1 /*
2  * Copyright (c) 2012-2017 Qualcomm Atheros, Inc.
3  * Copyright (c) 2018, The Linux Foundation. All rights reserved.
4  *
5  * Permission to use, copy, modify, and/or distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <linux/etherdevice.h>
19 #include <linux/moduleparam.h>
20 #include <net/netlink.h>
21 #include <net/cfg80211.h>
22 #include "wil6210.h"
23 #include "wmi.h"
24 #include "fw.h"
25 
26 #define WIL_MAX_ROC_DURATION_MS 5000
27 
28 bool disable_ap_sme;
29 module_param(disable_ap_sme, bool, 0444);
30 MODULE_PARM_DESC(disable_ap_sme, " let user space handle AP mode SME");
31 
32 #ifdef CONFIG_PM
33 static struct wiphy_wowlan_support wil_wowlan_support = {
34 	.flags = WIPHY_WOWLAN_ANY | WIPHY_WOWLAN_DISCONNECT,
35 };
36 #endif
37 
38 #define CHAN60G(_channel, _flags) {				\
39 	.band			= NL80211_BAND_60GHZ,		\
40 	.center_freq		= 56160 + (2160 * (_channel)),	\
41 	.hw_value		= (_channel),			\
42 	.flags			= (_flags),			\
43 	.max_antenna_gain	= 0,				\
44 	.max_power		= 40,				\
45 }
46 
47 static struct ieee80211_channel wil_60ghz_channels[] = {
48 	CHAN60G(1, 0),
49 	CHAN60G(2, 0),
50 	CHAN60G(3, 0),
51 /* channel 4 not supported yet */
52 };
53 
54 /* Vendor id to be used in vendor specific command and events
55  * to user space.
56  * NOTE: The authoritative place for definition of QCA_NL80211_VENDOR_ID,
57  * vendor subcmd definitions prefixed with QCA_NL80211_VENDOR_SUBCMD, and
58  * qca_wlan_vendor_attr is open source file src/common/qca-vendor.h in
59  * git://w1.fi/srv/git/hostap.git; the values here are just a copy of that
60  */
61 
62 #define QCA_NL80211_VENDOR_ID	0x001374
63 
64 #define WIL_MAX_RF_SECTORS (128)
65 #define WIL_CID_ALL (0xff)
66 
67 enum qca_wlan_vendor_attr_rf_sector {
68 	QCA_ATTR_MAC_ADDR = 6,
69 	QCA_ATTR_PAD = 13,
70 	QCA_ATTR_TSF = 29,
71 	QCA_ATTR_DMG_RF_SECTOR_INDEX = 30,
72 	QCA_ATTR_DMG_RF_SECTOR_TYPE = 31,
73 	QCA_ATTR_DMG_RF_MODULE_MASK = 32,
74 	QCA_ATTR_DMG_RF_SECTOR_CFG = 33,
75 	QCA_ATTR_DMG_RF_SECTOR_MAX,
76 };
77 
78 enum qca_wlan_vendor_attr_dmg_rf_sector_type {
79 	QCA_ATTR_DMG_RF_SECTOR_TYPE_RX,
80 	QCA_ATTR_DMG_RF_SECTOR_TYPE_TX,
81 	QCA_ATTR_DMG_RF_SECTOR_TYPE_MAX
82 };
83 
84 enum qca_wlan_vendor_attr_dmg_rf_sector_cfg {
85 	QCA_ATTR_DMG_RF_SECTOR_CFG_INVALID = 0,
86 	QCA_ATTR_DMG_RF_SECTOR_CFG_MODULE_INDEX,
87 	QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE0,
88 	QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE1,
89 	QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE2,
90 	QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_HI,
91 	QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_LO,
92 	QCA_ATTR_DMG_RF_SECTOR_CFG_DTYPE_X16,
93 
94 	/* keep last */
95 	QCA_ATTR_DMG_RF_SECTOR_CFG_AFTER_LAST,
96 	QCA_ATTR_DMG_RF_SECTOR_CFG_MAX =
97 	QCA_ATTR_DMG_RF_SECTOR_CFG_AFTER_LAST - 1
98 };
99 
100 static const struct
101 nla_policy wil_rf_sector_policy[QCA_ATTR_DMG_RF_SECTOR_MAX + 1] = {
102 	[QCA_ATTR_MAC_ADDR] = { .len = ETH_ALEN },
103 	[QCA_ATTR_DMG_RF_SECTOR_INDEX] = { .type = NLA_U16 },
104 	[QCA_ATTR_DMG_RF_SECTOR_TYPE] = { .type = NLA_U8 },
105 	[QCA_ATTR_DMG_RF_MODULE_MASK] = { .type = NLA_U32 },
106 	[QCA_ATTR_DMG_RF_SECTOR_CFG] = { .type = NLA_NESTED },
107 };
108 
109 static const struct
110 nla_policy wil_rf_sector_cfg_policy[QCA_ATTR_DMG_RF_SECTOR_CFG_MAX + 1] = {
111 	[QCA_ATTR_DMG_RF_SECTOR_CFG_MODULE_INDEX] = { .type = NLA_U8 },
112 	[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE0] = { .type = NLA_U32 },
113 	[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE1] = { .type = NLA_U32 },
114 	[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE2] = { .type = NLA_U32 },
115 	[QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_HI] = { .type = NLA_U32 },
116 	[QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_LO] = { .type = NLA_U32 },
117 	[QCA_ATTR_DMG_RF_SECTOR_CFG_DTYPE_X16] = { .type = NLA_U32 },
118 };
119 
120 enum qca_nl80211_vendor_subcmds {
121 	QCA_NL80211_VENDOR_SUBCMD_DMG_RF_GET_SECTOR_CFG = 139,
122 	QCA_NL80211_VENDOR_SUBCMD_DMG_RF_SET_SECTOR_CFG = 140,
123 	QCA_NL80211_VENDOR_SUBCMD_DMG_RF_GET_SELECTED_SECTOR = 141,
124 	QCA_NL80211_VENDOR_SUBCMD_DMG_RF_SET_SELECTED_SECTOR = 142,
125 };
126 
127 static int wil_rf_sector_get_cfg(struct wiphy *wiphy,
128 				 struct wireless_dev *wdev,
129 				 const void *data, int data_len);
130 static int wil_rf_sector_set_cfg(struct wiphy *wiphy,
131 				 struct wireless_dev *wdev,
132 				 const void *data, int data_len);
133 static int wil_rf_sector_get_selected(struct wiphy *wiphy,
134 				      struct wireless_dev *wdev,
135 				      const void *data, int data_len);
136 static int wil_rf_sector_set_selected(struct wiphy *wiphy,
137 				      struct wireless_dev *wdev,
138 				      const void *data, int data_len);
139 
140 /* vendor specific commands */
141 static const struct wiphy_vendor_command wil_nl80211_vendor_commands[] = {
142 	{
143 		.info.vendor_id = QCA_NL80211_VENDOR_ID,
144 		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_DMG_RF_GET_SECTOR_CFG,
145 		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
146 			 WIPHY_VENDOR_CMD_NEED_RUNNING,
147 		.doit = wil_rf_sector_get_cfg
148 	},
149 	{
150 		.info.vendor_id = QCA_NL80211_VENDOR_ID,
151 		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_DMG_RF_SET_SECTOR_CFG,
152 		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
153 			 WIPHY_VENDOR_CMD_NEED_RUNNING,
154 		.doit = wil_rf_sector_set_cfg
155 	},
156 	{
157 		.info.vendor_id = QCA_NL80211_VENDOR_ID,
158 		.info.subcmd =
159 			QCA_NL80211_VENDOR_SUBCMD_DMG_RF_GET_SELECTED_SECTOR,
160 		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
161 			 WIPHY_VENDOR_CMD_NEED_RUNNING,
162 		.doit = wil_rf_sector_get_selected
163 	},
164 	{
165 		.info.vendor_id = QCA_NL80211_VENDOR_ID,
166 		.info.subcmd =
167 			QCA_NL80211_VENDOR_SUBCMD_DMG_RF_SET_SELECTED_SECTOR,
168 		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
169 			 WIPHY_VENDOR_CMD_NEED_RUNNING,
170 		.doit = wil_rf_sector_set_selected
171 	},
172 };
173 
174 static struct ieee80211_supported_band wil_band_60ghz = {
175 	.channels = wil_60ghz_channels,
176 	.n_channels = ARRAY_SIZE(wil_60ghz_channels),
177 	.ht_cap = {
178 		.ht_supported = true,
179 		.cap = 0, /* TODO */
180 		.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K, /* TODO */
181 		.ampdu_density = IEEE80211_HT_MPDU_DENSITY_8, /* TODO */
182 		.mcs = {
183 				/* MCS 1..12 - SC PHY */
184 			.rx_mask = {0xfe, 0x1f}, /* 1..12 */
185 			.tx_params = IEEE80211_HT_MCS_TX_DEFINED, /* TODO */
186 		},
187 	},
188 };
189 
190 static const struct ieee80211_txrx_stypes
191 wil_mgmt_stypes[NUM_NL80211_IFTYPES] = {
192 	[NL80211_IFTYPE_STATION] = {
193 		.tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
194 		BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
195 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
196 		BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
197 	},
198 	[NL80211_IFTYPE_AP] = {
199 		.tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
200 		BIT(IEEE80211_STYPE_PROBE_RESP >> 4) |
201 		BIT(IEEE80211_STYPE_ASSOC_RESP >> 4) |
202 		BIT(IEEE80211_STYPE_DISASSOC >> 4),
203 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
204 		BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
205 		BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
206 		BIT(IEEE80211_STYPE_DISASSOC >> 4) |
207 		BIT(IEEE80211_STYPE_AUTH >> 4) |
208 		BIT(IEEE80211_STYPE_DEAUTH >> 4) |
209 		BIT(IEEE80211_STYPE_REASSOC_REQ >> 4)
210 	},
211 	[NL80211_IFTYPE_P2P_CLIENT] = {
212 		.tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
213 		BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
214 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
215 		BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
216 	},
217 	[NL80211_IFTYPE_P2P_GO] = {
218 		.tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
219 		BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
220 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
221 		BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
222 	},
223 	[NL80211_IFTYPE_P2P_DEVICE] = {
224 		.tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
225 		BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
226 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
227 		BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
228 	},
229 };
230 
231 static const u32 wil_cipher_suites[] = {
232 	WLAN_CIPHER_SUITE_GCMP,
233 };
234 
235 static const char * const key_usage_str[] = {
236 	[WMI_KEY_USE_PAIRWISE]	= "PTK",
237 	[WMI_KEY_USE_RX_GROUP]	= "RX_GTK",
238 	[WMI_KEY_USE_TX_GROUP]	= "TX_GTK",
239 };
240 
241 int wil_iftype_nl2wmi(enum nl80211_iftype type)
242 {
243 	static const struct {
244 		enum nl80211_iftype nl;
245 		enum wmi_network_type wmi;
246 	} __nl2wmi[] = {
247 		{NL80211_IFTYPE_ADHOC,		WMI_NETTYPE_ADHOC},
248 		{NL80211_IFTYPE_STATION,	WMI_NETTYPE_INFRA},
249 		{NL80211_IFTYPE_AP,		WMI_NETTYPE_AP},
250 		{NL80211_IFTYPE_P2P_CLIENT,	WMI_NETTYPE_P2P},
251 		{NL80211_IFTYPE_P2P_GO,		WMI_NETTYPE_P2P},
252 		{NL80211_IFTYPE_MONITOR,	WMI_NETTYPE_ADHOC}, /* FIXME */
253 	};
254 	uint i;
255 
256 	for (i = 0; i < ARRAY_SIZE(__nl2wmi); i++) {
257 		if (__nl2wmi[i].nl == type)
258 			return __nl2wmi[i].wmi;
259 	}
260 
261 	return -EOPNOTSUPP;
262 }
263 
264 int wil_cid_fill_sinfo(struct wil6210_vif *vif, int cid,
265 		       struct station_info *sinfo)
266 {
267 	struct wil6210_priv *wil = vif_to_wil(vif);
268 	struct wmi_notify_req_cmd cmd = {
269 		.cid = cid,
270 		.interval_usec = 0,
271 	};
272 	struct {
273 		struct wmi_cmd_hdr wmi;
274 		struct wmi_notify_req_done_event evt;
275 	} __packed reply;
276 	struct wil_net_stats *stats = &wil->sta[cid].stats;
277 	int rc;
278 
279 	memset(&reply, 0, sizeof(reply));
280 
281 	rc = wmi_call(wil, WMI_NOTIFY_REQ_CMDID, vif->mid, &cmd, sizeof(cmd),
282 		      WMI_NOTIFY_REQ_DONE_EVENTID, &reply, sizeof(reply), 20);
283 	if (rc)
284 		return rc;
285 
286 	wil_dbg_wmi(wil, "Link status for CID %d MID %d: {\n"
287 		    "  MCS %d TSF 0x%016llx\n"
288 		    "  BF status 0x%08x RSSI %d SQI %d%%\n"
289 		    "  Tx Tpt %d goodput %d Rx goodput %d\n"
290 		    "  Sectors(rx:tx) my %d:%d peer %d:%d\n""}\n",
291 		    cid, vif->mid, le16_to_cpu(reply.evt.bf_mcs),
292 		    le64_to_cpu(reply.evt.tsf), reply.evt.status,
293 		    reply.evt.rssi,
294 		    reply.evt.sqi,
295 		    le32_to_cpu(reply.evt.tx_tpt),
296 		    le32_to_cpu(reply.evt.tx_goodput),
297 		    le32_to_cpu(reply.evt.rx_goodput),
298 		    le16_to_cpu(reply.evt.my_rx_sector),
299 		    le16_to_cpu(reply.evt.my_tx_sector),
300 		    le16_to_cpu(reply.evt.other_rx_sector),
301 		    le16_to_cpu(reply.evt.other_tx_sector));
302 
303 	sinfo->generation = wil->sinfo_gen;
304 
305 	sinfo->filled = BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
306 			BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
307 			BIT_ULL(NL80211_STA_INFO_RX_PACKETS) |
308 			BIT_ULL(NL80211_STA_INFO_TX_PACKETS) |
309 			BIT_ULL(NL80211_STA_INFO_RX_BITRATE) |
310 			BIT_ULL(NL80211_STA_INFO_TX_BITRATE) |
311 			BIT_ULL(NL80211_STA_INFO_RX_DROP_MISC) |
312 			BIT_ULL(NL80211_STA_INFO_TX_FAILED);
313 
314 	sinfo->txrate.flags = RATE_INFO_FLAGS_60G;
315 	sinfo->txrate.mcs = le16_to_cpu(reply.evt.bf_mcs);
316 	sinfo->rxrate.mcs = stats->last_mcs_rx;
317 	sinfo->rx_bytes = stats->rx_bytes;
318 	sinfo->rx_packets = stats->rx_packets;
319 	sinfo->rx_dropped_misc = stats->rx_dropped;
320 	sinfo->tx_bytes = stats->tx_bytes;
321 	sinfo->tx_packets = stats->tx_packets;
322 	sinfo->tx_failed = stats->tx_errors;
323 
324 	if (test_bit(wil_vif_fwconnected, vif->status)) {
325 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
326 		if (test_bit(WMI_FW_CAPABILITY_RSSI_REPORTING,
327 			     wil->fw_capabilities))
328 			sinfo->signal = reply.evt.rssi;
329 		else
330 			sinfo->signal = reply.evt.sqi;
331 	}
332 
333 	return rc;
334 }
335 
336 static int wil_cfg80211_get_station(struct wiphy *wiphy,
337 				    struct net_device *ndev,
338 				    const u8 *mac, struct station_info *sinfo)
339 {
340 	struct wil6210_vif *vif = ndev_to_vif(ndev);
341 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
342 	int rc;
343 
344 	int cid = wil_find_cid(wil, vif->mid, mac);
345 
346 	wil_dbg_misc(wil, "get_station: %pM CID %d MID %d\n", mac, cid,
347 		     vif->mid);
348 	if (cid < 0)
349 		return cid;
350 
351 	rc = wil_cid_fill_sinfo(vif, cid, sinfo);
352 
353 	return rc;
354 }
355 
356 /*
357  * Find @idx-th active STA for specific MID for station dump.
