn(ar, "failed to find free vdev id for monitor vdev\n");
1078 		return -ENOMEM;
1079 	}
1080 
1081 	bit = __ffs64(ar->free_vdev_map);
1082 
1083 	ar->monitor_vdev_id = bit;
1084 
1085 	ret = ath10k_wmi_vdev_create(ar, ar->monitor_vdev_id,
1086 				     WMI_VDEV_TYPE_MONITOR,
1087 				     0, ar->mac_addr);
1088 	if (ret) {
1089 		ath10k_warn(ar, "failed to request monitor vdev %i creation: %d\n",
1090 			    ar->monitor_vdev_id, ret);
1091 		return ret;
1092 	}
1093 
1094 	ar->free_vdev_map &= ~(1LL << ar->monitor_vdev_id);
1095 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac monitor vdev %d created\n",
1096 		   ar->monitor_vdev_id);
1097 
1098 	return 0;
1099 }
1100 
1101 static int ath10k_monitor_vdev_delete(struct ath10k *ar)
1102 {
1103 	int ret = 0;
1104 
1105 	lockdep_assert_held(&ar->conf_mutex);
1106 
1107 	ret = ath10k_wmi_vdev_delete(ar, ar->monitor_vdev_id);
1108 	if (ret) {
1109 		ath10k_warn(ar, "failed to request wmi monitor vdev %i removal: %d\n",
1110 			    ar->monitor_vdev_id, ret);
1111 		return ret;
1112 	}
1113 
1114 	ar->free_vdev_map |= 1LL << ar->monitor_vdev_id;
1115 
1116 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac monitor vdev %d deleted\n",
1117 		   ar->monitor_vdev_id);
1118 	return ret;
1119 }
1120 
1121 static int ath10k_monitor_start(struct ath10k *ar)
1122 {
1123 	int ret;
1124 
1125 	lockdep_assert_held(&ar->conf_mutex);
1126 
1127 	ret = ath10k_monitor_vdev_create(ar);
1128 	if (ret) {
1129 		ath10k_warn(ar, "failed to create monitor vdev: %d\n", ret);
1130 		return ret;
1131 	}
1132 
1133 	ret = ath10k_monitor_vdev_start(ar, ar->monitor_vdev_id);
1134 	if (ret) {
1135 		ath10k_warn(ar, "failed to start monitor vdev: %d\n", ret);
1136 		ath10k_monitor_vdev_delete(ar);
1137 		return ret;
1138 	}
1139 
1140 	ar->monitor_started = true;
1141 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac monitor started\n");
1142 
1143 	return 0;
1144 }
1145 
1146 static int ath10k_monitor_stop(struct ath10k *ar)
1147 {
1148 	int ret;
1149 
1150 	lockdep_assert_held(&ar->conf_mutex);
1151 
1152 	ret = ath10k_monitor_vdev_stop(ar);
1153 	if (ret) {
1154 		ath10k_warn(ar, "failed to stop monitor vdev: %d\n", ret);
1155 		return ret;
1156 	}
1157 
1158 	ret = ath10k_monitor_vdev_delete(ar);
1159 	if (ret) {
1160 		ath10k_warn(ar, "failed to delete monitor vdev: %d\n", ret);
1161 		return ret;
1162 	}
1163 
1164 	ar->monitor_started = false;
1165 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac monitor stopped\n");
1166 
1167 	return 0;
1168 }
1169 
1170 static bool ath10k_mac_monitor_vdev_is_needed(struct ath10k *ar)
1171 {
1172 	int num_ctx;
1173 
1174 	/* At least one chanctx is required to derive a channel to start
1175 	 * monitor vdev on.
1176 	 */
1177 	num_ctx = ath10k_mac_num_chanctxs(ar);
1178 	if (num_ctx == 0)
1179 		return false;
1180 
1181 	/* If there's already an existing special monitor interface then don't
1182 	 * bother creating another monitor vdev.
1183 	 */
1184 	if (ar->monitor_arvif)
1185 		return false;
1186 
1187 	return ar->monitor ||
1188 	       (!test_bit(ATH10K_FW_FEATURE_ALLOWS_MESH_BCAST,
1189 			  ar->running_fw->fw_file.fw_features) &&
1190 		(ar->filter_flags & FIF_OTHER_BSS)) ||
1191 	       test_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
1192 }
1193 
1194 static bool ath10k_mac_monitor_vdev_is_allowed(struct ath10k *ar)
1195 {
1196 	int num_ctx;
1197 
1198 	num_ctx = ath10k_mac_num_chanctxs(ar);
1199 
1200 	/* FIXME: Current interface combinations and cfg80211/mac80211 code
1201 	 * shouldn't allow this but make sure to prevent handling the following
1202 	 * case anyway since multi-channel DFS hasn't been tested at all.
1203 	 */
1204 	if (test_bit(ATH10K_CAC_RUNNING, &ar->dev_flags) && num_ctx > 1)
1205 		return false;
1206 
1207 	return true;
1208 }
1209 
1210 static int ath10k_monitor_recalc(struct ath10k *ar)
1211 {
1212 	bool needed;
1213 	bool allowed;
1214 	int ret;
1215 
1216 	lockdep_assert_held(&ar->conf_mutex);
1217 
1218 	needed = ath10k_mac_monitor_vdev_is_needed(ar);
1219 	allowed = ath10k_mac_monitor_vdev_is_allowed(ar);
1220 
1221 	ath10k_dbg(ar, ATH10K_DBG_MAC,
1222 		   "mac monitor recalc started? %d needed? %d allowed? %d\n",
1223 		   ar->monitor_started, needed, allowed);
1224 
1225 	if (WARN_ON(needed && !allowed)) {
1226 		if (ar->monitor_started) {
1227 			ath10k_dbg(ar, ATH10K_DBG_MAC, "mac monitor stopping disallowed monitor\n");
1228 
1229 			ret = ath10k_monitor_stop(ar);
1230 			if (ret)
1231 				ath10k_warn(ar, "failed to stop disallowed monitor: %d\n",
1232 					    ret);
1233 				/* not serious */
1234 		}
1235 
1236 		return -EPERM;
1237 	}
1238 
1239 	if (needed == ar->monitor_started)
1240 		return 0;
1241 
1242 	if (needed)
1243 		return ath10k_monitor_start(ar);
1244 	else
1245 		return ath10k_monitor_stop(ar);
1246 }
1247 
1248 static bool ath10k_mac_can_set_cts_prot(struct ath10k_vif *arvif)
1249 {
1250 	struct ath10k *ar = arvif->ar;
1251 
1252 	lockdep_assert_held(&ar->conf_mutex);
1253 
1254 	if (!arvif->is_started) {
1255 		ath10k_dbg(ar, ATH10K_DBG_MAC, "defer cts setup, vdev is not ready yet\n");
1256 		return false;
1257 	}
1258 
1259 	return true;
1260 }
1261 
1262 static int ath10k_mac_set_cts_prot(struct ath10k_vif *arvif)
1263 {
1264 	struct ath10k *ar = arvif->ar;
1265 	u32 vdev_param;
1266 
1267 	lockdep_assert_held(&ar->conf_mutex);
1268 
1269 	vdev_param = ar->wmi.vdev_param->protection_mode;
1270 
1271 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d cts_protection %d\n",
1272 		   arvif->vdev_id, arvif->use_cts_prot);
1273 
1274 	return ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
1275 					 arvif->use_cts_prot ? 1 : 0);
1276 }
1277 
1278 static int ath10k_recalc_rtscts_prot(struct ath10k_vif *arvif)
1279 {
1280 	struct ath10k *ar = arvif->ar;
1281 	u32 vdev_param, rts_cts = 0;
1282 
1283 	lockdep_assert_held(&ar->conf_mutex);
1284 
1285 	vdev_param = ar->wmi.vdev_param->enable_rtscts;
1286 
1287 	rts_cts |= SM(WMI_RTSCTS_ENABLED, WMI_RTSCTS_SET);
1288 
1289 	if (arvif->num_legacy_stations > 0)
1290 		rts_cts |= SM(WMI_RTSCTS_ACROSS_SW_RETRIES,
1291 			      WMI_RTSCTS_PROFILE);
1292 	else
1293 		rts_cts |= SM(WMI_RTSCTS_FOR_SECOND_RATESERIES,
1294 			      WMI_RTSCTS_PROFILE);
1295 
1296 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d recalc rts/cts prot %d\n",
1297 		   arvif->vdev_id, rts_cts);
1298 
1299 	return ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
1300 					 rts_cts);
1301 }
1302 
1303 static int ath10k_start_cac(struct ath10k *ar)
1304 {
1305 	int ret;
1306 
1307 	lockdep_assert_held(&ar->conf_mutex);
1308 
1309 	set_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
1310 
1311 	ret = ath10k_monitor_recalc(ar);
1312 	if (ret) {
1313 		ath10k_warn(ar, "failed to start monitor (cac): %d\n", ret);
1314 		clear_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
1315 		return ret;
1316 	}
1317 
1318 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac cac start monitor vdev %d\n",
1319 		   ar->monitor_vdev_id);
1320 
1321 	return 0;
1322 }
1323 
1324 static int ath10k_stop_cac(struct ath10k *ar)
1325 {
1326 	lockdep_assert_held(&ar->conf_mutex);
1327 
1328 	/* CAC is not running - do nothing */
1329 	if (!test_bit(ATH10K_CAC_RUNNING, &ar->dev_flags))
1330 		return 0;
1331 
1332 	clear_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
1333 	ath10k_monitor_stop(ar);
1334 
1335 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac cac finished\n");
1336 
1337 	return 0;
1338 }
1339 
1340 static void ath10k_mac_has_radar_iter(struct ieee80211_hw *hw,
1341 				      struct ieee80211_chanctx_conf *conf,
1342 				      void *data)
1343 {
1344 	bool *ret = data;
1345 
1346 	if (!*ret && conf->radar_enabled)
1347 		*ret = true;
1348 }
1349 
1350 static bool ath10k_mac_has_radar_enabled(struct ath10k *ar)
1351 {
1352 	bool has_radar = false;
1353 
1354 	ieee80211_iter_chan_contexts_atomic(ar->hw,
1355 					    ath10k_mac_has_radar_iter,
1356 					    &has_radar);
1357 
1358 	return has_radar;
1359 }
1360 
1361 static void ath10k_recalc_radar_detection(struct ath10k *ar)
1362 {
1363 	int ret;
1364 
1365 	lockdep_assert_held(&ar->conf_mutex);
1366 
1367 	ath10k_stop_cac(ar);
1368 
1369 	if (!ath10k_mac_has_radar_enabled(ar))
1370 		return;
1371 
1372 	if (ar->num_started_vdevs > 0)
1373 		return;
1374 
1375 	ret = ath10k_start_cac(ar);
1376 	if (ret) {
1377 		/*
1378 		 * Not possible to start CAC on current channel so starting
1379 		 * radiation is not allowed, make this channel DFS_UNAVAILABLE
1380 		 * by indicating that radar was detected.
1381 		 */
1382 		ath10k_warn(ar, "failed to start CAC: %d\n", ret);
1383 		ieee80211_radar_detected(ar->hw);
1384 	}
1385 }
1386 
1387 static int ath10k_vdev_stop(struct ath10k_vif *arvif)
1388 {
1389 	struct ath10k *ar = arvif->ar;
1390 	int ret;
1391 
1392 	lockdep_assert_held(&ar->conf_mutex);
1393 
1394 	reinit_completion(&ar->vdev_setup_done);
1395 
1396 	ret = ath10k_wmi_vdev_stop(ar, arvif->vdev_id);
1397 	if (ret) {
1398 		ath10k_warn(ar, "failed to stop WMI vdev %i: %d\n",
1399 			    arvif->vdev_id, ret);
1400 		return ret;
1401 	}
1402 
1403 	ret = ath10k_vdev_setup_sync(ar);
1404 	if (ret) {
1405 		ath10k_warn(ar, "failed to synchronize setup for vdev %i: %d\n",
1406 			    arvif->vdev_id, ret);
1407 		return ret;
1408 	}
1409 
1410 	WARN_ON(ar->num_started_vdevs == 0);
1411 
1412 	if (ar->num_started_vdevs != 0) {
1413 		ar->num_started_vdevs--;
1414 		ath10k_recalc_radar_detection(ar);
1415 	}
1416 
1417 	return ret;
1418 }
1419 
1420 static int ath10k_vdev_start_restart(struct ath10k_vif *arvif,
1421 				     const struct cfg80211_chan_def *chandef,
1422 				     bool restart)
1423 {
1424 	struct ath10k *ar = arvif->ar;
1425 	struct wmi_vdev_start_request_arg arg = {};
1426 	int ret = 0;
1427 
1428 	lockdep_assert_held(&ar->conf_mutex);
1429 
1430 	reinit_completion(&ar->vdev_setup_done);
1431 
1432 	arg.vdev_id = arvif->vdev_id;
1433 	arg.dtim_period = arvif->dtim_period;
1434 	arg.bcn_intval = arvif->beacon_interval;
1435 
1436 	arg.channel.freq = chandef->chan->center_freq;
1437 	arg.channel.band_center_freq1 = chandef->center_freq1;
1438 	arg.channel.band_center_freq2 = chandef->center_freq2;
1439 	arg.channel.mode = chan_to_phymode(chandef);
1440 
1441 	arg.channel.min_power = 0;
1442 	arg.channel.max_power = chandef->chan->max_power * 2;
1443 	arg.channel.max_reg_power = chandef->chan->max_reg_power * 2;
1444 	arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain * 2;
1445 
1446 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
1447 		arg.ssid = arvif->u.ap.ssid;
1448 		arg.ssid_len = arvif->u.ap.ssid_len;
1449 		arg.hidden_ssid = arvif->u.ap.hidden_ssid;
1450 
1451 		/* For now allow DFS for AP mode */
1452 		arg.channel.chan_radar =
1453 			!!(chandef->chan->flags & IEEE80211_CHAN_RADAR);
1454 	} else if (arvif->vdev_type == WMI_VDEV_TYPE_IBSS) {
1455 		arg.ssid = arvif->vif->bss_conf.ssid;
1456 		arg.ssid_len = arvif->vif->bss_conf.ssid_len;
1457 	}
1458 
1459 	ath10k_dbg(ar, ATH10K_DBG_MAC,
1460 		   "mac vdev %d start center_freq %d phymode %s\n",
1461 		   arg.vdev_id, arg.channel.freq,
1462 		   ath10k_wmi_phymode_str(arg.channel.mode));
1463 
1464 	if (restart)
1465 		ret = ath10k_wmi_vdev_restart(ar, &arg);
1466 	else
1467 		ret = ath10k_wmi_vdev_start(ar, &arg);
1468 
1469 	if (ret) {
1470 		ath10k_warn(ar, "failed to start WMI vdev %i: %d\n",
1471 			    arg.vdev_id, ret);
1472 		return ret;
1473 	}
1474 
1475 	ret = ath10k_vdev_setup_sync(ar);
1476 	if (ret) {
1477 		ath10k_warn(ar,
1478 			    "failed to synchronize setup for vdev %i restart %d: %d\n",
1479 			    arg.vdev_id, restart, ret);
1480 		return ret;
1481 	}
1482 
1483 	ar->num_started_vdevs++;
1484 	ath10k_recalc_radar_detection(ar);
1485 
1486 	return ret;
1487 }
1488 
1489 static int ath10k_vdev_start(struct ath10k_vif *arvif,
1490 			     const struct cfg80211_chan_def *def)
1491 {
1492 	return ath10k_vdev_start_restart(arvif, def, false);
1493 }
1494 
1495 static int ath10k_vdev_restart(struct ath10k_vif *arvif,
1496 			       const struct cfg80211_chan_def *def)
1497 {
1498 	return ath10k_vdev_start_restart(arvif, def, true);
1499 }
1500 
1501 static int ath10k_mac_setup_bcn_p2p_ie(struct ath10k_vif *arvif,
1502 				       struct sk_buff *bcn)
1503 {
1504 	struct ath10k *ar = arvif->ar;
1505 	struct ieee80211_mgmt *mgmt;
1506 	const u8 *p2p_ie;
1507 	int ret;
1508 
1509 	if (arvif->vif->type != NL80211_IFTYPE_AP || !arvif->vif->p2p)
1510 		return 0;
1511 
1512 	mgmt = (void *)bcn->data;
1513 	p2p_ie = cfg80211_find_vendor_ie(WLAN_OUI_WFA, WLAN_OUI_TYPE_WFA_P2P,
1514 					 mgmt->u.beacon.variable,
1515 					 bcn->len - (mgmt->u.beacon.variable -
1516 						     bcn->data));
1517 	if (!p2p_ie)
1518 		return -ENOENT;
1519 
1520 	ret = ath10k_wmi_p2p_go_bcn_ie(ar, arvif->vdev_id, p2p_ie);
1521 	if (ret) {
1522 		ath10k_warn(ar, "failed to submit p2p go bcn ie for vdev %i: %d\n",
1523 			    arvif->vdev_id, ret);
1524 		return ret;
1525 	}
1526 
1527 	return 0;
1528 }
1529 
1530 static int ath10k_mac_remove_vendor_ie(struct sk_buff *skb, unsigned int oui,
1531 				       u8 oui_type, size_t ie_offset)
1532 {
1533 	size_t len;
1534 	const u8 *next;
1535 	const u8 *end;
1536 	u8 *ie;
1537 
1538 	if (WARN_ON(skb->len < ie_offset))
1539 		return -EINVAL;
1540 
1541 	ie = (u8 *)cfg80211_find_vendor_ie(oui, oui_type,
1542 					   skb->data + ie_offset,
1543 					   skb->len - ie_offset);
1544 	if (!ie)
1545 		return -ENOENT;
1546 
1547 	len = ie[1] + 2;
1548 	end = skb->data + skb->len;
1549 	next = ie + len;
1550 
1551 	if (WARN_ON(next > end))
1552 		return -EINVAL;
1553 
1554 	memmove(ie, next, end - next);
1555 	skb_trim(skb, skb->len - len);
1556 
1557 	return 0;
1558 }
1559 
1560 static int ath10k_mac_setup_bcn_tmpl(struct ath10k_vif *arvif)
1561 {
1562 	struct ath10k *ar = arvif->ar;
1563 	struct ieee80211_hw *hw = ar->hw;
1564 	struct ieee80211_vif *vif = arvif->vif;
1565 	struct ieee80211_mutable_offsets offs = {};
1566 	struct sk_buff *bcn;
1567 	int ret;
1568 
1569 	if (!test_bit(WMI_SERVICE_BEACON_OFFLOAD, ar->wmi.svc_map))
1570 		return 0;
1571 
1572 	if (arvif->vdev_type != WMI_VDEV_TYPE_AP &&
1573 	    arvif->vdev_type != WMI_VDEV_TYPE_IBSS)
1574 		return 0;
1575 
1576 	bcn = ieee80211_beacon_get_template(hw, vif, &offs);
1577 	if (!bcn) {
1578 		ath10k_warn(ar, "failed to get beacon template from mac80211\n");
1579 		return -EPERM;
1580 	}
1581 
1582 	ret = ath10k_mac_setup_bcn_p2p_ie(arvif, bcn);
1583 	if (ret) {
1584 		ath10k_warn(ar, "failed to setup p2p go bcn ie: %d\n", ret);
1585 		kfree_skb(bcn);
1586 		return ret;
1587 	}
1588 
1589 	/* P2P IE is inserted by firmware automatically (as configured above)
1590 	 * so remove it from the base beacon template to avoid duplicate P2P
1591 	 * IEs in beacon frames.
1592 	 */
1593 	ath10k_mac_remove_vendor_ie(bcn, WLAN_OUI_WFA, WLAN_OUI_TYPE_WFA_P2P,
1594 				    offsetof(struct ieee80211_mgmt,
1595 					     u.beacon.variable));
1596 
1597 	ret = ath10k_wmi_bcn_tmpl(ar, arvif->vdev_id, offs.tim_offset, bcn, 0,
1598 				  0, NULL, 0);
1599 	kfree_skb(bcn);
1600 
1601 	if (ret) {
1602 		ath10k_warn(ar, "failed to submit beacon template command: %d\n",
1603 			    ret);
1604 		return ret;
1605 	}
1606 
1607 	return 0;
1608 }
1609 
1610 static int ath10k_mac_setup_prb_tmpl(struct ath10k_vif *arvif)
1611 {
1612 	struct ath10k *ar = arvif->ar;
1613 	struct ieee80211_hw *hw = ar->hw;
1614 	struct ieee80211_vif *vif = arvif->vif;
1615 	struct sk_buff *prb;
1616 	int ret;
1617 
1618 	if (!test_bit(WMI_SERVICE_BEACON_OFFLOAD, ar->wmi.svc_map))
1619 		return 0;
1620 
1621 	if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
1622 		return 0;
1623 
1624 	prb = ieee80211_proberesp_get(hw, vif);
1625 	if (!prb) {
1626 		ath10k_warn(ar, "failed to get probe resp template from mac80211\n");
1627 		return -EPERM;
1628 	}
1629 
1630 	ret = ath10k_wmi_prb_tmpl(ar, arvif->vdev_id, prb);
1631 	kfree_skb(prb);
1632 
1633 	if (ret) {
1634 		ath10k_warn(ar, "failed to submit probe resp template command: %d\n",
1635 			    ret);
1636 		return ret;
1637 	}
1638 
1639 	return 0;
1640 }
1641 
1642 static int ath10k_mac_vif_fix_hidden_ssid(struct ath10k_vif *arvif)
1643 {
1644 	struct ath10k *ar = arvif->ar;
1645 	struct cfg80211_chan_def def;
1646 	int ret;
1647 
1648 	/* When originally vdev is started during assign_vif_chanctx() some
1649 	 * information is missing, notably SSID. Firmware revisions with beacon
1650 	 * offloading require the SSID to be provided during vdev (re)start to
1651 	 * handle hidden SSID properly.
1652 	 *
1653 	 * Vdev restart must be done after vdev has been both started and
1654 	 * upped. Otherwise some firmware revisions (at least 10.2) fail to
1655 	 * deliver vdev restart response event causing timeouts during vdev
1656 	 * syncing in ath10k.
1657 	 *
1658 	 * Note: The vdev down/up and template reinstallation could be skipped
1659 	 * since only wmi-tlv firmware are known to have beacon offload and
1660 	 * wmi-tlv doesn't seem to misbehave like 10.2 wrt vdev restart
1661 	 * response delivery. It's probably more robust to keep it as is.
1662 	 */
1663 	if (!test_bit(WMI_SERVICE_BEACON_OFFLOAD, ar->wmi.svc_map))
1664 		return 0;
1665 
1666 	if (WARN_ON(!arvif->is_started))
1667 		return -EINVAL;
1668 
1669 	if (WARN_ON(!arvif->is_up))
1670 		return -EINVAL;
1671 
1672 	if (WARN_ON(ath10k_mac_vif_chan(arvif->vif, &def)))
1673 		return -EINVAL;
1674 
1675 	ret = ath10k_wmi_vdev_down(ar, arvif->vdev_id);
1676 	if (ret) {
1677 		ath10k_warn(ar, "failed to bring down ap vdev %i: %d\n",
1678 			    arvif->vdev_id, ret);
1679 		return ret;
1680 	}
1681 
1682 	/* Vdev down reset beacon & presp templates. Reinstall them. Otherwise
1683 	 * firmware will crash upon vdev up.
1684 	 */
1685 
1686 	ret = ath10k_mac_setup_bcn_tmpl(arvif);
1687 	if (ret) {
1688 		ath10k_warn(ar, "failed to update beacon template: %d\n", ret);
1689 		return ret;
1690 	}
1691 
1692 	ret = ath10k_mac_setup_prb_tmpl(arvif);
1693 	if (ret) {
1694 		ath10k_warn(ar, "failed to update presp template: %d\n", ret);
1695 		return ret;
1696 	}
1697 
1698 	ret = ath10k_vdev_restart(arvif, &def);
1699 	if (ret) {
1700 		ath10k_warn(ar, "failed to restart ap vdev %i: %d\n",
1701 			    arvif->vdev_id, ret);
1702 		return ret;
1703 	}
1704 
1705 	ret = ath10k_wmi_vdev_up(arvif->ar, arvif->vdev_id, arvif->aid,
1706 				 arvif->bssid);
1707 	if (ret) {
1708 		ath10k_warn(ar, "failed to bring up ap vdev %i: %d\n",
1709 			    arvif->vdev_id, ret);
1710 		return ret;
1711 	}
1712 
1713 	return 0;
1714 }
1715 
1716 static void ath10k_control_beaconing(struct ath10k_vif *arvif,
1717 				     struct ieee80211_bss_conf *info)
1718 {
1719 	struct ath10k *ar = arvif->ar;
1720 	int ret = 0;
1721 
1722 	lockdep_assert_held(&arvif->ar->conf_mutex);
1723 
1724 	if (!info->enable_beacon) {
1725 		ret = ath10k_wmi_vdev_down(ar, arvif->vdev_id);
1726 		if (ret)
1727 			ath10k_warn(ar, "failed to down vdev_id %i: %d\n",
1728 				    arvif->vdev_id, ret);
1729 
1730 		arvif->is_up = false;
1731 
1732 		spin_lock_bh(&arvif->ar->data_lock);
1733 		ath10k_mac_vif_beacon_free(arvif);
1734 		spin_unlock_bh(&arvif->ar->data_lock);
1735 
1736 		return;
1737 	}
1738 
1739 	arvif->tx_seq_no = 0x1000;
1740 
1741 	arvif->aid = 0;
1742 	ether_addr_copy(arvif->bssid, info->bssid);
1743 
1744 	ret = ath10k_wmi_vdev_up(arvif->ar, arvif->vdev_id, arvif->aid,
1745 				 arvif->bssid);
1746 	if (ret) {
1747 		ath10k_warn(ar, "failed to bring up vdev %d: %i\n",
1748 			    arvif->vdev_id, ret);
1749 		return;
1750 	}
1751 
1752 	arvif->is_up = true;
1753 
1754 	ret = ath10k_mac_vif_fix_hidden_ssid(arvif);
1755 	if (ret) {
1756 		ath10k_warn(ar, "failed to fix hidden ssid for vdev %i, expect trouble: %d\n",
1757 			    arvif->vdev_id, ret);
1758 		return;
1759 	}
1760 
1761 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d up\n", arvif->vdev_id);
1762 }
1763 
1764 static void ath10k_control_ibss(struct ath10k_vif *arvif,
1765 				struct ieee80211_bss_conf *info,
1766 				const u8 self_peer[ETH_ALEN])
1767 {
1768 	struct ath10k *ar = arvif->ar;
1769 	u32 vdev_param;
1770 	int ret = 0;
1771 
1772 	lockdep_assert_held(&arvif->ar->conf_mutex);
1773 
1774 	if (!info->ibss_joined) {
1775 		if (is_zero_ether_addr(arvif->bssid))
1776 			return;
1777 
1778 		eth_zero_addr(arvif->bssid);
1779 
1780 		return;
1781 	}
1782 
1783 	vdev_param = arvif->ar->wmi.vdev_param->atim_window;
1784 	ret = ath10k_wmi_vdev_set_param(arvif->ar, arvif->vdev_id, vdev_param,
1785 					ATH10K_DEFAULT_ATIM);
1786 	if (ret)
1787 		ath10k_warn(ar, "failed to set IBSS ATIM for vdev %d: %d\n",
1788 			    arvif->vdev_id, ret);
1789 }
1790 
1791 static int ath10k_mac_vif_recalc_ps_wake_threshold(struct ath10k_vif *arvif)
1792 {
1793 	struct ath10k *ar = arvif->ar;
1794 	u32 param;
1795 	u32 value;
1796 	int ret;
1797 
1798 	lockdep_assert_held(&arvif->ar->conf_mutex);
1799 
1800 	if (arvif->u.sta.uapsd)
1801 		value = WMI_STA_PS_TX_WAKE_THRESHOLD_NEVER;
1802 	else
1803 		value = WMI_STA_PS_TX_WAKE_THRESHOLD_ALWAYS;
1804 
1805 	param = WMI_STA_PS_PARAM_TX_WAKE_THRESHOLD;
1806 	ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id, param, value);
1807 	if (ret) {
1808 		ath10k_warn(ar, "failed to submit ps wake threshold %u on vdev %i: %d\n",
1809 			    value, arvif->vdev_id, ret);
1810 		return ret;
1811 	}
1812 
1813 	return 0;
1814 }
1815 
1816 static int ath10k_mac_vif_recalc_ps_poll_count(struct ath10k_vif *arvif)
1817 {
1818 	struct ath10k *ar = arvif->ar;
1819 	u32 param;
1820 	u32 value;
1821 	int ret;
1822 
1823 	lockdep_assert_held(&arvif->ar->conf_mutex);
1824 
1825 	if (arvif->u.sta.uapsd)
1826 		value = WMI_STA_PS_PSPOLL_COUNT_UAPSD;
1827 	else
1828 		value = WMI_STA_PS_PSPOLL_COUNT_NO_MAX;
1829 
1830 	param = WMI_STA_PS_PARAM_PSPOLL_COUNT;
1831 	ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
1832 					  param, value);
1833 	if (ret) {
1834 		ath10k_warn(ar, "failed to submit ps poll count %u on vdev %i: %d\n",
1835 			    value, arvif->vdev_id, ret);
1836 		return ret;
1837 	}
1838 
1839 	return 0;
1840 }
1841 
1842 static int ath10k_mac_num_vifs_started(struct ath10k *ar)
1843 {
1844 	struct ath10k_vif *arvif;
1845 	int num = 0;
1846 
1847 	lockdep_assert_held(&ar->conf_mutex);
1848 
1849 	list_for_each_entry(arvif, &ar->arvifs, list)
1850 		if (arvif->is_started)
1851 			num++;
1852 
1853 	return num;
1854 }
1855 
1856 static int ath10k_mac_vif_setup_ps(struct ath10k_vif *arvif)
1857 {
1858 	struct ath10k *ar = arvif->ar;
1859 	struct ieee80211_vif *vif = arvif->vif;
1860 	struct ieee80211_conf *conf = &ar->hw->conf;
1861 	enum wmi_sta_powersave_param param;
1862 	enum wmi_sta_ps_mode psmode;
1863 	int ret;
1864 	int ps_timeout;
1865 	bool enable_ps;
1866 
1867 	lockdep_assert_held(&arvif->ar->conf_mutex);
1868 
1869 	if (arvif->vif->type != NL80211_IFTYPE_STATION)
1870 		return 0;
1871 
1872 	enable_ps = arvif->ps;
1873 
1874 	if (enable_ps && ath10k_mac_num_vifs_started(ar) > 1 &&
1875 	    !test_bit(ATH10K_FW_FEATURE_MULTI_VIF_PS_SUPPORT,
1876 		      ar->running_fw->fw_file.fw_features)) {
1877 		ath10k_warn(ar, "refusing to enable ps on vdev %i: not supported by fw\n",
1878 			    arvif->vdev_id);
1879 		enable_ps = false;
1880 	}
1881 
1882 	if (!arvif->is_started) {
1883 		/* mac80211 can update vif powersave state while disconnected.
1884 		 * Firmware doesn't behave nicely and consumes more power than
1885 		 * necessary if PS is disabled on a non-started vdev. Hence
1886 		 * force-enable PS for non-running vdevs.
1887 		 */
1888 		psmode = WMI_STA_PS_MODE_ENABLED;
1889 	} else if (enable_ps) {
1890 		psmode = WMI_STA_PS_MODE_ENABLED;
1891 		param = WMI_STA_PS_PARAM_INACTIVITY_TIME;
1892 
1893 		ps_timeout = conf->dynamic_ps_timeout;
1894 		if (ps_timeout == 0) {
1895 			/* Firmware doesn't like 0 */
1896 			ps_timeout = ieee80211_tu_to_usec(
1897 				vif->bss_conf.beacon_int) / 1000;
1898 		}
1899 
1900 		ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id, param,
1901 						  ps_timeout);
1902 		if (ret) {
1903 			ath10k_warn(ar, "failed to set inactivity time for vdev %d: %i\n",
1904 				    arvif->vdev_id, ret);
1905 			return ret;
1906 		}
1907 	} else {
1908 		psmode = WMI_STA_PS_MODE_DISABLED;
1909 	}
1910 
1911 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d psmode %s\n",
1912 		   arvif->vdev_id, psmode ? "enable" : "disable");
1913 
1914 	ret = ath10k_wmi_set_psmode(ar, arvif->vdev_id, psmode);
1915 	if (ret) {
1916 		ath10k_warn(ar, "failed to set PS Mode %d for vdev %d: %d\n",
1917 			    psmode, arvif->vdev_id, ret);
1918 		return ret;
1919 	}
1920 
1921 	return 0;
1922 }
1923 
1924 static int ath10k_mac_vif_disable_keepalive(struct ath10k_vif *arvif)
1925 {
1926 	struct ath10k *ar = arvif->ar;
1927 	struct wmi_sta_keepalive_arg arg = {};
1928 	int ret;
1929 
1930 	lockdep_assert_held(&arvif->ar->conf_mutex);
1931 
1932 	if (arvif->vdev_type != WMI_VDEV_TYPE_STA)
1933 		return 0;
1934 
1935 	if (!test_bit(WMI_SERVICE_STA_KEEP_ALIVE, ar->wmi.svc_map))
1936 		return 0;
1937 
1938 	/* Some firmware revisions have a bug and ignore the `enabled` field.
1939 	 * Instead use the interval to disable the keepalive.
1940 	 */
1941 	arg.vdev_id = arvif->vdev_id;
1942 	arg.enabled = 1;
1943 	arg.method = WMI_STA_KEEPALIVE_METHOD_NULL_FRAME;
1944 	arg.interval = WMI_STA_KEEPALIVE_INTERVAL_DISABLE;
1945 
1946 	ret = ath10k_wmi_sta_keepalive(ar, &arg);
1947 	if (ret) {
1948 		ath10k_warn(ar, "failed to submit keepalive on vdev %i: %d\n",
1949 			    arvif->vdev_id, ret);
1950 		return ret;
1951 	}
1952 
1953 	return 0;
1954 }
1955 
1956 static void ath10k_mac_vif_ap_csa_count_down(struct ath10k_vif *arvif)
1957 {
1958 	struct ath10k *ar = arvif->ar;
1959 	struct ieee80211_vif *vif = arvif->vif;
1960 	int ret;
1961 
1962 	lockdep_assert_held(&arvif->ar->conf_mutex);
1963 
1964 	if (WARN_ON(!test_bit(WMI_SERVICE_BEACON_OFFLOAD, ar->wmi.svc_map)))
1965 		return;
1966 
1967 	if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
1968 		return;
1969 
1970 	if (!vif->csa_active)
1971 		return;
1972 
1973 	if (!arvif->is_up)
1974 		return;
1975 
1976 	if (!ieee80211_csa_is_complete(vif)) {
1977 		ieee80211_csa_update_counter(vif);
1978 
1979 		ret = ath10k_mac_setup_bcn_tmpl(arvif);
1980 		if (ret)
1981 			ath10k_warn(ar, "failed to update bcn tmpl during csa: %d\n",
1982 				    ret);
1983 
1984 		ret = ath10k_mac_setup_prb_tmpl(arvif);
1985 		if (ret)
1986 			ath10k_warn(ar, "failed to update prb tmpl during csa: %d\n",
1987 				    ret);
1988 	} else {
1989 		ieee80211_csa_finish(vif);
1990 	}
1991 }
1992 
1993 static void ath10k_mac_vif_ap_csa_work(struct work_struct *work)
1994 {
1995 	struct ath10k_vif *arvif = container_of(work, struct ath10k_vif,
1996 						ap_csa_work);
1997 	struct ath10k *ar = arvif->ar;
1998 
1999 	mutex_lock(&ar->conf_mutex);
2000 	ath10k_mac_vif_ap_csa_count_down(arvif);
2001 	mutex_unlock(&ar->conf_mutex);
2002 }
2003 
2004 static void ath10k_mac_handle_beacon_iter(void *data, u8 *mac,
2005 					  struct ieee80211_vif *vif)
2006 {
2007 	struct sk_buff *skb = data;
2008 	struct ieee80211_mgmt *mgmt = (void *)skb->data;
2009 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
2010 
2011 	if (vif->type != NL80211_IFTYPE_STATION)
2012 		return;
2013 
2014 	if (!ether_addr_equal(mgmt->bssid, vif->bss_conf.bssid))
2015 		return;
2016 
2017 	cancel_delayed_work(&arvif->connection_loss_work);
2018 }
2019 
2020 void ath10k_mac_handle_beacon(struct ath10k *ar, struct sk_buff *skb)
2021 {
2022 	ieee80211_iterate_active_interfaces_atomic(ar->hw,
2023 						   IEEE80211_IFACE_ITER_NORMAL,
2024 						   ath10k_mac_handle_beacon_iter,
2025 						   skb);
2026 }
2027 
2028 static void ath10k_mac_handle_beacon_miss_iter(void *data, u8 *mac,
2029 					       struct ieee80211_vif *vif)
2030 {
2031 	u32 *vdev_id = data;
2032 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
2033 	struct ath10k *ar = arvif->ar;
2034 	struct ieee80211_hw *hw = ar->hw;
2035 
2036 	if (arvif->vdev_id != *vdev_id)
2037 		return;
2038 
2039 	if (!arvif->is_up)
2040 		return;
2041 
2042 	ieee80211_beacon_loss(vif);
2043 
2044 	/* Firmware doesn't report beacon loss events repeatedly. If AP probe
2045 	 * (done by mac80211) succeeds but beacons do not resume then it
2046 	 * doesn't make sense to continue operation. Queue connection loss work
2047 	 * which can be cancelled when beacon is received.
2048 	 */
2049 	ieee80211_queue_delayed_work(hw, &arvif->connection_loss_work,
2050 				     ATH10K_CONNECTION_LOSS_HZ);
2051 }
2052 
2053 void ath10k_mac_handle_beacon_miss(struct ath10k *ar, u32 vdev_id)
2054 {
2055 	ieee80211_iterate_active_interfaces_atomic(ar->hw,
2056 						   IEEE80211_IFACE_ITER_NORMAL,
2057 						   ath10k_mac_handle_beacon_miss_iter,
2058 						   &vdev_id);
2059 }
2060 
2061 static void ath10k_mac_vif_sta_connection_loss_work(struct work_struct *work)
2062 {
2063 	struct ath10k_vif *arvif = container_of(work, struct ath10k_vif,
2064 						connection_loss_work.work);
2065 	struct ieee80211_vif *vif = arvif->vif;
2066 
2067 	if (!arvif->is_up)
2068 		return;
2069 
2070 	ieee80211_connection_loss(vif);
2071 }
2072 
2073 /**********************/
2074 /* Station management */
2075 /**********************/
2076 
2077 static u32 ath10k_peer_assoc_h_listen_intval(struct ath10k *ar,
2078 					     struct ieee80211_vif *vif)
2079 {
2080 	/* Some firmware revisions have unstable STA powersave when listen
2081 	 * interval is set too high (e.g. 5). The symptoms are firmware doesn't
2082 	 * generate NullFunc frames properly even if buffered frames have been
2083 	 * indicated in Beacon TIM. Firmware would seldom wake up to pull
2084 	 * buffered frames. Often pinging the device from AP would simply fail.
