1 /******************************************************************************
2  *
3  * This file is provided under a dual BSD/GPLv2 license.  When using or
4  * redistributing this file, you may do so under either license.
5  *
6  * GPL LICENSE SUMMARY
7  *
8  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
9  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
10  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
11  * Copyright(c) 2018 - 2019 Intel Corporation
12  *
13  * This program is free software; you can redistribute it and/or modify
14  * it under the terms of version 2 of the GNU General Public License as
15  * published by the Free Software Foundation.
16  *
17  * This program is distributed in the hope that it will be useful, but
18  * WITHOUT ANY WARRANTY; without even the implied warranty of
19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
20  * General Public License for more details.
21  *
22  * The full GNU General Public License is included in this distribution
23  * in the file called COPYING.
24  *
25  * Contact Information:
26  *  Intel Linux Wireless <linuxwifi@intel.com>
27  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
28  *
29  * BSD LICENSE
30  *
31  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
32  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
33  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
34  * Copyright(c) 2018 - 2019 Intel Corporation
35  * All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  *
41  *  * Redistributions of source code must retain the above copyright
42  *    notice, this list of conditions and the following disclaimer.
43  *  * Redistributions in binary form must reproduce the above copyright
44  *    notice, this list of conditions and the following disclaimer in
45  *    the documentation and/or other materials provided with the
46  *    distribution.
47  *  * Neither the name Intel Corporation nor the names of its
48  *    contributors may be used to endorse or promote products derived
49  *    from this software without specific prior written permission.
50  *
51  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
52  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
53  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
54  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
55  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
56  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
57  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
58  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
59  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
60  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
61  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
62  *
63  *****************************************************************************/
64 #include <linux/kernel.h>
65 #include <linux/slab.h>
66 #include <linux/skbuff.h>
67 #include <linux/netdevice.h>
68 #include <linux/etherdevice.h>
69 #include <linux/ip.h>
70 #include <linux/if_arp.h>
71 #include <linux/time.h>
72 #include <net/mac80211.h>
73 #include <net/ieee80211_radiotap.h>
74 #include <net/tcp.h>
75 
76 #include "iwl-op-mode.h"
77 #include "iwl-io.h"
78 #include "mvm.h"
79 #include "sta.h"
80 #include "time-event.h"
81 #include "iwl-eeprom-parse.h"
82 #include "iwl-phy-db.h"
83 #include "testmode.h"
84 #include "fw/error-dump.h"
85 #include "iwl-prph.h"
86 #include "iwl-nvm-parse.h"
87 
88 static const struct ieee80211_iface_limit iwl_mvm_limits[] = {
89 	{
90 		.max = 1,
91 		.types = BIT(NL80211_IFTYPE_STATION),
92 	},
93 	{
94 		.max = 1,
95 		.types = BIT(NL80211_IFTYPE_AP) |
96 			BIT(NL80211_IFTYPE_P2P_CLIENT) |
97 			BIT(NL80211_IFTYPE_P2P_GO),
98 	},
99 	{
100 		.max = 1,
101 		.types = BIT(NL80211_IFTYPE_P2P_DEVICE),
102 	},
103 };
104 
105 static const struct ieee80211_iface_combination iwl_mvm_iface_combinations[] = {
106 	{
107 		.num_different_channels = 2,
108 		.max_interfaces = 3,
109 		.limits = iwl_mvm_limits,
110 		.n_limits = ARRAY_SIZE(iwl_mvm_limits),
111 	},
112 };
113 
114 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
115 /*
116  * Use the reserved field to indicate magic values.
117  * these values will only be used internally by the driver,
118  * and won't make it to the fw (reserved will be 0).
119  * BC_FILTER_MAGIC_IP - configure the val of this attribute to
120  *	be the vif's ip address. in case there is not a single
121  *	ip address (0, or more than 1), this attribute will
122  *	be skipped.
123  * BC_FILTER_MAGIC_MAC - set the val of this attribute to
124  *	the LSB bytes of the vif's mac address
125  */
126 enum {
127 	BC_FILTER_MAGIC_NONE = 0,
128 	BC_FILTER_MAGIC_IP,
129 	BC_FILTER_MAGIC_MAC,
130 };
131 
132 static const struct iwl_fw_bcast_filter iwl_mvm_default_bcast_filters[] = {
133 	{
134 		/* arp */
135 		.discard = 0,
136 		.frame_type = BCAST_FILTER_FRAME_TYPE_ALL,
137 		.attrs = {
138 			{
139 				/* frame type - arp, hw type - ethernet */
140 				.offset_type =
141 					BCAST_FILTER_OFFSET_PAYLOAD_START,
142 				.offset = sizeof(rfc1042_header),
143 				.val = cpu_to_be32(0x08060001),
144 				.mask = cpu_to_be32(0xffffffff),
145 			},
146 			{
147 				/* arp dest ip */
148 				.offset_type =
149 					BCAST_FILTER_OFFSET_PAYLOAD_START,
150 				.offset = sizeof(rfc1042_header) + 2 +
151 					  sizeof(struct arphdr) +
152 					  ETH_ALEN + sizeof(__be32) +
153 					  ETH_ALEN,
154 				.mask = cpu_to_be32(0xffffffff),
155 				/* mark it as special field */
156 				.reserved1 = cpu_to_le16(BC_FILTER_MAGIC_IP),
157 			},
158 		},
159 	},
160 	{
161 		/* dhcp offer bcast */
162 		.discard = 0,
163 		.frame_type = BCAST_FILTER_FRAME_TYPE_IPV4,
164 		.attrs = {
165 			{
166 				/* udp dest port - 68 (bootp client)*/
167 				.offset_type = BCAST_FILTER_OFFSET_IP_END,
168 				.offset = offsetof(struct udphdr, dest),
169 				.val = cpu_to_be32(0x00440000),
170 				.mask = cpu_to_be32(0xffff0000),
171 			},
172 			{
173 				/* dhcp - lsb bytes of client hw address */
174 				.offset_type = BCAST_FILTER_OFFSET_IP_END,
175 				.offset = 38,
176 				.mask = cpu_to_be32(0xffffffff),
177 				/* mark it as special field */
178 				.reserved1 = cpu_to_le16(BC_FILTER_MAGIC_MAC),
179 			},
180 		},
181 	},
182 	/* last filter must be empty */
183 	{},
184 };
185 #endif
186 
187 static const struct cfg80211_pmsr_capabilities iwl_mvm_pmsr_capa = {
188 	.max_peers = IWL_MVM_TOF_MAX_APS,
189 	.report_ap_tsf = 1,
190 	.randomize_mac_addr = 1,
191 
192 	.ftm = {
193 		.supported = 1,
194 		.asap = 1,
195 		.non_asap = 1,
196 		.request_lci = 1,
197 		.request_civicloc = 1,
198 		.max_bursts_exponent = -1, /* all supported */
199 		.max_ftms_per_burst = 0, /* no limits */
200 		.bandwidths = BIT(NL80211_CHAN_WIDTH_20_NOHT) |
201 			      BIT(NL80211_CHAN_WIDTH_20) |
202 			      BIT(NL80211_CHAN_WIDTH_40) |
203 			      BIT(NL80211_CHAN_WIDTH_80),
204 		.preambles = BIT(NL80211_PREAMBLE_LEGACY) |
205 			     BIT(NL80211_PREAMBLE_HT) |
206 			     BIT(NL80211_PREAMBLE_VHT),
207 	},
208 };
209 
210 void iwl_mvm_ref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
211 {
212 	if (!iwl_mvm_is_d0i3_supported(mvm))
213 		return;
214 
215 	IWL_DEBUG_RPM(mvm, "Take mvm reference - type %d\n", ref_type);
216 	spin_lock_bh(&mvm->refs_lock);
217 	mvm->refs[ref_type]++;
218 	spin_unlock_bh(&mvm->refs_lock);
219 	iwl_trans_ref(mvm->trans);
220 }
221 
222 void iwl_mvm_unref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
223 {
224 	if (!iwl_mvm_is_d0i3_supported(mvm))
225 		return;
226 
227 	IWL_DEBUG_RPM(mvm, "Leave mvm reference - type %d\n", ref_type);
228 	spin_lock_bh(&mvm->refs_lock);
229 	if (WARN_ON(!mvm->refs[ref_type])) {
230 		spin_unlock_bh(&mvm->refs_lock);
231 		return;
232 	}
233 	mvm->refs[ref_type]--;
234 	spin_unlock_bh(&mvm->refs_lock);
235 	iwl_trans_unref(mvm->trans);
236 }
237 
238 static void iwl_mvm_unref_all_except(struct iwl_mvm *mvm,
239 				     enum iwl_mvm_ref_type except_ref)
240 {
241 	int i, j;
242 
243 	if (!iwl_mvm_is_d0i3_supported(mvm))
244 		return;
245 
246 	spin_lock_bh(&mvm->refs_lock);
247 	for (i = 0; i < IWL_MVM_REF_COUNT; i++) {
248 		if (except_ref == i || !mvm->refs[i])
249 			continue;
250 
251 		IWL_DEBUG_RPM(mvm, "Cleanup: remove mvm ref type %d (%d)\n",
252 			      i, mvm->refs[i]);
253 		for (j = 0; j < mvm->refs[i]; j++)
254 			iwl_trans_unref(mvm->trans);
255 		mvm->refs[i] = 0;
256 	}
257 	spin_unlock_bh(&mvm->refs_lock);
258 }
259 
260 bool iwl_mvm_ref_taken(struct iwl_mvm *mvm)
261 {
262 	int i;
263 	bool taken = false;
264 
265 	if (!iwl_mvm_is_d0i3_supported(mvm))
266 		return true;
267 
268 	spin_lock_bh(&mvm->refs_lock);
269 	for (i = 0; i < IWL_MVM_REF_COUNT; i++) {
270 		if (mvm->refs[i]) {
271 			taken = true;
272 			break;
273 		}
274 	}
275 	spin_unlock_bh(&mvm->refs_lock);
276 
277 	return taken;
278 }
279 
280 int iwl_mvm_ref_sync(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
281 {
282 	iwl_mvm_ref(mvm, ref_type);
283 
284 	if (!wait_event_timeout(mvm->d0i3_exit_waitq,
285 				!test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status),
286 				HZ)) {
287 		WARN_ON_ONCE(1);
288 		iwl_mvm_unref(mvm, ref_type);
289 		return -EIO;
290 	}
291 
292 	return 0;
293 }
294 
295 static void iwl_mvm_reset_phy_ctxts(struct iwl_mvm *mvm)
296 {
297 	int i;
298 
299 	memset(mvm->phy_ctxts, 0, sizeof(mvm->phy_ctxts));
300 	for (i = 0; i < NUM_PHY_CTX; i++) {
301 		mvm->phy_ctxts[i].id = i;
302 		mvm->phy_ctxts[i].ref = 0;
303 	}
304 }
305 
306 struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
307 						  const char *alpha2,
308 						  enum iwl_mcc_source src_id,
309 						  bool *changed)
310 {
311 	struct ieee80211_regdomain *regd = NULL;
312 	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
313 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
314 	struct iwl_mcc_update_resp *resp;
315 
316 	IWL_DEBUG_LAR(mvm, "Getting regdomain data for %s from FW\n", alpha2);
317 
318 	lockdep_assert_held(&mvm->mutex);
319 
320 	resp = iwl_mvm_update_mcc(mvm, alpha2, src_id);
321 	if (IS_ERR_OR_NULL(resp)) {
322 		IWL_DEBUG_LAR(mvm, "Could not get update from FW %d\n",
323 			      PTR_ERR_OR_ZERO(resp));
324 		goto out;
325 	}
326 
327 	if (changed) {
328 		u32 status = le32_to_cpu(resp->status);
329 
330 		*changed = (status == MCC_RESP_NEW_CHAN_PROFILE ||
331 			    status == MCC_RESP_ILLEGAL);
332 	}
333 
334 	regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg,
335 				      __le32_to_cpu(resp->n_channels),
336 				      resp->channels,
337 				      __le16_to_cpu(resp->mcc),
338 				      __le16_to_cpu(resp->geo_info));
339 	/* Store the return source id */
340 	src_id = resp->source_id;
341 	kfree(resp);
342 	if (IS_ERR_OR_NULL(regd)) {
343 		IWL_DEBUG_LAR(mvm, "Could not get parse update from FW %d\n",
344 			      PTR_ERR_OR_ZERO(regd));
345 		goto out;
346 	}
347 
348 	IWL_DEBUG_LAR(mvm, "setting alpha2 from FW to %s (0x%x, 0x%x) src=%d\n",
349 		      regd->alpha2, regd->alpha2[0], regd->alpha2[1], src_id);
350 	mvm->lar_regdom_set = true;
351 	mvm->mcc_src = src_id;
352 
353 out:
354 	return regd;
355 }
356 
357 void iwl_mvm_update_changed_regdom(struct iwl_mvm *mvm)
358 {
359 	bool changed;
360 	struct ieee80211_regdomain *regd;
361 
362 	if (!iwl_mvm_is_lar_supported(mvm))
363 		return;
364 
365 	regd = iwl_mvm_get_current_regdomain(mvm, &changed);
366 	if (!IS_ERR_OR_NULL(regd)) {
367 		/* only update the regulatory core if changed */
368 		if (changed)
369 			regulatory_set_wiphy_regd(mvm->hw->wiphy, regd);
370 
371 		kfree(regd);
372 	}
373 }
374 
375 struct ieee80211_regdomain *iwl_mvm_get_current_regdomain(struct iwl_mvm *mvm,
376 							  bool *changed)
377 {
378 	return iwl_mvm_get_regdomain(mvm->hw->wiphy, "ZZ",
379 				     iwl_mvm_is_wifi_mcc_supported(mvm) ?