358  */
359 static int wil_find_cid_by_idx(struct wil6210_priv *wil, u8 mid, int idx)
360 {
361 	int i;
362 
363 	for (i = 0; i < ARRAY_SIZE(wil->sta); i++) {
364 		if (wil->sta[i].status == wil_sta_unused)
365 			continue;
366 		if (wil->sta[i].mid != mid)
367 			continue;
368 		if (idx == 0)
369 			return i;
370 		idx--;
371 	}
372 
373 	return -ENOENT;
374 }
375 
376 static int wil_cfg80211_dump_station(struct wiphy *wiphy,
377 				     struct net_device *dev, int idx,
378 				     u8 *mac, struct station_info *sinfo)
379 {
380 	struct wil6210_vif *vif = ndev_to_vif(dev);
381 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
382 	int rc;
383 	int cid = wil_find_cid_by_idx(wil, vif->mid, idx);
384 
385 	if (cid < 0)
386 		return -ENOENT;
387 
388 	ether_addr_copy(mac, wil->sta[cid].addr);
389 	wil_dbg_misc(wil, "dump_station: %pM CID %d MID %d\n", mac, cid,
390 		     vif->mid);
391 
392 	rc = wil_cid_fill_sinfo(vif, cid, sinfo);
393 
394 	return rc;
395 }
396 
397 static int wil_cfg80211_start_p2p_device(struct wiphy *wiphy,
398 					 struct wireless_dev *wdev)
399 {
400 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
401 
402 	wil_dbg_misc(wil, "start_p2p_device: entered\n");
403 	wil->p2p_dev_started = 1;
404 	return 0;
405 }
406 
407 static void wil_cfg80211_stop_p2p_device(struct wiphy *wiphy,
408 					 struct wireless_dev *wdev)
409 {
410 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
411 
412 	if (!wil->p2p_dev_started)
413 		return;
414 
415 	wil_dbg_misc(wil, "stop_p2p_device: entered\n");
416 	mutex_lock(&wil->mutex);
417 	mutex_lock(&wil->vif_mutex);
418 	wil_p2p_stop_radio_operations(wil);
419 	wil->p2p_dev_started = 0;
420 	mutex_unlock(&wil->vif_mutex);
421 	mutex_unlock(&wil->mutex);
422 }
423 
424 static int wil_cfg80211_validate_add_iface(struct wil6210_priv *wil,
425 					   enum nl80211_iftype new_type)
426 {
427 	int i;
428 	struct wireless_dev *wdev;
429 	struct iface_combination_params params = {
430 		.num_different_channels = 1,
431 	};
432 
433 	for (i = 0; i < wil->max_vifs; i++) {
434 		if (wil->vifs[i]) {
435 			wdev = vif_to_wdev(wil->vifs[i]);
436 			params.iftype_num[wdev->iftype]++;
437 		}
438 	}
439 	params.iftype_num[new_type]++;
440 	return cfg80211_check_combinations(wil->wiphy, &params);
441 }
442 
443 static int wil_cfg80211_validate_change_iface(struct wil6210_priv *wil,
444 					      struct wil6210_vif *vif,
445 					      enum nl80211_iftype new_type)
446 {
447 	int i, ret = 0;
448 	struct wireless_dev *wdev;
449 	struct iface_combination_params params = {
450 		.num_different_channels = 1,
451 	};
452 	bool check_combos = false;
453 
454 	for (i = 0; i < wil->max_vifs; i++) {
455 		struct wil6210_vif *vif_pos = wil->vifs[i];
456 
457 		if (vif_pos && vif != vif_pos) {
458 			wdev = vif_to_wdev(vif_pos);
459 			params.iftype_num[wdev->iftype]++;
460 			check_combos = true;
461 		}
462 	}
463 
464 	if (check_combos) {
465 		params.iftype_num[new_type]++;
466 		ret = cfg80211_check_combinations(wil->wiphy, &params);
467 	}
468 	return ret;
469 }
470 
471 static struct wireless_dev *
472 wil_cfg80211_add_iface(struct wiphy *wiphy, const char *name,
473 		       unsigned char name_assign_type,
474 		       enum nl80211_iftype type,
475 		       struct vif_params *params)
476 {
477 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
478 	struct net_device *ndev_main = wil->main_ndev, *ndev;
479 	struct wil6210_vif *vif;
480 	struct wireless_dev *p2p_wdev, *wdev;
481 	int rc;
482 
483 	wil_dbg_misc(wil, "add_iface, type %d\n", type);
484 
485 	/* P2P device is not a real virtual interface, it is a management-only
486 	 * interface that shares the main interface.
487 	 * Skip concurrency checks here.
488 	 */
489 	if (type == NL80211_IFTYPE_P2P_DEVICE) {
490 		if (wil->p2p_wdev) {
491 			wil_err(wil, "P2P_DEVICE interface already created\n");
492 			return ERR_PTR(-EINVAL);
493 		}
494 
495 		p2p_wdev = kzalloc(sizeof(*p2p_wdev), GFP_KERNEL);
496 		if (!p2p_wdev)
497 			return ERR_PTR(-ENOMEM);
498 
499 		p2p_wdev->iftype = type;
500 		p2p_wdev->wiphy = wiphy;
501 		/* use our primary ethernet address */
502 		ether_addr_copy(p2p_wdev->address, ndev_main->perm_addr);
503 
504 		wil->p2p_wdev = p2p_wdev;
505 
506 		return p2p_wdev;
507 	}
508 
509 	if (!wil->wiphy->n_iface_combinations) {
510 		wil_err(wil, "virtual interfaces not supported\n");
511 		return ERR_PTR(-EINVAL);
512 	}
513 
514 	rc = wil_cfg80211_validate_add_iface(wil, type);
515 	if (rc) {
516 		wil_err(wil, "iface validation failed, err=%d\n", rc);
517 		return ERR_PTR(rc);
518 	}
519 
520 	vif = wil_vif_alloc(wil, name, name_assign_type, type);
521 	if (IS_ERR(vif))
522 		return ERR_CAST(vif);
523 
524 	ndev = vif_to_ndev(vif);
525 	ether_addr_copy(ndev->perm_addr, ndev_main->perm_addr);
526 	if (is_valid_ether_addr(params->macaddr)) {
527 		ether_addr_copy(ndev->dev_addr, params->macaddr);
528 	} else {
529 		ether_addr_copy(ndev->dev_addr, ndev_main->perm_addr);
530 		ndev->dev_addr[0] = (ndev->dev_addr[0] ^ (1 << vif->mid)) |
531 			0x2; /* locally administered */
532 	}
533 	wdev = vif_to_wdev(vif);
534 	ether_addr_copy(wdev->address, ndev->dev_addr);
535 
536 	rc = wil_vif_add(wil, vif);
537 	if (rc)
538 		goto out;
539 
540 	wil_info(wil, "added VIF, mid %d iftype %d MAC %pM\n",
541 		 vif->mid, type, wdev->address);
542 	return wdev;
543 out:
544 	wil_vif_free(vif);
545 	return ERR_PTR(rc);
546 }
547 
548 int wil_vif_prepare_stop(struct wil6210_vif *vif)
549 {
550 	struct wil6210_priv *wil = vif_to_wil(vif);
551 	struct wireless_dev *wdev = vif_to_wdev(vif);
552 	struct net_device *ndev;
553 	int rc;
554 
555 	if (wdev->iftype != NL80211_IFTYPE_AP)
556 		return 0;
557 
558 	ndev = vif_to_ndev(vif);
559 	if (netif_carrier_ok(ndev)) {
560 		rc = wmi_pcp_stop(vif);
561 		if (rc) {
562 			wil_info(wil, "failed to stop AP, status %d\n",
563 				 rc);
564 			/* continue */
565 		}
566 		wil_bcast_fini(vif);
567 		netif_carrier_off(ndev);
568 	}
569 
570 	return 0;
571 }
572 
573 static int wil_cfg80211_del_iface(struct wiphy *wiphy,
574 				  struct wireless_dev *wdev)
575 {
576 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
577 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
578 	int rc;
579 
580 	wil_dbg_misc(wil, "del_iface\n");
581 
582 	if (wdev->iftype == NL80211_IFTYPE_P2P_DEVICE) {
583 		if (wdev != wil->p2p_wdev) {
584 			wil_err(wil, "delete of incorrect interface 0x%p\n",
585 				wdev);
586 			return -EINVAL;
587 		}
588 
589 		wil_cfg80211_stop_p2p_device(wiphy, wdev);
590 		wil_p2p_wdev_free(wil);
591 		return 0;
592 	}
593 
594 	if (vif->mid == 0) {
595 		wil_err(wil, "cannot remove the main interface\n");
596 		return -EINVAL;
597 	}
598 
599 	rc = wil_vif_prepare_stop(vif);
600 	if (rc)
601 		goto out;
602 
603 	wil_info(wil, "deleted VIF, mid %d iftype %d MAC %pM\n",
604 		 vif->mid, wdev->iftype, wdev->address);
605 
606 	wil_vif_remove(wil, vif->mid);
607 out:
608 	return rc;
609 }
610 
611 static int wil_cfg80211_change_iface(struct wiphy *wiphy,
612 				     struct net_device *ndev,
613 				     enum nl80211_iftype type,
614 				     struct vif_params *params)
615 {
616 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
617 	struct wil6210_vif *vif = ndev_to_vif(ndev);
618 	struct wireless_dev *wdev = vif_to_wdev(vif);
619 	int rc;
620 	bool fw_reset = false;
621 
622 	wil_dbg_misc(wil, "change_iface: type=%d\n", type);
623 
624 	if (wiphy->n_iface_combinations) {
625 		rc = wil_cfg80211_validate_change_iface(wil, vif, type);
626 		if (rc) {
627 			wil_err(wil, "iface validation failed, err=%d\n", rc);
628 			return rc;
629 		}
630 	}
631 
632 	/* do not reset FW when there are active VIFs,
633 	 * because it can cause significant disruption
634 	 */
635 	if (!wil_has_other_active_ifaces(wil, ndev, true, false) &&
636 	    netif_running(ndev) && !wil_is_recovery_blocked(wil)) {
637 		wil_dbg_misc(wil, "interface is up. resetting...\n");
638 		mutex_lock(&wil->mutex);
639 		__wil_down(wil);
640 		rc = __wil_up(wil);
641 		mutex_unlock(&wil->mutex);
642 
643 		if (rc)
644 			return rc;
645 		fw_reset = true;
646 	}
647 
648 	switch (type) {
649 	case NL80211_IFTYPE_STATION:
650 	case NL80211_IFTYPE_AP:
651 	case NL80211_IFTYPE_P2P_CLIENT:
652 	case NL80211_IFTYPE_P2P_GO:
653 		break;
654 	case NL80211_IFTYPE_MONITOR:
655 		if (params->flags)
656 			wil->monitor_flags = params->flags;
657 		break;
658 	default:
659 		return -EOPNOTSUPP;
660 	}
661 
662 	if (vif->mid != 0 && wil_has_active_ifaces(wil, true, false)) {
663 		if (!fw_reset)
664 			wil_vif_prepare_stop(vif);
665 		rc = wmi_port_delete(wil, vif->mid);
666 		if (rc)
667 			return rc;
668 		rc = wmi_port_allocate(wil, vif->mid, ndev->dev_addr, type);
669 		if (rc)
670 			return rc;
671 	}
672 
673 	wdev->iftype = type;
674 	return 0;
675 }
676 
677 static int wil_cfg80211_scan(struct wiphy *wiphy,
678 			     struct cfg80211_scan_request *request)
679 {
680 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
681 	struct wireless_dev *wdev = request->wdev;
682 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
683 	struct {
684 		struct wmi_start_scan_cmd cmd;
685 		u16 chnl[4];
686 	} __packed cmd;
687 	uint i, n;
688 	int rc;
689 
690 	wil_dbg_misc(wil, "scan: wdev=0x%p iftype=%d\n", wdev, wdev->iftype);
691 
692 	/* scan is supported on client interfaces and on AP interface */
693 	switch (wdev->iftype) {
694 	case NL80211_IFTYPE_STATION:
695 	case NL80211_IFTYPE_P2P_CLIENT:
696 	case NL80211_IFTYPE_P2P_DEVICE:
697 	case NL80211_IFTYPE_AP:
698 		break;
699 	default:
700 		return -EOPNOTSUPP;
701 	}
702 
703 	/* FW don't support scan after connection attempt */
704 	if (test_bit(wil_status_dontscan, wil->status)) {
705 		wil_err(wil, "Can't scan now\n");
706 		return -EBUSY;
707 	}
708 
709 	mutex_lock(&wil->mutex);
710 
711 	mutex_lock(&wil->vif_mutex);
712 	if (vif->scan_request || vif->p2p.discovery_started) {
713 		wil_err(wil, "Already scanning\n");
714 		mutex_unlock(&wil->vif_mutex);
715 		rc = -EAGAIN;
716 		goto out;
717 	}
718 	mutex_unlock(&wil->vif_mutex);
719 
720 	if (wdev->iftype == NL80211_IFTYPE_P2P_DEVICE) {
721 		if (!wil->p2p_dev_started) {
722 			wil_err(wil, "P2P search requested on stopped P2P device\n");
723 			rc = -EIO;
724 			goto out;
725 		}
726 		/* social scan on P2P_DEVICE is handled as p2p search */
727 		if (wil_p2p_is_social_scan(request)) {
728 			vif->scan_request = request;
729 			if (vif->mid == 0)
730 				wil->radio_wdev = wdev;
731 			rc = wil_p2p_search(vif, request);
732 			if (rc) {
733 				if (vif->mid == 0)
734 					wil->radio_wdev =
735 						wil->main_ndev->ieee80211_ptr;
736 				vif->scan_request = NULL;
737 			}
738 			goto out;
739 		}
740 	}
741 
742 	(void)wil_p2p_stop_discovery(vif);
743 
744 	wil_dbg_misc(wil, "Start scan_request 0x%p\n", request);
745 	wil_dbg_misc(wil, "SSID count: %d", request->n_ssids);
746 
747 	for (i = 0; i < request->n_ssids; i++) {
748 		wil_dbg_misc(wil, "SSID[%d]", i);
749 		wil_hex_dump_misc("SSID ", DUMP_PREFIX_OFFSET, 16, 1,
