1 // SPDX-License-Identifier: GPL-2.0-only
2 /******************************************************************************
3  *
4  * Copyright(c) 2003 - 2014, 2022 Intel Corporation. All rights reserved.
5  *
6  * Portions of this file are derived from the ipw3945 project, as well
7  * as portions of the ieee80211 subsystem header files.
8  *****************************************************************************/
9 #include <linux/etherdevice.h>
10 #include <net/mac80211.h>
11 #include "iwl-trans.h"
12 #include "dev.h"
13 #include "agn.h"
14 
15 const u8 iwl_bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
16 
17 static int iwl_sta_ucode_activate(struct iwl_priv *priv, u8 sta_id)
18 {
19 	lockdep_assert_held(&priv->sta_lock);
20 
21 	if (sta_id >= IWLAGN_STATION_COUNT) {
22 		IWL_ERR(priv, "invalid sta_id %u\n", sta_id);
23 		return -EINVAL;
24 	}
25 	if (!(priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE))
26 		IWL_ERR(priv, "ACTIVATE a non DRIVER active station id %u "
27 			"addr %pM\n",
28 			sta_id, priv->stations[sta_id].sta.sta.addr);
29 
30 	if (priv->stations[sta_id].used & IWL_STA_UCODE_ACTIVE) {
31 		IWL_DEBUG_ASSOC(priv,
32 				"STA id %u addr %pM already present in uCode "
33 				"(according to driver)\n",
34 				sta_id, priv->stations[sta_id].sta.sta.addr);
35 	} else {
36 		priv->stations[sta_id].used |= IWL_STA_UCODE_ACTIVE;
37 		IWL_DEBUG_ASSOC(priv, "Added STA id %u addr %pM to uCode\n",
38 				sta_id, priv->stations[sta_id].sta.sta.addr);
39 	}
40 	return 0;
41 }
42 
43 static void iwl_process_add_sta_resp(struct iwl_priv *priv,
44 				     struct iwl_rx_packet *pkt)
45 {
46 	struct iwl_add_sta_resp *add_sta_resp = (void *)pkt->data;
47 
48 	IWL_DEBUG_INFO(priv, "Processing response for adding station\n");
49 
50 	spin_lock_bh(&priv->sta_lock);
51 
52 	switch (add_sta_resp->status) {
53 	case ADD_STA_SUCCESS_MSK:
54 		IWL_DEBUG_INFO(priv, "REPLY_ADD_STA PASSED\n");
55 		break;
56 	case ADD_STA_NO_ROOM_IN_TABLE:
57 		IWL_ERR(priv, "Adding station failed, no room in table.\n");
58 		break;
59 	case ADD_STA_NO_BLOCK_ACK_RESOURCE:
60 		IWL_ERR(priv,
61 			"Adding station failed, no block ack resource.\n");
62 		break;
63 	case ADD_STA_MODIFY_NON_EXIST_STA:
64 		IWL_ERR(priv, "Attempting to modify non-existing station\n");
65 		break;
66 	default:
67 		IWL_DEBUG_ASSOC(priv, "Received REPLY_ADD_STA:(0x%08X)\n",
68 				add_sta_resp->status);
69 		break;
70 	}
71 
72 	spin_unlock_bh(&priv->sta_lock);
73 }
74 
75 void iwl_add_sta_callback(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb)
76 {
77 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
78 
79 	iwl_process_add_sta_resp(priv, pkt);
80 }
81 
82 int iwl_send_add_sta(struct iwl_priv *priv,
83 		     struct iwl_addsta_cmd *sta, u8 flags)
84 {
85 	int ret = 0;
86 	struct iwl_host_cmd cmd = {
87 		.id = REPLY_ADD_STA,
88 		.flags = flags,
89 		.data = { sta, },
90 		.len = { sizeof(*sta), },
91 	};
92 	u8 sta_id __maybe_unused = sta->sta.sta_id;
93 	struct iwl_rx_packet *pkt;
94 	struct iwl_add_sta_resp *add_sta_resp;
95 
96 	IWL_DEBUG_INFO(priv, "Adding sta %u (%pM) %ssynchronously\n",
97 		       sta_id, sta->sta.addr, flags & CMD_ASYNC ?  "a" : "");
98 
99 	if (!(flags & CMD_ASYNC)) {
100 		cmd.flags |= CMD_WANT_SKB;
101 		might_sleep();
102 	}
103 
104 	ret = iwl_dvm_send_cmd(priv, &cmd);
105 
106 	if (ret || (flags & CMD_ASYNC))
107 		return ret;
108 
109 	pkt = cmd.resp_pkt;
110 	add_sta_resp = (void *)pkt->data;
111 
112 	/* debug messages are printed in the handler */
113 	if (add_sta_resp->status == ADD_STA_SUCCESS_MSK) {
114 		spin_lock_bh(&priv->sta_lock);
115 		ret = iwl_sta_ucode_activate(priv, sta_id);
116 		spin_unlock_bh(&priv->sta_lock);
117 	} else {
118 		ret = -EIO;
119 	}
120 
121 	iwl_free_resp(&cmd);
122 
123 	return ret;
124 }
125 
126 bool iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
127 			    struct iwl_rxon_context *ctx,
128 			    struct ieee80211_sta *sta)
129 {
130 	if (!ctx->ht.enabled || !ctx->ht.is_40mhz)
131 		return false;
132 
133 #ifdef CONFIG_IWLWIFI_DEBUGFS
134 	if (priv->disable_ht40)
135 		return false;
136 #endif
137 
138 	/* special case for RXON */
139 	if (!sta)
140 		return true;
141 
142 	return sta->deflink.bandwidth >= IEEE80211_STA_RX_BW_40;
143 }
144 
145 static void iwl_sta_calc_ht_flags(struct iwl_priv *priv,
146 				  struct ieee80211_sta *sta,
147 				  struct iwl_rxon_context *ctx,
148 				  __le32 *flags, __le32 *mask)
149 {
150 	struct ieee80211_sta_ht_cap *sta_ht_inf = &sta->deflink.ht_cap;
151 
152 	*mask = STA_FLG_RTS_MIMO_PROT_MSK |
153 		STA_FLG_MIMO_DIS_MSK |
154 		STA_FLG_HT40_EN_MSK |
155 		STA_FLG_MAX_AGG_SIZE_MSK |
156 		STA_FLG_AGG_MPDU_DENSITY_MSK;
157 	*flags = 0;
158 
159 	if (!sta || !sta_ht_inf->ht_supported)
160 		return;
161 
162 	IWL_DEBUG_INFO(priv, "STA %pM SM PS mode: %s\n",
163 			sta->addr,
164 			(sta->deflink.smps_mode == IEEE80211_SMPS_STATIC) ?
165 			"static" :
166 			(sta->deflink.smps_mode == IEEE80211_SMPS_DYNAMIC) ?