380 				     MCC_SOURCE_GET_CURRENT :
381 				     MCC_SOURCE_OLD_FW, changed);
382 }
383 
384 int iwl_mvm_init_fw_regd(struct iwl_mvm *mvm)
385 {
386 	enum iwl_mcc_source used_src;
387 	struct ieee80211_regdomain *regd;
388 	int ret;
389 	bool changed;
390 	const struct ieee80211_regdomain *r =
391 			rtnl_dereference(mvm->hw->wiphy->regd);
392 
393 	if (!r)
394 		return -ENOENT;
395 
396 	/* save the last source in case we overwrite it below */
397 	used_src = mvm->mcc_src;
398 	if (iwl_mvm_is_wifi_mcc_supported(mvm)) {
399 		/* Notify the firmware we support wifi location updates */
400 		regd = iwl_mvm_get_current_regdomain(mvm, NULL);
401 		if (!IS_ERR_OR_NULL(regd))
402 			kfree(regd);
403 	}
404 
405 	/* Now set our last stored MCC and source */
406 	regd = iwl_mvm_get_regdomain(mvm->hw->wiphy, r->alpha2, used_src,
407 				     &changed);
408 	if (IS_ERR_OR_NULL(regd))
409 		return -EIO;
410 
411 	/* update cfg80211 if the regdomain was changed */
412 	if (changed)
413 		ret = regulatory_set_wiphy_regd_sync_rtnl(mvm->hw->wiphy, regd);
414 	else
415 		ret = 0;
416 
417 	kfree(regd);
418 	return ret;
419 }
420 
421 const static u8 he_if_types_ext_capa_sta[] = {
422 	 [0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
423 	 [2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
424 	 [7] = WLAN_EXT_CAPA8_OPMODE_NOTIF,
425 	 [9] = WLAN_EXT_CAPA10_TWT_REQUESTER_SUPPORT,
426 };
427 
428 const static struct wiphy_iftype_ext_capab he_iftypes_ext_capa[] = {
429 	{
430 		.iftype = NL80211_IFTYPE_STATION,
431 		.extended_capabilities = he_if_types_ext_capa_sta,
432 		.extended_capabilities_mask = he_if_types_ext_capa_sta,
433 		.extended_capabilities_len = sizeof(he_if_types_ext_capa_sta),
434 	},
435 };
436 
437 int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
438 {
439 	struct ieee80211_hw *hw = mvm->hw;
440 	int num_mac, ret, i;
441 	static const u32 mvm_ciphers[] = {
442 		WLAN_CIPHER_SUITE_WEP40,
443 		WLAN_CIPHER_SUITE_WEP104,
444 		WLAN_CIPHER_SUITE_TKIP,
445 		WLAN_CIPHER_SUITE_CCMP,
446 	};
447 #ifdef CONFIG_PM_SLEEP
448 	bool unified = fw_has_capa(&mvm->fw->ucode_capa,
449 				   IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
450 #endif
451 
452 	/* Tell mac80211 our characteristics */
453 	ieee80211_hw_set(hw, SIGNAL_DBM);
454 	ieee80211_hw_set(hw, SPECTRUM_MGMT);
455 	ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
456 	ieee80211_hw_set(hw, WANT_MONITOR_VIF);
457 	ieee80211_hw_set(hw, SUPPORTS_PS);
458 	ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
459 	ieee80211_hw_set(hw, AMPDU_AGGREGATION);
460 	ieee80211_hw_set(hw, TIMING_BEACON_ONLY);
461 	ieee80211_hw_set(hw, CONNECTION_MONITOR);
462 	ieee80211_hw_set(hw, CHANCTX_STA_CSA);
463 	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
464 	ieee80211_hw_set(hw, SUPPORTS_CLONED_SKBS);
465 	ieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);
466 	ieee80211_hw_set(hw, NEEDS_UNIQUE_STA_ADDR);
467 	ieee80211_hw_set(hw, DEAUTH_NEED_MGD_TX_PREP);
468 	ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);
469 	ieee80211_hw_set(hw, BUFF_MMPDU_TXQ);
470 	ieee80211_hw_set(hw, STA_MMPDU_TXQ);
471 	ieee80211_hw_set(hw, TX_AMSDU);
472 	ieee80211_hw_set(hw, TX_FRAG_LIST);
473 
474 	if (iwl_mvm_has_tlc_offload(mvm)) {
475 		ieee80211_hw_set(hw, TX_AMPDU_SETUP_IN_HW);
476 		ieee80211_hw_set(hw, HAS_RATE_CONTROL);
477 	}
478 
479 	if (iwl_mvm_has_new_rx_api(mvm))
480 		ieee80211_hw_set(hw, SUPPORTS_REORDERING_BUFFER);
481 
482 	if (fw_has_capa(&mvm->fw->ucode_capa,
483 			IWL_UCODE_TLV_CAPA_STA_PM_NOTIF)) {
484 		ieee80211_hw_set(hw, AP_LINK_PS);
485 	} else if (WARN_ON(iwl_mvm_has_new_tx_api(mvm))) {
486 		/*
487 		 * we absolutely need this for the new TX API since that comes
488 		 * with many more queues than the current code can deal with
489 		 * for station powersave
490 		 */
491 		return -EINVAL;
492 	}
493 
494 	if (mvm->trans->num_rx_queues > 1)
495 		ieee80211_hw_set(hw, USES_RSS);
496 
497 	if (mvm->trans->max_skb_frags)
498 		hw->netdev_features = NETIF_F_HIGHDMA | NETIF_F_SG;
499 
500 	hw->queues = IEEE80211_MAX_QUEUES;
501 	hw->offchannel_tx_hw_queue = IWL_MVM_OFFCHANNEL_QUEUE;
502 	hw->radiotap_mcs_details |= IEEE80211_RADIOTAP_MCS_HAVE_FEC |
503 				    IEEE80211_RADIOTAP_MCS_HAVE_STBC;
504 	hw->radiotap_vht_details |= IEEE80211_RADIOTAP_VHT_KNOWN_STBC |
505 		IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED;
506 
507 	hw->radiotap_timestamp.units_pos =
508 		IEEE80211_RADIOTAP_TIMESTAMP_UNIT_US |
509 		IEEE80211_RADIOTAP_TIMESTAMP_SPOS_PLCP_SIG_ACQ;
510 	/* this is the case for CCK frames, it's better (only 8) for OFDM */
511 	hw->radiotap_timestamp.accuracy = 22;
512 
513 	if (!iwl_mvm_has_tlc_offload(mvm))
514 		hw->rate_control_algorithm = RS_NAME;
515 
516 	hw->uapsd_queues = IWL_MVM_UAPSD_QUEUES;
517 	hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
518 	hw->max_tx_fragments = mvm->trans->max_skb_frags;
519 
520 	BUILD_BUG_ON(ARRAY_SIZE(mvm->ciphers) < ARRAY_SIZE(mvm_ciphers) + 6);
521 	memcpy(mvm->ciphers, mvm_ciphers, sizeof(mvm_ciphers));
522 	hw->wiphy->n_cipher_suites = ARRAY_SIZE(mvm_ciphers);
523 	hw->wiphy->cipher_suites = mvm->ciphers;
524 
525 	if (iwl_mvm_has_new_rx_api(mvm)) {
526 		mvm->ciphers[hw->wiphy->n_cipher_suites] =
527 			WLAN_CIPHER_SUITE_GCMP;
528 		hw->wiphy->n_cipher_suites++;
529 		mvm->ciphers[hw->wiphy->n_cipher_suites] =
530 			WLAN_CIPHER_SUITE_GCMP_256;
531 		hw->wiphy->n_cipher_suites++;
532 	}
533 
534 	/* Enable 11w if software crypto is not enabled (as the
535 	 * firmware will interpret some mgmt packets, so enabling it
536 	 * with software crypto isn't safe).
537 	 */
538 	if (!iwlwifi_mod_params.swcrypto) {
539 		ieee80211_hw_set(hw, MFP_CAPABLE);
540 		mvm->ciphers[hw->wiphy->n_cipher_suites] =
541 			WLAN_CIPHER_SUITE_AES_CMAC;
542 		hw->wiphy->n_cipher_suites++;
543 		if (iwl_mvm_has_new_rx_api(mvm)) {
544 			mvm->ciphers[hw->wiphy->n_cipher_suites] =
545 				WLAN_CIPHER_SUITE_BIP_GMAC_128;
546 			hw->wiphy->n_cipher_suites++;
547 			mvm->ciphers[hw->wiphy->n_cipher_suites] =
548 				WLAN_CIPHER_SUITE_BIP_GMAC_256;
549 			hw->wiphy->n_cipher_suites++;
550 		}
551 	}
552 
553 	/* currently FW API supports only one optional cipher scheme */
554 	if (mvm->fw->cs[0].cipher) {
555 		const struct iwl_fw_cipher_scheme *fwcs = &mvm->fw->cs[0];
556 		struct ieee80211_cipher_scheme *cs = &mvm->cs[0];
557 
558 		mvm->hw->n_cipher_schemes = 1;
559 
560 		cs->cipher = le32_to_cpu(fwcs->cipher);
561 		cs->iftype = BIT(NL80211_IFTYPE_STATION);
562 		cs->hdr_len = fwcs->hdr_len;
563 		cs->pn_len = fwcs->pn_len;
564 		cs->pn_off = fwcs->pn_off;
565 		cs->key_idx_off = fwcs->key_idx_off;
566 		cs->key_idx_mask = fwcs->key_idx_mask;
567 		cs->key_idx_shift = fwcs->key_idx_shift;
568 		cs->mic_len = fwcs->mic_len;
569 
570 		mvm->hw->cipher_schemes = mvm->cs;
571 		mvm->ciphers[hw->wiphy->n_cipher_suites] = cs->cipher;
572 		hw->wiphy->n_cipher_suites++;
573 	}
574 
575 	if (fw_has_capa(&mvm->fw->ucode_capa,
576 			IWL_UCODE_TLV_CAPA_FTM_CALIBRATED)) {
577 		wiphy_ext_feature_set(hw->wiphy,
578 				      NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
579 		hw->wiphy->pmsr_capa = &iwl_mvm_pmsr_capa;
580 	}
581 
582 	ieee80211_hw_set(hw, SINGLE_SCAN_ON_ALL_BANDS);
583 	hw->wiphy->features |=
584 		NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR |
585 		NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR |
586 		NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
587 
588 	hw->sta_data_size = sizeof(struct iwl_mvm_sta);
589 	hw->vif_data_size = sizeof(struct iwl_mvm_vif);
590 	hw->chanctx_data_size = sizeof(u16);
591 	hw->txq_data_size = sizeof(struct iwl_mvm_txq);
592 
593 	hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
594 		BIT(NL80211_IFTYPE_P2P_CLIENT) |
595 		BIT(NL80211_IFTYPE_AP) |
596 		BIT(NL80211_IFTYPE_P2P_GO) |
597 		BIT(NL80211_IFTYPE_P2P_DEVICE) |
598 		BIT(NL80211_IFTYPE_ADHOC);
599 
600 	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
601 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
602 	hw->wiphy->features |= NL80211_FEATURE_HT_IBSS;
603 
604 	hw->wiphy->regulatory_flags |= REGULATORY_ENABLE_RELAX_NO_IR;
605 	if (iwl_mvm_is_lar_supported(mvm))
606 		hw->wiphy->regulatory_flags |= REGULATORY_WIPHY_SELF_MANAGED;
607 	else
608 		hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG |
609 					       REGULATORY_DISABLE_BEACON_HINTS;
610 
611 	hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
612 	hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
613 
614 	hw->wiphy->iface_combinations = iwl_mvm_iface_combinations;
615 	hw->wiphy->n_iface_combinations =
616 		ARRAY_SIZE(iwl_mvm_iface_combinations);
617 
618 	hw->wiphy->max_remain_on_channel_duration = 10000;
619 	hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
620 
621 	/* Extract MAC address */
622 	memcpy(mvm->addresses[0].addr, mvm->nvm_data->hw_addr, ETH_ALEN);
623 	hw->wiphy->addresses = mvm->addresses;
624 	hw->wiphy->n_addresses = 1;
625 
626 	/* Extract additional MAC addresses if available */
627 	num_mac = (mvm->nvm_data->n_hw_addrs > 1) ?
628 		min(IWL_MVM_MAX_ADDRESSES, mvm->nvm_data->n_hw_addrs) : 1;
629 
630 	for (i = 1; i < num_mac; i++) {
631 		memcpy(mvm->addresses[i].addr, mvm->addresses[i-1].addr,
632 		       ETH_ALEN);
633 		mvm->addresses[i].addr[5]++;
634 		hw->wiphy->n_addresses++;
635 	}
636 
637 	iwl_mvm_reset_phy_ctxts(mvm);
638 
639 	hw->wiphy->max_scan_ie_len = iwl_mvm_max_scan_ie_len(mvm);
640 
641 	hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
642 
643 	BUILD_BUG_ON(IWL_MVM_SCAN_STOPPING_MASK & IWL_MVM_SCAN_MASK);
644 	BUILD_BUG_ON(IWL_MVM_MAX_UMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK) ||
645 		     IWL_MVM_MAX_LMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK));
646 
647 	if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
648 		mvm->max_scans = IWL_MVM_MAX_UMAC_SCANS;
649 	else
650 		mvm->max_scans = IWL_MVM_MAX_LMAC_SCANS;
651 
652 	if (mvm->nvm_data->bands[NL80211_BAND_2GHZ].n_channels)
653 		hw->wiphy->bands[NL80211_BAND_2GHZ] =
654 			&mvm->nvm_data->bands[NL80211_BAND_2GHZ];
655 	if (mvm->nvm_data->bands[NL80211_BAND_5GHZ].n_channels) {
656 		hw->wiphy->bands[NL80211_BAND_5GHZ] =
657 			&mvm->nvm_data->bands[NL80211_BAND_5GHZ];
658 
659 		if (fw_has_capa(&mvm->fw->ucode_capa,
660 				IWL_UCODE_TLV_CAPA_BEAMFORMER) &&
661 		    fw_has_api(&mvm->fw->ucode_capa,
662 			       IWL_UCODE_TLV_API_LQ_SS_PARAMS))
663 			hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.cap |=
664 				IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
665 	}
666 
667 	hw->wiphy->hw_version = mvm->trans->hw_id;
668 
669 	if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM)
670 		hw->wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
671 	else
672 		hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
673 
674 	hw->wiphy->max_sched_scan_reqs = 1;
675 	hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
676 	hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
677 	/* we create the 802.11 header and zero length SSID IE. */
678 	hw->wiphy->max_sched_scan_ie_len =
679 		SCAN_OFFLOAD_PROBE_REQ_SIZE - 24 - 2;
680 	hw->wiphy->max_sched_scan_plans = IWL_MAX_SCHED_SCAN_PLANS;
681 	hw->wiphy->max_sched_scan_plan_interval = U16_MAX;
682 
683 	/*
684 	 * the firmware uses u8 for num of iterations, but 0xff is saved for
685 	 * infinite loop, so the maximum number of iterations is actually 254.
686 	 */
687 	hw->wiphy->max_sched_scan_plan_iterations = 254;
688 
689 	hw->wiphy->features |= NL80211_FEATURE_P2P_GO_CTWIN |
690 			       NL80211_FEATURE_LOW_PRIORITY_SCAN |
691 			       NL80211_FEATURE_P2P_GO_OPPPS |
692 			       NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
693 			       NL80211_FEATURE_DYNAMIC_SMPS |
694 			       NL80211_FEATURE_STATIC_SMPS |
695 			       NL80211_FEATURE_SUPPORTS_WMM_ADMISSION;
696 
697 	if (fw_has_capa(&mvm->fw->ucode_capa,
698 			IWL_UCODE_TLV_CAPA_TXPOWER_INSERTION_SUPPORT))
699 		hw->wiphy->features |= NL80211_FEATURE_TX_POWER_INSERTION;
700 	if (fw_has_capa(&mvm->fw->ucode_capa,
701 			IWL_UCODE_TLV_CAPA_QUIET_PERIOD_SUPPORT))
702 		hw->wiphy->features |= NL80211_FEATURE_QUIET;
703 
704 	if (fw_has_capa(&mvm->fw->ucode_capa,
705 			IWL_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT))
706 		hw->wiphy->features |=
707 			NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES;
708 
709 	if (fw_has_capa(&mvm->fw->ucode_capa,
710 			IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT))
711 		hw->wiphy->features |= NL80211_FEATURE_WFA_TPC_IE_IN_PROBES;
712 
713 	if (fw_has_api(&mvm->fw->ucode_capa,
714 		       IWL_UCODE_TLV_API_SCAN_TSF_REPORT)) {
715 		wiphy_ext_feature_set(hw->wiphy,
716 				      NL80211_EXT_FEATURE_SCAN_START_TIME);
717 		wiphy_ext_feature_set(hw->wiphy,
718 				      NL80211_EXT_FEATURE_BSS_PARENT_TSF);
719 		wiphy_ext_feature_set(hw->wiphy,
720 				      NL80211_EXT_FEATURE_SET_SCAN_DWELL);
721 	}
722 
723 	if (iwl_mvm_is_oce_supported(mvm)) {
724 		wiphy_ext_feature_set(hw->wiphy,
725 			NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP);
726 		wiphy_ext_feature_set(hw->wiphy,
727 			NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME);
728 		wiphy_ext_feature_set(hw->wiphy,
729 			NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION);
730 		wiphy_ext_feature_set(hw->wiphy,
731 			NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE);
732 	}
733 
734 	if (mvm->nvm_data->sku_cap_11ax_enable &&
735 	    !iwlwifi_mod_params.disable_11ax) {
736 		hw->wiphy->iftype_ext_capab = he_iftypes_ext_capa;
737 		hw->wiphy->num_iftype_ext_capab =
738 			ARRAY_SIZE(he_iftypes_ext_capa);
739 
740 		ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
741 		ieee80211_hw_set(hw, SUPPORTS_ONLY_HE_MULTI_BSSID);
742 	}
743 
744 	mvm->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
745 
746 #ifdef CONFIG_PM_SLEEP
747 	if (iwl_mvm_is_d0i3_supported(mvm) &&
748 	    device_can_wakeup(mvm->trans->dev)) {
749 		mvm->wowlan.flags = WIPHY_WOWLAN_ANY;
750 		hw->wiphy->wowlan = &mvm->wowlan;
751 	}
752 
753 	if ((unified || mvm->fw->img[IWL_UCODE_WOWLAN].num_sec) &&
754 	    mvm->trans->ops->d3_suspend &&
755 	    mvm->trans->ops->d3_resume &&
756 	    device_can_wakeup(mvm->trans->dev)) {
757 		mvm->wowlan.flags |= WIPHY_WOWLAN_MAGIC_PKT |
758 				     WIPHY_WOWLAN_DISCONNECT |
759 				     WIPHY_WOWLAN_EAP_IDENTITY_REQ |
760 				     WIPHY_WOWLAN_RFKILL_RELEASE |
761 				     WIPHY_WOWLAN_NET_DETECT;
762 		if (!iwlwifi_mod_params.swcrypto)
763 			mvm->wowlan.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY |
764 					     WIPHY_WOWLAN_GTK_REKEY_FAILURE |
765 					     WIPHY_WOWLAN_4WAY_HANDSHAKE;
766 
767 		mvm->wowlan.n_patterns = IWL_WOWLAN_MAX_PATTERNS;
768 		mvm->wowlan.pattern_min_len = IWL_WOWLAN_MIN_PATTERN_LEN;
769 		mvm->wowlan.pattern_max_len = IWL_WOWLAN_MAX_PATTERN_LEN;
770 		mvm->wowlan.max_nd_match_sets = IWL_SCAN_MAX_PROFILES;
771 		hw->wiphy->wowlan = &mvm->wowlan;
772 	}
773 #endif
774 
775 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
776 	/* assign default bcast filtering configuration */
777 	mvm->bcast_filters = iwl_mvm_default_bcast_filters;
778 #endif
779 
780 	ret = iwl_mvm_leds_init(mvm);
781 	if (ret)
782 		return ret;
783 
784 	if (fw_has_capa(&mvm->fw->ucode_capa,
785 			IWL_UCODE_TLV_CAPA_TDLS_SUPPORT)) {
786 		IWL_DEBUG_TDLS(mvm, "TDLS supported\n");
787 		hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
788 		ieee80211_hw_set(hw, TDLS_WIDER_BW);
789 	}
790 
791 	if (fw_has_capa(&mvm->fw->ucode_capa,
792 			IWL_UCODE_TLV_CAPA_TDLS_CHANNEL_SWITCH)) {
793 		IWL_DEBUG_TDLS(mvm, "TDLS channel switch supported\n");
794 		hw->wiphy->features |= NL80211_FEATURE_TDLS_CHANNEL_SWITCH;
795 	}
796 
797 	hw->netdev_features |= mvm->cfg->features;
798 	if (!iwl_mvm_is_csum_supported(mvm)) {
799 		hw->netdev_features &= ~(IWL_TX_CSUM_NETIF_FLAGS |
800 					 NETIF_F_RXCSUM);
801 		/* We may support SW TX CSUM */
802 		if (IWL_MVM_SW_TX_CSUM_OFFLOAD)
803 			hw->netdev_features |= IWL_TX_CSUM_NETIF_FLAGS;
804 	}
805 
806 	if (mvm->cfg->vht_mu_mimo_supported)
807 		wiphy_ext_feature_set(hw->wiphy,
808 				      NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER);
809 
810 	ret = ieee80211_register_hw(mvm->hw);
811 	if (ret) {
812 		iwl_mvm_leds_exit(mvm);
813 	}
814 
815 	return ret;
816 }
817 
818 static bool iwl_mvm_defer_tx(struct iwl_mvm *mvm,
819 			     struct ieee80211_sta *sta,
820 			     struct sk_buff *skb)
821 {
822 	struct iwl_mvm_sta *mvmsta;
823 	bool defer = false;
824 
825 	/*
826 	 * double check the IN_D0I3 flag both before and after
827 	 * taking the spinlock, in order to prevent taking
828 	 * the spinlock when not needed.