750 				  request->ssids[i].ssid,
751 				  request->ssids[i].ssid_len, true);
752 	}
753 
754 	if (request->n_ssids)
755 		rc = wmi_set_ssid(vif, request->ssids[0].ssid_len,
756 				  request->ssids[0].ssid);
757 	else
758 		rc = wmi_set_ssid(vif, 0, NULL);
759 
760 	if (rc) {
761 		wil_err(wil, "set SSID for scan request failed: %d\n", rc);
762 		goto out;
763 	}
764 
765 	vif->scan_request = request;
766 	mod_timer(&vif->scan_timer, jiffies + WIL6210_SCAN_TO);
767 
768 	memset(&cmd, 0, sizeof(cmd));
769 	cmd.cmd.scan_type = WMI_ACTIVE_SCAN;
770 	cmd.cmd.num_channels = 0;
771 	n = min(request->n_channels, 4U);
772 	for (i = 0; i < n; i++) {
773 		int ch = request->channels[i]->hw_value;
774 
775 		if (ch == 0) {
776 			wil_err(wil,
777 				"Scan requested for unknown frequency %dMhz\n",
778 				request->channels[i]->center_freq);
779 			continue;
780 		}
781 		/* 0-based channel indexes */
782 		cmd.cmd.channel_list[cmd.cmd.num_channels++].channel = ch - 1;
783 		wil_dbg_misc(wil, "Scan for ch %d  : %d MHz\n", ch,
784 			     request->channels[i]->center_freq);
785 	}
786 
787 	if (request->ie_len)
788 		wil_hex_dump_misc("Scan IE ", DUMP_PREFIX_OFFSET, 16, 1,
789 				  request->ie, request->ie_len, true);
790 	else
791 		wil_dbg_misc(wil, "Scan has no IE's\n");
792 
793 	rc = wmi_set_ie(vif, WMI_FRAME_PROBE_REQ,
794 			request->ie_len, request->ie);
795 	if (rc)
796 		goto out_restore;
797 
798 	if (wil->discovery_mode && cmd.cmd.scan_type == WMI_ACTIVE_SCAN) {
799 		cmd.cmd.discovery_mode = 1;
800 		wil_dbg_misc(wil, "active scan with discovery_mode=1\n");
801 	}
802 
803 	if (vif->mid == 0)
804 		wil->radio_wdev = wdev;
805 	rc = wmi_send(wil, WMI_START_SCAN_CMDID, vif->mid,
806 		      &cmd, sizeof(cmd.cmd) +
807 		      cmd.cmd.num_channels * sizeof(cmd.cmd.channel_list[0]));
808 
809 out_restore:
810 	if (rc) {
811 		del_timer_sync(&vif->scan_timer);
812 		if (vif->mid == 0)
813 			wil->radio_wdev = wil->main_ndev->ieee80211_ptr;
814 		vif->scan_request = NULL;
815 	}
816 out:
817 	mutex_unlock(&wil->mutex);
818 	return rc;
819 }
820 
821 static void wil_cfg80211_abort_scan(struct wiphy *wiphy,
822 				    struct wireless_dev *wdev)
823 {
824 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
825 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
826 
827 	wil_dbg_misc(wil, "wdev=0x%p iftype=%d\n", wdev, wdev->iftype);
828 
829 	mutex_lock(&wil->mutex);
830 	mutex_lock(&wil->vif_mutex);
831 
832 	if (!vif->scan_request)
833 		goto out;
834 
835 	if (wdev != vif->scan_request->wdev) {
836 		wil_dbg_misc(wil, "abort scan was called on the wrong iface\n");
837 		goto out;
838 	}
839 
840 	if (wdev == wil->p2p_wdev && wil->radio_wdev == wil->p2p_wdev)
841 		wil_p2p_stop_radio_operations(wil);
842 	else
843 		wil_abort_scan(vif, true);
844 
845 out:
846 	mutex_unlock(&wil->vif_mutex);
847 	mutex_unlock(&wil->mutex);
848 }
849 
850 static void wil_print_crypto(struct wil6210_priv *wil,
851 			     struct cfg80211_crypto_settings *c)
852 {
853 	int i, n;
854 
855 	wil_dbg_misc(wil, "WPA versions: 0x%08x cipher group 0x%08x\n",
856 		     c->wpa_versions, c->cipher_group);
857 	wil_dbg_misc(wil, "Pairwise ciphers [%d] {\n", c->n_ciphers_pairwise);
858 	n = min_t(int, c->n_ciphers_pairwise, ARRAY_SIZE(c->ciphers_pairwise));
859 	for (i = 0; i < n; i++)
860 		wil_dbg_misc(wil, "  [%d] = 0x%08x\n", i,
861 			     c->ciphers_pairwise[i]);
862 	wil_dbg_misc(wil, "}\n");
863 	wil_dbg_misc(wil, "AKM suites [%d] {\n", c->n_akm_suites);
864 	n = min_t(int, c->n_akm_suites, ARRAY_SIZE(c->akm_suites));
865 	for (i = 0; i < n; i++)
866 		wil_dbg_misc(wil, "  [%d] = 0x%08x\n", i,
867 			     c->akm_suites[i]);
868 	wil_dbg_misc(wil, "}\n");
869 	wil_dbg_misc(wil, "Control port : %d, eth_type 0x%04x no_encrypt %d\n",
870 		     c->control_port, be16_to_cpu(c->control_port_ethertype),
871 		     c->control_port_no_encrypt);
872 }
873 
874 static void wil_print_connect_params(struct wil6210_priv *wil,
875 				     struct cfg80211_connect_params *sme)
876 {
877 	wil_info(wil, "Connecting to:\n");
878 	if (sme->channel) {
879 		wil_info(wil, "  Channel: %d freq %d\n",
880 			 sme->channel->hw_value, sme->channel->center_freq);
881 	}
882 	if (sme->bssid)
883 		wil_info(wil, "  BSSID: %pM\n", sme->bssid);
884 	if (sme->ssid)
885 		print_hex_dump(KERN_INFO, "  SSID: ", DUMP_PREFIX_OFFSET,
886 			       16, 1, sme->ssid, sme->ssid_len, true);
887 	wil_info(wil, "  Privacy: %s\n", sme->privacy ? "secure" : "open");
888 	wil_info(wil, "  PBSS: %d\n", sme->pbss);
889 	wil_print_crypto(wil, &sme->crypto);
890 }
891 
892 static int wil_cfg80211_connect(struct wiphy *wiphy,
893 				struct net_device *ndev,
894 				struct cfg80211_connect_params *sme)
895 {
896 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
897 	struct wil6210_vif *vif = ndev_to_vif(ndev);
898 	struct cfg80211_bss *bss;
899 	struct wmi_connect_cmd conn;
900 	const u8 *ssid_eid;
901 	const u8 *rsn_eid;
902 	int ch;
903 	int rc = 0;
904 	enum ieee80211_bss_type bss_type = IEEE80211_BSS_TYPE_ESS;
905 
906 	wil_dbg_misc(wil, "connect, mid=%d\n", vif->mid);
907 	wil_print_connect_params(wil, sme);
908 
909 	if (test_bit(wil_vif_fwconnecting, vif->status) ||
910 	    test_bit(wil_vif_fwconnected, vif->status))
911 		return -EALREADY;
912 
913 	if (sme->ie_len > WMI_MAX_IE_LEN) {
914 		wil_err(wil, "IE too large (%td bytes)\n", sme->ie_len);
915 		return -ERANGE;
916 	}
917 
918 	rsn_eid = sme->ie ?
919 			cfg80211_find_ie(WLAN_EID_RSN, sme->ie, sme->ie_len) :
920 			NULL;
921 	if (sme->privacy && !rsn_eid)
922 		wil_info(wil, "WSC connection\n");
923 
924 	if (sme->pbss)
925 		bss_type = IEEE80211_BSS_TYPE_PBSS;
926 
927 	bss = cfg80211_get_bss(wiphy, sme->channel, sme->bssid,
928 			       sme->ssid, sme->ssid_len,
929 			       bss_type, IEEE80211_PRIVACY_ANY);
930 	if (!bss) {
931 		wil_err(wil, "Unable to find BSS\n");
932 		return -ENOENT;
933 	}
934 
935 	ssid_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
936 	if (!ssid_eid) {
937 		wil_err(wil, "No SSID\n");
938 		rc = -ENOENT;
939 		goto out;
940 	}
941 	vif->privacy = sme->privacy;
942 	vif->pbss = sme->pbss;
943 
944 	if (vif->privacy) {
945 		/* For secure assoc, remove old keys */
946 		rc = wmi_del_cipher_key(vif, 0, bss->bssid,
947 					WMI_KEY_USE_PAIRWISE);
948 		if (rc) {
949 			wil_err(wil, "WMI_DELETE_CIPHER_KEY_CMD(PTK) failed\n");
950 			goto out;
951 		}
952 		rc = wmi_del_cipher_key(vif, 0, bss->bssid,
953 					WMI_KEY_USE_RX_GROUP);
954 		if (rc) {
955 			wil_err(wil, "WMI_DELETE_CIPHER_KEY_CMD(GTK) failed\n");
956 			goto out;
957 		}
958 	}
959 
960 	/* WMI_SET_APPIE_CMD. ie may contain rsn info as well as other info
961 	 * elements. Send it also in case it's empty, to erase previously set
962 	 * ies in FW.
963 	 */
964 	rc = wmi_set_ie(vif, WMI_FRAME_ASSOC_REQ, sme->ie_len, sme->ie);
965 	if (rc)
966 		goto out;
967 
968 	/* WMI_CONNECT_CMD */
969 	memset(&conn, 0, sizeof(conn));
970 	switch (bss->capability & WLAN_CAPABILITY_DMG_TYPE_MASK) {
971 	case WLAN_CAPABILITY_DMG_TYPE_AP:
972 		conn.network_type = WMI_NETTYPE_INFRA;
973 		break;
974 	case WLAN_CAPABILITY_DMG_TYPE_PBSS:
975 		conn.network_type = WMI_NETTYPE_P2P;
976 		break;
977 	default:
978 		wil_err(wil, "Unsupported BSS type, capability= 0x%04x\n",
979 			bss->capability);
980 		goto out;
981 	}
982 	if (vif->privacy) {
983 		if (rsn_eid) { /* regular secure connection */
984 			conn.dot11_auth_mode = WMI_AUTH11_SHARED;
985 			conn.auth_mode = WMI_AUTH_WPA2_PSK;
986 			conn.pairwise_crypto_type = WMI_CRYPT_AES_GCMP;
987 			conn.pairwise_crypto_len = 16;
988 			conn.group_crypto_type = WMI_CRYPT_AES_GCMP;
989 			conn.group_crypto_len = 16;
990 		} else { /* WSC */
991 			conn.dot11_auth_mode = WMI_AUTH11_WSC;
992 			conn.auth_mode = WMI_AUTH_NONE;
993 		}
994 	} else { /* insecure connection */
995 		conn.dot11_auth_mode = WMI_AUTH11_OPEN;
996 		conn.auth_mode = WMI_AUTH_NONE;
997 	}
998 
999 	conn.ssid_len = min_t(u8, ssid_eid[1], 32);
1000 	memcpy(conn.ssid, ssid_eid+2, conn.ssid_len);
1001 
1002 	ch = bss->channel->hw_value;
1003 	if (ch == 0) {
1004 		wil_err(wil, "BSS at unknown frequency %dMhz\n",
1005 			bss->channel->center_freq);
1006 		rc = -EOPNOTSUPP;
1007 		goto out;
1008 	}
1009 	conn.channel = ch - 1;
1010 
1011 	ether_addr_copy(conn.bssid, bss->bssid);
1012 	ether_addr_copy(conn.dst_mac, bss->bssid);
1013 
1014 	set_bit(wil_vif_fwconnecting, vif->status);
1015 
1016 	rc = wmi_send(wil, WMI_CONNECT_CMDID, vif->mid, &conn, sizeof(conn));
1017 	if (rc == 0) {
1018 		netif_carrier_on(ndev);
1019 		if (!wil_has_other_active_ifaces(wil, ndev, false, true))
1020 			wil6210_bus_request(wil, WIL_MAX_BUS_REQUEST_KBPS);
1021 		vif->bss = bss;
1022 		/* Connect can take lots of time */
1023 		mod_timer(&vif->connect_timer,
1024 			  jiffies + msecs_to_jiffies(5000));
1025 	} else {
1026 		clear_bit(wil_vif_fwconnecting, vif->status);
1027 	}
1028 
1029  out:
1030 	cfg80211_put_bss(wiphy, bss);
1031 
1032 	return rc;
1033 }
1034 
1035 static int wil_cfg80211_disconnect(struct wiphy *wiphy,
1036 				   struct net_device *ndev,
1037 				   u16 reason_code)
1038 {
1039 	int rc;
1040 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1041 	struct wil6210_vif *vif = ndev_to_vif(ndev);
1042 
1043 	wil_dbg_misc(wil, "disconnect: reason=%d, mid=%d\n",
1044 		     reason_code, vif->mid);
1045 
1046 	if (!(test_bit(wil_vif_fwconnecting, vif->status) ||
1047 	      test_bit(wil_vif_fwconnected, vif->status))) {
1048 		wil_err(wil, "Disconnect was called while disconnected\n");
1049 		return 0;
1050 	}
1051 
1052 	vif->locally_generated_disc = true;
1053 	rc = wmi_call(wil, WMI_DISCONNECT_CMDID, vif->mid, NULL, 0,
1054 		      WMI_DISCONNECT_EVENTID, NULL, 0,
1055 		      WIL6210_DISCONNECT_TO_MS);
1056 	if (rc)
1057 		wil_err(wil, "disconnect error %d\n", rc);
1058 
1059 	return rc;
1060 }
1061 
1062 static int wil_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1063 {
1064 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1065 	int rc;
1066 
1067 	/* these parameters are explicitly not supported */
1068 	if (changed & (WIPHY_PARAM_RETRY_LONG |
1069 		       WIPHY_PARAM_FRAG_THRESHOLD |
1070 		       WIPHY_PARAM_RTS_THRESHOLD))
1071 		return -ENOTSUPP;
1072 
1073 	if (changed & WIPHY_PARAM_RETRY_SHORT) {
1074 		rc = wmi_set_mgmt_retry(wil, wiphy->retry_short);
1075 		if (rc)
1076 			return rc;
1077 	}
1078 
1079 	return 0;
1080 }
1081 
1082 int wil_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
1083 			 struct cfg80211_mgmt_tx_params *params,
1084 			 u64 *cookie)
1085 {
1086 	const u8 *buf = params->buf;
1087 	size_t len = params->len;
1088 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1089 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
1090 	int rc;
1091 	bool tx_status;
1092 
1093 	wil_dbg_misc(wil, "mgmt_tx: channel %d offchan %d, wait %d\n",
1094 		     params->chan ? params->chan->hw_value : -1,
1095 		     params->offchan,
1096 		     params->wait);
1097 
1098 	/* Note, currently we support the "wait" parameter only on AP mode.