167 			"dynamic" : "disabled");
168 
169 	switch (sta->deflink.smps_mode) {
170 	case IEEE80211_SMPS_STATIC:
171 		*flags |= STA_FLG_MIMO_DIS_MSK;
172 		break;
173 	case IEEE80211_SMPS_DYNAMIC:
174 		*flags |= STA_FLG_RTS_MIMO_PROT_MSK;
175 		break;
176 	case IEEE80211_SMPS_OFF:
177 		break;
178 	default:
179 		IWL_WARN(priv, "Invalid MIMO PS mode %d\n", sta->deflink.smps_mode);
180 		break;
181 	}
182 
183 	*flags |= cpu_to_le32(
184 		(u32)sta_ht_inf->ampdu_factor << STA_FLG_MAX_AGG_SIZE_POS);
185 
186 	*flags |= cpu_to_le32(
187 		(u32)sta_ht_inf->ampdu_density << STA_FLG_AGG_MPDU_DENSITY_POS);
188 
189 	if (iwl_is_ht40_tx_allowed(priv, ctx, sta))
190 		*flags |= STA_FLG_HT40_EN_MSK;
191 }
192 
193 int iwl_sta_update_ht(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
194 		      struct ieee80211_sta *sta)
195 {
196 	u8 sta_id = iwl_sta_id(sta);
197 	__le32 flags, mask;
198 	struct iwl_addsta_cmd cmd;
199 
200 	if (WARN_ON_ONCE(sta_id == IWL_INVALID_STATION))
201 		return -EINVAL;
202 
203 	iwl_sta_calc_ht_flags(priv, sta, ctx, &flags, &mask);
204 
205 	spin_lock_bh(&priv->sta_lock);
206 	priv->stations[sta_id].sta.station_flags &= ~mask;
207 	priv->stations[sta_id].sta.station_flags |= flags;
208 	spin_unlock_bh(&priv->sta_lock);
209 
210 	memset(&cmd, 0, sizeof(cmd));
211 	cmd.mode = STA_CONTROL_MODIFY_MSK;
212 	cmd.station_flags_msk = mask;
213 	cmd.station_flags = flags;
214 	cmd.sta.sta_id = sta_id;
215 
216 	return iwl_send_add_sta(priv, &cmd, 0);
217 }
218 
219 static void iwl_set_ht_add_station(struct iwl_priv *priv, u8 index,
220 				   struct ieee80211_sta *sta,
221 				   struct iwl_rxon_context *ctx)
222 {
223 	__le32 flags, mask;
224 
225 	iwl_sta_calc_ht_flags(priv, sta, ctx, &flags, &mask);
226 
227 	lockdep_assert_held(&priv->sta_lock);
228 	priv->stations[index].sta.station_flags &= ~mask;
229 	priv->stations[index].sta.station_flags |= flags;
230 }
231 
232 /*
233  * iwl_prep_station - Prepare station information for addition
234  *
235  * should be called with sta_lock held
236  */
237 u8 iwl_prep_station(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
238 		    const u8 *addr, bool is_ap, struct ieee80211_sta *sta)
239 {
240 	struct iwl_station_entry *station;
241 	int i;
242 	u8 sta_id = IWL_INVALID_STATION;
243 
244 	if (is_ap)
245 		sta_id = ctx->ap_sta_id;
246 	else if (is_broadcast_ether_addr(addr))
247 		sta_id = ctx->bcast_sta_id;
248 	else
249 		for (i = IWL_STA_ID; i < IWLAGN_STATION_COUNT; i++) {
250 			if (ether_addr_equal(priv->stations[i].sta.sta.addr,
251 					     addr)) {
252 				sta_id = i;
253 				break;
254 			}
255 
256 			if (!priv->stations[i].used &&
257 			    sta_id == IWL_INVALID_STATION)
258 				sta_id = i;
259 		}
260 
261 	/*
262 	 * These two conditions have the same outcome, but keep them
263 	 * separate
264 	 */
265 	if (unlikely(sta_id == IWL_INVALID_STATION))
266 		return sta_id;
267 
268 	/*
269 	 * uCode is not able to deal with multiple requests to add a
270 	 * station. Keep track if one is in progress so that we do not send
271 	 * another.
272 	 */
273 	if (priv->stations[sta_id].used & IWL_STA_UCODE_INPROGRESS) {
274 		IWL_DEBUG_INFO(priv, "STA %d already in process of being "
275 			       "added.\n", sta_id);
276 		return sta_id;
277 	}
278 
279 	if ((priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE) &&
280 	    (priv->stations[sta_id].used & IWL_STA_UCODE_ACTIVE) &&
281 	    ether_addr_equal(priv->stations[sta_id].sta.sta.addr, addr)) {
282 		IWL_DEBUG_ASSOC(priv, "STA %d (%pM) already added, not "
283 				"adding again.\n", sta_id, addr);
284 		return sta_id;
285 	}
286 
287 	station = &priv->stations[sta_id];
288 	station->used = IWL_STA_DRIVER_ACTIVE;
289 	IWL_DEBUG_ASSOC(priv, "Add STA to driver ID %d: %pM\n",
290 			sta_id, addr);
291 	priv->num_stations++;
292 
293 	/* Set up the REPLY_ADD_STA command to send to device */
294 	memset(&station->sta, 0, sizeof(struct iwl_addsta_cmd));
295 	memcpy(station->sta.sta.addr, addr, ETH_ALEN);
296 	station->sta.mode = 0;
297 	station->sta.sta.sta_id = sta_id;
298 	station->sta.station_flags = ctx->station_flags;
299 	station->ctxid = ctx->ctxid;
300 
301 	if (sta) {
302 		struct iwl_station_priv *sta_priv;
303 
304 		sta_priv = (void *)sta->drv_priv;
305 		sta_priv->ctx = ctx;
306 	}
307 
308 	/*
309 	 * OK to call unconditionally, since local stations (IBSS BSSID
310 	 * STA and broadcast STA) pass in a NULL sta, and mac80211
311 	 * doesn't allow HT IBSS.
312 	 */
313 	iwl_set_ht_add_station(priv, sta_id, sta, ctx);
314 
315 	return sta_id;
316 
317 }
318 
319 #define STA_WAIT_TIMEOUT (HZ/2)
320 
321 /*
322  * iwl_add_station_common -
323  */
324 int iwl_add_station_common(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
325 			   const u8 *addr, bool is_ap,
326 			   struct ieee80211_sta *sta, u8 *sta_id_r)
327 {
328 	int ret = 0;
329 	u8 sta_id;
330 	struct iwl_addsta_cmd sta_cmd;
331 
332 	*sta_id_r = 0;
333 	spin_lock_bh(&priv->sta_lock);
334 	sta_id = iwl_prep_station(priv, ctx, addr, is_ap, sta);
335 	if (sta_id == IWL_INVALID_STATION) {
336 		IWL_ERR(priv, "Unable to prepare station %pM for addition\n",
337 			addr);
338 		spin_unlock_bh(&priv->sta_lock);
339 		return -EINVAL;
340 	}
341 
342 	/*
343 	 * uCode is not able to deal with multiple requests to add a
344 	 * station. Keep track if one is in progress so that we do not send
345 	 * another.