2085 	 *
2086 	 * As a workaround set it to 1.
2087 	 */
2088 	if (vif->type == NL80211_IFTYPE_STATION)
2089 		return 1;
2090 
2091 	return ar->hw->conf.listen_interval;
2092 }
2093 
2094 static void ath10k_peer_assoc_h_basic(struct ath10k *ar,
2095 				      struct ieee80211_vif *vif,
2096 				      struct ieee80211_sta *sta,
2097 				      struct wmi_peer_assoc_complete_arg *arg)
2098 {
2099 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
2100 	u32 aid;
2101 
2102 	lockdep_assert_held(&ar->conf_mutex);
2103 
2104 	if (vif->type == NL80211_IFTYPE_STATION)
2105 		aid = vif->bss_conf.aid;
2106 	else
2107 		aid = sta->aid;
2108 
2109 	ether_addr_copy(arg->addr, sta->addr);
2110 	arg->vdev_id = arvif->vdev_id;
2111 	arg->peer_aid = aid;
2112 	arg->peer_flags |= arvif->ar->wmi.peer_flags->auth;
2113 	arg->peer_listen_intval = ath10k_peer_assoc_h_listen_intval(ar, vif);
2114 	arg->peer_num_spatial_streams = 1;
2115 	arg->peer_caps = vif->bss_conf.assoc_capability;
2116 }
2117 
2118 static void ath10k_peer_assoc_h_crypto(struct ath10k *ar,
2119 				       struct ieee80211_vif *vif,
2120 				       struct ieee80211_sta *sta,
2121 				       struct wmi_peer_assoc_complete_arg *arg)
2122 {
2123 	struct ieee80211_bss_conf *info = &vif->bss_conf;
2124 	struct cfg80211_chan_def def;
2125 	struct cfg80211_bss *bss;
2126 	const u8 *rsnie = NULL;
2127 	const u8 *wpaie = NULL;
2128 
2129 	lockdep_assert_held(&ar->conf_mutex);
2130 
2131 	if (WARN_ON(ath10k_mac_vif_chan(vif, &def)))
2132 		return;
2133 
2134 	bss = cfg80211_get_bss(ar->hw->wiphy, def.chan, info->bssid, NULL, 0,
2135 			       IEEE80211_BSS_TYPE_ANY, IEEE80211_PRIVACY_ANY);
2136 	if (bss) {
2137 		const struct cfg80211_bss_ies *ies;
2138 
2139 		rcu_read_lock();
2140 		rsnie = ieee80211_bss_get_ie(bss, WLAN_EID_RSN);
2141 
2142 		ies = rcu_dereference(bss->ies);
2143 
2144 		wpaie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
2145 						WLAN_OUI_TYPE_MICROSOFT_WPA,
2146 						ies->data,
2147 						ies->len);
2148 		rcu_read_unlock();
2149 		cfg80211_put_bss(ar->hw->wiphy, bss);
2150 	}
2151 
2152 	/* FIXME: base on RSN IE/WPA IE is a correct idea? */
2153 	if (rsnie || wpaie) {
2154 		ath10k_dbg(ar, ATH10K_DBG_WMI, "%s: rsn ie found\n", __func__);
2155 		arg->peer_flags |= ar->wmi.peer_flags->need_ptk_4_way;
2156 	}
2157 
2158 	if (wpaie) {
2159 		ath10k_dbg(ar, ATH10K_DBG_WMI, "%s: wpa ie found\n", __func__);
2160 		arg->peer_flags |= ar->wmi.peer_flags->need_gtk_2_way;
2161 	}
2162 
2163 	if (sta->mfp &&
2164 	    test_bit(ATH10K_FW_FEATURE_MFP_SUPPORT,
2165 		     ar->running_fw->fw_file.fw_features)) {
2166 		arg->peer_flags |= ar->wmi.peer_flags->pmf;
2167 	}
2168 }
2169 
2170 static void ath10k_peer_assoc_h_rates(struct ath10k *ar,
2171 				      struct ieee80211_vif *vif,
2172 				      struct ieee80211_sta *sta,
2173 				      struct wmi_peer_assoc_complete_arg *arg)
2174 {
2175 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
2176 	struct wmi_rate_set_arg *rateset = &arg->peer_legacy_rates;
2177 	struct cfg80211_chan_def def;
2178 	const struct ieee80211_supported_band *sband;
2179 	const struct ieee80211_rate *rates;
2180 	enum nl80211_band band;
2181 	u32 ratemask;
2182 	u8 rate;
2183 	int i;
2184 
2185 	lockdep_assert_held(&ar->conf_mutex);
2186 
2187 	if (WARN_ON(ath10k_mac_vif_chan(vif, &def)))
2188 		return;
2189 
2190 	band = def.chan->band;
2191 	sband = ar->hw->wiphy->bands[band];
2192 	ratemask = sta->supp_rates[band];
2193 	ratemask &= arvif->bitrate_mask.control[band].legacy;
2194 	rates = sband->bitrates;
2195 
2196 	rateset->num_rates = 0;
2197 
2198 	for (i = 0; i < 32; i++, ratemask >>= 1, rates++) {
2199 		if (!(ratemask & 1))
2200 			continue;
2201 
2202 		rate = ath10k_mac_bitrate_to_rate(rates->bitrate);
2203 		rateset->rates[rateset->num_rates] = rate;
2204 		rateset->num_rates++;
2205 	}
2206 }
2207 
2208 static bool
2209 ath10k_peer_assoc_h_ht_masked(const u8 ht_mcs_mask[IEEE80211_HT_MCS_MASK_LEN])
2210 {
2211 	int nss;
2212 
2213 	for (nss = 0; nss < IEEE80211_HT_MCS_MASK_LEN; nss++)
2214 		if (ht_mcs_mask[nss])
2215 			return false;
2216 
2217 	return true;
2218 }
2219 
2220 static bool
2221 ath10k_peer_assoc_h_vht_masked(const u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
2222 {
2223 	int nss;
2224 
2225 	for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++)
2226 		if (vht_mcs_mask[nss])
2227 			return false;
2228 
2229 	return true;
2230 }
2231 
2232 static void ath10k_peer_assoc_h_ht(struct ath10k *ar,
2233 				   struct ieee80211_vif *vif,
2234 				   struct ieee80211_sta *sta,
2235 				   struct wmi_peer_assoc_complete_arg *arg)
2236 {
2237 	const struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
2238 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
2239 	struct cfg80211_chan_def def;
2240 	enum nl80211_band band;
2241 	const u8 *ht_mcs_mask;
2242 	const u16 *vht_mcs_mask;
2243 	int i, n;
2244 	u8 max_nss;
2245 	u32 stbc;
2246 
2247 	lockdep_assert_held(&ar->conf_mutex);
2248 
2249 	if (WARN_ON(ath10k_mac_vif_chan(vif, &def)))
2250 		return;
2251 
2252 	if (!ht_cap->ht_supported)
2253 		return;
2254 
2255 	band = def.chan->band;
2256 	ht_mcs_mask = arvif->bitrate_mask.control[band].ht_mcs;
2257 	vht_mcs_mask = arvif->bitrate_mask.control[band].vht_mcs;
2258 
2259 	if (ath10k_peer_assoc_h_ht_masked(ht_mcs_mask) &&
2260 	    ath10k_peer_assoc_h_vht_masked(vht_mcs_mask))
2261 		return;
2262 
2263 	arg->peer_flags |= ar->wmi.peer_flags->ht;
2264 	arg->peer_max_mpdu = (1 << (IEEE80211_HT_MAX_AMPDU_FACTOR +
2265 				    ht_cap->ampdu_factor)) - 1;
2266 
2267 	arg->peer_mpdu_density =
2268 		ath10k_parse_mpdudensity(ht_cap->ampdu_density);
2269 
2270 	arg->peer_ht_caps = ht_cap->cap;
2271 	arg->peer_rate_caps |= WMI_RC_HT_FLAG;
2272 
2273 	if (ht_cap->cap & IEEE80211_HT_CAP_LDPC_CODING)
2274 		arg->peer_flags |= ar->wmi.peer_flags->ldbc;
2275 
2276 	if (sta->bandwidth >= IEEE80211_STA_RX_BW_40) {
2277 		arg->peer_flags |= ar->wmi.peer_flags->bw40;
2278 		arg->peer_rate_caps |= WMI_RC_CW40_FLAG;
2279 	}
2280 
2281 	if (arvif->bitrate_mask.control[band].gi != NL80211_TXRATE_FORCE_LGI) {
2282 		if (ht_cap->cap & IEEE80211_HT_CAP_SGI_20)
2283 			arg->peer_rate_caps |= WMI_RC_SGI_FLAG;
2284 
2285 		if (ht_cap->cap & IEEE80211_HT_CAP_SGI_40)
2286 			arg->peer_rate_caps |= WMI_RC_SGI_FLAG;
2287 	}
2288 
2289 	if (ht_cap->cap & IEEE80211_HT_CAP_TX_STBC) {
2290 		arg->peer_rate_caps |= WMI_RC_TX_STBC_FLAG;
2291 		arg->peer_flags |= ar->wmi.peer_flags->stbc;
2292 	}
2293 
2294 	if (ht_cap->cap & IEEE80211_HT_CAP_RX_STBC) {
2295 		stbc = ht_cap->cap & IEEE80211_HT_CAP_RX_STBC;
2296 		stbc = stbc >> IEEE80211_HT_CAP_RX_STBC_SHIFT;
2297 		stbc = stbc << WMI_RC_RX_STBC_FLAG_S;
2298 		arg->peer_rate_caps |= stbc;
2299 		arg->peer_flags |= ar->wmi.peer_flags->stbc;
2300 	}
2301 
2302 	if (ht_cap->mcs.rx_mask[1] && ht_cap->mcs.rx_mask[2])
2303 		arg->peer_rate_caps |= WMI_RC_TS_FLAG;
2304 	else if (ht_cap->mcs.rx_mask[1])
2305 		arg->peer_rate_caps |= WMI_RC_DS_FLAG;
2306 
2307 	for (i = 0, n = 0, max_nss = 0; i < IEEE80211_HT_MCS_MASK_LEN * 8; i++)
2308 		if ((ht_cap->mcs.rx_mask[i / 8] & BIT(i % 8)) &&
2309 		    (ht_mcs_mask[i / 8] & BIT(i % 8))) {
2310 			max_nss = (i / 8) + 1;
2311 			arg->peer_ht_rates.rates[n++] = i;
2312 		}
2313 
2314 	/*
2315 	 * This is a workaround for HT-enabled STAs which break the spec
2316 	 * and have no HT capabilities RX mask (no HT RX MCS map).
2317 	 *
2318 	 * As per spec, in section 20.3.5 Modulation and coding scheme (MCS),
2319 	 * MCS 0 through 7 are mandatory in 20MHz with 800 ns GI at all STAs.
2320 	 *
2321 	 * Firmware asserts if such situation occurs.
2322 	 */
2323 	if (n == 0) {
2324 		arg->peer_ht_rates.num_rates = 8;
2325 		for (i = 0; i < arg->peer_ht_rates.num_rates; i++)
2326 			arg->peer_ht_rates.rates[i] = i;
2327 	} else {
2328 		arg->peer_ht_rates.num_rates = n;
2329 		arg->peer_num_spatial_streams = min(sta->rx_nss, max_nss);
2330 	}
2331 
2332 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac ht peer %pM mcs cnt %d nss %d\n",
2333 		   arg->addr,
2334 		   arg->peer_ht_rates.num_rates,
2335 		   arg->peer_num_spatial_streams);
2336 }
2337 
2338 static int ath10k_peer_assoc_qos_ap(struct ath10k *ar,
2339 				    struct ath10k_vif *arvif,
2340 				    struct ieee80211_sta *sta)
2341 {
2342 	u32 uapsd = 0;
2343 	u32 max_sp = 0;
2344 	int ret = 0;
2345 
2346 	lockdep_assert_held(&ar->conf_mutex);
2347 
2348 	if (sta->wme && sta->uapsd_queues) {
2349 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac uapsd_queues 0x%x max_sp %d\n",
2350 			   sta->uapsd_queues, sta->max_sp);
2351 
2352 		if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
2353 			uapsd |= WMI_AP_PS_UAPSD_AC3_DELIVERY_EN |
2354 				 WMI_AP_PS_UAPSD_AC3_TRIGGER_EN;
2355 		if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
2356 			uapsd |= WMI_AP_PS_UAPSD_AC2_DELIVERY_EN |
2357 				 WMI_AP_PS_UAPSD_AC2_TRIGGER_EN;
2358 		if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
2359 			uapsd |= WMI_AP_PS_UAPSD_AC1_DELIVERY_EN |
2360 				 WMI_AP_PS_UAPSD_AC1_TRIGGER_EN;
2361 		if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
2362 			uapsd |= WMI_AP_PS_UAPSD_AC0_DELIVERY_EN |
2363 				 WMI_AP_PS_UAPSD_AC0_TRIGGER_EN;
2364 
2365 		if (sta->max_sp < MAX_WMI_AP_PS_PEER_PARAM_MAX_SP)
2366 			max_sp = sta->max_sp;
2367 
2368 		ret = ath10k_wmi_set_ap_ps_param(ar, arvif->vdev_id,
2369 						 sta->addr,
2370 						 WMI_AP_PS_PEER_PARAM_UAPSD,
2371 						 uapsd);
2372 		if (ret) {
2373 			ath10k_warn(ar, "failed to set ap ps peer param uapsd for vdev %i: %d\n",
2374 				    arvif->vdev_id, ret);
2375 			return ret;
2376 		}
2377 
2378 		ret = ath10k_wmi_set_ap_ps_param(ar, arvif->vdev_id,
2379 						 sta->addr,
2380 						 WMI_AP_PS_PEER_PARAM_MAX_SP,
2381 						 max_sp);
2382 		if (ret) {
2383 			ath10k_warn(ar, "failed to set ap ps peer param max sp for vdev %i: %d\n",
2384 				    arvif->vdev_id, ret);
2385 			return ret;
2386 		}
2387 
2388 		/* TODO setup this based on STA listen interval and
2389 		 * beacon interval. Currently we don't know
2390 		 * sta->listen_interval - mac80211 patch required.
2391 		 * Currently use 10 seconds
2392 		 */
2393 		ret = ath10k_wmi_set_ap_ps_param(ar, arvif->vdev_id, sta->addr,
2394 						 WMI_AP_PS_PEER_PARAM_AGEOUT_TIME,
2395 						 10);
2396 		if (ret) {
2397 			ath10k_warn(ar, "failed to set ap ps peer param ageout time for vdev %i: %d\n",
2398 				    arvif->vdev_id, ret);
2399 			return ret;
2400 		}
2401 	}
2402 
2403 	return 0;
2404 }
2405 
2406 static u16
2407 ath10k_peer_assoc_h_vht_limit(u16 tx_mcs_set,
2408 			      const u16 vht_mcs_limit[NL80211_VHT_NSS_MAX])
2409 {
2410 	int idx_limit;
2411 	int nss;
2412 	u16 mcs_map;
2413 	u16 mcs;
2414 
2415 	for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
2416 		mcs_map = ath10k_mac_get_max_vht_mcs_map(tx_mcs_set, nss) &
2417 			  vht_mcs_limit[nss];
2418 
2419 		if (mcs_map)
2420 			idx_limit = fls(mcs_map) - 1;
2421 		else
2422 			idx_limit = -1;
2423 
2424 		switch (idx_limit) {
2425 		case 0: /* fall through */
2426 		case 1: /* fall through */
2427 		case 2: /* fall through */
2428 		case 3: /* fall through */
2429 		case 4: /* fall through */
2430 		case 5: /* fall through */
2431 		case 6: /* fall through */
2432 		default:
2433 			/* see ath10k_mac_can_set_bitrate_mask() */
2434 			WARN_ON(1);
2435 			/* fall through */
2436 		case -1:
2437 			mcs = IEEE80211_VHT_MCS_NOT_SUPPORTED;
2438 			break;
2439 		case 7:
2440 			mcs = IEEE80211_VHT_MCS_SUPPORT_0_7;
2441 			break;
2442 		case 8:
2443 			mcs = IEEE80211_VHT_MCS_SUPPORT_0_8;
2444 			break;
2445 		case 9:
2446 			mcs = IEEE80211_VHT_MCS_SUPPORT_0_9;
2447 			break;
2448 		}
2449 
2450 		tx_mcs_set &= ~(0x3 << (nss * 2));
2451 		tx_mcs_set |= mcs << (nss * 2);
2452 	}
2453 
2454 	return tx_mcs_set;
2455 }
2456 
2457 static void ath10k_peer_assoc_h_vht(struct ath10k *ar,
2458 				    struct ieee80211_vif *vif,
2459 				    struct ieee80211_sta *sta,
2460 				    struct wmi_peer_assoc_complete_arg *arg)
2461 {
2462 	const struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
2463 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
2464 	struct cfg80211_chan_def def;
2465 	enum nl80211_band band;
2466 	const u16 *vht_mcs_mask;
2467 	u8 ampdu_factor;
2468 	u8 max_nss, vht_mcs;
2469 	int i;
2470 
2471 	if (WARN_ON(ath10k_mac_vif_chan(vif, &def)))
2472 		return;
2473 
2474 	if (!vht_cap->vht_supported)
2475 		return;
2476 
2477 	band = def.chan->band;
2478 	vht_mcs_mask = arvif->bitrate_mask.control[band].vht_mcs;
2479 
2480 	if (ath10k_peer_assoc_h_vht_masked(vht_mcs_mask))
2481 		return;
2482 
2483 	arg->peer_flags |= ar->wmi.peer_flags->vht;
2484 
2485 	if (def.chan->band == NL80211_BAND_2GHZ)
2486 		arg->peer_flags |= ar->wmi.peer_flags->vht_2g;
2487 
2488 	arg->peer_vht_caps = vht_cap->cap;
2489 
2490 	ampdu_factor = (vht_cap->cap &
2491 			IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK) >>
2492 		       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
2493 
2494 	/* Workaround: Some Netgear/Linksys 11ac APs set Rx A-MPDU factor to
2495 	 * zero in VHT IE. Using it would result in degraded throughput.
2496 	 * arg->peer_max_mpdu at this point contains HT max_mpdu so keep
2497 	 * it if VHT max_mpdu is smaller.
2498 	 */
2499 	arg->peer_max_mpdu = max(arg->peer_max_mpdu,
2500 				 (1U << (IEEE80211_HT_MAX_AMPDU_FACTOR +
2501 					ampdu_factor)) - 1);
2502 
2503 	if (sta->bandwidth == IEEE80211_STA_RX_BW_80)
2504 		arg->peer_flags |= ar->wmi.peer_flags->bw80;
2505 
2506 	if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
2507 		arg->peer_flags |= ar->wmi.peer_flags->bw160;
2508 
2509 	/* Calculate peer NSS capability from VHT capabilities if STA
2510 	 * supports VHT.
2511 	 */
2512 	for (i = 0, max_nss = 0, vht_mcs = 0; i < NL80211_VHT_NSS_MAX; i++) {
2513 		vht_mcs = __le16_to_cpu(vht_cap->vht_mcs.rx_mcs_map) >>
2514 			  (2 * i) & 3;
2515 
2516 		if ((vht_mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED) &&
2517 		    vht_mcs_mask[i])
2518 			max_nss = i + 1;
2519 	}
2520 	arg->peer_num_spatial_streams = min(sta->rx_nss, max_nss);
2521 	arg->peer_vht_rates.rx_max_rate =
2522 		__le16_to_cpu(vht_cap->vht_mcs.rx_highest);
2523 	arg->peer_vht_rates.rx_mcs_set =
2524 		__le16_to_cpu(vht_cap->vht_mcs.rx_mcs_map);
2525 	arg->peer_vht_rates.tx_max_rate =
2526 		__le16_to_cpu(vht_cap->vht_mcs.tx_highest);
2527 	arg->peer_vht_rates.tx_mcs_set = ath10k_peer_assoc_h_vht_limit(
2528 		__le16_to_cpu(vht_cap->vht_mcs.tx_mcs_map), vht_mcs_mask);
2529 
2530 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vht peer %pM max_mpdu %d flags 0x%x\n",
2531 		   sta->addr, arg->peer_max_mpdu, arg->peer_flags);
2532 
2533 	if (arg->peer_vht_rates.rx_max_rate &&
2534 	    (sta->vht_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK)) {
2535 		switch (arg->peer_vht_rates.rx_max_rate) {
2536 		case 1560:
2537 			/* Must be 2x2 at 160Mhz is all it can do. */
2538 			arg->peer_bw_rxnss_override = 2;
2539 			break;
2540 		case 780:
2541 			/* Can only do 1x1 at 160Mhz (Long Guard Interval) */
2542 			arg->peer_bw_rxnss_override = 1;
2543 			break;
2544 		}
2545 	}
2546 }
2547 
2548 static void ath10k_peer_assoc_h_qos(struct ath10k *ar,
2549 				    struct ieee80211_vif *vif,
2550 				    struct ieee80211_sta *sta,
2551 				    struct wmi_peer_assoc_complete_arg *arg)
2552 {
2553 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
2554 
2555 	switch (arvif->vdev_type) {
2556 	case WMI_VDEV_TYPE_AP:
2557 		if (sta->wme)
2558 			arg->peer_flags |= arvif->ar->wmi.peer_flags->qos;
2559 
2560 		if (sta->wme && sta->uapsd_queues) {
2561 			arg->peer_flags |= arvif->ar->wmi.peer_flags->apsd;
2562 			arg->peer_rate_caps |= WMI_RC_UAPSD_FLAG;
2563 		}
2564 		break;
2565 	case WMI_VDEV_TYPE_STA:
2566 		if (sta->wme)
2567 			arg->peer_flags |= arvif->ar->wmi.peer_flags->qos;
2568 		break;
2569 	case WMI_VDEV_TYPE_IBSS:
2570 		if (sta->wme)
2571 			arg->peer_flags |= arvif->ar->wmi.peer_flags->qos;
2572 		break;
2573 	default:
2574 		break;
2575 	}
2576 
2577 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac peer %pM qos %d\n",
2578 		   sta->addr, !!(arg->peer_flags &
2579 		   arvif->ar->wmi.peer_flags->qos));
2580 }
2581 
2582 static bool ath10k_mac_sta_has_ofdm_only(struct ieee80211_sta *sta)
2583 {
2584 	return sta->supp_rates[NL80211_BAND_2GHZ] >>
2585 	       ATH10K_MAC_FIRST_OFDM_RATE_IDX;
2586 }
2587 
2588 static enum wmi_phy_mode ath10k_mac_get_phymode_vht(struct ath10k *ar,
2589 						    struct ieee80211_sta *sta)
2590 {
2591 	if (sta->bandwidth == IEEE80211_STA_RX_BW_160) {
2592 		switch (sta->vht_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) {
2593 		case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ:
2594 			return MODE_11AC_VHT160;
2595 		case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ:
2596 			return MODE_11AC_VHT80_80;
2597 		default:
2598 			/* not sure if this is a valid case? */
2599 			return MODE_11AC_VHT160;
2600 		}
2601 	}
2602 
2603 	if (sta->bandwidth == IEEE80211_STA_RX_BW_80)
2604 		return MODE_11AC_VHT80;
2605 
2606 	if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
2607 		return MODE_11AC_VHT40;
2608 
2609 	if (sta->bandwidth == IEEE80211_STA_RX_BW_20)
2610 		return MODE_11AC_VHT20;
2611 
2612 	return MODE_UNKNOWN;
2613 }
2614 
2615 static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
2616 					struct ieee80211_vif *vif,
2617 					struct ieee80211_sta *sta,
2618 					struct wmi_peer_assoc_complete_arg *arg)
2619 {
2620 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
2621 	struct cfg80211_chan_def def;
2622 	enum nl80211_band band;
2623 	const u8 *ht_mcs_mask;
2624 	const u16 *vht_mcs_mask;
2625 	enum wmi_phy_mode phymode = MODE_UNKNOWN;
2626 
2627 	if (WARN_ON(ath10k_mac_vif_chan(vif, &def)))
2628 		return;
2629 
2630 	band = def.chan->band;
2631 	ht_mcs_mask = arvif->bitrate_mask.control[band].ht_mcs;
2632 	vht_mcs_mask = arvif->bitrate_mask.control[band].vht_mcs;
2633 
2634 	switch (band) {
2635 	case NL80211_BAND_2GHZ:
2636 		if (sta->vht_cap.vht_supported &&
2637 		    !ath10k_peer_assoc_h_vht_masked(vht_mcs_mask)) {
2638 			if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
2639 				phymode = MODE_11AC_VHT40;
2640 			else
2641 				phymode = MODE_11AC_VHT20;
2642 		} else if (sta->ht_cap.ht_supported &&
2643 			   !ath10k_peer_assoc_h_ht_masked(ht_mcs_mask)) {
2644 			if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
2645 				phymode = MODE_11NG_HT40;
2646 			else
2647 				phymode = MODE_11NG_HT20;
2648 		} else if (ath10k_mac_sta_has_ofdm_only(sta)) {
2649 			phymode = MODE_11G;
2650 		} else {
2651 			phymode = MODE_11B;
2652 		}
2653 
2654 		break;
2655 	case NL80211_BAND_5GHZ:
2656 		/*
2657 		 * Check VHT first.
2658 		 */
2659 		if (sta->vht_cap.vht_supported &&
2660 		    !ath10k_peer_assoc_h_vht_masked(vht_mcs_mask)) {
2661 			phymode = ath10k_mac_get_phymode_vht(ar, sta);
2662 		} else if (sta->ht_cap.ht_supported &&
2663 			   !ath10k_peer_assoc_h_ht_masked(ht_mcs_mask)) {
2664 			if (sta->bandwidth >= IEEE80211_STA_RX_BW_40)
2665 				phymode = MODE_11NA_HT40;
2666 			else
2667 				phymode = MODE_11NA_HT20;
2668 		} else {
2669 			phymode = MODE_11A;
2670 		}
2671 
2672 		break;
2673 	default:
2674 		break;
2675 	}
2676 
2677 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac peer %pM phymode %s\n",
2678 		   sta->addr, ath10k_wmi_phymode_str(phymode));
2679 
2680 	arg->peer_phymode = phymode;
2681 	WARN_ON(phymode == MODE_UNKNOWN);
2682 }
2683 
2684 static int ath10k_peer_assoc_prepare(struct ath10k *ar,
2685 				     struct ieee80211_vif *vif,
2686 				     struct ieee80211_sta *sta,
2687 				     struct wmi_peer_assoc_complete_arg *arg)
2688 {
2689 	lockdep_assert_held(&ar->conf_mutex);
2690 
2691 	memset(arg, 0, sizeof(*arg));
2692 
2693 	ath10k_peer_assoc_h_basic(ar, vif, sta, arg);
2694 	ath10k_peer_assoc_h_crypto(ar, vif, sta, arg);
2695 	ath10k_peer_assoc_h_rates(ar, vif, sta, arg);
2696 	ath10k_peer_assoc_h_ht(ar, vif, sta, arg);
2697 	ath10k_peer_assoc_h_vht(ar, vif, sta, arg);
2698 	ath10k_peer_assoc_h_qos(ar, vif, sta, arg);
2699 	ath10k_peer_assoc_h_phymode(ar, vif, sta, arg);
2700 
2701 	return 0;
2702 }
2703 
2704 static const u32 ath10k_smps_map[] = {
2705 	[WLAN_HT_CAP_SM_PS_STATIC] = WMI_PEER_SMPS_STATIC,
2706 	[WLAN_HT_CAP_SM_PS_DYNAMIC] = WMI_PEER_SMPS_DYNAMIC,
2707 	[WLAN_HT_CAP_SM_PS_INVALID] = WMI_PEER_SMPS_PS_NONE,
2708 	[WLAN_HT_CAP_SM_PS_DISABLED] = WMI_PEER_SMPS_PS_NONE,
2709 };
2710 
2711 static int ath10k_setup_peer_smps(struct ath10k *ar, struct ath10k_vif *arvif,
2712 				  const u8 *addr,
2713 				  const struct ieee80211_sta_ht_cap *ht_cap)
2714 {
2715 	int smps;
2716 
2717 	if (!ht_cap->ht_supported)
2718 		return 0;
2719 
2720 	smps = ht_cap->cap & IEEE80211_HT_CAP_SM_PS;
2721 	smps >>= IEEE80211_HT_CAP_SM_PS_SHIFT;
2722 
2723 	if (smps >= ARRAY_SIZE(ath10k_smps_map))
2724 		return -EINVAL;
2725 
2726 	return ath10k_wmi_peer_set_param(ar, arvif->vdev_id, addr,
2727 					 WMI_PEER_SMPS_STATE,
2728 					 ath10k_smps_map[smps]);
2729 }
2730 
2731 static int ath10k_mac_vif_recalc_txbf(struct ath10k *ar,
2732 				      struct ieee80211_vif *vif,
2733 				      struct ieee80211_sta_vht_cap vht_cap)
2734 {
2735 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
2736 	int ret;
2737 	u32 param;
2738 	u32 value;
2739 
2740 	if (ath10k_wmi_get_txbf_conf_scheme(ar) != WMI_TXBF_CONF_AFTER_ASSOC)
2741 		return 0;
2742 
2743 	if (!(ar->vht_cap_info &
2744 	      (IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
2745 	       IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE |
2746 	       IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
2747 	       IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
2748 		return 0;
2749 
2750 	param = ar->wmi.vdev_param->txbf;
2751 	value = 0;
2752 
2753 	if (WARN_ON(param == WMI_VDEV_PARAM_UNSUPPORTED))
2754 		return 0;
2755 
2756 	/* The following logic is correct. If a remote STA advertises support
2757 	 * for being a beamformer then we should enable us being a beamformee.
2758 	 */
2759 
2760 	if (ar->vht_cap_info &
2761 	    (IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
2762 	     IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE)) {
2763 		if (vht_cap.cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)
2764 			value |= WMI_VDEV_PARAM_TXBF_SU_TX_BFEE;
2765 
2766 		if (vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)
2767 			value |= WMI_VDEV_PARAM_TXBF_MU_TX_BFEE;
2768 	}
2769 
2770 	if (ar->vht_cap_info &
2771 	    (IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
2772 	     IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)) {
2773 		if (vht_cap.cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE)
2774 			value |= WMI_VDEV_PARAM_TXBF_SU_TX_BFER;
2775 
2776 		if (vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE)
2777 			value |= WMI_VDEV_PARAM_TXBF_MU_TX_BFER;
2778 	}
2779 
2780 	if (value & WMI_VDEV_PARAM_TXBF_MU_TX_BFEE)
2781 		value |= WMI_VDEV_PARAM_TXBF_SU_TX_BFEE;
2782 
2783 	if (value & WMI_VDEV_PARAM_TXBF_MU_TX_BFER)
2784 		value |= WMI_VDEV_PARAM_TXBF_SU_TX_BFER;
2785 
2786 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, param, value);
2787 	if (ret) {
2788 		ath10k_warn(ar, "failed to submit vdev param txbf 0x%x: %d\n",
2789 			    value, ret);
2790 		return ret;
2791 	}
2792 
2793 	return 0;
2794 }
2795 
2796 /* can be called only in mac80211 callbacks due to `key_count` usage */
2797 static void ath10k_bss_assoc(struct ieee80211_hw *hw,
2798 			     struct ieee80211_vif *vif,
2799 			     struct ieee80211_bss_conf *bss_conf)
2800 {
2801 	struct ath10k *ar = hw->priv;
2802 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
2803 	struct ieee80211_sta_ht_cap ht_cap;
2804 	struct ieee80211_sta_vht_cap vht_cap;
2805 	struct wmi_peer_assoc_complete_arg peer_arg;
2806 	struct ieee80211_sta *ap_sta;
2807 	int ret;
2808 
2809 	lockdep_assert_held(&ar->conf_mutex);
2810 
2811 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %i assoc bssid %pM aid %d\n",
2812 		   arvif->vdev_id, arvif->bssid, arvif->aid);
2813 
2814 	rcu_read_lock();
2815 
2816 	ap_sta = ieee80211_find_sta(vif, bss_conf->bssid);
2817 	if (!ap_sta) {
2818 		ath10k_warn(ar, "failed to find station entry for bss %pM vdev %i\n",
2819 			    bss_conf->bssid, arvif->vdev_id);
2820 		rcu_read_unlock();
2821 		return;
2822 	}
2823 
2824 	/* ap_sta must be accessed only within rcu section which must be left
2825 	 * before calling ath10k_setup_peer_smps() which might sleep.
2826 	 */
2827 	ht_cap = ap_sta->ht_cap;
2828 	vht_cap = ap_sta->vht_cap;
2829 
2830 	ret = ath10k_peer_assoc_prepare(ar, vif, ap_sta, &peer_arg);
2831 	if (ret) {
2832 		ath10k_warn(ar, "failed to prepare peer assoc for %pM vdev %i: %d\n",
2833 			    bss_conf->bssid, arvif->vdev_id, ret);
2834 		rcu_read_unlock();
2835 		return;
2836 	}
2837 
2838 	rcu_read_unlock();
2839 
2840 	ret = ath10k_wmi_peer_assoc(ar, &peer_arg);
2841 	if (ret) {
2842 		ath10k_warn(ar, "failed to run peer assoc for %pM vdev %i: %d\n",
2843 			    bss_conf->bssid, arvif->vdev_id, ret);
2844 		return;
2845 	}
2846 
2847 	ret = ath10k_setup_peer_smps(ar, arvif, bss_conf->bssid, &ht_cap);
2848 	if (ret) {
2849 		ath10k_warn(ar, "failed to setup peer SMPS for vdev %i: %d\n",
2850 			    arvif->vdev_id, ret);
2851 		return;
2852 	}
2853 
2854 	ret = ath10k_mac_vif_recalc_txbf(ar, vif, vht_cap);
2855 	if (ret) {
2856 		ath10k_warn(ar, "failed to recalc txbf for vdev %i on bss %pM: %d\n",
2857 			    arvif->vdev_id, bss_conf->bssid, ret);
2858 		return;
2859 	}
2860 
2861 	ath10k_dbg(ar, ATH10K_DBG_MAC,
2862 		   "mac vdev %d up (associated) bssid %pM aid %d\n",
2863 		   arvif->vdev_id, bss_conf->bssid, bss_conf->aid);
2864 
2865 	WARN_ON(arvif->is_up);
2866 
2867 	arvif->aid = bss_conf->aid;
2868 	ether_addr_copy(arvif->bssid, bss_conf->bssid);
2869 
2870 	ret = ath10k_wmi_vdev_up(ar, arvif->vdev_id, arvif->aid, arvif->bssid);
2871 	if (ret) {
2872 		ath10k_warn(ar, "failed to set vdev %d up: %d\n",
2873 			    arvif->vdev_id, ret);
2874 		return;
2875 	}
2876 
2877 	arvif->is_up = true;
2878 
2879 	/* Workaround: Some firmware revisions (tested with qca6174
2880 	 * WLAN.RM.2.0-00073) have buggy powersave state machine and must be
2881 	 * poked with peer param command.
2882 	 */
2883 	ret = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, arvif->bssid,
2884 					WMI_PEER_DUMMY_VAR, 1);
2885 	if (ret) {
2886 		ath10k_warn(ar, "failed to poke peer %pM param for ps workaround on vdev %i: %d\n",
2887 			    arvif->bssid, arvif->vdev_id, ret);
2888 		return;
2889 	}
2890 }
2891 
2892 static void ath10k_bss_disassoc(struct ieee80211_hw *hw,
2893 				struct ieee80211_vif *vif)
2894 {
2895 	struct ath10k *ar = hw->priv;
2896 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
2897 	struct ieee80211_sta_vht_cap vht_cap = {};
2898 	int ret;
2899 
2900 	lockdep_assert_held(&ar->conf_mutex);
2901 
2902 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %i disassoc bssid %pM\n",
2903 		   arvif->vdev_id, arvif->bssid);
2904 
2905 	ret = ath10k_wmi_vdev_down(ar, arvif->vdev_id);
2906 	if (ret)
2907 		ath10k_warn(ar, "failed to down vdev %i: %d\n",
2908 			    arvif->vdev_id, ret);
2909 
2910 	arvif->def_wep_key_idx = -1;
2911 
2912 	ret = ath10k_mac_vif_recalc_txbf(ar, vif, vht_cap);
2913 	if (ret) {
2914 		ath10k_warn(ar, "failed to recalc txbf for vdev %i: %d\n",
2915 			    arvif->vdev_id, ret);
2916 		return;
2917 	}
2918 
2919 	arvif->is_up = false;
2920 
2921 	cancel_delayed_work_sync(&arvif->connection_loss_work);
2922 }
2923 
2924 static int ath10k_station_assoc(struct ath10k *ar,
2925 				struct ieee80211_vif *vif,
2926 				struct ieee80211_sta *sta,
2927 				bool reassoc)
2928 {
2929 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
2930 	struct wmi_peer_assoc_complete_arg peer_arg;
2931 	int ret = 0;
2932 
2933 	lockdep_assert_held(&ar->conf_mutex);
2934 
2935 	ret = ath10k_peer_assoc_prepare(ar, vif, sta, &peer_arg);
2936 	if (ret) {
2937 		ath10k_warn(ar, "failed to prepare WMI peer assoc for %pM vdev %i: %i\n",
2938 			    sta->addr, arvif->vdev_id, ret);
2939 		return ret;
2940 	}
2941 
2942 	ret = ath10k_wmi_peer_assoc(ar, &peer_arg);
2943 	if (ret) {
2944 		ath10k_warn(ar, "failed to run peer assoc for STA %pM vdev %i: %d\n",
2945 			    sta->addr, arvif->vdev_id, ret);
2946 		return ret;
2947 	}
2948 
2949 	/* Re-assoc is run only to update supported rates for given station. It
2950 	 * doesn't make much sense to reconfigure the peer completely.
