1 // SPDX-License-Identifier: GPL-2.0-only
2 /******************************************************************************
3  *
4  * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
5  *
6  * Portions of this file are derived from the ipw3945 project, as well
7  * as portions of the ieee80211 subsystem header files.
8  *
9  * Contact Information:
10  *  Intel Linux Wireless <linuxwifi@intel.com>
11  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
12  *
13  *****************************************************************************/
14 #include <linux/etherdevice.h>
15 #include <net/mac80211.h>
16 #include "iwl-trans.h"
17 #include "dev.h"
18 #include "agn.h"
19 
20 const u8 iwl_bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
21 
22 static int iwl_sta_ucode_activate(struct iwl_priv *priv, u8 sta_id)
23 {
24 	lockdep_assert_held(&priv->sta_lock);
25 
26 	if (sta_id >= IWLAGN_STATION_COUNT) {
27 		IWL_ERR(priv, "invalid sta_id %u\n", sta_id);
28 		return -EINVAL;
29 	}
30 	if (!(priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE))
31 		IWL_ERR(priv, "ACTIVATE a non DRIVER active station id %u "
32 			"addr %pM\n",
33 			sta_id, priv->stations[sta_id].sta.sta.addr);
34 
35 	if (priv->stations[sta_id].used & IWL_STA_UCODE_ACTIVE) {
36 		IWL_DEBUG_ASSOC(priv,
37 				"STA id %u addr %pM already present in uCode "
38 				"(according to driver)\n",
39 				sta_id, priv->stations[sta_id].sta.sta.addr);
40 	} else {
41 		priv->stations[sta_id].used |= IWL_STA_UCODE_ACTIVE;
42 		IWL_DEBUG_ASSOC(priv, "Added STA id %u addr %pM to uCode\n",
43 				sta_id, priv->stations[sta_id].sta.sta.addr);
44 	}
45 	return 0;
46 }
47 
48 static void iwl_process_add_sta_resp(struct iwl_priv *priv,
49 				     struct iwl_rx_packet *pkt)
50 {
51 	struct iwl_add_sta_resp *add_sta_resp = (void *)pkt->data;
52 
53 	IWL_DEBUG_INFO(priv, "Processing response for adding station\n");
54 
55 	spin_lock_bh(&priv->sta_lock);
56 
57 	switch (add_sta_resp->status) {
58 	case ADD_STA_SUCCESS_MSK:
59 		IWL_DEBUG_INFO(priv, "REPLY_ADD_STA PASSED\n");
60 		break;
61 	case ADD_STA_NO_ROOM_IN_TABLE:
62 		IWL_ERR(priv, "Adding station failed, no room in table.\n");
63 		break;
64 	case ADD_STA_NO_BLOCK_ACK_RESOURCE:
65 		IWL_ERR(priv,
66 			"Adding station failed, no block ack resource.\n");
67 		break;
68 	case ADD_STA_MODIFY_NON_EXIST_STA:
69 		IWL_ERR(priv, "Attempting to modify non-existing station\n");
70 		break;
71 	default:
72 		IWL_DEBUG_ASSOC(priv, "Received REPLY_ADD_STA:(0x%08X)\n",
73 				add_sta_resp->status);
74 		break;
75 	}
76 
77 	spin_unlock_bh(&priv->sta_lock);
78 }
79 
80 void iwl_add_sta_callback(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb)
81 {
82 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
83 
84 	iwl_process_add_sta_resp(priv, pkt);
85 }
86 
87 int iwl_send_add_sta(struct iwl_priv *priv,
88 		     struct iwl_addsta_cmd *sta, u8 flags)
89 {
90 	int ret = 0;
91 	struct iwl_host_cmd cmd = {
92 		.id = REPLY_ADD_STA,
93 		.flags = flags,
94 		.data = { sta, },
95 		.len = { sizeof(*sta), },
96 	};
97 	u8 sta_id __maybe_unused = sta->sta.sta_id;
98 	struct iwl_rx_packet *pkt;
99 	struct iwl_add_sta_resp *add_sta_resp;
100 
101 	IWL_DEBUG_INFO(priv, "Adding sta %u (%pM) %ssynchronously\n",
102 		       sta_id, sta->sta.addr, flags & CMD_ASYNC ?  "a" : "");
103 
104 	if (!(flags & CMD_ASYNC)) {
105 		cmd.flags |= CMD_WANT_SKB;
106 		might_sleep();
107 	}
108 
109 	ret = iwl_dvm_send_cmd(priv, &cmd);
110 
111 	if (ret || (flags & CMD_ASYNC))
112 		return ret;
113 
114 	pkt = cmd.resp_pkt;
115 	add_sta_resp = (void *)pkt->data;
116 
117 	/* debug messages are printed in the handler */
118 	if (add_sta_resp->status == ADD_STA_SUCCESS_MSK) {
119 		spin_lock_bh(&priv->sta_lock);
120 		ret = iwl_sta_ucode_activate(priv, sta_id);
121 		spin_unlock_bh(&priv->sta_lock);
122 	} else {
123 		ret = -EIO;
124 	}
125 
126 	iwl_free_resp(&cmd);
127 
128 	return ret;
129 }
130 
131 bool iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
132 			    struct iwl_rxon_context *ctx,
133 			    struct ieee80211_sta *sta)
134 {
135 	if (!ctx->ht.enabled || !ctx->ht.is_40mhz)
136 		return false;
137 
138 #ifdef CONFIG_IWLWIFI_DEBUGFS
139 	if (priv->disable_ht40)
140 		return false;
141 #endif
142 
143 	/* special case for RXON */
144 	if (!sta)
145 		return true;
146 
147 	return sta->bandwidth >= IEEE80211_STA_RX_BW_40;
148 }
149 
150 static void iwl_sta_calc_ht_flags(struct iwl_priv *priv,
151 				  struct ieee80211_sta *sta,
152 				  struct iwl_rxon_context *ctx,
153 				  __le32 *flags, __le32 *mask)
154 {
155 	struct ieee80211_sta_ht_cap *sta_ht_inf = &sta->ht_cap;
156 
157 	*mask = STA_FLG_RTS_MIMO_PROT_MSK |
158 		STA_FLG_MIMO_DIS_MSK |
159 		STA_FLG_HT40_EN_MSK |
160 		STA_FLG_MAX_AGG_SIZE_MSK |
161 		STA_FLG_AGG_MPDU_DENSITY_MSK;
162 	*flags = 0;
163 
164 	if (!sta || !sta_ht_inf->ht_supported)
165 		return;
166 
167 	IWL_DEBUG_INFO(priv, "STA %pM SM PS mode: %s\n",
168 			sta->addr,
169 			(sta->smps_mode == IEEE80211_SMPS_STATIC) ?
170 			"static" :
171 			(sta->smps_mode == IEEE80211_SMPS_DYNAMIC) ?