829 	 */
830 	if (likely(!test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status)))
831 		return false;
832 
833 	spin_lock(&mvm->d0i3_tx_lock);
834 	/*
835 	 * testing the flag again ensures the skb dequeue
836 	 * loop (on d0i3 exit) hasn't run yet.
837 	 */
838 	if (!test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status))
839 		goto out;
840 
841 	mvmsta = iwl_mvm_sta_from_mac80211(sta);
842 	if (mvmsta->sta_id == IWL_MVM_INVALID_STA ||
843 	    mvmsta->sta_id != mvm->d0i3_ap_sta_id)
844 		goto out;
845 
846 	__skb_queue_tail(&mvm->d0i3_tx, skb);
847 
848 	/* trigger wakeup */
849 	iwl_mvm_ref(mvm, IWL_MVM_REF_TX);
850 	iwl_mvm_unref(mvm, IWL_MVM_REF_TX);
851 
852 	defer = true;
853 out:
854 	spin_unlock(&mvm->d0i3_tx_lock);
855 	return defer;
856 }
857 
858 static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
859 			   struct ieee80211_tx_control *control,
860 			   struct sk_buff *skb)
861 {
862 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
863 	struct ieee80211_sta *sta = control->sta;
864 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
865 	struct ieee80211_hdr *hdr = (void *)skb->data;
866 	bool offchannel = IEEE80211_SKB_CB(skb)->flags &
867 		IEEE80211_TX_CTL_TX_OFFCHAN;
868 
869 	if (iwl_mvm_is_radio_killed(mvm)) {
870 		IWL_DEBUG_DROP(mvm, "Dropping - RF/CT KILL\n");
871 		goto drop;
872 	}
873 
874 	if (offchannel &&
875 	    !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status) &&
876 	    !test_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status))
877 		goto drop;
878 
879 	/* treat non-bufferable MMPDUs on AP interfaces as broadcast */
880 	if ((info->control.vif->type == NL80211_IFTYPE_AP ||
881 	     info->control.vif->type == NL80211_IFTYPE_ADHOC) &&
882 	    ieee80211_is_mgmt(hdr->frame_control) &&
883 	    !ieee80211_is_bufferable_mmpdu(hdr->frame_control))
884 		sta = NULL;
885 
886 	/* If there is no sta, and it's not offchannel - send through AP */
887 	if (!sta && info->control.vif->type == NL80211_IFTYPE_STATION &&
888 	    !offchannel) {
889 		struct iwl_mvm_vif *mvmvif =
890 			iwl_mvm_vif_from_mac80211(info->control.vif);
891 		u8 ap_sta_id = READ_ONCE(mvmvif->ap_sta_id);
892 
893 		if (ap_sta_id < IWL_MVM_STATION_COUNT) {
894 			/* mac80211 holds rcu read lock */
895 			sta = rcu_dereference(mvm->fw_id_to_mac_id[ap_sta_id]);
896 			if (IS_ERR_OR_NULL(sta))
897 				goto drop;
898 		}
899 	}
900 
901 	if (sta) {
902 		if (iwl_mvm_defer_tx(mvm, sta, skb))
903 			return;
904 		if (iwl_mvm_tx_skb(mvm, skb, sta))
905 			goto drop;
906 		return;
907 	}
908 
909 	if (iwl_mvm_tx_skb_non_sta(mvm, skb))
910 		goto drop;
911 	return;
912  drop:
913 	ieee80211_free_txskb(hw, skb);
914 }
915 
916 void iwl_mvm_mac_itxq_xmit(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
917 {
918 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
919 	struct iwl_mvm_txq *mvmtxq = iwl_mvm_txq_from_mac80211(txq);
920 	struct sk_buff *skb = NULL;
921 
922 	/*
923 	 * No need for threads to be pending here, they can leave the first
924 	 * taker all the work.
925 	 *
926 	 * mvmtxq->tx_request logic:
927 	 *
928 	 * If 0, no one is currently TXing, set to 1 to indicate current thread
929 	 * will now start TX and other threads should quit.
930 	 *
931 	 * If 1, another thread is currently TXing, set to 2 to indicate to
932 	 * that thread that there was another request. Since that request may
933 	 * have raced with the check whether the queue is empty, the TXing
934 	 * thread should check the queue's status one more time before leaving.
935 	 * This check is done in order to not leave any TX hanging in the queue
936 	 * until the next TX invocation (which may not even happen).
937 	 *
938 	 * If 2, another thread is currently TXing, and it will already double
939 	 * check the queue, so do nothing.
940 	 */
941 	if (atomic_fetch_add_unless(&mvmtxq->tx_request, 1, 2))
942 		return;
943 
944 	rcu_read_lock();
945 	do {
946 		while (likely(!mvmtxq->stopped &&
947 			      (mvm->trans->system_pm_mode ==
948 			       IWL_PLAT_PM_MODE_DISABLED))) {
949 			skb = ieee80211_tx_dequeue(hw, txq);
950 
951 			if (!skb) {
952 				if (txq->sta)
953 					IWL_DEBUG_TX(mvm,
954 						     "TXQ of sta %pM tid %d is now empty\n",
955 						     txq->sta->addr,
956 						     txq->tid);
957 				break;
958 			}
959 
960 			if (!txq->sta)
961 				iwl_mvm_tx_skb_non_sta(mvm, skb);
962 			else
963 				iwl_mvm_tx_skb(mvm, skb, txq->sta);
964 		}
965 	} while (atomic_dec_return(&mvmtxq->tx_request));
966 	rcu_read_unlock();
967 }
968 
969 static void iwl_mvm_mac_wake_tx_queue(struct ieee80211_hw *hw,
970 				      struct ieee80211_txq *txq)
971 {
972 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
973 	struct iwl_mvm_txq *mvmtxq = iwl_mvm_txq_from_mac80211(txq);
974 
975 	/*
976 	 * Please note that racing is handled very carefully here:
977 	 * mvmtxq->txq_id is updated during allocation, and mvmtxq->list is
978 	 * deleted afterwards.
979 	 * This means that if:
980 	 * mvmtxq->txq_id != INVALID_QUEUE && list_empty(&mvmtxq->list):
981 	 *	queue is allocated and we can TX.
982 	 * mvmtxq->txq_id != INVALID_QUEUE && !list_empty(&mvmtxq->list):
983 	 *	a race, should defer the frame.
984 	 * mvmtxq->txq_id == INVALID_QUEUE && list_empty(&mvmtxq->list):
985 	 *	need to allocate the queue and defer the frame.
986 	 * mvmtxq->txq_id == INVALID_QUEUE && !list_empty(&mvmtxq->list):
987 	 *	queue is already scheduled for allocation, no need to allocate,
988 	 *	should defer the frame.
989 	 */
990 
991 	/* If the queue is allocated TX and return. */
992 	if (!txq->sta || mvmtxq->txq_id != IWL_MVM_INVALID_QUEUE) {
993 		/*
994 		 * Check that list is empty to avoid a race where txq_id is
995 		 * already updated, but the queue allocation work wasn't
996 		 * finished
997 		 */
998 		if (unlikely(txq->sta && !list_empty(&mvmtxq->list)))
999 			return;
1000 
1001 		iwl_mvm_mac_itxq_xmit(hw, txq);
1002 		return;
1003 	}
1004 
1005 	/* The list is being deleted only after the queue is fully allocated. */
1006 	if (!list_empty(&mvmtxq->list))
1007 		return;
1008 
1009 	list_add_tail(&mvmtxq->list, &mvm->add_stream_txqs);
1010 	schedule_work(&mvm->add_stream_wk);
1011 }
1012 
1013 #define CHECK_BA_TRIGGER(_mvm, _trig, _tid_bm, _tid, _fmt...)		\
1014 	do {								\
1015 		if (!(le16_to_cpu(_tid_bm) & BIT(_tid)))		\
1016 			break;						\
1017 		iwl_fw_dbg_collect_trig(&(_mvm)->fwrt, _trig, _fmt);	\
1018 	} while (0)
1019 
1020 static void
1021 iwl_mvm_ampdu_check_trigger(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1022 			    struct ieee80211_sta *sta, u16 tid, u16 rx_ba_ssn,
1023 			    enum ieee80211_ampdu_mlme_action action)
1024 {
1025 	struct iwl_fw_dbg_trigger_tlv *trig;
1026 	struct iwl_fw_dbg_trigger_ba *ba_trig;
1027 
1028 	trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
1029 				     FW_DBG_TRIGGER_BA);
1030 	if (!trig)
1031 		return;
1032 
1033 	ba_trig = (void *)trig->data;
1034 
1035 	switch (action) {
1036 	case IEEE80211_AMPDU_TX_OPERATIONAL: {
1037 		struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
1038 		struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
1039 
1040 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_start, tid,
1041 				 "TX AGG START: MAC %pM tid %d ssn %d\n",
1042 				 sta->addr, tid, tid_data->ssn);
1043 		break;
1044 		}
1045 	case IEEE80211_AMPDU_TX_STOP_CONT:
1046 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_stop, tid,
1047 				 "TX AGG STOP: MAC %pM tid %d\n",
1048 				 sta->addr, tid);
1049 		break;
1050 	case IEEE80211_AMPDU_RX_START:
1051 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_start, tid,
1052 				 "RX AGG START: MAC %pM tid %d ssn %d\n",
1053 				 sta->addr, tid, rx_ba_ssn);
1054 		break;
1055 	case IEEE80211_AMPDU_RX_STOP:
1056 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_stop, tid,
1057 				 "RX AGG STOP: MAC %pM tid %d\n",
1058 				 sta->addr, tid);
1059 		break;
1060 	default:
1061 		break;
1062 	}
1063 }
1064 
1065 static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
1066 				    struct ieee80211_vif *vif,
1067 				    struct ieee80211_ampdu_params *params)
1068 {
1069 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1070 	int ret;
1071 	bool tx_agg_ref = false;
1072 	struct ieee80211_sta *sta = params->sta;
1073 	enum ieee80211_ampdu_mlme_action action = params->action;
1074 	u16 tid = params->tid;
1075 	u16 *ssn = &params->ssn;
1076 	u16 buf_size = params->buf_size;
1077 	bool amsdu = params->amsdu;
1078 	u16 timeout = params->timeout;
1079 
1080 	IWL_DEBUG_HT(mvm, "A-MPDU action on addr %pM tid %d: action %d\n",
1081 		     sta->addr, tid, action);
1082 
1083 	if (!(mvm->nvm_data->sku_cap_11n_enable))
1084 		return -EACCES;
1085 
1086 	/* return from D0i3 before starting a new Tx aggregation */
1087 	switch (action) {
1088 	case IEEE80211_AMPDU_TX_START:
1089 	case IEEE80211_AMPDU_TX_STOP_CONT:
1090 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
1091 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
1092 	case IEEE80211_AMPDU_TX_OPERATIONAL:
1093 		/*
1094 		 * for tx start, wait synchronously until D0i3 exit to
1095 		 * get the correct sequence number for the tid.
1096 		 * additionally, some other ampdu actions use direct
1097 		 * target access, which is not handled automatically
1098 		 * by the trans layer (unlike commands), so wait for
1099 		 * d0i3 exit in these cases as well.
1100 		 */
1101 		ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_TX_AGG);
1102 		if (ret)
1103 			return ret;
1104 
1105 		tx_agg_ref = true;
1106 		break;
1107 	default:
1108 		break;
1109 	}
1110 
1111 	mutex_lock(&mvm->mutex);
1112 
1113 	switch (action) {
1114 	case IEEE80211_AMPDU_RX_START:
1115 		if (iwl_mvm_vif_from_mac80211(vif)->ap_sta_id ==
1116 				iwl_mvm_sta_from_mac80211(sta)->sta_id) {
1117 			struct iwl_mvm_vif *mvmvif;
1118 			u16 macid = iwl_mvm_vif_from_mac80211(vif)->id;
1119 			struct iwl_mvm_tcm_mac *mdata = &mvm->tcm.data[macid];
1120 
1121 			mdata->opened_rx_ba_sessions = true;
1122 			mvmvif = iwl_mvm_vif_from_mac80211(vif);
1123 			cancel_delayed_work(&mvmvif->uapsd_nonagg_detected_wk);
1124 		}
1125 		if (!iwl_enable_rx_ampdu()) {
1126 			ret = -EINVAL;
1127 			break;
1128 		}
1129 		ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, *ssn, true, buf_size,
1130 					 timeout);
1131 		break;
1132 	case IEEE80211_AMPDU_RX_STOP:
1133 		ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, 0, false, buf_size,
1134 					 timeout);
1135 		break;
1136 	case IEEE80211_AMPDU_TX_START:
1137 		if (!iwl_enable_tx_ampdu()) {
1138 			ret = -EINVAL;
1139 			break;
1140 		}
1141 		ret = iwl_mvm_sta_tx_agg_start(mvm, vif, sta, tid, ssn);
1142 		break;
1143 	case IEEE80211_AMPDU_TX_STOP_CONT:
1144 		ret = iwl_mvm_sta_tx_agg_stop(mvm, vif, sta, tid);
1145 		break;
1146 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
1147 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
1148 		ret = iwl_mvm_sta_tx_agg_flush(mvm, vif, sta, tid);
1149 		break;
1150 	case IEEE80211_AMPDU_TX_OPERATIONAL:
1151 		ret = iwl_mvm_sta_tx_agg_oper(mvm, vif, sta, tid,
1152 					      buf_size, amsdu);
1153 		break;
1154 	default:
1155 		WARN_ON_ONCE(1);
1156 		ret = -EINVAL;
1157 		break;
1158 	}
1159 
1160 	if (!ret) {
1161 		u16 rx_ba_ssn = 0;
1162 
1163 		if (action == IEEE80211_AMPDU_RX_START)
1164 			rx_ba_ssn = *ssn;
1165 
1166 		iwl_mvm_ampdu_check_trigger(mvm, vif, sta, tid,
1167 					    rx_ba_ssn, action);
1168 	}
1169 	mutex_unlock(&mvm->mutex);
1170 
1171 	/*
1172 	 * If the tid is marked as started, we won't use it for offloaded
1173 	 * traffic on the next D0i3 entry. It's safe to unref.