2951 	 */
2952 	if (!reassoc) {
2953 		ret = ath10k_setup_peer_smps(ar, arvif, sta->addr,
2954 					     &sta->ht_cap);
2955 		if (ret) {
2956 			ath10k_warn(ar, "failed to setup peer SMPS for vdev %d: %d\n",
2957 				    arvif->vdev_id, ret);
2958 			return ret;
2959 		}
2960 
2961 		ret = ath10k_peer_assoc_qos_ap(ar, arvif, sta);
2962 		if (ret) {
2963 			ath10k_warn(ar, "failed to set qos params for STA %pM for vdev %i: %d\n",
2964 				    sta->addr, arvif->vdev_id, ret);
2965 			return ret;
2966 		}
2967 
2968 		if (!sta->wme) {
2969 			arvif->num_legacy_stations++;
2970 			ret  = ath10k_recalc_rtscts_prot(arvif);
2971 			if (ret) {
2972 				ath10k_warn(ar, "failed to recalculate rts/cts prot for vdev %d: %d\n",
2973 					    arvif->vdev_id, ret);
2974 				return ret;
2975 			}
2976 		}
2977 
2978 		/* Plumb cached keys only for static WEP */
2979 		if (arvif->def_wep_key_idx != -1) {
2980 			ret = ath10k_install_peer_wep_keys(arvif, sta->addr);
2981 			if (ret) {
2982 				ath10k_warn(ar, "failed to install peer wep keys for vdev %i: %d\n",
2983 					    arvif->vdev_id, ret);
2984 				return ret;
2985 			}
2986 		}
2987 	}
2988 
2989 	return ret;
2990 }
2991 
2992 static int ath10k_station_disassoc(struct ath10k *ar,
2993 				   struct ieee80211_vif *vif,
2994 				   struct ieee80211_sta *sta)
2995 {
2996 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
2997 	int ret = 0;
2998 
2999 	lockdep_assert_held(&ar->conf_mutex);
3000 
3001 	if (!sta->wme) {
3002 		arvif->num_legacy_stations--;
3003 		ret = ath10k_recalc_rtscts_prot(arvif);
3004 		if (ret) {
3005 			ath10k_warn(ar, "failed to recalculate rts/cts prot for vdev %d: %d\n",
3006 				    arvif->vdev_id, ret);
3007 			return ret;
3008 		}
3009 	}
3010 
3011 	ret = ath10k_clear_peer_keys(arvif, sta->addr);
3012 	if (ret) {
3013 		ath10k_warn(ar, "failed to clear all peer wep keys for vdev %i: %d\n",
3014 			    arvif->vdev_id, ret);
3015 		return ret;
3016 	}
3017 
3018 	return ret;
3019 }
3020 
3021 /**************/
3022 /* Regulatory */
3023 /**************/
3024 
3025 static int ath10k_update_channel_list(struct ath10k *ar)
3026 {
3027 	struct ieee80211_hw *hw = ar->hw;
3028 	struct ieee80211_supported_band **bands;
3029 	enum nl80211_band band;
3030 	struct ieee80211_channel *channel;
3031 	struct wmi_scan_chan_list_arg arg = {0};
3032 	struct wmi_channel_arg *ch;
3033 	bool passive;
3034 	int len;
3035 	int ret;
3036 	int i;
3037 
3038 	lockdep_assert_held(&ar->conf_mutex);
3039 
3040 	bands = hw->wiphy->bands;
3041 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
3042 		if (!bands[band])
3043 			continue;
3044 
3045 		for (i = 0; i < bands[band]->n_channels; i++) {
3046 			if (bands[band]->channels[i].flags &
3047 			    IEEE80211_CHAN_DISABLED)
3048 				continue;
3049 
3050 			arg.n_channels++;
3051 		}
3052 	}
3053 
3054 	len = sizeof(struct wmi_channel_arg) * arg.n_channels;
3055 	arg.channels = kzalloc(len, GFP_KERNEL);
3056 	if (!arg.channels)
3057 		return -ENOMEM;
3058 
3059 	ch = arg.channels;
3060 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
3061 		if (!bands[band])
3062 			continue;
3063 
3064 		for (i = 0; i < bands[band]->n_channels; i++) {
3065 			channel = &bands[band]->channels[i];
3066 
3067 			if (channel->flags & IEEE80211_CHAN_DISABLED)
3068 				continue;
3069 
3070 			ch->allow_ht = true;
3071 
3072 			/* FIXME: when should we really allow VHT? */
3073 			ch->allow_vht = true;
3074 
3075 			ch->allow_ibss =
3076 				!(channel->flags & IEEE80211_CHAN_NO_IR);
3077 
3078 			ch->ht40plus =
3079 				!(channel->flags & IEEE80211_CHAN_NO_HT40PLUS);
3080 
3081 			ch->chan_radar =
3082 				!!(channel->flags & IEEE80211_CHAN_RADAR);
3083 
3084 			passive = channel->flags & IEEE80211_CHAN_NO_IR;
3085 			ch->passive = passive;
3086 
3087 			ch->freq = channel->center_freq;
3088 			ch->band_center_freq1 = channel->center_freq;
3089 			ch->min_power = 0;
3090 			ch->max_power = channel->max_power * 2;
3091 			ch->max_reg_power = channel->max_reg_power * 2;
3092 			ch->max_antenna_gain = channel->max_antenna_gain * 2;
3093 			ch->reg_class_id = 0; /* FIXME */
3094 
3095 			/* FIXME: why use only legacy modes, why not any
3096 			 * HT/VHT modes? Would that even make any
3097 			 * difference?
3098 			 */
3099 			if (channel->band == NL80211_BAND_2GHZ)
3100 				ch->mode = MODE_11G;
3101 			else
3102 				ch->mode = MODE_11A;
3103 
3104 			if (WARN_ON_ONCE(ch->mode == MODE_UNKNOWN))
3105 				continue;
3106 
3107 			ath10k_dbg(ar, ATH10K_DBG_WMI,
3108 				   "mac channel [%zd/%d] freq %d maxpower %d regpower %d antenna %d mode %d\n",
3109 				    ch - arg.channels, arg.n_channels,
3110 				   ch->freq, ch->max_power, ch->max_reg_power,
3111 				   ch->max_antenna_gain, ch->mode);
3112 
3113 			ch++;
3114 		}
3115 	}
3116 
3117 	ret = ath10k_wmi_scan_chan_list(ar, &arg);
3118 	kfree(arg.channels);
3119 
3120 	return ret;
3121 }
3122 
3123 static enum wmi_dfs_region
3124 ath10k_mac_get_dfs_region(enum nl80211_dfs_regions dfs_region)
3125 {
3126 	switch (dfs_region) {
3127 	case NL80211_DFS_UNSET:
3128 		return WMI_UNINIT_DFS_DOMAIN;
3129 	case NL80211_DFS_FCC:
3130 		return WMI_FCC_DFS_DOMAIN;
3131 	case NL80211_DFS_ETSI:
3132 		return WMI_ETSI_DFS_DOMAIN;
3133 	case NL80211_DFS_JP:
3134 		return WMI_MKK4_DFS_DOMAIN;
3135 	}
3136 	return WMI_UNINIT_DFS_DOMAIN;
3137 }
3138 
3139 static void ath10k_regd_update(struct ath10k *ar)
3140 {
3141 	struct reg_dmn_pair_mapping *regpair;
3142 	int ret;
3143 	enum wmi_dfs_region wmi_dfs_reg;
3144 	enum nl80211_dfs_regions nl_dfs_reg;
3145 
3146 	lockdep_assert_held(&ar->conf_mutex);
3147 
3148 	ret = ath10k_update_channel_list(ar);
3149 	if (ret)
3150 		ath10k_warn(ar, "failed to update channel list: %d\n", ret);
3151 
3152 	regpair = ar->ath_common.regulatory.regpair;
3153 
3154 	if (IS_ENABLED(CONFIG_ATH10K_DFS_CERTIFIED) && ar->dfs_detector) {
3155 		nl_dfs_reg = ar->dfs_detector->region;
3156 		wmi_dfs_reg = ath10k_mac_get_dfs_region(nl_dfs_reg);
3157 	} else {
3158 		wmi_dfs_reg = WMI_UNINIT_DFS_DOMAIN;
3159 	}
3160 
3161 	/* Target allows setting up per-band regdomain but ath_common provides
3162 	 * a combined one only
3163 	 */
3164 	ret = ath10k_wmi_pdev_set_regdomain(ar,
3165 					    regpair->reg_domain,
3166 					    regpair->reg_domain, /* 2ghz */
3167 					    regpair->reg_domain, /* 5ghz */
3168 					    regpair->reg_2ghz_ctl,
3169 					    regpair->reg_5ghz_ctl,
3170 					    wmi_dfs_reg);
3171 	if (ret)
3172 		ath10k_warn(ar, "failed to set pdev regdomain: %d\n", ret);
3173 }
3174 
3175 static void ath10k_mac_update_channel_list(struct ath10k *ar,
3176 					   struct ieee80211_supported_band *band)
3177 {
3178 	int i;
3179 
3180 	if (ar->low_5ghz_chan && ar->high_5ghz_chan) {
3181 		for (i = 0; i < band->n_channels; i++) {
3182 			if (band->channels[i].center_freq < ar->low_5ghz_chan ||
3183 			    band->channels[i].center_freq > ar->high_5ghz_chan)
3184 				band->channels[i].flags |=
3185 					IEEE80211_CHAN_DISABLED;
3186 		}
3187 	}
3188 }
3189 
3190 static void ath10k_reg_notifier(struct wiphy *wiphy,
3191 				struct regulatory_request *request)
3192 {
3193 	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
3194 	struct ath10k *ar = hw->priv;
3195 	bool result;
3196 
3197 	ath_reg_notifier_apply(wiphy, request, &ar->ath_common.regulatory);
3198 
3199 	if (IS_ENABLED(CONFIG_ATH10K_DFS_CERTIFIED) && ar->dfs_detector) {
3200 		ath10k_dbg(ar, ATH10K_DBG_REGULATORY, "dfs region 0x%x\n",
3201 			   request->dfs_region);
3202 		result = ar->dfs_detector->set_dfs_domain(ar->dfs_detector,
3203 							  request->dfs_region);
3204 		if (!result)
3205 			ath10k_warn(ar, "DFS region 0x%X not supported, will trigger radar for every pulse\n",
3206 				    request->dfs_region);
3207 	}
3208 
3209 	mutex_lock(&ar->conf_mutex);
3210 	if (ar->state == ATH10K_STATE_ON)
3211 		ath10k_regd_update(ar);
3212 	mutex_unlock(&ar->conf_mutex);
3213 
3214 	if (ar->phy_capability & WHAL_WLAN_11A_CAPABILITY)
3215 		ath10k_mac_update_channel_list(ar,
3216 					       ar->hw->wiphy->bands[NL80211_BAND_5GHZ]);
3217 }
3218 
3219 /***************/
3220 /* TX handlers */
3221 /***************/
3222 
3223 enum ath10k_mac_tx_path {
3224 	ATH10K_MAC_TX_HTT,
3225 	ATH10K_MAC_TX_HTT_MGMT,
3226 	ATH10K_MAC_TX_WMI_MGMT,
3227 	ATH10K_MAC_TX_UNKNOWN,
3228 };
3229 
3230 void ath10k_mac_tx_lock(struct ath10k *ar, int reason)
3231 {
3232 	lockdep_assert_held(&ar->htt.tx_lock);
3233 
3234 	WARN_ON(reason >= ATH10K_TX_PAUSE_MAX);
3235 	ar->tx_paused |= BIT(reason);
3236 	ieee80211_stop_queues(ar->hw);
3237 }
3238 
3239 static void ath10k_mac_tx_unlock_iter(void *data, u8 *mac,
3240 				      struct ieee80211_vif *vif)
3241 {
3242 	struct ath10k *ar = data;
3243 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
3244 
3245 	if (arvif->tx_paused)
3246 		return;
3247 
3248 	ieee80211_wake_queue(ar->hw, arvif->vdev_id);
3249 }
3250 
3251 void ath10k_mac_tx_unlock(struct ath10k *ar, int reason)
3252 {
3253 	lockdep_assert_held(&ar->htt.tx_lock);
3254 
3255 	WARN_ON(reason >= ATH10K_TX_PAUSE_MAX);
3256 	ar->tx_paused &= ~BIT(reason);
3257 
3258 	if (ar->tx_paused)
3259 		return;
3260 
3261 	ieee80211_iterate_active_interfaces_atomic(ar->hw,
3262 						   IEEE80211_IFACE_ITER_RESUME_ALL,
3263 						   ath10k_mac_tx_unlock_iter,
3264 						   ar);
3265 
3266 	ieee80211_wake_queue(ar->hw, ar->hw->offchannel_tx_hw_queue);
3267 }
3268 
3269 void ath10k_mac_vif_tx_lock(struct ath10k_vif *arvif, int reason)
3270 {
3271 	struct ath10k *ar = arvif->ar;
3272 
3273 	lockdep_assert_held(&ar->htt.tx_lock);
3274 
3275 	WARN_ON(reason >= BITS_PER_LONG);
3276 	arvif->tx_paused |= BIT(reason);
3277 	ieee80211_stop_queue(ar->hw, arvif->vdev_id);
3278 }
3279 
3280 void ath10k_mac_vif_tx_unlock(struct ath10k_vif *arvif, int reason)
3281 {
3282 	struct ath10k *ar = arvif->ar;
3283 
3284 	lockdep_assert_held(&ar->htt.tx_lock);
3285 
3286 	WARN_ON(reason >= BITS_PER_LONG);
3287 	arvif->tx_paused &= ~BIT(reason);
3288 
3289 	if (ar->tx_paused)
3290 		return;
3291 
3292 	if (arvif->tx_paused)
3293 		return;
3294 
3295 	ieee80211_wake_queue(ar->hw, arvif->vdev_id);
3296 }
3297 
3298 static void ath10k_mac_vif_handle_tx_pause(struct ath10k_vif *arvif,
3299 					   enum wmi_tlv_tx_pause_id pause_id,
3300 					   enum wmi_tlv_tx_pause_action action)
3301 {
3302 	struct ath10k *ar = arvif->ar;
3303 
3304 	lockdep_assert_held(&ar->htt.tx_lock);
3305 
3306 	switch (action) {
3307 	case WMI_TLV_TX_PAUSE_ACTION_STOP:
3308 		ath10k_mac_vif_tx_lock(arvif, pause_id);
3309 		break;
3310 	case WMI_TLV_TX_PAUSE_ACTION_WAKE:
3311 		ath10k_mac_vif_tx_unlock(arvif, pause_id);
3312 		break;
3313 	default:
3314 		ath10k_dbg(ar, ATH10K_DBG_BOOT,
3315 			   "received unknown tx pause action %d on vdev %i, ignoring\n",
3316 			    action, arvif->vdev_id);
3317 		break;
3318 	}
3319 }
3320 
3321 struct ath10k_mac_tx_pause {
3322 	u32 vdev_id;
3323 	enum wmi_tlv_tx_pause_id pause_id;
3324 	enum wmi_tlv_tx_pause_action action;
3325 };
3326 
3327 static void ath10k_mac_handle_tx_pause_iter(void *data, u8 *mac,
3328 					    struct ieee80211_vif *vif)
3329 {
3330 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
3331 	struct ath10k_mac_tx_pause *arg = data;
3332 
3333 	if (arvif->vdev_id != arg->vdev_id)
3334 		return;
3335 
3336 	ath10k_mac_vif_handle_tx_pause(arvif, arg->pause_id, arg->action);
3337 }
3338 
3339 void ath10k_mac_handle_tx_pause_vdev(struct ath10k *ar, u32 vdev_id,
3340 				     enum wmi_tlv_tx_pause_id pause_id,
3341 				     enum wmi_tlv_tx_pause_action action)
3342 {
3343 	struct ath10k_mac_tx_pause arg = {
3344 		.vdev_id = vdev_id,
3345 		.pause_id = pause_id,
3346 		.action = action,
3347 	};
3348 
3349 	spin_lock_bh(&ar->htt.tx_lock);
3350 	ieee80211_iterate_active_interfaces_atomic(ar->hw,
3351 						   IEEE80211_IFACE_ITER_RESUME_ALL,
3352 						   ath10k_mac_handle_tx_pause_iter,
3353 						   &arg);
3354 	spin_unlock_bh(&ar->htt.tx_lock);
3355 }
3356 
3357 static enum ath10k_hw_txrx_mode
3358 ath10k_mac_tx_h_get_txmode(struct ath10k *ar,
3359 			   struct ieee80211_vif *vif,
3360 			   struct ieee80211_sta *sta,
3361 			   struct sk_buff *skb)
3362 {
3363 	const struct ieee80211_hdr *hdr = (void *)skb->data;
3364 	__le16 fc = hdr->frame_control;
3365 
3366 	if (!vif || vif->type == NL80211_IFTYPE_MONITOR)
3367 		return ATH10K_HW_TXRX_RAW;
3368 
3369 	if (ieee80211_is_mgmt(fc))
3370 		return ATH10K_HW_TXRX_MGMT;
3371 
3372 	/* Workaround:
3373 	 *
3374 	 * NullFunc frames are mostly used to ping if a client or AP are still
3375 	 * reachable and responsive. This implies tx status reports must be
3376 	 * accurate - otherwise either mac80211 or userspace (e.g. hostapd) can
3377 	 * come to a conclusion that the other end disappeared and tear down
3378 	 * BSS connection or it can never disconnect from BSS/client (which is
3379 	 * the case).
3380 	 *
3381 	 * Firmware with HTT older than 3.0 delivers incorrect tx status for
3382 	 * NullFunc frames to driver. However there's a HTT Mgmt Tx command
3383 	 * which seems to deliver correct tx reports for NullFunc frames. The
3384 	 * downside of using it is it ignores client powersave state so it can
3385 	 * end up disconnecting sleeping clients in AP mode. It should fix STA
3386 	 * mode though because AP don't sleep.
3387 	 */
3388 	if (ar->htt.target_version_major < 3 &&
3389 	    (ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc)) &&
3390 	    !test_bit(ATH10K_FW_FEATURE_HAS_WMI_MGMT_TX,
3391 		      ar->running_fw->fw_file.fw_features))
3392 		return ATH10K_HW_TXRX_MGMT;
3393 
3394 	/* Workaround:
3395 	 *
3396 	 * Some wmi-tlv firmwares for qca6174 have broken Tx key selection for
3397 	 * NativeWifi txmode - it selects AP key instead of peer key. It seems
3398 	 * to work with Ethernet txmode so use it.
3399 	 *
3400 	 * FIXME: Check if raw mode works with TDLS.
3401 	 */
3402 	if (ieee80211_is_data_present(fc) && sta && sta->tdls)
3403 		return ATH10K_HW_TXRX_ETHERNET;
3404 
3405 	if (test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags))
3406 		return ATH10K_HW_TXRX_RAW;
3407 
3408 	return ATH10K_HW_TXRX_NATIVE_WIFI;
3409 }
3410 
3411 static bool ath10k_tx_h_use_hwcrypto(struct ieee80211_vif *vif,
3412 				     struct sk_buff *skb)
3413 {
3414 	const struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
3415 	const struct ieee80211_hdr *hdr = (void *)skb->data;
3416 	const u32 mask = IEEE80211_TX_INTFL_DONT_ENCRYPT |
3417 			 IEEE80211_TX_CTL_INJECTED;
3418 
3419 	if (!ieee80211_has_protected(hdr->frame_control))
3420 		return false;
3421 
3422 	if ((info->flags & mask) == mask)
3423 		return false;
3424 
3425 	if (vif)
3426 		return !((struct ath10k_vif *)vif->drv_priv)->nohwcrypt;
3427 
3428 	return true;
3429 }
3430 
3431 /* HTT Tx uses Native Wifi tx mode which expects 802.11 frames without QoS
3432  * Control in the header.
3433  */
3434 static void ath10k_tx_h_nwifi(struct ieee80211_hw *hw, struct sk_buff *skb)
3435 {
3436 	struct ieee80211_hdr *hdr = (void *)skb->data;
3437 	struct ath10k_skb_cb *cb = ATH10K_SKB_CB(skb);
3438 	u8 *qos_ctl;
3439 
3440 	if (!ieee80211_is_data_qos(hdr->frame_control))
3441 		return;
3442 
3443 	qos_ctl = ieee80211_get_qos_ctl(hdr);
3444 	memmove(skb->data + IEEE80211_QOS_CTL_LEN,
3445 		skb->data, (void *)qos_ctl - (void *)skb->data);
3446 	skb_pull(skb, IEEE80211_QOS_CTL_LEN);
3447 
3448 	/* Some firmware revisions don't handle sending QoS NullFunc well.
3449 	 * These frames are mainly used for CQM purposes so it doesn't really
3450 	 * matter whether QoS NullFunc or NullFunc are sent.
3451 	 */
3452 	hdr = (void *)skb->data;
3453 	if (ieee80211_is_qos_nullfunc(hdr->frame_control))
3454 		cb->flags &= ~ATH10K_SKB_F_QOS;
3455 
3456 	hdr->frame_control &= ~__cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
3457 }
3458 
3459 static void ath10k_tx_h_8023(struct sk_buff *skb)
3460 {
3461 	struct ieee80211_hdr *hdr;
3462 	struct rfc1042_hdr *rfc1042;
3463 	struct ethhdr *eth;
3464 	size_t hdrlen;
3465 	u8 da[ETH_ALEN];
3466 	u8 sa[ETH_ALEN];
3467 	__be16 type;
3468 
3469 	hdr = (void *)skb->data;
3470 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
3471 	rfc1042 = (void *)skb->data + hdrlen;
3472 
3473 	ether_addr_copy(da, ieee80211_get_DA(hdr));
3474 	ether_addr_copy(sa, ieee80211_get_SA(hdr));
3475 	type = rfc1042->snap_type;
3476 
3477 	skb_pull(skb, hdrlen + sizeof(*rfc1042));
3478 	skb_push(skb, sizeof(*eth));
3479 
3480 	eth = (void *)skb->data;
3481 	ether_addr_copy(eth->h_dest, da);
3482 	ether_addr_copy(eth->h_source, sa);
3483 	eth->h_proto = type;
3484 }
3485 
3486 static void ath10k_tx_h_add_p2p_noa_ie(struct ath10k *ar,
3487 				       struct ieee80211_vif *vif,
3488 				       struct sk_buff *skb)
3489 {
3490 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
3491 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
3492 
3493 	/* This is case only for P2P_GO */
3494 	if (vif->type != NL80211_IFTYPE_AP || !vif->p2p)
3495 		return;
3496 
3497 	if (unlikely(ieee80211_is_probe_resp(hdr->frame_control))) {
3498 		spin_lock_bh(&ar->data_lock);
3499 		if (arvif->u.ap.noa_data)
3500 			if (!pskb_expand_head(skb, 0, arvif->u.ap.noa_len,
3501 					      GFP_ATOMIC))
3502 				skb_put_data(skb, arvif->u.ap.noa_data,
3503 					     arvif->u.ap.noa_len);
3504 		spin_unlock_bh(&ar->data_lock);
3505 	}
3506 }
3507 
3508 static void ath10k_mac_tx_h_fill_cb(struct ath10k *ar,
3509 				    struct ieee80211_vif *vif,
3510 				    struct ieee80211_txq *txq,
3511 				    struct sk_buff *skb)
3512 {
3513 	struct ieee80211_hdr *hdr = (void *)skb->data;
3514 	struct ath10k_skb_cb *cb = ATH10K_SKB_CB(skb);
3515 
3516 	cb->flags = 0;
3517 	if (!ath10k_tx_h_use_hwcrypto(vif, skb))
3518 		cb->flags |= ATH10K_SKB_F_NO_HWCRYPT;
3519 
3520 	if (ieee80211_is_mgmt(hdr->frame_control))
3521 		cb->flags |= ATH10K_SKB_F_MGMT;
3522 
3523 	if (ieee80211_is_data_qos(hdr->frame_control))
3524 		cb->flags |= ATH10K_SKB_F_QOS;
3525 
3526 	cb->vif = vif;
3527 	cb->txq = txq;
3528 }
3529 
3530 bool ath10k_mac_tx_frm_has_freq(struct ath10k *ar)
3531 {
3532 	/* FIXME: Not really sure since when the behaviour changed. At some
3533 	 * point new firmware stopped requiring creation of peer entries for
3534 	 * offchannel tx (and actually creating them causes issues with wmi-htc
3535 	 * tx credit replenishment and reliability). Assuming it's at least 3.4
3536 	 * because that's when the `freq` was introduced to TX_FRM HTT command.
3537 	 */
3538 	return (ar->htt.target_version_major >= 3 &&
3539 		ar->htt.target_version_minor >= 4 &&
3540 		ar->running_fw->fw_file.htt_op_version == ATH10K_FW_HTT_OP_VERSION_TLV);
3541 }
3542 
3543 static int ath10k_mac_tx_wmi_mgmt(struct ath10k *ar, struct sk_buff *skb)
3544 {
3545 	struct sk_buff_head *q = &ar->wmi_mgmt_tx_queue;
3546 	int ret = 0;
3547 
3548 	spin_lock_bh(&ar->data_lock);
3549 
3550 	if (skb_queue_len(q) == ATH10K_MAX_NUM_MGMT_PENDING) {
3551 		ath10k_warn(ar, "wmi mgmt tx queue is full\n");
3552 		ret = -ENOSPC;
3553 		goto unlock;
3554 	}
3555 
3556 	__skb_queue_tail(q, skb);
3557 	ieee80211_queue_work(ar->hw, &ar->wmi_mgmt_tx_work);
3558 
3559 unlock:
3560 	spin_unlock_bh(&ar->data_lock);
3561 
3562 	return ret;
3563 }
3564 
3565 static enum ath10k_mac_tx_path
3566 ath10k_mac_tx_h_get_txpath(struct ath10k *ar,
3567 			   struct sk_buff *skb,
3568 			   enum ath10k_hw_txrx_mode txmode)
3569 {
3570 	switch (txmode) {
3571 	case ATH10K_HW_TXRX_RAW:
3572 	case ATH10K_HW_TXRX_NATIVE_WIFI:
3573 	case ATH10K_HW_TXRX_ETHERNET:
3574 		return ATH10K_MAC_TX_HTT;
3575 	case ATH10K_HW_TXRX_MGMT:
3576 		if (test_bit(ATH10K_FW_FEATURE_HAS_WMI_MGMT_TX,
3577 			     ar->running_fw->fw_file.fw_features) ||
3578 			     test_bit(WMI_SERVICE_MGMT_TX_WMI,
3579 				      ar->wmi.svc_map))
3580 			return ATH10K_MAC_TX_WMI_MGMT;
3581 		else if (ar->htt.target_version_major >= 3)
3582 			return ATH10K_MAC_TX_HTT;
3583 		else
3584 			return ATH10K_MAC_TX_HTT_MGMT;
3585 	}
3586 
3587 	return ATH10K_MAC_TX_UNKNOWN;
3588 }
3589 
3590 static int ath10k_mac_tx_submit(struct ath10k *ar,
3591 				enum ath10k_hw_txrx_mode txmode,
3592 				enum ath10k_mac_tx_path txpath,
3593 				struct sk_buff *skb)
3594 {
3595 	struct ath10k_htt *htt = &ar->htt;
3596 	int ret = -EINVAL;
3597 
3598 	switch (txpath) {
3599 	case ATH10K_MAC_TX_HTT:
3600 		ret = htt->tx_ops->htt_tx(htt, txmode, skb);
3601 		break;
3602 	case ATH10K_MAC_TX_HTT_MGMT:
3603 		ret = ath10k_htt_mgmt_tx(htt, skb);
3604 		break;
3605 	case ATH10K_MAC_TX_WMI_MGMT:
3606 		ret = ath10k_mac_tx_wmi_mgmt(ar, skb);
3607 		break;
3608 	case ATH10K_MAC_TX_UNKNOWN:
3609 		WARN_ON_ONCE(1);
3610 		ret = -EINVAL;
3611 		break;
3612 	}
3613 
3614 	if (ret) {
3615 		ath10k_warn(ar, "failed to transmit packet, dropping: %d\n",
3616 			    ret);
3617 		ieee80211_free_txskb(ar->hw, skb);
3618 	}
3619 
3620 	return ret;
3621 }
3622 
3623 /* This function consumes the sk_buff regardless of return value as far as
3624  * caller is concerned so no freeing is necessary afterwards.
3625  */
3626 static int ath10k_mac_tx(struct ath10k *ar,
3627 			 struct ieee80211_vif *vif,
3628 			 enum ath10k_hw_txrx_mode txmode,
3629 			 enum ath10k_mac_tx_path txpath,
3630 			 struct sk_buff *skb)
3631 {
3632 	struct ieee80211_hw *hw = ar->hw;
3633 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
3634 	int ret;
3635 
3636 	/* We should disable CCK RATE due to P2P */
3637 	if (info->flags & IEEE80211_TX_CTL_NO_CCK_RATE)
3638 		ath10k_dbg(ar, ATH10K_DBG_MAC, "IEEE80211_TX_CTL_NO_CCK_RATE\n");
3639 
3640 	switch (txmode) {
3641 	case ATH10K_HW_TXRX_MGMT:
3642 	case ATH10K_HW_TXRX_NATIVE_WIFI:
3643 		ath10k_tx_h_nwifi(hw, skb);
3644 		ath10k_tx_h_add_p2p_noa_ie(ar, vif, skb);
3645 		ath10k_tx_h_seq_no(vif, skb);
3646 		break;
3647 	case ATH10K_HW_TXRX_ETHERNET:
3648 		ath10k_tx_h_8023(skb);
3649 		break;
3650 	case ATH10K_HW_TXRX_RAW:
3651 		if (!test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags)) {
3652 			WARN_ON_ONCE(1);
3653 			ieee80211_free_txskb(hw, skb);
3654 			return -ENOTSUPP;
3655 		}
3656 	}
3657 
3658 	if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) {
3659 		if (!ath10k_mac_tx_frm_has_freq(ar)) {
3660 			ath10k_dbg(ar, ATH10K_DBG_MAC, "queued offchannel skb %pK\n",
3661 				   skb);
3662 
3663 			skb_queue_tail(&ar->offchan_tx_queue, skb);
3664 			ieee80211_queue_work(hw, &ar->offchan_tx_work);
3665 			return 0;
3666 		}
3667 	}
3668 
3669 	ret = ath10k_mac_tx_submit(ar, txmode, txpath, skb);
3670 	if (ret) {
3671 		ath10k_warn(ar, "failed to submit frame: %d\n", ret);
3672 		return ret;
3673 	}
3674 
3675 	return 0;
3676 }
3677 
3678 void ath10k_offchan_tx_purge(struct ath10k *ar)
3679 {
3680 	struct sk_buff *skb;
3681 
3682 	for (;;) {
3683 		skb = skb_dequeue(&ar->offchan_tx_queue);
3684 		if (!skb)
3685 			break;
3686 
3687 		ieee80211_free_txskb(ar->hw, skb);
3688 	}
3689 }
3690 
3691 void ath10k_offchan_tx_work(struct work_struct *work)
3692 {
3693 	struct ath10k *ar = container_of(work, struct ath10k, offchan_tx_work);
3694 	struct ath10k_peer *peer;
3695 	struct ath10k_vif *arvif;
3696 	enum ath10k_hw_txrx_mode txmode;
3697 	enum ath10k_mac_tx_path txpath;
3698 	struct ieee80211_hdr *hdr;
3699 	struct ieee80211_vif *vif;
3700 	struct ieee80211_sta *sta;
3701 	struct sk_buff *skb;
3702 	const u8 *peer_addr;
3703 	int vdev_id;
3704 	int ret;
3705 	unsigned long time_left;
3706 	bool tmp_peer_created = false;
3707 
3708 	/* FW requirement: We must create a peer before FW will send out
3709 	 * an offchannel frame. Otherwise the frame will be stuck and
3710 	 * never transmitted. We delete the peer upon tx completion.
3711 	 * It is unlikely that a peer for offchannel tx will already be
3712 	 * present. However it may be in some rare cases so account for that.
3713 	 * Otherwise we might remove a legitimate peer and break stuff.
3714 	 */
3715 
3716 	for (;;) {
3717 		skb = skb_dequeue(&ar->offchan_tx_queue);
3718 		if (!skb)
3719 			break;
3720 
3721 		mutex_lock(&ar->conf_mutex);
3722 
3723 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac offchannel skb %pK\n",
3724 			   skb);
3725 
3726 		hdr = (struct ieee80211_hdr *)skb->data;
3727 		peer_addr = ieee80211_get_DA(hdr);
3728 
3729 		spin_lock_bh(&ar->data_lock);
3730 		vdev_id = ar->scan.vdev_id;
3731 		peer = ath10k_peer_find(ar, vdev_id, peer_addr);
3732 		spin_unlock_bh(&ar->data_lock);
3733 
3734 		if (peer)
3735 			/* FIXME: should this use ath10k_warn()? */
3736 			ath10k_dbg(ar, ATH10K_DBG_MAC, "peer %pM on vdev %d already present\n",
3737 				   peer_addr, vdev_id);
3738 
3739 		if (!peer) {
3740 			ret = ath10k_peer_create(ar, NULL, NULL, vdev_id,
3741 						 peer_addr,
3742 						 WMI_PEER_TYPE_DEFAULT);
3743 			if (ret)
3744 				ath10k_warn(ar, "failed to create peer %pM on vdev %d: %d\n",
3745 					    peer_addr, vdev_id, ret);
3746 			tmp_peer_created = (ret == 0);
3747 		}
3748 
3749 		spin_lock_bh(&ar->data_lock);
3750 		reinit_completion(&ar->offchan_tx_completed);
3751 		ar->offchan_tx_skb = skb;
3752 		spin_unlock_bh(&ar->data_lock);
3753 
3754 		/* It's safe to access vif and sta - conf_mutex guarantees that
3755 		 * sta_state() and remove_interface() are locked exclusively
3756 		 * out wrt to this offchannel worker.