1099 	 * In other modes, user-space must call remain_on_channel before
1100 	 * mgmt_tx or listen on a channel other than active one.
1101 	 */
1102 
1103 	if (params->chan && params->chan->hw_value == 0) {
1104 		wil_err(wil, "invalid channel\n");
1105 		return -EINVAL;
1106 	}
1107 
1108 	if (wdev->iftype != NL80211_IFTYPE_AP) {
1109 		wil_dbg_misc(wil,
1110 			     "send WMI_SW_TX_REQ_CMDID on non-AP interfaces\n");
1111 		rc = wmi_mgmt_tx(vif, buf, len);
1112 		goto out;
1113 	}
1114 
1115 	if (!params->chan || params->chan->hw_value == vif->channel) {
1116 		wil_dbg_misc(wil,
1117 			     "send WMI_SW_TX_REQ_CMDID for on-channel\n");
1118 		rc = wmi_mgmt_tx(vif, buf, len);
1119 		goto out;
1120 	}
1121 
1122 	if (params->offchan == 0) {
1123 		wil_err(wil,
1124 			"invalid channel params: current %d requested %d, off-channel not allowed\n",
1125 			vif->channel, params->chan->hw_value);
1126 		return -EBUSY;
1127 	}
1128 
1129 	/* use the wmi_mgmt_tx_ext only on AP mode and off-channel */
1130 	rc = wmi_mgmt_tx_ext(vif, buf, len, params->chan->hw_value,
1131 			     params->wait);
1132 
1133 out:
1134 	tx_status = (rc == 0);
1135 	cfg80211_mgmt_tx_status(wdev, cookie ? *cookie : 0, buf, len,
1136 				tx_status, GFP_KERNEL);
1137 
1138 	return rc;
1139 }
1140 
1141 static int wil_cfg80211_set_channel(struct wiphy *wiphy,
1142 				    struct cfg80211_chan_def *chandef)
1143 {
1144 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1145 
1146 	wil->monitor_chandef = *chandef;
1147 
1148 	return 0;
1149 }
1150 
1151 static enum wmi_key_usage wil_detect_key_usage(struct wireless_dev *wdev,
1152 					       bool pairwise)
1153 {
1154 	struct wil6210_priv *wil = wdev_to_wil(wdev);
1155 	enum wmi_key_usage rc;
1156 
1157 	if (pairwise) {
1158 		rc = WMI_KEY_USE_PAIRWISE;
1159 	} else {
1160 		switch (wdev->iftype) {
1161 		case NL80211_IFTYPE_STATION:
1162 		case NL80211_IFTYPE_P2P_CLIENT:
1163 			rc = WMI_KEY_USE_RX_GROUP;
1164 			break;
1165 		case NL80211_IFTYPE_AP:
1166 		case NL80211_IFTYPE_P2P_GO:
1167 			rc = WMI_KEY_USE_TX_GROUP;
1168 			break;
1169 		default:
1170 			/* TODO: Rx GTK or Tx GTK? */
1171 			wil_err(wil, "Can't determine GTK type\n");
1172 			rc = WMI_KEY_USE_RX_GROUP;
1173 			break;
1174 		}
1175 	}
1176 	wil_dbg_misc(wil, "detect_key_usage: -> %s\n", key_usage_str[rc]);
1177 
1178 	return rc;
1179 }
1180 
1181 static struct wil_sta_info *
1182 wil_find_sta_by_key_usage(struct wil6210_priv *wil, u8 mid,
1183 			  enum wmi_key_usage key_usage, const u8 *mac_addr)
1184 {
1185 	int cid = -EINVAL;
1186 
1187 	if (key_usage == WMI_KEY_USE_TX_GROUP)
1188 		return NULL; /* not needed */
1189 
1190 	/* supplicant provides Rx group key in STA mode with NULL MAC address */
1191 	if (mac_addr)
1192 		cid = wil_find_cid(wil, mid, mac_addr);
1193 	else if (key_usage == WMI_KEY_USE_RX_GROUP)
1194 		cid = wil_find_cid_by_idx(wil, mid, 0);
1195 	if (cid < 0) {
1196 		wil_err(wil, "No CID for %pM %s\n", mac_addr,
1197 			key_usage_str[key_usage]);
1198 		return ERR_PTR(cid);
1199 	}
1200 
1201 	return &wil->sta[cid];
1202 }
1203 
1204 static void wil_set_crypto_rx(u8 key_index, enum wmi_key_usage key_usage,
1205 			      struct wil_sta_info *cs,
1206 			      struct key_params *params)
1207 {
1208 	struct wil_tid_crypto_rx_single *cc;
1209 	int tid;
1210 
1211 	if (!cs)
1212 		return;
1213 
1214 	switch (key_usage) {
1215 	case WMI_KEY_USE_PAIRWISE:
1216 		for (tid = 0; tid < WIL_STA_TID_NUM; tid++) {
1217 			cc = &cs->tid_crypto_rx[tid].key_id[key_index];
1218 			if (params->seq)
1219 				memcpy(cc->pn, params->seq,
1220 				       IEEE80211_GCMP_PN_LEN);
1221 			else
1222 				memset(cc->pn, 0, IEEE80211_GCMP_PN_LEN);
1223 			cc->key_set = true;
1224 		}
1225 		break;
1226 	case WMI_KEY_USE_RX_GROUP:
1227 		cc = &cs->group_crypto_rx.key_id[key_index];
1228 		if (params->seq)
1229 			memcpy(cc->pn, params->seq, IEEE80211_GCMP_PN_LEN);
1230 		else
1231 			memset(cc->pn, 0, IEEE80211_GCMP_PN_LEN);
1232 		cc->key_set = true;
1233 		break;
1234 	default:
1235 		break;
1236 	}
1237 }
1238 
1239 static void wil_del_rx_key(u8 key_index, enum wmi_key_usage key_usage,
1240 			   struct wil_sta_info *cs)
1241 {
1242 	struct wil_tid_crypto_rx_single *cc;
1243 	int tid;
1244 
1245 	if (!cs)
1246 		return;
1247 
1248 	switch (key_usage) {
1249 	case WMI_KEY_USE_PAIRWISE:
1250 		for (tid = 0; tid < WIL_STA_TID_NUM; tid++) {
1251 			cc = &cs->tid_crypto_rx[tid].key_id[key_index];
1252 			cc->key_set = false;
1253 		}
1254 		break;
1255 	case WMI_KEY_USE_RX_GROUP:
1256 		cc = &cs->group_crypto_rx.key_id[key_index];
1257 		cc->key_set = false;
1258 		break;
1259 	default:
1260 		break;
1261 	}
1262 }
1263 
1264 static int wil_cfg80211_add_key(struct wiphy *wiphy,
1265 				struct net_device *ndev,
1266 				u8 key_index, bool pairwise,
1267 				const u8 *mac_addr,
1268 				struct key_params *params)
1269 {
1270 	int rc;
1271 	struct wil6210_vif *vif = ndev_to_vif(ndev);
1272 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1273 	struct wireless_dev *wdev = vif_to_wdev(vif);
1274 	enum wmi_key_usage key_usage = wil_detect_key_usage(wdev, pairwise);
1275 	struct wil_sta_info *cs = wil_find_sta_by_key_usage(wil, vif->mid,
1276 							    key_usage,
1277 							    mac_addr);
1278 
1279 	if (!params) {
1280 		wil_err(wil, "NULL params\n");
1281 		return -EINVAL;
1282 	}
1283 
1284 	wil_dbg_misc(wil, "add_key: %pM %s[%d] PN %*phN\n",
1285 		     mac_addr, key_usage_str[key_usage], key_index,
1286 		     params->seq_len, params->seq);
1287 
1288 	if (IS_ERR(cs)) {
1289 		wil_err(wil, "Not connected, %pM %s[%d] PN %*phN\n",
1290 			mac_addr, key_usage_str[key_usage], key_index,
1291 			params->seq_len, params->seq);
1292 		return -EINVAL;
1293 	}
1294 
1295 	wil_del_rx_key(key_index, key_usage, cs);
1296 
1297 	if (params->seq && params->seq_len != IEEE80211_GCMP_PN_LEN) {
1298 		wil_err(wil,
1299 			"Wrong PN len %d, %pM %s[%d] PN %*phN\n",
1300 			params->seq_len, mac_addr,
1301 			key_usage_str[key_usage], key_index,
1302 			params->seq_len, params->seq);
1303 		return -EINVAL;
1304 	}
1305 
1306 	rc = wmi_add_cipher_key(vif, key_index, mac_addr, params->key_len,
1307 				params->key, key_usage);
1308 	if (!rc)
1309 		wil_set_crypto_rx(key_index, key_usage, cs, params);
1310 
1311 	return rc;
1312 }
1313 
1314 static int wil_cfg80211_del_key(struct wiphy *wiphy,
1315 				struct net_device *ndev,
1316 				u8 key_index, bool pairwise,
1317 				const u8 *mac_addr)
1318 {
1319 	struct wil6210_vif *vif = ndev_to_vif(ndev);
1320 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1321 	struct wireless_dev *wdev = vif_to_wdev(vif);
1322 	enum wmi_key_usage key_usage = wil_detect_key_usage(wdev, pairwise);
1323 	struct wil_sta_info *cs = wil_find_sta_by_key_usage(wil, vif->mid,
1324 							    key_usage,
1325 							    mac_addr);
1326 
1327 	wil_dbg_misc(wil, "del_key: %pM %s[%d]\n", mac_addr,
1328 		     key_usage_str[key_usage], key_index);
1329 
1330 	if (IS_ERR(cs))
1331 		wil_info(wil, "Not connected, %pM %s[%d]\n",
1332 			 mac_addr, key_usage_str[key_usage], key_index);
1333 
1334 	if (!IS_ERR_OR_NULL(cs))
1335 		wil_del_rx_key(key_index, key_usage, cs);
1336 
1337 	return wmi_del_cipher_key(vif, key_index, mac_addr, key_usage);
1338 }
1339 
1340 /* Need to be present or wiphy_new() will WARN */
1341 static int wil_cfg80211_set_default_key(struct wiphy *wiphy,
1342 					struct net_device *ndev,
1343 					u8 key_index, bool unicast,
1344 					bool multicast)
1345 {
1346 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1347 
1348 	wil_dbg_misc(wil, "set_default_key: entered\n");
1349 	return 0;
1350 }
1351 
1352 static int wil_remain_on_channel(struct wiphy *wiphy,
1353 				 struct wireless_dev *wdev,
1354 				 struct ieee80211_channel *chan,
1355 				 unsigned int duration,
1356 				 u64 *cookie)
1357 {
1358 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1359 	int rc;
1360 
1361 	wil_dbg_misc(wil,
1362 		     "remain_on_channel: center_freq=%d, duration=%d iftype=%d\n",
1363 		     chan->center_freq, duration, wdev->iftype);
1364 
1365 	rc = wil_p2p_listen(wil, wdev, duration, chan, cookie);
1366 	return rc;
1367 }
1368 
1369 static int wil_cancel_remain_on_channel(struct wiphy *wiphy,
1370 					struct wireless_dev *wdev,
1371 					u64 cookie)
1372 {
1373 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1374 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
1375 
1376 	wil_dbg_misc(wil, "cancel_remain_on_channel\n");
1377 
1378 	return wil_p2p_cancel_listen(vif, cookie);
1379 }
1380 
1381 /**
1382  * find a specific IE in a list of IEs
1383  * return a pointer to the beginning of IE in the list
1384  * or NULL if not found
1385  */
1386 static const u8 *_wil_cfg80211_find_ie(const u8 *ies, u16 ies_len, const u8 *ie,
1387 				       u16 ie_len)
1388 {
1389 	struct ieee80211_vendor_ie *vie;
1390 	u32 oui;
1391 
1392 	/* IE tag at offset 0, length at offset 1 */
1393 	if (ie_len < 2 || 2 + ie[1] > ie_len)
1394 		return NULL;
1395 
1396 	if (ie[0] != WLAN_EID_VENDOR_SPECIFIC)
1397 		return cfg80211_find_ie(ie[0], ies, ies_len);
1398 
1399 	/* make sure there is room for 3 bytes OUI + 1 byte OUI type */
1400 	if (ie[1] < 4)
1401 		return NULL;
1402 	vie = (struct ieee80211_vendor_ie *)ie;
1403 	oui = vie->oui[0] << 16 | vie->oui[1] << 8 | vie->oui[2];
1404 	return cfg80211_find_vendor_ie(oui, vie->oui_type, ies,
1405 				       ies_len);
1406 }
1407 
1408 /**
1409  * merge the IEs in two lists into a single list.
1410  * do not include IEs from the second list which exist in the first list.