172 			"dynamic" : "disabled");
173 
174 	switch (sta->smps_mode) {
175 	case IEEE80211_SMPS_STATIC:
176 		*flags |= STA_FLG_MIMO_DIS_MSK;
177 		break;
178 	case IEEE80211_SMPS_DYNAMIC:
179 		*flags |= STA_FLG_RTS_MIMO_PROT_MSK;
180 		break;
181 	case IEEE80211_SMPS_OFF:
182 		break;
183 	default:
184 		IWL_WARN(priv, "Invalid MIMO PS mode %d\n", sta->smps_mode);
185 		break;
186 	}
187 
188 	*flags |= cpu_to_le32(
189 		(u32)sta_ht_inf->ampdu_factor << STA_FLG_MAX_AGG_SIZE_POS);
190 
191 	*flags |= cpu_to_le32(
192 		(u32)sta_ht_inf->ampdu_density << STA_FLG_AGG_MPDU_DENSITY_POS);
193 
194 	if (iwl_is_ht40_tx_allowed(priv, ctx, sta))
195 		*flags |= STA_FLG_HT40_EN_MSK;
196 }
197 
198 int iwl_sta_update_ht(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
199 		      struct ieee80211_sta *sta)
200 {
201 	u8 sta_id = iwl_sta_id(sta);
202 	__le32 flags, mask;
203 	struct iwl_addsta_cmd cmd;
204 
205 	if (WARN_ON_ONCE(sta_id == IWL_INVALID_STATION))
206 		return -EINVAL;
207 
208 	iwl_sta_calc_ht_flags(priv, sta, ctx, &flags, &mask);
209 
210 	spin_lock_bh(&priv->sta_lock);
211 	priv->stations[sta_id].sta.station_flags &= ~mask;
212 	priv->stations[sta_id].sta.station_flags |= flags;
213 	spin_unlock_bh(&priv->sta_lock);
214 
215 	memset(&cmd, 0, sizeof(cmd));
216 	cmd.mode = STA_CONTROL_MODIFY_MSK;
217 	cmd.station_flags_msk = mask;
218 	cmd.station_flags = flags;
219 	cmd.sta.sta_id = sta_id;
220 
221 	return iwl_send_add_sta(priv, &cmd, 0);
222 }
223 
224 static void iwl_set_ht_add_station(struct iwl_priv *priv, u8 index,
225 				   struct ieee80211_sta *sta,
226 				   struct iwl_rxon_context *ctx)
227 {
228 	__le32 flags, mask;
229 
230 	iwl_sta_calc_ht_flags(priv, sta, ctx, &flags, &mask);
231 
232 	lockdep_assert_held(&priv->sta_lock);
233 	priv->stations[index].sta.station_flags &= ~mask;
234 	priv->stations[index].sta.station_flags |= flags;
235 }
236 
237 /**
238  * iwl_prep_station - Prepare station information for addition
239  *
240  * should be called with sta_lock held
241  */
242 u8 iwl_prep_station(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
243 		    const u8 *addr, bool is_ap, struct ieee80211_sta *sta)
244 {
245 	struct iwl_station_entry *station;
246 	int i;
247 	u8 sta_id = IWL_INVALID_STATION;
248 
249 	if (is_ap)
250 		sta_id = ctx->ap_sta_id;
251 	else if (is_broadcast_ether_addr(addr))
252 		sta_id = ctx->bcast_sta_id;
253 	else
254 		for (i = IWL_STA_ID; i < IWLAGN_STATION_COUNT; i++) {
255 			if (ether_addr_equal(priv->stations[i].sta.sta.addr,
256 					     addr)) {
257 				sta_id = i;
258 				break;
259 			}
260 
261 			if (!priv->stations[i].used &&
262 			    sta_id == IWL_INVALID_STATION)
263 				sta_id = i;
264 		}
265 
266 	/*
267 	 * These two conditions have the same outcome, but keep them
268 	 * separate
269 	 */
270 	if (unlikely(sta_id == IWL_INVALID_STATION))
271 		return sta_id;
272 
273 	/*
274 	 * uCode is not able to deal with multiple requests to add a
275 	 * station. Keep track if one is in progress so that we do not send
276 	 * another.
277 	 */
278 	if (priv->stations[sta_id].used & IWL_STA_UCODE_INPROGRESS) {
279 		IWL_DEBUG_INFO(priv, "STA %d already in process of being "
280 			       "added.\n", sta_id);
281 		return sta_id;
282 	}
283 
284 	if ((priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE) &&
285 	    (priv->stations[sta_id].used & IWL_STA_UCODE_ACTIVE) &&
286 	    ether_addr_equal(priv->stations[sta_id].sta.sta.addr, addr)) {
287 		IWL_DEBUG_ASSOC(priv, "STA %d (%pM) already added, not "
288 				"adding again.\n", sta_id, addr);
289 		return sta_id;
290 	}
291 
292 	station = &priv->stations[sta_id];
293 	station->used = IWL_STA_DRIVER_ACTIVE;
294 	IWL_DEBUG_ASSOC(priv, "Add STA to driver ID %d: %pM\n",
295 			sta_id, addr);
296 	priv->num_stations++;
297 
298 	/* Set up the REPLY_ADD_STA command to send to device */
299 	memset(&station->sta, 0, sizeof(struct iwl_addsta_cmd));
300 	memcpy(station->sta.sta.addr, addr, ETH_ALEN);
301 	station->sta.mode = 0;
302 	station->sta.sta.sta_id = sta_id;
303 	station->sta.station_flags = ctx->station_flags;
304 	station->ctxid = ctx->ctxid;
305 
306 	if (sta) {
307 		struct iwl_station_priv *sta_priv;
308 
309 		sta_priv = (void *)sta->drv_priv;
310 		sta_priv->ctx = ctx;
311 	}
312 
313 	/*
314 	 * OK to call unconditionally, since local stations (IBSS BSSID
315 	 * STA and broadcast STA) pass in a NULL sta, and mac80211
316 	 * doesn't allow HT IBSS.
317 	 */
318 	iwl_set_ht_add_station(priv, sta_id, sta, ctx);
319 
320 	return sta_id;
321 
322 }
323 
324 #define STA_WAIT_TIMEOUT (HZ/2)
325 
326 /**
327  * iwl_add_station_common -
328  */
329 int iwl_add_station_common(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
330 			   const u8 *addr, bool is_ap,
331 			   struct ieee80211_sta *sta, u8 *sta_id_r)
332 {
333 	int ret = 0;
334 	u8 sta_id;
335 	struct iwl_addsta_cmd sta_cmd;
336 
337 	*sta_id_r = 0;
338 	spin_lock_bh(&priv->sta_lock);
339 	sta_id = iwl_prep_station(priv, ctx, addr, is_ap, sta);
340 	if (sta_id == IWL_INVALID_STATION) {
341 		IWL_ERR(priv, "Unable to prepare station %pM for addition\n",
342 			addr);
343 		spin_unlock_bh(&priv->sta_lock);
344 		return -EINVAL;
345 	}
346 
347 	/*
348 	 * uCode is not able to deal with multiple requests to add a
349 	 * station. Keep track if one is in progress so that we do not send
350 	 * another.