346 	 */
347 	if (priv->stations[sta_id].used & IWL_STA_UCODE_INPROGRESS) {
348 		IWL_DEBUG_INFO(priv, "STA %d already in process of being "
349 			       "added.\n", sta_id);
350 		spin_unlock_bh(&priv->sta_lock);
351 		return -EEXIST;
352 	}
353 
354 	if ((priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE) &&
355 	    (priv->stations[sta_id].used & IWL_STA_UCODE_ACTIVE)) {
356 		IWL_DEBUG_ASSOC(priv, "STA %d (%pM) already added, not "
357 				"adding again.\n", sta_id, addr);
358 		spin_unlock_bh(&priv->sta_lock);
359 		return -EEXIST;
360 	}
361 
362 	priv->stations[sta_id].used |= IWL_STA_UCODE_INPROGRESS;
363 	memcpy(&sta_cmd, &priv->stations[sta_id].sta,
364 	       sizeof(struct iwl_addsta_cmd));
365 	spin_unlock_bh(&priv->sta_lock);
366 
367 	/* Add station to device's station table */
368 	ret = iwl_send_add_sta(priv, &sta_cmd, 0);
369 	if (ret) {
370 		spin_lock_bh(&priv->sta_lock);
371 		IWL_ERR(priv, "Adding station %pM failed.\n",
372 			priv->stations[sta_id].sta.sta.addr);
373 		priv->stations[sta_id].used &= ~IWL_STA_DRIVER_ACTIVE;
374 		priv->stations[sta_id].used &= ~IWL_STA_UCODE_INPROGRESS;
375 		spin_unlock_bh(&priv->sta_lock);
376 	}
377 	*sta_id_r = sta_id;
378 	return ret;
379 }
380 
381 /*
382  * iwl_sta_ucode_deactivate - deactivate ucode status for a station
383  */
384 static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, u8 sta_id)
385 {
386 	lockdep_assert_held(&priv->sta_lock);
387 
388 	/* Ucode must be active and driver must be non active */
389 	if ((priv->stations[sta_id].used &
390 	     (IWL_STA_UCODE_ACTIVE | IWL_STA_DRIVER_ACTIVE)) !=
391 	      IWL_STA_UCODE_ACTIVE)
392 		IWL_ERR(priv, "removed non active STA %u\n", sta_id);
393 
394 	priv->stations[sta_id].used &= ~IWL_STA_UCODE_ACTIVE;
395 
396 	memset(&priv->stations[sta_id], 0, sizeof(struct iwl_station_entry));
397 	IWL_DEBUG_ASSOC(priv, "Removed STA %u\n", sta_id);
398 }
399 
400 static int iwl_send_remove_station(struct iwl_priv *priv,
401 				   const u8 *addr, int sta_id,
402 				   bool temporary)
403 {
404 	struct iwl_rx_packet *pkt;
405 	int ret;
406 	struct iwl_rem_sta_cmd rm_sta_cmd;
407 	struct iwl_rem_sta_resp *rem_sta_resp;
408 
409 	struct iwl_host_cmd cmd = {
410 		.id = REPLY_REMOVE_STA,
411 		.len = { sizeof(struct iwl_rem_sta_cmd), },
412 		.data = { &rm_sta_cmd, },
413 	};
414 
415 	memset(&rm_sta_cmd, 0, sizeof(rm_sta_cmd));
416 	rm_sta_cmd.num_sta = 1;
417 	memcpy(&rm_sta_cmd.addr, addr, ETH_ALEN);
418 
419 	cmd.flags |= CMD_WANT_SKB;
420 
421 	ret = iwl_dvm_send_cmd(priv, &cmd);
422 
423 	if (ret)
424 		return ret;
425 
426 	pkt = cmd.resp_pkt;
427 	rem_sta_resp = (void *)pkt->data;
428 
429 	switch (rem_sta_resp->status) {
430 	case REM_STA_SUCCESS_MSK:
431 		if (!temporary) {
432 			spin_lock_bh(&priv->sta_lock);
433 			iwl_sta_ucode_deactivate(priv, sta_id);
434 			spin_unlock_bh(&priv->sta_lock);
435 		}
436 		IWL_DEBUG_ASSOC(priv, "REPLY_REMOVE_STA PASSED\n");
437 		break;
438 	default:
439 		ret = -EIO;
440 		IWL_ERR(priv, "REPLY_REMOVE_STA failed\n");
441 		break;
442 	}
443 
444 	iwl_free_resp(&cmd);
445 
446 	return ret;
447 }
448 
449 /*
450  * iwl_remove_station - Remove driver's knowledge of station.
451  */
452 int iwl_remove_station(struct iwl_priv *priv, const u8 sta_id,
453 		       const u8 *addr)
454 {
455 	u8 tid;
456 
457 	if (!iwl_is_ready(priv)) {
458 		IWL_DEBUG_INFO(priv,
459 			"Unable to remove station %pM, device not ready.\n",
460 			addr);
461 		/*
462 		 * It is typical for stations to be removed when we are
463 		 * going down. Return success since device will be down
464 		 * soon anyway
465 		 */
466 		return 0;
467 	}
468 
469 	IWL_DEBUG_ASSOC(priv, "Removing STA from driver:%d  %pM\n",
470 			sta_id, addr);
471 
472 	if (WARN_ON(sta_id == IWL_INVALID_STATION))
473 		return -EINVAL;
474 
475 	spin_lock_bh(&priv->sta_lock);
476 
477 	if (!(priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE)) {
478 		IWL_DEBUG_INFO(priv, "Removing %pM but non DRIVER active\n",
479 				addr);
480 		goto out_err;
481 	}
482 
483 	if (!(priv->stations[sta_id].used & IWL_STA_UCODE_ACTIVE)) {
484 		IWL_DEBUG_INFO(priv, "Removing %pM but non UCODE active\n",
485 				addr);
486 		goto out_err;
487 	}
488 
489 	if (priv->stations[sta_id].used & IWL_STA_LOCAL) {
490 		kfree(priv->stations[sta_id].lq);
491 		priv->stations[sta_id].lq = NULL;
492 	}
493 
494 	for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++)
495 		memset(&priv->tid_data[sta_id][tid], 0,
496 			sizeof(priv->tid_data[sta_id][tid]));
497 
498 	priv->stations[sta_id].used &= ~IWL_STA_DRIVER_ACTIVE;
499 
500 	priv->num_stations--;
501 
502 	if (WARN_ON(priv->num_stations < 0))
503 		priv->num_stations = 0;
504 
505 	spin_unlock_bh(&priv->sta_lock);
506 
507 	return iwl_send_remove_station(priv, addr, sta_id, false);
508 out_err:
509 	spin_unlock_bh(&priv->sta_lock);
510 	return -EINVAL;
511 }
512 
513 void iwl_deactivate_station(struct iwl_priv *priv, const u8 sta_id,
514 			    const u8 *addr)
515 {
516 	u8 tid;
517 
518 	if (!iwl_is_ready(priv)) {
519 		IWL_DEBUG_INFO(priv,
520 			"Unable to remove station %pM, device not ready.\n",
521 			addr);
522 		return;
523 	}
524 
525 	IWL_DEBUG_ASSOC(priv, "Deactivating STA: %pM (%d)\n", addr, sta_id);
526 
527 	if (WARN_ON_ONCE(sta_id == IWL_INVALID_STATION))
528 		return;
529 
530 	spin_lock_bh(&priv->sta_lock);
531 
532 	WARN_ON_ONCE(!(priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE));
533 
534 	for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++)
535 		memset(&priv->tid_data[sta_id][tid], 0,
536 			sizeof(priv->tid_data[sta_id][tid]));
537 
538 	priv->stations[sta_id].used &= ~IWL_STA_DRIVER_ACTIVE;
539 	priv->stations[sta_id].used &= ~IWL_STA_UCODE_INPROGRESS;
540 
541 	priv->num_stations--;
542 
543 	if (WARN_ON_ONCE(priv->num_stations < 0))
544 		priv->num_stations = 0;
545 
546 	spin_unlock_bh(&priv->sta_lock);
547 }
548 
549 static void iwl_sta_fill_lq(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
550 			    u8 sta_id, struct iwl_link_quality_cmd *link_cmd)
551 {
552 	int i, r;
553 	u32 rate_flags = 0;
554 	__le32 rate_n_flags;
555 
556 	lockdep_assert_held(&priv->mutex);
557 
558 	memset(link_cmd, 0, sizeof(*link_cmd));
559 
560 	/* Set up the rate scaling to start at selected rate, fall back
561 	 * all the way down to 1M in IEEE order, and then spin on 1M */
562 	if (priv->band == NL80211_BAND_5GHZ)
563 		r = IWL_RATE_6M_INDEX;
564 	else if (ctx && ctx->vif && ctx->vif->p2p)
565 		r = IWL_RATE_6M_INDEX;
566 	else
567 		r = IWL_RATE_1M_INDEX;
568 
569 	if (r >= IWL_FIRST_CCK_RATE && r <= IWL_LAST_CCK_RATE)
570 		rate_flags |= RATE_MCS_CCK_MSK;
571 
572 	rate_flags |= first_antenna(priv->nvm_data->valid_tx_ant) <<
573 				RATE_MCS_ANT_POS;