3757 		 */
3758 		arvif = ath10k_get_arvif(ar, vdev_id);
3759 		if (arvif) {
3760 			vif = arvif->vif;
3761 			sta = ieee80211_find_sta(vif, peer_addr);
3762 		} else {
3763 			vif = NULL;
3764 			sta = NULL;
3765 		}
3766 
3767 		txmode = ath10k_mac_tx_h_get_txmode(ar, vif, sta, skb);
3768 		txpath = ath10k_mac_tx_h_get_txpath(ar, skb, txmode);
3769 
3770 		ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb);
3771 		if (ret) {
3772 			ath10k_warn(ar, "failed to transmit offchannel frame: %d\n",
3773 				    ret);
3774 			/* not serious */
3775 		}
3776 
3777 		time_left =
3778 		wait_for_completion_timeout(&ar->offchan_tx_completed, 3 * HZ);
3779 		if (time_left == 0)
3780 			ath10k_warn(ar, "timed out waiting for offchannel skb %pK\n",
3781 				    skb);
3782 
3783 		if (!peer && tmp_peer_created) {
3784 			ret = ath10k_peer_delete(ar, vdev_id, peer_addr);
3785 			if (ret)
3786 				ath10k_warn(ar, "failed to delete peer %pM on vdev %d: %d\n",
3787 					    peer_addr, vdev_id, ret);
3788 		}
3789 
3790 		mutex_unlock(&ar->conf_mutex);
3791 	}
3792 }
3793 
3794 void ath10k_mgmt_over_wmi_tx_purge(struct ath10k *ar)
3795 {
3796 	struct sk_buff *skb;
3797 
3798 	for (;;) {
3799 		skb = skb_dequeue(&ar->wmi_mgmt_tx_queue);
3800 		if (!skb)
3801 			break;
3802 
3803 		ieee80211_free_txskb(ar->hw, skb);
3804 	}
3805 }
3806 
3807 void ath10k_mgmt_over_wmi_tx_work(struct work_struct *work)
3808 {
3809 	struct ath10k *ar = container_of(work, struct ath10k, wmi_mgmt_tx_work);
3810 	struct sk_buff *skb;
3811 	int ret;
3812 
3813 	for (;;) {
3814 		skb = skb_dequeue(&ar->wmi_mgmt_tx_queue);
3815 		if (!skb)
3816 			break;
3817 
3818 		ret = ath10k_wmi_mgmt_tx(ar, skb);
3819 		if (ret) {
3820 			ath10k_warn(ar, "failed to transmit management frame via WMI: %d\n",
3821 				    ret);
3822 			ieee80211_free_txskb(ar->hw, skb);
3823 		}
3824 	}
3825 }
3826 
3827 static void ath10k_mac_txq_init(struct ieee80211_txq *txq)
3828 {
3829 	struct ath10k_txq *artxq;
3830 
3831 	if (!txq)
3832 		return;
3833 
3834 	artxq = (void *)txq->drv_priv;
3835 	INIT_LIST_HEAD(&artxq->list);
3836 }
3837 
3838 static void ath10k_mac_txq_unref(struct ath10k *ar, struct ieee80211_txq *txq)
3839 {
3840 	struct ath10k_txq *artxq;
3841 	struct ath10k_skb_cb *cb;
3842 	struct sk_buff *msdu;
3843 	int msdu_id;
3844 
3845 	if (!txq)
3846 		return;
3847 
3848 	artxq = (void *)txq->drv_priv;
3849 	spin_lock_bh(&ar->txqs_lock);
3850 	if (!list_empty(&artxq->list))
3851 		list_del_init(&artxq->list);
3852 	spin_unlock_bh(&ar->txqs_lock);
3853 
3854 	spin_lock_bh(&ar->htt.tx_lock);
3855 	idr_for_each_entry(&ar->htt.pending_tx, msdu, msdu_id) {
3856 		cb = ATH10K_SKB_CB(msdu);
3857 		if (cb->txq == txq)
3858 			cb->txq = NULL;
3859 	}
3860 	spin_unlock_bh(&ar->htt.tx_lock);
3861 }
3862 
3863 struct ieee80211_txq *ath10k_mac_txq_lookup(struct ath10k *ar,
3864 					    u16 peer_id,
3865 					    u8 tid)
3866 {
3867 	struct ath10k_peer *peer;
3868 
3869 	lockdep_assert_held(&ar->data_lock);
3870 
3871 	peer = ar->peer_map[peer_id];
3872 	if (!peer)
3873 		return NULL;
3874 
3875 	if (peer->removed)
3876 		return NULL;
3877 
3878 	if (peer->sta)
3879 		return peer->sta->txq[tid];
3880 	else if (peer->vif)
3881 		return peer->vif->txq;
3882 	else
3883 		return NULL;
3884 }
3885 
3886 static bool ath10k_mac_tx_can_push(struct ieee80211_hw *hw,
3887 				   struct ieee80211_txq *txq)
3888 {
3889 	struct ath10k *ar = hw->priv;
3890 	struct ath10k_txq *artxq = (void *)txq->drv_priv;
3891 
3892 	/* No need to get locks */
3893 
3894 	if (ar->htt.tx_q_state.mode == HTT_TX_MODE_SWITCH_PUSH)
3895 		return true;
3896 
3897 	if (ar->htt.num_pending_tx < ar->htt.tx_q_state.num_push_allowed)
3898 		return true;
3899 
3900 	if (artxq->num_fw_queued < artxq->num_push_allowed)
3901 		return true;
3902 
3903 	return false;
3904 }
3905 
3906 int ath10k_mac_tx_push_txq(struct ieee80211_hw *hw,
3907 			   struct ieee80211_txq *txq)
3908 {
3909 	struct ath10k *ar = hw->priv;
3910 	struct ath10k_htt *htt = &ar->htt;
3911 	struct ath10k_txq *artxq = (void *)txq->drv_priv;
3912 	struct ieee80211_vif *vif = txq->vif;
3913 	struct ieee80211_sta *sta = txq->sta;
3914 	enum ath10k_hw_txrx_mode txmode;
3915 	enum ath10k_mac_tx_path txpath;
3916 	struct sk_buff *skb;
3917 	struct ieee80211_hdr *hdr;
3918 	size_t skb_len;
3919 	bool is_mgmt, is_presp;
3920 	int ret;
3921 
3922 	spin_lock_bh(&ar->htt.tx_lock);
3923 	ret = ath10k_htt_tx_inc_pending(htt);
3924 	spin_unlock_bh(&ar->htt.tx_lock);
3925 
3926 	if (ret)
3927 		return ret;
3928 
3929 	skb = ieee80211_tx_dequeue(hw, txq);
3930 	if (!skb) {
3931 		spin_lock_bh(&ar->htt.tx_lock);
3932 		ath10k_htt_tx_dec_pending(htt);
3933 		spin_unlock_bh(&ar->htt.tx_lock);
3934 
3935 		return -ENOENT;
3936 	}
3937 
3938 	ath10k_mac_tx_h_fill_cb(ar, vif, txq, skb);
3939 
3940 	skb_len = skb->len;
3941 	txmode = ath10k_mac_tx_h_get_txmode(ar, vif, sta, skb);
3942 	txpath = ath10k_mac_tx_h_get_txpath(ar, skb, txmode);
3943 	is_mgmt = (txpath == ATH10K_MAC_TX_HTT_MGMT);
3944 
3945 	if (is_mgmt) {
3946 		hdr = (struct ieee80211_hdr *)skb->data;
3947 		is_presp = ieee80211_is_probe_resp(hdr->frame_control);
3948 
3949 		spin_lock_bh(&ar->htt.tx_lock);
3950 		ret = ath10k_htt_tx_mgmt_inc_pending(htt, is_mgmt, is_presp);
3951 
3952 		if (ret) {
3953 			ath10k_htt_tx_dec_pending(htt);
3954 			spin_unlock_bh(&ar->htt.tx_lock);
3955 			return ret;
3956 		}
3957 		spin_unlock_bh(&ar->htt.tx_lock);
3958 	}
3959 
3960 	ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb);
3961 	if (unlikely(ret)) {
3962 		ath10k_warn(ar, "failed to push frame: %d\n", ret);
3963 
3964 		spin_lock_bh(&ar->htt.tx_lock);
3965 		ath10k_htt_tx_dec_pending(htt);
3966 		if (is_mgmt)
3967 			ath10k_htt_tx_mgmt_dec_pending(htt);
3968 		spin_unlock_bh(&ar->htt.tx_lock);
3969 
3970 		return ret;
3971 	}
3972 
3973 	spin_lock_bh(&ar->htt.tx_lock);
3974 	artxq->num_fw_queued++;
3975 	spin_unlock_bh(&ar->htt.tx_lock);
3976 
3977 	return skb_len;
3978 }
3979 
3980 void ath10k_mac_tx_push_pending(struct ath10k *ar)
3981 {
3982 	struct ieee80211_hw *hw = ar->hw;
3983 	struct ieee80211_txq *txq;
3984 	struct ath10k_txq *artxq;
3985 	struct ath10k_txq *last;
3986 	int ret;
3987 	int max;
3988 
3989 	if (ar->htt.num_pending_tx >= (ar->htt.max_num_pending_tx / 2))
3990 		return;
3991 
3992 	spin_lock_bh(&ar->txqs_lock);
3993 	rcu_read_lock();
3994 
3995 	last = list_last_entry(&ar->txqs, struct ath10k_txq, list);
3996 	while (!list_empty(&ar->txqs)) {
3997 		artxq = list_first_entry(&ar->txqs, struct ath10k_txq, list);
3998 		txq = container_of((void *)artxq, struct ieee80211_txq,
3999 				   drv_priv);
4000 
4001 		/* Prevent aggressive sta/tid taking over tx queue */
4002 		max = 16;
4003 		ret = 0;
4004 		while (ath10k_mac_tx_can_push(hw, txq) && max--) {
4005 			ret = ath10k_mac_tx_push_txq(hw, txq);
4006 			if (ret < 0)
4007 				break;
4008 		}
4009 
4010 		list_del_init(&artxq->list);
4011 		if (ret != -ENOENT)
4012 			list_add_tail(&artxq->list, &ar->txqs);
4013 
4014 		ath10k_htt_tx_txq_update(hw, txq);
4015 
4016 		if (artxq == last || (ret < 0 && ret != -ENOENT))
4017 			break;
4018 	}
4019 
4020 	rcu_read_unlock();
4021 	spin_unlock_bh(&ar->txqs_lock);
4022 }
4023 
4024 /************/
4025 /* Scanning */
4026 /************/
4027 
4028 void __ath10k_scan_finish(struct ath10k *ar)
4029 {
4030 	lockdep_assert_held(&ar->data_lock);
4031 
4032 	switch (ar->scan.state) {
4033 	case ATH10K_SCAN_IDLE:
4034 		break;
4035 	case ATH10K_SCAN_RUNNING:
4036 	case ATH10K_SCAN_ABORTING:
4037 		if (!ar->scan.is_roc) {
4038 			struct cfg80211_scan_info info = {
4039 				.aborted = (ar->scan.state ==
4040 					    ATH10K_SCAN_ABORTING),
4041 			};
4042 
4043 			ieee80211_scan_completed(ar->hw, &info);
4044 		} else if (ar->scan.roc_notify) {
4045 			ieee80211_remain_on_channel_expired(ar->hw);
4046 		}
4047 		/* fall through */
4048 	case ATH10K_SCAN_STARTING:
4049 		ar->scan.state = ATH10K_SCAN_IDLE;
4050 		ar->scan_channel = NULL;
4051 		ar->scan.roc_freq = 0;
4052 		ath10k_offchan_tx_purge(ar);
4053 		cancel_delayed_work(&ar->scan.timeout);
4054 		complete(&ar->scan.completed);
4055 		break;
4056 	}
4057 }
4058 
4059 void ath10k_scan_finish(struct ath10k *ar)
4060 {
4061 	spin_lock_bh(&ar->data_lock);
4062 	__ath10k_scan_finish(ar);
4063 	spin_unlock_bh(&ar->data_lock);
4064 }
4065 
4066 static int ath10k_scan_stop(struct ath10k *ar)
4067 {
4068 	struct wmi_stop_scan_arg arg = {
4069 		.req_id = 1, /* FIXME */
4070 		.req_type = WMI_SCAN_STOP_ONE,
4071 		.u.scan_id = ATH10K_SCAN_ID,
4072 	};
4073 	int ret;
4074 
4075 	lockdep_assert_held(&ar->conf_mutex);
4076 
4077 	ret = ath10k_wmi_stop_scan(ar, &arg);
4078 	if (ret) {
4079 		ath10k_warn(ar, "failed to stop wmi scan: %d\n", ret);
4080 		goto out;
4081 	}
4082 
4083 	ret = wait_for_completion_timeout(&ar->scan.completed, 3 * HZ);
4084 	if (ret == 0) {
4085 		ath10k_warn(ar, "failed to receive scan abortion completion: timed out\n");
4086 		ret = -ETIMEDOUT;
4087 	} else if (ret > 0) {
4088 		ret = 0;
4089 	}
4090 
4091 out:
4092 	/* Scan state should be updated upon scan completion but in case
4093 	 * firmware fails to deliver the event (for whatever reason) it is
4094 	 * desired to clean up scan state anyway. Firmware may have just
4095 	 * dropped the scan completion event delivery due to transport pipe
4096 	 * being overflown with data and/or it can recover on its own before
4097 	 * next scan request is submitted.
4098 	 */
4099 	spin_lock_bh(&ar->data_lock);
4100 	if (ar->scan.state != ATH10K_SCAN_IDLE)
4101 		__ath10k_scan_finish(ar);
4102 	spin_unlock_bh(&ar->data_lock);
4103 
4104 	return ret;
4105 }
4106 
4107 static void ath10k_scan_abort(struct ath10k *ar)
4108 {
4109 	int ret;
4110 
4111 	lockdep_assert_held(&ar->conf_mutex);
4112 
4113 	spin_lock_bh(&ar->data_lock);
4114 
4115 	switch (ar->scan.state) {
4116 	case ATH10K_SCAN_IDLE:
4117 		/* This can happen if timeout worker kicked in and called
4118 		 * abortion while scan completion was being processed.
4119 		 */
4120 		break;
4121 	case ATH10K_SCAN_STARTING:
4122 	case ATH10K_SCAN_ABORTING:
4123 		ath10k_warn(ar, "refusing scan abortion due to invalid scan state: %s (%d)\n",
4124 			    ath10k_scan_state_str(ar->scan.state),
4125 			    ar->scan.state);
4126 		break;
4127 	case ATH10K_SCAN_RUNNING:
4128 		ar->scan.state = ATH10K_SCAN_ABORTING;
4129 		spin_unlock_bh(&ar->data_lock);
4130 
4131 		ret = ath10k_scan_stop(ar);
4132 		if (ret)
4133 			ath10k_warn(ar, "failed to abort scan: %d\n", ret);
4134 
4135 		spin_lock_bh(&ar->data_lock);
4136 		break;
4137 	}
4138 
4139 	spin_unlock_bh(&ar->data_lock);
4140 }
4141 
4142 void ath10k_scan_timeout_work(struct work_struct *work)
4143 {
4144 	struct ath10k *ar = container_of(work, struct ath10k,
4145 					 scan.timeout.work);
4146 
4147 	mutex_lock(&ar->conf_mutex);
4148 	ath10k_scan_abort(ar);
4149 	mutex_unlock(&ar->conf_mutex);
4150 }
4151 
4152 static int ath10k_start_scan(struct ath10k *ar,
4153 			     const struct wmi_start_scan_arg *arg)
4154 {
4155 	int ret;
4156 
4157 	lockdep_assert_held(&ar->conf_mutex);
4158 
4159 	ret = ath10k_wmi_start_scan(ar, arg);
4160 	if (ret)
4161 		return ret;
4162 
4163 	ret = wait_for_completion_timeout(&ar->scan.started, 1 * HZ);
4164 	if (ret == 0) {
4165 		ret = ath10k_scan_stop(ar);
4166 		if (ret)
4167 			ath10k_warn(ar, "failed to stop scan: %d\n", ret);
4168 
4169 		return -ETIMEDOUT;
4170 	}
4171 
4172 	/* If we failed to start the scan, return error code at
4173 	 * this point.  This is probably due to some issue in the
4174 	 * firmware, but no need to wedge the driver due to that...
4175 	 */
4176 	spin_lock_bh(&ar->data_lock);
4177 	if (ar->scan.state == ATH10K_SCAN_IDLE) {
4178 		spin_unlock_bh(&ar->data_lock);
4179 		return -EINVAL;
4180 	}
4181 	spin_unlock_bh(&ar->data_lock);
4182 
4183 	return 0;
4184 }
4185 
4186 /**********************/
4187 /* mac80211 callbacks */
4188 /**********************/
4189 
4190 static void ath10k_mac_op_tx(struct ieee80211_hw *hw,
4191 			     struct ieee80211_tx_control *control,
4192 			     struct sk_buff *skb)
4193 {
4194 	struct ath10k *ar = hw->priv;
4195 	struct ath10k_htt *htt = &ar->htt;
4196 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
4197 	struct ieee80211_vif *vif = info->control.vif;
4198 	struct ieee80211_sta *sta = control->sta;
4199 	struct ieee80211_txq *txq = NULL;
4200 	struct ieee80211_hdr *hdr = (void *)skb->data;
4201 	enum ath10k_hw_txrx_mode txmode;
4202 	enum ath10k_mac_tx_path txpath;
4203 	bool is_htt;
4204 	bool is_mgmt;
4205 	bool is_presp;
4206 	int ret;
4207 
4208 	ath10k_mac_tx_h_fill_cb(ar, vif, txq, skb);
4209 
4210 	txmode = ath10k_mac_tx_h_get_txmode(ar, vif, sta, skb);
4211 	txpath = ath10k_mac_tx_h_get_txpath(ar, skb, txmode);
4212 	is_htt = (txpath == ATH10K_MAC_TX_HTT ||
4213 		  txpath == ATH10K_MAC_TX_HTT_MGMT);
4214 	is_mgmt = (txpath == ATH10K_MAC_TX_HTT_MGMT);
4215 
4216 	if (is_htt) {
4217 		spin_lock_bh(&ar->htt.tx_lock);
4218 		is_presp = ieee80211_is_probe_resp(hdr->frame_control);
4219 
4220 		ret = ath10k_htt_tx_inc_pending(htt);
4221 		if (ret) {
4222 			ath10k_warn(ar, "failed to increase tx pending count: %d, dropping\n",
4223 				    ret);
4224 			spin_unlock_bh(&ar->htt.tx_lock);
4225 			ieee80211_free_txskb(ar->hw, skb);
4226 			return;
4227 		}
4228 
4229 		ret = ath10k_htt_tx_mgmt_inc_pending(htt, is_mgmt, is_presp);
4230 		if (ret) {
4231 			ath10k_dbg(ar, ATH10K_DBG_MAC, "failed to increase tx mgmt pending count: %d, dropping\n",
4232 				   ret);
4233 			ath10k_htt_tx_dec_pending(htt);
4234 			spin_unlock_bh(&ar->htt.tx_lock);
4235 			ieee80211_free_txskb(ar->hw, skb);
4236 			return;
4237 		}
4238 		spin_unlock_bh(&ar->htt.tx_lock);
4239 	}
4240 
4241 	ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb);
4242 	if (ret) {
4243 		ath10k_warn(ar, "failed to transmit frame: %d\n", ret);
4244 		if (is_htt) {
4245 			spin_lock_bh(&ar->htt.tx_lock);
4246 			ath10k_htt_tx_dec_pending(htt);
4247 			if (is_mgmt)
4248 				ath10k_htt_tx_mgmt_dec_pending(htt);
4249 			spin_unlock_bh(&ar->htt.tx_lock);
4250 		}
4251 		return;
4252 	}
4253 }
4254 
4255 static void ath10k_mac_op_wake_tx_queue(struct ieee80211_hw *hw,
4256 					struct ieee80211_txq *txq)
4257 {
4258 	struct ath10k *ar = hw->priv;
4259 	struct ath10k_txq *artxq = (void *)txq->drv_priv;
4260 	struct ieee80211_txq *f_txq;
4261 	struct ath10k_txq *f_artxq;
4262 	int ret = 0;
4263 	int max = 16;
4264 
4265 	spin_lock_bh(&ar->txqs_lock);
4266 	if (list_empty(&artxq->list))
4267 		list_add_tail(&artxq->list, &ar->txqs);
4268 
4269 	f_artxq = list_first_entry(&ar->txqs, struct ath10k_txq, list);
4270 	f_txq = container_of((void *)f_artxq, struct ieee80211_txq, drv_priv);
4271 	list_del_init(&f_artxq->list);
4272 
4273 	while (ath10k_mac_tx_can_push(hw, f_txq) && max--) {
4274 		ret = ath10k_mac_tx_push_txq(hw, f_txq);
4275 		if (ret)
4276 			break;
4277 	}
4278 	if (ret != -ENOENT)
4279 		list_add_tail(&f_artxq->list, &ar->txqs);
4280 	spin_unlock_bh(&ar->txqs_lock);
4281 
4282 	ath10k_htt_tx_txq_update(hw, f_txq);
4283 	ath10k_htt_tx_txq_update(hw, txq);
4284 }
4285 
4286 /* Must not be called with conf_mutex held as workers can use that also. */
4287 void ath10k_drain_tx(struct ath10k *ar)
4288 {
4289 	/* make sure rcu-protected mac80211 tx path itself is drained */
4290 	synchronize_net();
4291 
4292 	ath10k_offchan_tx_purge(ar);
4293 	ath10k_mgmt_over_wmi_tx_purge(ar);
4294 
4295 	cancel_work_sync(&ar->offchan_tx_work);
4296 	cancel_work_sync(&ar->wmi_mgmt_tx_work);
4297 }
4298 
4299 void ath10k_halt(struct ath10k *ar)
4300 {
4301 	struct ath10k_vif *arvif;
4302 
4303 	lockdep_assert_held(&ar->conf_mutex);
4304 
4305 	clear_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
4306 	ar->filter_flags = 0;
4307 	ar->monitor = false;
4308 	ar->monitor_arvif = NULL;
4309 
4310 	if (ar->monitor_started)
4311 		ath10k_monitor_stop(ar);
4312 
4313 	ar->monitor_started = false;
4314 	ar->tx_paused = 0;
4315 
4316 	ath10k_scan_finish(ar);
4317 	ath10k_peer_cleanup_all(ar);
4318 	ath10k_core_stop(ar);
4319 	ath10k_hif_power_down(ar);
4320 
4321 	spin_lock_bh(&ar->data_lock);
4322 	list_for_each_entry(arvif, &ar->arvifs, list)
4323 		ath10k_mac_vif_beacon_cleanup(arvif);
4324 	spin_unlock_bh(&ar->data_lock);
4325 }
4326 
4327 static int ath10k_get_antenna(struct ieee80211_hw *hw, u32 *tx_ant, u32 *rx_ant)
4328 {
4329 	struct ath10k *ar = hw->priv;
4330 
4331 	mutex_lock(&ar->conf_mutex);
4332 
4333 	*tx_ant = ar->cfg_tx_chainmask;
4334 	*rx_ant = ar->cfg_rx_chainmask;
4335 
4336 	mutex_unlock(&ar->conf_mutex);
4337 
4338 	return 0;
4339 }
4340 
4341 static void ath10k_check_chain_mask(struct ath10k *ar, u32 cm, const char *dbg)
4342 {
4343 	/* It is not clear that allowing gaps in chainmask
4344 	 * is helpful.  Probably it will not do what user
4345 	 * is hoping for, so warn in that case.
4346 	 */
4347 	if (cm == 15 || cm == 7 || cm == 3 || cm == 1 || cm == 0)
4348 		return;
4349 
4350 	ath10k_warn(ar, "mac %s antenna chainmask may be invalid: 0x%x.  Suggested values: 15, 7, 3, 1 or 0.\n",
4351 		    dbg, cm);
4352 }
4353 
4354 static int ath10k_mac_get_vht_cap_bf_sts(struct ath10k *ar)
4355 {
4356 	int nsts = ar->vht_cap_info;
4357 
4358 	nsts &= IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
4359 	nsts >>= IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT;
4360 
4361 	/* If firmware does not deliver to host number of space-time
4362 	 * streams supported, assume it support up to 4 BF STS and return
4363 	 * the value for VHT CAP: nsts-1)
4364 	 */
4365 	if (nsts == 0)
4366 		return 3;
4367 
4368 	return nsts;
4369 }
4370 
4371 static int ath10k_mac_get_vht_cap_bf_sound_dim(struct ath10k *ar)
4372 {
4373 	int sound_dim = ar->vht_cap_info;
4374 
4375 	sound_dim &= IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK;
4376 	sound_dim >>= IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT;
4377 
4378 	/* If the sounding dimension is not advertised by the firmware,
4379 	 * let's use a default value of 1
4380 	 */
4381 	if (sound_dim == 0)
4382 		return 1;
4383 
4384 	return sound_dim;
4385 }
4386 
4387 static struct ieee80211_sta_vht_cap ath10k_create_vht_cap(struct ath10k *ar)
4388 {
4389 	struct ieee80211_sta_vht_cap vht_cap = {0};
4390 	struct ath10k_hw_params *hw = &ar->hw_params;
4391 	u16 mcs_map;
4392 	u32 val;
4393 	int i;
4394 
4395 	vht_cap.vht_supported = 1;
4396 	vht_cap.cap = ar->vht_cap_info;
4397 
4398 	if (ar->vht_cap_info & (IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
4399 				IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE)) {
4400 		val = ath10k_mac_get_vht_cap_bf_sts(ar);
4401 		val <<= IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT;
4402 		val &= IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
4403 
4404 		vht_cap.cap |= val;
4405 	}
4406 
4407 	if (ar->vht_cap_info & (IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
4408 				IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)) {
4409 		val = ath10k_mac_get_vht_cap_bf_sound_dim(ar);
4410 		val <<= IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT;
4411 		val &= IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK;
4412 
4413 		vht_cap.cap |= val;
4414 	}
4415 
4416 	/* Currently the firmware seems to be buggy, don't enable 80+80
4417 	 * mode until that's resolved.
4418 	 */
4419 	if ((ar->vht_cap_info & IEEE80211_VHT_CAP_SHORT_GI_160) &&
4420 	    (ar->vht_cap_info & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) == 0)
4421 		vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
4422 
4423 	mcs_map = 0;
4424 	for (i = 0; i < 8; i++) {
4425 		if ((i < ar->num_rf_chains) && (ar->cfg_tx_chainmask & BIT(i)))
4426 			mcs_map |= IEEE80211_VHT_MCS_SUPPORT_0_9 << (i * 2);
4427 		else
4428 			mcs_map |= IEEE80211_VHT_MCS_NOT_SUPPORTED << (i * 2);
4429 	}
4430 
4431 	if (ar->cfg_tx_chainmask <= 1)
4432 		vht_cap.cap &= ~IEEE80211_VHT_CAP_TXSTBC;
4433 
4434 	vht_cap.vht_mcs.rx_mcs_map = cpu_to_le16(mcs_map);
4435 	vht_cap.vht_mcs.tx_mcs_map = cpu_to_le16(mcs_map);
4436 
4437 	/* If we are supporting 160Mhz or 80+80, then the NIC may be able to do
4438 	 * a restricted NSS for 160 or 80+80 vs what it can do for 80Mhz.  Give
4439 	 * user-space a clue if that is the case.
4440 	 */
4441 	if ((vht_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) &&
4442 	    (hw->vht160_mcs_rx_highest != 0 ||
4443 	     hw->vht160_mcs_tx_highest != 0)) {
4444 		vht_cap.vht_mcs.rx_highest = cpu_to_le16(hw->vht160_mcs_rx_highest);
4445 		vht_cap.vht_mcs.tx_highest = cpu_to_le16(hw->vht160_mcs_tx_highest);
4446 	}
4447 
4448 	return vht_cap;
4449 }
4450 
4451 static struct ieee80211_sta_ht_cap ath10k_get_ht_cap(struct ath10k *ar)
4452 {
4453 	int i;
4454 	struct ieee80211_sta_ht_cap ht_cap = {0};
4455 
4456 	if (!(ar->ht_cap_info & WMI_HT_CAP_ENABLED))
4457 		return ht_cap;
4458 
4459 	ht_cap.ht_supported = 1;
4460 	ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
4461 	ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_8;
4462 	ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
4463 	ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
4464 	ht_cap.cap |=
4465 		WLAN_HT_CAP_SM_PS_DISABLED << IEEE80211_HT_CAP_SM_PS_SHIFT;
4466 
4467 	if (ar->ht_cap_info & WMI_HT_CAP_HT20_SGI)
4468 		ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
4469 
4470 	if (ar->ht_cap_info & WMI_HT_CAP_HT40_SGI)
4471 		ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
4472 
4473 	if (ar->ht_cap_info & WMI_HT_CAP_DYNAMIC_SMPS) {
4474 		u32 smps;
4475 
4476 		smps   = WLAN_HT_CAP_SM_PS_DYNAMIC;
4477 		smps <<= IEEE80211_HT_CAP_SM_PS_SHIFT;
4478 
4479 		ht_cap.cap |= smps;
4480 	}
4481 
4482 	if (ar->ht_cap_info & WMI_HT_CAP_TX_STBC && (ar->cfg_tx_chainmask > 1))
4483 		ht_cap.cap |= IEEE80211_HT_CAP_TX_STBC;
4484 
4485 	if (ar->ht_cap_info & WMI_HT_CAP_RX_STBC) {
4486 		u32 stbc;
4487 
4488 		stbc   = ar->ht_cap_info;
4489 		stbc  &= WMI_HT_CAP_RX_STBC;
4490 		stbc >>= WMI_HT_CAP_RX_STBC_MASK_SHIFT;
4491 		stbc <<= IEEE80211_HT_CAP_RX_STBC_SHIFT;
4492 		stbc  &= IEEE80211_HT_CAP_RX_STBC;
4493 
4494 		ht_cap.cap |= stbc;
4495 	}
4496 
4497 	if (ar->ht_cap_info & WMI_HT_CAP_LDPC)
4498 		ht_cap.cap |= IEEE80211_HT_CAP_LDPC_CODING;
4499 
4500 	if (ar->ht_cap_info & WMI_HT_CAP_L_SIG_TXOP_PROT)
4501 		ht_cap.cap |= IEEE80211_HT_CAP_LSIG_TXOP_PROT;
4502 
4503 	/* max AMSDU is implicitly taken from vht_cap_info */
4504 	if (ar->vht_cap_info & WMI_VHT_CAP_MAX_MPDU_LEN_MASK)
4505 		ht_cap.cap |= IEEE80211_HT_CAP_MAX_AMSDU;
4506 
4507 	for (i = 0; i < ar->num_rf_chains; i++) {
4508 		if (ar->cfg_rx_chainmask & BIT(i))
4509 			ht_cap.mcs.rx_mask[i] = 0xFF;
4510 	}
4511 
4512 	ht_cap.mcs.tx_params |= IEEE80211_HT_MCS_TX_DEFINED;
4513 
4514 	return ht_cap;
4515 }
4516 
4517 static void ath10k_mac_setup_ht_vht_cap(struct ath10k *ar)
4518 {
4519 	struct ieee80211_supported_band *band;
4520 	struct ieee80211_sta_vht_cap vht_cap;
4521 	struct ieee80211_sta_ht_cap ht_cap;
4522 
4523 	ht_cap = ath10k_get_ht_cap(ar);
4524 	vht_cap = ath10k_create_vht_cap(ar);
4525 
4526 	if (ar->phy_capability & WHAL_WLAN_11G_CAPABILITY) {
4527 		band = &ar->mac.sbands[NL80211_BAND_2GHZ];
4528 		band->ht_cap = ht_cap;
4529 	}
4530 	if (ar->phy_capability & WHAL_WLAN_11A_CAPABILITY) {
4531 		band = &ar->mac.sbands[NL80211_BAND_5GHZ];
4532 		band->ht_cap = ht_cap;
4533 		band->vht_cap = vht_cap;
4534 	}
4535 }
4536 
4537 static int __ath10k_set_antenna(struct ath10k *ar, u32 tx_ant, u32 rx_ant)
4538 {
4539 	int ret;
4540 
4541 	lockdep_assert_held(&ar->conf_mutex);
4542 
4543 	ath10k_check_chain_mask(ar, tx_ant, "tx");
4544 	ath10k_check_chain_mask(ar, rx_ant, "rx");
4545 
4546 	ar->cfg_tx_chainmask = tx_ant;
4547 	ar->cfg_rx_chainmask = rx_ant;
4548 
4549 	if ((ar->state != ATH10K_STATE_ON) &&
4550 	    (ar->state != ATH10K_STATE_RESTARTED))
4551 		return 0;
4552 
4553 	ret = ath10k_wmi_pdev_set_param(ar, ar->wmi.pdev_param->tx_chain_mask,
4554 					tx_ant);
4555 	if (ret) {
4556 		ath10k_warn(ar, "failed to set tx-chainmask: %d, req 0x%x\n",
4557 			    ret, tx_ant);
4558 		return ret;
4559 	}
4560 
4561 	ret = ath10k_wmi_pdev_set_param(ar, ar->wmi.pdev_param->rx_chain_mask,
4562 					rx_ant);
4563 	if (ret) {
4564 		ath10k_warn(ar, "failed to set rx-chainmask: %d, req 0x%x\n",
4565 			    ret, rx_ant);
4566 		return ret;
4567 	}
4568 
4569 	/* Reload HT/VHT capability */
4570 	ath10k_mac_setup_ht_vht_cap(ar);
4571 
4572 	return 0;
4573 }
4574 
4575 static int ath10k_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
4576 {
4577 	struct ath10k *ar = hw->priv;
4578 	int ret;
4579 
4580 	mutex_lock(&ar->conf_mutex);
4581 	ret = __ath10k_set_antenna(ar, tx_ant, rx_ant);
4582 	mutex_unlock(&ar->conf_mutex);
4583 	return ret;
4584 }
4585 
4586 static int ath10k_start(struct ieee80211_hw *hw)
4587 {
4588 	struct ath10k *ar = hw->priv;
4589 	u32 param;
4590 	int ret = 0;
4591 
4592 	/*
4593 	 * This makes sense only when restarting hw. It is harmless to call
4594 	 * unconditionally. This is necessary to make sure no HTT/WMI tx
4595 	 * commands will be submitted while restarting.
4596 	 */
4597 	ath10k_drain_tx(ar);
4598 
4599 	mutex_lock(&ar->conf_mutex);
4600 
4601 	switch (ar->state) {
4602 	case ATH10K_STATE_OFF:
4603 		ar->state = ATH10K_STATE_ON;
4604 		break;
4605 	case ATH10K_STATE_RESTARTING:
4606 		ar->state = ATH10K_STATE_RESTARTED;
4607 		break;
4608 	case ATH10K_STATE_ON:
4609 	case ATH10K_STATE_RESTARTED:
4610 	case ATH10K_STATE_WEDGED:
4611 		WARN_ON(1);
4612 		ret = -EINVAL;
4613 		goto err;
4614 	case ATH10K_STATE_UTF:
4615 		ret = -EBUSY;
4616 		goto err;
4617 	}
4618 
4619 	ret = ath10k_hif_power_up(ar);
4620 	if (ret) {
4621 		ath10k_err(ar, "Could not init hif: %d\n", ret);
4622 		goto err_off;
4623 	}
4624 
4625 	ret = ath10k_core_start(ar, ATH10K_FIRMWARE_MODE_NORMAL,
4626 				&ar->normal_mode_fw);
4627 	if (ret) {
4628 		ath10k_err(ar, "Could not init core: %d\n", ret);
4629 		goto err_power_down;
4630 	}
4631 
4632 	param = ar->wmi.pdev_param->pmf_qos;
4633 	ret = ath10k_wmi_pdev_set_param(ar, param, 1);
4634 	if (ret) {
4635 		ath10k_warn(ar, "failed to enable PMF QOS: %d\n", ret);
4636 		goto err_core_stop;
4637 	}
4638 
4639 	param = ar->wmi.pdev_param->dynamic_bw;
4640 	ret = ath10k_wmi_pdev_set_param(ar, param, 1);
4641 	if (ret) {
4642 		ath10k_warn(ar, "failed to enable dynamic BW: %d\n", ret);
4643 		goto err_core_stop;
4644 	}
4645 
4646 	if (test_bit(WMI_SERVICE_ADAPTIVE_OCS, ar->wmi.svc_map)) {
4647 		ret = ath10k_wmi_adaptive_qcs(ar, true);
4648 		if (ret) {
4649 			ath10k_warn(ar, "failed to enable adaptive qcs: %d\n",
4650 				    ret);
4651 			goto err_core_stop;
4652 		}
4653 	}
4654 
4655 	if (test_bit(WMI_SERVICE_BURST, ar->wmi.svc_map)) {
4656 		param = ar->wmi.pdev_param->burst_enable;
4657 		ret = ath10k_wmi_pdev_set_param(ar, param, 0);
4658 		if (ret) {
4659 			ath10k_warn(ar, "failed to disable burst: %d\n", ret);
4660 			goto err_core_stop;
4661 		}
4662 	}
4663 
4664 	__ath10k_set_antenna(ar, ar->cfg_tx_chainmask, ar->cfg_rx_chainmask);
4665 
4666 	/*
4667 	 * By default FW set ARP frames ac to voice (6). In that case ARP
4668 	 * exchange is not working properly for UAPSD enabled AP. ARP requests
4669 	 * which arrives with access category 0 are processed by network stack
4670 	 * and send back with access category 0, but FW changes access category
4671 	 * to 6. Set ARP frames access category to best effort (0) solves
4672 	 * this problem.
4673 	 */
4674 
4675 	param = ar->wmi.pdev_param->arp_ac_override;
4676 	ret = ath10k_wmi_pdev_set_param(ar, param, 0);
4677 	if (ret) {
4678 		ath10k_warn(ar, "failed to set arp ac override parameter: %d\n",
4679 			    ret);
4680 		goto err_core_stop;
4681 	}
4682 
4683 	if (test_bit(ATH10K_FW_FEATURE_SUPPORTS_ADAPTIVE_CCA,
4684 		     ar->running_fw->fw_file.fw_features)) {
4685 		ret = ath10k_wmi_pdev_enable_adaptive_cca(ar, 1,
4686 							  WMI_CCA_DETECT_LEVEL_AUTO,
4687 							  WMI_CCA_DETECT_MARGIN_AUTO);
4688 		if (ret) {
4689 			ath10k_warn(ar, "failed to enable adaptive cca: %d\n",
4690 				    ret);
4691 			goto err_core_stop;
4692 		}
4693 	}
4694 
4695 	param = ar->wmi.pdev_param->ani_enable;
4696 	ret = ath10k_wmi_pdev_set_param(ar, param, 1);
4697 	if (ret) {
4698 		ath10k_warn(ar, "failed to enable ani by default: %d\n",
4699 			    ret);
4700 		goto err_core_stop;
4701 	}
4702 
4703 	ar->ani_enabled = true;
4704 
4705 	if (ath10k_peer_stats_enabled(ar)) {
4706 		param = ar->wmi.pdev_param->peer_stats_update_period;
4707 		ret = ath10k_wmi_pdev_set_param(ar, param,
4708 						PEER_DEFAULT_STATS_UPDATE_PERIOD);
4709 		if (ret) {
4710 			ath10k_warn(ar,
4711 				    "failed to set peer stats period : %d\n",
4712 				    ret);
4713 			goto err_core_stop;
4714 		}
4715 	}
4716 
4717 	param = ar->wmi.pdev_param->enable_btcoex;
4718 	if (test_bit(WMI_SERVICE_COEX_GPIO, ar->wmi.svc_map) &&
4719 	    test_bit(ATH10K_FW_FEATURE_BTCOEX_PARAM,
4720 		     ar->running_fw->fw_file.fw_features)) {
4721 		ret = ath10k_wmi_pdev_set_param(ar, param, 0);
4722 		if (ret) {
4723 			ath10k_warn(ar,
4724 				    "failed to set btcoex param: %d\n", ret);
4725 			goto err_core_stop;
4726 		}
4727 		clear_bit(ATH10K_FLAG_BTCOEX, &ar->dev_flags);
4728 	}
4729 
4730 	ar->num_started_vdevs = 0;
4731 	ath10k_regd_update(ar);
4732 
4733 	ath10k_spectral_start(ar);
4734 	ath10k_thermal_set_throttling(ar);
4735 
4736 	mutex_unlock(&ar->conf_mutex);
4737 	return 0;
4738 
4739 err_core_stop:
4740 	ath10k_core_stop(ar);
4741 
4742 err_power_down:
4743 	ath10k_hif_power_down(ar);
4744 
4745 err_off:
4746 	ar->state = ATH10K_STATE_OFF;
4747 
4748 err:
4749 	mutex_unlock(&ar->conf_mutex);
4750 	return ret;
4751 }
4752 
4753 static void ath10k_stop(struct ieee80211_hw *hw)
4754 {
4755 	struct ath10k *ar = hw->priv;
4756 
4757 	ath10k_drain_tx(ar);
4758 
4759 	mutex_lock(&ar->conf_mutex);
4760 	if (ar->state != ATH10K_STATE_OFF) {
4761 		ath10k_halt(ar);
4762 		ar->state = ATH10K_STATE_OFF;
4763 	}
4764 	mutex_unlock(&ar->conf_mutex);
4765 
4766 	cancel_work_sync(&ar->set_coverage_class_work);
4767 	cancel_delayed_work_sync(&ar->scan.timeout);
4768 	cancel_work_sync(&ar->restart_work);
4769 }
4770 
4771 static int ath10k_config_ps(struct ath10k *ar)
4772 {
4773 	struct ath10k_vif *arvif;
4774 	int ret = 0;
4775 
4776 	lockdep_assert_held(&ar->conf_mutex);
4777 
4778 	list_for_each_entry(arvif, &ar->arvifs, list) {
4779 		ret = ath10k_mac_vif_setup_ps(arvif);
4780 		if (ret) {
4781 			ath10k_warn(ar, "failed to setup powersave: %d\n", ret);
4782 			break;
4783 		}
4784 	}
4785 
4786 	return ret;
4787 }
4788 
4789 static int ath10k_mac_txpower_setup(struct ath10k *ar, int txpower)
4790 {
4791 	int ret;
4792 	u32 param;
4793 
4794 	lockdep_assert_held(&ar->conf_mutex);
4795 
4796 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac txpower %d\n", txpower);
4797 
4798 	param = ar->wmi.pdev_param->txpower_limit2g;
4799 	ret = ath10k_wmi_pdev_set_param(ar, param, txpower * 2);
4800 	if (ret) {
4801 		ath10k_warn(ar, "failed to set 2g txpower %d: %d\n",
4802 			    txpower, ret);
4803 		return ret;
4804 	}
4805 
4806 	param = ar->wmi.pdev_param->txpower_limit5g;
4807 	ret = ath10k_wmi_pdev_set_param(ar, param, txpower * 2);
4808 	if (ret) {
4809 		ath10k_warn(ar, "failed to set 5g txpower %d: %d\n",
4810 			    txpower, ret);
4811 		return ret;
4812 	}
4813 
4814 	return 0;
4815 }
4816 
4817 static int ath10k_mac_txpower_recalc(struct ath10k *ar)
4818 {
4819 	struct ath10k_vif *arvif;
4820 	int ret, txpower = -1;
4821 
4822 	lockdep_assert_held(&ar->conf_mutex);
4823 
4824 	list_for_each_entry(arvif, &ar->arvifs, list) {
4825 		if (arvif->txpower <= 0)
4826 			continue;
4827 
4828 		if (txpower == -1)
4829 			txpower = arvif->txpower;
4830 		else
4831 			txpower = min(txpower, arvif->txpower);
4832 	}
4833 
4834 	if (txpower == -1)
4835 		return 0;
4836 
4837 	ret = ath10k_mac_txpower_setup(ar, txpower);
4838 	if (ret) {
4839 		ath10k_warn(ar, "failed to setup tx power %d: %d\n",
4840 			    txpower, ret);
4841 		return ret;
4842 	}
4843 
4844 	return 0;
4845 }
4846 
4847 static int ath10k_config(struct ieee80211_hw *hw, u32 changed)
4848 {
4849 	struct ath10k *ar = hw->priv;
4850 	struct ieee80211_conf *conf = &hw->conf;
4851 	int ret = 0;
4852 
4853 	mutex_lock(&ar->conf_mutex);
4854 
4855 	if (changed & IEEE80211_CONF_CHANGE_PS)
4856 		ath10k_config_ps(ar);
4857 
4858 	if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
4859 		ar->monitor = conf->flags & IEEE80211_CONF_MONITOR;
4860 		ret = ath10k_monitor_recalc(ar);
4861 		if (ret)
4862 			ath10k_warn(ar, "failed to recalc monitor: %d\n", ret);
4863 	}
4864 
4865 	mutex_unlock(&ar->conf_mutex);
4866 	return ret;
4867 }
4868 
4869 static u32 get_nss_from_chainmask(u16 chain_mask)
4870 {
4871 	if ((chain_mask & 0xf) == 0xf)
4872 		return 4;
4873 	else if ((chain_mask & 0x7) == 0x7)
4874 		return 3;
4875 	else if ((chain_mask & 0x3) == 0x3)
4876 		return 2;
4877 	return 1;
4878 }
4879 
4880 static int ath10k_mac_set_txbf_conf(struct ath10k_vif *arvif)
4881 {
4882 	u32 value = 0;
4883 	struct ath10k *ar = arvif->ar;
4884 	int nsts;
4885 	int sound_dim;
4886 
4887 	if (ath10k_wmi_get_txbf_conf_scheme(ar) != WMI_TXBF_CONF_BEFORE_ASSOC)
4888 		return 0;
4889 
4890 	nsts = ath10k_mac_get_vht_cap_bf_sts(ar);
4891 	if (ar->vht_cap_info & (IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
4892 				IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE))
4893 		value |= SM(nsts, WMI_TXBF_STS_CAP_OFFSET);
4894 
4895 	sound_dim = ath10k_mac_get_vht_cap_bf_sound_dim(ar);
4896 	if (ar->vht_cap_info & (IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
4897 				IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE))
4898 		value |= SM(sound_dim, WMI_BF_SOUND_DIM_OFFSET);
4899 
4900 	if (!value)
4901 		return 0;
4902 
4903 	if (ar->vht_cap_info & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)
4904 		value |= WMI_VDEV_PARAM_TXBF_SU_TX_BFER;
4905 
4906 	if (ar->vht_cap_info & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)
4907 		value |= (WMI_VDEV_PARAM_TXBF_MU_TX_BFER |
4908 			  WMI_VDEV_PARAM_TXBF_SU_TX_BFER);
4909 
4910 	if (ar->vht_cap_info & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE)
4911 		value |= WMI_VDEV_PARAM_TXBF_SU_TX_BFEE;
4912 
4913 	if (ar->vht_cap_info & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE)
4914 		value |= (WMI_VDEV_PARAM_TXBF_MU_TX_BFEE |
4915 			  WMI_VDEV_PARAM_TXBF_SU_TX_BFEE);
4916 
4917 	return ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
4918 					 ar->wmi.vdev_param->txbf, value);
4919 }
4920 
4921 /*
4922  * TODO:
4923  * Figure out how to handle WMI_VDEV_SUBTYPE_P2P_DEVICE,
4924  * because we will send mgmt frames without CCK. This requirement
4925  * for P2P_FIND/GO_NEG should be handled by checking CCK flag
4926  * in the TX packet.