351 	 */
352 	if (priv->stations[sta_id].used & IWL_STA_UCODE_INPROGRESS) {
353 		IWL_DEBUG_INFO(priv, "STA %d already in process of being "
354 			       "added.\n", sta_id);
355 		spin_unlock_bh(&priv->sta_lock);
356 		return -EEXIST;
357 	}
358 
359 	if ((priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE) &&
360 	    (priv->stations[sta_id].used & IWL_STA_UCODE_ACTIVE)) {
361 		IWL_DEBUG_ASSOC(priv, "STA %d (%pM) already added, not "
362 				"adding again.\n", sta_id, addr);
363 		spin_unlock_bh(&priv->sta_lock);
364 		return -EEXIST;
365 	}
366 
367 	priv->stations[sta_id].used |= IWL_STA_UCODE_INPROGRESS;
368 	memcpy(&sta_cmd, &priv->stations[sta_id].sta,
369 	       sizeof(struct iwl_addsta_cmd));
370 	spin_unlock_bh(&priv->sta_lock);
371 
372 	/* Add station to device's station table */
373 	ret = iwl_send_add_sta(priv, &sta_cmd, 0);
374 	if (ret) {
375 		spin_lock_bh(&priv->sta_lock);
376 		IWL_ERR(priv, "Adding station %pM failed.\n",
377 			priv->stations[sta_id].sta.sta.addr);
378 		priv->stations[sta_id].used &= ~IWL_STA_DRIVER_ACTIVE;
379 		priv->stations[sta_id].used &= ~IWL_STA_UCODE_INPROGRESS;
380 		spin_unlock_bh(&priv->sta_lock);
381 	}
382 	*sta_id_r = sta_id;
383 	return ret;
384 }
385 
386 /**
387  * iwl_sta_ucode_deactivate - deactivate ucode status for a station
388  */
389 static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, u8 sta_id)
390 {
391 	lockdep_assert_held(&priv->sta_lock);
392 
393 	/* Ucode must be active and driver must be non active */
394 	if ((priv->stations[sta_id].used &
395 	     (IWL_STA_UCODE_ACTIVE | IWL_STA_DRIVER_ACTIVE)) !=
396 	      IWL_STA_UCODE_ACTIVE)
397 		IWL_ERR(priv, "removed non active STA %u\n", sta_id);
398 
399 	priv->stations[sta_id].used &= ~IWL_STA_UCODE_ACTIVE;
400 
401 	memset(&priv->stations[sta_id], 0, sizeof(struct iwl_station_entry));
402 	IWL_DEBUG_ASSOC(priv, "Removed STA %u\n", sta_id);
403 }
404 
405 static int iwl_send_remove_station(struct iwl_priv *priv,
406 				   const u8 *addr, int sta_id,
407 				   bool temporary)
408 {
409 	struct iwl_rx_packet *pkt;
410 	int ret;
411 	struct iwl_rem_sta_cmd rm_sta_cmd;
412 	struct iwl_rem_sta_resp *rem_sta_resp;
413 
414 	struct iwl_host_cmd cmd = {
415 		.id = REPLY_REMOVE_STA,
416 		.len = { sizeof(struct iwl_rem_sta_cmd), },
417 		.data = { &rm_sta_cmd, },
418 	};
419 
420 	memset(&rm_sta_cmd, 0, sizeof(rm_sta_cmd));
421 	rm_sta_cmd.num_sta = 1;
422 	memcpy(&rm_sta_cmd.addr, addr, ETH_ALEN);
423 
424 	cmd.flags |= CMD_WANT_SKB;
425 
426 	ret = iwl_dvm_send_cmd(priv, &cmd);
427 
428 	if (ret)
429 		return ret;
430 
431 	pkt = cmd.resp_pkt;
432 	rem_sta_resp = (void *)pkt->data;
433 
434 	switch (rem_sta_resp->status) {
435 	case REM_STA_SUCCESS_MSK:
436 		if (!temporary) {
437 			spin_lock_bh(&priv->sta_lock);
438 			iwl_sta_ucode_deactivate(priv, sta_id);
439 			spin_unlock_bh(&priv->sta_lock);
440 		}
441 		IWL_DEBUG_ASSOC(priv, "REPLY_REMOVE_STA PASSED\n");
442 		break;
443 	default:
444 		ret = -EIO;
445 		IWL_ERR(priv, "REPLY_REMOVE_STA failed\n");
446 		break;
447 	}
448 
449 	iwl_free_resp(&cmd);
450 
451 	return ret;
452 }
453 
454 /**
455  * iwl_remove_station - Remove driver's knowledge of station.
456  */
457 int iwl_remove_station(struct iwl_priv *priv, const u8 sta_id,
458 		       const u8 *addr)
459 {
460 	u8 tid;
461 
462 	if (!iwl_is_ready(priv)) {
463 		IWL_DEBUG_INFO(priv,
464 			"Unable to remove station %pM, device not ready.\n",
465 			addr);
466 		/*
467 		 * It is typical for stations to be removed when we are
468 		 * going down. Return success since device will be down
469 		 * soon anyway
470 		 */
471 		return 0;
472 	}
473 
474 	IWL_DEBUG_ASSOC(priv, "Removing STA from driver:%d  %pM\n",
475 			sta_id, addr);
476 
477 	if (WARN_ON(sta_id == IWL_INVALID_STATION))
478 		return -EINVAL;
479 
480 	spin_lock_bh(&priv->sta_lock);
481 
482 	if (!(priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE)) {
483 		IWL_DEBUG_INFO(priv, "Removing %pM but non DRIVER active\n",
484 				addr);
485 		goto out_err;
486 	}
487 
488 	if (!(priv->stations[sta_id].used & IWL_STA_UCODE_ACTIVE)) {
489 		IWL_DEBUG_INFO(priv, "Removing %pM but non UCODE active\n",
490 				addr);
491 		goto out_err;
492 	}
493 
494 	if (priv->stations[sta_id].used & IWL_STA_LOCAL) {
495 		kfree(priv->stations[sta_id].lq);
496 		priv->stations[sta_id].lq = NULL;
497 	}
498 
499 	for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++)
500 		memset(&priv->tid_data[sta_id][tid], 0,
501 			sizeof(priv->tid_data[sta_id][tid]));
502 
503 	priv->stations[sta_id].used &= ~IWL_STA_DRIVER_ACTIVE;
504 
505 	priv->num_stations--;
506 
507 	if (WARN_ON(priv->num_stations < 0))
508 		priv->num_stations = 0;
509 
510 	spin_unlock_bh(&priv->sta_lock);
511 
512 	return iwl_send_remove_station(priv, addr, sta_id, false);
513 out_err:
514 	spin_unlock_bh(&priv->sta_lock);
515 	return -EINVAL;
516 }
517 
518 void iwl_deactivate_station(struct iwl_priv *priv, const u8 sta_id,
519 			    const u8 *addr)
520 {
521 	u8 tid;
522 
523 	if (!iwl_is_ready(priv)) {
524 		IWL_DEBUG_INFO(priv,
525 			"Unable to remove station %pM, device not ready.\n",
526 			addr);
527 		return;
528 	}
529 
530 	IWL_DEBUG_ASSOC(priv, "Deactivating STA: %pM (%d)\n", addr, sta_id);
531 
532 	if (WARN_ON_ONCE(sta_id == IWL_INVALID_STATION))
533 		return;
534 
535 	spin_lock_bh(&priv->sta_lock);
536 
537 	WARN_ON_ONCE(!(priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE));
538 
539 	for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++)
540 		memset(&priv->tid_data[sta_id][tid], 0,
541 			sizeof(priv->tid_data[sta_id][tid]));
542 
543 	priv->stations[sta_id].used &= ~IWL_STA_DRIVER_ACTIVE;
544 	priv->stations[sta_id].used &= ~IWL_STA_UCODE_INPROGRESS;
545 
546 	priv->num_stations--;
547 
548 	if (WARN_ON_ONCE(priv->num_stations < 0))
549 		priv->num_stations = 0;
550 
551 	spin_unlock_bh(&priv->sta_lock);
552 }
553 
554 static void iwl_sta_fill_lq(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
555 			    u8 sta_id, struct iwl_link_quality_cmd *link_cmd)
556 {
557 	int i, r;
558 	u32 rate_flags = 0;
559 	__le32 rate_n_flags;
560 
561 	lockdep_assert_held(&priv->mutex);
562 
563 	memset(link_cmd, 0, sizeof(*link_cmd));
564 
565 	/* Set up the rate scaling to start at selected rate, fall back
566 	 * all the way down to 1M in IEEE order, and then spin on 1M */
567 	if (priv->band == NL80211_BAND_5GHZ)
568 		r = IWL_RATE_6M_INDEX;
569 	else if (ctx && ctx->vif && ctx->vif->p2p)
570 		r = IWL_RATE_6M_INDEX;
571 	else
572 		r = IWL_RATE_1M_INDEX;
573 
574 	if (r >= IWL_FIRST_CCK_RATE && r <= IWL_LAST_CCK_RATE)
575 		rate_flags |= RATE_MCS_CCK_MSK;
576 
577 	rate_flags |= first_antenna(priv->nvm_data->valid_tx_ant) <<
578 				RATE_MCS_ANT_POS;