1174 	 */
1175 	if (tx_agg_ref)
1176 		iwl_mvm_unref(mvm, IWL_MVM_REF_TX_AGG);
1177 
1178 	return ret;
1179 }
1180 
1181 static void iwl_mvm_cleanup_iterator(void *data, u8 *mac,
1182 				     struct ieee80211_vif *vif)
1183 {
1184 	struct iwl_mvm *mvm = data;
1185 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1186 
1187 	mvmvif->uploaded = false;
1188 	mvmvif->ap_sta_id = IWL_MVM_INVALID_STA;
1189 
1190 	spin_lock_bh(&mvm->time_event_lock);
1191 	iwl_mvm_te_clear_data(mvm, &mvmvif->time_event_data);
1192 	spin_unlock_bh(&mvm->time_event_lock);
1193 
1194 	mvmvif->phy_ctxt = NULL;
1195 	memset(&mvmvif->bf_data, 0, sizeof(mvmvif->bf_data));
1196 	memset(&mvmvif->probe_resp_data, 0, sizeof(mvmvif->probe_resp_data));
1197 }
1198 
1199 static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
1200 {
1201 	/* cleanup all stale references (scan, roc), but keep the
1202 	 * ucode_down ref until reconfig is complete
1203 	 */
1204 	iwl_mvm_unref_all_except(mvm, IWL_MVM_REF_UCODE_DOWN);
1205 
1206 	iwl_mvm_stop_device(mvm);
1207 
1208 	mvm->cur_aid = 0;
1209 
1210 	mvm->scan_status = 0;
1211 	mvm->ps_disabled = false;
1212 	mvm->calibrating = false;
1213 
1214 	/* just in case one was running */
1215 	iwl_mvm_cleanup_roc_te(mvm);
1216 	ieee80211_remain_on_channel_expired(mvm->hw);
1217 
1218 	iwl_mvm_ftm_restart(mvm);
1219 
1220 	/*
1221 	 * cleanup all interfaces, even inactive ones, as some might have
1222 	 * gone down during the HW restart
1223 	 */
1224 	ieee80211_iterate_interfaces(mvm->hw, 0, iwl_mvm_cleanup_iterator, mvm);
1225 
1226 	mvm->p2p_device_vif = NULL;
1227 	mvm->d0i3_ap_sta_id = IWL_MVM_INVALID_STA;
1228 
1229 	iwl_mvm_reset_phy_ctxts(mvm);
1230 	memset(mvm->fw_key_table, 0, sizeof(mvm->fw_key_table));
1231 	memset(&mvm->last_bt_notif, 0, sizeof(mvm->last_bt_notif));
1232 	memset(&mvm->last_bt_ci_cmd, 0, sizeof(mvm->last_bt_ci_cmd));
1233 
1234 	ieee80211_wake_queues(mvm->hw);
1235 
1236 	/* clear any stale d0i3 state */
1237 	clear_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status);
1238 
1239 	mvm->vif_count = 0;
1240 	mvm->rx_ba_sessions = 0;
1241 	mvm->fwrt.dump.conf = FW_DBG_INVALID;
1242 	mvm->monitor_on = false;
1243 
1244 	/* keep statistics ticking */
1245 	iwl_mvm_accu_radio_stats(mvm);
1246 }
1247 
1248 int __iwl_mvm_mac_start(struct iwl_mvm *mvm)
1249 {
1250 	int ret;
1251 
1252 	lockdep_assert_held(&mvm->mutex);
1253 
1254 	if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status)) {
1255 		/*
1256 		 * Now convert the HW_RESTART_REQUESTED flag to IN_HW_RESTART
1257 		 * so later code will - from now on - see that we're doing it.
1258 		 */
1259 		set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1260 		clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status);
1261 		/* Clean up some internal and mac80211 state on restart */
1262 		iwl_mvm_restart_cleanup(mvm);
1263 	} else {
1264 		/* Hold the reference to prevent runtime suspend while
1265 		 * the start procedure runs.  It's a bit confusing
1266 		 * that the UCODE_DOWN reference is taken, but it just
1267 		 * means "UCODE is not UP yet". ( TODO: rename this
1268 		 * reference).
1269 		 */
1270 		iwl_mvm_ref(mvm, IWL_MVM_REF_UCODE_DOWN);
1271 	}
1272 	ret = iwl_mvm_up(mvm);
1273 
1274 	iwl_fw_dbg_apply_point(&mvm->fwrt, IWL_FW_INI_APPLY_POST_INIT);
1275 
1276 	if (ret && test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
1277 		/* Something went wrong - we need to finish some cleanup
1278 		 * that normally iwl_mvm_mac_restart_complete() below
1279 		 * would do.
1280 		 */
1281 		clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1282 #ifdef CONFIG_PM
1283 		iwl_mvm_d0i3_enable_tx(mvm, NULL);
1284 #endif
1285 	}
1286 
1287 	return ret;
1288 }
1289 
1290 static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
1291 {
1292 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1293 	int ret;
1294 
1295 	/* Some hw restart cleanups must not hold the mutex */
1296 	if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
1297 		/*
1298 		 * Make sure we are out of d0i3. This is needed
1299 		 * to make sure the reference accounting is correct
1300 		 * (and there is no stale d0i3_exit_work).
1301 		 */
1302 		wait_event_timeout(mvm->d0i3_exit_waitq,
1303 				   !test_bit(IWL_MVM_STATUS_IN_D0I3,
1304 					     &mvm->status),
1305 				   HZ);
1306 	}
1307 
1308 	mutex_lock(&mvm->mutex);
1309 	ret = __iwl_mvm_mac_start(mvm);
1310 	mutex_unlock(&mvm->mutex);
1311 
1312 	return ret;
1313 }
1314 
1315 static void iwl_mvm_restart_complete(struct iwl_mvm *mvm)
1316 {
1317 	int ret;
1318 
1319 	mutex_lock(&mvm->mutex);
1320 
1321 	clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1322 #ifdef CONFIG_PM
1323 	iwl_mvm_d0i3_enable_tx(mvm, NULL);
1324 #endif
1325 	ret = iwl_mvm_update_quotas(mvm, true, NULL);
1326 	if (ret)
1327 		IWL_ERR(mvm, "Failed to update quotas after restart (%d)\n",
1328 			ret);
1329 
1330 	/* allow transport/FW low power modes */
1331 	iwl_mvm_unref(mvm, IWL_MVM_REF_UCODE_DOWN);
1332 
1333 	iwl_mvm_send_recovery_cmd(mvm, ERROR_RECOVERY_END_OF_RECOVERY);
1334 
1335 	/*
1336 	 * If we have TDLS peers, remove them. We don't know the last seqno/PN
1337 	 * of packets the FW sent out, so we must reconnect.
1338 	 */
1339 	iwl_mvm_teardown_tdls_peers(mvm);
1340 
1341 	mutex_unlock(&mvm->mutex);
1342 }
1343 
1344 static void iwl_mvm_resume_complete(struct iwl_mvm *mvm)
1345 {
1346 	if (iwl_mvm_is_d0i3_supported(mvm) &&
1347 	    iwl_mvm_enter_d0i3_on_suspend(mvm))
1348 		WARN_ONCE(!wait_event_timeout(mvm->d0i3_exit_waitq,
1349 					      !test_bit(IWL_MVM_STATUS_IN_D0I3,
1350 							&mvm->status),
1351 					      HZ),
1352 			  "D0i3 exit on resume timed out\n");
1353 }
1354 
1355 static void
1356 iwl_mvm_mac_reconfig_complete(struct ieee80211_hw *hw,
1357 			      enum ieee80211_reconfig_type reconfig_type)
1358 {
1359 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1360 
1361 	switch (reconfig_type) {
1362 	case IEEE80211_RECONFIG_TYPE_RESTART:
1363 		iwl_mvm_restart_complete(mvm);
1364 		break;
1365 	case IEEE80211_RECONFIG_TYPE_SUSPEND:
1366 		iwl_mvm_resume_complete(mvm);
1367 		break;
1368 	}
1369 }
1370 
1371 void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
1372 {
1373 	lockdep_assert_held(&mvm->mutex);
1374 
1375 	/* firmware counters are obviously reset now, but we shouldn't
1376 	 * partially track so also clear the fw_reset_accu counters.
1377 	 */
1378 	memset(&mvm->accu_radio_stats, 0, sizeof(mvm->accu_radio_stats));
1379 
1380 	/* async_handlers_wk is now blocked */
1381 
1382 	/*
1383 	 * The work item could be running or queued if the
1384 	 * ROC time event stops just as we get here.
1385 	 */
1386 	flush_work(&mvm->roc_done_wk);
1387 
1388 	iwl_mvm_stop_device(mvm);
1389 
1390 	iwl_mvm_async_handlers_purge(mvm);
1391 	/* async_handlers_list is empty and will stay empty: HW is stopped */
1392 
1393 	/* the fw is stopped, the aux sta is dead: clean up driver state */
1394 	iwl_mvm_del_aux_sta(mvm);
1395 
1396 	/*
1397 	 * Clear IN_HW_RESTART and HW_RESTART_REQUESTED flag when stopping the
1398 	 * hw (as restart_complete() won't be called in this case) and mac80211
1399 	 * won't execute the restart.
1400 	 * But make sure to cleanup interfaces that have gone down before/during
1401 	 * HW restart was requested.
1402 	 */
1403 	if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) ||
1404 	    test_and_clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
1405 			       &mvm->status))
1406 		ieee80211_iterate_interfaces(mvm->hw, 0,
1407 					     iwl_mvm_cleanup_iterator, mvm);
1408 
1409 	/* We shouldn't have any UIDs still set.  Loop over all the UIDs to
1410 	 * make sure there's nothing left there and warn if any is found.
1411 	 */
1412 	if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1413 		int i;
1414 
1415 		for (i = 0; i < mvm->max_scans; i++) {
1416 			if (WARN_ONCE(mvm->scan_uid_status[i],
1417 				      "UMAC scan UID %d status was not cleaned\n",
1418 				      i))
1419 				mvm->scan_uid_status[i] = 0;
1420 		}
1421 	}
1422 }
1423 
1424 static void iwl_mvm_mac_stop(struct ieee80211_hw *hw)
1425 {
1426 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1427 
1428 	flush_work(&mvm->d0i3_exit_work);
1429 	flush_work(&mvm->async_handlers_wk);
1430 	flush_work(&mvm->add_stream_wk);
1431 
1432 	/*
1433 	 * Lock and clear the firmware running bit here already, so that
1434 	 * new commands coming in elsewhere, e.g. from debugfs, will not
1435 	 * be able to proceed. This is important here because one of those
1436 	 * debugfs files causes the firmware dump to be triggered, and if we
1437 	 * don't stop debugfs accesses before canceling that it could be
1438 	 * retriggered after we flush it but before we've cleared the bit.
1439 	 */
1440 	clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status);
1441 
1442 	iwl_fw_cancel_dump(&mvm->fwrt);
1443 	cancel_delayed_work_sync(&mvm->cs_tx_unblock_dwork);
1444 	cancel_delayed_work_sync(&mvm->scan_timeout_dwork);
1445 	iwl_fw_free_dump_desc(&mvm->fwrt);
1446 
1447 	mutex_lock(&mvm->mutex);
1448 	__iwl_mvm_mac_stop(mvm);
1449 	mutex_unlock(&mvm->mutex);
1450 
1451 	/*
1452 	 * The worker might have been waiting for the mutex, let it run and
1453 	 * discover that its list is now empty.
1454 	 */
1455 	cancel_work_sync(&mvm->async_handlers_wk);
1456 }
1457 
1458 static struct iwl_mvm_phy_ctxt *iwl_mvm_get_free_phy_ctxt(struct iwl_mvm *mvm)
1459 {
1460 	u16 i;
1461 
1462 	lockdep_assert_held(&mvm->mutex);
1463 
1464 	for (i = 0; i < NUM_PHY_CTX; i++)
1465 		if (!mvm->phy_ctxts[i].ref)
1466 			return &mvm->phy_ctxts[i];
1467 
1468 	IWL_ERR(mvm, "No available PHY context\n");
1469 	return NULL;
1470 }
1471 
1472 static int iwl_mvm_set_tx_power(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1473 				s16 tx_power)
1474 {
1475 	int len;
1476 	union {
1477 		struct iwl_dev_tx_power_cmd v5;
1478 		struct iwl_dev_tx_power_cmd_v4 v4;
1479 	} cmd = {
1480 		.v5.v3.set_mode = cpu_to_le32(IWL_TX_POWER_MODE_SET_MAC),
1481 		.v5.v3.mac_context_id =
1482 			cpu_to_le32(iwl_mvm_vif_from_mac80211(vif)->id),
1483 		.v5.v3.pwr_restriction = cpu_to_le16(8 * tx_power),
1484 	};
1485 
1486 	if (tx_power == IWL_DEFAULT_MAX_TX_POWER)
1487 		cmd.v5.v3.pwr_restriction = cpu_to_le16(IWL_DEV_MAX_TX_POWER);
1488 
1489 	if (fw_has_api(&mvm->fw->ucode_capa,
1490 		       IWL_UCODE_TLV_API_REDUCE_TX_POWER))
1491 		len = sizeof(cmd.v5);
1492 	else if (fw_has_capa(&mvm->fw->ucode_capa,
1493 			     IWL_UCODE_TLV_CAPA_TX_POWER_ACK))
1494 		len = sizeof(cmd.v4);
1495 	else
1496 		len = sizeof(cmd.v4.v3);
1497 
1498 	return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, 0, len, &cmd);
1499 }
1500 
1501 static int iwl_mvm_post_channel_switch(struct ieee80211_hw *hw,
1502 				       struct ieee80211_vif *vif)
1503 {
1504 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1505 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1506 	int ret;
1507 
1508 	mutex_lock(&mvm->mutex);
1509 
1510 	if (mvmvif->csa_failed) {
1511 		mvmvif->csa_failed = false;
1512 		ret = -EIO;
1513 		goto out_unlock;
1514 	}
1515 
1516 	if (vif->type == NL80211_IFTYPE_STATION) {
1517 		struct iwl_mvm_sta *mvmsta;
1518 
1519 		mvmvif->csa_bcn_pending = false;
1520 		mvmsta = iwl_mvm_sta_from_staid_protected(mvm,
1521 							  mvmvif->ap_sta_id);
1522 
1523 		if (WARN_ON(!mvmsta)) {
1524 			ret = -EIO;
1525 			goto out_unlock;
1526 		}
1527 
1528 		iwl_mvm_sta_modify_disable_tx(mvm, mvmsta, false);
1529 
1530 		iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
1531 
1532 		ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
1533 		if (ret)
1534 			goto out_unlock;
1535 
1536 		iwl_mvm_stop_session_protection(mvm, vif);
1537 	}
1538 
1539 	mvmvif->ps_disabled = false;
1540 
1541 	ret = iwl_mvm_power_update_ps(mvm);
1542 
1543 out_unlock:
1544 	mutex_unlock(&mvm->mutex);
1545 
1546 	return ret;
1547 }
1548 
1549 static void iwl_mvm_abort_channel_switch(struct ieee80211_hw *hw,
1550 					 struct ieee80211_vif *vif)
1551 {
1552 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1553 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1554 	struct iwl_chan_switch_te_cmd cmd = {
1555 		.mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
1556 							  mvmvif->color)),
1557 		.action = cpu_to_le32(FW_CTXT_ACTION_REMOVE),
1558 	};
1559 
1560 	IWL_DEBUG_MAC80211(mvm, "Abort CSA on mac %d\n", mvmvif->id);
1561 
1562 	mutex_lock(&mvm->mutex);
1563 	WARN_ON(iwl_mvm_send_cmd_pdu(mvm,
1564 				     WIDE_ID(MAC_CONF_GROUP,
1565 					     CHANNEL_SWITCH_TIME_EVENT_CMD),
1566 				     0, sizeof(cmd), &cmd));
1567 	mutex_unlock(&mvm->mutex);
1568 
1569 	WARN_ON(iwl_mvm_post_channel_switch(hw, vif));
1570 }
1571 
1572 static void iwl_mvm_channel_switch_disconnect_wk(struct work_struct *wk)
1573 {
1574 	struct iwl_mvm *mvm;
1575 	struct iwl_mvm_vif *mvmvif;
1576 	struct ieee80211_vif *vif;
1577 
1578 	mvmvif = container_of(wk, struct iwl_mvm_vif, csa_work.work);
1579 	vif = container_of((void *)mvmvif, struct ieee80211_vif, drv_priv);
1580 	mvm = mvmvif->mvm;
1581 
1582 	iwl_mvm_abort_channel_switch(mvm->hw, vif);
1583 	ieee80211_chswitch_done(vif, false);
1584 }
1585 
1586 static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
1587 				     struct ieee80211_vif *vif)
1588 {
1589 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1590 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1591 	int ret;
1592 
1593 	mvmvif->mvm = mvm;
1594 	RCU_INIT_POINTER(mvmvif->probe_resp_data, NULL);
1595 
1596 	/*
1597 	 * make sure D0i3 exit is completed, otherwise a target access
1598 	 * during tx queue configuration could be done when still in
1599 	 * D0i3 state.
1600 	 */
1601 	ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_ADD_IF);
1602 	if (ret)
1603 		return ret;
1604 
1605 	/*
1606 	 * Not much to do here. The stack will not allow interface
1607 	 * types or combinations that we didn't advertise, so we
1608 	 * don't really have to check the types.
1609 	 */
1610 
1611 	mutex_lock(&mvm->mutex);
1612 
1613 	/* make sure that beacon statistics don't go backwards with FW reset */
1614 	if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
1615 		mvmvif->beacon_stats.accu_num_beacons +=
1616 			mvmvif->beacon_stats.num_beacons;
1617 
1618 	/* Allocate resources for the MAC context, and add it to the fw  */
1619 	ret = iwl_mvm_mac_ctxt_init(mvm, vif);
1620 	if (ret)
1621 		goto out_unlock;
1622 
1623 	rcu_assign_pointer(mvm->vif_id_to_mac[mvmvif->id], vif);
1624 
1625 	/* Counting number of interfaces is needed for legacy PM */
1626 	if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1627 		mvm->vif_count++;
1628 
1629 	/*
1630 	 * The AP binding flow can be done only after the beacon
1631 	 * template is configured (which happens only in the mac80211
1632 	 * start_ap() flow), and adding the broadcast station can happen
1633 	 * only after the binding.
1634 	 * In addition, since modifying the MAC before adding a bcast
1635 	 * station is not allowed by the FW, delay the adding of MAC context to
1636 	 * the point where we can also add the bcast station.