4927  */
4928 static int ath10k_add_interface(struct ieee80211_hw *hw,
4929 				struct ieee80211_vif *vif)
4930 {
4931 	struct ath10k *ar = hw->priv;
4932 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
4933 	struct ath10k_peer *peer;
4934 	enum wmi_sta_powersave_param param;
4935 	int ret = 0;
4936 	u32 value;
4937 	int bit;
4938 	int i;
4939 	u32 vdev_param;
4940 
4941 	vif->driver_flags |= IEEE80211_VIF_SUPPORTS_UAPSD;
4942 
4943 	mutex_lock(&ar->conf_mutex);
4944 
4945 	memset(arvif, 0, sizeof(*arvif));
4946 	ath10k_mac_txq_init(vif->txq);
4947 
4948 	arvif->ar = ar;
4949 	arvif->vif = vif;
4950 
4951 	INIT_LIST_HEAD(&arvif->list);
4952 	INIT_WORK(&arvif->ap_csa_work, ath10k_mac_vif_ap_csa_work);
4953 	INIT_DELAYED_WORK(&arvif->connection_loss_work,
4954 			  ath10k_mac_vif_sta_connection_loss_work);
4955 
4956 	for (i = 0; i < ARRAY_SIZE(arvif->bitrate_mask.control); i++) {
4957 		arvif->bitrate_mask.control[i].legacy = 0xffffffff;
4958 		memset(arvif->bitrate_mask.control[i].ht_mcs, 0xff,
4959 		       sizeof(arvif->bitrate_mask.control[i].ht_mcs));
4960 		memset(arvif->bitrate_mask.control[i].vht_mcs, 0xff,
4961 		       sizeof(arvif->bitrate_mask.control[i].vht_mcs));
4962 	}
4963 
4964 	if (ar->num_peers >= ar->max_num_peers) {
4965 		ath10k_warn(ar, "refusing vdev creation due to insufficient peer entry resources in firmware\n");
4966 		ret = -ENOBUFS;
4967 		goto err;
4968 	}
4969 
4970 	if (ar->free_vdev_map == 0) {
4971 		ath10k_warn(ar, "Free vdev map is empty, no more interfaces allowed.\n");
4972 		ret = -EBUSY;
4973 		goto err;
4974 	}
4975 	bit = __ffs64(ar->free_vdev_map);
4976 
4977 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac create vdev %i map %llx\n",
4978 		   bit, ar->free_vdev_map);
4979 
4980 	arvif->vdev_id = bit;
4981 	arvif->vdev_subtype =
4982 		ath10k_wmi_get_vdev_subtype(ar, WMI_VDEV_SUBTYPE_NONE);
4983 
4984 	switch (vif->type) {
4985 	case NL80211_IFTYPE_P2P_DEVICE:
4986 		arvif->vdev_type = WMI_VDEV_TYPE_STA;
4987 		arvif->vdev_subtype = ath10k_wmi_get_vdev_subtype
4988 					(ar, WMI_VDEV_SUBTYPE_P2P_DEVICE);
4989 		break;
4990 	case NL80211_IFTYPE_UNSPECIFIED:
4991 	case NL80211_IFTYPE_STATION:
4992 		arvif->vdev_type = WMI_VDEV_TYPE_STA;
4993 		if (vif->p2p)
4994 			arvif->vdev_subtype = ath10k_wmi_get_vdev_subtype
4995 					(ar, WMI_VDEV_SUBTYPE_P2P_CLIENT);
4996 		break;
4997 	case NL80211_IFTYPE_ADHOC:
4998 		arvif->vdev_type = WMI_VDEV_TYPE_IBSS;
4999 		break;
5000 	case NL80211_IFTYPE_MESH_POINT:
5001 		if (test_bit(WMI_SERVICE_MESH_11S, ar->wmi.svc_map)) {
5002 			arvif->vdev_subtype = ath10k_wmi_get_vdev_subtype
5003 						(ar, WMI_VDEV_SUBTYPE_MESH_11S);
5004 		} else if (!test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags)) {
5005 			ret = -EINVAL;
5006 			ath10k_warn(ar, "must load driver with rawmode=1 to add mesh interfaces\n");
5007 			goto err;
5008 		}
5009 		arvif->vdev_type = WMI_VDEV_TYPE_AP;
5010 		break;
5011 	case NL80211_IFTYPE_AP:
5012 		arvif->vdev_type = WMI_VDEV_TYPE_AP;
5013 
5014 		if (vif->p2p)
5015 			arvif->vdev_subtype = ath10k_wmi_get_vdev_subtype
5016 						(ar, WMI_VDEV_SUBTYPE_P2P_GO);
5017 		break;
5018 	case NL80211_IFTYPE_MONITOR:
5019 		arvif->vdev_type = WMI_VDEV_TYPE_MONITOR;
5020 		break;
5021 	default:
5022 		WARN_ON(1);
5023 		break;
5024 	}
5025 
5026 	/* Using vdev_id as queue number will make it very easy to do per-vif
5027 	 * tx queue locking. This shouldn't wrap due to interface combinations
5028 	 * but do a modulo for correctness sake and prevent using offchannel tx
5029 	 * queues for regular vif tx.
5030 	 */
5031 	vif->cab_queue = arvif->vdev_id % (IEEE80211_MAX_QUEUES - 1);
5032 	for (i = 0; i < ARRAY_SIZE(vif->hw_queue); i++)
5033 		vif->hw_queue[i] = arvif->vdev_id % (IEEE80211_MAX_QUEUES - 1);
5034 
5035 	/* Some firmware revisions don't wait for beacon tx completion before
5036 	 * sending another SWBA event. This could lead to hardware using old
5037 	 * (freed) beacon data in some cases, e.g. tx credit starvation
5038 	 * combined with missed TBTT. This is very very rare.
5039 	 *
5040 	 * On non-IOMMU-enabled hosts this could be a possible security issue
5041 	 * because hw could beacon some random data on the air.  On
5042 	 * IOMMU-enabled hosts DMAR faults would occur in most cases and target
5043 	 * device would crash.
5044 	 *
5045 	 * Since there are no beacon tx completions (implicit nor explicit)
5046 	 * propagated to host the only workaround for this is to allocate a
5047 	 * DMA-coherent buffer for a lifetime of a vif and use it for all
5048 	 * beacon tx commands. Worst case for this approach is some beacons may
5049 	 * become corrupted, e.g. have garbled IEs or out-of-date TIM bitmap.
5050 	 */
5051 	if (vif->type == NL80211_IFTYPE_ADHOC ||
5052 	    vif->type == NL80211_IFTYPE_MESH_POINT ||
5053 	    vif->type == NL80211_IFTYPE_AP) {
5054 		arvif->beacon_buf = dma_zalloc_coherent(ar->dev,
5055 							IEEE80211_MAX_FRAME_LEN,
5056 							&arvif->beacon_paddr,
5057 							GFP_ATOMIC);
5058 		if (!arvif->beacon_buf) {
5059 			ret = -ENOMEM;
5060 			ath10k_warn(ar, "failed to allocate beacon buffer: %d\n",
5061 				    ret);
5062 			goto err;
5063 		}
5064 	}
5065 	if (test_bit(ATH10K_FLAG_HW_CRYPTO_DISABLED, &ar->dev_flags))
5066 		arvif->nohwcrypt = true;
5067 
5068 	if (arvif->nohwcrypt &&
5069 	    !test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags)) {
5070 		ath10k_warn(ar, "cryptmode module param needed for sw crypto\n");
5071 		goto err;
5072 	}
5073 
5074 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev create %d (add interface) type %d subtype %d bcnmode %s\n",
5075 		   arvif->vdev_id, arvif->vdev_type, arvif->vdev_subtype,
5076 		   arvif->beacon_buf ? "single-buf" : "per-skb");
5077 
5078 	ret = ath10k_wmi_vdev_create(ar, arvif->vdev_id, arvif->vdev_type,
5079 				     arvif->vdev_subtype, vif->addr);
5080 	if (ret) {
5081 		ath10k_warn(ar, "failed to create WMI vdev %i: %d\n",
5082 			    arvif->vdev_id, ret);
5083 		goto err;
5084 	}
5085 
5086 	ar->free_vdev_map &= ~(1LL << arvif->vdev_id);
5087 	spin_lock_bh(&ar->data_lock);
5088 	list_add(&arvif->list, &ar->arvifs);
5089 	spin_unlock_bh(&ar->data_lock);
5090 
5091 	/* It makes no sense to have firmware do keepalives. mac80211 already
5092 	 * takes care of this with idle connection polling.
5093 	 */
5094 	ret = ath10k_mac_vif_disable_keepalive(arvif);
5095 	if (ret) {
5096 		ath10k_warn(ar, "failed to disable keepalive on vdev %i: %d\n",
5097 			    arvif->vdev_id, ret);
5098 		goto err_vdev_delete;
5099 	}
5100 
5101 	arvif->def_wep_key_idx = -1;
5102 
5103 	vdev_param = ar->wmi.vdev_param->tx_encap_type;
5104 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
5105 					ATH10K_HW_TXRX_NATIVE_WIFI);
5106 	/* 10.X firmware does not support this VDEV parameter. Do not warn */
5107 	if (ret && ret != -EOPNOTSUPP) {
5108 		ath10k_warn(ar, "failed to set vdev %i TX encapsulation: %d\n",
5109 			    arvif->vdev_id, ret);
5110 		goto err_vdev_delete;
5111 	}
5112 
5113 	/* Configuring number of spatial stream for monitor interface is causing
5114 	 * target assert in qca9888 and qca6174.
5115 	 */
5116 	if (ar->cfg_tx_chainmask && (vif->type != NL80211_IFTYPE_MONITOR)) {
5117 		u16 nss = get_nss_from_chainmask(ar->cfg_tx_chainmask);
5118 
5119 		vdev_param = ar->wmi.vdev_param->nss;
5120 		ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
5121 						nss);
5122 		if (ret) {
5123 			ath10k_warn(ar, "failed to set vdev %i chainmask 0x%x, nss %i: %d\n",
5124 				    arvif->vdev_id, ar->cfg_tx_chainmask, nss,
5125 				    ret);
5126 			goto err_vdev_delete;
5127 		}
5128 	}
5129 
5130 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP ||
5131 	    arvif->vdev_type == WMI_VDEV_TYPE_IBSS) {
5132 		ret = ath10k_peer_create(ar, vif, NULL, arvif->vdev_id,
5133 					 vif->addr, WMI_PEER_TYPE_DEFAULT);
5134 		if (ret) {
5135 			ath10k_warn(ar, "failed to create vdev %i peer for AP/IBSS: %d\n",
5136 				    arvif->vdev_id, ret);
5137 			goto err_vdev_delete;
5138 		}
5139 
5140 		spin_lock_bh(&ar->data_lock);
5141 
5142 		peer = ath10k_peer_find(ar, arvif->vdev_id, vif->addr);
5143 		if (!peer) {
5144 			ath10k_warn(ar, "failed to lookup peer %pM on vdev %i\n",
5145 				    vif->addr, arvif->vdev_id);
5146 			spin_unlock_bh(&ar->data_lock);
5147 			ret = -ENOENT;
5148 			goto err_peer_delete;
5149 		}
5150 
5151 		arvif->peer_id = find_first_bit(peer->peer_ids,
5152 						ATH10K_MAX_NUM_PEER_IDS);
5153 
5154 		spin_unlock_bh(&ar->data_lock);
5155 	} else {
5156 		arvif->peer_id = HTT_INVALID_PEERID;
5157 	}
5158 
5159 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
5160 		ret = ath10k_mac_set_kickout(arvif);
5161 		if (ret) {
5162 			ath10k_warn(ar, "failed to set vdev %i kickout parameters: %d\n",
5163 				    arvif->vdev_id, ret);
5164 			goto err_peer_delete;
5165 		}
5166 	}
5167 
5168 	if (arvif->vdev_type == WMI_VDEV_TYPE_STA) {
5169 		param = WMI_STA_PS_PARAM_RX_WAKE_POLICY;
5170 		value = WMI_STA_PS_RX_WAKE_POLICY_WAKE;
5171 		ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
5172 						  param, value);
5173 		if (ret) {
5174 			ath10k_warn(ar, "failed to set vdev %i RX wake policy: %d\n",
5175 				    arvif->vdev_id, ret);
5176 			goto err_peer_delete;
5177 		}
5178 
5179 		ret = ath10k_mac_vif_recalc_ps_wake_threshold(arvif);
5180 		if (ret) {
5181 			ath10k_warn(ar, "failed to recalc ps wake threshold on vdev %i: %d\n",
5182 				    arvif->vdev_id, ret);
5183 			goto err_peer_delete;
5184 		}
5185 
5186 		ret = ath10k_mac_vif_recalc_ps_poll_count(arvif);
5187 		if (ret) {
5188 			ath10k_warn(ar, "failed to recalc ps poll count on vdev %i: %d\n",
5189 				    arvif->vdev_id, ret);
5190 			goto err_peer_delete;
5191 		}
5192 	}
5193 
5194 	ret = ath10k_mac_set_txbf_conf(arvif);
5195 	if (ret) {
5196 		ath10k_warn(ar, "failed to set txbf for vdev %d: %d\n",
5197 			    arvif->vdev_id, ret);
5198 		goto err_peer_delete;
5199 	}
5200 
5201 	ret = ath10k_mac_set_rts(arvif, ar->hw->wiphy->rts_threshold);
5202 	if (ret) {
5203 		ath10k_warn(ar, "failed to set rts threshold for vdev %d: %d\n",
5204 			    arvif->vdev_id, ret);
5205 		goto err_peer_delete;
5206 	}
5207 
5208 	arvif->txpower = vif->bss_conf.txpower;
5209 	ret = ath10k_mac_txpower_recalc(ar);
5210 	if (ret) {
5211 		ath10k_warn(ar, "failed to recalc tx power: %d\n", ret);
5212 		goto err_peer_delete;
5213 	}
5214 
5215 	if (vif->type == NL80211_IFTYPE_MONITOR) {
5216 		ar->monitor_arvif = arvif;
5217 		ret = ath10k_monitor_recalc(ar);
5218 		if (ret) {
5219 			ath10k_warn(ar, "failed to recalc monitor: %d\n", ret);
5220 			goto err_peer_delete;
5221 		}
5222 	}
5223 
5224 	spin_lock_bh(&ar->htt.tx_lock);
5225 	if (!ar->tx_paused)
5226 		ieee80211_wake_queue(ar->hw, arvif->vdev_id);
5227 	spin_unlock_bh(&ar->htt.tx_lock);
5228 
5229 	mutex_unlock(&ar->conf_mutex);
5230 	return 0;
5231 
5232 err_peer_delete:
5233 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP ||
5234 	    arvif->vdev_type == WMI_VDEV_TYPE_IBSS)
5235 		ath10k_wmi_peer_delete(ar, arvif->vdev_id, vif->addr);
5236 
5237 err_vdev_delete:
5238 	ath10k_wmi_vdev_delete(ar, arvif->vdev_id);
5239 	ar->free_vdev_map |= 1LL << arvif->vdev_id;
5240 	spin_lock_bh(&ar->data_lock);
5241 	list_del(&arvif->list);
5242 	spin_unlock_bh(&ar->data_lock);
5243 
5244 err:
5245 	if (arvif->beacon_buf) {
5246 		dma_free_coherent(ar->dev, IEEE80211_MAX_FRAME_LEN,
5247 				  arvif->beacon_buf, arvif->beacon_paddr);
5248 		arvif->beacon_buf = NULL;
5249 	}
5250 
5251 	mutex_unlock(&ar->conf_mutex);
5252 
5253 	return ret;
5254 }
5255 
5256 static void ath10k_mac_vif_tx_unlock_all(struct ath10k_vif *arvif)
5257 {
5258 	int i;
5259 
5260 	for (i = 0; i < BITS_PER_LONG; i++)
5261 		ath10k_mac_vif_tx_unlock(arvif, i);
5262 }
5263 
5264 static void ath10k_remove_interface(struct ieee80211_hw *hw,
5265 				    struct ieee80211_vif *vif)
5266 {
5267 	struct ath10k *ar = hw->priv;
5268 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
5269 	struct ath10k_peer *peer;
5270 	int ret;
5271 	int i;
5272 
5273 	cancel_work_sync(&arvif->ap_csa_work);
5274 	cancel_delayed_work_sync(&arvif->connection_loss_work);
5275 
5276 	mutex_lock(&ar->conf_mutex);
5277 
5278 	spin_lock_bh(&ar->data_lock);
5279 	ath10k_mac_vif_beacon_cleanup(arvif);
5280 	spin_unlock_bh(&ar->data_lock);
5281 
5282 	ret = ath10k_spectral_vif_stop(arvif);
5283 	if (ret)
5284 		ath10k_warn(ar, "failed to stop spectral for vdev %i: %d\n",
5285 			    arvif->vdev_id, ret);
5286 
5287 	ar->free_vdev_map |= 1LL << arvif->vdev_id;
5288 	spin_lock_bh(&ar->data_lock);
5289 	list_del(&arvif->list);
5290 	spin_unlock_bh(&ar->data_lock);
5291 
5292 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP ||
5293 	    arvif->vdev_type == WMI_VDEV_TYPE_IBSS) {
5294 		ret = ath10k_wmi_peer_delete(arvif->ar, arvif->vdev_id,
5295 					     vif->addr);
5296 		if (ret)
5297 			ath10k_warn(ar, "failed to submit AP/IBSS self-peer removal on vdev %i: %d\n",
5298 				    arvif->vdev_id, ret);
5299 
5300 		kfree(arvif->u.ap.noa_data);
5301 	}
5302 
5303 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %i delete (remove interface)\n",
5304 		   arvif->vdev_id);
5305 
5306 	ret = ath10k_wmi_vdev_delete(ar, arvif->vdev_id);
5307 	if (ret)
5308 		ath10k_warn(ar, "failed to delete WMI vdev %i: %d\n",
5309 			    arvif->vdev_id, ret);
5310 
5311 	/* Some firmware revisions don't notify host about self-peer removal
5312 	 * until after associated vdev is deleted.
5313 	 */
5314 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP ||
5315 	    arvif->vdev_type == WMI_VDEV_TYPE_IBSS) {
5316 		ret = ath10k_wait_for_peer_deleted(ar, arvif->vdev_id,
5317 						   vif->addr);
5318 		if (ret)
5319 			ath10k_warn(ar, "failed to remove AP self-peer on vdev %i: %d\n",
5320 				    arvif->vdev_id, ret);
5321 
5322 		spin_lock_bh(&ar->data_lock);
5323 		ar->num_peers--;
5324 		spin_unlock_bh(&ar->data_lock);
5325 	}
5326 
5327 	spin_lock_bh(&ar->data_lock);
5328 	for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++) {
5329 		peer = ar->peer_map[i];
5330 		if (!peer)
5331 			continue;
5332 
5333 		if (peer->vif == vif) {
5334 			ath10k_warn(ar, "found vif peer %pM entry on vdev %i after it was supposedly removed\n",
5335 				    vif->addr, arvif->vdev_id);
5336 			peer->vif = NULL;
5337 		}
5338 	}
5339 	spin_unlock_bh(&ar->data_lock);
5340 
5341 	ath10k_peer_cleanup(ar, arvif->vdev_id);
5342 	ath10k_mac_txq_unref(ar, vif->txq);
5343 
5344 	if (vif->type == NL80211_IFTYPE_MONITOR) {
5345 		ar->monitor_arvif = NULL;
5346 		ret = ath10k_monitor_recalc(ar);
5347 		if (ret)
5348 			ath10k_warn(ar, "failed to recalc monitor: %d\n", ret);
5349 	}
5350 
5351 	ret = ath10k_mac_txpower_recalc(ar);
5352 	if (ret)
5353 		ath10k_warn(ar, "failed to recalc tx power: %d\n", ret);
5354 
5355 	spin_lock_bh(&ar->htt.tx_lock);
5356 	ath10k_mac_vif_tx_unlock_all(arvif);
5357 	spin_unlock_bh(&ar->htt.tx_lock);
5358 
5359 	ath10k_mac_txq_unref(ar, vif->txq);
5360 
5361 	mutex_unlock(&ar->conf_mutex);
5362 }
5363 
5364 /*
5365  * FIXME: Has to be verified.
5366  */
5367 #define SUPPORTED_FILTERS			\
5368 	(FIF_ALLMULTI |				\
5369 	FIF_CONTROL |				\
5370 	FIF_PSPOLL |				\
5371 	FIF_OTHER_BSS |				\
5372 	FIF_BCN_PRBRESP_PROMISC |		\
5373 	FIF_PROBE_REQ |				\
5374 	FIF_FCSFAIL)
5375 
5376 static void ath10k_configure_filter(struct ieee80211_hw *hw,
5377 				    unsigned int changed_flags,
5378 				    unsigned int *total_flags,
5379 				    u64 multicast)
5380 {
5381 	struct ath10k *ar = hw->priv;
5382 	int ret;
5383 
5384 	mutex_lock(&ar->conf_mutex);
5385 
5386 	changed_flags &= SUPPORTED_FILTERS;
5387 	*total_flags &= SUPPORTED_FILTERS;
5388 	ar->filter_flags = *total_flags;
5389 
5390 	ret = ath10k_monitor_recalc(ar);
5391 	if (ret)
5392 		ath10k_warn(ar, "failed to recalc monitor: %d\n", ret);
5393 
5394 	mutex_unlock(&ar->conf_mutex);
5395 }
5396 
5397 static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
5398 				    struct ieee80211_vif *vif,
5399 				    struct ieee80211_bss_conf *info,
5400 				    u32 changed)
5401 {
5402 	struct ath10k *ar = hw->priv;
5403 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
5404 	int ret = 0;
5405 	u32 vdev_param, pdev_param, slottime, preamble;
5406 
5407 	mutex_lock(&ar->conf_mutex);
5408 
5409 	if (changed & BSS_CHANGED_IBSS)
5410 		ath10k_control_ibss(arvif, info, vif->addr);
5411 
5412 	if (changed & BSS_CHANGED_BEACON_INT) {
5413 		arvif->beacon_interval = info->beacon_int;
5414 		vdev_param = ar->wmi.vdev_param->beacon_interval;
5415 		ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
5416 						arvif->beacon_interval);
5417 		ath10k_dbg(ar, ATH10K_DBG_MAC,
5418 			   "mac vdev %d beacon_interval %d\n",
5419 			   arvif->vdev_id, arvif->beacon_interval);
5420 
5421 		if (ret)
5422 			ath10k_warn(ar, "failed to set beacon interval for vdev %d: %i\n",
5423 				    arvif->vdev_id, ret);
5424 	}
5425 
5426 	if (changed & BSS_CHANGED_BEACON) {
5427 		ath10k_dbg(ar, ATH10K_DBG_MAC,
5428 			   "vdev %d set beacon tx mode to staggered\n",
5429 			   arvif->vdev_id);
5430 
5431 		pdev_param = ar->wmi.pdev_param->beacon_tx_mode;
5432 		ret = ath10k_wmi_pdev_set_param(ar, pdev_param,
5433 						WMI_BEACON_STAGGERED_MODE);
5434 		if (ret)
5435 			ath10k_warn(ar, "failed to set beacon mode for vdev %d: %i\n",
5436 				    arvif->vdev_id, ret);
5437 
5438 		ret = ath10k_mac_setup_bcn_tmpl(arvif);
5439 		if (ret)
5440 			ath10k_warn(ar, "failed to update beacon template: %d\n",
5441 				    ret);
5442 
5443 		if (ieee80211_vif_is_mesh(vif)) {
5444 			/* mesh doesn't use SSID but firmware needs it */
5445 			strncpy(arvif->u.ap.ssid, "mesh",
5446 				sizeof(arvif->u.ap.ssid));
5447 			arvif->u.ap.ssid_len = 4;
5448 		}
5449 	}
5450 
5451 	if (changed & BSS_CHANGED_AP_PROBE_RESP) {
5452 		ret = ath10k_mac_setup_prb_tmpl(arvif);
5453 		if (ret)
5454 			ath10k_warn(ar, "failed to setup probe resp template on vdev %i: %d\n",
5455 				    arvif->vdev_id, ret);
5456 	}
5457 
5458 	if (changed & (BSS_CHANGED_BEACON_INFO | BSS_CHANGED_BEACON)) {
5459 		arvif->dtim_period = info->dtim_period;
5460 
5461 		ath10k_dbg(ar, ATH10K_DBG_MAC,
5462 			   "mac vdev %d dtim_period %d\n",
5463 			   arvif->vdev_id, arvif->dtim_period);
5464 
5465 		vdev_param = ar->wmi.vdev_param->dtim_period;
5466 		ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
5467 						arvif->dtim_period);
5468 		if (ret)
5469 			ath10k_warn(ar, "failed to set dtim period for vdev %d: %i\n",
5470 				    arvif->vdev_id, ret);
5471 	}
5472 
5473 	if (changed & BSS_CHANGED_SSID &&
5474 	    vif->type == NL80211_IFTYPE_AP) {
5475 		arvif->u.ap.ssid_len = info->ssid_len;
5476 		if (info->ssid_len)
5477 			memcpy(arvif->u.ap.ssid, info->ssid, info->ssid_len);
5478 		arvif->u.ap.hidden_ssid = info->hidden_ssid;
5479 	}
5480 
5481 	if (changed & BSS_CHANGED_BSSID && !is_zero_ether_addr(info->bssid))
5482 		ether_addr_copy(arvif->bssid, info->bssid);
5483 
5484 	if (changed & BSS_CHANGED_BEACON_ENABLED)
5485 		ath10k_control_beaconing(arvif, info);
5486 
5487 	if (changed & BSS_CHANGED_ERP_CTS_PROT) {
5488 		arvif->use_cts_prot = info->use_cts_prot;
5489 
5490 		ret = ath10k_recalc_rtscts_prot(arvif);
5491 		if (ret)
5492 			ath10k_warn(ar, "failed to recalculate rts/cts prot for vdev %d: %d\n",
5493 				    arvif->vdev_id, ret);
5494 
5495 		if (ath10k_mac_can_set_cts_prot(arvif)) {
5496 			ret = ath10k_mac_set_cts_prot(arvif);
5497 			if (ret)
5498 				ath10k_warn(ar, "failed to set cts protection for vdev %d: %d\n",
5499 					    arvif->vdev_id, ret);
5500 		}
5501 	}
5502 
5503 	if (changed & BSS_CHANGED_ERP_SLOT) {
5504 		if (info->use_short_slot)
5505 			slottime = WMI_VDEV_SLOT_TIME_SHORT; /* 9us */
5506 
5507 		else
5508 			slottime = WMI_VDEV_SLOT_TIME_LONG; /* 20us */
5509 
5510 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d slot_time %d\n",
5511 			   arvif->vdev_id, slottime);
5512 
5513 		vdev_param = ar->wmi.vdev_param->slot_time;
5514 		ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
5515 						slottime);
5516 		if (ret)
5517 			ath10k_warn(ar, "failed to set erp slot for vdev %d: %i\n",
5518 				    arvif->vdev_id, ret);
5519 	}
5520 
5521 	if (changed & BSS_CHANGED_ERP_PREAMBLE) {
5522 		if (info->use_short_preamble)
5523 			preamble = WMI_VDEV_PREAMBLE_SHORT;
5524 		else
5525 			preamble = WMI_VDEV_PREAMBLE_LONG;
5526 
5527 		ath10k_dbg(ar, ATH10K_DBG_MAC,
5528 			   "mac vdev %d preamble %dn",
5529 			   arvif->vdev_id, preamble);
5530 
5531 		vdev_param = ar->wmi.vdev_param->preamble;
5532 		ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
5533 						preamble);
5534 		if (ret)
5535 			ath10k_warn(ar, "failed to set preamble for vdev %d: %i\n",
5536 				    arvif->vdev_id, ret);
5537 	}
5538 
5539 	if (changed & BSS_CHANGED_ASSOC) {
5540 		if (info->assoc) {
5541 			/* Workaround: Make sure monitor vdev is not running
5542 			 * when associating to prevent some firmware revisions
5543 			 * (e.g. 10.1 and 10.2) from crashing.
5544 			 */
5545 			if (ar->monitor_started)
5546 				ath10k_monitor_stop(ar);
5547 			ath10k_bss_assoc(hw, vif, info);
5548 			ath10k_monitor_recalc(ar);
5549 		} else {
5550 			ath10k_bss_disassoc(hw, vif);
5551 		}
5552 	}
5553 
5554 	if (changed & BSS_CHANGED_TXPOWER) {
5555 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev_id %i txpower %d\n",
5556 			   arvif->vdev_id, info->txpower);
5557 
5558 		arvif->txpower = info->txpower;
5559 		ret = ath10k_mac_txpower_recalc(ar);
5560 		if (ret)
5561 			ath10k_warn(ar, "failed to recalc tx power: %d\n", ret);
5562 	}
5563 
5564 	if (changed & BSS_CHANGED_PS) {
5565 		arvif->ps = vif->bss_conf.ps;
5566 
5567 		ret = ath10k_config_ps(ar);
5568 		if (ret)
5569 			ath10k_warn(ar, "failed to setup ps on vdev %i: %d\n",
5570 				    arvif->vdev_id, ret);
5571 	}
5572 
5573 	mutex_unlock(&ar->conf_mutex);
5574 }
5575 
5576 static void ath10k_mac_op_set_coverage_class(struct ieee80211_hw *hw, s16 value)
5577 {
5578 	struct ath10k *ar = hw->priv;
5579 
5580 	/* This function should never be called if setting the coverage class
5581 	 * is not supported on this hardware.
5582 	 */
5583 	if (!ar->hw_params.hw_ops->set_coverage_class) {
5584 		WARN_ON_ONCE(1);
5585 		return;
5586 	}
5587 	ar->hw_params.hw_ops->set_coverage_class(ar, value);
5588 }
5589 
5590 struct ath10k_mac_tdls_iter_data {
5591 	u32 num_tdls_stations;
5592 	struct ieee80211_vif *curr_vif;
5593 };
5594 
5595 static void ath10k_mac_tdls_vif_stations_count_iter(void *data,
5596 						    struct ieee80211_sta *sta)
5597 {
5598 	struct ath10k_mac_tdls_iter_data *iter_data = data;
5599 	struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
5600 	struct ieee80211_vif *sta_vif = arsta->arvif->vif;
5601 
5602 	if (sta->tdls && sta_vif == iter_data->curr_vif)
5603 		iter_data->num_tdls_stations++;
5604 }
5605 
5606 static int ath10k_mac_tdls_vif_stations_count(struct ieee80211_hw *hw,
5607 					      struct ieee80211_vif *vif)
5608 {
5609 	struct ath10k_mac_tdls_iter_data data = {};
5610 
5611 	data.curr_vif = vif;
5612 
5613 	ieee80211_iterate_stations_atomic(hw,
5614 					  ath10k_mac_tdls_vif_stations_count_iter,
5615 					  &data);
5616 	return data.num_tdls_stations;
5617 }
5618 
5619 static void ath10k_mac_tdls_vifs_count_iter(void *data, u8 *mac,
5620 					    struct ieee80211_vif *vif)
5621 {
5622 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
5623 	int *num_tdls_vifs = data;
5624 
5625 	if (vif->type != NL80211_IFTYPE_STATION)
5626 		return;
5627 
5628 	if (ath10k_mac_tdls_vif_stations_count(arvif->ar->hw, vif) > 0)
5629 		(*num_tdls_vifs)++;
5630 }
5631 
5632 static int ath10k_mac_tdls_vifs_count(struct ieee80211_hw *hw)
5633 {
5634 	int num_tdls_vifs = 0;
5635 
5636 	ieee80211_iterate_active_interfaces_atomic(hw,
5637 						   IEEE80211_IFACE_ITER_NORMAL,
5638 						   ath10k_mac_tdls_vifs_count_iter,
5639 						   &num_tdls_vifs);
5640 	return num_tdls_vifs;
5641 }
5642 
5643 static int ath10k_hw_scan(struct ieee80211_hw *hw,
5644 			  struct ieee80211_vif *vif,
5645 			  struct ieee80211_scan_request *hw_req)
5646 {
5647 	struct ath10k *ar = hw->priv;
5648 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
5649 	struct cfg80211_scan_request *req = &hw_req->req;
5650 	struct wmi_start_scan_arg arg;
5651 	int ret = 0;
5652 	int i;
5653 
5654 	mutex_lock(&ar->conf_mutex);
5655 
5656 	if (ath10k_mac_tdls_vif_stations_count(hw, vif) > 0) {
5657 		ret = -EBUSY;
5658 		goto exit;
5659 	}
5660 
5661 	spin_lock_bh(&ar->data_lock);
5662 	switch (ar->scan.state) {
5663 	case ATH10K_SCAN_IDLE:
5664 		reinit_completion(&ar->scan.started);
5665 		reinit_completion(&ar->scan.completed);
5666 		ar->scan.state = ATH10K_SCAN_STARTING;
5667 		ar->scan.is_roc = false;
5668 		ar->scan.vdev_id = arvif->vdev_id;
5669 		ret = 0;
5670 		break;
5671 	case ATH10K_SCAN_STARTING:
5672 	case ATH10K_SCAN_RUNNING:
5673 	case ATH10K_SCAN_ABORTING:
5674 		ret = -EBUSY;
5675 		break;
5676 	}
5677 	spin_unlock_bh(&ar->data_lock);
5678 
5679 	if (ret)
5680 		goto exit;
5681 
5682 	memset(&arg, 0, sizeof(arg));
5683 	ath10k_wmi_start_scan_init(ar, &arg);
5684 	arg.vdev_id = arvif->vdev_id;
5685 	arg.scan_id = ATH10K_SCAN_ID;
5686 
5687 	if (req->ie_len) {
5688 		arg.ie_len = req->ie_len;
5689 		memcpy(arg.ie, req->ie, arg.ie_len);
5690 	}
5691 
5692 	if (req->n_ssids) {
5693 		arg.n_ssids = req->n_ssids;
5694 		for (i = 0; i < arg.n_ssids; i++) {
5695 			arg.ssids[i].len  = req->ssids[i].ssid_len;
5696 			arg.ssids[i].ssid = req->ssids[i].ssid;
5697 		}
5698 	} else {
5699 		arg.scan_ctrl_flags |= WMI_SCAN_FLAG_PASSIVE;
5700 	}
5701 
5702 	if (req->n_channels) {
5703 		arg.n_channels = req->n_channels;
5704 		for (i = 0; i < arg.n_channels; i++)
5705 			arg.channels[i] = req->channels[i]->center_freq;
5706 	}
5707 
5708 	ret = ath10k_start_scan(ar, &arg);
5709 	if (ret) {
5710 		ath10k_warn(ar, "failed to start hw scan: %d\n", ret);
5711 		spin_lock_bh(&ar->data_lock);
5712 		ar->scan.state = ATH10K_SCAN_IDLE;
5713 		spin_unlock_bh(&ar->data_lock);
5714 	}
5715 
5716 	/* Add a 200ms margin to account for event/command processing */
5717 	ieee80211_queue_delayed_work(ar->hw, &ar->scan.timeout,
5718 				     msecs_to_jiffies(arg.max_scan_time +
5719 						      200));
5720 
5721 exit:
5722 	mutex_unlock(&ar->conf_mutex);
5723 	return ret;
5724 }
5725 
5726 static void ath10k_cancel_hw_scan(struct ieee80211_hw *hw,
5727 				  struct ieee80211_vif *vif)
5728 {
5729 	struct ath10k *ar = hw->priv;
5730 
5731 	mutex_lock(&ar->conf_mutex);
5732 	ath10k_scan_abort(ar);
5733 	mutex_unlock(&ar->conf_mutex);
5734 
5735 	cancel_delayed_work_sync(&ar->scan.timeout);
5736 }
5737 
5738 static void ath10k_set_key_h_def_keyidx(struct ath10k *ar,
5739 					struct ath10k_vif *arvif,
5740 					enum set_key_cmd cmd,
5741 					struct ieee80211_key_conf *key)
5742 {
5743 	u32 vdev_param = arvif->ar->wmi.vdev_param->def_keyid;
5744 	int ret;
5745 
5746 	/* 10.1 firmware branch requires default key index to be set to group
5747 	 * key index after installing it. Otherwise FW/HW Txes corrupted
5748 	 * frames with multi-vif APs. This is not required for main firmware
5749 	 * branch (e.g. 636).