579 	rate_n_flags = iwl_hw_set_rate_n_flags(iwl_rates[r].plcp, rate_flags);
580 	for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++)
581 		link_cmd->rs_table[i].rate_n_flags = rate_n_flags;
582 
583 	link_cmd->general_params.single_stream_ant_msk =
584 			first_antenna(priv->nvm_data->valid_tx_ant);
585 
586 	link_cmd->general_params.dual_stream_ant_msk =
587 		priv->nvm_data->valid_tx_ant &
588 		~first_antenna(priv->nvm_data->valid_tx_ant);
589 	if (!link_cmd->general_params.dual_stream_ant_msk) {
590 		link_cmd->general_params.dual_stream_ant_msk = ANT_AB;
591 	} else if (num_of_ant(priv->nvm_data->valid_tx_ant) == 2) {
592 		link_cmd->general_params.dual_stream_ant_msk =
593 			priv->nvm_data->valid_tx_ant;
594 	}
595 
596 	link_cmd->agg_params.agg_dis_start_th =
597 		LINK_QUAL_AGG_DISABLE_START_DEF;
598 	link_cmd->agg_params.agg_time_limit =
599 		cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
600 
601 	link_cmd->sta_id = sta_id;
602 }
603 
604 /**
605  * iwl_clear_ucode_stations - clear ucode station table bits
606  *
607  * This function clears all the bits in the driver indicating
608  * which stations are active in the ucode. Call when something
609  * other than explicit station management would cause this in
610  * the ucode, e.g. unassociated RXON.
611  */
612 void iwl_clear_ucode_stations(struct iwl_priv *priv,
613 			      struct iwl_rxon_context *ctx)
614 {
615 	int i;
616 	bool cleared = false;
617 
618 	IWL_DEBUG_INFO(priv, "Clearing ucode stations in driver\n");
619 
620 	spin_lock_bh(&priv->sta_lock);
621 	for (i = 0; i < IWLAGN_STATION_COUNT; i++) {
622 		if (ctx && ctx->ctxid != priv->stations[i].ctxid)
623 			continue;
624 
625 		if (priv->stations[i].used & IWL_STA_UCODE_ACTIVE) {
626 			IWL_DEBUG_INFO(priv,
627 				"Clearing ucode active for station %d\n", i);
628 			priv->stations[i].used &= ~IWL_STA_UCODE_ACTIVE;
629 			cleared = true;
630 		}
631 	}
632 	spin_unlock_bh(&priv->sta_lock);
633 
634 	if (!cleared)
635 		IWL_DEBUG_INFO(priv,
636 			       "No active stations found to be cleared\n");
637 }
638 
639 /**
640  * iwl_restore_stations() - Restore driver known stations to device
641  *
642  * All stations considered active by driver, but not present in ucode, is
643  * restored.
644  *
645  * Function sleeps.
646  */
647 void iwl_restore_stations(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
648 {
649 	struct iwl_addsta_cmd sta_cmd;
650 	static const struct iwl_link_quality_cmd zero_lq = {};
651 	struct iwl_link_quality_cmd lq;
652 	int i;
653 	bool found = false;
654 	int ret;
655 	bool send_lq;
656 
657 	if (!iwl_is_ready(priv)) {
658 		IWL_DEBUG_INFO(priv,
659 			       "Not ready yet, not restoring any stations.\n");
660 		return;
661 	}
662 
663 	IWL_DEBUG_ASSOC(priv, "Restoring all known stations ... start.\n");
664 	spin_lock_bh(&priv->sta_lock);
665 	for (i = 0; i < IWLAGN_STATION_COUNT; i++) {
666 		if (ctx->ctxid != priv->stations[i].ctxid)
667 			continue;
668 		if ((priv->stations[i].used & IWL_STA_DRIVER_ACTIVE) &&
669 			    !(priv->stations[i].used & IWL_STA_UCODE_ACTIVE)) {
670 			IWL_DEBUG_ASSOC(priv, "Restoring sta %pM\n",
671 					priv->stations[i].sta.sta.addr);
672 			priv->stations[i].sta.mode = 0;
673 			priv->stations[i].used |= IWL_STA_UCODE_INPROGRESS;
674 			found = true;
675 		}
676 	}
677 
678 	for (i = 0; i < IWLAGN_STATION_COUNT; i++) {
679 		if ((priv->stations[i].used & IWL_STA_UCODE_INPROGRESS)) {
680 			memcpy(&sta_cmd, &priv->stations[i].sta,
681 			       sizeof(struct iwl_addsta_cmd));
682 			send_lq = false;
683 			if (priv->stations[i].lq) {
684 				if (priv->wowlan)
685 					iwl_sta_fill_lq(priv, ctx, i, &lq);
686 				else
687 					memcpy(&lq, priv->stations[i].lq,
688 					       sizeof(struct iwl_link_quality_cmd));
689 
690 				if (memcmp(&lq, &zero_lq, sizeof(lq)))
691 					send_lq = true;
692 			}
693 			spin_unlock_bh(&priv->sta_lock);
694 			ret = iwl_send_add_sta(priv, &sta_cmd, 0);
695 			if (ret) {
696 				spin_lock_bh(&priv->sta_lock);
697 				IWL_ERR(priv, "Adding station %pM failed.\n",
698 					priv->stations[i].sta.sta.addr);
699 				priv->stations[i].used &=
700 						~IWL_STA_DRIVER_ACTIVE;
701 				priv->stations[i].used &=
702 						~IWL_STA_UCODE_INPROGRESS;
703 				continue;
704 			}
705 			/*
706 			 * Rate scaling has already been initialized, send
707 			 * current LQ command
708 			 */
709 			if (send_lq)
710 				iwl_send_lq_cmd(priv, ctx, &lq, 0, true);
711 			spin_lock_bh(&priv->sta_lock);
712 			priv->stations[i].used &= ~IWL_STA_UCODE_INPROGRESS;
713 		}
714 	}
715 
716 	spin_unlock_bh(&priv->sta_lock);
717 	if (!found)
718 		IWL_DEBUG_INFO(priv, "Restoring all known stations .... "
719 			"no stations to be restored.\n");
720 	else
721 		IWL_DEBUG_INFO(priv, "Restoring all known stations .... "
722 			"complete.\n");
723 }
724 
725 int iwl_get_free_ucode_key_offset(struct iwl_priv *priv)
726 {
727 	int i;
728 
729 	for (i = 0; i < priv->sta_key_max_num; i++)
730 		if (!test_and_set_bit(i, &priv->ucode_key_table))
731 			return i;
732 
733 	return WEP_INVALID_OFFSET;
734 }
735 
736 void iwl_dealloc_bcast_stations(struct iwl_priv *priv)
737 {
738 	int i;
739 
740 	spin_lock_bh(&priv->sta_lock);
741 	for (i = 0; i < IWLAGN_STATION_COUNT; i++) {
742 		if (!(priv->stations[i].used & IWL_STA_BCAST))
743 			continue;
744 
745 		priv->stations[i].used &= ~IWL_STA_UCODE_ACTIVE;
746 		priv->num_stations--;
747 		if (WARN_ON(priv->num_stations < 0))
748 			priv->num_stations = 0;
749 		kfree(priv->stations[i].lq);
750 		priv->stations[i].lq = NULL;
751 	}
752 	spin_unlock_bh(&priv->sta_lock);
753 }
754 
755 #ifdef CONFIG_IWLWIFI_DEBUG
756 static void iwl_dump_lq_cmd(struct iwl_priv *priv,
757 			   struct iwl_link_quality_cmd *lq)
758 {
759 	int i;
760 	IWL_DEBUG_RATE(priv, "lq station id 0x%x\n", lq->sta_id);
761 	IWL_DEBUG_RATE(priv, "lq ant 0x%X 0x%X\n",
762 		       lq->general_params.single_stream_ant_msk,
763 		       lq->general_params.dual_stream_ant_msk);
764 
765 	for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++)
766 		IWL_DEBUG_RATE(priv, "lq index %d 0x%X\n",
767 			       i, lq->rs_table[i].rate_n_flags);
768 }
769 #else
770 static inline void iwl_dump_lq_cmd(struct iwl_priv *priv,
771 				   struct iwl_link_quality_cmd *lq)
772 {
773 }
774 #endif
775 
776 /**
777  * is_lq_table_valid() - Test one aspect of LQ cmd for validity
778  *
779  * It sometimes happens when a HT rate has been in use and we
780  * loose connectivity with AP then mac80211 will first tell us that the
781  * current channel is not HT anymore before removing the station. In such a
782  * scenario the RXON flags will be updated to indicate we are not
783  * communicating HT anymore, but the LQ command may still contain HT rates.