1411  * add only vendor specific IEs from second list to keep
1412  * the merged list sorted (since vendor-specific IE has the
1413  * highest tag number)
1414  * caller must free the allocated memory for merged IEs
1415  */
1416 static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len,
1417 					 const u8 *ies2, u16 ies2_len,
1418 					 u8 **merged_ies, u16 *merged_len)
1419 {
1420 	u8 *buf, *dpos;
1421 	const u8 *spos;
1422 
1423 	if (ies1_len == 0 && ies2_len == 0) {
1424 		*merged_ies = NULL;
1425 		*merged_len = 0;
1426 		return 0;
1427 	}
1428 
1429 	buf = kmalloc(ies1_len + ies2_len, GFP_KERNEL);
1430 	if (!buf)
1431 		return -ENOMEM;
1432 	memcpy(buf, ies1, ies1_len);
1433 	dpos = buf + ies1_len;
1434 	spos = ies2;
1435 	while (spos + 1 < ies2 + ies2_len) {
1436 		/* IE tag at offset 0, length at offset 1 */
1437 		u16 ielen = 2 + spos[1];
1438 
1439 		if (spos + ielen > ies2 + ies2_len)
1440 			break;
1441 		if (spos[0] == WLAN_EID_VENDOR_SPECIFIC &&
1442 		    !_wil_cfg80211_find_ie(ies1, ies1_len, spos, ielen)) {
1443 			memcpy(dpos, spos, ielen);
1444 			dpos += ielen;
1445 		}
1446 		spos += ielen;
1447 	}
1448 
1449 	*merged_ies = buf;
1450 	*merged_len = dpos - buf;
1451 	return 0;
1452 }
1453 
1454 static void wil_print_bcon_data(struct cfg80211_beacon_data *b)
1455 {
1456 	wil_hex_dump_misc("head     ", DUMP_PREFIX_OFFSET, 16, 1,
1457 			  b->head, b->head_len, true);
1458 	wil_hex_dump_misc("tail     ", DUMP_PREFIX_OFFSET, 16, 1,
1459 			  b->tail, b->tail_len, true);
1460 	wil_hex_dump_misc("BCON IE  ", DUMP_PREFIX_OFFSET, 16, 1,
1461 			  b->beacon_ies, b->beacon_ies_len, true);
1462 	wil_hex_dump_misc("PROBE    ", DUMP_PREFIX_OFFSET, 16, 1,
1463 			  b->probe_resp, b->probe_resp_len, true);
1464 	wil_hex_dump_misc("PROBE IE ", DUMP_PREFIX_OFFSET, 16, 1,
1465 			  b->proberesp_ies, b->proberesp_ies_len, true);
1466 	wil_hex_dump_misc("ASSOC IE ", DUMP_PREFIX_OFFSET, 16, 1,
1467 			  b->assocresp_ies, b->assocresp_ies_len, true);
1468 }
1469 
1470 /* internal functions for device reset and starting AP */
1471 static int _wil_cfg80211_set_ies(struct wil6210_vif *vif,
1472 				 struct cfg80211_beacon_data *bcon)
1473 {
1474 	int rc;
1475 	u16 len = 0, proberesp_len = 0;
1476 	u8 *ies = NULL, *proberesp = NULL;
1477 
1478 	if (bcon->probe_resp) {
1479 		struct ieee80211_mgmt *f =
1480 			(struct ieee80211_mgmt *)bcon->probe_resp;
1481 		size_t hlen = offsetof(struct ieee80211_mgmt,
1482 				       u.probe_resp.variable);
1483 		proberesp = f->u.probe_resp.variable;
1484 		proberesp_len = bcon->probe_resp_len - hlen;
1485 	}
1486 	rc = _wil_cfg80211_merge_extra_ies(proberesp,
1487 					   proberesp_len,
1488 					   bcon->proberesp_ies,
1489 					   bcon->proberesp_ies_len,
1490 					   &ies, &len);
1491 
1492 	if (rc)
1493 		goto out;
1494 
1495 	rc = wmi_set_ie(vif, WMI_FRAME_PROBE_RESP, len, ies);
1496 	if (rc)
1497 		goto out;
1498 
1499 	if (bcon->assocresp_ies)
1500 		rc = wmi_set_ie(vif, WMI_FRAME_ASSOC_RESP,
1501 				bcon->assocresp_ies_len, bcon->assocresp_ies);
1502 	else
1503 		rc = wmi_set_ie(vif, WMI_FRAME_ASSOC_RESP, len, ies);
1504 #if 0 /* to use beacon IE's, remove this #if 0 */
1505 	if (rc)
1506 		goto out;
1507 
1508 	rc = wmi_set_ie(vif, WMI_FRAME_BEACON,
1509 			bcon->tail_len, bcon->tail);
1510 #endif
1511 out:
1512 	kfree(ies);
1513 	return rc;
1514 }
1515 
1516 static int _wil_cfg80211_start_ap(struct wiphy *wiphy,
1517 				  struct net_device *ndev,
1518 				  const u8 *ssid, size_t ssid_len, u32 privacy,
1519 				  int bi, u8 chan,
1520 				  struct cfg80211_beacon_data *bcon,
1521 				  u8 hidden_ssid, u32 pbss)
1522 {
1523 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1524 	struct wil6210_vif *vif = ndev_to_vif(ndev);
1525 	int rc;
1526 	struct wireless_dev *wdev = ndev->ieee80211_ptr;
1527 	u8 wmi_nettype = wil_iftype_nl2wmi(wdev->iftype);
1528 	u8 is_go = (wdev->iftype == NL80211_IFTYPE_P2P_GO);
1529 
1530 	if (pbss)
1531 		wmi_nettype = WMI_NETTYPE_P2P;
1532 
1533 	wil_dbg_misc(wil, "start_ap: mid=%d, is_go=%d\n", vif->mid, is_go);
1534 	if (is_go && !pbss) {
1535 		wil_err(wil, "P2P GO must be in PBSS\n");
1536 		return -ENOTSUPP;
1537 	}
1538 
1539 	wil_set_recovery_state(wil, fw_recovery_idle);
1540 
1541 	mutex_lock(&wil->mutex);
1542 
1543 	if (!wil_has_other_active_ifaces(wil, ndev, true, false)) {
1544 		__wil_down(wil);
1545 		rc = __wil_up(wil);
1546 		if (rc)
1547 			goto out;
1548 	}
1549 
1550 	rc = wmi_set_ssid(vif, ssid_len, ssid);
1551 	if (rc)
1552 		goto out;
1553 
1554 	rc = _wil_cfg80211_set_ies(vif, bcon);
1555 	if (rc)
1556 		goto out;
1557 
1558 	vif->privacy = privacy;
1559 	vif->channel = chan;
1560 	vif->hidden_ssid = hidden_ssid;
1561 	vif->pbss = pbss;
1562 
1563 	netif_carrier_on(ndev);
1564 	if (!wil_has_other_active_ifaces(wil, ndev, false, true))
1565 		wil6210_bus_request(wil, WIL_MAX_BUS_REQUEST_KBPS);
1566 
1567 	rc = wmi_pcp_start(vif, bi, wmi_nettype, chan, hidden_ssid, is_go);
1568 	if (rc)
1569 		goto err_pcp_start;
1570 
1571 	rc = wil_bcast_init(vif);
1572 	if (rc)
1573 		goto err_bcast;
1574 
1575 	goto out; /* success */
1576 
1577 err_bcast:
1578 	wmi_pcp_stop(vif);
1579 err_pcp_start:
1580 	netif_carrier_off(ndev);
1581 	if (!wil_has_other_active_ifaces(wil, ndev, false, true))
1582 		wil6210_bus_request(wil, WIL_DEFAULT_BUS_REQUEST_KBPS);
1583 out:
1584 	mutex_unlock(&wil->mutex);
1585 	return rc;
1586 }
1587 
1588 static int wil_cfg80211_change_beacon(struct wiphy *wiphy,
1589 				      struct net_device *ndev,
1590 				      struct cfg80211_beacon_data *bcon)
1591 {
1592 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1593 	struct wil6210_vif *vif = ndev_to_vif(ndev);
1594 	int rc;
1595 	u32 privacy = 0;
1596 
1597 	wil_dbg_misc(wil, "change_beacon, mid=%d\n", vif->mid);
1598 	wil_print_bcon_data(bcon);
1599 
1600 	if (bcon->tail &&
1601 	    cfg80211_find_ie(WLAN_EID_RSN, bcon->tail,
1602 			     bcon->tail_len))
1603 		privacy = 1;
1604 
1605 	/* in case privacy has changed, need to restart the AP */
1606 	if (vif->privacy != privacy) {
1607 		struct wireless_dev *wdev = ndev->ieee80211_ptr;
1608 
1609 		wil_dbg_misc(wil, "privacy changed %d=>%d. Restarting AP\n",
1610 			     vif->privacy, privacy);
1611 
1612 		rc = _wil_cfg80211_start_ap(wiphy, ndev, wdev->ssid,
1613 					    wdev->ssid_len, privacy,
1614 					    wdev->beacon_interval,
1615 					    vif->channel, bcon,
1616 					    vif->hidden_ssid,
1617 					    vif->pbss);
1618 	} else {
1619 		rc = _wil_cfg80211_set_ies(vif, bcon);
1620 	}
1621 
1622 	return rc;
1623 }
1624 
1625 static int wil_cfg80211_start_ap(struct wiphy *wiphy,
1626 				 struct net_device *ndev,
1627 				 struct cfg80211_ap_settings *info)
1628 {
1629 	int rc;
1630 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1631 	struct ieee80211_channel *channel = info->chandef.chan;
1632 	struct cfg80211_beacon_data *bcon = &info->beacon;
1633 	struct cfg80211_crypto_settings *crypto = &info->crypto;
1634 	u8 hidden_ssid;
1635 
1636 	wil_dbg_misc(wil, "start_ap\n");
1637 
1638 	if (!channel) {
1639 		wil_err(wil, "AP: No channel???\n");
1640 		return -EINVAL;
1641 	}
1642 
1643 	switch (info->hidden_ssid) {
1644 	case NL80211_HIDDEN_SSID_NOT_IN_USE:
1645 		hidden_ssid = WMI_HIDDEN_SSID_DISABLED;
1646 		break;
1647 
1648 	case NL80211_HIDDEN_SSID_ZERO_LEN:
1649 		hidden_ssid = WMI_HIDDEN_SSID_SEND_EMPTY;
1650 		break;
1651 
1652 	case NL80211_HIDDEN_SSID_ZERO_CONTENTS:
1653 		hidden_ssid = WMI_HIDDEN_SSID_CLEAR;
1654 		break;
1655 
1656 	default:
1657 		wil_err(wil, "AP: Invalid hidden SSID %d\n", info->hidden_ssid);
1658 		return -EOPNOTSUPP;
1659 	}
1660 	wil_dbg_misc(wil, "AP on Channel %d %d MHz, %s\n", channel->hw_value,
1661 		     channel->center_freq, info->privacy ? "secure" : "open");
1662 	wil_dbg_misc(wil, "Privacy: %d auth_type %d\n",
1663 		     info->privacy, info->auth_type);
1664 	wil_dbg_misc(wil, "Hidden SSID mode: %d\n",
1665 		     info->hidden_ssid);
1666 	wil_dbg_misc(wil, "BI %d DTIM %d\n", info->beacon_interval,
1667 		     info->dtim_period);
1668 	wil_dbg_misc(wil, "PBSS %d\n", info->pbss);
1669 	wil_hex_dump_misc("SSID ", DUMP_PREFIX_OFFSET, 16, 1,
1670 			  info->ssid, info->ssid_len, true);
1671 	wil_print_bcon_data(bcon);
1672 	wil_print_crypto(wil, crypto);
1673 
1674 	rc = _wil_cfg80211_start_ap(wiphy, ndev,
1675 				    info->ssid, info->ssid_len, info->privacy,
1676 				    info->beacon_interval, channel->hw_value,
1677 				    bcon, hidden_ssid, info->pbss);
1678 
1679 	return rc;
1680 }
1681 
1682 static int wil_cfg80211_stop_ap(struct wiphy *wiphy,
1683 				struct net_device *ndev)
1684 {
1685 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1686 	struct wil6210_vif *vif = ndev_to_vif(ndev);
1687 	bool last;
1688 
1689 	wil_dbg_misc(wil, "stop_ap, mid=%d\n", vif->mid);
1690 
1691 	netif_carrier_off(ndev);
1692 	last = !wil_has_other_active_ifaces(wil, ndev, false, true);
1693 	if (last) {
1694 		wil6210_bus_request(wil, WIL_DEFAULT_BUS_REQUEST_KBPS);
1695 		wil_set_recovery_state(wil, fw_recovery_idle);
1696 		set_bit(wil_status_resetting, wil->status);
1697 	}
1698 
1699 	mutex_lock(&wil->mutex);
1700 
1701 	wmi_pcp_stop(vif);
1702 
1703 	if (last)
1704 		__wil_down(wil);
1705 	else
1706 		wil_bcast_fini(vif);
1707 
1708 	mutex_unlock(&wil->mutex);
1709 
1710 	return 0;
1711 }
1712 
1713 static int wil_cfg80211_add_station(struct wiphy *wiphy,
1714 				    struct net_device *dev,
1715 				    const u8 *mac,
1716 				    struct station_parameters *params)
1717 {
1718 	struct wil6210_vif *vif = ndev_to_vif(dev);
1719 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1720 
1721 	wil_dbg_misc(wil, "add station %pM aid %d mid %d\n",