1637 	 * In short: there's not much we can do at this point, other than
1638 	 * allocating resources :)
1639 	 */
1640 	if (vif->type == NL80211_IFTYPE_AP ||
1641 	    vif->type == NL80211_IFTYPE_ADHOC) {
1642 		ret = iwl_mvm_alloc_bcast_sta(mvm, vif);
1643 		if (ret) {
1644 			IWL_ERR(mvm, "Failed to allocate bcast sta\n");
1645 			goto out_release;
1646 		}
1647 
1648 		/*
1649 		 * Only queue for this station is the mcast queue,
1650 		 * which shouldn't be in TFD mask anyway
1651 		 */
1652 		ret = iwl_mvm_allocate_int_sta(mvm, &mvmvif->mcast_sta,
1653 					       0, vif->type,
1654 					       IWL_STA_MULTICAST);
1655 		if (ret)
1656 			goto out_release;
1657 
1658 		iwl_mvm_vif_dbgfs_register(mvm, vif);
1659 		goto out_unlock;
1660 	}
1661 
1662 	mvmvif->features |= hw->netdev_features;
1663 
1664 	ret = iwl_mvm_mac_ctxt_add(mvm, vif);
1665 	if (ret)
1666 		goto out_release;
1667 
1668 	ret = iwl_mvm_power_update_mac(mvm);
1669 	if (ret)
1670 		goto out_remove_mac;
1671 
1672 	/* beacon filtering */
1673 	ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
1674 	if (ret)
1675 		goto out_remove_mac;
1676 
1677 	if (!mvm->bf_allowed_vif &&
1678 	    vif->type == NL80211_IFTYPE_STATION && !vif->p2p) {
1679 		mvm->bf_allowed_vif = mvmvif;
1680 		vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
1681 				     IEEE80211_VIF_SUPPORTS_CQM_RSSI;
1682 	}
1683 
1684 	/*
1685 	 * P2P_DEVICE interface does not have a channel context assigned to it,
1686 	 * so a dedicated PHY context is allocated to it and the corresponding
1687 	 * MAC context is bound to it at this stage.
1688 	 */
1689 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1690 
1691 		mvmvif->phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
1692 		if (!mvmvif->phy_ctxt) {
1693 			ret = -ENOSPC;
1694 			goto out_free_bf;
1695 		}
1696 
1697 		iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
1698 		ret = iwl_mvm_binding_add_vif(mvm, vif);
1699 		if (ret)
1700 			goto out_unref_phy;
1701 
1702 		ret = iwl_mvm_add_p2p_bcast_sta(mvm, vif);
1703 		if (ret)
1704 			goto out_unbind;
1705 
1706 		/* Save a pointer to p2p device vif, so it can later be used to
1707 		 * update the p2p device MAC when a GO is started/stopped */
1708 		mvm->p2p_device_vif = vif;
1709 	}
1710 
1711 	iwl_mvm_tcm_add_vif(mvm, vif);
1712 	INIT_DELAYED_WORK(&mvmvif->csa_work,
1713 			  iwl_mvm_channel_switch_disconnect_wk);
1714 
1715 	if (vif->type == NL80211_IFTYPE_MONITOR)
1716 		mvm->monitor_on = true;
1717 
1718 	iwl_mvm_vif_dbgfs_register(mvm, vif);
1719 	goto out_unlock;
1720 
1721  out_unbind:
1722 	iwl_mvm_binding_remove_vif(mvm, vif);
1723  out_unref_phy:
1724 	iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1725  out_free_bf:
1726 	if (mvm->bf_allowed_vif == mvmvif) {
1727 		mvm->bf_allowed_vif = NULL;
1728 		vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1729 				       IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1730 	}
1731  out_remove_mac:
1732 	mvmvif->phy_ctxt = NULL;
1733 	iwl_mvm_mac_ctxt_remove(mvm, vif);
1734  out_release:
1735 	if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1736 		mvm->vif_count--;
1737  out_unlock:
1738 	mutex_unlock(&mvm->mutex);
1739 
1740 	iwl_mvm_unref(mvm, IWL_MVM_REF_ADD_IF);
1741 
1742 	return ret;
1743 }
1744 
1745 static void iwl_mvm_prepare_mac_removal(struct iwl_mvm *mvm,
1746 					struct ieee80211_vif *vif)
1747 {
1748 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1749 		/*
1750 		 * Flush the ROC worker which will flush the OFFCHANNEL queue.
1751 		 * We assume here that all the packets sent to the OFFCHANNEL
1752 		 * queue are sent in ROC session.
1753 		 */
1754 		flush_work(&mvm->roc_done_wk);
1755 	}
1756 }
1757 
1758 static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
1759 					 struct ieee80211_vif *vif)
1760 {
1761 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1762 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1763 	struct iwl_probe_resp_data *probe_data;
1764 
1765 	iwl_mvm_prepare_mac_removal(mvm, vif);
1766 
1767 	if (!(vif->type == NL80211_IFTYPE_AP ||
1768 	      vif->type == NL80211_IFTYPE_ADHOC))
1769 		iwl_mvm_tcm_rm_vif(mvm, vif);
1770 
1771 	mutex_lock(&mvm->mutex);
1772 
1773 	probe_data = rcu_dereference_protected(mvmvif->probe_resp_data,
1774 					       lockdep_is_held(&mvm->mutex));
1775 	RCU_INIT_POINTER(mvmvif->probe_resp_data, NULL);
1776 	if (probe_data)
1777 		kfree_rcu(probe_data, rcu_head);
1778 
1779 	if (mvm->bf_allowed_vif == mvmvif) {
1780 		mvm->bf_allowed_vif = NULL;
1781 		vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1782 				       IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1783 	}
1784 
1785 	if (vif->bss_conf.ftm_responder)
1786 		memset(&mvm->ftm_resp_stats, 0, sizeof(mvm->ftm_resp_stats));
1787 
1788 	iwl_mvm_vif_dbgfs_clean(mvm, vif);
1789 
1790 	/*
1791 	 * For AP/GO interface, the tear down of the resources allocated to the
1792 	 * interface is be handled as part of the stop_ap flow.
1793 	 */
1794 	if (vif->type == NL80211_IFTYPE_AP ||
1795 	    vif->type == NL80211_IFTYPE_ADHOC) {
1796 #ifdef CONFIG_NL80211_TESTMODE
1797 		if (vif == mvm->noa_vif) {
1798 			mvm->noa_vif = NULL;
1799 			mvm->noa_duration = 0;
1800 		}
1801 #endif
1802 		iwl_mvm_dealloc_int_sta(mvm, &mvmvif->mcast_sta);
1803 		iwl_mvm_dealloc_bcast_sta(mvm, vif);
1804 		goto out_release;
1805 	}
1806 
1807 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1808 		mvm->p2p_device_vif = NULL;
1809 		iwl_mvm_rm_p2p_bcast_sta(mvm, vif);
1810 		iwl_mvm_binding_remove_vif(mvm, vif);
1811 		iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1812 		mvmvif->phy_ctxt = NULL;
1813 	}
1814 
1815 	if (mvm->vif_count && vif->type != NL80211_IFTYPE_P2P_DEVICE)
1816 		mvm->vif_count--;
1817 
1818 	iwl_mvm_power_update_mac(mvm);
1819 	iwl_mvm_mac_ctxt_remove(mvm, vif);
1820 
1821 	RCU_INIT_POINTER(mvm->vif_id_to_mac[mvmvif->id], NULL);
1822 
1823 	if (vif->type == NL80211_IFTYPE_MONITOR)
1824 		mvm->monitor_on = false;
1825 
1826 out_release:
1827 	mutex_unlock(&mvm->mutex);
1828 }
1829 
1830 static int iwl_mvm_mac_config(struct ieee80211_hw *hw, u32 changed)
1831 {
1832 	return 0;
1833 }
1834 
1835 struct iwl_mvm_mc_iter_data {
1836 	struct iwl_mvm *mvm;
1837 	int port_id;
1838 };
1839 
1840 static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
1841 				      struct ieee80211_vif *vif)
1842 {
1843 	struct iwl_mvm_mc_iter_data *data = _data;
1844 	struct iwl_mvm *mvm = data->mvm;
1845 	struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd;
1846 	struct iwl_host_cmd hcmd = {
1847 		.id = MCAST_FILTER_CMD,
1848 		.flags = CMD_ASYNC,
1849 		.dataflags[0] = IWL_HCMD_DFL_NOCOPY,
1850 	};
1851 	int ret, len;
1852 
1853 	/* if we don't have free ports, mcast frames will be dropped */
1854 	if (WARN_ON_ONCE(data->port_id >= MAX_PORT_ID_NUM))
1855 		return;
1856 
1857 	if (vif->type != NL80211_IFTYPE_STATION ||
1858 	    !vif->bss_conf.assoc)
1859 		return;
1860 
1861 	cmd->port_id = data->port_id++;
1862 	memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
1863 	len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4);
1864 
1865 	hcmd.len[0] = len;
1866 	hcmd.data[0] = cmd;
1867 
1868 	ret = iwl_mvm_send_cmd(mvm, &hcmd);
1869 	if (ret)
1870 		IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret);
1871 }
1872 
1873 static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm)
1874 {
1875 	struct iwl_mvm_mc_iter_data iter_data = {
1876 		.mvm = mvm,
1877 	};
1878 
1879 	lockdep_assert_held(&mvm->mutex);
1880 
1881 	if (WARN_ON_ONCE(!mvm->mcast_filter_cmd))
1882 		return;
1883 
1884 	ieee80211_iterate_active_interfaces_atomic(
1885 		mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1886 		iwl_mvm_mc_iface_iterator, &iter_data);
1887 }
1888 
1889 static u64 iwl_mvm_prepare_multicast(struct ieee80211_hw *hw,
1890 				     struct netdev_hw_addr_list *mc_list)
1891 {
1892 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1893 	struct iwl_mcast_filter_cmd *cmd;
1894 	struct netdev_hw_addr *addr;
1895 	int addr_count;
1896 	bool pass_all;
1897 	int len;
1898 
1899 	addr_count = netdev_hw_addr_list_count(mc_list);
1900 	pass_all = addr_count > MAX_MCAST_FILTERING_ADDRESSES ||
1901 		   IWL_MVM_FW_MCAST_FILTER_PASS_ALL;
1902 	if (pass_all)
1903 		addr_count = 0;
1904 
1905 	len = roundup(sizeof(*cmd) + addr_count * ETH_ALEN, 4);
1906 	cmd = kzalloc(len, GFP_ATOMIC);
1907 	if (!cmd)
1908 		return 0;
1909 
1910 	if (pass_all) {
1911 		cmd->pass_all = 1;
1912 		return (u64)(unsigned long)cmd;
1913 	}
1914 
1915 	netdev_hw_addr_list_for_each(addr, mc_list) {
1916 		IWL_DEBUG_MAC80211(mvm, "mcast addr (%d): %pM\n",
1917 				   cmd->count, addr->addr);
1918 		memcpy(&cmd->addr_list[cmd->count * ETH_ALEN],
1919 		       addr->addr, ETH_ALEN);
1920 		cmd->count++;
1921 	}
1922 
1923 	return (u64)(unsigned long)cmd;
1924 }
1925 
1926 static void iwl_mvm_configure_filter(struct ieee80211_hw *hw,
1927 				     unsigned int changed_flags,
1928 				     unsigned int *total_flags,
1929 				     u64 multicast)
1930 {
1931 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1932 	struct iwl_mcast_filter_cmd *cmd = (void *)(unsigned long)multicast;
1933 
1934 	mutex_lock(&mvm->mutex);
1935 
1936 	/* replace previous configuration */
1937 	kfree(mvm->mcast_filter_cmd);
1938 	mvm->mcast_filter_cmd = cmd;
1939 
1940 	if (!cmd)
1941 		goto out;
1942 
1943 	if (changed_flags & FIF_ALLMULTI)
1944 		cmd->pass_all = !!(*total_flags & FIF_ALLMULTI);
1945 
1946 	if (cmd->pass_all)
1947 		cmd->count = 0;
1948 
1949 	iwl_mvm_recalc_multicast(mvm);
1950 out:
1951 	mutex_unlock(&mvm->mutex);
1952 	*total_flags = 0;
1953 }
1954 
1955 static void iwl_mvm_config_iface_filter(struct ieee80211_hw *hw,
1956 					struct ieee80211_vif *vif,
1957 					unsigned int filter_flags,
1958 					unsigned int changed_flags)
1959 {
1960 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1961 
1962 	/* We support only filter for probe requests */
1963 	if (!(changed_flags & FIF_PROBE_REQ))
1964 		return;
1965 
1966 	/* Supported only for p2p client interfaces */
1967 	if (vif->type != NL80211_IFTYPE_STATION || !vif->bss_conf.assoc ||
1968 	    !vif->p2p)
1969 		return;
1970 
1971 	mutex_lock(&mvm->mutex);
1972 	iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
1973 	mutex_unlock(&mvm->mutex);
1974 }
1975 
1976 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
1977 struct iwl_bcast_iter_data {
1978 	struct iwl_mvm *mvm;
1979 	struct iwl_bcast_filter_cmd *cmd;
1980 	u8 current_filter;
1981 };
1982 
1983 static void
1984 iwl_mvm_set_bcast_filter(struct ieee80211_vif *vif,
1985 			 const struct iwl_fw_bcast_filter *in_filter,
1986 			 struct iwl_fw_bcast_filter *out_filter)
1987 {
1988 	struct iwl_fw_bcast_filter_attr *attr;
1989 	int i;
1990 
1991 	memcpy(out_filter, in_filter, sizeof(*out_filter));
1992 
1993 	for (i = 0; i < ARRAY_SIZE(out_filter->attrs); i++) {
1994 		attr = &out_filter->attrs[i];
1995 
1996 		if (!attr->mask)
1997 			break;
1998 
1999 		switch (attr->reserved1) {
2000 		case cpu_to_le16(BC_FILTER_MAGIC_IP):
2001 			if (vif->bss_conf.arp_addr_cnt != 1) {
2002 				attr->mask = 0;
2003 				continue;
2004 			}
2005 
2006 			attr->val = vif->bss_conf.arp_addr_list[0];
2007 			break;
2008 		case cpu_to_le16(BC_FILTER_MAGIC_MAC):
2009 			attr->val = *(__be32 *)&vif->addr[2];
2010 			break;
2011 		default:
2012 			break;
2013 		}
2014 		attr->reserved1 = 0;
2015 		out_filter->num_attrs++;
2016 	}
2017 }
2018 
2019 static void iwl_mvm_bcast_filter_iterator(void *_data, u8 *mac,
2020 					  struct ieee80211_vif *vif)
2021 {
2022 	struct iwl_bcast_iter_data *data = _data;
2023 	struct iwl_mvm *mvm = data->mvm;
2024 	struct iwl_bcast_filter_cmd *cmd = data->cmd;
2025 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2026 	struct iwl_fw_bcast_mac *bcast_mac;
2027 	int i;
2028 
2029 	if (WARN_ON(mvmvif->id >= ARRAY_SIZE(cmd->macs)))
2030 		return;
2031 
2032 	bcast_mac = &cmd->macs[mvmvif->id];
2033 
2034 	/*
2035 	 * enable filtering only for associated stations, but not for P2P
2036 	 * Clients
2037 	 */
2038 	if (vif->type != NL80211_IFTYPE_STATION || vif->p2p ||
2039 	    !vif->bss_conf.assoc)
2040 		return;
2041 
2042 	bcast_mac->default_discard = 1;
2043 
2044 	/* copy all configured filters */
2045 	for (i = 0; mvm->bcast_filters[i].attrs[0].mask; i++) {
2046 		/*
2047 		 * Make sure we don't exceed our filters limit.
2048 		 * if there is still a valid filter to be configured,
2049 		 * be on the safe side and just allow bcast for this mac.