5750 	 *
5751 	 * This is also needed for 636 fw for IBSS-RSN to work more reliably.
5752 	 *
5753 	 * FIXME: It remains unknown if this is required for multi-vif STA
5754 	 * interfaces on 10.1.
5755 	 */
5756 
5757 	if (arvif->vdev_type != WMI_VDEV_TYPE_AP &&
5758 	    arvif->vdev_type != WMI_VDEV_TYPE_IBSS)
5759 		return;
5760 
5761 	if (key->cipher == WLAN_CIPHER_SUITE_WEP40)
5762 		return;
5763 
5764 	if (key->cipher == WLAN_CIPHER_SUITE_WEP104)
5765 		return;
5766 
5767 	if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
5768 		return;
5769 
5770 	if (cmd != SET_KEY)
5771 		return;
5772 
5773 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
5774 					key->keyidx);
5775 	if (ret)
5776 		ath10k_warn(ar, "failed to set vdev %i group key as default key: %d\n",
5777 			    arvif->vdev_id, ret);
5778 }
5779 
5780 static int ath10k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
5781 			  struct ieee80211_vif *vif, struct ieee80211_sta *sta,
5782 			  struct ieee80211_key_conf *key)
5783 {
5784 	struct ath10k *ar = hw->priv;
5785 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
5786 	struct ath10k_peer *peer;
5787 	const u8 *peer_addr;
5788 	bool is_wep = key->cipher == WLAN_CIPHER_SUITE_WEP40 ||
5789 		      key->cipher == WLAN_CIPHER_SUITE_WEP104;
5790 	int ret = 0;
5791 	int ret2;
5792 	u32 flags = 0;
5793 	u32 flags2;
5794 
5795 	/* this one needs to be done in software */
5796 	if (key->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
5797 	    key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
5798 	    key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256 ||
5799 	    key->cipher == WLAN_CIPHER_SUITE_BIP_CMAC_256)
5800 		return 1;
5801 
5802 	if (arvif->nohwcrypt)
5803 		return 1;
5804 
5805 	if (key->keyidx > WMI_MAX_KEY_INDEX)
5806 		return -ENOSPC;
5807 
5808 	mutex_lock(&ar->conf_mutex);
5809 
5810 	if (sta)
5811 		peer_addr = sta->addr;
5812 	else if (arvif->vdev_type == WMI_VDEV_TYPE_STA)
5813 		peer_addr = vif->bss_conf.bssid;
5814 	else
5815 		peer_addr = vif->addr;
5816 
5817 	key->hw_key_idx = key->keyidx;
5818 
5819 	if (is_wep) {
5820 		if (cmd == SET_KEY)
5821 			arvif->wep_keys[key->keyidx] = key;
5822 		else
5823 			arvif->wep_keys[key->keyidx] = NULL;
5824 	}
5825 
5826 	/* the peer should not disappear in mid-way (unless FW goes awry) since
5827 	 * we already hold conf_mutex. we just make sure its there now.
5828 	 */
5829 	spin_lock_bh(&ar->data_lock);
5830 	peer = ath10k_peer_find(ar, arvif->vdev_id, peer_addr);
5831 	spin_unlock_bh(&ar->data_lock);
5832 
5833 	if (!peer) {
5834 		if (cmd == SET_KEY) {
5835 			ath10k_warn(ar, "failed to install key for non-existent peer %pM\n",
5836 				    peer_addr);
5837 			ret = -EOPNOTSUPP;
5838 			goto exit;
5839 		} else {
5840 			/* if the peer doesn't exist there is no key to disable anymore */
5841 			goto exit;
5842 		}
5843 	}
5844 
5845 	if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
5846 		flags |= WMI_KEY_PAIRWISE;
5847 	else
5848 		flags |= WMI_KEY_GROUP;
5849 
5850 	if (is_wep) {
5851 		if (cmd == DISABLE_KEY)
5852 			ath10k_clear_vdev_key(arvif, key);
5853 
5854 		/* When WEP keys are uploaded it's possible that there are
5855 		 * stations associated already (e.g. when merging) without any
5856 		 * keys. Static WEP needs an explicit per-peer key upload.
5857 		 */
5858 		if (vif->type == NL80211_IFTYPE_ADHOC &&
5859 		    cmd == SET_KEY)
5860 			ath10k_mac_vif_update_wep_key(arvif, key);
5861 
5862 		/* 802.1x never sets the def_wep_key_idx so each set_key()
5863 		 * call changes default tx key.
5864 		 *
5865 		 * Static WEP sets def_wep_key_idx via .set_default_unicast_key
5866 		 * after first set_key().
5867 		 */
5868 		if (cmd == SET_KEY && arvif->def_wep_key_idx == -1)
5869 			flags |= WMI_KEY_TX_USAGE;
5870 	}
5871 
5872 	ret = ath10k_install_key(arvif, key, cmd, peer_addr, flags);
5873 	if (ret) {
5874 		WARN_ON(ret > 0);
5875 		ath10k_warn(ar, "failed to install key for vdev %i peer %pM: %d\n",
5876 			    arvif->vdev_id, peer_addr, ret);
5877 		goto exit;
5878 	}
5879 
5880 	/* mac80211 sets static WEP keys as groupwise while firmware requires
5881 	 * them to be installed twice as both pairwise and groupwise.
5882 	 */
5883 	if (is_wep && !sta && vif->type == NL80211_IFTYPE_STATION) {
5884 		flags2 = flags;
5885 		flags2 &= ~WMI_KEY_GROUP;
5886 		flags2 |= WMI_KEY_PAIRWISE;
5887 
5888 		ret = ath10k_install_key(arvif, key, cmd, peer_addr, flags2);
5889 		if (ret) {
5890 			WARN_ON(ret > 0);
5891 			ath10k_warn(ar, "failed to install (ucast) key for vdev %i peer %pM: %d\n",
5892 				    arvif->vdev_id, peer_addr, ret);
5893 			ret2 = ath10k_install_key(arvif, key, DISABLE_KEY,
5894 						  peer_addr, flags);
5895 			if (ret2) {
5896 				WARN_ON(ret2 > 0);
5897 				ath10k_warn(ar, "failed to disable (mcast) key for vdev %i peer %pM: %d\n",
5898 					    arvif->vdev_id, peer_addr, ret2);
5899 			}
5900 			goto exit;
5901 		}
5902 	}
5903 
5904 	ath10k_set_key_h_def_keyidx(ar, arvif, cmd, key);
5905 
5906 	spin_lock_bh(&ar->data_lock);
5907 	peer = ath10k_peer_find(ar, arvif->vdev_id, peer_addr);
5908 	if (peer && cmd == SET_KEY)
5909 		peer->keys[key->keyidx] = key;
5910 	else if (peer && cmd == DISABLE_KEY)
5911 		peer->keys[key->keyidx] = NULL;
5912 	else if (peer == NULL)
5913 		/* impossible unless FW goes crazy */
5914 		ath10k_warn(ar, "Peer %pM disappeared!\n", peer_addr);
5915 	spin_unlock_bh(&ar->data_lock);
5916 
5917 exit:
5918 	mutex_unlock(&ar->conf_mutex);
5919 	return ret;
5920 }
5921 
5922 static void ath10k_set_default_unicast_key(struct ieee80211_hw *hw,
5923 					   struct ieee80211_vif *vif,
5924 					   int keyidx)
5925 {
5926 	struct ath10k *ar = hw->priv;
5927 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
5928 	int ret;
5929 
5930 	mutex_lock(&arvif->ar->conf_mutex);
5931 
5932 	if (arvif->ar->state != ATH10K_STATE_ON)
5933 		goto unlock;
5934 
5935 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d set keyidx %d\n",
5936 		   arvif->vdev_id, keyidx);
5937 
5938 	ret = ath10k_wmi_vdev_set_param(arvif->ar,
5939 					arvif->vdev_id,
5940 					arvif->ar->wmi.vdev_param->def_keyid,
5941 					keyidx);
5942 
5943 	if (ret) {
5944 		ath10k_warn(ar, "failed to update wep key index for vdev %d: %d\n",
5945 			    arvif->vdev_id,
5946 			    ret);
5947 		goto unlock;
5948 	}
5949 
5950 	arvif->def_wep_key_idx = keyidx;
5951 
5952 unlock:
5953 	mutex_unlock(&arvif->ar->conf_mutex);
5954 }
5955 
5956 static void ath10k_sta_rc_update_wk(struct work_struct *wk)
5957 {
5958 	struct ath10k *ar;
5959 	struct ath10k_vif *arvif;
5960 	struct ath10k_sta *arsta;
5961 	struct ieee80211_sta *sta;
5962 	struct cfg80211_chan_def def;
5963 	enum nl80211_band band;
5964 	const u8 *ht_mcs_mask;
5965 	const u16 *vht_mcs_mask;
5966 	u32 changed, bw, nss, smps;
5967 	int err;
5968 
5969 	arsta = container_of(wk, struct ath10k_sta, update_wk);
5970 	sta = container_of((void *)arsta, struct ieee80211_sta, drv_priv);
5971 	arvif = arsta->arvif;
5972 	ar = arvif->ar;
5973 
5974 	if (WARN_ON(ath10k_mac_vif_chan(arvif->vif, &def)))
5975 		return;
5976 
5977 	band = def.chan->band;
5978 	ht_mcs_mask = arvif->bitrate_mask.control[band].ht_mcs;
5979 	vht_mcs_mask = arvif->bitrate_mask.control[band].vht_mcs;
5980 
5981 	spin_lock_bh(&ar->data_lock);
5982 
5983 	changed = arsta->changed;
5984 	arsta->changed = 0;
5985 
5986 	bw = arsta->bw;
5987 	nss = arsta->nss;
5988 	smps = arsta->smps;
5989 
5990 	spin_unlock_bh(&ar->data_lock);
5991 
5992 	mutex_lock(&ar->conf_mutex);
5993 
5994 	nss = max_t(u32, 1, nss);
5995 	nss = min(nss, max(ath10k_mac_max_ht_nss(ht_mcs_mask),
5996 			   ath10k_mac_max_vht_nss(vht_mcs_mask)));
5997 
5998 	if (changed & IEEE80211_RC_BW_CHANGED) {
5999 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM peer bw %d\n",
6000 			   sta->addr, bw);
6001 
6002 		err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr,
6003 						WMI_PEER_CHAN_WIDTH, bw);
6004 		if (err)
6005 			ath10k_warn(ar, "failed to update STA %pM peer bw %d: %d\n",
6006 				    sta->addr, bw, err);
6007 	}
6008 
6009 	if (changed & IEEE80211_RC_NSS_CHANGED) {
6010 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM nss %d\n",
6011 			   sta->addr, nss);
6012 
6013 		err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr,
6014 						WMI_PEER_NSS, nss);
6015 		if (err)
6016 			ath10k_warn(ar, "failed to update STA %pM nss %d: %d\n",
6017 				    sta->addr, nss, err);
6018 	}
6019 
6020 	if (changed & IEEE80211_RC_SMPS_CHANGED) {
6021 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM smps %d\n",
6022 			   sta->addr, smps);
6023 
6024 		err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr,
6025 						WMI_PEER_SMPS_STATE, smps);
6026 		if (err)
6027 			ath10k_warn(ar, "failed to update STA %pM smps %d: %d\n",
6028 				    sta->addr, smps, err);
6029 	}
6030 
6031 	if (changed & IEEE80211_RC_SUPP_RATES_CHANGED ||
6032 	    changed & IEEE80211_RC_NSS_CHANGED) {
6033 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM supp rates/nss\n",
6034 			   sta->addr);
6035 
6036 		err = ath10k_station_assoc(ar, arvif->vif, sta, true);
6037 		if (err)
6038 			ath10k_warn(ar, "failed to reassociate station: %pM\n",
6039 				    sta->addr);
6040 	}
6041 
6042 	mutex_unlock(&ar->conf_mutex);
6043 }
6044 
6045 static int ath10k_mac_inc_num_stations(struct ath10k_vif *arvif,
6046 				       struct ieee80211_sta *sta)
6047 {
6048 	struct ath10k *ar = arvif->ar;
6049 
6050 	lockdep_assert_held(&ar->conf_mutex);
6051 
6052 	if (arvif->vdev_type == WMI_VDEV_TYPE_STA && !sta->tdls)
6053 		return 0;
6054 
6055 	if (ar->num_stations >= ar->max_num_stations)
6056 		return -ENOBUFS;
6057 
6058 	ar->num_stations++;
6059 
6060 	return 0;
6061 }
6062 
6063 static void ath10k_mac_dec_num_stations(struct ath10k_vif *arvif,
6064 					struct ieee80211_sta *sta)
6065 {
6066 	struct ath10k *ar = arvif->ar;
6067 
6068 	lockdep_assert_held(&ar->conf_mutex);
6069 
6070 	if (arvif->vdev_type == WMI_VDEV_TYPE_STA && !sta->tdls)
6071 		return;
6072 
6073 	ar->num_stations--;
6074 }
6075 
6076 static int ath10k_sta_state(struct ieee80211_hw *hw,
6077 			    struct ieee80211_vif *vif,
6078 			    struct ieee80211_sta *sta,
6079 			    enum ieee80211_sta_state old_state,
6080 			    enum ieee80211_sta_state new_state)
6081 {
6082 	struct ath10k *ar = hw->priv;
6083 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
6084 	struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
6085 	struct ath10k_peer *peer;
6086 	int ret = 0;
6087 	int i;
6088 
6089 	if (old_state == IEEE80211_STA_NOTEXIST &&
6090 	    new_state == IEEE80211_STA_NONE) {
6091 		memset(arsta, 0, sizeof(*arsta));
6092 		arsta->arvif = arvif;
6093 		INIT_WORK(&arsta->update_wk, ath10k_sta_rc_update_wk);
6094 
6095 		for (i = 0; i < ARRAY_SIZE(sta->txq); i++)
6096 			ath10k_mac_txq_init(sta->txq[i]);
6097 	}
6098 
6099 	/* cancel must be done outside the mutex to avoid deadlock */
6100 	if ((old_state == IEEE80211_STA_NONE &&
6101 	     new_state == IEEE80211_STA_NOTEXIST))
6102 		cancel_work_sync(&arsta->update_wk);
6103 
6104 	mutex_lock(&ar->conf_mutex);
6105 
6106 	if (old_state == IEEE80211_STA_NOTEXIST &&
6107 	    new_state == IEEE80211_STA_NONE) {
6108 		/*
6109 		 * New station addition.
6110 		 */
6111 		enum wmi_peer_type peer_type = WMI_PEER_TYPE_DEFAULT;
6112 		u32 num_tdls_stations;
6113 		u32 num_tdls_vifs;
6114 
6115 		ath10k_dbg(ar, ATH10K_DBG_MAC,
6116 			   "mac vdev %d peer create %pM (new sta) sta %d / %d peer %d / %d\n",
6117 			   arvif->vdev_id, sta->addr,
6118 			   ar->num_stations + 1, ar->max_num_stations,
6119 			   ar->num_peers + 1, ar->max_num_peers);
6120 
6121 		num_tdls_stations = ath10k_mac_tdls_vif_stations_count(hw, vif);
6122 		num_tdls_vifs = ath10k_mac_tdls_vifs_count(hw);
6123 
6124 		if (sta->tdls) {
6125 			if (num_tdls_stations >= ar->max_num_tdls_vdevs) {
6126 				ath10k_warn(ar, "vdev %i exceeded maximum number of tdls vdevs %i\n",
6127 					    arvif->vdev_id,
6128 					    ar->max_num_tdls_vdevs);
6129 				ret = -ELNRNG;
6130 				goto exit;
6131 			}
6132 			peer_type = WMI_PEER_TYPE_TDLS;
6133 		}
6134 
6135 		ret = ath10k_mac_inc_num_stations(arvif, sta);
6136 		if (ret) {
6137 			ath10k_warn(ar, "refusing to associate station: too many connected already (%d)\n",
6138 				    ar->max_num_stations);
6139 			goto exit;
6140 		}
6141 
6142 		ret = ath10k_peer_create(ar, vif, sta, arvif->vdev_id,
6143 					 sta->addr, peer_type);
6144 		if (ret) {
6145 			ath10k_warn(ar, "failed to add peer %pM for vdev %d when adding a new sta: %i\n",
6146 				    sta->addr, arvif->vdev_id, ret);
6147 			ath10k_mac_dec_num_stations(arvif, sta);
6148 			goto exit;
6149 		}
6150 
6151 		spin_lock_bh(&ar->data_lock);
6152 
6153 		peer = ath10k_peer_find(ar, arvif->vdev_id, sta->addr);
6154 		if (!peer) {
6155 			ath10k_warn(ar, "failed to lookup peer %pM on vdev %i\n",
6156 				    vif->addr, arvif->vdev_id);
6157 			spin_unlock_bh(&ar->data_lock);
6158 			ath10k_peer_delete(ar, arvif->vdev_id, sta->addr);
6159 			ath10k_mac_dec_num_stations(arvif, sta);
6160 			ret = -ENOENT;
6161 			goto exit;
6162 		}
6163 
6164 		arsta->peer_id = find_first_bit(peer->peer_ids,
6165 						ATH10K_MAX_NUM_PEER_IDS);
6166 
6167 		spin_unlock_bh(&ar->data_lock);
6168 
6169 		if (!sta->tdls)
6170 			goto exit;
6171 
6172 		ret = ath10k_wmi_update_fw_tdls_state(ar, arvif->vdev_id,
6173 						      WMI_TDLS_ENABLE_ACTIVE);
6174 		if (ret) {
6175 			ath10k_warn(ar, "failed to update fw tdls state on vdev %i: %i\n",
6176 				    arvif->vdev_id, ret);
6177 			ath10k_peer_delete(ar, arvif->vdev_id,
6178 					   sta->addr);
6179 			ath10k_mac_dec_num_stations(arvif, sta);
6180 			goto exit;
6181 		}
6182 
6183 		ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id, sta,
6184 						  WMI_TDLS_PEER_STATE_PEERING);
6185 		if (ret) {
6186 			ath10k_warn(ar,
6187 				    "failed to update tdls peer %pM for vdev %d when adding a new sta: %i\n",
6188 				    sta->addr, arvif->vdev_id, ret);
6189 			ath10k_peer_delete(ar, arvif->vdev_id, sta->addr);
6190 			ath10k_mac_dec_num_stations(arvif, sta);
6191 
6192 			if (num_tdls_stations != 0)
6193 				goto exit;
6194 			ath10k_wmi_update_fw_tdls_state(ar, arvif->vdev_id,
6195 							WMI_TDLS_DISABLE);
6196 		}
6197 	} else if ((old_state == IEEE80211_STA_NONE &&
6198 		    new_state == IEEE80211_STA_NOTEXIST)) {
6199 		/*
6200 		 * Existing station deletion.
6201 		 */
6202 		ath10k_dbg(ar, ATH10K_DBG_MAC,
6203 			   "mac vdev %d peer delete %pM sta %pK (sta gone)\n",
6204 			   arvif->vdev_id, sta->addr, sta);
6205 
6206 		if (sta->tdls) {
6207 			ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id,
6208 							  sta,
6209 							  WMI_TDLS_PEER_STATE_TEARDOWN);
6210 			if (ret)
6211 				ath10k_warn(ar, "failed to update tdls peer state for %pM state %d: %i\n",
6212 					    sta->addr,
6213 					    WMI_TDLS_PEER_STATE_TEARDOWN, ret);
6214 		}
6215 
6216 		ret = ath10k_peer_delete(ar, arvif->vdev_id, sta->addr);
6217 		if (ret)
6218 			ath10k_warn(ar, "failed to delete peer %pM for vdev %d: %i\n",
6219 				    sta->addr, arvif->vdev_id, ret);
6220 
6221 		ath10k_mac_dec_num_stations(arvif, sta);
6222 
6223 		spin_lock_bh(&ar->data_lock);
6224 		for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++) {
6225 			peer = ar->peer_map[i];
6226 			if (!peer)
6227 				continue;
6228 
6229 			if (peer->sta == sta) {
6230 				ath10k_warn(ar, "found sta peer %pM (ptr %pK id %d) entry on vdev %i after it was supposedly removed\n",
6231 					    sta->addr, peer, i, arvif->vdev_id);
6232 				peer->sta = NULL;
6233 
6234 				/* Clean up the peer object as well since we
6235 				 * must have failed to do this above.
6236 				 */
6237 				list_del(&peer->list);
6238 				ar->peer_map[i] = NULL;
6239 				kfree(peer);
6240 				ar->num_peers--;
6241 			}
6242 		}
6243 		spin_unlock_bh(&ar->data_lock);
6244 
6245 		for (i = 0; i < ARRAY_SIZE(sta->txq); i++)
6246 			ath10k_mac_txq_unref(ar, sta->txq[i]);
6247 
6248 		if (!sta->tdls)
6249 			goto exit;
6250 
6251 		if (ath10k_mac_tdls_vif_stations_count(hw, vif))
6252 			goto exit;
6253 
6254 		/* This was the last tdls peer in current vif */
6255 		ret = ath10k_wmi_update_fw_tdls_state(ar, arvif->vdev_id,
6256 						      WMI_TDLS_DISABLE);
6257 		if (ret) {
6258 			ath10k_warn(ar, "failed to update fw tdls state on vdev %i: %i\n",
6259 				    arvif->vdev_id, ret);
6260 		}
6261 	} else if (old_state == IEEE80211_STA_AUTH &&
6262 		   new_state == IEEE80211_STA_ASSOC &&
6263 		   (vif->type == NL80211_IFTYPE_AP ||
6264 		    vif->type == NL80211_IFTYPE_MESH_POINT ||
6265 		    vif->type == NL80211_IFTYPE_ADHOC)) {
6266 		/*
6267 		 * New association.
6268 		 */
6269 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac sta %pM associated\n",
6270 			   sta->addr);
6271 
6272 		ret = ath10k_station_assoc(ar, vif, sta, false);
6273 		if (ret)
6274 			ath10k_warn(ar, "failed to associate station %pM for vdev %i: %i\n",
6275 				    sta->addr, arvif->vdev_id, ret);
6276 	} else if (old_state == IEEE80211_STA_ASSOC &&
6277 		   new_state == IEEE80211_STA_AUTHORIZED &&
6278 		   sta->tdls) {
6279 		/*
6280 		 * Tdls station authorized.
6281 		 */
6282 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac tdls sta %pM authorized\n",
6283 			   sta->addr);
6284 
6285 		ret = ath10k_station_assoc(ar, vif, sta, false);
6286 		if (ret) {
6287 			ath10k_warn(ar, "failed to associate tdls station %pM for vdev %i: %i\n",
6288 				    sta->addr, arvif->vdev_id, ret);
6289 			goto exit;
6290 		}
6291 
6292 		ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id, sta,
6293 						  WMI_TDLS_PEER_STATE_CONNECTED);
6294 		if (ret)
6295 			ath10k_warn(ar, "failed to update tdls peer %pM for vdev %i: %i\n",
6296 				    sta->addr, arvif->vdev_id, ret);
6297 	} else if (old_state == IEEE80211_STA_ASSOC &&
6298 		    new_state == IEEE80211_STA_AUTH &&
6299 		    (vif->type == NL80211_IFTYPE_AP ||
6300 		     vif->type == NL80211_IFTYPE_MESH_POINT ||
6301 		     vif->type == NL80211_IFTYPE_ADHOC)) {
6302 		/*
6303 		 * Disassociation.
6304 		 */
6305 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac sta %pM disassociated\n",
6306 			   sta->addr);
6307 
6308 		ret = ath10k_station_disassoc(ar, vif, sta);
6309 		if (ret)
6310 			ath10k_warn(ar, "failed to disassociate station: %pM vdev %i: %i\n",
6311 				    sta->addr, arvif->vdev_id, ret);
6312 	}
6313 exit:
6314 	mutex_unlock(&ar->conf_mutex);
6315 	return ret;
6316 }
6317 
6318 static int ath10k_conf_tx_uapsd(struct ath10k *ar, struct ieee80211_vif *vif,
6319 				u16 ac, bool enable)
6320 {
6321 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
6322 	struct wmi_sta_uapsd_auto_trig_arg arg = {};
6323 	u32 prio = 0, acc = 0;
6324 	u32 value = 0;
6325 	int ret = 0;
6326 
6327 	lockdep_assert_held(&ar->conf_mutex);
6328 
6329 	if (arvif->vdev_type != WMI_VDEV_TYPE_STA)
6330 		return 0;
6331 
6332 	switch (ac) {
6333 	case IEEE80211_AC_VO:
6334 		value = WMI_STA_PS_UAPSD_AC3_DELIVERY_EN |
6335 			WMI_STA_PS_UAPSD_AC3_TRIGGER_EN;
6336 		prio = 7;
6337 		acc = 3;
6338 		break;
6339 	case IEEE80211_AC_VI:
6340 		value = WMI_STA_PS_UAPSD_AC2_DELIVERY_EN |
6341 			WMI_STA_PS_UAPSD_AC2_TRIGGER_EN;
6342 		prio = 5;
6343 		acc = 2;
6344 		break;
6345 	case IEEE80211_AC_BE:
6346 		value = WMI_STA_PS_UAPSD_AC1_DELIVERY_EN |
6347 			WMI_STA_PS_UAPSD_AC1_TRIGGER_EN;
6348 		prio = 2;
6349 		acc = 1;
6350 		break;
6351 	case IEEE80211_AC_BK:
6352 		value = WMI_STA_PS_UAPSD_AC0_DELIVERY_EN |
6353 			WMI_STA_PS_UAPSD_AC0_TRIGGER_EN;
6354 		prio = 0;
6355 		acc = 0;
6356 		break;
6357 	}
6358 
6359 	if (enable)
6360 		arvif->u.sta.uapsd |= value;
6361 	else
6362 		arvif->u.sta.uapsd &= ~value;
6363 
6364 	ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
6365 					  WMI_STA_PS_PARAM_UAPSD,
6366 					  arvif->u.sta.uapsd);
6367 	if (ret) {
6368 		ath10k_warn(ar, "failed to set uapsd params: %d\n", ret);
6369 		goto exit;
6370 	}
6371 
6372 	if (arvif->u.sta.uapsd)
6373 		value = WMI_STA_PS_RX_WAKE_POLICY_POLL_UAPSD;
6374 	else
6375 		value = WMI_STA_PS_RX_WAKE_POLICY_WAKE;
6376 
6377 	ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
6378 					  WMI_STA_PS_PARAM_RX_WAKE_POLICY,
6379 					  value);
6380 	if (ret)
6381 		ath10k_warn(ar, "failed to set rx wake param: %d\n", ret);
6382 
6383 	ret = ath10k_mac_vif_recalc_ps_wake_threshold(arvif);
6384 	if (ret) {
6385 		ath10k_warn(ar, "failed to recalc ps wake threshold on vdev %i: %d\n",
6386 			    arvif->vdev_id, ret);
6387 		return ret;
6388 	}
6389 
6390 	ret = ath10k_mac_vif_recalc_ps_poll_count(arvif);
6391 	if (ret) {
6392 		ath10k_warn(ar, "failed to recalc ps poll count on vdev %i: %d\n",
6393 			    arvif->vdev_id, ret);
6394 		return ret;
6395 	}
6396 
6397 	if (test_bit(WMI_SERVICE_STA_UAPSD_BASIC_AUTO_TRIG, ar->wmi.svc_map) ||
6398 	    test_bit(WMI_SERVICE_STA_UAPSD_VAR_AUTO_TRIG, ar->wmi.svc_map)) {
6399 		/* Only userspace can make an educated decision when to send
6400 		 * trigger frame. The following effectively disables u-UAPSD
6401 		 * autotrigger in firmware (which is enabled by default
6402 		 * provided the autotrigger service is available).
6403 		 */
6404 
6405 		arg.wmm_ac = acc;
6406 		arg.user_priority = prio;
6407 		arg.service_interval = 0;
6408 		arg.suspend_interval = WMI_STA_UAPSD_MAX_INTERVAL_MSEC;
6409 		arg.delay_interval = WMI_STA_UAPSD_MAX_INTERVAL_MSEC;
6410 
6411 		ret = ath10k_wmi_vdev_sta_uapsd(ar, arvif->vdev_id,
6412 						arvif->bssid, &arg, 1);
6413 		if (ret) {
6414 			ath10k_warn(ar, "failed to set uapsd auto trigger %d\n",
6415 				    ret);
6416 			return ret;
6417 		}
6418 	}
6419 
6420 exit:
6421 	return ret;
6422 }
6423 
6424 static int ath10k_conf_tx(struct ieee80211_hw *hw,
6425 			  struct ieee80211_vif *vif, u16 ac,
6426 			  const struct ieee80211_tx_queue_params *params)
6427 {
6428 	struct ath10k *ar = hw->priv;
6429 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
6430 	struct wmi_wmm_params_arg *p = NULL;
6431 	int ret;
6432 
6433 	mutex_lock(&ar->conf_mutex);
6434 
6435 	switch (ac) {
6436 	case IEEE80211_AC_VO:
6437 		p = &arvif->wmm_params.ac_vo;
6438 		break;
6439 	case IEEE80211_AC_VI:
6440 		p = &arvif->wmm_params.ac_vi;
6441 		break;
6442 	case IEEE80211_AC_BE:
6443 		p = &arvif->wmm_params.ac_be;
6444 		break;
6445 	case IEEE80211_AC_BK:
6446 		p = &arvif->wmm_params.ac_bk;
6447 		break;
6448 	}
6449 
6450 	if (WARN_ON(!p)) {
6451 		ret = -EINVAL;
6452 		goto exit;
6453 	}
6454 
6455 	p->cwmin = params->cw_min;
6456 	p->cwmax = params->cw_max;
6457 	p->aifs = params->aifs;
6458 
6459 	/*
6460 	 * The channel time duration programmed in the HW is in absolute
6461 	 * microseconds, while mac80211 gives the txop in units of
6462 	 * 32 microseconds.
6463 	 */
6464 	p->txop = params->txop * 32;
6465 
6466 	if (ar->wmi.ops->gen_vdev_wmm_conf) {
6467 		ret = ath10k_wmi_vdev_wmm_conf(ar, arvif->vdev_id,
6468 					       &arvif->wmm_params);
6469 		if (ret) {
6470 			ath10k_warn(ar, "failed to set vdev wmm params on vdev %i: %d\n",
6471 				    arvif->vdev_id, ret);
6472 			goto exit;
6473 		}
6474 	} else {
6475 		/* This won't work well with multi-interface cases but it's
6476 		 * better than nothing.
6477 		 */
6478 		ret = ath10k_wmi_pdev_set_wmm_params(ar, &arvif->wmm_params);
6479 		if (ret) {
6480 			ath10k_warn(ar, "failed to set wmm params: %d\n", ret);
6481 			goto exit;
6482 		}
6483 	}
6484 
6485 	ret = ath10k_conf_tx_uapsd(ar, vif, ac, params->uapsd);
6486 	if (ret)
6487 		ath10k_warn(ar, "failed to set sta uapsd: %d\n", ret);
6488 
6489 exit:
6490 	mutex_unlock(&ar->conf_mutex);
6491 	return ret;
6492 }
6493 
6494 #define ATH10K_ROC_TIMEOUT_HZ (2 * HZ)
6495 
6496 static int ath10k_remain_on_channel(struct ieee80211_hw *hw,
6497 				    struct ieee80211_vif *vif,
6498 				    struct ieee80211_channel *chan,
6499 				    int duration,
6500 				    enum ieee80211_roc_type type)
6501 {
6502 	struct ath10k *ar = hw->priv;
6503 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
6504 	struct wmi_start_scan_arg arg;
6505 	int ret = 0;
6506 	u32 scan_time_msec;
6507 
6508 	mutex_lock(&ar->conf_mutex);
6509 
6510 	if (ath10k_mac_tdls_vif_stations_count(hw, vif) > 0) {
6511 		ret = -EBUSY;
6512 		goto exit;
6513 	}
6514 
6515 	spin_lock_bh(&ar->data_lock);
6516 	switch (ar->scan.state) {
6517 	case ATH10K_SCAN_IDLE:
6518 		reinit_completion(&ar->scan.started);
6519 		reinit_completion(&ar->scan.completed);
6520 		reinit_completion(&ar->scan.on_channel);
6521 		ar->scan.state = ATH10K_SCAN_STARTING;
6522 		ar->scan.is_roc = true;
6523 		ar->scan.vdev_id = arvif->vdev_id;
6524 		ar->scan.roc_freq = chan->center_freq;
6525 		ar->scan.roc_notify = true;
6526 		ret = 0;
6527 		break;
6528 	case ATH10K_SCAN_STARTING:
6529 	case ATH10K_SCAN_RUNNING:
6530 	case ATH10K_SCAN_ABORTING:
6531 		ret = -EBUSY;
6532 		break;
6533 	}
6534 	spin_unlock_bh(&ar->data_lock);
6535 
6536 	if (ret)
6537 		goto exit;
6538 
6539 	scan_time_msec = ar->hw->wiphy->max_remain_on_channel_duration * 2;
6540 
6541 	memset(&arg, 0, sizeof(arg));
6542 	ath10k_wmi_start_scan_init(ar, &arg);
6543 	arg.vdev_id = arvif->vdev_id;
6544 	arg.scan_id = ATH10K_SCAN_ID;
6545 	arg.n_channels = 1;
6546 	arg.channels[0] = chan->center_freq;
6547 	arg.dwell_time_active = scan_time_msec;
6548 	arg.dwell_time_passive = scan_time_msec;
6549 	arg.max_scan_time = scan_time_msec;
6550 	arg.scan_ctrl_flags |= WMI_SCAN_FLAG_PASSIVE;
6551 	arg.scan_ctrl_flags |= WMI_SCAN_FILTER_PROBE_REQ;
6552 	arg.burst_duration_ms = duration;
6553 
6554 	ret = ath10k_start_scan(ar, &arg);
6555 	if (ret) {
6556 		ath10k_warn(ar, "failed to start roc scan: %d\n", ret);
6557 		spin_lock_bh(&ar->data_lock);
6558 		ar->scan.state = ATH10K_SCAN_IDLE;
6559 		spin_unlock_bh(&ar->data_lock);
6560 		goto exit;
6561 	}
6562 
6563 	ret = wait_for_completion_timeout(&ar->scan.on_channel, 3 * HZ);
6564 	if (ret == 0) {
6565 		ath10k_warn(ar, "failed to switch to channel for roc scan\n");
6566 
6567 		ret = ath10k_scan_stop(ar);
6568 		if (ret)
6569 			ath10k_warn(ar, "failed to stop scan: %d\n", ret);
6570 
6571 		ret = -ETIMEDOUT;
6572 		goto exit;
6573 	}
6574 
6575 	ieee80211_queue_delayed_work(ar->hw, &ar->scan.timeout,
6576 				     msecs_to_jiffies(duration));
6577 
6578 	ret = 0;
6579 exit:
6580 	mutex_unlock(&ar->conf_mutex);
6581 	return ret;
6582 }
6583 
6584 static int ath10k_cancel_remain_on_channel(struct ieee80211_hw *hw)
6585 {
6586 	struct ath10k *ar = hw->priv;
6587 
6588 	mutex_lock(&ar->conf_mutex);
6589 
6590 	spin_lock_bh(&ar->data_lock);
6591 	ar->scan.roc_notify = false;
6592 	spin_unlock_bh(&ar->data_lock);
6593 
6594 	ath10k_scan_abort(ar);
6595 
6596 	mutex_unlock(&ar->conf_mutex);
6597 
6598 	cancel_delayed_work_sync(&ar->scan.timeout);
6599 
6600 	return 0;
6601 }
6602 
6603 /*
6604  * Both RTS and Fragmentation threshold are interface-specific
6605  * in ath10k, but device-specific in mac80211.
6606  */
6607 
6608 static int ath10k_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
6609 {
6610 	struct ath10k *ar = hw->priv;
6611 	struct ath10k_vif *arvif;
6612 	int ret = 0;
6613 
6614 	mutex_lock(&ar->conf_mutex);
6615 	list_for_each_entry(arvif, &ar->arvifs, list) {
6616 		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d rts threshold %d\n",
6617 			   arvif->vdev_id, value);
6618 
6619 		ret = ath10k_mac_set_rts(arvif, value);
6620 		if (ret) {
6621 			ath10k_warn(ar, "failed to set rts threshold for vdev %d: %d\n",
6622 				    arvif->vdev_id, ret);
6623 			break;
6624 		}
6625 	}
6626 	mutex_unlock(&ar->conf_mutex);
6627 
6628 	return ret;
6629 }
6630 
6631 static int ath10k_mac_op_set_frag_threshold(struct ieee80211_hw *hw, u32 value)
6632 {
6633 	/* Even though there's a WMI enum for fragmentation threshold no known
6634 	 * firmware actually implements it. Moreover it is not possible to rely
6635 	 * frame fragmentation to mac80211 because firmware clears the "more
6636 	 * fragments" bit in frame control making it impossible for remote
6637 	 * devices to reassemble frames.
6638 	 *
6639 	 * Hence implement a dummy callback just to say fragmentation isn't
6640 	 * supported. This effectively prevents mac80211 from doing frame
6641 	 * fragmentation in software.