1722 		     mac, params->aid, vif->mid);
1723 
1724 	if (!disable_ap_sme) {
1725 		wil_err(wil, "not supported with AP SME enabled\n");
1726 		return -EOPNOTSUPP;
1727 	}
1728 
1729 	if (params->aid > WIL_MAX_DMG_AID) {
1730 		wil_err(wil, "invalid aid\n");
1731 		return -EINVAL;
1732 	}
1733 
1734 	return wmi_new_sta(vif, mac, params->aid);
1735 }
1736 
1737 static int wil_cfg80211_del_station(struct wiphy *wiphy,
1738 				    struct net_device *dev,
1739 				    struct station_del_parameters *params)
1740 {
1741 	struct wil6210_vif *vif = ndev_to_vif(dev);
1742 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1743 
1744 	wil_dbg_misc(wil, "del_station: %pM, reason=%d mid=%d\n",
1745 		     params->mac, params->reason_code, vif->mid);
1746 
1747 	mutex_lock(&wil->mutex);
1748 	wil6210_disconnect(vif, params->mac, params->reason_code, false);
1749 	mutex_unlock(&wil->mutex);
1750 
1751 	return 0;
1752 }
1753 
1754 static int wil_cfg80211_change_station(struct wiphy *wiphy,
1755 				       struct net_device *dev,
1756 				       const u8 *mac,
1757 				       struct station_parameters *params)
1758 {
1759 	struct wil6210_vif *vif = ndev_to_vif(dev);
1760 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1761 	int authorize;
1762 	int cid, i;
1763 	struct wil_ring_tx_data *txdata = NULL;
1764 
1765 	wil_dbg_misc(wil, "change station %pM mask 0x%x set 0x%x mid %d\n",
1766 		     mac, params->sta_flags_mask, params->sta_flags_set,
1767 		     vif->mid);
1768 
1769 	if (!disable_ap_sme) {
1770 		wil_dbg_misc(wil, "not supported with AP SME enabled\n");
1771 		return -EOPNOTSUPP;
1772 	}
1773 
1774 	if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
1775 		return 0;
1776 
1777 	cid = wil_find_cid(wil, vif->mid, mac);
1778 	if (cid < 0) {
1779 		wil_err(wil, "station not found\n");
1780 		return -ENOLINK;
1781 	}
1782 
1783 	for (i = 0; i < ARRAY_SIZE(wil->ring2cid_tid); i++)
1784 		if (wil->ring2cid_tid[i][0] == cid) {
1785 			txdata = &wil->ring_tx_data[i];
1786 			break;
1787 		}
1788 
1789 	if (!txdata) {
1790 		wil_err(wil, "ring data not found\n");
1791 		return -ENOLINK;
1792 	}
1793 
1794 	authorize = params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED);
1795 	txdata->dot1x_open = authorize ? 1 : 0;
1796 	wil_dbg_misc(wil, "cid %d ring %d authorize %d\n", cid, i,
1797 		     txdata->dot1x_open);
1798 
1799 	return 0;
1800 }
1801 
1802 /* probe_client handling */
1803 static void wil_probe_client_handle(struct wil6210_priv *wil,
1804 				    struct wil6210_vif *vif,
1805 				    struct wil_probe_client_req *req)
1806 {
1807 	struct net_device *ndev = vif_to_ndev(vif);
1808 	struct wil_sta_info *sta = &wil->sta[req->cid];
1809 	/* assume STA is alive if it is still connected,
1810 	 * else FW will disconnect it
1811 	 */
1812 	bool alive = (sta->status == wil_sta_connected);
1813 
1814 	cfg80211_probe_status(ndev, sta->addr, req->cookie, alive,
1815 			      0, false, GFP_KERNEL);
1816 }
1817 
1818 static struct list_head *next_probe_client(struct wil6210_vif *vif)
1819 {
1820 	struct list_head *ret = NULL;
1821 
1822 	mutex_lock(&vif->probe_client_mutex);
1823 
1824 	if (!list_empty(&vif->probe_client_pending)) {
1825 		ret = vif->probe_client_pending.next;
1826 		list_del(ret);
1827 	}
1828 
1829 	mutex_unlock(&vif->probe_client_mutex);
1830 
1831 	return ret;
1832 }
1833 
1834 void wil_probe_client_worker(struct work_struct *work)
1835 {
1836 	struct wil6210_vif *vif = container_of(work, struct wil6210_vif,
1837 					       probe_client_worker);
1838 	struct wil6210_priv *wil = vif_to_wil(vif);
1839 	struct wil_probe_client_req *req;
1840 	struct list_head *lh;
1841 
1842 	while ((lh = next_probe_client(vif)) != NULL) {
1843 		req = list_entry(lh, struct wil_probe_client_req, list);
1844 
1845 		wil_probe_client_handle(wil, vif, req);
1846 		kfree(req);
1847 	}
1848 }
1849 
1850 void wil_probe_client_flush(struct wil6210_vif *vif)
1851 {
1852 	struct wil_probe_client_req *req, *t;
1853 	struct wil6210_priv *wil = vif_to_wil(vif);
1854 
1855 	wil_dbg_misc(wil, "probe_client_flush\n");
1856 
1857 	mutex_lock(&vif->probe_client_mutex);
1858 
1859 	list_for_each_entry_safe(req, t, &vif->probe_client_pending, list) {
1860 		list_del(&req->list);
1861 		kfree(req);
1862 	}
1863 
1864 	mutex_unlock(&vif->probe_client_mutex);
1865 }
1866 
1867 static int wil_cfg80211_probe_client(struct wiphy *wiphy,
1868 				     struct net_device *dev,
1869 				     const u8 *peer, u64 *cookie)
1870 {
1871 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1872 	struct wil6210_vif *vif = ndev_to_vif(dev);
1873 	struct wil_probe_client_req *req;
1874 	int cid = wil_find_cid(wil, vif->mid, peer);
1875 
1876 	wil_dbg_misc(wil, "probe_client: %pM => CID %d MID %d\n",
1877 		     peer, cid, vif->mid);
1878 
1879 	if (cid < 0)
1880 		return -ENOLINK;
1881 
1882 	req = kzalloc(sizeof(*req), GFP_KERNEL);
1883 	if (!req)
1884 		return -ENOMEM;
1885 
1886 	req->cid = cid;
1887 	req->cookie = cid;
1888 
1889 	mutex_lock(&vif->probe_client_mutex);
1890 	list_add_tail(&req->list, &vif->probe_client_pending);
1891 	mutex_unlock(&vif->probe_client_mutex);
1892 
1893 	*cookie = req->cookie;
1894 	queue_work(wil->wq_service, &vif->probe_client_worker);
1895 	return 0;
1896 }
1897 
1898 static int wil_cfg80211_change_bss(struct wiphy *wiphy,
1899 				   struct net_device *dev,
1900 				   struct bss_parameters *params)
1901 {
1902 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1903 	struct wil6210_vif *vif = ndev_to_vif(dev);
1904 
1905 	if (params->ap_isolate >= 0) {
1906 		wil_dbg_misc(wil, "change_bss: ap_isolate MID %d, %d => %d\n",
1907 			     vif->mid, vif->ap_isolate, params->ap_isolate);
1908 		vif->ap_isolate = params->ap_isolate;
1909 	}
1910 
1911 	return 0;
1912 }
1913 
1914 static int wil_cfg80211_set_power_mgmt(struct wiphy *wiphy,
1915 				       struct net_device *dev,
1916 				       bool enabled, int timeout)
1917 {
1918 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1919 	enum wmi_ps_profile_type ps_profile;
1920 
1921 	wil_dbg_misc(wil, "enabled=%d, timeout=%d\n",
1922 		     enabled, timeout);
1923 
1924 	if (enabled)
1925 		ps_profile = WMI_PS_PROFILE_TYPE_DEFAULT;
1926 	else
1927 		ps_profile = WMI_PS_PROFILE_TYPE_PS_DISABLED;
1928 
1929 	return wil_ps_update(wil, ps_profile);
1930 }
1931 
1932 static int wil_cfg80211_suspend(struct wiphy *wiphy,
1933 				struct cfg80211_wowlan *wow)
1934 {
1935 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1936 	int rc;
1937 
1938 	/* Setting the wakeup trigger based on wow is TBD */
1939 
1940 	if (test_bit(wil_status_suspended, wil->status)) {
1941 		wil_dbg_pm(wil, "trying to suspend while suspended\n");
1942 		return 0;
1943 	}
1944 
1945 	rc = wil_can_suspend(wil, false);
1946 	if (rc)
1947 		goto out;
1948 
1949 	wil_dbg_pm(wil, "suspending\n");
1950 
1951 	mutex_lock(&wil->mutex);
1952 	mutex_lock(&wil->vif_mutex);
1953 	wil_p2p_stop_radio_operations(wil);
1954 	wil_abort_scan_all_vifs(wil, true);
1955 	mutex_unlock(&wil->vif_mutex);
1956 	mutex_unlock(&wil->mutex);
1957 
1958 out:
1959 	return rc;
1960 }
1961 
1962 static int wil_cfg80211_resume(struct wiphy *wiphy)
1963 {
1964 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1965 
1966 	wil_dbg_pm(wil, "resuming\n");
1967 
1968 	return 0;
1969 }
1970 
1971 static int
1972 wil_cfg80211_sched_scan_start(struct wiphy *wiphy,
1973 			      struct net_device *dev,
1974 			      struct cfg80211_sched_scan_request *request)
1975 {
1976 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1977 	struct wil6210_vif *vif = ndev_to_vif(dev);
1978 	int i, rc;
1979 
1980 	if (vif->mid != 0)
1981 		return -EOPNOTSUPP;
1982 
1983 	wil_dbg_misc(wil,
1984 		     "sched scan start: n_ssids %d, ie_len %zu, flags 0x%x\n",
1985 		     request->n_ssids, request->ie_len, request->flags);
1986 	for (i = 0; i < request->n_ssids; i++) {
1987 		wil_dbg_misc(wil, "SSID[%d]:", i);
1988 		wil_hex_dump_misc("SSID ", DUMP_PREFIX_OFFSET, 16, 1,
1989 				  request->ssids[i].ssid,
1990 				  request->ssids[i].ssid_len, true);
1991 	}
1992 	wil_dbg_misc(wil, "channels:");
1993 	for (i = 0; i < request->n_channels; i++)
1994 		wil_dbg_misc(wil, " %d%s", request->channels[i]->hw_value,
1995 			     i == request->n_channels - 1 ? "\n" : "");
1996 	wil_dbg_misc(wil, "n_match_sets %d, min_rssi_thold %d, delay %d\n",
1997 		     request->n_match_sets, request->min_rssi_thold,
1998 		     request->delay);
1999 	for (i = 0; i < request->n_match_sets; i++) {
2000 		struct cfg80211_match_set *ms = &request->match_sets[i];
2001 
2002 		wil_dbg_misc(wil, "MATCHSET[%d]: rssi_thold %d\n",
2003 			     i, ms->rssi_thold);
2004 		wil_hex_dump_misc("SSID ", DUMP_PREFIX_OFFSET, 16, 1,
2005 				  ms->ssid.ssid,
2006 				  ms->ssid.ssid_len, true);
2007 	}
2008 	wil_dbg_misc(wil, "n_scan_plans %d\n", request->n_scan_plans);
2009 	for (i = 0; i < request->n_scan_plans; i++) {
2010 		struct cfg80211_sched_scan_plan *sp = &request->scan_plans[i];
2011 
2012 		wil_dbg_misc(wil, "SCAN PLAN[%d]: interval %d iterations %d\n",
2013 			     i, sp->interval, sp->iterations);
2014 	}
2015 
2016 	rc = wmi_set_ie(vif, WMI_FRAME_PROBE_REQ,
2017 			request->ie_len, request->ie);
2018 	if (rc)
2019 		return rc;
2020 	return wmi_start_sched_scan(wil, request);
2021 }
2022 
2023 static int
2024 wil_cfg80211_sched_scan_stop(struct wiphy *wiphy, struct net_device *dev,
2025 			     u64 reqid)
2026 {
2027 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2028 	struct wil6210_vif *vif = ndev_to_vif(dev);
2029 	int rc;
2030 
2031 	if (vif->mid != 0)
2032 		return -EOPNOTSUPP;
2033 
2034 	rc = wmi_stop_sched_scan(wil);
2035 	/* device would return error if it thinks PNO is already stopped.