2050 		 */
2051 		if (WARN_ON_ONCE(data->current_filter >=
2052 				 ARRAY_SIZE(cmd->filters))) {
2053 			bcast_mac->default_discard = 0;
2054 			bcast_mac->attached_filters = 0;
2055 			break;
2056 		}
2057 
2058 		iwl_mvm_set_bcast_filter(vif,
2059 					 &mvm->bcast_filters[i],
2060 					 &cmd->filters[data->current_filter]);
2061 
2062 		/* skip current filter if it contains no attributes */
2063 		if (!cmd->filters[data->current_filter].num_attrs)
2064 			continue;
2065 
2066 		/* attach the filter to current mac */
2067 		bcast_mac->attached_filters |=
2068 				cpu_to_le16(BIT(data->current_filter));
2069 
2070 		data->current_filter++;
2071 	}
2072 }
2073 
2074 bool iwl_mvm_bcast_filter_build_cmd(struct iwl_mvm *mvm,
2075 				    struct iwl_bcast_filter_cmd *cmd)
2076 {
2077 	struct iwl_bcast_iter_data iter_data = {
2078 		.mvm = mvm,
2079 		.cmd = cmd,
2080 	};
2081 
2082 	if (IWL_MVM_FW_BCAST_FILTER_PASS_ALL)
2083 		return false;
2084 
2085 	memset(cmd, 0, sizeof(*cmd));
2086 	cmd->max_bcast_filters = ARRAY_SIZE(cmd->filters);
2087 	cmd->max_macs = ARRAY_SIZE(cmd->macs);
2088 
2089 #ifdef CONFIG_IWLWIFI_DEBUGFS
2090 	/* use debugfs filters/macs if override is configured */
2091 	if (mvm->dbgfs_bcast_filtering.override) {
2092 		memcpy(cmd->filters, &mvm->dbgfs_bcast_filtering.cmd.filters,
2093 		       sizeof(cmd->filters));
2094 		memcpy(cmd->macs, &mvm->dbgfs_bcast_filtering.cmd.macs,
2095 		       sizeof(cmd->macs));
2096 		return true;
2097 	}
2098 #endif
2099 
2100 	/* if no filters are configured, do nothing */
2101 	if (!mvm->bcast_filters)
2102 		return false;
2103 
2104 	/* configure and attach these filters for each associated sta vif */
2105 	ieee80211_iterate_active_interfaces(
2106 		mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
2107 		iwl_mvm_bcast_filter_iterator, &iter_data);
2108 
2109 	return true;
2110 }
2111 
2112 static int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
2113 {
2114 	struct iwl_bcast_filter_cmd cmd;
2115 
2116 	if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BCAST_FILTERING))
2117 		return 0;
2118 
2119 	if (!iwl_mvm_bcast_filter_build_cmd(mvm, &cmd))
2120 		return 0;
2121 
2122 	return iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, 0,
2123 				    sizeof(cmd), &cmd);
2124 }
2125 #else
2126 static inline int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
2127 {
2128 	return 0;
2129 }
2130 #endif
2131 
2132 static int iwl_mvm_update_mu_groups(struct iwl_mvm *mvm,
2133 				    struct ieee80211_vif *vif)
2134 {
2135 	struct iwl_mu_group_mgmt_cmd cmd = {};
2136 
2137 	memcpy(cmd.membership_status, vif->bss_conf.mu_group.membership,
2138 	       WLAN_MEMBERSHIP_LEN);
2139 	memcpy(cmd.user_position, vif->bss_conf.mu_group.position,
2140 	       WLAN_USER_POSITION_LEN);
2141 
2142 	return iwl_mvm_send_cmd_pdu(mvm,
2143 				    WIDE_ID(DATA_PATH_GROUP,
2144 					    UPDATE_MU_GROUPS_CMD),
2145 				    0, sizeof(cmd), &cmd);
2146 }
2147 
2148 static void iwl_mvm_mu_mimo_iface_iterator(void *_data, u8 *mac,
2149 					   struct ieee80211_vif *vif)
2150 {
2151 	if (vif->mu_mimo_owner) {
2152 		struct iwl_mu_group_mgmt_notif *notif = _data;
2153 
2154 		/*
2155 		 * MU-MIMO Group Id action frame is little endian. We treat
2156 		 * the data received from firmware as if it came from the
2157 		 * action frame, so no conversion is needed.
2158 		 */
2159 		ieee80211_update_mu_groups(vif,
2160 					   (u8 *)&notif->membership_status,
2161 					   (u8 *)&notif->user_position);
2162 	}
2163 }
2164 
2165 void iwl_mvm_mu_mimo_grp_notif(struct iwl_mvm *mvm,
2166 			       struct iwl_rx_cmd_buffer *rxb)
2167 {
2168 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
2169 	struct iwl_mu_group_mgmt_notif *notif = (void *)pkt->data;
2170 
2171 	ieee80211_iterate_active_interfaces_atomic(
2172 			mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
2173 			iwl_mvm_mu_mimo_iface_iterator, notif);
2174 }
2175 
2176 static u8 iwl_mvm_he_get_ppe_val(u8 *ppe, u8 ppe_pos_bit)
2177 {
2178 	u8 byte_num = ppe_pos_bit / 8;
2179 	u8 bit_num = ppe_pos_bit % 8;
2180 	u8 residue_bits;
2181 	u8 res;
2182 
2183 	if (bit_num <= 5)
2184 		return (ppe[byte_num] >> bit_num) &
2185 		       (BIT(IEEE80211_PPE_THRES_INFO_PPET_SIZE) - 1);
2186 
2187 	/*
2188 	 * If bit_num > 5, we have to combine bits with next byte.
2189 	 * Calculate how many bits we need to take from current byte (called
2190 	 * here "residue_bits"), and add them to bits from next byte.
2191 	 */
2192 
2193 	residue_bits = 8 - bit_num;
2194 
2195 	res = (ppe[byte_num + 1] &
2196 	       (BIT(IEEE80211_PPE_THRES_INFO_PPET_SIZE - residue_bits) - 1)) <<
2197 	      residue_bits;
2198 	res += (ppe[byte_num] >> bit_num) & (BIT(residue_bits) - 1);
2199 
2200 	return res;
2201 }
2202 
2203 static void iwl_mvm_cfg_he_sta(struct iwl_mvm *mvm,
2204 			       struct ieee80211_vif *vif, u8 sta_id)
2205 {
2206 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2207 	struct iwl_he_sta_context_cmd sta_ctxt_cmd = {
2208 		.sta_id = sta_id,
2209 		.tid_limit = IWL_MAX_TID_COUNT,
2210 		.bss_color = vif->bss_conf.bss_color,
2211 		.htc_trig_based_pkt_ext = vif->bss_conf.htc_trig_based_pkt_ext,
2212 		.frame_time_rts_th =
2213 			cpu_to_le16(vif->bss_conf.frame_time_rts_th),
2214 	};
2215 	int size = fw_has_api(&mvm->fw->ucode_capa,
2216 			      IWL_UCODE_TLV_API_MBSSID_HE) ?
2217 		   sizeof(sta_ctxt_cmd) :
2218 		   sizeof(struct iwl_he_sta_context_cmd_v1);
2219 	struct ieee80211_sta *sta;
2220 	u32 flags;
2221 	int i;
2222 
2223 	rcu_read_lock();
2224 
2225 	sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_ctxt_cmd.sta_id]);
2226 	if (IS_ERR(sta)) {
2227 		rcu_read_unlock();
2228 		WARN(1, "Can't find STA to configure HE\n");
2229 		return;
2230 	}
2231 
2232 	if (!sta->he_cap.has_he) {
2233 		rcu_read_unlock();
2234 		return;
2235 	}
2236 
2237 	flags = 0;
2238 
2239 	/* HTC flags */
2240 	if (sta->he_cap.he_cap_elem.mac_cap_info[0] &
2241 	    IEEE80211_HE_MAC_CAP0_HTC_HE)
2242 		sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_SUPPORT);
2243 	if ((sta->he_cap.he_cap_elem.mac_cap_info[1] &
2244 	      IEEE80211_HE_MAC_CAP1_LINK_ADAPTATION) ||
2245 	    (sta->he_cap.he_cap_elem.mac_cap_info[2] &
2246 	      IEEE80211_HE_MAC_CAP2_LINK_ADAPTATION)) {
2247 		u8 link_adap =
2248 			((sta->he_cap.he_cap_elem.mac_cap_info[2] &
2249 			  IEEE80211_HE_MAC_CAP2_LINK_ADAPTATION) << 1) +
2250 			 (sta->he_cap.he_cap_elem.mac_cap_info[1] &
2251 			  IEEE80211_HE_MAC_CAP1_LINK_ADAPTATION);
2252 
2253 		if (link_adap == 2)
2254 			sta_ctxt_cmd.htc_flags |=
2255 				cpu_to_le32(IWL_HE_HTC_LINK_ADAP_UNSOLICITED);
2256 		else if (link_adap == 3)
2257 			sta_ctxt_cmd.htc_flags |=
2258 				cpu_to_le32(IWL_HE_HTC_LINK_ADAP_BOTH);
2259 	}
2260 	if (sta->he_cap.he_cap_elem.mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
2261 		sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_BSR_SUPP);
2262 	if (sta->he_cap.he_cap_elem.mac_cap_info[3] &
2263 	    IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
2264 		sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_OMI_SUPP);
2265 	if (sta->he_cap.he_cap_elem.mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
2266 		sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_BQR_SUPP);
2267 
2268 	/*
2269 	 * Initialize the PPE thresholds to "None" (7), as described in Table
2270 	 * 9-262ac of 80211.ax/D3.0.
2271 	 */
2272 	memset(&sta_ctxt_cmd.pkt_ext, 7, sizeof(sta_ctxt_cmd.pkt_ext));
2273 
2274 	/* If PPE Thresholds exist, parse them into a FW-familiar format. */
2275 	if (sta->he_cap.he_cap_elem.phy_cap_info[6] &
2276 	    IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT) {
2277 		u8 nss = (sta->he_cap.ppe_thres[0] &
2278 			  IEEE80211_PPE_THRES_NSS_MASK) + 1;
2279 		u8 ru_index_bitmap =
2280 			(sta->he_cap.ppe_thres[0] &
2281 			 IEEE80211_PPE_THRES_RU_INDEX_BITMASK_MASK) >>
2282 			IEEE80211_PPE_THRES_RU_INDEX_BITMASK_POS;
2283 		u8 *ppe = &sta->he_cap.ppe_thres[0];
2284 		u8 ppe_pos_bit = 7; /* Starting after PPE header */
2285 
2286 		/*
2287 		 * FW currently supports only nss == MAX_HE_SUPP_NSS
2288 		 *
2289 		 * If nss > MAX: we can ignore values we don't support
2290 		 * If nss < MAX: we can set zeros in other streams
2291 		 */
2292 		if (nss > MAX_HE_SUPP_NSS) {
2293 			IWL_INFO(mvm, "Got NSS = %d - trimming to %d\n", nss,
2294 				 MAX_HE_SUPP_NSS);
2295 			nss = MAX_HE_SUPP_NSS;
2296 		}
2297 
2298 		for (i = 0; i < nss; i++) {
2299 			u8 ru_index_tmp = ru_index_bitmap << 1;
2300 			u8 bw;
2301 
2302 			for (bw = 0; bw < MAX_HE_CHANNEL_BW_INDX; bw++) {
2303 				ru_index_tmp >>= 1;
2304 				if (!(ru_index_tmp & 1))
2305 					continue;
2306 
2307 				sta_ctxt_cmd.pkt_ext.pkt_ext_qam_th[i][bw][1] =
2308 					iwl_mvm_he_get_ppe_val(ppe,
2309 							       ppe_pos_bit);
2310 				ppe_pos_bit +=
2311 					IEEE80211_PPE_THRES_INFO_PPET_SIZE;
2312 				sta_ctxt_cmd.pkt_ext.pkt_ext_qam_th[i][bw][0] =
2313 					iwl_mvm_he_get_ppe_val(ppe,
2314 							       ppe_pos_bit);
2315 				ppe_pos_bit +=
2316 					IEEE80211_PPE_THRES_INFO_PPET_SIZE;
2317 			}
2318 		}
2319 
2320 		flags |= STA_CTXT_HE_PACKET_EXT;
2321 	} else if ((sta->he_cap.he_cap_elem.phy_cap_info[9] &
2322 		    IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_MASK) !=
2323 		  IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_RESERVED) {
2324 		int low_th = -1;
2325 		int high_th = -1;
2326 
2327 		/* Take the PPE thresholds from the nominal padding info */
2328 		switch (sta->he_cap.he_cap_elem.phy_cap_info[9] &
2329 			IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_MASK) {
2330 		case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_0US:
2331 			low_th = IWL_HE_PKT_EXT_NONE;
2332 			high_th = IWL_HE_PKT_EXT_NONE;
2333 			break;
2334 		case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_8US:
2335 			low_th = IWL_HE_PKT_EXT_BPSK;
2336 			high_th = IWL_HE_PKT_EXT_NONE;
2337 			break;
2338 		case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_16US:
2339 			low_th = IWL_HE_PKT_EXT_NONE;
2340 			high_th = IWL_HE_PKT_EXT_BPSK;
2341 			break;
2342 		}
2343 
2344 		/* Set the PPE thresholds accordingly */
2345 		if (low_th >= 0 && high_th >= 0) {
2346 			struct iwl_he_pkt_ext *pkt_ext =
2347 				(struct iwl_he_pkt_ext *)&sta_ctxt_cmd.pkt_ext;
2348 
2349 			for (i = 0; i < MAX_HE_SUPP_NSS; i++) {
2350 				u8 bw;
2351 
2352 				for (bw = 0; bw < MAX_HE_CHANNEL_BW_INDX;
2353 				     bw++) {
2354 					pkt_ext->pkt_ext_qam_th[i][bw][0] =
2355 						low_th;
2356 					pkt_ext->pkt_ext_qam_th[i][bw][1] =
2357 						high_th;
2358 				}
2359 			}
2360 
2361 			flags |= STA_CTXT_HE_PACKET_EXT;
2362 		}
2363 	}
2364 	rcu_read_unlock();
2365 
2366 	/* Mark MU EDCA as enabled, unless none detected on some AC */
2367 	flags |= STA_CTXT_HE_MU_EDCA_CW;
2368 	for (i = 0; i < AC_NUM; i++) {
2369 		struct ieee80211_he_mu_edca_param_ac_rec *mu_edca =
2370 			&mvmvif->queue_params[i].mu_edca_param_rec;
2371 
2372 		if (!mvmvif->queue_params[i].mu_edca) {
2373 			flags &= ~STA_CTXT_HE_MU_EDCA_CW;
2374 			break;
2375 		}
2376 
2377 		sta_ctxt_cmd.trig_based_txf[i].cwmin =
2378 			cpu_to_le16(mu_edca->ecw_min_max & 0xf);
2379 		sta_ctxt_cmd.trig_based_txf[i].cwmax =
2380 			cpu_to_le16((mu_edca->ecw_min_max & 0xf0) >> 4);
2381 		sta_ctxt_cmd.trig_based_txf[i].aifsn =
2382 			cpu_to_le16(mu_edca->aifsn);
2383 		sta_ctxt_cmd.trig_based_txf[i].mu_time =
2384 			cpu_to_le16(mu_edca->mu_edca_timer);
2385 	}
2386 
2387 	if (vif->bss_conf.multi_sta_back_32bit)
2388 		flags |= STA_CTXT_HE_32BIT_BA_BITMAP;
2389 
2390 	if (vif->bss_conf.ack_enabled)
2391 		flags |= STA_CTXT_HE_ACK_ENABLED;
2392 
2393 	if (vif->bss_conf.uora_exists) {
2394 		flags |= STA_CTXT_HE_TRIG_RND_ALLOC;
2395 
2396 		sta_ctxt_cmd.rand_alloc_ecwmin =
2397 			vif->bss_conf.uora_ocw_range & 0x7;
2398 		sta_ctxt_cmd.rand_alloc_ecwmax =
2399 			(vif->bss_conf.uora_ocw_range >> 3) & 0x7;
2400 	}
2401 
2402 	if (vif->bss_conf.nontransmitted) {
2403 		flags |= STA_CTXT_HE_REF_BSSID_VALID;
2404 		ether_addr_copy(sta_ctxt_cmd.ref_bssid_addr,
2405 				vif->bss_conf.transmitter_bssid);
2406 		sta_ctxt_cmd.max_bssid_indicator =
2407 			vif->bss_conf.bssid_indicator;
2408 		sta_ctxt_cmd.bssid_index = vif->bss_conf.bssid_index;
2409 		sta_ctxt_cmd.ema_ap = vif->bss_conf.ema_ap;
2410 		sta_ctxt_cmd.profile_periodicity =
2411 			vif->bss_conf.profile_periodicity;
2412 	}
2413 
2414 	sta_ctxt_cmd.flags = cpu_to_le32(flags);
2415 
2416 	if (iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(STA_HE_CTXT_CMD,
2417 						 DATA_PATH_GROUP, 0),
2418 				 0, size, &sta_ctxt_cmd))
2419 		IWL_ERR(mvm, "Failed to config FW to work HE!\n");
2420 }
2421 
2422 static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
2423 					     struct ieee80211_vif *vif,
2424 					     struct ieee80211_bss_conf *bss_conf,
2425 					     u32 changes)
2426 {
2427 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2428 	int ret;
2429 
2430 	/*
2431 	 * Re-calculate the tsf id, as the master-slave relations depend on the
2432 	 * beacon interval, which was not known when the station interface was
2433 	 * added.
2434 	 */
2435 	if (changes & BSS_CHANGED_ASSOC && bss_conf->assoc) {
2436 		if (vif->bss_conf.he_support &&
2437 		    !iwlwifi_mod_params.disable_11ax)
2438 			iwl_mvm_cfg_he_sta(mvm, vif, mvmvif->ap_sta_id);
2439 
2440 		iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
2441 	}
2442 
2443 	/* Update MU EDCA params */
2444 	if (changes & BSS_CHANGED_QOS && mvmvif->associated &&
2445 	    bss_conf->assoc && vif->bss_conf.he_support &&
2446 	    !iwlwifi_mod_params.disable_11ax)
2447 		iwl_mvm_cfg_he_sta(mvm, vif, mvmvif->ap_sta_id);
2448 
2449 	/*
2450 	 * If we're not associated yet, take the (new) BSSID before associating
2451 	 * so the firmware knows. If we're already associated, then use the old
2452 	 * BSSID here, and we'll send a cleared one later in the CHANGED_ASSOC
2453 	 * branch for disassociation below.