574 	rate_n_flags = iwl_hw_set_rate_n_flags(iwl_rates[r].plcp, rate_flags);
575 	for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++)
576 		link_cmd->rs_table[i].rate_n_flags = rate_n_flags;
577 
578 	link_cmd->general_params.single_stream_ant_msk =
579 			first_antenna(priv->nvm_data->valid_tx_ant);
580 
581 	link_cmd->general_params.dual_stream_ant_msk =
582 		priv->nvm_data->valid_tx_ant &
583 		~first_antenna(priv->nvm_data->valid_tx_ant);
584 	if (!link_cmd->general_params.dual_stream_ant_msk) {
585 		link_cmd->general_params.dual_stream_ant_msk = ANT_AB;
586 	} else if (num_of_ant(priv->nvm_data->valid_tx_ant) == 2) {
587 		link_cmd->general_params.dual_stream_ant_msk =
588 			priv->nvm_data->valid_tx_ant;
589 	}
590 
591 	link_cmd->agg_params.agg_dis_start_th =
592 		LINK_QUAL_AGG_DISABLE_START_DEF;
593 	link_cmd->agg_params.agg_time_limit =
594 		cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
595 
596 	link_cmd->sta_id = sta_id;
597 }
598 
599 /*
600  * iwl_clear_ucode_stations - clear ucode station table bits
601  *
602  * This function clears all the bits in the driver indicating
603  * which stations are active in the ucode. Call when something
604  * other than explicit station management would cause this in
605  * the ucode, e.g. unassociated RXON.
606  */
607 void iwl_clear_ucode_stations(struct iwl_priv *priv,
608 			      struct iwl_rxon_context *ctx)
609 {
610 	int i;
611 	bool cleared = false;
612 
613 	IWL_DEBUG_INFO(priv, "Clearing ucode stations in driver\n");
614 
615 	spin_lock_bh(&priv->sta_lock);
616 	for (i = 0; i < IWLAGN_STATION_COUNT; i++) {
617 		if (ctx && ctx->ctxid != priv->stations[i].ctxid)
618 			continue;
619 
620 		if (priv->stations[i].used & IWL_STA_UCODE_ACTIVE) {
621 			IWL_DEBUG_INFO(priv,
622 				"Clearing ucode active for station %d\n", i);
623 			priv->stations[i].used &= ~IWL_STA_UCODE_ACTIVE;
624 			cleared = true;
625 		}
626 	}
627 	spin_unlock_bh(&priv->sta_lock);
628 
629 	if (!cleared)
630 		IWL_DEBUG_INFO(priv,
631 			       "No active stations found to be cleared\n");
632 }
633 
634 /*
635  * iwl_restore_stations() - Restore driver known stations to device
636  *
637  * All stations considered active by driver, but not present in ucode, is
638  * restored.
639  *
640  * Function sleeps.
641  */
642 void iwl_restore_stations(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
643 {
644 	struct iwl_addsta_cmd sta_cmd;
645 	static const struct iwl_link_quality_cmd zero_lq = {};
646 	struct iwl_link_quality_cmd lq;
647 	int i;
648 	bool found = false;
649 	int ret;
650 	bool send_lq;
651 
652 	if (!iwl_is_ready(priv)) {
653 		IWL_DEBUG_INFO(priv,
654 			       "Not ready yet, not restoring any stations.\n");
655 		return;
656 	}
657 
658 	IWL_DEBUG_ASSOC(priv, "Restoring all known stations ... start.\n");
659 	spin_lock_bh(&priv->sta_lock);
660 	for (i = 0; i < IWLAGN_STATION_COUNT; i++) {
661 		if (ctx->ctxid != priv->stations[i].ctxid)
662 			continue;
663 		if ((priv->stations[i].used & IWL_STA_DRIVER_ACTIVE) &&
664 			    !(priv->stations[i].used & IWL_STA_UCODE_ACTIVE)) {
665 			IWL_DEBUG_ASSOC(priv, "Restoring sta %pM\n",
666 					priv->stations[i].sta.sta.addr);
667 			priv->stations[i].sta.mode = 0;
668 			priv->stations[i].used |= IWL_STA_UCODE_INPROGRESS;
669 			found = true;
670 		}
671 	}
672 
673 	for (i = 0; i < IWLAGN_STATION_COUNT; i++) {
674 		if ((priv->stations[i].used & IWL_STA_UCODE_INPROGRESS)) {
675 			memcpy(&sta_cmd, &priv->stations[i].sta,
676 			       sizeof(struct iwl_addsta_cmd));
677 			send_lq = false;
678 			if (priv->stations[i].lq) {
679 				if (priv->wowlan)
680 					iwl_sta_fill_lq(priv, ctx, i, &lq);
681 				else
682 					memcpy(&lq, priv->stations[i].lq,
683 					       sizeof(struct iwl_link_quality_cmd));
684 
685 				if (memcmp(&lq, &zero_lq, sizeof(lq)))
686 					send_lq = true;
687 			}
688 			spin_unlock_bh(&priv->sta_lock);
689 			ret = iwl_send_add_sta(priv, &sta_cmd, 0);
690 			if (ret) {
691 				spin_lock_bh(&priv->sta_lock);
692 				IWL_ERR(priv, "Adding station %pM failed.\n",
693 					priv->stations[i].sta.sta.addr);
694 				priv->stations[i].used &=
695 						~IWL_STA_DRIVER_ACTIVE;
696 				priv->stations[i].used &=
697 						~IWL_STA_UCODE_INPROGRESS;
698 				continue;
699 			}
700 			/*
701 			 * Rate scaling has already been initialized, send
702 			 * current LQ command
703 			 */
704 			if (send_lq)
705 				iwl_send_lq_cmd(priv, ctx, &lq, 0, true);
706 			spin_lock_bh(&priv->sta_lock);
707 			priv->stations[i].used &= ~IWL_STA_UCODE_INPROGRESS;
708 		}
709 	}
710 
711 	spin_unlock_bh(&priv->sta_lock);
712 	if (!found)
713 		IWL_DEBUG_INFO(priv, "Restoring all known stations .... "
714 			"no stations to be restored.\n");
715 	else
716 		IWL_DEBUG_INFO(priv, "Restoring all known stations .... "
717 			"complete.\n");
718 }
719 
720 int iwl_get_free_ucode_key_offset(struct iwl_priv *priv)
721 {
722 	int i;
723 
724 	for (i = 0; i < priv->sta_key_max_num; i++)
725 		if (!test_and_set_bit(i, &priv->ucode_key_table))
726 			return i;
727 
728 	return WEP_INVALID_OFFSET;
729 }
730 
731 void iwl_dealloc_bcast_stations(struct iwl_priv *priv)
732 {
733 	int i;
734 
735 	spin_lock_bh(&priv->sta_lock);
736 	for (i = 0; i < IWLAGN_STATION_COUNT; i++) {
737 		if (!(priv->stations[i].used & IWL_STA_BCAST))
738 			continue;
739 
740 		priv->stations[i].used &= ~IWL_STA_UCODE_ACTIVE;
741 		priv->num_stations--;
742 		if (WARN_ON(priv->num_stations < 0))
743 			priv->num_stations = 0;
744 		kfree(priv->stations[i].lq);
745 		priv->stations[i].lq = NULL;
746 	}
747 	spin_unlock_bh(&priv->sta_lock);
748 }
749 
750 #ifdef CONFIG_IWLWIFI_DEBUG
751 static void iwl_dump_lq_cmd(struct iwl_priv *priv,
752 			   struct iwl_link_quality_cmd *lq)
753 {
754 	int i;
755 	IWL_DEBUG_RATE(priv, "lq station id 0x%x\n", lq->sta_id);
756 	IWL_DEBUG_RATE(priv, "lq ant 0x%X 0x%X\n",
757 		       lq->general_params.single_stream_ant_msk,
758 		       lq->general_params.dual_stream_ant_msk);
759 
760 	for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++)
761 		IWL_DEBUG_RATE(priv, "lq index %d 0x%X\n",
762 			       i, lq->rs_table[i].rate_n_flags);
763 }
764 #else
765 static inline void iwl_dump_lq_cmd(struct iwl_priv *priv,
766 				   struct iwl_link_quality_cmd *lq)
767 {
768 }
769 #endif
770 
771 /*
772  * is_lq_table_valid() - Test one aspect of LQ cmd for validity
773  *
774  * It sometimes happens when a HT rate has been in use and we
775  * loose connectivity with AP then mac80211 will first tell us that the
776  * current channel is not HT anymore before removing the station. In such a
777  * scenario the RXON flags will be updated to indicate we are not
778  * communicating HT anymore, but the LQ command may still contain HT rates.