6642 	 */
6643 	return -EOPNOTSUPP;
6644 }
6645 
6646 static void ath10k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
6647 			 u32 queues, bool drop)
6648 {
6649 	struct ath10k *ar = hw->priv;
6650 	bool skip;
6651 	long time_left;
6652 
6653 	/* mac80211 doesn't care if we really xmit queued frames or not
6654 	 * we'll collect those frames either way if we stop/delete vdevs
6655 	 */
6656 	if (drop)
6657 		return;
6658 
6659 	mutex_lock(&ar->conf_mutex);
6660 
6661 	if (ar->state == ATH10K_STATE_WEDGED)
6662 		goto skip;
6663 
6664 	time_left = wait_event_timeout(ar->htt.empty_tx_wq, ({
6665 			bool empty;
6666 
6667 			spin_lock_bh(&ar->htt.tx_lock);
6668 			empty = (ar->htt.num_pending_tx == 0);
6669 			spin_unlock_bh(&ar->htt.tx_lock);
6670 
6671 			skip = (ar->state == ATH10K_STATE_WEDGED) ||
6672 			       test_bit(ATH10K_FLAG_CRASH_FLUSH,
6673 					&ar->dev_flags);
6674 
6675 			(empty || skip);
6676 		}), ATH10K_FLUSH_TIMEOUT_HZ);
6677 
6678 	if (time_left == 0 || skip)
6679 		ath10k_warn(ar, "failed to flush transmit queue (skip %i ar-state %i): %ld\n",
6680 			    skip, ar->state, time_left);
6681 
6682 skip:
6683 	mutex_unlock(&ar->conf_mutex);
6684 }
6685 
6686 /* TODO: Implement this function properly
6687  * For now it is needed to reply to Probe Requests in IBSS mode.
6688  * Propably we need this information from FW.
6689  */
6690 static int ath10k_tx_last_beacon(struct ieee80211_hw *hw)
6691 {
6692 	return 1;
6693 }
6694 
6695 static void ath10k_reconfig_complete(struct ieee80211_hw *hw,
6696 				     enum ieee80211_reconfig_type reconfig_type)
6697 {
6698 	struct ath10k *ar = hw->priv;
6699 
6700 	if (reconfig_type != IEEE80211_RECONFIG_TYPE_RESTART)
6701 		return;
6702 
6703 	mutex_lock(&ar->conf_mutex);
6704 
6705 	/* If device failed to restart it will be in a different state, e.g.
6706 	 * ATH10K_STATE_WEDGED
6707 	 */
6708 	if (ar->state == ATH10K_STATE_RESTARTED) {
6709 		ath10k_info(ar, "device successfully recovered\n");
6710 		ar->state = ATH10K_STATE_ON;
6711 		ieee80211_wake_queues(ar->hw);
6712 	}
6713 
6714 	mutex_unlock(&ar->conf_mutex);
6715 }
6716 
6717 static void
6718 ath10k_mac_update_bss_chan_survey(struct ath10k *ar,
6719 				  struct ieee80211_channel *channel)
6720 {
6721 	int ret;
6722 	enum wmi_bss_survey_req_type type = WMI_BSS_SURVEY_REQ_TYPE_READ_CLEAR;
6723 
6724 	lockdep_assert_held(&ar->conf_mutex);
6725 
6726 	if (!test_bit(WMI_SERVICE_BSS_CHANNEL_INFO_64, ar->wmi.svc_map) ||
6727 	    (ar->rx_channel != channel))
6728 		return;
6729 
6730 	if (ar->scan.state != ATH10K_SCAN_IDLE) {
6731 		ath10k_dbg(ar, ATH10K_DBG_MAC, "ignoring bss chan info request while scanning..\n");
6732 		return;
6733 	}
6734 
6735 	reinit_completion(&ar->bss_survey_done);
6736 
6737 	ret = ath10k_wmi_pdev_bss_chan_info_request(ar, type);
6738 	if (ret) {
6739 		ath10k_warn(ar, "failed to send pdev bss chan info request\n");
6740 		return;
6741 	}
6742 
6743 	ret = wait_for_completion_timeout(&ar->bss_survey_done, 3 * HZ);
6744 	if (!ret) {
6745 		ath10k_warn(ar, "bss channel survey timed out\n");
6746 		return;
6747 	}
6748 }
6749 
6750 static int ath10k_get_survey(struct ieee80211_hw *hw, int idx,
6751 			     struct survey_info *survey)
6752 {
6753 	struct ath10k *ar = hw->priv;
6754 	struct ieee80211_supported_band *sband;
6755 	struct survey_info *ar_survey = &ar->survey[idx];
6756 	int ret = 0;
6757 
6758 	mutex_lock(&ar->conf_mutex);
6759 
6760 	sband = hw->wiphy->bands[NL80211_BAND_2GHZ];
6761 	if (sband && idx >= sband->n_channels) {
6762 		idx -= sband->n_channels;
6763 		sband = NULL;
6764 	}
6765 
6766 	if (!sband)
6767 		sband = hw->wiphy->bands[NL80211_BAND_5GHZ];
6768 
6769 	if (!sband || idx >= sband->n_channels) {
6770 		ret = -ENOENT;
6771 		goto exit;
6772 	}
6773 
6774 	ath10k_mac_update_bss_chan_survey(ar, &sband->channels[idx]);
6775 
6776 	spin_lock_bh(&ar->data_lock);
6777 	memcpy(survey, ar_survey, sizeof(*survey));
6778 	spin_unlock_bh(&ar->data_lock);
6779 
6780 	survey->channel = &sband->channels[idx];
6781 
6782 	if (ar->rx_channel == survey->channel)
6783 		survey->filled |= SURVEY_INFO_IN_USE;
6784 
6785 exit:
6786 	mutex_unlock(&ar->conf_mutex);
6787 	return ret;
6788 }
6789 
6790 static bool
6791 ath10k_mac_bitrate_mask_has_single_rate(struct ath10k *ar,
6792 					enum nl80211_band band,
6793 					const struct cfg80211_bitrate_mask *mask)
6794 {
6795 	int num_rates = 0;
6796 	int i;
6797 
6798 	num_rates += hweight32(mask->control[band].legacy);
6799 
6800 	for (i = 0; i < ARRAY_SIZE(mask->control[band].ht_mcs); i++)
6801 		num_rates += hweight8(mask->control[band].ht_mcs[i]);
6802 
6803 	for (i = 0; i < ARRAY_SIZE(mask->control[band].vht_mcs); i++)
6804 		num_rates += hweight16(mask->control[band].vht_mcs[i]);
6805 
6806 	return num_rates == 1;
6807 }
6808 
6809 static bool
6810 ath10k_mac_bitrate_mask_get_single_nss(struct ath10k *ar,
6811 				       enum nl80211_band band,
6812 				       const struct cfg80211_bitrate_mask *mask,
6813 				       int *nss)
6814 {
6815 	struct ieee80211_supported_band *sband = &ar->mac.sbands[band];
6816 	u16 vht_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
6817 	u8 ht_nss_mask = 0;
6818 	u8 vht_nss_mask = 0;
6819 	int i;
6820 
6821 	if (mask->control[band].legacy)
6822 		return false;
6823 
6824 	for (i = 0; i < ARRAY_SIZE(mask->control[band].ht_mcs); i++) {
6825 		if (mask->control[band].ht_mcs[i] == 0)
6826 			continue;
6827 		else if (mask->control[band].ht_mcs[i] ==
6828 			 sband->ht_cap.mcs.rx_mask[i])
6829 			ht_nss_mask |= BIT(i);
6830 		else
6831 			return false;
6832 	}
6833 
6834 	for (i = 0; i < ARRAY_SIZE(mask->control[band].vht_mcs); i++) {
6835 		if (mask->control[band].vht_mcs[i] == 0)
6836 			continue;
6837 		else if (mask->control[band].vht_mcs[i] ==
6838 			 ath10k_mac_get_max_vht_mcs_map(vht_mcs_map, i))
6839 			vht_nss_mask |= BIT(i);
6840 		else
6841 			return false;
6842 	}
6843 
6844 	if (ht_nss_mask != vht_nss_mask)
6845 		return false;
6846 
6847 	if (ht_nss_mask == 0)
6848 		return false;
6849 
6850 	if (BIT(fls(ht_nss_mask)) - 1 != ht_nss_mask)
6851 		return false;
6852 
6853 	*nss = fls(ht_nss_mask);
6854 
6855 	return true;
6856 }
6857 
6858 static int
6859 ath10k_mac_bitrate_mask_get_single_rate(struct ath10k *ar,
6860 					enum nl80211_band band,
6861 					const struct cfg80211_bitrate_mask *mask,
6862 					u8 *rate, u8 *nss)
6863 {
6864 	struct ieee80211_supported_band *sband = &ar->mac.sbands[band];
6865 	int rate_idx;
6866 	int i;
6867 	u16 bitrate;
6868 	u8 preamble;
6869 	u8 hw_rate;
6870 
6871 	if (hweight32(mask->control[band].legacy) == 1) {
6872 		rate_idx = ffs(mask->control[band].legacy) - 1;
6873 
6874 		hw_rate = sband->bitrates[rate_idx].hw_value;
6875 		bitrate = sband->bitrates[rate_idx].bitrate;
6876 
6877 		if (ath10k_mac_bitrate_is_cck(bitrate))
6878 			preamble = WMI_RATE_PREAMBLE_CCK;
6879 		else
6880 			preamble = WMI_RATE_PREAMBLE_OFDM;
6881 
6882 		*nss = 1;
6883 		*rate = preamble << 6 |
6884 			(*nss - 1) << 4 |
6885 			hw_rate << 0;
6886 
6887 		return 0;
6888 	}
6889 
6890 	for (i = 0; i < ARRAY_SIZE(mask->control[band].ht_mcs); i++) {
6891 		if (hweight8(mask->control[band].ht_mcs[i]) == 1) {
6892 			*nss = i + 1;
6893 			*rate = WMI_RATE_PREAMBLE_HT << 6 |
6894 				(*nss - 1) << 4 |
6895 				(ffs(mask->control[band].ht_mcs[i]) - 1);
6896 
6897 			return 0;
6898 		}
6899 	}
6900 
6901 	for (i = 0; i < ARRAY_SIZE(mask->control[band].vht_mcs); i++) {
6902 		if (hweight16(mask->control[band].vht_mcs[i]) == 1) {
6903 			*nss = i + 1;
6904 			*rate = WMI_RATE_PREAMBLE_VHT << 6 |
6905 				(*nss - 1) << 4 |
6906 				(ffs(mask->control[band].vht_mcs[i]) - 1);
6907 
6908 			return 0;
6909 		}
6910 	}
6911 
6912 	return -EINVAL;
6913 }
6914 
6915 static int ath10k_mac_set_fixed_rate_params(struct ath10k_vif *arvif,
6916 					    u8 rate, u8 nss, u8 sgi, u8 ldpc)
6917 {
6918 	struct ath10k *ar = arvif->ar;
6919 	u32 vdev_param;
6920 	int ret;
6921 
6922 	lockdep_assert_held(&ar->conf_mutex);
6923 
6924 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac set fixed rate params vdev %i rate 0x%02hhx nss %hhu sgi %hhu\n",
6925 		   arvif->vdev_id, rate, nss, sgi);
6926 
6927 	vdev_param = ar->wmi.vdev_param->fixed_rate;
6928 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param, rate);
6929 	if (ret) {
6930 		ath10k_warn(ar, "failed to set fixed rate param 0x%02x: %d\n",
6931 			    rate, ret);
6932 		return ret;
6933 	}
6934 
6935 	vdev_param = ar->wmi.vdev_param->nss;
6936 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param, nss);
6937 	if (ret) {
6938 		ath10k_warn(ar, "failed to set nss param %d: %d\n", nss, ret);
6939 		return ret;
6940 	}
6941 
6942 	vdev_param = ar->wmi.vdev_param->sgi;
6943 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param, sgi);
6944 	if (ret) {
6945 		ath10k_warn(ar, "failed to set sgi param %d: %d\n", sgi, ret);
6946 		return ret;
6947 	}
6948 
6949 	vdev_param = ar->wmi.vdev_param->ldpc;
6950 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param, ldpc);
6951 	if (ret) {
6952 		ath10k_warn(ar, "failed to set ldpc param %d: %d\n", ldpc, ret);
6953 		return ret;
6954 	}
6955 
6956 	return 0;
6957 }
6958 
6959 static bool
6960 ath10k_mac_can_set_bitrate_mask(struct ath10k *ar,
6961 				enum nl80211_band band,
6962 				const struct cfg80211_bitrate_mask *mask)
6963 {
6964 	int i;
6965 	u16 vht_mcs;
6966 
6967 	/* Due to firmware limitation in WMI_PEER_ASSOC_CMDID it is impossible
6968 	 * to express all VHT MCS rate masks. Effectively only the following
6969 	 * ranges can be used: none, 0-7, 0-8 and 0-9.
6970 	 */
6971 	for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
6972 		vht_mcs = mask->control[band].vht_mcs[i];
6973 
6974 		switch (vht_mcs) {
6975 		case 0:
6976 		case BIT(8) - 1:
6977 		case BIT(9) - 1:
6978 		case BIT(10) - 1:
6979 			break;
6980 		default:
6981 			ath10k_warn(ar, "refusing bitrate mask with missing 0-7 VHT MCS rates\n");
6982 			return false;
6983 		}
6984 	}
6985 
6986 	return true;
6987 }
6988 
6989 static void ath10k_mac_set_bitrate_mask_iter(void *data,
6990 					     struct ieee80211_sta *sta)
6991 {
6992 	struct ath10k_vif *arvif = data;
6993 	struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
6994 	struct ath10k *ar = arvif->ar;
6995 
6996 	if (arsta->arvif != arvif)
6997 		return;
6998 
6999 	spin_lock_bh(&ar->data_lock);
7000 	arsta->changed |= IEEE80211_RC_SUPP_RATES_CHANGED;
7001 	spin_unlock_bh(&ar->data_lock);
7002 
7003 	ieee80211_queue_work(ar->hw, &arsta->update_wk);
7004 }
7005 
7006 static int ath10k_mac_op_set_bitrate_mask(struct ieee80211_hw *hw,
7007 					  struct ieee80211_vif *vif,
7008 					  const struct cfg80211_bitrate_mask *mask)
7009 {
7010 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
7011 	struct cfg80211_chan_def def;
7012 	struct ath10k *ar = arvif->ar;
7013 	enum nl80211_band band;
7014 	const u8 *ht_mcs_mask;
7015 	const u16 *vht_mcs_mask;
7016 	u8 rate;
7017 	u8 nss;
7018 	u8 sgi;
7019 	u8 ldpc;
7020 	int single_nss;
7021 	int ret;
7022 
7023 	if (ath10k_mac_vif_chan(vif, &def))
7024 		return -EPERM;
7025 
7026 	band = def.chan->band;
7027 	ht_mcs_mask = mask->control[band].ht_mcs;
7028 	vht_mcs_mask = mask->control[band].vht_mcs;
7029 	ldpc = !!(ar->ht_cap_info & WMI_HT_CAP_LDPC);
7030 
7031 	sgi = mask->control[band].gi;
7032 	if (sgi == NL80211_TXRATE_FORCE_LGI)
7033 		return -EINVAL;
7034 
7035 	if (ath10k_mac_bitrate_mask_has_single_rate(ar, band, mask)) {
7036 		ret = ath10k_mac_bitrate_mask_get_single_rate(ar, band, mask,
7037 							      &rate, &nss);
7038 		if (ret) {
7039 			ath10k_warn(ar, "failed to get single rate for vdev %i: %d\n",
7040 				    arvif->vdev_id, ret);
7041 			return ret;
7042 		}
7043 	} else if (ath10k_mac_bitrate_mask_get_single_nss(ar, band, mask,
7044 							  &single_nss)) {
7045 		rate = WMI_FIXED_RATE_NONE;
7046 		nss = single_nss;
7047 	} else {
7048 		rate = WMI_FIXED_RATE_NONE;
7049 		nss = min(ar->num_rf_chains,
7050 			  max(ath10k_mac_max_ht_nss(ht_mcs_mask),
7051 			      ath10k_mac_max_vht_nss(vht_mcs_mask)));
7052 
7053 		if (!ath10k_mac_can_set_bitrate_mask(ar, band, mask))
7054 			return -EINVAL;
7055 
7056 		mutex_lock(&ar->conf_mutex);
7057 
7058 		arvif->bitrate_mask = *mask;
7059 		ieee80211_iterate_stations_atomic(ar->hw,
7060 						  ath10k_mac_set_bitrate_mask_iter,
7061 						  arvif);
7062 
7063 		mutex_unlock(&ar->conf_mutex);
7064 	}
7065 
7066 	mutex_lock(&ar->conf_mutex);
7067 
7068 	ret = ath10k_mac_set_fixed_rate_params(arvif, rate, nss, sgi, ldpc);
7069 	if (ret) {
7070 		ath10k_warn(ar, "failed to set fixed rate params on vdev %i: %d\n",
7071 			    arvif->vdev_id, ret);
7072 		goto exit;
7073 	}
7074 
7075 exit:
7076 	mutex_unlock(&ar->conf_mutex);
7077 
7078 	return ret;
7079 }
7080 
7081 static void ath10k_sta_rc_update(struct ieee80211_hw *hw,
7082 				 struct ieee80211_vif *vif,
7083 				 struct ieee80211_sta *sta,
7084 				 u32 changed)
7085 {
7086 	struct ath10k *ar = hw->priv;
7087 	struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
7088 	u32 bw, smps;
7089 
7090 	spin_lock_bh(&ar->data_lock);
7091 
7092 	ath10k_dbg(ar, ATH10K_DBG_MAC,
7093 		   "mac sta rc update for %pM changed %08x bw %d nss %d smps %d\n",
7094 		   sta->addr, changed, sta->bandwidth, sta->rx_nss,
7095 		   sta->smps_mode);
7096 
7097 	if (changed & IEEE80211_RC_BW_CHANGED) {
7098 		bw = WMI_PEER_CHWIDTH_20MHZ;
7099 
7100 		switch (sta->bandwidth) {
7101 		case IEEE80211_STA_RX_BW_20:
7102 			bw = WMI_PEER_CHWIDTH_20MHZ;
7103 			break;
7104 		case IEEE80211_STA_RX_BW_40:
7105 			bw = WMI_PEER_CHWIDTH_40MHZ;
7106 			break;
7107 		case IEEE80211_STA_RX_BW_80:
7108 			bw = WMI_PEER_CHWIDTH_80MHZ;
7109 			break;
7110 		case IEEE80211_STA_RX_BW_160:
7111 			bw = WMI_PEER_CHWIDTH_160MHZ;
7112 			break;
7113 		default:
7114 			ath10k_warn(ar, "Invalid bandwidth %d in rc update for %pM\n",
7115 				    sta->bandwidth, sta->addr);
7116 			bw = WMI_PEER_CHWIDTH_20MHZ;
7117 			break;
7118 		}
7119 
7120 		arsta->bw = bw;
7121 	}
7122 
7123 	if (changed & IEEE80211_RC_NSS_CHANGED)
7124 		arsta->nss = sta->rx_nss;
7125 
7126 	if (changed & IEEE80211_RC_SMPS_CHANGED) {
7127 		smps = WMI_PEER_SMPS_PS_NONE;
7128 
7129 		switch (sta->smps_mode) {
7130 		case IEEE80211_SMPS_AUTOMATIC:
7131 		case IEEE80211_SMPS_OFF:
7132 			smps = WMI_PEER_SMPS_PS_NONE;
7133 			break;
7134 		case IEEE80211_SMPS_STATIC:
7135 			smps = WMI_PEER_SMPS_STATIC;
7136 			break;
7137 		case IEEE80211_SMPS_DYNAMIC:
7138 			smps = WMI_PEER_SMPS_DYNAMIC;
7139 			break;
7140 		case IEEE80211_SMPS_NUM_MODES:
7141 			ath10k_warn(ar, "Invalid smps %d in sta rc update for %pM\n",
7142 				    sta->smps_mode, sta->addr);
7143 			smps = WMI_PEER_SMPS_PS_NONE;
7144 			break;
7145 		}
7146 
7147 		arsta->smps = smps;
7148 	}
7149 
7150 	arsta->changed |= changed;
7151 
7152 	spin_unlock_bh(&ar->data_lock);
7153 
7154 	ieee80211_queue_work(hw, &arsta->update_wk);
7155 }
7156 
7157 static void ath10k_offset_tsf(struct ieee80211_hw *hw,
7158 			      struct ieee80211_vif *vif, s64 tsf_offset)
7159 {
7160 	struct ath10k *ar = hw->priv;
7161 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
7162 	u32 offset, vdev_param;
7163 	int ret;
7164 
7165 	if (tsf_offset < 0) {
7166 		vdev_param = ar->wmi.vdev_param->dec_tsf;
7167 		offset = -tsf_offset;
7168 	} else {
7169 		vdev_param = ar->wmi.vdev_param->inc_tsf;
7170 		offset = tsf_offset;
7171 	}
7172 
7173 	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
7174 					vdev_param, offset);
7175 
7176 	if (ret && ret != -EOPNOTSUPP)
7177 		ath10k_warn(ar, "failed to set tsf offset %d cmd %d: %d\n",
7178 			    offset, vdev_param, ret);
7179 }
7180 
7181 static int ath10k_ampdu_action(struct ieee80211_hw *hw,
7182 			       struct ieee80211_vif *vif,
7183 			       struct ieee80211_ampdu_params *params)
7184 {
7185 	struct ath10k *ar = hw->priv;
7186 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
7187 	struct ieee80211_sta *sta = params->sta;
7188 	enum ieee80211_ampdu_mlme_action action = params->action;
7189 	u16 tid = params->tid;
7190 
7191 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac ampdu vdev_id %i sta %pM tid %hu action %d\n",
7192 		   arvif->vdev_id, sta->addr, tid, action);
7193 
7194 	switch (action) {
7195 	case IEEE80211_AMPDU_RX_START:
7196 	case IEEE80211_AMPDU_RX_STOP:
7197 		/* HTT AddBa/DelBa events trigger mac80211 Rx BA session
7198 		 * creation/removal. Do we need to verify this?
7199 		 */
7200 		return 0;
7201 	case IEEE80211_AMPDU_TX_START:
7202 	case IEEE80211_AMPDU_TX_STOP_CONT:
7203 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
7204 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
7205 	case IEEE80211_AMPDU_TX_OPERATIONAL:
7206 		/* Firmware offloads Tx aggregation entirely so deny mac80211
7207 		 * Tx aggregation requests.
7208 		 */
7209 		return -EOPNOTSUPP;
7210 	}
7211 
7212 	return -EINVAL;
7213 }
7214 
7215 static void
7216 ath10k_mac_update_rx_channel(struct ath10k *ar,
7217 			     struct ieee80211_chanctx_conf *ctx,
7218 			     struct ieee80211_vif_chanctx_switch *vifs,
7219 			     int n_vifs)
7220 {
7221 	struct cfg80211_chan_def *def = NULL;
7222 
7223 	/* Both locks are required because ar->rx_channel is modified. This
7224 	 * allows readers to hold either lock.
7225 	 */
7226 	lockdep_assert_held(&ar->conf_mutex);
7227 	lockdep_assert_held(&ar->data_lock);
7228 
7229 	WARN_ON(ctx && vifs);
7230 	WARN_ON(vifs && !n_vifs);
7231 
7232 	/* FIXME: Sort of an optimization and a workaround. Peers and vifs are
7233 	 * on a linked list now. Doing a lookup peer -> vif -> chanctx for each
7234 	 * ppdu on Rx may reduce performance on low-end systems. It should be
7235 	 * possible to make tables/hashmaps to speed the lookup up (be vary of
7236 	 * cpu data cache lines though regarding sizes) but to keep the initial
7237 	 * implementation simple and less intrusive fallback to the slow lookup
7238 	 * only for multi-channel cases. Single-channel cases will remain to
7239 	 * use the old channel derival and thus performance should not be
7240 	 * affected much.
7241 	 */
7242 	rcu_read_lock();
7243 	if (!ctx && ath10k_mac_num_chanctxs(ar) == 1) {
7244 		ieee80211_iter_chan_contexts_atomic(ar->hw,
7245 						    ath10k_mac_get_any_chandef_iter,
7246 						    &def);
7247 
7248 		if (vifs)
7249 			def = &vifs[0].new_ctx->def;
7250 
7251 		ar->rx_channel = def->chan;
7252 	} else if ((ctx && ath10k_mac_num_chanctxs(ar) == 0) ||
7253 		   (ctx && (ar->state == ATH10K_STATE_RESTARTED))) {
7254 		/* During driver restart due to firmware assert, since mac80211
7255 		 * already has valid channel context for given radio, channel
7256 		 * context iteration return num_chanctx > 0. So fix rx_channel
7257 		 * when restart is in progress.
7258 		 */
7259 		ar->rx_channel = ctx->def.chan;
7260 	} else {
7261 		ar->rx_channel = NULL;
7262 	}
7263 	rcu_read_unlock();
7264 }
7265 
7266 static void
7267 ath10k_mac_update_vif_chan(struct ath10k *ar,
7268 			   struct ieee80211_vif_chanctx_switch *vifs,
7269 			   int n_vifs)
7270 {
7271 	struct ath10k_vif *arvif;
7272 	int ret;
7273 	int i;
7274 
7275 	lockdep_assert_held(&ar->conf_mutex);
7276 
7277 	/* First stop monitor interface. Some FW versions crash if there's a
7278 	 * lone monitor interface.
7279 	 */
7280 	if (ar->monitor_started)
7281 		ath10k_monitor_stop(ar);
7282 
7283 	for (i = 0; i < n_vifs; i++) {
7284 		arvif = (void *)vifs[i].vif->drv_priv;
7285 
7286 		ath10k_dbg(ar, ATH10K_DBG_MAC,
7287 			   "mac chanctx switch vdev_id %i freq %hu->%hu width %d->%d\n",
7288 			   arvif->vdev_id,
7289 			   vifs[i].old_ctx->def.chan->center_freq,
7290 			   vifs[i].new_ctx->def.chan->center_freq,
7291 			   vifs[i].old_ctx->def.width,
7292 			   vifs[i].new_ctx->def.width);
7293 
7294 		if (WARN_ON(!arvif->is_started))
7295 			continue;
7296 
7297 		if (WARN_ON(!arvif->is_up))
7298 			continue;
7299 
7300 		ret = ath10k_wmi_vdev_down(ar, arvif->vdev_id);
7301 		if (ret) {
7302 			ath10k_warn(ar, "failed to down vdev %d: %d\n",
7303 				    arvif->vdev_id, ret);
7304 			continue;
7305 		}
7306 	}
7307 
7308 	/* All relevant vdevs are downed and associated channel resources
7309 	 * should be available for the channel switch now.
7310 	 */
7311 
7312 	spin_lock_bh(&ar->data_lock);
7313 	ath10k_mac_update_rx_channel(ar, NULL, vifs, n_vifs);
7314 	spin_unlock_bh(&ar->data_lock);
7315 
7316 	for (i = 0; i < n_vifs; i++) {
7317 		arvif = (void *)vifs[i].vif->drv_priv;
7318 
7319 		if (WARN_ON(!arvif->is_started))
7320 			continue;
7321 
7322 		if (WARN_ON(!arvif->is_up))
7323 			continue;
7324 
7325 		ret = ath10k_mac_setup_bcn_tmpl(arvif);
7326 		if (ret)
7327 			ath10k_warn(ar, "failed to update bcn tmpl during csa: %d\n",
7328 				    ret);
7329 
7330 		ret = ath10k_mac_setup_prb_tmpl(arvif);
7331 		if (ret)
7332 			ath10k_warn(ar, "failed to update prb tmpl during csa: %d\n",
7333 				    ret);
7334 
7335 		ret = ath10k_vdev_restart(arvif, &vifs[i].new_ctx->def);
7336 		if (ret) {
7337 			ath10k_warn(ar, "failed to restart vdev %d: %d\n",
7338 				    arvif->vdev_id, ret);
7339 			continue;
7340 		}
7341 
7342 		ret = ath10k_wmi_vdev_up(arvif->ar, arvif->vdev_id, arvif->aid,
7343 					 arvif->bssid);
7344 		if (ret) {
7345 			ath10k_warn(ar, "failed to bring vdev up %d: %d\n",
7346 				    arvif->vdev_id, ret);
7347 			continue;
7348 		}
7349 	}
7350 
7351 	ath10k_monitor_recalc(ar);
7352 }
7353 
7354 static int
7355 ath10k_mac_op_add_chanctx(struct ieee80211_hw *hw,
7356 			  struct ieee80211_chanctx_conf *ctx)
7357 {
7358 	struct ath10k *ar = hw->priv;
7359 
7360 	ath10k_dbg(ar, ATH10K_DBG_MAC,
7361 		   "mac chanctx add freq %hu width %d ptr %pK\n",
7362 		   ctx->def.chan->center_freq, ctx->def.width, ctx);
7363 
7364 	mutex_lock(&ar->conf_mutex);
7365 
7366 	spin_lock_bh(&ar->data_lock);
7367 	ath10k_mac_update_rx_channel(ar, ctx, NULL, 0);
7368 	spin_unlock_bh(&ar->data_lock);
7369 
7370 	ath10k_recalc_radar_detection(ar);
7371 	ath10k_monitor_recalc(ar);
7372 
7373 	mutex_unlock(&ar->conf_mutex);
7374 
7375 	return 0;
7376 }
7377 
7378 static void
7379 ath10k_mac_op_remove_chanctx(struct ieee80211_hw *hw,
7380 			     struct ieee80211_chanctx_conf *ctx)
7381 {
7382 	struct ath10k *ar = hw->priv;
7383 
7384 	ath10k_dbg(ar, ATH10K_DBG_MAC,
7385 		   "mac chanctx remove freq %hu width %d ptr %pK\n",
7386 		   ctx->def.chan->center_freq, ctx->def.width, ctx);
7387 
7388 	mutex_lock(&ar->conf_mutex);
7389 
7390 	spin_lock_bh(&ar->data_lock);
7391 	ath10k_mac_update_rx_channel(ar, NULL, NULL, 0);
7392 	spin_unlock_bh(&ar->data_lock);
7393 
7394 	ath10k_recalc_radar_detection(ar);
7395 	ath10k_monitor_recalc(ar);
7396 
7397 	mutex_unlock(&ar->conf_mutex);
7398 }
7399 
7400 struct ath10k_mac_change_chanctx_arg {
7401 	struct ieee80211_chanctx_conf *ctx;
7402 	struct ieee80211_vif_chanctx_switch *vifs;
7403 	int n_vifs;
7404 	int next_vif;
7405 };
7406 
7407 static void
7408 ath10k_mac_change_chanctx_cnt_iter(void *data, u8 *mac,
7409 				   struct ieee80211_vif *vif)
7410 {
7411 	struct ath10k_mac_change_chanctx_arg *arg = data;
7412 
7413 	if (rcu_access_pointer(vif->chanctx_conf) != arg->ctx)
7414 		return;
7415 
7416 	arg->n_vifs++;
7417 }
7418 
7419 static void
7420 ath10k_mac_change_chanctx_fill_iter(void *data, u8 *mac,
7421 				    struct ieee80211_vif *vif)
7422 {
7423 	struct ath10k_mac_change_chanctx_arg *arg = data;
7424 	struct ieee80211_chanctx_conf *ctx;
7425 
7426 	ctx = rcu_access_pointer(vif->chanctx_conf);
7427 	if (ctx != arg->ctx)
7428 		return;
7429 
7430 	if (WARN_ON(arg->next_vif == arg->n_vifs))
7431 		return;
7432 
7433 	arg->vifs[arg->next_vif].vif = vif;
7434 	arg->vifs[arg->next_vif].old_ctx = ctx;
7435 	arg->vifs[arg->next_vif].new_ctx = ctx;
7436 	arg->next_vif++;
7437 }
7438 
7439 static void
7440 ath10k_mac_op_change_chanctx(struct ieee80211_hw *hw,
7441 			     struct ieee80211_chanctx_conf *ctx,
7442 			     u32 changed)
7443 {
7444 	struct ath10k *ar = hw->priv;
7445 	struct ath10k_mac_change_chanctx_arg arg = { .ctx = ctx };
7446 
7447 	mutex_lock(&ar->conf_mutex);
7448 
7449 	ath10k_dbg(ar, ATH10K_DBG_MAC,
7450 		   "mac chanctx change freq %hu width %d ptr %pK changed %x\n",
7451 		   ctx->def.chan->center_freq, ctx->def.width, ctx, changed);
7452 
7453 	/* This shouldn't really happen because channel switching should use
7454 	 * switch_vif_chanctx().
7455 	 */
7456 	if (WARN_ON(changed & IEEE80211_CHANCTX_CHANGE_CHANNEL))
7457 		goto unlock;
7458 
7459 	if (changed & IEEE80211_CHANCTX_CHANGE_WIDTH) {
7460 		ieee80211_iterate_active_interfaces_atomic(
7461 					hw,
7462 					IEEE80211_IFACE_ITER_NORMAL,
7463 					ath10k_mac_change_chanctx_cnt_iter,
7464 					&arg);
7465 		if (arg.n_vifs == 0)
7466 			goto radar;
7467 
7468 		arg.vifs = kcalloc(arg.n_vifs, sizeof(arg.vifs[0]),
7469 				   GFP_KERNEL);
7470 		if (!arg.vifs)
7471 			goto radar;
7472 
7473 		ieee80211_iterate_active_interfaces_atomic(
7474 					hw,
7475 					IEEE80211_IFACE_ITER_NORMAL,
7476 					ath10k_mac_change_chanctx_fill_iter,
7477 					&arg);
7478 		ath10k_mac_update_vif_chan(ar, arg.vifs, arg.n_vifs);
7479 		kfree(arg.vifs);
7480 	}
7481 
7482 radar:
7483 	ath10k_recalc_radar_detection(ar);
7484 
7485 	/* FIXME: How to configure Rx chains properly? */
7486 
7487 	/* No other actions are actually necessary. Firmware maintains channel
7488 	 * definitions per vdev internally and there's no host-side channel
7489 	 * context abstraction to configure, e.g. channel width.