2036 	 * ignore the return code so user space and driver gets back in-sync
2037 	 */
2038 	wil_dbg_misc(wil, "sched scan stopped (%d)\n", rc);
2039 
2040 	return 0;
2041 }
2042 
2043 static const struct cfg80211_ops wil_cfg80211_ops = {
2044 	.add_virtual_intf = wil_cfg80211_add_iface,
2045 	.del_virtual_intf = wil_cfg80211_del_iface,
2046 	.scan = wil_cfg80211_scan,
2047 	.abort_scan = wil_cfg80211_abort_scan,
2048 	.connect = wil_cfg80211_connect,
2049 	.disconnect = wil_cfg80211_disconnect,
2050 	.set_wiphy_params = wil_cfg80211_set_wiphy_params,
2051 	.change_virtual_intf = wil_cfg80211_change_iface,
2052 	.get_station = wil_cfg80211_get_station,
2053 	.dump_station = wil_cfg80211_dump_station,
2054 	.remain_on_channel = wil_remain_on_channel,
2055 	.cancel_remain_on_channel = wil_cancel_remain_on_channel,
2056 	.mgmt_tx = wil_cfg80211_mgmt_tx,
2057 	.set_monitor_channel = wil_cfg80211_set_channel,
2058 	.add_key = wil_cfg80211_add_key,
2059 	.del_key = wil_cfg80211_del_key,
2060 	.set_default_key = wil_cfg80211_set_default_key,
2061 	/* AP mode */
2062 	.change_beacon = wil_cfg80211_change_beacon,
2063 	.start_ap = wil_cfg80211_start_ap,
2064 	.stop_ap = wil_cfg80211_stop_ap,
2065 	.add_station = wil_cfg80211_add_station,
2066 	.del_station = wil_cfg80211_del_station,
2067 	.change_station = wil_cfg80211_change_station,
2068 	.probe_client = wil_cfg80211_probe_client,
2069 	.change_bss = wil_cfg80211_change_bss,
2070 	/* P2P device */
2071 	.start_p2p_device = wil_cfg80211_start_p2p_device,
2072 	.stop_p2p_device = wil_cfg80211_stop_p2p_device,
2073 	.set_power_mgmt = wil_cfg80211_set_power_mgmt,
2074 	.suspend = wil_cfg80211_suspend,
2075 	.resume = wil_cfg80211_resume,
2076 	.sched_scan_start = wil_cfg80211_sched_scan_start,
2077 	.sched_scan_stop = wil_cfg80211_sched_scan_stop,
2078 };
2079 
2080 static void wil_wiphy_init(struct wiphy *wiphy)
2081 {
2082 	wiphy->max_scan_ssids = 1;
2083 	wiphy->max_scan_ie_len = WMI_MAX_IE_LEN;
2084 	wiphy->max_remain_on_channel_duration = WIL_MAX_ROC_DURATION_MS;
2085 	wiphy->max_num_pmkids = 0 /* TODO: */;
2086 	wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
2087 				 BIT(NL80211_IFTYPE_AP) |
2088 				 BIT(NL80211_IFTYPE_P2P_CLIENT) |
2089 				 BIT(NL80211_IFTYPE_P2P_GO) |
2090 				 BIT(NL80211_IFTYPE_P2P_DEVICE) |
2091 				 BIT(NL80211_IFTYPE_MONITOR);
2092 	wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
2093 			WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD |
2094 			WIPHY_FLAG_PS_ON_BY_DEFAULT;
2095 	if (!disable_ap_sme)
2096 		wiphy->flags |= WIPHY_FLAG_HAVE_AP_SME;
2097 	dev_dbg(wiphy_dev(wiphy), "%s : flags = 0x%08x\n",
2098 		__func__, wiphy->flags);
2099 	wiphy->probe_resp_offload =
2100 		NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS |
2101 		NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2 |
2102 		NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P;
2103 
2104 	wiphy->bands[NL80211_BAND_60GHZ] = &wil_band_60ghz;
2105 
2106 	/* may change after reading FW capabilities */
2107 	wiphy->signal_type = CFG80211_SIGNAL_TYPE_UNSPEC;
2108 
2109 	wiphy->cipher_suites = wil_cipher_suites;
2110 	wiphy->n_cipher_suites = ARRAY_SIZE(wil_cipher_suites);
2111 	wiphy->mgmt_stypes = wil_mgmt_stypes;
2112 	wiphy->features |= NL80211_FEATURE_SK_TX_STATUS;
2113 
2114 	wiphy->n_vendor_commands = ARRAY_SIZE(wil_nl80211_vendor_commands);
2115 	wiphy->vendor_commands = wil_nl80211_vendor_commands;
2116 
2117 #ifdef CONFIG_PM
2118 	wiphy->wowlan = &wil_wowlan_support;
2119 #endif
2120 }
2121 
2122 int wil_cfg80211_iface_combinations_from_fw(
2123 	struct wil6210_priv *wil, const struct wil_fw_record_concurrency *conc)
2124 {
2125 	struct wiphy *wiphy = wil_to_wiphy(wil);
2126 	u32 total_limits = 0;
2127 	u16 n_combos;
2128 	const struct wil_fw_concurrency_combo *combo;
2129 	const struct wil_fw_concurrency_limit *limit;
2130 	struct ieee80211_iface_combination *iface_combinations;
2131 	struct ieee80211_iface_limit *iface_limit;
2132 	int i, j;
2133 
2134 	if (wiphy->iface_combinations) {
2135 		wil_dbg_misc(wil, "iface_combinations already set, skipping\n");
2136 		return 0;
2137 	}
2138 
2139 	combo = conc->combos;
2140 	n_combos = le16_to_cpu(conc->n_combos);
2141 	for (i = 0; i < n_combos; i++) {
2142 		total_limits += combo->n_limits;
2143 		limit = combo->limits + combo->n_limits;
2144 		combo = (struct wil_fw_concurrency_combo *)limit;
2145 	}
2146 
2147 	iface_combinations =
2148 		kzalloc(n_combos * sizeof(struct ieee80211_iface_combination) +
2149 			total_limits * sizeof(struct ieee80211_iface_limit),
2150 			GFP_KERNEL);
2151 	if (!iface_combinations)
2152 		return -ENOMEM;
2153 	iface_limit = (struct ieee80211_iface_limit *)(iface_combinations +
2154 						       n_combos);
2155 	combo = conc->combos;
2156 	for (i = 0; i < n_combos; i++) {
2157 		iface_combinations[i].max_interfaces = combo->max_interfaces;
2158 		iface_combinations[i].num_different_channels =
2159 			combo->n_diff_channels;
2160 		iface_combinations[i].beacon_int_infra_match =
2161 			combo->same_bi;
2162 		iface_combinations[i].n_limits = combo->n_limits;
2163 		wil_dbg_misc(wil,
2164 			     "iface_combination %d: max_if %d, num_ch %d, bi_match %d\n",
2165 			     i, iface_combinations[i].max_interfaces,
2166 			     iface_combinations[i].num_different_channels,
2167 			     iface_combinations[i].beacon_int_infra_match);
2168 		limit = combo->limits;
2169 		for (j = 0; j < combo->n_limits; j++) {
2170 			iface_limit[j].max = le16_to_cpu(limit[j].max);
2171 			iface_limit[j].types = le16_to_cpu(limit[j].types);
2172 			wil_dbg_misc(wil,
2173 				     "limit %d: max %d types 0x%x\n", j,
2174 				     iface_limit[j].max, iface_limit[j].types);
2175 		}
2176 		iface_combinations[i].limits = iface_limit;
2177 		iface_limit += combo->n_limits;
2178 		limit += combo->n_limits;
2179 		combo = (struct wil_fw_concurrency_combo *)limit;
2180 	}
2181 
2182 	wil_dbg_misc(wil, "multiple VIFs supported, n_mids %d\n", conc->n_mids);
2183 	wil->max_vifs = conc->n_mids + 1; /* including main interface */
2184 	if (wil->max_vifs > WIL_MAX_VIFS) {
2185 		wil_info(wil, "limited number of VIFs supported(%d, FW %d)\n",
2186 			 WIL_MAX_VIFS, wil->max_vifs);
2187 		wil->max_vifs = WIL_MAX_VIFS;
2188 	}
2189 	wiphy->n_iface_combinations = n_combos;
2190 	wiphy->iface_combinations = iface_combinations;
2191 	return 0;
2192 }
2193 
2194 struct wil6210_priv *wil_cfg80211_init(struct device *dev)
2195 {
2196 	struct wiphy *wiphy;
2197 	struct wil6210_priv *wil;
2198 	struct ieee80211_channel *ch;
2199 
2200 	dev_dbg(dev, "%s()\n", __func__);
2201 
2202 	/* Note: the wireless_dev structure is no longer allocated here.
2203 	 * Instead, it is allocated as part of the net_device structure
2204 	 * for main interface and each VIF.
2205 	 */
2206 	wiphy = wiphy_new(&wil_cfg80211_ops, sizeof(struct wil6210_priv));
2207 	if (!wiphy)
2208 		return ERR_PTR(-ENOMEM);
2209 
2210 	set_wiphy_dev(wiphy, dev);
2211 	wil_wiphy_init(wiphy);
2212 
2213 	wil = wiphy_to_wil(wiphy);
2214 	wil->wiphy = wiphy;
2215 
2216 	/* default monitor channel */
2217 	ch = wiphy->bands[NL80211_BAND_60GHZ]->channels;
2218 	cfg80211_chandef_create(&wil->monitor_chandef, ch, NL80211_CHAN_NO_HT);
2219 
2220 	return wil;
2221 }
2222 
2223 void wil_cfg80211_deinit(struct wil6210_priv *wil)
2224 {
2225 	struct wiphy *wiphy = wil_to_wiphy(wil);
2226 
2227 	dev_dbg(wil_to_dev(wil), "%s()\n", __func__);
2228 
2229 	if (!wiphy)
2230 		return;
2231 
2232 	kfree(wiphy->iface_combinations);
2233 	wiphy->iface_combinations = NULL;
2234 
2235 	wiphy_free(wiphy);
2236 	/* do not access wil6210_priv after returning from here */
2237 }
2238 
2239 void wil_p2p_wdev_free(struct wil6210_priv *wil)
2240 {
2241 	struct wireless_dev *p2p_wdev;
2242 
2243 	mutex_lock(&wil->vif_mutex);
2244 	p2p_wdev = wil->p2p_wdev;
2245 	wil->p2p_wdev = NULL;
2246 	wil->radio_wdev = wil->main_ndev->ieee80211_ptr;
2247 	mutex_unlock(&wil->vif_mutex);
2248 	if (p2p_wdev) {
2249 		cfg80211_unregister_wdev(p2p_wdev);
2250 		kfree(p2p_wdev);
2251 	}
2252 }
2253 
2254 static int wil_rf_sector_status_to_rc(u8 status)
2255 {
2256 	switch (status) {
2257 	case WMI_RF_SECTOR_STATUS_SUCCESS:
2258 		return 0;
2259 	case WMI_RF_SECTOR_STATUS_BAD_PARAMETERS_ERROR:
2260 		return -EINVAL;
2261 	case WMI_RF_SECTOR_STATUS_BUSY_ERROR:
2262 		return -EAGAIN;
2263 	case WMI_RF_SECTOR_STATUS_NOT_SUPPORTED_ERROR:
2264 		return -EOPNOTSUPP;
2265 	default:
2266 		return -EINVAL;
2267 	}
2268 }
2269 
2270 static int wil_rf_sector_get_cfg(struct wiphy *wiphy,
2271 				 struct wireless_dev *wdev,
2272 				 const void *data, int data_len)
2273 {
2274 	struct wil6210_priv *wil = wdev_to_wil(wdev);
2275 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
2276 	int rc;
2277 	struct nlattr *tb[QCA_ATTR_DMG_RF_SECTOR_MAX + 1];
2278 	u16 sector_index;
2279 	u8 sector_type;
2280 	u32 rf_modules_vec;
2281 	struct wmi_get_rf_sector_params_cmd cmd;
2282 	struct {
2283 		struct wmi_cmd_hdr wmi;
2284 		struct wmi_get_rf_sector_params_done_event evt;
2285 	} __packed reply = {
2286 		.evt = {.status = WMI_RF_SECTOR_STATUS_NOT_SUPPORTED_ERROR},
2287 	};
2288 	struct sk_buff *msg;
2289 	struct nlattr *nl_cfgs, *nl_cfg;
2290 	u32 i;
2291 	struct wmi_rf_sector_info *si;
2292 
2293 	if (!test_bit(WMI_FW_CAPABILITY_RF_SECTORS, wil->fw_capabilities))
2294 		return -EOPNOTSUPP;
2295 
2296 	rc = nla_parse(tb, QCA_ATTR_DMG_RF_SECTOR_MAX, data, data_len,
2297 		       wil_rf_sector_policy, NULL);
2298 	if (rc) {
2299 		wil_err(wil, "Invalid rf sector ATTR\n");
2300 		return rc;
2301 	}
2302 
2303 	if (!tb[QCA_ATTR_DMG_RF_SECTOR_INDEX] ||
2304 	    !tb[QCA_ATTR_DMG_RF_SECTOR_TYPE] ||
2305 	    !tb[QCA_ATTR_DMG_RF_MODULE_MASK]) {
2306 		wil_err(wil, "Invalid rf sector spec\n");
2307 		return -EINVAL;
2308 	}
2309 
2310 	sector_index = nla_get_u16(
2311 		tb[QCA_ATTR_DMG_RF_SECTOR_INDEX]);
2312 	if (sector_index >= WIL_MAX_RF_SECTORS) {
2313 		wil_err(wil, "Invalid sector index %d\n", sector_index);
2314 		return -EINVAL;
2315 	}
2316 
2317 	sector_type = nla_get_u8(tb[QCA_ATTR_DMG_RF_SECTOR_TYPE]);
2318 	if (sector_type >= QCA_ATTR_DMG_RF_SECTOR_TYPE_MAX) {
2319 		wil_err(wil, "Invalid sector type %d\n", sector_type);
2320 		return -EINVAL;
2321 	}
2322 
2323 	rf_modules_vec = nla_get_u32(
2324 		tb[QCA_ATTR_DMG_RF_MODULE_MASK]);
2325 	if (rf_modules_vec >= BIT(WMI_MAX_RF_MODULES_NUM)) {
2326 		wil_err(wil, "Invalid rf module mask 0x%x\n", rf_modules_vec);
2327 		return -EINVAL;
2328 	}
2329 
2330 	cmd.sector_idx = cpu_to_le16(sector_index);
2331 	cmd.sector_type = sector_type;
2332 	cmd.rf_modules_vec = rf_modules_vec & 0xFF;
2333 	rc = wmi_call(wil, WMI_GET_RF_SECTOR_PARAMS_CMDID, vif->mid,
2334 		      &cmd, sizeof(cmd), WMI_GET_RF_SECTOR_PARAMS_DONE_EVENTID,
2335 		      &reply, sizeof(reply),
2336 		      500);
2337 	if (rc)
2338 		return rc;
2339 	if (reply.evt.status) {
2340 		wil_err(wil, "get rf sector cfg failed with status %d\n",
2341 			reply.evt.status);
2342 		return wil_rf_sector_status_to_rc(reply.evt.status);
2343 	}
2344 
2345 	msg = cfg80211_vendor_cmd_alloc_reply_skb(
2346 		wiphy, 64 * WMI_MAX_RF_MODULES_NUM);
2347 	if (!msg)
2348 		return -ENOMEM;
2349 
2350 	if (nla_put_u64_64bit(msg, QCA_ATTR_TSF,
2351 			      le64_to_cpu(reply.evt.tsf),
2352 			      QCA_ATTR_PAD))
2353 		goto nla_put_failure;
2354 
2355 	nl_cfgs = nla_nest_start(msg, QCA_ATTR_DMG_RF_SECTOR_CFG);
2356 	if (!nl_cfgs)
2357 		goto nla_put_failure;
2358 	for (i = 0; i < WMI_MAX_RF_MODULES_NUM; i++) {
2359 		if (!(rf_modules_vec & BIT(i)))
2360 			continue;
2361 		nl_cfg = nla_nest_start(msg, i);
2362 		if (!nl_cfg)
2363 			goto nla_put_failure;
2364 		si = &reply.evt.sectors_info[i];
2365 		if (nla_put_u8(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_MODULE_INDEX,
2366 			       i) ||
2367 		    nla_put_u32(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE0,
2368 				le32_to_cpu(si->etype0)) ||
2369 		    nla_put_u32(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE1,
2370 				le32_to_cpu(si->etype1)) ||