779  * Test for this to prevent driver from sending LQ command between the time
780  * RXON flags are updated and when LQ command is updated.
781  */
782 static bool is_lq_table_valid(struct iwl_priv *priv,
783 			      struct iwl_rxon_context *ctx,
784 			      struct iwl_link_quality_cmd *lq)
785 {
786 	int i;
787 
788 	if (ctx->ht.enabled)
789 		return true;
790 
791 	IWL_DEBUG_INFO(priv, "Channel %u is not an HT channel\n",
792 		       ctx->active.channel);
793 	for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
794 		if (le32_to_cpu(lq->rs_table[i].rate_n_flags) &
795 		    RATE_MCS_HT_MSK) {
796 			IWL_DEBUG_INFO(priv,
797 				       "index %d of LQ expects HT channel\n",
798 				       i);
799 			return false;
800 		}
801 	}
802 	return true;
803 }
804 
805 /*
806  * iwl_send_lq_cmd() - Send link quality command
807  * @init: This command is sent as part of station initialization right
808  *        after station has been added.
809  *
810  * The link quality command is sent as the last step of station creation.
811  * This is the special case in which init is set and we call a callback in
812  * this case to clear the state indicating that station creation is in
813  * progress.
814  */
815 int iwl_send_lq_cmd(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
816 		    struct iwl_link_quality_cmd *lq, u8 flags, bool init)
817 {
818 	int ret = 0;
819 	struct iwl_host_cmd cmd = {
820 		.id = REPLY_TX_LINK_QUALITY_CMD,
821 		.len = { sizeof(struct iwl_link_quality_cmd), },
822 		.flags = flags,
823 		.data = { lq, },
824 	};
825 
826 	if (WARN_ON(lq->sta_id == IWL_INVALID_STATION))
827 		return -EINVAL;
828 
829 
830 	spin_lock_bh(&priv->sta_lock);
831 	if (!(priv->stations[lq->sta_id].used & IWL_STA_DRIVER_ACTIVE)) {
832 		spin_unlock_bh(&priv->sta_lock);
833 		return -EINVAL;
834 	}
835 	spin_unlock_bh(&priv->sta_lock);
836 
837 	iwl_dump_lq_cmd(priv, lq);
838 	if (WARN_ON(init && (cmd.flags & CMD_ASYNC)))
839 		return -EINVAL;
840 
841 	if (is_lq_table_valid(priv, ctx, lq))
842 		ret = iwl_dvm_send_cmd(priv, &cmd);
843 	else
844 		ret = -EINVAL;
845 
846 	if (cmd.flags & CMD_ASYNC)
847 		return ret;
848 
849 	if (init) {
850 		IWL_DEBUG_INFO(priv, "init LQ command complete, "
851 			       "clearing sta addition status for sta %d\n",
852 			       lq->sta_id);
853 		spin_lock_bh(&priv->sta_lock);
854 		priv->stations[lq->sta_id].used &= ~IWL_STA_UCODE_INPROGRESS;
855 		spin_unlock_bh(&priv->sta_lock);
856 	}
857 	return ret;
858 }
859 
860 
861 static struct iwl_link_quality_cmd *
862 iwl_sta_alloc_lq(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
863 		 u8 sta_id)
864 {
865 	struct iwl_link_quality_cmd *link_cmd;
866 
867 	link_cmd = kzalloc(sizeof(struct iwl_link_quality_cmd), GFP_KERNEL);
868 	if (!link_cmd) {
869 		IWL_ERR(priv, "Unable to allocate memory for LQ cmd.\n");
870 		return NULL;
871 	}
872 
873 	iwl_sta_fill_lq(priv, ctx, sta_id, link_cmd);
874 
875 	return link_cmd;
876 }
877 
878 /*
879  * iwlagn_add_bssid_station - Add the special IBSS BSSID station
880  *
881  * Function sleeps.
882  */
883 int iwlagn_add_bssid_station(struct iwl_priv *priv,
884 			     struct iwl_rxon_context *ctx,
885 			     const u8 *addr, u8 *sta_id_r)
886 {
887 	int ret;
888 	u8 sta_id;
889 	struct iwl_link_quality_cmd *link_cmd;
890 
891 	if (sta_id_r)
892 		*sta_id_r = IWL_INVALID_STATION;
893 
894 	ret = iwl_add_station_common(priv, ctx, addr, 0, NULL, &sta_id);
895 	if (ret) {
896 		IWL_ERR(priv, "Unable to add station %pM\n", addr);
897 		return ret;
898 	}
899 
900 	if (sta_id_r)
901 		*sta_id_r = sta_id;
902 
903 	spin_lock_bh(&priv->sta_lock);
904 	priv->stations[sta_id].used |= IWL_STA_LOCAL;
905 	spin_unlock_bh(&priv->sta_lock);
906 
907 	/* Set up default rate scaling table in device's station table */
908 	link_cmd = iwl_sta_alloc_lq(priv, ctx, sta_id);
909 	if (!link_cmd) {
910 		IWL_ERR(priv,
911 			"Unable to initialize rate scaling for station %pM.\n",
912 			addr);
913 		return -ENOMEM;
914 	}
915 
916 	ret = iwl_send_lq_cmd(priv, ctx, link_cmd, 0, true);
917 	if (ret)
918 		IWL_ERR(priv, "Link quality command failed (%d)\n", ret);
919 
920 	spin_lock_bh(&priv->sta_lock);
921 	priv->stations[sta_id].lq = link_cmd;
922 	spin_unlock_bh(&priv->sta_lock);
923 
924 	return 0;
925 }
926 
927 /*
928  * static WEP keys
929  *
930  * For each context, the device has a table of 4 static WEP keys
931  * (one for each key index) that is updated with the following
932  * commands.