784  * Test for this to prevent driver from sending LQ command between the time
785  * RXON flags are updated and when LQ command is updated.
786  */
787 static bool is_lq_table_valid(struct iwl_priv *priv,
788 			      struct iwl_rxon_context *ctx,
789 			      struct iwl_link_quality_cmd *lq)
790 {
791 	int i;
792 
793 	if (ctx->ht.enabled)
794 		return true;
795 
796 	IWL_DEBUG_INFO(priv, "Channel %u is not an HT channel\n",
797 		       ctx->active.channel);
798 	for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
799 		if (le32_to_cpu(lq->rs_table[i].rate_n_flags) &
800 		    RATE_MCS_HT_MSK) {
801 			IWL_DEBUG_INFO(priv,
802 				       "index %d of LQ expects HT channel\n",
803 				       i);
804 			return false;
805 		}
806 	}
807 	return true;
808 }
809 
810 /**
811  * iwl_send_lq_cmd() - Send link quality command
812  * @init: This command is sent as part of station initialization right
813  *        after station has been added.
814  *
815  * The link quality command is sent as the last step of station creation.
816  * This is the special case in which init is set and we call a callback in
817  * this case to clear the state indicating that station creation is in
818  * progress.
819  */
820 int iwl_send_lq_cmd(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
821 		    struct iwl_link_quality_cmd *lq, u8 flags, bool init)
822 {
823 	int ret = 0;
824 	struct iwl_host_cmd cmd = {
825 		.id = REPLY_TX_LINK_QUALITY_CMD,
826 		.len = { sizeof(struct iwl_link_quality_cmd), },
827 		.flags = flags,
828 		.data = { lq, },
829 	};
830 
831 	if (WARN_ON(lq->sta_id == IWL_INVALID_STATION))
832 		return -EINVAL;
833 
834 
835 	spin_lock_bh(&priv->sta_lock);
836 	if (!(priv->stations[lq->sta_id].used & IWL_STA_DRIVER_ACTIVE)) {
837 		spin_unlock_bh(&priv->sta_lock);
838 		return -EINVAL;
839 	}
840 	spin_unlock_bh(&priv->sta_lock);
841 
842 	iwl_dump_lq_cmd(priv, lq);
843 	if (WARN_ON(init && (cmd.flags & CMD_ASYNC)))
844 		return -EINVAL;
845 
846 	if (is_lq_table_valid(priv, ctx, lq))
847 		ret = iwl_dvm_send_cmd(priv, &cmd);
848 	else
849 		ret = -EINVAL;
850 
851 	if (cmd.flags & CMD_ASYNC)
852 		return ret;
853 
854 	if (init) {
855 		IWL_DEBUG_INFO(priv, "init LQ command complete, "
856 			       "clearing sta addition status for sta %d\n",
857 			       lq->sta_id);
858 		spin_lock_bh(&priv->sta_lock);
859 		priv->stations[lq->sta_id].used &= ~IWL_STA_UCODE_INPROGRESS;
860 		spin_unlock_bh(&priv->sta_lock);
861 	}
862 	return ret;
863 }
864 
865 
866 static struct iwl_link_quality_cmd *
867 iwl_sta_alloc_lq(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
868 		 u8 sta_id)
869 {
870 	struct iwl_link_quality_cmd *link_cmd;
871 
872 	link_cmd = kzalloc(sizeof(struct iwl_link_quality_cmd), GFP_KERNEL);
873 	if (!link_cmd) {
874 		IWL_ERR(priv, "Unable to allocate memory for LQ cmd.\n");
875 		return NULL;
876 	}
877 
878 	iwl_sta_fill_lq(priv, ctx, sta_id, link_cmd);
879 
880 	return link_cmd;
881 }
882 
883 /*
884  * iwlagn_add_bssid_station - Add the special IBSS BSSID station
885  *
886  * Function sleeps.
887  */
888 int iwlagn_add_bssid_station(struct iwl_priv *priv,
889 			     struct iwl_rxon_context *ctx,
890 			     const u8 *addr, u8 *sta_id_r)
891 {
892 	int ret;
893 	u8 sta_id;
894 	struct iwl_link_quality_cmd *link_cmd;
895 
896 	if (sta_id_r)
897 		*sta_id_r = IWL_INVALID_STATION;
898 
899 	ret = iwl_add_station_common(priv, ctx, addr, 0, NULL, &sta_id);
900 	if (ret) {
901 		IWL_ERR(priv, "Unable to add station %pM\n", addr);
902 		return ret;
903 	}
904 
905 	if (sta_id_r)
906 		*sta_id_r = sta_id;
907 
908 	spin_lock_bh(&priv->sta_lock);
909 	priv->stations[sta_id].used |= IWL_STA_LOCAL;
910 	spin_unlock_bh(&priv->sta_lock);
911 
912 	/* Set up default rate scaling table in device's station table */
913 	link_cmd = iwl_sta_alloc_lq(priv, ctx, sta_id);
914 	if (!link_cmd) {
915 		IWL_ERR(priv,
916 			"Unable to initialize rate scaling for station %pM.\n",
917 			addr);
918 		return -ENOMEM;
919 	}
920 
921 	ret = iwl_send_lq_cmd(priv, ctx, link_cmd, 0, true);
922 	if (ret)
923 		IWL_ERR(priv, "Link quality command failed (%d)\n", ret);
924 
925 	spin_lock_bh(&priv->sta_lock);
926 	priv->stations[sta_id].lq = link_cmd;
927 	spin_unlock_bh(&priv->sta_lock);
928 
929 	return 0;
930 }
931 
932 /*
933  * static WEP keys
934  *
935  * For each context, the device has a table of 4 static WEP keys
936  * (one for each key index) that is updated with the following
937  * commands.