2371 		    nla_put_u32(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE2,
2372 				le32_to_cpu(si->etype2)) ||
2373 		    nla_put_u32(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_HI,
2374 				le32_to_cpu(si->psh_hi)) ||
2375 		    nla_put_u32(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_LO,
2376 				le32_to_cpu(si->psh_lo)) ||
2377 		    nla_put_u32(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_DTYPE_X16,
2378 				le32_to_cpu(si->dtype_swch_off)))
2379 			goto nla_put_failure;
2380 		nla_nest_end(msg, nl_cfg);
2381 	}
2382 
2383 	nla_nest_end(msg, nl_cfgs);
2384 	rc = cfg80211_vendor_cmd_reply(msg);
2385 	return rc;
2386 nla_put_failure:
2387 	kfree_skb(msg);
2388 	return -ENOBUFS;
2389 }
2390 
2391 static int wil_rf_sector_set_cfg(struct wiphy *wiphy,
2392 				 struct wireless_dev *wdev,
2393 				 const void *data, int data_len)
2394 {
2395 	struct wil6210_priv *wil = wdev_to_wil(wdev);
2396 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
2397 	int rc, tmp;
2398 	struct nlattr *tb[QCA_ATTR_DMG_RF_SECTOR_MAX + 1];
2399 	struct nlattr *tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_MAX + 1];
2400 	u16 sector_index, rf_module_index;
2401 	u8 sector_type;
2402 	u32 rf_modules_vec = 0;
2403 	struct wmi_set_rf_sector_params_cmd cmd;
2404 	struct {
2405 		struct wmi_cmd_hdr wmi;
2406 		struct wmi_set_rf_sector_params_done_event evt;
2407 	} __packed reply = {
2408 		.evt = {.status = WMI_RF_SECTOR_STATUS_NOT_SUPPORTED_ERROR},
2409 	};
2410 	struct nlattr *nl_cfg;
2411 	struct wmi_rf_sector_info *si;
2412 
2413 	if (!test_bit(WMI_FW_CAPABILITY_RF_SECTORS, wil->fw_capabilities))
2414 		return -EOPNOTSUPP;
2415 
2416 	rc = nla_parse(tb, QCA_ATTR_DMG_RF_SECTOR_MAX, data, data_len,
2417 		       wil_rf_sector_policy, NULL);
2418 	if (rc) {
2419 		wil_err(wil, "Invalid rf sector ATTR\n");
2420 		return rc;
2421 	}
2422 
2423 	if (!tb[QCA_ATTR_DMG_RF_SECTOR_INDEX] ||
2424 	    !tb[QCA_ATTR_DMG_RF_SECTOR_TYPE] ||
2425 	    !tb[QCA_ATTR_DMG_RF_SECTOR_CFG]) {
2426 		wil_err(wil, "Invalid rf sector spec\n");
2427 		return -EINVAL;
2428 	}
2429 
2430 	sector_index = nla_get_u16(
2431 		tb[QCA_ATTR_DMG_RF_SECTOR_INDEX]);
2432 	if (sector_index >= WIL_MAX_RF_SECTORS) {
2433 		wil_err(wil, "Invalid sector index %d\n", sector_index);
2434 		return -EINVAL;
2435 	}
2436 
2437 	sector_type = nla_get_u8(tb[QCA_ATTR_DMG_RF_SECTOR_TYPE]);
2438 	if (sector_type >= QCA_ATTR_DMG_RF_SECTOR_TYPE_MAX) {
2439 		wil_err(wil, "Invalid sector type %d\n", sector_type);
2440 		return -EINVAL;
2441 	}
2442 
2443 	memset(&cmd, 0, sizeof(cmd));
2444 
2445 	cmd.sector_idx = cpu_to_le16(sector_index);
2446 	cmd.sector_type = sector_type;
2447 	nla_for_each_nested(nl_cfg, tb[QCA_ATTR_DMG_RF_SECTOR_CFG],
2448 			    tmp) {
2449 		rc = nla_parse_nested(tb2, QCA_ATTR_DMG_RF_SECTOR_CFG_MAX,
2450 				      nl_cfg, wil_rf_sector_cfg_policy,
2451 				      NULL);
2452 		if (rc) {
2453 			wil_err(wil, "invalid sector cfg\n");
2454 			return -EINVAL;
2455 		}
2456 
2457 		if (!tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_MODULE_INDEX] ||
2458 		    !tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE0] ||
2459 		    !tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE1] ||
2460 		    !tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE2] ||
2461 		    !tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_HI] ||
2462 		    !tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_LO] ||
2463 		    !tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_DTYPE_X16]) {
2464 			wil_err(wil, "missing cfg params\n");
2465 			return -EINVAL;
2466 		}
2467 
2468 		rf_module_index = nla_get_u8(
2469 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_MODULE_INDEX]);
2470 		if (rf_module_index >= WMI_MAX_RF_MODULES_NUM) {
2471 			wil_err(wil, "invalid RF module index %d\n",
2472 				rf_module_index);
2473 			return -EINVAL;
2474 		}
2475 		rf_modules_vec |= BIT(rf_module_index);
2476 		si = &cmd.sectors_info[rf_module_index];
2477 		si->etype0 = cpu_to_le32(nla_get_u32(
2478 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE0]));
2479 		si->etype1 = cpu_to_le32(nla_get_u32(
2480 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE1]));
2481 		si->etype2 = cpu_to_le32(nla_get_u32(
2482 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE2]));
2483 		si->psh_hi = cpu_to_le32(nla_get_u32(
2484 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_HI]));
2485 		si->psh_lo = cpu_to_le32(nla_get_u32(
2486 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_LO]));
2487 		si->dtype_swch_off = cpu_to_le32(nla_get_u32(
2488 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_DTYPE_X16]));
2489 	}
2490 
2491 	cmd.rf_modules_vec = rf_modules_vec & 0xFF;
2492 	rc = wmi_call(wil, WMI_SET_RF_SECTOR_PARAMS_CMDID, vif->mid,
2493 		      &cmd, sizeof(cmd), WMI_SET_RF_SECTOR_PARAMS_DONE_EVENTID,
2494 		      &reply, sizeof(reply),
2495 		      500);
2496 	if (rc)
2497 		return rc;
2498 	return wil_rf_sector_status_to_rc(reply.evt.status);
2499 }
2500 
2501 static int wil_rf_sector_get_selected(struct wiphy *wiphy,
2502 				      struct wireless_dev *wdev,
2503 				      const void *data, int data_len)
2504 {
2505 	struct wil6210_priv *wil = wdev_to_wil(wdev);
2506 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
2507 	int rc;
2508 	struct nlattr *tb[QCA_ATTR_DMG_RF_SECTOR_MAX + 1];
2509 	u8 sector_type, mac_addr[ETH_ALEN];
2510 	int cid = 0;
2511 	struct wmi_get_selected_rf_sector_index_cmd cmd;
2512 	struct {
2513 		struct wmi_cmd_hdr wmi;
2514 		struct wmi_get_selected_rf_sector_index_done_event evt;
2515 	} __packed reply = {
2516 		.evt = {.status = WMI_RF_SECTOR_STATUS_NOT_SUPPORTED_ERROR},
2517 	};
2518 	struct sk_buff *msg;
2519 
2520 	if (!test_bit(WMI_FW_CAPABILITY_RF_SECTORS, wil->fw_capabilities))
2521 		return -EOPNOTSUPP;
2522 
2523 	rc = nla_parse(tb, QCA_ATTR_DMG_RF_SECTOR_MAX, data, data_len,
2524 		       wil_rf_sector_policy, NULL);
2525 	if (rc) {
2526 		wil_err(wil, "Invalid rf sector ATTR\n");
2527 		return rc;
2528 	}
2529 
2530 	if (!tb[QCA_ATTR_DMG_RF_SECTOR_TYPE]) {
2531 		wil_err(wil, "Invalid rf sector spec\n");
2532 		return -EINVAL;
2533 	}
2534 	sector_type = nla_get_u8(tb[QCA_ATTR_DMG_RF_SECTOR_TYPE]);
2535 	if (sector_type >= QCA_ATTR_DMG_RF_SECTOR_TYPE_MAX) {
2536 		wil_err(wil, "Invalid sector type %d\n", sector_type);
2537 		return -EINVAL;
2538 	}
2539 
2540 	if (tb[QCA_ATTR_MAC_ADDR]) {
2541 		ether_addr_copy(mac_addr, nla_data(tb[QCA_ATTR_MAC_ADDR]));
2542 		cid = wil_find_cid(wil, vif->mid, mac_addr);
2543 		if (cid < 0) {
2544 			wil_err(wil, "invalid MAC address %pM\n", mac_addr);
2545 			return -ENOENT;
2546 		}
2547 	} else {
2548 		if (test_bit(wil_vif_fwconnected, vif->status)) {
2549 			wil_err(wil, "must specify MAC address when connected\n");
2550 			return -EINVAL;
2551 		}
2552 	}
2553 
2554 	memset(&cmd, 0, sizeof(cmd));
2555 	cmd.cid = (u8)cid;
2556 	cmd.sector_type = sector_type;
2557 	rc = wmi_call(wil, WMI_GET_SELECTED_RF_SECTOR_INDEX_CMDID, vif->mid,
2558 		      &cmd, sizeof(cmd),
2559 		      WMI_GET_SELECTED_RF_SECTOR_INDEX_DONE_EVENTID,
2560 		      &reply, sizeof(reply),
2561 		      500);
2562 	if (rc)
2563 		return rc;
2564 	if (reply.evt.status) {
2565 		wil_err(wil, "get rf selected sector cfg failed with status %d\n",
2566 			reply.evt.status);
2567 		return wil_rf_sector_status_to_rc(reply.evt.status);
2568 	}
2569 
2570 	msg = cfg80211_vendor_cmd_alloc_reply_skb(
2571 		wiphy, 64 * WMI_MAX_RF_MODULES_NUM);
2572 	if (!msg)
2573 		return -ENOMEM;
2574 
2575 	if (nla_put_u64_64bit(msg, QCA_ATTR_TSF,
2576 			      le64_to_cpu(reply.evt.tsf),
2577 			      QCA_ATTR_PAD) ||
2578 	    nla_put_u16(msg, QCA_ATTR_DMG_RF_SECTOR_INDEX,
2579 			le16_to_cpu(reply.evt.sector_idx)))
2580 		goto nla_put_failure;
2581 
2582 	rc = cfg80211_vendor_cmd_reply(msg);
2583 	return rc;
2584 nla_put_failure:
2585 	kfree_skb(msg);
2586 	return -ENOBUFS;
2587 }
2588 
2589 static int wil_rf_sector_wmi_set_selected(struct wil6210_priv *wil,
2590 					  u8 mid, u16 sector_index,
2591 					  u8 sector_type, u8 cid)
2592 {
2593 	struct wmi_set_selected_rf_sector_index_cmd cmd;
2594 	struct {
2595 		struct wmi_cmd_hdr wmi;
2596 		struct wmi_set_selected_rf_sector_index_done_event evt;
2597 	} __packed reply = {
2598 		.evt = {.status = WMI_RF_SECTOR_STATUS_NOT_SUPPORTED_ERROR},
2599 	};
2600 	int rc;
2601 
2602 	memset(&cmd, 0, sizeof(cmd));
2603 	cmd.sector_idx = cpu_to_le16(sector_index);
2604 	cmd.sector_type = sector_type;
2605 	cmd.cid = (u8)cid;
2606 	rc = wmi_call(wil, WMI_SET_SELECTED_RF_SECTOR_INDEX_CMDID, mid,
2607 		      &cmd, sizeof(cmd),
2608 		      WMI_SET_SELECTED_RF_SECTOR_INDEX_DONE_EVENTID,
2609 		      &reply, sizeof(reply),
2610 		      500);
2611 	if (rc)
2612 		return rc;
2613 	return wil_rf_sector_status_to_rc(reply.evt.status);
2614 }
2615 
2616 static int wil_rf_sector_set_selected(struct wiphy *wiphy,
2617 				      struct wireless_dev *wdev,
2618 				      const void *data, int data_len)
2619 {
2620 	struct wil6210_priv *wil = wdev_to_wil(wdev);
2621 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
2622 	int rc;
2623 	struct nlattr *tb[QCA_ATTR_DMG_RF_SECTOR_MAX + 1];
2624 	u16 sector_index;
2625 	u8 sector_type, mac_addr[ETH_ALEN], i;
2626 	int cid = 0;
2627 
2628 	if (!test_bit(WMI_FW_CAPABILITY_RF_SECTORS, wil->fw_capabilities))
2629 		return -EOPNOTSUPP;
2630 
2631 	rc = nla_parse(tb, QCA_ATTR_DMG_RF_SECTOR_MAX, data, data_len,
2632 		       wil_rf_sector_policy, NULL);
2633 	if (rc) {
2634 		wil_err(wil, "Invalid rf sector ATTR\n");
2635 		return rc;
2636 	}
2637 
2638 	if (!tb[QCA_ATTR_DMG_RF_SECTOR_INDEX] ||
2639 	    !tb[QCA_ATTR_DMG_RF_SECTOR_TYPE]) {
2640 		wil_err(wil, "Invalid rf sector spec\n");
2641 		return -EINVAL;
2642 	}
2643 
2644 	sector_index = nla_get_u16(
2645 		tb[QCA_ATTR_DMG_RF_SECTOR_INDEX]);
2646 	if (sector_index >= WIL_MAX_RF_SECTORS &&
2647 	    sector_index != WMI_INVALID_RF_SECTOR_INDEX) {
2648 		wil_err(wil, "Invalid sector index %d\n", sector_index);
2649 		return -EINVAL;
2650 	}
2651 
2652 	sector_type = nla_get_u8(tb[QCA_ATTR_DMG_RF_SECTOR_TYPE]);
2653 	if (sector_type >= QCA_ATTR_DMG_RF_SECTOR_TYPE_MAX) {
2654 		wil_err(wil, "Invalid sector type %d\n", sector_type);
2655 		return -EINVAL;
2656 	}
2657 
2658 	if (tb[QCA_ATTR_MAC_ADDR]) {
2659 		ether_addr_copy(mac_addr, nla_data(tb[QCA_ATTR_MAC_ADDR]));
2660 		if (!is_broadcast_ether_addr(mac_addr)) {
2661 			cid = wil_find_cid(wil, vif->mid, mac_addr);
2662 			if (cid < 0) {
2663 				wil_err(wil, "invalid MAC address %pM\n",
2664 					mac_addr);
2665 				return -ENOENT;
2666 			}
2667 		} else {
2668 			if (sector_index != WMI_INVALID_RF_SECTOR_INDEX) {
2669 				wil_err(wil, "broadcast MAC valid only with unlocking\n");
2670 				return -EINVAL;
2671 			}
2672 			cid = -1;
2673 		}
2674 	} else {
2675 		if (test_bit(wil_vif_fwconnected, vif->status)) {
2676 			wil_err(wil, "must specify MAC address when connected\n");
2677 			return -EINVAL;
2678 		}
2679 		/* otherwise, using cid=0 for unassociated station */
2680 	}
2681 
2682 	if (cid >= 0) {
2683 		rc = wil_rf_sector_wmi_set_selected(wil, vif->mid, sector_index,
2684 						    sector_type, cid);
2685 	} else {
2686 		/* unlock all cids */
2687 		rc = wil_rf_sector_wmi_set_selected(
2688 			wil, vif->mid, WMI_INVALID_RF_SECTOR_INDEX,
2689 			sector_type, WIL_CID_ALL);
2690 		if (rc == -EINVAL) {
2691 			for (i = 0; i < WIL6210_MAX_CID; i++) {
2692 				if (wil->sta[i].mid != vif->mid)
2693 					continue;
2694 				rc = wil_rf_sector_wmi_set_selected(
2695 					wil, vif->mid,
2696 					WMI_INVALID_RF_SECTOR_INDEX,
2697 					sector_type, i);
2698 				/* the FW will silently ignore and return
2699 				 * success for unused cid, so abort the loop
2700 				 * on any other error
2701 				 */
2702 				if (rc) {
2703 					wil_err(wil, "unlock cid %d failed with status %d\n",
2704 						i, rc);
2705 					break;
2706 				}
2707 			}
2708 		}
2709 	}
2710 
2711 	return rc;
2712 }
2713