933  */
934 
935 static int iwl_send_static_wepkey_cmd(struct iwl_priv *priv,
936 				      struct iwl_rxon_context *ctx,
937 				      bool send_if_empty)
938 {
939 	int i, not_empty = 0;
940 	u8 buff[sizeof(struct iwl_wep_cmd) +
941 		sizeof(struct iwl_wep_key) * WEP_KEYS_MAX];
942 	struct iwl_wep_cmd *wep_cmd = (struct iwl_wep_cmd *)buff;
943 	size_t cmd_size  = sizeof(struct iwl_wep_cmd);
944 	struct iwl_host_cmd cmd = {
945 		.id = ctx->wep_key_cmd,
946 		.data = { wep_cmd, },
947 	};
948 
949 	might_sleep();
950 
951 	memset(wep_cmd, 0, cmd_size +
952 			(sizeof(struct iwl_wep_key) * WEP_KEYS_MAX));
953 
954 	for (i = 0; i < WEP_KEYS_MAX ; i++) {
955 		wep_cmd->key[i].key_index = i;
956 		if (ctx->wep_keys[i].key_size) {
957 			wep_cmd->key[i].key_offset = i;
958 			not_empty = 1;
959 		} else {
960 			wep_cmd->key[i].key_offset = WEP_INVALID_OFFSET;
961 		}
962 
963 		wep_cmd->key[i].key_size = ctx->wep_keys[i].key_size;
964 		memcpy(&wep_cmd->key[i].key[3], ctx->wep_keys[i].key,
965 				ctx->wep_keys[i].key_size);
966 	}
967 
968 	wep_cmd->global_key_type = WEP_KEY_WEP_TYPE;
969 	wep_cmd->num_keys = WEP_KEYS_MAX;
970 
971 	cmd_size += sizeof(struct iwl_wep_key) * WEP_KEYS_MAX;
972 
973 	cmd.len[0] = cmd_size;
974 
975 	if (not_empty || send_if_empty)
976 		return iwl_dvm_send_cmd(priv, &cmd);
977 	else
978 		return 0;
979 }
980 
981 int iwl_restore_default_wep_keys(struct iwl_priv *priv,
982 				 struct iwl_rxon_context *ctx)
983 {
984 	lockdep_assert_held(&priv->mutex);
985 
986 	return iwl_send_static_wepkey_cmd(priv, ctx, false);
987 }
988 
989 int iwl_remove_default_wep_key(struct iwl_priv *priv,
990 			       struct iwl_rxon_context *ctx,
991 			       struct ieee80211_key_conf *keyconf)
992 {
993 	int ret;
994 
995 	lockdep_assert_held(&priv->mutex);
996 
997 	IWL_DEBUG_WEP(priv, "Removing default WEP key: idx=%d\n",
998 		      keyconf->keyidx);
999 
1000 	memset(&ctx->wep_keys[keyconf->keyidx], 0, sizeof(ctx->wep_keys[0]));
1001 	if (iwl_is_rfkill(priv)) {
1002 		IWL_DEBUG_WEP(priv,
1003 			"Not sending REPLY_WEPKEY command due to RFKILL.\n");
1004 		/* but keys in device are clear anyway so return success */
1005 		return 0;
1006 	}
1007 	ret = iwl_send_static_wepkey_cmd(priv, ctx, 1);
1008 	IWL_DEBUG_WEP(priv, "Remove default WEP key: idx=%d ret=%d\n",
1009 		      keyconf->keyidx, ret);
1010 
1011 	return ret;
1012 }
1013 
1014 int iwl_set_default_wep_key(struct iwl_priv *priv,
1015 			    struct iwl_rxon_context *ctx,
1016 			    struct ieee80211_key_conf *keyconf)
1017 {
1018 	int ret;
1019 
1020 	lockdep_assert_held(&priv->mutex);
1021 
1022 	if (keyconf->keylen != WEP_KEY_LEN_128 &&
1023 	    keyconf->keylen != WEP_KEY_LEN_64) {
1024 		IWL_DEBUG_WEP(priv,
1025 			      "Bad WEP key length %d\n", keyconf->keylen);
1026 		return -EINVAL;
1027 	}
1028 
1029 	keyconf->hw_key_idx = IWLAGN_HW_KEY_DEFAULT;
1030 
1031 	ctx->wep_keys[keyconf->keyidx].key_size = keyconf->keylen;
1032 	memcpy(&ctx->wep_keys[keyconf->keyidx].key, &keyconf->key,
1033 							keyconf->keylen);
1034 
1035 	ret = iwl_send_static_wepkey_cmd(priv, ctx, false);
1036 	IWL_DEBUG_WEP(priv, "Set default WEP key: len=%d idx=%d ret=%d\n",
1037 		keyconf->keylen, keyconf->keyidx, ret);
1038 
1039 	return ret;
1040 }
1041 
1042 /*
1043  * dynamic (per-station) keys
1044  *
1045  * The dynamic keys are a little more complicated. The device has
1046  * a key cache of up to STA_KEY_MAX_NUM/STA_KEY_MAX_NUM_PAN keys.
1047  * These are linked to stations by a table that contains an index
1048  * into the key table for each station/key index/{mcast,unicast},
1049  * i.e. it's basically an array of pointers like this:
1050  *	key_offset_t key_mapping[NUM_STATIONS][4][2];
1051  * (it really works differently, but you can think of it as such)
1052  *
1053  * The key uploading and linking happens in the same command, the
1054  * add station command with STA_MODIFY_KEY_MASK.
1055  */
1056 
1057 static u8 iwlagn_key_sta_id(struct iwl_priv *priv,
1058 			    struct ieee80211_vif *vif,
1059 			    struct ieee80211_sta *sta)
1060 {
1061 	struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
1062 
1063 	if (sta)
1064 		return iwl_sta_id(sta);
1065 
1066 	/*
1067 	 * The device expects GTKs for station interfaces to be
1068 	 * installed as GTKs for the AP station. If we have no
1069 	 * station ID, then use the ap_sta_id in that case.