938  */
939 
940 static int iwl_send_static_wepkey_cmd(struct iwl_priv *priv,
941 				      struct iwl_rxon_context *ctx,
942 				      bool send_if_empty)
943 {
944 	int i, not_empty = 0;
945 	u8 buff[sizeof(struct iwl_wep_cmd) +
946 		sizeof(struct iwl_wep_key) * WEP_KEYS_MAX];
947 	struct iwl_wep_cmd *wep_cmd = (struct iwl_wep_cmd *)buff;
948 	size_t cmd_size  = sizeof(struct iwl_wep_cmd);
949 	struct iwl_host_cmd cmd = {
950 		.id = ctx->wep_key_cmd,
951 		.data = { wep_cmd, },
952 	};
953 
954 	might_sleep();
955 
956 	memset(wep_cmd, 0, cmd_size +
957 			(sizeof(struct iwl_wep_key) * WEP_KEYS_MAX));
958 
959 	for (i = 0; i < WEP_KEYS_MAX ; i++) {
960 		wep_cmd->key[i].key_index = i;
961 		if (ctx->wep_keys[i].key_size) {
962 			wep_cmd->key[i].key_offset = i;
963 			not_empty = 1;
964 		} else {
965 			wep_cmd->key[i].key_offset = WEP_INVALID_OFFSET;
966 		}
967 
968 		wep_cmd->key[i].key_size = ctx->wep_keys[i].key_size;
969 		memcpy(&wep_cmd->key[i].key[3], ctx->wep_keys[i].key,
970 				ctx->wep_keys[i].key_size);
971 	}
972 
973 	wep_cmd->global_key_type = WEP_KEY_WEP_TYPE;
974 	wep_cmd->num_keys = WEP_KEYS_MAX;
975 
976 	cmd_size += sizeof(struct iwl_wep_key) * WEP_KEYS_MAX;
977 
978 	cmd.len[0] = cmd_size;
979 
980 	if (not_empty || send_if_empty)
981 		return iwl_dvm_send_cmd(priv, &cmd);
982 	else
983 		return 0;
984 }
985 
986 int iwl_restore_default_wep_keys(struct iwl_priv *priv,
987 				 struct iwl_rxon_context *ctx)
988 {
989 	lockdep_assert_held(&priv->mutex);
990 
991 	return iwl_send_static_wepkey_cmd(priv, ctx, false);
992 }
993 
994 int iwl_remove_default_wep_key(struct iwl_priv *priv,
995 			       struct iwl_rxon_context *ctx,
996 			       struct ieee80211_key_conf *keyconf)
997 {
998 	int ret;
999 
1000 	lockdep_assert_held(&priv->mutex);
1001 
1002 	IWL_DEBUG_WEP(priv, "Removing default WEP key: idx=%d\n",
1003 		      keyconf->keyidx);
1004 
1005 	memset(&ctx->wep_keys[keyconf->keyidx], 0, sizeof(ctx->wep_keys[0]));
1006 	if (iwl_is_rfkill(priv)) {
1007 		IWL_DEBUG_WEP(priv,
1008 			"Not sending REPLY_WEPKEY command due to RFKILL.\n");
1009 		/* but keys in device are clear anyway so return success */
1010 		return 0;
1011 	}
1012 	ret = iwl_send_static_wepkey_cmd(priv, ctx, 1);
1013 	IWL_DEBUG_WEP(priv, "Remove default WEP key: idx=%d ret=%d\n",
1014 		      keyconf->keyidx, ret);
1015 
1016 	return ret;
1017 }
1018 
1019 int iwl_set_default_wep_key(struct iwl_priv *priv,
1020 			    struct iwl_rxon_context *ctx,
1021 			    struct ieee80211_key_conf *keyconf)
1022 {
1023 	int ret;
1024 
1025 	lockdep_assert_held(&priv->mutex);
1026 
1027 	if (keyconf->keylen != WEP_KEY_LEN_128 &&
1028 	    keyconf->keylen != WEP_KEY_LEN_64) {
1029 		IWL_DEBUG_WEP(priv,
1030 			      "Bad WEP key length %d\n", keyconf->keylen);
1031 		return -EINVAL;
1032 	}
1033 
1034 	keyconf->hw_key_idx = IWLAGN_HW_KEY_DEFAULT;
1035 
1036 	ctx->wep_keys[keyconf->keyidx].key_size = keyconf->keylen;
1037 	memcpy(&ctx->wep_keys[keyconf->keyidx].key, &keyconf->key,
1038 							keyconf->keylen);
1039 
1040 	ret = iwl_send_static_wepkey_cmd(priv, ctx, false);
1041 	IWL_DEBUG_WEP(priv, "Set default WEP key: len=%d idx=%d ret=%d\n",
1042 		keyconf->keylen, keyconf->keyidx, ret);
1043 
1044 	return ret;
1045 }
1046 
1047 /*
1048  * dynamic (per-station) keys
1049  *
1050  * The dynamic keys are a little more complicated. The device has
1051  * a key cache of up to STA_KEY_MAX_NUM/STA_KEY_MAX_NUM_PAN keys.
1052  * These are linked to stations by a table that contains an index
1053  * into the key table for each station/key index/{mcast,unicast},
1054  * i.e. it's basically an array of pointers like this:
1055  *	key_offset_t key_mapping[NUM_STATIONS][4][2];
1056  * (it really works differently, but you can think of it as such)
1057  *
1058  * The key uploading and linking happens in the same command, the
1059  * add station command with STA_MODIFY_KEY_MASK.
1060  */
1061 
1062 static u8 iwlagn_key_sta_id(struct iwl_priv *priv,
1063 			    struct ieee80211_vif *vif,
1064 			    struct ieee80211_sta *sta)
1065 {
1066 	struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
1067 
1068 	if (sta)
1069 		return iwl_sta_id(sta);
1070 
1071 	/*
1072 	 * The device expects GTKs for station interfaces to be
1073 	 * installed as GTKs for the AP station. If we have no
1074 	 * station ID, then use the ap_sta_id in that case.