2454 	 */
2455 	if (changes & BSS_CHANGED_BSSID && !mvmvif->associated)
2456 		memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
2457 
2458 	ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, mvmvif->bssid);
2459 	if (ret)
2460 		IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
2461 
2462 	/* after sending it once, adopt mac80211 data */
2463 	memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
2464 	mvmvif->associated = bss_conf->assoc;
2465 
2466 	if (changes & BSS_CHANGED_ASSOC) {
2467 		if (bss_conf->assoc) {
2468 			/* clear statistics to get clean beacon counter */
2469 			iwl_mvm_request_statistics(mvm, true);
2470 			memset(&mvmvif->beacon_stats, 0,
2471 			       sizeof(mvmvif->beacon_stats));
2472 
2473 			/* add quota for this interface */
2474 			ret = iwl_mvm_update_quotas(mvm, true, NULL);
2475 			if (ret) {
2476 				IWL_ERR(mvm, "failed to update quotas\n");
2477 				return;
2478 			}
2479 
2480 			if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
2481 				     &mvm->status)) {
2482 				/*
2483 				 * If we're restarting then the firmware will
2484 				 * obviously have lost synchronisation with
2485 				 * the AP. It will attempt to synchronise by
2486 				 * itself, but we can make it more reliable by
2487 				 * scheduling a session protection time event.
2488 				 *
2489 				 * The firmware needs to receive a beacon to
2490 				 * catch up with synchronisation, use 110% of
2491 				 * the beacon interval.
2492 				 *
2493 				 * Set a large maximum delay to allow for more
2494 				 * than a single interface.
2495 				 */
2496 				u32 dur = (11 * vif->bss_conf.beacon_int) / 10;
2497 				iwl_mvm_protect_session(mvm, vif, dur, dur,
2498 							5 * dur, false);
2499 			}
2500 
2501 			iwl_mvm_sf_update(mvm, vif, false);
2502 			iwl_mvm_power_vif_assoc(mvm, vif);
2503 			if (vif->p2p) {
2504 				iwl_mvm_ref(mvm, IWL_MVM_REF_P2P_CLIENT);
2505 				iwl_mvm_update_smps(mvm, vif,
2506 						    IWL_MVM_SMPS_REQ_PROT,
2507 						    IEEE80211_SMPS_DYNAMIC);
2508 			}
2509 		} else if (mvmvif->ap_sta_id != IWL_MVM_INVALID_STA) {
2510 			/*
2511 			 * If update fails - SF might be running in associated
2512 			 * mode while disassociated - which is forbidden.
2513 			 */
2514 			ret = iwl_mvm_sf_update(mvm, vif, false);
2515 			WARN_ONCE(ret &&
2516 				  !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
2517 					    &mvm->status),
2518 				  "Failed to update SF upon disassociation\n");
2519 
2520 			/*
2521 			 * If we get an assert during the connection (after the
2522 			 * station has been added, but before the vif is set
2523 			 * to associated), mac80211 will re-add the station and
2524 			 * then configure the vif. Since the vif is not
2525 			 * associated, we would remove the station here and
2526 			 * this would fail the recovery.
2527 			 */
2528 			if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
2529 				      &mvm->status)) {
2530 				/*
2531 				 * Remove AP station now that
2532 				 * the MAC is unassoc
2533 				 */
2534 				ret = iwl_mvm_rm_sta_id(mvm, vif,
2535 							mvmvif->ap_sta_id);
2536 				if (ret)
2537 					IWL_ERR(mvm,
2538 						"failed to remove AP station\n");
2539 
2540 				if (mvm->d0i3_ap_sta_id == mvmvif->ap_sta_id)
2541 					mvm->d0i3_ap_sta_id =
2542 						IWL_MVM_INVALID_STA;
2543 				mvmvif->ap_sta_id = IWL_MVM_INVALID_STA;
2544 			}
2545 
2546 			/* remove quota for this interface */
2547 			ret = iwl_mvm_update_quotas(mvm, false, NULL);
2548 			if (ret)
2549 				IWL_ERR(mvm, "failed to update quotas\n");
2550 
2551 			if (vif->p2p)
2552 				iwl_mvm_unref(mvm, IWL_MVM_REF_P2P_CLIENT);
2553 
2554 			/* this will take the cleared BSSID from bss_conf */
2555 			ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
2556 			if (ret)
2557 				IWL_ERR(mvm,
2558 					"failed to update MAC %pM (clear after unassoc)\n",
2559 					vif->addr);
2560 		}
2561 
2562 		/*
2563 		 * The firmware tracks the MU-MIMO group on its own.
2564 		 * However, on HW restart we should restore this data.
2565 		 */
2566 		if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
2567 		    (changes & BSS_CHANGED_MU_GROUPS) && vif->mu_mimo_owner) {
2568 			ret = iwl_mvm_update_mu_groups(mvm, vif);
2569 			if (ret)
2570 				IWL_ERR(mvm,
2571 					"failed to update VHT MU_MIMO groups\n");
2572 		}
2573 
2574 		iwl_mvm_recalc_multicast(mvm);
2575 		iwl_mvm_configure_bcast_filter(mvm);
2576 
2577 		/* reset rssi values */
2578 		mvmvif->bf_data.ave_beacon_signal = 0;
2579 
2580 		iwl_mvm_bt_coex_vif_change(mvm);
2581 		iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_TT,
2582 				    IEEE80211_SMPS_AUTOMATIC);
2583 		if (fw_has_capa(&mvm->fw->ucode_capa,
2584 				IWL_UCODE_TLV_CAPA_UMAC_SCAN))
2585 			iwl_mvm_config_scan(mvm);
2586 	}
2587 
2588 	if (changes & BSS_CHANGED_BEACON_INFO) {
2589 		/*
2590 		 * We received a beacon from the associated AP so
2591 		 * remove the session protection.
2592 		 */
2593 		iwl_mvm_stop_session_protection(mvm, vif);
2594 
2595 		iwl_mvm_sf_update(mvm, vif, false);
2596 		WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
2597 	}
2598 
2599 	if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS | BSS_CHANGED_QOS |
2600 		       /*
2601 			* Send power command on every beacon change,
2602 			* because we may have not enabled beacon abort yet.
2603 			*/
2604 		       BSS_CHANGED_BEACON_INFO)) {
2605 		ret = iwl_mvm_power_update_mac(mvm);
2606 		if (ret)
2607 			IWL_ERR(mvm, "failed to update power mode\n");
2608 	}
2609 
2610 	if (changes & BSS_CHANGED_TXPOWER) {
2611 		IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2612 				bss_conf->txpower);
2613 		iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2614 	}
2615 
2616 	if (changes & BSS_CHANGED_CQM) {
2617 		IWL_DEBUG_MAC80211(mvm, "cqm info_changed\n");
2618 		/* reset cqm events tracking */
2619 		mvmvif->bf_data.last_cqm_event = 0;
2620 		if (mvmvif->bf_data.bf_enabled) {
2621 			ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
2622 			if (ret)
2623 				IWL_ERR(mvm,
2624 					"failed to update CQM thresholds\n");
2625 		}
2626 	}
2627 
2628 	if (changes & BSS_CHANGED_ARP_FILTER) {
2629 		IWL_DEBUG_MAC80211(mvm, "arp filter changed\n");
2630 		iwl_mvm_configure_bcast_filter(mvm);
2631 	}
2632 }
2633 
2634 static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
2635 				 struct ieee80211_vif *vif)
2636 {
2637 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2638 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2639 	int ret;
2640 
2641 	/*
2642 	 * iwl_mvm_mac_ctxt_add() might read directly from the device
2643 	 * (the system time), so make sure it is available.
2644 	 */
2645 	ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_START_AP);
2646 	if (ret)
2647 		return ret;
2648 
2649 	mutex_lock(&mvm->mutex);
2650 
2651 	/* Send the beacon template */
2652 	ret = iwl_mvm_mac_ctxt_beacon_changed(mvm, vif);
2653 	if (ret)
2654 		goto out_unlock;
2655 
2656 	/*
2657 	 * Re-calculate the tsf id, as the master-slave relations depend on the
2658 	 * beacon interval, which was not known when the AP interface was added.
2659 	 */
2660 	if (vif->type == NL80211_IFTYPE_AP)
2661 		iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
2662 
2663 	mvmvif->ap_assoc_sta_count = 0;
2664 
2665 	/* Add the mac context */
2666 	ret = iwl_mvm_mac_ctxt_add(mvm, vif);
2667 	if (ret)
2668 		goto out_unlock;
2669 
2670 	/* Perform the binding */
2671 	ret = iwl_mvm_binding_add_vif(mvm, vif);
2672 	if (ret)
2673 		goto out_remove;
2674 
2675 	/*
2676 	 * This is not very nice, but the simplest:
2677 	 * For older FWs adding the mcast sta before the bcast station may
2678 	 * cause assert 0x2b00.
2679 	 * This is fixed in later FW so make the order of removal depend on
2680 	 * the TLV
2681 	 */
2682 	if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE)) {
2683 		ret = iwl_mvm_add_mcast_sta(mvm, vif);
2684 		if (ret)
2685 			goto out_unbind;
2686 		/*
2687 		 * Send the bcast station. At this stage the TBTT and DTIM time
2688 		 * events are added and applied to the scheduler
2689 		 */
2690 		ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
2691 		if (ret) {
2692 			iwl_mvm_rm_mcast_sta(mvm, vif);
2693 			goto out_unbind;
2694 		}
2695 	} else {
2696 		/*
2697 		 * Send the bcast station. At this stage the TBTT and DTIM time
2698 		 * events are added and applied to the scheduler
2699 		 */
2700 		ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
2701 		if (ret)
2702 			goto out_unbind;
2703 		ret = iwl_mvm_add_mcast_sta(mvm, vif);
2704 		if (ret) {
2705 			iwl_mvm_send_rm_bcast_sta(mvm, vif);
2706 			goto out_unbind;
2707 		}
2708 	}
2709 
2710 	/* must be set before quota calculations */
2711 	mvmvif->ap_ibss_active = true;
2712 
2713 	if (vif->type == NL80211_IFTYPE_AP && !vif->p2p) {
2714 		iwl_mvm_vif_set_low_latency(mvmvif, true,
2715 					    LOW_LATENCY_VIF_TYPE);
2716 		iwl_mvm_send_low_latency_cmd(mvm, true, mvmvif->id);
2717 	}
2718 
2719 	/* power updated needs to be done before quotas */
2720 	iwl_mvm_power_update_mac(mvm);
2721 
2722 	ret = iwl_mvm_update_quotas(mvm, false, NULL);
2723 	if (ret)
2724 		goto out_quota_failed;
2725 
2726 	/* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2727 	if (vif->p2p && mvm->p2p_device_vif)
2728 		iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2729 
2730 	iwl_mvm_ref(mvm, IWL_MVM_REF_AP_IBSS);
2731 
2732 	iwl_mvm_bt_coex_vif_change(mvm);
2733 
2734 	/* we don't support TDLS during DCM */
2735 	if (iwl_mvm_phy_ctx_count(mvm) > 1)
2736 		iwl_mvm_teardown_tdls_peers(mvm);
2737 
2738 	iwl_mvm_ftm_restart_responder(mvm, vif);
2739 
2740 	goto out_unlock;
2741 
2742 out_quota_failed:
2743 	iwl_mvm_power_update_mac(mvm);
2744 	mvmvif->ap_ibss_active = false;
2745 	iwl_mvm_send_rm_bcast_sta(mvm, vif);
2746 	iwl_mvm_rm_mcast_sta(mvm, vif);
2747 out_unbind:
2748 	iwl_mvm_binding_remove_vif(mvm, vif);
2749 out_remove:
2750 	iwl_mvm_mac_ctxt_remove(mvm, vif);
2751 out_unlock:
2752 	mutex_unlock(&mvm->mutex);
2753 	iwl_mvm_unref(mvm, IWL_MVM_REF_START_AP);
2754 	return ret;
2755 }
2756 
2757 static void iwl_mvm_stop_ap_ibss(struct ieee80211_hw *hw,
2758 				 struct ieee80211_vif *vif)
2759 {
2760 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2761 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2762 
2763 	iwl_mvm_prepare_mac_removal(mvm, vif);
2764 
2765 	mutex_lock(&mvm->mutex);
2766 
2767 	/* Handle AP stop while in CSA */
2768 	if (rcu_access_pointer(mvm->csa_vif) == vif) {
2769 		iwl_mvm_remove_time_event(mvm, mvmvif,
2770 					  &mvmvif->time_event_data);
2771 		RCU_INIT_POINTER(mvm->csa_vif, NULL);
2772 		mvmvif->csa_countdown = false;
2773 	}
2774 
2775 	if (rcu_access_pointer(mvm->csa_tx_blocked_vif) == vif) {
2776 		RCU_INIT_POINTER(mvm->csa_tx_blocked_vif, NULL);
2777 		mvm->csa_tx_block_bcn_timeout = 0;
2778 	}
2779 
2780 	mvmvif->ap_ibss_active = false;
2781 	mvm->ap_last_beacon_gp2 = 0;
2782 
2783 	if (vif->type == NL80211_IFTYPE_AP && !vif->p2p) {
2784 		iwl_mvm_vif_set_low_latency(mvmvif, false,
2785 					    LOW_LATENCY_VIF_TYPE);
2786 		iwl_mvm_send_low_latency_cmd(mvm, false,  mvmvif->id);
2787 	}
2788 
2789 	iwl_mvm_bt_coex_vif_change(mvm);
2790 
2791 	iwl_mvm_unref(mvm, IWL_MVM_REF_AP_IBSS);
2792 
2793 	/* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2794 	if (vif->p2p && mvm->p2p_device_vif)
2795 		iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2796 
2797 	iwl_mvm_update_quotas(mvm, false, NULL);
2798 
2799 	/*
2800 	 * This is not very nice, but the simplest:
2801 	 * For older FWs removing the mcast sta before the bcast station may
2802 	 * cause assert 0x2b00.
2803 	 * This is fixed in later FW (which will stop beaconing when removing
2804 	 * bcast station).
2805 	 * So make the order of removal depend on the TLV
2806 	 */
2807 	if (!fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE))
2808 		iwl_mvm_rm_mcast_sta(mvm, vif);
2809 	iwl_mvm_send_rm_bcast_sta(mvm, vif);
2810 	if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE))
2811 		iwl_mvm_rm_mcast_sta(mvm, vif);
2812 	iwl_mvm_binding_remove_vif(mvm, vif);
2813 
2814 	iwl_mvm_power_update_mac(mvm);
2815 
2816 	iwl_mvm_mac_ctxt_remove(mvm, vif);
2817 
2818 	mutex_unlock(&mvm->mutex);
2819 }
2820 
2821 static void
2822 iwl_mvm_bss_info_changed_ap_ibss(struct iwl_mvm *mvm,
2823 				 struct ieee80211_vif *vif,
2824 				 struct ieee80211_bss_conf *bss_conf,
2825 				 u32 changes)
2826 {
2827 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2828 
2829 	/* Changes will be applied when the AP/IBSS is started */
2830 	if (!mvmvif->ap_ibss_active)
2831 		return;
2832 
2833 	if (changes & (BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_HT |
2834 		       BSS_CHANGED_BANDWIDTH | BSS_CHANGED_QOS) &&
2835 	    iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL))
2836 		IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
2837 
2838 	/* Need to send a new beacon template to the FW */
2839 	if (changes & BSS_CHANGED_BEACON &&
2840 	    iwl_mvm_mac_ctxt_beacon_changed(mvm, vif))
2841 		IWL_WARN(mvm, "Failed updating beacon data\n");
2842 
2843 	if (changes & BSS_CHANGED_TXPOWER) {
2844 		IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2845 				bss_conf->txpower);
2846 		iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2847 	}
2848 
2849 	if (changes & BSS_CHANGED_FTM_RESPONDER) {
2850 		int ret = iwl_mvm_ftm_start_responder(mvm, vif);
2851 
2852 		if (ret)
2853 			IWL_WARN(mvm, "Failed to enable FTM responder (%d)\n",
2854 				 ret);
2855 	}
2856 
2857 }
2858 
2859 static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw,
2860 				     struct ieee80211_vif *vif,
2861 				     struct ieee80211_bss_conf *bss_conf,
2862 				     u32 changes)
2863 {
2864 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2865 
2866 	/*
2867 	 * iwl_mvm_bss_info_changed_station() might call
2868 	 * iwl_mvm_protect_session(), which reads directly from
2869 	 * the device (the system time), so make sure it is available.