1070 	 */
1071 	if (vif->type == NL80211_IFTYPE_STATION && vif_priv->ctx)
1072 		return vif_priv->ctx->ap_sta_id;
1073 
1074 	return IWL_INVALID_STATION;
1075 }
1076 
1077 static int iwlagn_send_sta_key(struct iwl_priv *priv,
1078 			       struct ieee80211_key_conf *keyconf,
1079 			       u8 sta_id, u32 tkip_iv32, u16 *tkip_p1k,
1080 			       u32 cmd_flags)
1081 {
1082 	__le16 key_flags;
1083 	struct iwl_addsta_cmd sta_cmd;
1084 	int i;
1085 
1086 	spin_lock_bh(&priv->sta_lock);
1087 	memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(sta_cmd));
1088 	spin_unlock_bh(&priv->sta_lock);
1089 
1090 	key_flags = cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
1091 	key_flags |= STA_KEY_FLG_MAP_KEY_MSK;
1092 
1093 	switch (keyconf->cipher) {
1094 	case WLAN_CIPHER_SUITE_CCMP:
1095 		key_flags |= STA_KEY_FLG_CCMP;
1096 		memcpy(sta_cmd.key.key, keyconf->key, keyconf->keylen);
1097 		break;
1098 	case WLAN_CIPHER_SUITE_TKIP:
1099 		key_flags |= STA_KEY_FLG_TKIP;
1100 		sta_cmd.key.tkip_rx_tsc_byte2 = tkip_iv32;
1101 		for (i = 0; i < 5; i++)
1102 			sta_cmd.key.tkip_rx_ttak[i] = cpu_to_le16(tkip_p1k[i]);
1103 		memcpy(sta_cmd.key.key, keyconf->key, keyconf->keylen);
1104 		break;
1105 	case WLAN_CIPHER_SUITE_WEP104:
1106 		key_flags |= STA_KEY_FLG_KEY_SIZE_MSK;
1107 		fallthrough;
1108 	case WLAN_CIPHER_SUITE_WEP40:
1109 		key_flags |= STA_KEY_FLG_WEP;
1110 		memcpy(&sta_cmd.key.key[3], keyconf->key, keyconf->keylen);
1111 		break;
1112 	default:
1113 		WARN_ON(1);
1114 		return -EINVAL;
1115 	}
1116 
1117 	if (!(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE))
1118 		key_flags |= STA_KEY_MULTICAST_MSK;
1119 
1120 	/* key pointer (offset) */
1121 	sta_cmd.key.key_offset = keyconf->hw_key_idx;
1122 
1123 	sta_cmd.key.key_flags = key_flags;
1124 	sta_cmd.mode = STA_CONTROL_MODIFY_MSK;
1125 	sta_cmd.sta.modify_mask = STA_MODIFY_KEY_MASK;
1126 
1127 	return iwl_send_add_sta(priv, &sta_cmd, cmd_flags);
1128 }
1129 
1130 void iwl_update_tkip_key(struct iwl_priv *priv,
1131 			 struct ieee80211_vif *vif,
1132 			 struct ieee80211_key_conf *keyconf,
1133 			 struct ieee80211_sta *sta, u32 iv32, u16 *phase1key)
1134 {
1135 	u8 sta_id = iwlagn_key_sta_id(priv, vif, sta);
1136 
1137 	if (sta_id == IWL_INVALID_STATION)
1138 		return;
1139 
1140 	if (iwl_scan_cancel(priv)) {
1141 		/* cancel scan failed, just live w/ bad key and rely
1142 		   briefly on SW decryption */
1143 		return;
1144 	}
1145 
1146 	iwlagn_send_sta_key(priv, keyconf, sta_id,
1147 			    iv32, phase1key, CMD_ASYNC);
1148 }
1149 
1150 int iwl_remove_dynamic_key(struct iwl_priv *priv,
1151 			   struct iwl_rxon_context *ctx,
1152 			   struct ieee80211_key_conf *keyconf,
1153 			   struct ieee80211_sta *sta)
1154 {
1155 	struct iwl_addsta_cmd sta_cmd;
1156 	u8 sta_id = iwlagn_key_sta_id(priv, ctx->vif, sta);
1157 	__le16 key_flags;
1158 
1159 	/* if station isn't there, neither is the key */
1160 	if (sta_id == IWL_INVALID_STATION)
1161 		return -ENOENT;
1162 
1163 	spin_lock_bh(&priv->sta_lock);
1164 	memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(sta_cmd));
1165 	if (!(priv->stations[sta_id].used & IWL_STA_UCODE_ACTIVE))
1166 		sta_id = IWL_INVALID_STATION;
1167 	spin_unlock_bh(&priv->sta_lock);
1168 
1169 	if (sta_id == IWL_INVALID_STATION)
1170 		return 0;
1171 
1172 	lockdep_assert_held(&priv->mutex);
1173 
1174 	ctx->key_mapping_keys--;
1175 
1176 	IWL_DEBUG_WEP(priv, "Remove dynamic key: idx=%d sta=%d\n",
1177 		      keyconf->keyidx, sta_id);
1178 
1179 	if (!test_and_clear_bit(keyconf->hw_key_idx, &priv->ucode_key_table))
1180 		IWL_ERR(priv, "offset %d not used in uCode key table.\n",
1181 			keyconf->hw_key_idx);
1182 
1183 	key_flags = cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
1184 	key_flags |= STA_KEY_FLG_MAP_KEY_MSK | STA_KEY_FLG_NO_ENC |
1185 		     STA_KEY_FLG_INVALID;
1186 
1187 	if (!(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE))
1188 		key_flags |= STA_KEY_MULTICAST_MSK;
1189 
1190 	sta_cmd.key.key_flags = key_flags;
1191 	sta_cmd.key.key_offset = keyconf->hw_key_idx;
1192 	sta_cmd.sta.modify_mask = STA_MODIFY_KEY_MASK;
1193 	sta_cmd.mode = STA_CONTROL_MODIFY_MSK;
1194 
1195 	return iwl_send_add_sta(priv, &sta_cmd, 0);
1196 }
1197 
1198 int iwl_set_dynamic_key(struct iwl_priv *priv,
1199 			struct iwl_rxon_context *ctx,
1200 			struct ieee80211_key_conf *keyconf,
1201 			struct ieee80211_sta *sta)
1202 {
1203 	struct ieee80211_key_seq seq;
1204 	u16 p1k[5];
1205 	int ret;
1206 	u8 sta_id = iwlagn_key_sta_id(priv, ctx->vif, sta);
1207 	const u8 *addr;
1208 
1209 	if (sta_id == IWL_INVALID_STATION)
1210 		return -EINVAL;
1211 
1212 	lockdep_assert_held(&priv->mutex);
1213 
1214 	keyconf->hw_key_idx = iwl_get_free_ucode_key_offset(priv);
1215 	if (keyconf->hw_key_idx == WEP_INVALID_OFFSET)
1216 		return -ENOSPC;
1217 
1218 	ctx->key_mapping_keys++;
1219 
1220 	switch (keyconf->cipher) {
1221 	case WLAN_CIPHER_SUITE_TKIP:
1222 		if (sta)
1223 			addr = sta->addr;
1224 		else /* station mode case only */
1225 			addr = ctx->active.bssid_addr;
1226 
1227 		/* pre-fill phase 1 key into device cache */
1228 		ieee80211_get_key_rx_seq(keyconf, 0, &seq);
1229 		ieee80211_get_tkip_rx_p1k(keyconf, addr, seq.tkip.iv32, p1k);
1230 		ret = iwlagn_send_sta_key(priv, keyconf, sta_id,
1231 					  seq.tkip.iv32, p1k, 0);
1232 		break;
1233 	case WLAN_CIPHER_SUITE_CCMP:
1234 	case WLAN_CIPHER_SUITE_WEP40:
1235 	case WLAN_CIPHER_SUITE_WEP104:
1236 		ret = iwlagn_send_sta_key(priv, keyconf, sta_id,
1237 					  0, NULL, 0);
1238 		break;
1239 	default:
1240 		IWL_ERR(priv, "Unknown cipher %x\n", keyconf->cipher);
1241 		ret = -EINVAL;
1242 	}
1243 
1244 	if (ret) {
1245 		ctx->key_mapping_keys--;
1246 		clear_bit(keyconf->hw_key_idx, &priv->ucode_key_table);
1247 	}
1248 
1249 	IWL_DEBUG_WEP(priv, "Set dynamic key: cipher=%x len=%d idx=%d sta=%pM ret=%d\n",
1250 		      keyconf->cipher, keyconf->keylen, keyconf->keyidx,
1251 		      sta ? sta->addr : NULL, ret);
1252 
1253 	return ret;
1254 }
1255 
1256 /*
1257  * iwlagn_alloc_bcast_station - add broadcast station into driver's station table.