1075 	 */
1076 	if (vif->type == NL80211_IFTYPE_STATION && vif_priv->ctx)
1077 		return vif_priv->ctx->ap_sta_id;
1078 
1079 	return IWL_INVALID_STATION;
1080 }
1081 
1082 static int iwlagn_send_sta_key(struct iwl_priv *priv,
1083 			       struct ieee80211_key_conf *keyconf,
1084 			       u8 sta_id, u32 tkip_iv32, u16 *tkip_p1k,
1085 			       u32 cmd_flags)
1086 {
1087 	__le16 key_flags;
1088 	struct iwl_addsta_cmd sta_cmd;
1089 	int i;
1090 
1091 	spin_lock_bh(&priv->sta_lock);
1092 	memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(sta_cmd));
1093 	spin_unlock_bh(&priv->sta_lock);
1094 
1095 	key_flags = cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
1096 	key_flags |= STA_KEY_FLG_MAP_KEY_MSK;
1097 
1098 	switch (keyconf->cipher) {
1099 	case WLAN_CIPHER_SUITE_CCMP:
1100 		key_flags |= STA_KEY_FLG_CCMP;
1101 		memcpy(sta_cmd.key.key, keyconf->key, keyconf->keylen);
1102 		break;
1103 	case WLAN_CIPHER_SUITE_TKIP:
1104 		key_flags |= STA_KEY_FLG_TKIP;
1105 		sta_cmd.key.tkip_rx_tsc_byte2 = tkip_iv32;
1106 		for (i = 0; i < 5; i++)
1107 			sta_cmd.key.tkip_rx_ttak[i] = cpu_to_le16(tkip_p1k[i]);
1108 		memcpy(sta_cmd.key.key, keyconf->key, keyconf->keylen);
1109 		break;
1110 	case WLAN_CIPHER_SUITE_WEP104:
1111 		key_flags |= STA_KEY_FLG_KEY_SIZE_MSK;
1112 		/* fall through */
1113 	case WLAN_CIPHER_SUITE_WEP40:
1114 		key_flags |= STA_KEY_FLG_WEP;
1115 		memcpy(&sta_cmd.key.key[3], keyconf->key, keyconf->keylen);
1116 		break;
1117 	default:
1118 		WARN_ON(1);
1119 		return -EINVAL;
1120 	}
1121 
1122 	if (!(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE))
1123 		key_flags |= STA_KEY_MULTICAST_MSK;
1124 
1125 	/* key pointer (offset) */
1126 	sta_cmd.key.key_offset = keyconf->hw_key_idx;
1127 
1128 	sta_cmd.key.key_flags = key_flags;
1129 	sta_cmd.mode = STA_CONTROL_MODIFY_MSK;
1130 	sta_cmd.sta.modify_mask = STA_MODIFY_KEY_MASK;
1131 
1132 	return iwl_send_add_sta(priv, &sta_cmd, cmd_flags);
1133 }
1134 
1135 void iwl_update_tkip_key(struct iwl_priv *priv,
1136 			 struct ieee80211_vif *vif,
1137 			 struct ieee80211_key_conf *keyconf,
1138 			 struct ieee80211_sta *sta, u32 iv32, u16 *phase1key)
1139 {
1140 	u8 sta_id = iwlagn_key_sta_id(priv, vif, sta);
1141 
1142 	if (sta_id == IWL_INVALID_STATION)
1143 		return;
1144 
1145 	if (iwl_scan_cancel(priv)) {
1146 		/* cancel scan failed, just live w/ bad key and rely
1147 		   briefly on SW decryption */
1148 		return;
1149 	}
1150 
1151 	iwlagn_send_sta_key(priv, keyconf, sta_id,
1152 			    iv32, phase1key, CMD_ASYNC);
1153 }
1154 
1155 int iwl_remove_dynamic_key(struct iwl_priv *priv,
1156 			   struct iwl_rxon_context *ctx,
1157 			   struct ieee80211_key_conf *keyconf,
1158 			   struct ieee80211_sta *sta)
1159 {
1160 	struct iwl_addsta_cmd sta_cmd;
1161 	u8 sta_id = iwlagn_key_sta_id(priv, ctx->vif, sta);
1162 	__le16 key_flags;
1163 
1164 	/* if station isn't there, neither is the key */
1165 	if (sta_id == IWL_INVALID_STATION)
1166 		return -ENOENT;
1167 
1168 	spin_lock_bh(&priv->sta_lock);
1169 	memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(sta_cmd));
1170 	if (!(priv->stations[sta_id].used & IWL_STA_UCODE_ACTIVE))
1171 		sta_id = IWL_INVALID_STATION;
1172 	spin_unlock_bh(&priv->sta_lock);
1173 
1174 	if (sta_id == IWL_INVALID_STATION)
1175 		return 0;
1176 
1177 	lockdep_assert_held(&priv->mutex);
1178 
1179 	ctx->key_mapping_keys--;
1180 
1181 	IWL_DEBUG_WEP(priv, "Remove dynamic key: idx=%d sta=%d\n",
1182 		      keyconf->keyidx, sta_id);
1183 
1184 	if (!test_and_clear_bit(keyconf->hw_key_idx, &priv->ucode_key_table))
1185 		IWL_ERR(priv, "offset %d not used in uCode key table.\n",
1186 			keyconf->hw_key_idx);
1187 
1188 	key_flags = cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
1189 	key_flags |= STA_KEY_FLG_MAP_KEY_MSK | STA_KEY_FLG_NO_ENC |
1190 		     STA_KEY_FLG_INVALID;
1191 
1192 	if (!(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE))
1193 		key_flags |= STA_KEY_MULTICAST_MSK;
1194 
1195 	sta_cmd.key.key_flags = key_flags;
1196 	sta_cmd.key.key_offset = keyconf->hw_key_idx;
1197 	sta_cmd.sta.modify_mask = STA_MODIFY_KEY_MASK;
1198 	sta_cmd.mode = STA_CONTROL_MODIFY_MSK;
1199 
1200 	return iwl_send_add_sta(priv, &sta_cmd, 0);
1201 }
1202 
1203 int iwl_set_dynamic_key(struct iwl_priv *priv,
1204 			struct iwl_rxon_context *ctx,
1205 			struct ieee80211_key_conf *keyconf,
1206 			struct ieee80211_sta *sta)
1207 {
1208 	struct ieee80211_key_seq seq;
1209 	u16 p1k[5];
1210 	int ret;
1211 	u8 sta_id = iwlagn_key_sta_id(priv, ctx->vif, sta);
1212 	const u8 *addr;
1213 
1214 	if (sta_id == IWL_INVALID_STATION)
1215 		return -EINVAL;
1216 
1217 	lockdep_assert_held(&priv->mutex);
1218 
1219 	keyconf->hw_key_idx = iwl_get_free_ucode_key_offset(priv);
1220 	if (keyconf->hw_key_idx == WEP_INVALID_OFFSET)
1221 		return -ENOSPC;
1222 
1223 	ctx->key_mapping_keys++;
1224 
1225 	switch (keyconf->cipher) {
1226 	case WLAN_CIPHER_SUITE_TKIP:
1227 		if (sta)
1228 			addr = sta->addr;
1229 		else /* station mode case only */
1230 			addr = ctx->active.bssid_addr;
1231 
1232 		/* pre-fill phase 1 key into device cache */
1233 		ieee80211_get_key_rx_seq(keyconf, 0, &seq);
1234 		ieee80211_get_tkip_rx_p1k(keyconf, addr, seq.tkip.iv32, p1k);
1235 		ret = iwlagn_send_sta_key(priv, keyconf, sta_id,
1236 					  seq.tkip.iv32, p1k, 0);
1237 		break;
1238 	case WLAN_CIPHER_SUITE_CCMP:
1239 	case WLAN_CIPHER_SUITE_WEP40:
1240 	case WLAN_CIPHER_SUITE_WEP104:
1241 		ret = iwlagn_send_sta_key(priv, keyconf, sta_id,
1242 					  0, NULL, 0);
1243 		break;
1244 	default:
1245 		IWL_ERR(priv, "Unknown cipher %x\n", keyconf->cipher);
1246 		ret = -EINVAL;
1247 	}
1248 
1249 	if (ret) {
1250 		ctx->key_mapping_keys--;
1251 		clear_bit(keyconf->hw_key_idx, &priv->ucode_key_table);
1252 	}
1253 
1254 	IWL_DEBUG_WEP(priv, "Set dynamic key: cipher=%x len=%d idx=%d sta=%pM ret=%d\n",
1255 		      keyconf->cipher, keyconf->keylen, keyconf->keyidx,
1256 		      sta ? sta->addr : NULL, ret);
1257 
1258 	return ret;
1259 }
1260 
1261 /**
1262  * iwlagn_alloc_bcast_station - add broadcast station into driver's station table.