7490 	 */
7491 
7492 unlock:
7493 	mutex_unlock(&ar->conf_mutex);
7494 }
7495 
7496 static int
7497 ath10k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
7498 				 struct ieee80211_vif *vif,
7499 				 struct ieee80211_chanctx_conf *ctx)
7500 {
7501 	struct ath10k *ar = hw->priv;
7502 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
7503 	int ret;
7504 
7505 	mutex_lock(&ar->conf_mutex);
7506 
7507 	ath10k_dbg(ar, ATH10K_DBG_MAC,
7508 		   "mac chanctx assign ptr %pK vdev_id %i\n",
7509 		   ctx, arvif->vdev_id);
7510 
7511 	if (WARN_ON(arvif->is_started)) {
7512 		mutex_unlock(&ar->conf_mutex);
7513 		return -EBUSY;
7514 	}
7515 
7516 	ret = ath10k_vdev_start(arvif, &ctx->def);
7517 	if (ret) {
7518 		ath10k_warn(ar, "failed to start vdev %i addr %pM on freq %d: %d\n",
7519 			    arvif->vdev_id, vif->addr,
7520 			    ctx->def.chan->center_freq, ret);
7521 		goto err;
7522 	}
7523 
7524 	arvif->is_started = true;
7525 
7526 	ret = ath10k_mac_vif_setup_ps(arvif);
7527 	if (ret) {
7528 		ath10k_warn(ar, "failed to update vdev %i ps: %d\n",
7529 			    arvif->vdev_id, ret);
7530 		goto err_stop;
7531 	}
7532 
7533 	if (vif->type == NL80211_IFTYPE_MONITOR) {
7534 		ret = ath10k_wmi_vdev_up(ar, arvif->vdev_id, 0, vif->addr);
7535 		if (ret) {
7536 			ath10k_warn(ar, "failed to up monitor vdev %i: %d\n",
7537 				    arvif->vdev_id, ret);
7538 			goto err_stop;
7539 		}
7540 
7541 		arvif->is_up = true;
7542 	}
7543 
7544 	if (ath10k_mac_can_set_cts_prot(arvif)) {
7545 		ret = ath10k_mac_set_cts_prot(arvif);
7546 		if (ret)
7547 			ath10k_warn(ar, "failed to set cts protection for vdev %d: %d\n",
7548 				    arvif->vdev_id, ret);
7549 	}
7550 
7551 	if (ath10k_peer_stats_enabled(ar)) {
7552 		ar->pktlog_filter |= ATH10K_PKTLOG_PEER_STATS;
7553 		ret = ath10k_wmi_pdev_pktlog_enable(ar,
7554 						    ar->pktlog_filter);
7555 		if (ret) {
7556 			ath10k_warn(ar, "failed to enable pktlog %d\n", ret);
7557 			goto err_stop;
7558 		}
7559 	}
7560 
7561 	mutex_unlock(&ar->conf_mutex);
7562 	return 0;
7563 
7564 err_stop:
7565 	ath10k_vdev_stop(arvif);
7566 	arvif->is_started = false;
7567 	ath10k_mac_vif_setup_ps(arvif);
7568 
7569 err:
7570 	mutex_unlock(&ar->conf_mutex);
7571 	return ret;
7572 }
7573 
7574 static void
7575 ath10k_mac_op_unassign_vif_chanctx(struct ieee80211_hw *hw,
7576 				   struct ieee80211_vif *vif,
7577 				   struct ieee80211_chanctx_conf *ctx)
7578 {
7579 	struct ath10k *ar = hw->priv;
7580 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
7581 	int ret;
7582 
7583 	mutex_lock(&ar->conf_mutex);
7584 
7585 	ath10k_dbg(ar, ATH10K_DBG_MAC,
7586 		   "mac chanctx unassign ptr %pK vdev_id %i\n",
7587 		   ctx, arvif->vdev_id);
7588 
7589 	WARN_ON(!arvif->is_started);
7590 
7591 	if (vif->type == NL80211_IFTYPE_MONITOR) {
7592 		WARN_ON(!arvif->is_up);
7593 
7594 		ret = ath10k_wmi_vdev_down(ar, arvif->vdev_id);
7595 		if (ret)
7596 			ath10k_warn(ar, "failed to down monitor vdev %i: %d\n",
7597 				    arvif->vdev_id, ret);
7598 
7599 		arvif->is_up = false;
7600 	}
7601 
7602 	ret = ath10k_vdev_stop(arvif);
7603 	if (ret)
7604 		ath10k_warn(ar, "failed to stop vdev %i: %d\n",
7605 			    arvif->vdev_id, ret);
7606 
7607 	arvif->is_started = false;
7608 
7609 	mutex_unlock(&ar->conf_mutex);
7610 }
7611 
7612 static int
7613 ath10k_mac_op_switch_vif_chanctx(struct ieee80211_hw *hw,
7614 				 struct ieee80211_vif_chanctx_switch *vifs,
7615 				 int n_vifs,
7616 				 enum ieee80211_chanctx_switch_mode mode)
7617 {
7618 	struct ath10k *ar = hw->priv;
7619 
7620 	mutex_lock(&ar->conf_mutex);
7621 
7622 	ath10k_dbg(ar, ATH10K_DBG_MAC,
7623 		   "mac chanctx switch n_vifs %d mode %d\n",
7624 		   n_vifs, mode);
7625 	ath10k_mac_update_vif_chan(ar, vifs, n_vifs);
7626 
7627 	mutex_unlock(&ar->conf_mutex);
7628 	return 0;
7629 }
7630 
7631 static void ath10k_mac_op_sta_pre_rcu_remove(struct ieee80211_hw *hw,
7632 					     struct ieee80211_vif *vif,
7633 					     struct ieee80211_sta *sta)
7634 {
7635 	struct ath10k *ar;
7636 	struct ath10k_peer *peer;
7637 
7638 	ar = hw->priv;
7639 
7640 	list_for_each_entry(peer, &ar->peers, list)
7641 		if (peer->sta == sta)
7642 			peer->removed = true;
7643 }
7644 
7645 static void ath10k_sta_statistics(struct ieee80211_hw *hw,
7646 				  struct ieee80211_vif *vif,
7647 				  struct ieee80211_sta *sta,
7648 				  struct station_info *sinfo)
7649 {
7650 	struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
7651 	struct ath10k *ar = arsta->arvif->ar;
7652 
7653 	if (!ath10k_peer_stats_enabled(ar))
7654 		return;
7655 
7656 	sinfo->rx_duration = arsta->rx_duration;
7657 	sinfo->filled |= 1ULL << NL80211_STA_INFO_RX_DURATION;
7658 
7659 	if (!arsta->txrate.legacy && !arsta->txrate.nss)
7660 		return;
7661 
7662 	if (arsta->txrate.legacy) {
7663 		sinfo->txrate.legacy = arsta->txrate.legacy;
7664 	} else {
7665 		sinfo->txrate.mcs = arsta->txrate.mcs;
7666 		sinfo->txrate.nss = arsta->txrate.nss;
7667 		sinfo->txrate.bw = arsta->txrate.bw;
7668 	}
7669 	sinfo->txrate.flags = arsta->txrate.flags;
7670 	sinfo->filled |= 1ULL << NL80211_STA_INFO_TX_BITRATE;
7671 }
7672 
7673 static const struct ieee80211_ops ath10k_ops = {
7674 	.tx				= ath10k_mac_op_tx,
7675 	.wake_tx_queue			= ath10k_mac_op_wake_tx_queue,
7676 	.start				= ath10k_start,
7677 	.stop				= ath10k_stop,
7678 	.config				= ath10k_config,
7679 	.add_interface			= ath10k_add_interface,
7680 	.remove_interface		= ath10k_remove_interface,
7681 	.configure_filter		= ath10k_configure_filter,
7682 	.bss_info_changed		= ath10k_bss_info_changed,
7683 	.set_coverage_class		= ath10k_mac_op_set_coverage_class,
7684 	.hw_scan			= ath10k_hw_scan,
7685 	.cancel_hw_scan			= ath10k_cancel_hw_scan,
7686 	.set_key			= ath10k_set_key,
7687 	.set_default_unicast_key        = ath10k_set_default_unicast_key,
7688 	.sta_state			= ath10k_sta_state,
7689 	.conf_tx			= ath10k_conf_tx,
7690 	.remain_on_channel		= ath10k_remain_on_channel,
7691 	.cancel_remain_on_channel	= ath10k_cancel_remain_on_channel,
7692 	.set_rts_threshold		= ath10k_set_rts_threshold,
7693 	.set_frag_threshold		= ath10k_mac_op_set_frag_threshold,
7694 	.flush				= ath10k_flush,
7695 	.tx_last_beacon			= ath10k_tx_last_beacon,
7696 	.set_antenna			= ath10k_set_antenna,
7697 	.get_antenna			= ath10k_get_antenna,
7698 	.reconfig_complete		= ath10k_reconfig_complete,
7699 	.get_survey			= ath10k_get_survey,
7700 	.set_bitrate_mask		= ath10k_mac_op_set_bitrate_mask,
7701 	.sta_rc_update			= ath10k_sta_rc_update,
7702 	.offset_tsf			= ath10k_offset_tsf,
7703 	.ampdu_action			= ath10k_ampdu_action,
7704 	.get_et_sset_count		= ath10k_debug_get_et_sset_count,
7705 	.get_et_stats			= ath10k_debug_get_et_stats,
7706 	.get_et_strings			= ath10k_debug_get_et_strings,
7707 	.add_chanctx			= ath10k_mac_op_add_chanctx,
7708 	.remove_chanctx			= ath10k_mac_op_remove_chanctx,
7709 	.change_chanctx			= ath10k_mac_op_change_chanctx,
7710 	.assign_vif_chanctx		= ath10k_mac_op_assign_vif_chanctx,
7711 	.unassign_vif_chanctx		= ath10k_mac_op_unassign_vif_chanctx,
7712 	.switch_vif_chanctx		= ath10k_mac_op_switch_vif_chanctx,
7713 	.sta_pre_rcu_remove		= ath10k_mac_op_sta_pre_rcu_remove,
7714 	.sta_statistics			= ath10k_sta_statistics,
7715 
7716 	CFG80211_TESTMODE_CMD(ath10k_tm_cmd)
7717 
7718 #ifdef CONFIG_PM
7719 	.suspend			= ath10k_wow_op_suspend,
7720 	.resume				= ath10k_wow_op_resume,
7721 	.set_wakeup			= ath10k_wow_op_set_wakeup,
7722 #endif
7723 #ifdef CONFIG_MAC80211_DEBUGFS
7724 	.sta_add_debugfs		= ath10k_sta_add_debugfs,
7725 #endif
7726 };
7727 
7728 #define CHAN2G(_channel, _freq, _flags) { \
7729 	.band			= NL80211_BAND_2GHZ, \
7730 	.hw_value		= (_channel), \
7731 	.center_freq		= (_freq), \
7732 	.flags			= (_flags), \
7733 	.max_antenna_gain	= 0, \
7734 	.max_power		= 30, \
7735 }
7736 
7737 #define CHAN5G(_channel, _freq, _flags) { \
7738 	.band			= NL80211_BAND_5GHZ, \
7739 	.hw_value		= (_channel), \
7740 	.center_freq		= (_freq), \
7741 	.flags			= (_flags), \
7742 	.max_antenna_gain	= 0, \
7743 	.max_power		= 30, \
7744 }
7745 
7746 static const struct ieee80211_channel ath10k_2ghz_channels[] = {
7747 	CHAN2G(1, 2412, 0),
7748 	CHAN2G(2, 2417, 0),
7749 	CHAN2G(3, 2422, 0),
7750 	CHAN2G(4, 2427, 0),
7751 	CHAN2G(5, 2432, 0),
7752 	CHAN2G(6, 2437, 0),
7753 	CHAN2G(7, 2442, 0),
7754 	CHAN2G(8, 2447, 0),
7755 	CHAN2G(9, 2452, 0),
7756 	CHAN2G(10, 2457, 0),
7757 	CHAN2G(11, 2462, 0),
7758 	CHAN2G(12, 2467, 0),
7759 	CHAN2G(13, 2472, 0),
7760 	CHAN2G(14, 2484, 0),
7761 };
7762 
7763 static const struct ieee80211_channel ath10k_5ghz_channels[] = {
7764 	CHAN5G(36, 5180, 0),
7765 	CHAN5G(40, 5200, 0),
7766 	CHAN5G(44, 5220, 0),
7767 	CHAN5G(48, 5240, 0),
7768 	CHAN5G(52, 5260, 0),
7769 	CHAN5G(56, 5280, 0),
7770 	CHAN5G(60, 5300, 0),
7771 	CHAN5G(64, 5320, 0),
7772 	CHAN5G(100, 5500, 0),
7773 	CHAN5G(104, 5520, 0),
7774 	CHAN5G(108, 5540, 0),
7775 	CHAN5G(112, 5560, 0),
7776 	CHAN5G(116, 5580, 0),
7777 	CHAN5G(120, 5600, 0),
7778 	CHAN5G(124, 5620, 0),
7779 	CHAN5G(128, 5640, 0),
7780 	CHAN5G(132, 5660, 0),
7781 	CHAN5G(136, 5680, 0),
7782 	CHAN5G(140, 5700, 0),
7783 	CHAN5G(144, 5720, 0),
7784 	CHAN5G(149, 5745, 0),
7785 	CHAN5G(153, 5765, 0),
7786 	CHAN5G(157, 5785, 0),
7787 	CHAN5G(161, 5805, 0),
7788 	CHAN5G(165, 5825, 0),
7789 	CHAN5G(169, 5845, 0),
7790 };
7791 
7792 struct ath10k *ath10k_mac_create(size_t priv_size)
7793 {
7794 	struct ieee80211_hw *hw;
7795 	struct ieee80211_ops *ops;
7796 	struct ath10k *ar;
7797 
7798 	ops = kmemdup(&ath10k_ops, sizeof(ath10k_ops), GFP_KERNEL);
7799 	if (!ops)
7800 		return NULL;
7801 
7802 	hw = ieee80211_alloc_hw(sizeof(struct ath10k) + priv_size, ops);
7803 	if (!hw) {
7804 		kfree(ops);
7805 		return NULL;
7806 	}
7807 
7808 	ar = hw->priv;
7809 	ar->hw = hw;
7810 	ar->ops = ops;
7811 
7812 	return ar;
7813 }
7814 
7815 void ath10k_mac_destroy(struct ath10k *ar)
7816 {
7817 	struct ieee80211_ops *ops = ar->ops;
7818 
7819 	ieee80211_free_hw(ar->hw);
7820 	kfree(ops);
7821 }
7822 
7823 static const struct ieee80211_iface_limit ath10k_if_limits[] = {
7824 	{
7825 		.max	= 8,
7826 		.types	= BIT(NL80211_IFTYPE_STATION)
7827 			| BIT(NL80211_IFTYPE_P2P_CLIENT)
7828 	},
7829 	{
7830 		.max	= 3,
7831 		.types	= BIT(NL80211_IFTYPE_P2P_GO)
7832 	},
7833 	{
7834 		.max	= 1,
7835 		.types	= BIT(NL80211_IFTYPE_P2P_DEVICE)
7836 	},
7837 	{
7838 		.max	= 7,
7839 		.types	= BIT(NL80211_IFTYPE_AP)
7840 #ifdef CONFIG_MAC80211_MESH
7841 			| BIT(NL80211_IFTYPE_MESH_POINT)
7842 #endif
7843 	},
7844 };
7845 
7846 static const struct ieee80211_iface_limit ath10k_10x_if_limits[] = {
7847 	{
7848 		.max	= 8,
7849 		.types	= BIT(NL80211_IFTYPE_AP)
7850 #ifdef CONFIG_MAC80211_MESH
7851 			| BIT(NL80211_IFTYPE_MESH_POINT)
7852 #endif
7853 	},
7854 	{
7855 		.max	= 1,
7856 		.types	= BIT(NL80211_IFTYPE_STATION)
7857 	},
7858 };
7859 
7860 static const struct ieee80211_iface_combination ath10k_if_comb[] = {
7861 	{
7862 		.limits = ath10k_if_limits,
7863 		.n_limits = ARRAY_SIZE(ath10k_if_limits),
7864 		.max_interfaces = 8,
7865 		.num_different_channels = 1,
7866 		.beacon_int_infra_match = true,
7867 	},
7868 };
7869 
7870 static const struct ieee80211_iface_combination ath10k_10x_if_comb[] = {
7871 	{
7872 		.limits = ath10k_10x_if_limits,
7873 		.n_limits = ARRAY_SIZE(ath10k_10x_if_limits),
7874 		.max_interfaces = 8,
7875 		.num_different_channels = 1,
7876 		.beacon_int_infra_match = true,
7877 #ifdef CONFIG_ATH10K_DFS_CERTIFIED
7878 		.radar_detect_widths =	BIT(NL80211_CHAN_WIDTH_20_NOHT) |
7879 					BIT(NL80211_CHAN_WIDTH_20) |
7880 					BIT(NL80211_CHAN_WIDTH_40) |
7881 					BIT(NL80211_CHAN_WIDTH_80),
7882 #endif
7883 	},
7884 };
7885 
7886 static const struct ieee80211_iface_limit ath10k_tlv_if_limit[] = {
7887 	{
7888 		.max = 2,
7889 		.types = BIT(NL80211_IFTYPE_STATION),
7890 	},
7891 	{
7892 		.max = 2,
7893 		.types = BIT(NL80211_IFTYPE_AP) |
7894 #ifdef CONFIG_MAC80211_MESH
7895 			 BIT(NL80211_IFTYPE_MESH_POINT) |
7896 #endif
7897 			 BIT(NL80211_IFTYPE_P2P_CLIENT) |
7898 			 BIT(NL80211_IFTYPE_P2P_GO),
7899 	},
7900 	{
7901 		.max = 1,
7902 		.types = BIT(NL80211_IFTYPE_P2P_DEVICE),
7903 	},
7904 };
7905 
7906 static const struct ieee80211_iface_limit ath10k_tlv_qcs_if_limit[] = {
7907 	{
7908 		.max = 2,
7909 		.types = BIT(NL80211_IFTYPE_STATION),
7910 	},
7911 	{
7912 		.max = 2,
7913 		.types = BIT(NL80211_IFTYPE_P2P_CLIENT),
7914 	},
7915 	{
7916 		.max = 1,
7917 		.types = BIT(NL80211_IFTYPE_AP) |
7918 #ifdef CONFIG_MAC80211_MESH
7919 			 BIT(NL80211_IFTYPE_MESH_POINT) |
7920 #endif
7921 			 BIT(NL80211_IFTYPE_P2P_GO),
7922 	},
7923 	{
7924 		.max = 1,
7925 		.types = BIT(NL80211_IFTYPE_P2P_DEVICE),
7926 	},
7927 };
7928 
7929 static const struct ieee80211_iface_limit ath10k_tlv_if_limit_ibss[] = {
7930 	{
7931 		.max = 1,
7932 		.types = BIT(NL80211_IFTYPE_STATION),
7933 	},
7934 	{
7935 		.max = 1,
7936 		.types = BIT(NL80211_IFTYPE_ADHOC),
7937 	},
7938 };
7939 
7940 /* FIXME: This is not thouroughly tested. These combinations may over- or
7941  * underestimate hw/fw capabilities.
7942  */
7943 static struct ieee80211_iface_combination ath10k_tlv_if_comb[] = {
7944 	{
7945 		.limits = ath10k_tlv_if_limit,
7946 		.num_different_channels = 1,
7947 		.max_interfaces = 4,
7948 		.n_limits = ARRAY_SIZE(ath10k_tlv_if_limit),
7949 	},
7950 	{
7951 		.limits = ath10k_tlv_if_limit_ibss,
7952 		.num_different_channels = 1,
7953 		.max_interfaces = 2,
7954 		.n_limits = ARRAY_SIZE(ath10k_tlv_if_limit_ibss),
7955 	},
7956 };
7957 
7958 static struct ieee80211_iface_combination ath10k_tlv_qcs_if_comb[] = {
7959 	{
7960 		.limits = ath10k_tlv_if_limit,
7961 		.num_different_channels = 1,
7962 		.max_interfaces = 4,
7963 		.n_limits = ARRAY_SIZE(ath10k_tlv_if_limit),
7964 	},
7965 	{
7966 		.limits = ath10k_tlv_qcs_if_limit,
7967 		.num_different_channels = 2,
7968 		.max_interfaces = 4,
7969 		.n_limits = ARRAY_SIZE(ath10k_tlv_qcs_if_limit),
7970 	},
7971 	{
7972 		.limits = ath10k_tlv_if_limit_ibss,
7973 		.num_different_channels = 1,
7974 		.max_interfaces = 2,
7975 		.n_limits = ARRAY_SIZE(ath10k_tlv_if_limit_ibss),
7976 	},
7977 };
7978 
7979 static const struct ieee80211_iface_limit ath10k_10_4_if_limits[] = {
7980 	{
7981 		.max = 1,
7982 		.types = BIT(NL80211_IFTYPE_STATION),
7983 	},
7984 	{
7985 		.max	= 16,
7986 		.types	= BIT(NL80211_IFTYPE_AP)
7987 #ifdef CONFIG_MAC80211_MESH
7988 			| BIT(NL80211_IFTYPE_MESH_POINT)
7989 #endif
7990 	},
7991 };
7992 
7993 static const struct ieee80211_iface_combination ath10k_10_4_if_comb[] = {
7994 	{
7995 		.limits = ath10k_10_4_if_limits,
7996 		.n_limits = ARRAY_SIZE(ath10k_10_4_if_limits),
7997 		.max_interfaces = 16,
7998 		.num_different_channels = 1,
7999 		.beacon_int_infra_match = true,
8000 #ifdef CONFIG_ATH10K_DFS_CERTIFIED
8001 		.radar_detect_widths =	BIT(NL80211_CHAN_WIDTH_20_NOHT) |
8002 					BIT(NL80211_CHAN_WIDTH_20) |
8003 					BIT(NL80211_CHAN_WIDTH_40) |
8004 					BIT(NL80211_CHAN_WIDTH_80),
8005 #endif
8006 	},
8007 };
8008 
8009 static void ath10k_get_arvif_iter(void *data, u8 *mac,
8010 				  struct ieee80211_vif *vif)
8011 {
8012 	struct ath10k_vif_iter *arvif_iter = data;
8013 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
8014 
8015 	if (arvif->vdev_id == arvif_iter->vdev_id)
8016 		arvif_iter->arvif = arvif;
8017 }
8018 
8019 struct ath10k_vif *ath10k_get_arvif(struct ath10k *ar, u32 vdev_id)
8020 {
8021 	struct ath10k_vif_iter arvif_iter;
8022 	u32 flags;
8023 
8024 	memset(&arvif_iter, 0, sizeof(struct ath10k_vif_iter));
8025 	arvif_iter.vdev_id = vdev_id;
8026 
8027 	flags = IEEE80211_IFACE_ITER_RESUME_ALL;
8028 	ieee80211_iterate_active_interfaces_atomic(ar->hw,
8029 						   flags,
8030 						   ath10k_get_arvif_iter,
8031 						   &arvif_iter);
8032 	if (!arvif_iter.arvif) {
8033 		ath10k_warn(ar, "No VIF found for vdev %d\n", vdev_id);
8034 		return NULL;
8035 	}
8036 
8037 	return arvif_iter.arvif;
8038 }
8039 
8040 #define WRD_METHOD "WRDD"
8041 #define WRDD_WIFI  (0x07)
8042 
8043 static u32 ath10k_mac_wrdd_get_mcc(struct ath10k *ar, union acpi_object *wrdd)
8044 {
8045 	union acpi_object *mcc_pkg;
8046 	union acpi_object *domain_type;
8047 	union acpi_object *mcc_value;
8048 	u32 i;
8049 
8050 	if (wrdd->type != ACPI_TYPE_PACKAGE ||
8051 	    wrdd->package.count < 2 ||
8052 	    wrdd->package.elements[0].type != ACPI_TYPE_INTEGER ||
8053 	    wrdd->package.elements[0].integer.value != 0) {
8054 		ath10k_warn(ar, "ignoring malformed/unsupported wrdd structure\n");
8055 		return 0;
8056 	}
8057 
8058 	for (i = 1; i < wrdd->package.count; ++i) {
8059 		mcc_pkg = &wrdd->package.elements[i];
8060 
8061 		if (mcc_pkg->type != ACPI_TYPE_PACKAGE)
8062 			continue;
8063 		if (mcc_pkg->package.count < 2)
8064 			continue;
8065 		if (mcc_pkg->package.elements[0].type != ACPI_TYPE_INTEGER ||
8066 		    mcc_pkg->package.elements[1].type != ACPI_TYPE_INTEGER)
8067 			continue;
8068 
8069 		domain_type = &mcc_pkg->package.elements[0];
8070 		if (domain_type->integer.value != WRDD_WIFI)
8071 			continue;
8072 
8073 		mcc_value = &mcc_pkg->package.elements[1];
8074 		return mcc_value->integer.value;
8075 	}
8076 	return 0;
8077 }
8078 
8079 static int ath10k_mac_get_wrdd_regulatory(struct ath10k *ar, u16 *rd)
8080 {
8081 	struct pci_dev __maybe_unused *pdev = to_pci_dev(ar->dev);
8082 	acpi_handle root_handle;
8083 	acpi_handle handle;
8084 	struct acpi_buffer wrdd = {ACPI_ALLOCATE_BUFFER, NULL};
8085 	acpi_status status;
8086 	u32 alpha2_code;
8087 	char alpha2[3];
8088 
8089 	root_handle = ACPI_HANDLE(&pdev->dev);
8090 	if (!root_handle)
8091 		return -EOPNOTSUPP;
8092 
8093 	status = acpi_get_handle(root_handle, (acpi_string)WRD_METHOD, &handle);
8094 	if (ACPI_FAILURE(status)) {
8095 		ath10k_dbg(ar, ATH10K_DBG_BOOT,
8096 			   "failed to get wrd method %d\n", status);
8097 		return -EIO;
8098 	}
8099 
8100 	status = acpi_evaluate_object(handle, NULL, NULL, &wrdd);
8101 	if (ACPI_FAILURE(status)) {
8102 		ath10k_dbg(ar, ATH10K_DBG_BOOT,
8103 			   "failed to call wrdc %d\n", status);
8104 		return -EIO;
8105 	}
8106 
8107 	alpha2_code = ath10k_mac_wrdd_get_mcc(ar, wrdd.pointer);
8108 	kfree(wrdd.pointer);
8109 	if (!alpha2_code)
8110 		return -EIO;
8111 
8112 	alpha2[0] = (alpha2_code >> 8) & 0xff;
8113 	alpha2[1] = (alpha2_code >> 0) & 0xff;
8114 	alpha2[2] = '\0';
8115 
8116 	ath10k_dbg(ar, ATH10K_DBG_BOOT,
8117 		   "regulatory hint from WRDD (alpha2-code): %s\n", alpha2);
8118 
8119 	*rd = ath_regd_find_country_by_name(alpha2);
8120 	if (*rd == 0xffff)
8121 		return -EIO;
8122 
8123 	*rd |= COUNTRY_ERD_FLAG;
8124 	return 0;
8125 }
8126 
8127 static int ath10k_mac_init_rd(struct ath10k *ar)
8128 {
8129 	int ret;
8130 	u16 rd;
8131 
8132 	ret = ath10k_mac_get_wrdd_regulatory(ar, &rd);
8133 	if (ret) {
8134 		ath10k_dbg(ar, ATH10K_DBG_BOOT,
8135 			   "fallback to eeprom programmed regulatory settings\n");
8136 		rd = ar->hw_eeprom_rd;
8137 	}
8138 
8139 	ar->ath_common.regulatory.current_rd = rd;
8140 	return 0;
8141 }
8142 
8143 int ath10k_mac_register(struct ath10k *ar)
8144 {
8145 	static const u32 cipher_suites[] = {
8146 		WLAN_CIPHER_SUITE_WEP40,
8147 		WLAN_CIPHER_SUITE_WEP104,
8148 		WLAN_CIPHER_SUITE_TKIP,
8149 		WLAN_CIPHER_SUITE_CCMP,
8150 
8151 		/* Do not add hardware supported ciphers before this line.
8152 		 * Allow software encryption for all chips. Don't forget to
8153 		 * update n_cipher_suites below.
8154 		 */
8155 		WLAN_CIPHER_SUITE_AES_CMAC,
8156 		WLAN_CIPHER_SUITE_BIP_CMAC_256,
8157 		WLAN_CIPHER_SUITE_BIP_GMAC_128,
8158 		WLAN_CIPHER_SUITE_BIP_GMAC_256,
8159 
8160 		/* Only QCA99x0 and QCA4019 varients support GCMP-128, GCMP-256
8161 		 * and CCMP-256 in hardware.
8162 		 */
8163 		WLAN_CIPHER_SUITE_GCMP,
8164 		WLAN_CIPHER_SUITE_GCMP_256,
8165 		WLAN_CIPHER_SUITE_CCMP_256,
8166 	};
8167 	struct ieee80211_supported_band *band;
8168 	void *channels;
8169 	int ret;
8170 
8171 	SET_IEEE80211_PERM_ADDR(ar->hw, ar->mac_addr);
8172 
8173 	SET_IEEE80211_DEV(ar->hw, ar->dev);
8174 
8175 	BUILD_BUG_ON((ARRAY_SIZE(ath10k_2ghz_channels) +
8176 		      ARRAY_SIZE(ath10k_5ghz_channels)) !=
8177 		     ATH10K_NUM_CHANS);
8178 
8179 	if (ar->phy_capability & WHAL_WLAN_11G_CAPABILITY) {
8180 		channels = kmemdup(ath10k_2ghz_channels,
8181 				   sizeof(ath10k_2ghz_channels),
8182 				   GFP_KERNEL);
8183 		if (!channels) {
8184 			ret = -ENOMEM;
8185 			goto err_free;
8186 		}
8187 
8188 		band = &ar->mac.sbands[NL80211_BAND_2GHZ];
8189 		band->n_channels = ARRAY_SIZE(ath10k_2ghz_channels);
8190 		band->channels = channels;
8191 
8192 		if (ar->hw_params.cck_rate_map_rev2) {
8193 			band->n_bitrates = ath10k_g_rates_rev2_size;
8194 			band->bitrates = ath10k_g_rates_rev2;
8195 		} else {
8196 			band->n_bitrates = ath10k_g_rates_size;
8197 			band->bitrates = ath10k_g_rates;
8198 		}
8199 
8200 		ar->hw->wiphy->bands[NL80211_BAND_2GHZ] = band;
8201 	}
8202 
8203 	if (ar->phy_capability & WHAL_WLAN_11A_CAPABILITY) {
8204 		channels = kmemdup(ath10k_5ghz_channels,
8205 				   sizeof(ath10k_5ghz_channels),
8206 				   GFP_KERNEL);
8207 		if (!channels) {
8208 			ret = -ENOMEM;
8209 			goto err_free;
8210 		}
8211 
8212 		band = &ar->mac.sbands[NL80211_BAND_5GHZ];
8213 		band->n_channels = ARRAY_SIZE(ath10k_5ghz_channels);
8214 		band->channels = channels;
8215 		band->n_bitrates = ath10k_a_rates_size;
8216 		band->bitrates = ath10k_a_rates;
8217 		ar->hw->wiphy->bands[NL80211_BAND_5GHZ] = band;
8218 	}
8219 
8220 	ath10k_mac_setup_ht_vht_cap(ar);
8221 
8222 	ar->hw->wiphy->interface_modes =
8223 		BIT(NL80211_IFTYPE_STATION) |
8224 		BIT(NL80211_IFTYPE_AP) |
8225 		BIT(NL80211_IFTYPE_MESH_POINT);
8226 
8227 	ar->hw->wiphy->available_antennas_rx = ar->cfg_rx_chainmask;
8228 	ar->hw->wiphy->available_antennas_tx = ar->cfg_tx_chainmask;
8229 
8230 	if (!test_bit(ATH10K_FW_FEATURE_NO_P2P, ar->normal_mode_fw.fw_file.fw_features))
8231 		ar->hw->wiphy->interface_modes |=
8232 			BIT(NL80211_IFTYPE_P2P_DEVICE) |
8233 			BIT(NL80211_IFTYPE_P2P_CLIENT) |
8234 			BIT(NL80211_IFTYPE_P2P_GO);
8235 
8236 	ieee80211_hw_set(ar->hw, SIGNAL_DBM);
8237 
8238 	if (!test_bit(ATH10K_FW_FEATURE_NO_PS,
8239 		      ar->running_fw->fw_file.fw_features)) {
8240 		ieee80211_hw_set(ar->hw, SUPPORTS_PS);
8241 		ieee80211_hw_set(ar->hw, SUPPORTS_DYNAMIC_PS);
8242 	}
8243 
8244 	ieee80211_hw_set(ar->hw, MFP_CAPABLE);
8245 	ieee80211_hw_set(ar->hw, REPORTS_TX_ACK_STATUS);
8246 	ieee80211_hw_set(ar->hw, HAS_RATE_CONTROL);
8247 	ieee80211_hw_set(ar->hw, AP_LINK_PS);
8248 	ieee80211_hw_set(ar->hw, SPECTRUM_MGMT);
8249 	ieee80211_hw_set(ar->hw, SUPPORT_FAST_XMIT);
8250 	ieee80211_hw_set(ar->hw, CONNECTION_MONITOR);
8251 	ieee80211_hw_set(ar->hw, SUPPORTS_PER_STA_GTK);
8252 	ieee80211_hw_set(ar->hw, WANT_MONITOR_VIF);
8253 	ieee80211_hw_set(ar->hw, CHANCTX_STA_CSA);
8254 	ieee80211_hw_set(ar->hw, QUEUE_CONTROL);
8255 	ieee80211_hw_set(ar->hw, SUPPORTS_TX_FRAG);
8256 	ieee80211_hw_set(ar->hw, REPORTS_LOW_ACK);
8257 
8258 	if (!test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags))
8259 		ieee80211_hw_set(ar->hw, SW_CRYPTO_CONTROL);
8260 
8261 	ar->hw->wiphy->features |= NL80211_FEATURE_STATIC_SMPS;
8262 	ar->hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
8263 
8264 	if (ar->ht_cap_info & WMI_HT_CAP_DYNAMIC_SMPS)
8265 		ar->hw->wiphy->features |= NL80211_FEATURE_DYNAMIC_SMPS;
8266 
8267 	if (ar->ht_cap_info & WMI_HT_CAP_ENABLED) {
8268 		ieee80211_hw_set(ar->hw, AMPDU_AGGREGATION);
8269 		ieee80211_hw_set(ar->hw, TX_AMPDU_SETUP_IN_HW);
8270 	}
8271 
8272 	ar->hw->wiphy->max_scan_ssids = WLAN_SCAN_PARAMS_MAX_SSID;
8273 	ar->hw->wiphy->max_scan_ie_len = WLAN_SCAN_PARAMS_MAX_IE_LEN;
8274 
8275 	ar->hw->vif_data_size = sizeof(struct ath10k_vif);
8276 	ar->hw->sta_data_size = sizeof(struct ath10k_sta);
8277 	ar->hw->txq_data_size = sizeof(struct ath10k_txq);
8278 
8279 	ar->hw->max_listen_interval = ATH10K_MAX_HW_LISTEN_INTERVAL;
8280 
8281 	if (test_bit(WMI_SERVICE_BEACON_OFFLOAD, ar->wmi.svc_map)) {
8282 		ar->hw->wiphy->flags |= WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
8283 
8284 		/* Firmware delivers WPS/P2P Probe Requests frames to driver so
8285 		 * that userspace (e.g. wpa_supplicant/hostapd) can generate
8286 		 * correct Probe Responses. This is more of a hack advert..
8287 		 */
8288 		ar->hw->wiphy->probe_resp_offload |=
8289 			NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS |
8290 			NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2 |
8291 			NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P;
8292 	}
8293 
8294 	if (test_bit(WMI_SERVICE_TDLS, ar->wmi.svc_map) ||
8295 	    test_bit(WMI_SERVICE_TDLS_EXPLICIT_MODE_ONLY, ar->wmi.svc_map)) {
8296 		ar->hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
8297 		if (test_bit(WMI_SERVICE_TDLS_WIDER_BANDWIDTH, ar->wmi.svc_map))
8298 			ieee80211_hw_set(ar->hw, TDLS_WIDER_BW);
8299 	}
8300 
8301 	ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
8302 	ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
8303 	ar->hw->wiphy->max_remain_on_channel_duration = 5000;
8304 
8305 	ar->hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
8306 	ar->hw->wiphy->features |= NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
8307 				   NL80211_FEATURE_AP_SCAN;
8308 
8309 	ar->hw->wiphy->max_ap_assoc_sta = ar->max_num_stations;
8310 
8311 	ret = ath10k_wow_init(ar);
8312 	if (ret) {
8313 		ath10k_warn(ar, "failed to init wow: %d\n", ret);
8314 		goto err_free;
8315 	}
8316 
8317 	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
8318 
8319 	/*
8320 	 * on LL hardware queues are managed entirely by the FW
8321 	 * so we only advertise to mac we can do the queues thing
8322 	 */
8323 	ar->hw->queues = IEEE80211_MAX_QUEUES;
8324 
8325 	/* vdev_ids are used as hw queue numbers. Make sure offchan tx queue is
8326 	 * something that vdev_ids can't reach so that we don't stop the queue
8327 	 * accidentally.
8328 	 */
8329 	ar->hw->offchannel_tx_hw_queue = IEEE80211_MAX_QUEUES - 1;
8330 
8331 	switch (ar->running_fw->fw_file.wmi_op_version) {
8332 	case ATH10K_FW_WMI_OP_VERSION_MAIN:
8333 		ar->hw->wiphy->iface_combinations = ath10k_if_comb;
8334 		ar->hw->wiphy->n_iface_combinations =
8335 			ARRAY_SIZE(ath10k_if_comb);
8336 		ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
8337 		break;
8338 	case ATH10K_FW_WMI_OP_VERSION_TLV:
8339 		if (test_bit(WMI_SERVICE_ADAPTIVE_OCS, ar->wmi.svc_map)) {
8340 			ar->hw->wiphy->iface_combinations =
8341 				ath10k_tlv_qcs_if_comb;
8342 			ar->hw->wiphy->n_iface_combinations =
8343 				ARRAY_SIZE(ath10k_tlv_qcs_if_comb);
8344 		} else {
8345 			ar->hw->wiphy->iface_combinations = ath10k_tlv_if_comb;
8346 			ar->hw->wiphy->n_iface_combinations =
8347 				ARRAY_SIZE(ath10k_tlv_if_comb);
8348 		}
8349 		ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
8350 		break;
8351 	case ATH10K_FW_WMI_OP_VERSION_10_1:
8352 	case ATH10K_FW_WMI_OP_VERSION_10_2:
8353 	case ATH10K_FW_WMI_OP_VERSION_10_2_4:
8354 		ar->hw->wiphy->iface_combinations = ath10k_10x_if_comb;
8355 		ar->hw->wiphy->n_iface_combinations =
8356 			ARRAY_SIZE(ath10k_10x_if_comb);
8357 		break;
8358 	case ATH10K_FW_WMI_OP_VERSION_10_4:
8359 		ar->hw->wiphy->iface_combinations = ath10k_10_4_if_comb;
8360 		ar->hw->wiphy->n_iface_combinations =
8361 			ARRAY_SIZE(ath10k_10_4_if_comb);
8362 		break;
8363 	case ATH10K_FW_WMI_OP_VERSION_UNSET:
8364 	case ATH10K_FW_WMI_OP_VERSION_MAX:
8365 		WARN_ON(1);
8366 		ret = -EINVAL;
8367 		goto err_free;
8368 	}
8369 
8370 	if (!test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags))
8371 		ar->hw->netdev_features = NETIF_F_HW_CSUM;
8372 
8373 	if (IS_ENABLED(CONFIG_ATH10K_DFS_CERTIFIED)) {
8374 		/* Init ath dfs pattern detector */
8375 		ar->ath_common.debug_mask = ATH_DBG_DFS;
8376 		ar->dfs_detector = dfs_pattern_detector_init(&ar->ath_common,
8377 							     NL80211_DFS_UNSET);
8378 
8379 		if (!ar->dfs_detector)
8380 			ath10k_warn(ar, "failed to initialise DFS pattern detector\n");
8381 	}
8382 
8383 	ret = ath10k_mac_init_rd(ar);
8384 	if (ret) {
8385 		ath10k_err(ar, "failed to derive regdom: %d\n", ret);
8386 		goto err_dfs_detector_exit;
8387 	}
8388 
8389 	/* Disable set_coverage_class for chipsets that do not support it. */
8390 	if (!ar->hw_params.hw_ops->set_coverage_class)
8391 		ar->ops->set_coverage_class = NULL;
8392 
8393 	ret = ath_regd_init(&ar->ath_common.regulatory, ar->hw->wiphy,
8394 			    ath10k_reg_notifier);
8395 	if (ret) {
8396 		ath10k_err(ar, "failed to initialise regulatory: %i\n", ret);
8397 		goto err_dfs_detector_exit;
8398 	}
8399 
8400 	ar->hw->wiphy->cipher_suites = cipher_suites;
8401 
8402 	/* QCA988x and QCA6174 family chips do not support CCMP-256, GCMP-128
8403 	 * and GCMP-256 ciphers in hardware. Fetch number of ciphers supported
8404 	 * from chip specific hw_param table.
8405 	 */
8406 	if (!ar->hw_params.n_cipher_suites ||
8407 	    ar->hw_params.n_cipher_suites > ARRAY_SIZE(cipher_suites)) {
8408 		ath10k_err(ar, "invalid hw_params.n_cipher_suites %d\n",
8409 			   ar->hw_params.n_cipher_suites);
8410 		ar->hw_params.n_cipher_suites = 8;
8411 	}
8412 	ar->hw->wiphy->n_cipher_suites = ar->hw_params.n_cipher_suites;
8413 
8414 	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
8415 
8416 	ret = ieee80211_register_hw(ar->hw);
8417 	if (ret) {
8418 		ath10k_err(ar, "failed to register ieee80211: %d\n", ret);
8419 		goto err_dfs_detector_exit;
8420 	}
8421 
8422 	if (!ath_is_world_regd(&ar->ath_common.regulatory)) {
8423 		ret = regulatory_hint(ar->hw->wiphy,
8424 				      ar->ath_common.regulatory.alpha2);
8425 		if (ret)
8426 			goto err_unregister;
8427 	}
8428 
8429 	return 0;
8430 
8431 err_unregister:
8432 	ieee80211_unregister_hw(ar->hw);
8433 
8434 err_dfs_detector_exit:
8435 	if (IS_ENABLED(CONFIG_ATH10K_DFS_CERTIFIED) && ar->dfs_detector)
8436 		ar->dfs_detector->exit(ar->dfs_detector);
8437 
8438 err_free:
8439 	kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels);
8440 	kfree(ar->mac.sbands[NL80211_BAND_5GHZ].channels);
8441 
8442 	SET_IEEE80211_DEV(ar->hw, NULL);
8443 	return ret;
8444 }
8445 
8446 void ath10k_mac_unregister(struct ath10k *ar)
8447 {
8448 	ieee80211_unregister_hw(ar->hw);
8449 
8450 	if (IS_ENABLED(CONFIG_ATH10K_DFS_CERTIFIED) && ar->dfs_detector)
8451 		ar->dfs_detector->exit(ar->dfs_detector);
8452 
8453 	kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels);
8454 	kfree(ar->mac.sbands[NL80211_BAND_5GHZ].channels);
8455 
8456 	SET_IEEE80211_DEV(ar->hw, NULL);
8457 }
8458