1258  *
1259  * This adds the broadcast station into the driver's station table
1260  * and marks it driver active, so that it will be restored to the
1261  * device at the next best time.
1262  */
1263 int iwlagn_alloc_bcast_station(struct iwl_priv *priv,
1264 			       struct iwl_rxon_context *ctx)
1265 {
1266 	struct iwl_link_quality_cmd *link_cmd;
1267 	u8 sta_id;
1268 
1269 	spin_lock_bh(&priv->sta_lock);
1270 	sta_id = iwl_prep_station(priv, ctx, iwl_bcast_addr, false, NULL);
1271 	if (sta_id == IWL_INVALID_STATION) {
1272 		IWL_ERR(priv, "Unable to prepare broadcast station\n");
1273 		spin_unlock_bh(&priv->sta_lock);
1274 
1275 		return -EINVAL;
1276 	}
1277 
1278 	priv->stations[sta_id].used |= IWL_STA_DRIVER_ACTIVE;
1279 	priv->stations[sta_id].used |= IWL_STA_BCAST;
1280 	spin_unlock_bh(&priv->sta_lock);
1281 
1282 	link_cmd = iwl_sta_alloc_lq(priv, ctx, sta_id);
1283 	if (!link_cmd) {
1284 		IWL_ERR(priv,
1285 			"Unable to initialize rate scaling for bcast station.\n");
1286 		return -ENOMEM;
1287 	}
1288 
1289 	spin_lock_bh(&priv->sta_lock);
1290 	priv->stations[sta_id].lq = link_cmd;
1291 	spin_unlock_bh(&priv->sta_lock);
1292 
1293 	return 0;
1294 }
1295 
1296 /*
1297  * iwl_update_bcast_station - update broadcast station's LQ command
1298  *
1299  * Only used by iwlagn. Placed here to have all bcast station management
1300  * code together.
1301  */
1302 int iwl_update_bcast_station(struct iwl_priv *priv,
1303 			     struct iwl_rxon_context *ctx)
1304 {
1305 	struct iwl_link_quality_cmd *link_cmd;
1306 	u8 sta_id = ctx->bcast_sta_id;
1307 
1308 	link_cmd = iwl_sta_alloc_lq(priv, ctx, sta_id);
1309 	if (!link_cmd) {
1310 		IWL_ERR(priv, "Unable to initialize rate scaling for bcast station.\n");
1311 		return -ENOMEM;
1312 	}
1313 
1314 	spin_lock_bh(&priv->sta_lock);
1315 	if (priv->stations[sta_id].lq)
1316 		kfree(priv->stations[sta_id].lq);
1317 	else
1318 		IWL_DEBUG_INFO(priv, "Bcast station rate scaling has not been initialized yet.\n");
1319 	priv->stations[sta_id].lq = link_cmd;
1320 	spin_unlock_bh(&priv->sta_lock);
1321 
1322 	return 0;
1323 }
1324 
1325 int iwl_update_bcast_stations(struct iwl_priv *priv)
1326 {
1327 	struct iwl_rxon_context *ctx;
1328 	int ret = 0;
1329 
1330 	for_each_context(priv, ctx) {
1331 		ret = iwl_update_bcast_station(priv, ctx);
1332 		if (ret)
1333 			break;
1334 	}
1335 
1336 	return ret;
1337 }
1338 
1339 /*
1340  * iwl_sta_tx_modify_enable_tid - Enable Tx for this TID in station table
1341  */
1342 int iwl_sta_tx_modify_enable_tid(struct iwl_priv *priv, int sta_id, int tid)
1343 {
1344 	struct iwl_addsta_cmd sta_cmd;
1345 
1346 	lockdep_assert_held(&priv->mutex);
1347 
1348 	/* Remove "disable" flag, to enable Tx for this TID */
1349 	spin_lock_bh(&priv->sta_lock);
1350 	priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_TID_DISABLE_TX;
1351 	priv->stations[sta_id].sta.tid_disable_tx &= cpu_to_le16(~(1 << tid));
1352 	priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
1353 	memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
1354 	spin_unlock_bh(&priv->sta_lock);
1355 
1356 	return iwl_send_add_sta(priv, &sta_cmd, 0);
1357 }
1358 
1359 int iwl_sta_rx_agg_start(struct iwl_priv *priv, struct ieee80211_sta *sta,
1360 			 int tid, u16 ssn)
1361 {
1362 	int sta_id;
1363 	struct iwl_addsta_cmd sta_cmd;
1364 
1365 	lockdep_assert_held(&priv->mutex);
1366 
1367 	sta_id = iwl_sta_id(sta);
1368 	if (sta_id == IWL_INVALID_STATION)
1369 		return -ENXIO;
1370 
1371 	spin_lock_bh(&priv->sta_lock);
1372 	priv->stations[sta_id].sta.station_flags_msk = 0;
1373 	priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_ADDBA_TID_MSK;
1374 	priv->stations[sta_id].sta.add_immediate_ba_tid = (u8)tid;
1375 	priv->stations[sta_id].sta.add_immediate_ba_ssn = cpu_to_le16(ssn);
1376 	priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
1377 	memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
1378 	spin_unlock_bh(&priv->sta_lock);
1379 
1380 	return iwl_send_add_sta(priv, &sta_cmd, 0);
1381 }
1382 
1383 int iwl_sta_rx_agg_stop(struct iwl_priv *priv, struct ieee80211_sta *sta,
1384 			int tid)
1385 {
1386 	int sta_id;
1387 	struct iwl_addsta_cmd sta_cmd;
1388 
1389 	lockdep_assert_held(&priv->mutex);
1390 
1391 	sta_id = iwl_sta_id(sta);
1392 	if (sta_id == IWL_INVALID_STATION) {
1393 		IWL_ERR(priv, "Invalid station for AGG tid %d\n", tid);
1394 		return -ENXIO;
1395 	}
1396 
1397 	spin_lock_bh(&priv->sta_lock);
1398 	priv->stations[sta_id].sta.station_flags_msk = 0;
1399 	priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_DELBA_TID_MSK;
1400 	priv->stations[sta_id].sta.remove_immediate_ba_tid = (u8)tid;
1401 	priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
1402 	memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
1403 	spin_unlock_bh(&priv->sta_lock);
1404 
1405 	return iwl_send_add_sta(priv, &sta_cmd, 0);
1406 }
1407 
1408 
1409 
1410 void iwl_sta_modify_sleep_tx_count(struct iwl_priv *priv, int sta_id, int cnt)
1411 {
1412 	struct iwl_addsta_cmd cmd = {
1413 		.mode = STA_CONTROL_MODIFY_MSK,
1414 		.station_flags = STA_FLG_PWR_SAVE_MSK,
1415 		.station_flags_msk = STA_FLG_PWR_SAVE_MSK,
1416 		.sta.sta_id = sta_id,
1417 		.sta.modify_mask = STA_MODIFY_SLEEP_TX_COUNT_MSK,
1418 		.sleep_tx_count = cpu_to_le16(cnt),
1419 	};
1420 
1421 	iwl_send_add_sta(priv, &cmd, CMD_ASYNC);
1422 }
1423