1263  *
1264  * This adds the broadcast station into the driver's station table
1265  * and marks it driver active, so that it will be restored to the
1266  * device at the next best time.
1267  */
1268 int iwlagn_alloc_bcast_station(struct iwl_priv *priv,
1269 			       struct iwl_rxon_context *ctx)
1270 {
1271 	struct iwl_link_quality_cmd *link_cmd;
1272 	u8 sta_id;
1273 
1274 	spin_lock_bh(&priv->sta_lock);
1275 	sta_id = iwl_prep_station(priv, ctx, iwl_bcast_addr, false, NULL);
1276 	if (sta_id == IWL_INVALID_STATION) {
1277 		IWL_ERR(priv, "Unable to prepare broadcast station\n");
1278 		spin_unlock_bh(&priv->sta_lock);
1279 
1280 		return -EINVAL;
1281 	}
1282 
1283 	priv->stations[sta_id].used |= IWL_STA_DRIVER_ACTIVE;
1284 	priv->stations[sta_id].used |= IWL_STA_BCAST;
1285 	spin_unlock_bh(&priv->sta_lock);
1286 
1287 	link_cmd = iwl_sta_alloc_lq(priv, ctx, sta_id);
1288 	if (!link_cmd) {
1289 		IWL_ERR(priv,
1290 			"Unable to initialize rate scaling for bcast station.\n");
1291 		return -ENOMEM;
1292 	}
1293 
1294 	spin_lock_bh(&priv->sta_lock);
1295 	priv->stations[sta_id].lq = link_cmd;
1296 	spin_unlock_bh(&priv->sta_lock);
1297 
1298 	return 0;
1299 }
1300 
1301 /**
1302  * iwl_update_bcast_station - update broadcast station's LQ command
1303  *
1304  * Only used by iwlagn. Placed here to have all bcast station management
1305  * code together.
1306  */
1307 int iwl_update_bcast_station(struct iwl_priv *priv,
1308 			     struct iwl_rxon_context *ctx)
1309 {
1310 	struct iwl_link_quality_cmd *link_cmd;
1311 	u8 sta_id = ctx->bcast_sta_id;
1312 
1313 	link_cmd = iwl_sta_alloc_lq(priv, ctx, sta_id);
1314 	if (!link_cmd) {
1315 		IWL_ERR(priv, "Unable to initialize rate scaling for bcast station.\n");
1316 		return -ENOMEM;
1317 	}
1318 
1319 	spin_lock_bh(&priv->sta_lock);
1320 	if (priv->stations[sta_id].lq)
1321 		kfree(priv->stations[sta_id].lq);
1322 	else
1323 		IWL_DEBUG_INFO(priv, "Bcast station rate scaling has not been initialized yet.\n");
1324 	priv->stations[sta_id].lq = link_cmd;
1325 	spin_unlock_bh(&priv->sta_lock);
1326 
1327 	return 0;
1328 }
1329 
1330 int iwl_update_bcast_stations(struct iwl_priv *priv)
1331 {
1332 	struct iwl_rxon_context *ctx;
1333 	int ret = 0;
1334 
1335 	for_each_context(priv, ctx) {
1336 		ret = iwl_update_bcast_station(priv, ctx);
1337 		if (ret)
1338 			break;
1339 	}
1340 
1341 	return ret;
1342 }
1343 
1344 /**
1345  * iwl_sta_tx_modify_enable_tid - Enable Tx for this TID in station table
1346  */
1347 int iwl_sta_tx_modify_enable_tid(struct iwl_priv *priv, int sta_id, int tid)
1348 {
1349 	struct iwl_addsta_cmd sta_cmd;
1350 
1351 	lockdep_assert_held(&priv->mutex);
1352 
1353 	/* Remove "disable" flag, to enable Tx for this TID */
1354 	spin_lock_bh(&priv->sta_lock);
1355 	priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_TID_DISABLE_TX;
1356 	priv->stations[sta_id].sta.tid_disable_tx &= cpu_to_le16(~(1 << tid));
1357 	priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
1358 	memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
1359 	spin_unlock_bh(&priv->sta_lock);
1360 
1361 	return iwl_send_add_sta(priv, &sta_cmd, 0);
1362 }
1363 
1364 int iwl_sta_rx_agg_start(struct iwl_priv *priv, struct ieee80211_sta *sta,
1365 			 int tid, u16 ssn)
1366 {
1367 	int sta_id;
1368 	struct iwl_addsta_cmd sta_cmd;
1369 
1370 	lockdep_assert_held(&priv->mutex);
1371 
1372 	sta_id = iwl_sta_id(sta);
1373 	if (sta_id == IWL_INVALID_STATION)
1374 		return -ENXIO;
1375 
1376 	spin_lock_bh(&priv->sta_lock);
1377 	priv->stations[sta_id].sta.station_flags_msk = 0;
1378 	priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_ADDBA_TID_MSK;
1379 	priv->stations[sta_id].sta.add_immediate_ba_tid = (u8)tid;
1380 	priv->stations[sta_id].sta.add_immediate_ba_ssn = cpu_to_le16(ssn);
1381 	priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
1382 	memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
1383 	spin_unlock_bh(&priv->sta_lock);
1384 
1385 	return iwl_send_add_sta(priv, &sta_cmd, 0);
1386 }
1387 
1388 int iwl_sta_rx_agg_stop(struct iwl_priv *priv, struct ieee80211_sta *sta,
1389 			int tid)
1390 {
1391 	int sta_id;
1392 	struct iwl_addsta_cmd sta_cmd;
1393 
1394 	lockdep_assert_held(&priv->mutex);
1395 
1396 	sta_id = iwl_sta_id(sta);
1397 	if (sta_id == IWL_INVALID_STATION) {
1398 		IWL_ERR(priv, "Invalid station for AGG tid %d\n", tid);
1399 		return -ENXIO;
1400 	}
1401 
1402 	spin_lock_bh(&priv->sta_lock);
1403 	priv->stations[sta_id].sta.station_flags_msk = 0;
1404 	priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_DELBA_TID_MSK;
1405 	priv->stations[sta_id].sta.remove_immediate_ba_tid = (u8)tid;
1406 	priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
1407 	memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
1408 	spin_unlock_bh(&priv->sta_lock);
1409 
1410 	return iwl_send_add_sta(priv, &sta_cmd, 0);
1411 }
1412 
1413 
1414 
1415 void iwl_sta_modify_sleep_tx_count(struct iwl_priv *priv, int sta_id, int cnt)
1416 {
1417 	struct iwl_addsta_cmd cmd = {
1418 		.mode = STA_CONTROL_MODIFY_MSK,
1419 		.station_flags = STA_FLG_PWR_SAVE_MSK,
1420 		.station_flags_msk = STA_FLG_PWR_SAVE_MSK,
1421 		.sta.sta_id = sta_id,
1422 		.sta.modify_mask = STA_MODIFY_SLEEP_TX_COUNT_MSK,
1423 		.sleep_tx_count = cpu_to_le16(cnt),
1424 	};
1425 
1426 	iwl_send_add_sta(priv, &cmd, CMD_ASYNC);
1427 }
1428