2870 	 */
2871 	if (iwl_mvm_ref_sync(mvm, IWL_MVM_REF_BSS_CHANGED))
2872 		return;
2873 
2874 	mutex_lock(&mvm->mutex);
2875 
2876 	if (changes & BSS_CHANGED_IDLE && !bss_conf->idle)
2877 		iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true);
2878 
2879 	switch (vif->type) {
2880 	case NL80211_IFTYPE_STATION:
2881 		iwl_mvm_bss_info_changed_station(mvm, vif, bss_conf, changes);
2882 		break;
2883 	case NL80211_IFTYPE_AP:
2884 	case NL80211_IFTYPE_ADHOC:
2885 		iwl_mvm_bss_info_changed_ap_ibss(mvm, vif, bss_conf, changes);
2886 		break;
2887 	case NL80211_IFTYPE_MONITOR:
2888 		if (changes & BSS_CHANGED_MU_GROUPS)
2889 			iwl_mvm_update_mu_groups(mvm, vif);
2890 		break;
2891 	default:
2892 		/* shouldn't happen */
2893 		WARN_ON_ONCE(1);
2894 	}
2895 
2896 	mutex_unlock(&mvm->mutex);
2897 	iwl_mvm_unref(mvm, IWL_MVM_REF_BSS_CHANGED);
2898 }
2899 
2900 static int iwl_mvm_mac_hw_scan(struct ieee80211_hw *hw,
2901 			       struct ieee80211_vif *vif,
2902 			       struct ieee80211_scan_request *hw_req)
2903 {
2904 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2905 	int ret;
2906 
2907 	if (hw_req->req.n_channels == 0 ||
2908 	    hw_req->req.n_channels > mvm->fw->ucode_capa.n_scan_channels)
2909 		return -EINVAL;
2910 
2911 	mutex_lock(&mvm->mutex);
2912 	ret = iwl_mvm_reg_scan_start(mvm, vif, &hw_req->req, &hw_req->ies);
2913 	mutex_unlock(&mvm->mutex);
2914 
2915 	return ret;
2916 }
2917 
2918 static void iwl_mvm_mac_cancel_hw_scan(struct ieee80211_hw *hw,
2919 				       struct ieee80211_vif *vif)
2920 {
2921 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2922 
2923 	mutex_lock(&mvm->mutex);
2924 
2925 	/* Due to a race condition, it's possible that mac80211 asks
2926 	 * us to stop a hw_scan when it's already stopped.  This can
2927 	 * happen, for instance, if we stopped the scan ourselves,
2928 	 * called ieee80211_scan_completed() and the userspace called
2929 	 * cancel scan scan before ieee80211_scan_work() could run.
2930 	 * To handle that, simply return if the scan is not running.
2931 	*/
2932 	if (mvm->scan_status & IWL_MVM_SCAN_REGULAR)
2933 		iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true);
2934 
2935 	mutex_unlock(&mvm->mutex);
2936 }
2937 
2938 static void
2939 iwl_mvm_mac_allow_buffered_frames(struct ieee80211_hw *hw,
2940 				  struct ieee80211_sta *sta, u16 tids,
2941 				  int num_frames,
2942 				  enum ieee80211_frame_release_type reason,
2943 				  bool more_data)
2944 {
2945 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2946 
2947 	/* Called when we need to transmit (a) frame(s) from mac80211 */
2948 
2949 	iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2950 					  tids, more_data, false);
2951 }
2952 
2953 static void
2954 iwl_mvm_mac_release_buffered_frames(struct ieee80211_hw *hw,
2955 				    struct ieee80211_sta *sta, u16 tids,
2956 				    int num_frames,
2957 				    enum ieee80211_frame_release_type reason,
2958 				    bool more_data)
2959 {
2960 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2961 
2962 	/* Called when we need to transmit (a) frame(s) from agg or dqa queue */
2963 
2964 	iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2965 					  tids, more_data, true);
2966 }
2967 
2968 static void __iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
2969 				     enum sta_notify_cmd cmd,
2970 				     struct ieee80211_sta *sta)
2971 {
2972 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2973 	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
2974 	unsigned long txqs = 0, tids = 0;
2975 	int tid;
2976 
2977 	/*
2978 	 * If we have TVQM then we get too high queue numbers - luckily
2979 	 * we really shouldn't get here with that because such hardware
2980 	 * should have firmware supporting buffer station offload.
2981 	 */
2982 	if (WARN_ON(iwl_mvm_has_new_tx_api(mvm)))
2983 		return;
2984 
2985 	spin_lock_bh(&mvmsta->lock);
2986 	for (tid = 0; tid < ARRAY_SIZE(mvmsta->tid_data); tid++) {
2987 		struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
2988 
2989 		if (tid_data->txq_id == IWL_MVM_INVALID_QUEUE)
2990 			continue;
2991 
2992 		__set_bit(tid_data->txq_id, &txqs);
2993 
2994 		if (iwl_mvm_tid_queued(mvm, tid_data) == 0)
2995 			continue;
2996 
2997 		__set_bit(tid, &tids);
2998 	}
2999 
3000 	switch (cmd) {
3001 	case STA_NOTIFY_SLEEP:
3002 		for_each_set_bit(tid, &tids, IWL_MAX_TID_COUNT)
3003 			ieee80211_sta_set_buffered(sta, tid, true);
3004 
3005 		if (txqs)
3006 			iwl_trans_freeze_txq_timer(mvm->trans, txqs, true);
3007 		/*
3008 		 * The fw updates the STA to be asleep. Tx packets on the Tx
3009 		 * queues to this station will not be transmitted. The fw will
3010 		 * send a Tx response with TX_STATUS_FAIL_DEST_PS.
3011 		 */
3012 		break;
3013 	case STA_NOTIFY_AWAKE:
3014 		if (WARN_ON(mvmsta->sta_id == IWL_MVM_INVALID_STA))
3015 			break;
3016 
3017 		if (txqs)
3018 			iwl_trans_freeze_txq_timer(mvm->trans, txqs, false);
3019 		iwl_mvm_sta_modify_ps_wake(mvm, sta);
3020 		break;
3021 	default:
3022 		break;
3023 	}
3024 	spin_unlock_bh(&mvmsta->lock);
3025 }
3026 
3027 static void iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
3028 				   struct ieee80211_vif *vif,
3029 				   enum sta_notify_cmd cmd,
3030 				   struct ieee80211_sta *sta)
3031 {
3032 	__iwl_mvm_mac_sta_notify(hw, cmd, sta);
3033 }
3034 
3035 void iwl_mvm_sta_pm_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
3036 {
3037 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
3038 	struct iwl_mvm_pm_state_notification *notif = (void *)pkt->data;
3039 	struct ieee80211_sta *sta;
3040 	struct iwl_mvm_sta *mvmsta;
3041 	bool sleeping = (notif->type != IWL_MVM_PM_EVENT_AWAKE);
3042 
3043 	if (WARN_ON(notif->sta_id >= ARRAY_SIZE(mvm->fw_id_to_mac_id)))
3044 		return;
3045 
3046 	rcu_read_lock();
3047 	sta = rcu_dereference(mvm->fw_id_to_mac_id[notif->sta_id]);
3048 	if (WARN_ON(IS_ERR_OR_NULL(sta))) {
3049 		rcu_read_unlock();
3050 		return;
3051 	}
3052 
3053 	mvmsta = iwl_mvm_sta_from_mac80211(sta);
3054 
3055 	if (!mvmsta->vif ||
3056 	    mvmsta->vif->type != NL80211_IFTYPE_AP) {
3057 		rcu_read_unlock();
3058 		return;
3059 	}
3060 
3061 	if (mvmsta->sleeping != sleeping) {
3062 		mvmsta->sleeping = sleeping;
3063 		__iwl_mvm_mac_sta_notify(mvm->hw,
3064 			sleeping ? STA_NOTIFY_SLEEP : STA_NOTIFY_AWAKE,
3065 			sta);
3066 		ieee80211_sta_ps_transition(sta, sleeping);
3067 	}
3068 
3069 	if (sleeping) {
3070 		switch (notif->type) {
3071 		case IWL_MVM_PM_EVENT_AWAKE:
3072 		case IWL_MVM_PM_EVENT_ASLEEP:
3073 			break;
3074 		case IWL_MVM_PM_EVENT_UAPSD:
3075 			ieee80211_sta_uapsd_trigger(sta, IEEE80211_NUM_TIDS);
3076 			break;
3077 		case IWL_MVM_PM_EVENT_PS_POLL:
3078 			ieee80211_sta_pspoll(sta);
3079 			break;
3080 		default:
3081 			break;
3082 		}
3083 	}
3084 
3085 	rcu_read_unlock();
3086 }
3087 
3088 static void iwl_mvm_sta_pre_rcu_remove(struct ieee80211_hw *hw,
3089 				       struct ieee80211_vif *vif,
3090 				       struct ieee80211_sta *sta)
3091 {
3092 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3093 	struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
3094 
3095 	/*
3096 	 * This is called before mac80211 does RCU synchronisation,
3097 	 * so here we already invalidate our internal RCU-protected
3098 	 * station pointer. The rest of the code will thus no longer
3099 	 * be able to find the station this way, and we don't rely
3100 	 * on further RCU synchronisation after the sta_state()
3101 	 * callback deleted the station.
3102 	 */
3103 	mutex_lock(&mvm->mutex);
3104 	if (sta == rcu_access_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id]))
3105 		rcu_assign_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id],
3106 				   ERR_PTR(-ENOENT));
3107 
3108 	mutex_unlock(&mvm->mutex);
3109 }
3110 
3111 static void iwl_mvm_check_uapsd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
3112 				const u8 *bssid)
3113 {
3114 	int i;
3115 
3116 	if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
3117 		struct iwl_mvm_tcm_mac *mdata;
3118 
3119 		mdata = &mvm->tcm.data[iwl_mvm_vif_from_mac80211(vif)->id];
3120 		ewma_rate_init(&mdata->uapsd_nonagg_detect.rate);
3121 		mdata->opened_rx_ba_sessions = false;
3122 	}
3123 
3124 	if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT))
3125 		return;
3126 
3127 	if (vif->p2p && !iwl_mvm_is_p2p_scm_uapsd_supported(mvm)) {
3128 		vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
3129 		return;
3130 	}
3131 
3132 	if (!vif->p2p &&
3133 	    (iwlwifi_mod_params.uapsd_disable & IWL_DISABLE_UAPSD_BSS)) {
3134 		vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
3135 		return;
3136 	}
3137 
3138 	for (i = 0; i < IWL_MVM_UAPSD_NOAGG_LIST_LEN; i++) {
3139 		if (ether_addr_equal(mvm->uapsd_noagg_bssids[i].addr, bssid)) {
3140 			vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
3141 			return;
3142 		}
3143 	}
3144 
3145 	vif->driver_flags |= IEEE80211_VIF_SUPPORTS_UAPSD;
3146 }
3147 
3148 static void
3149 iwl_mvm_tdls_check_trigger(struct iwl_mvm *mvm,
3150 			   struct ieee80211_vif *vif, u8 *peer_addr,
3151 			   enum nl80211_tdls_operation action)
3152 {
3153 	struct iwl_fw_dbg_trigger_tlv *trig;
3154 	struct iwl_fw_dbg_trigger_tdls *tdls_trig;
3155 
3156 	trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
3157 				     FW_DBG_TRIGGER_TDLS);
3158 	if (!trig)
3159 		return;
3160 
3161 	tdls_trig = (void *)trig->data;
3162 
3163 	if (!(tdls_trig->action_bitmap & BIT(action)))
3164 		return;
3165 
3166 	if (tdls_trig->peer_mode &&
3167 	    memcmp(tdls_trig->peer, peer_addr, ETH_ALEN) != 0)
3168 		return;
3169 
3170 	iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
3171 				"TDLS event occurred, peer %pM, action %d",
3172 				peer_addr, action);
3173 }
3174 
3175 static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
3176 				 struct ieee80211_vif *vif,
3177 				 struct ieee80211_sta *sta,
3178 				 enum ieee80211_sta_state old_state,
3179 				 enum ieee80211_sta_state new_state)
3180 {
3181 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3182 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3183 	struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
3184 	int ret;
3185 
3186 	IWL_DEBUG_MAC80211(mvm, "station %pM state change %d->%d\n",
3187 			   sta->addr, old_state, new_state);
3188 
3189 	/* this would be a mac80211 bug ... but don't crash */
3190 	if (WARN_ON_ONCE(!mvmvif->phy_ctxt))
3191 		return -EINVAL;
3192 
3193 	/*
3194 	 * If we are in a STA removal flow and in DQA mode:
3195 	 *
3196 	 * This is after the sync_rcu part, so the queues have already been
3197 	 * flushed. No more TXs on their way in mac80211's path, and no more in
3198 	 * the queues.
3199 	 * Also, we won't be getting any new TX frames for this station.
3200 	 * What we might have are deferred TX frames that need to be taken care
3201 	 * of.
3202 	 *
3203 	 * Drop any still-queued deferred-frame before removing the STA, and
3204 	 * make sure the worker is no longer handling frames for this STA.
3205 	 */
3206 	if (old_state == IEEE80211_STA_NONE &&
3207 	    new_state == IEEE80211_STA_NOTEXIST) {
3208 		flush_work(&mvm->add_stream_wk);
3209 
3210 		/*
3211 		 * No need to make sure deferred TX indication is off since the
3212 		 * worker will already remove it if it was on
3213 		 */
3214 	}
3215 
3216 	mutex_lock(&mvm->mutex);
3217 	/* track whether or not the station is associated */
3218 	mvm_sta->sta_state = new_state;
3219 
3220 	if (old_state == IEEE80211_STA_NOTEXIST &&
3221 	    new_state == IEEE80211_STA_NONE) {
3222 		/*
3223 		 * Firmware bug - it'll crash if the beacon interval is less
3224 		 * than 16. We can't avoid connecting at all, so refuse the
3225 		 * station state change, this will cause mac80211 to abandon
3226 		 * attempts to connect to this AP, and eventually wpa_s will
3227 		 * blacklist the AP...
3228 		 */
3229 		if (vif->type == NL80211_IFTYPE_STATION &&
3230 		    vif->bss_conf.beacon_int < 16) {
3231 			IWL_ERR(mvm,
3232 				"AP %pM beacon interval is %d, refusing due to firmware bug!\n",
3233 				sta->addr, vif->bss_conf.beacon_int);
3234 			ret = -EINVAL;
3235 			goto out_unlock;
3236 		}
3237 
3238 		if (sta->tdls &&
3239 		    (vif->p2p ||
3240 		     iwl_mvm_tdls_sta_count(mvm, NULL) ==
3241 						IWL_MVM_TDLS_STA_COUNT ||
3242 		     iwl_mvm_phy_ctx_count(mvm) > 1)) {
3243 			IWL_DEBUG_MAC80211(mvm, "refusing TDLS sta\n");
3244 			ret = -EBUSY;
3245 			goto out_unlock;
3246 		}
3247 
3248 		ret = iwl_mvm_add_sta(mvm, vif, sta);
3249 		if (sta->tdls && ret == 0) {
3250 			iwl_mvm_recalc_tdls_state(mvm, vif, true);
3251 			iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3252 						   NL80211_TDLS_SETUP);
3253 		}
3254 
3255 		sta->max_rc_amsdu_len = 1;
3256 	} else if (old_state == IEEE80211_STA_NONE &&
3257 		   new_state == IEEE80211_STA_AUTH) {
3258 		/*
3259 		 * EBS may be disabled due to previous failures reported by FW.
3260 		 * Reset EBS status here assuming environment has been changed.
3261 		 */
3262 		mvm->last_ebs_successful = true;
3263 		iwl_mvm_check_uapsd(mvm, vif, sta->addr);
3264 		ret = 0;
3265 	} else if (old_state == IEEE80211_STA_AUTH &&
3266 		   new_state == IEEE80211_STA_ASSOC) {
3267 		if (vif->type == NL80211_IFTYPE_AP) {
3268 			vif->bss_conf.he_support = sta->he_cap.has_he;
3269 			mvmvif->ap_assoc_sta_count++;
3270 			iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3271 			if (vif->bss_conf.he_support &&
3272 			    !iwlwifi_mod_params.disable_11ax)
3273 				iwl_mvm_cfg_he_sta(mvm, vif, mvm_sta->sta_id);
3274 		} else if (vif->type == NL80211_IFTYPE_STATION) {
3275 			vif->bss_conf.he_support = sta->he_cap.has_he;
3276 			iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3277 		}
3278 
3279 		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3280 				     false);
3281 		ret = iwl_mvm_update_sta(mvm, vif, sta);
3282 	} else if (old_state == IEEE80211_STA_ASSOC &&
3283 		   new_state == IEEE80211_STA_AUTHORIZED) {
3284 		ret = 0;
3285 
3286 		/* we don't support TDLS during DCM */
3287 		if (iwl_mvm_phy_ctx_count(mvm) > 1)
3288 			iwl_mvm_teardown_tdls_peers(mvm);
3289 
3290 		if (sta->tdls)
3291 			iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3292 						   NL80211_TDLS_ENABLE_LINK);
3293 
3294 		/* enable beacon filtering */
3295 		WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
3296 
3297 		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3298 				     true);
3299 	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
3300 		   new_state == IEEE80211_STA_ASSOC) {
3301 		/* disable beacon filtering */
3302 		ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
3303 		WARN_ON(ret &&
3304 			!test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
3305 				  &mvm->status));
3306 		ret = 0;
3307 	} else if (old_state == IEEE80211_STA_ASSOC &&
3308 		   new_state == IEEE80211_STA_AUTH) {
3309 		if (vif->type == NL80211_IFTYPE_AP) {
3310 			mvmvif->ap_assoc_sta_count--;
3311 			iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3312 		}
3313 		ret = 0;
3314 	} else if (old_state == IEEE80211_STA_AUTH &&
3315 		   new_state == IEEE80211_STA_NONE) {
3316 		ret = 0;
3317 	} else if (old_state == IEEE80211_STA_NONE &&
3318 		   new_state == IEEE80211_STA_NOTEXIST) {
3319 		ret = iwl_mvm_rm_sta(mvm, vif, sta);
3320 		if (sta->tdls) {
3321 			iwl_mvm_recalc_tdls_state(mvm, vif, false);
3322 			iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3323 						   NL80211_TDLS_DISABLE_LINK);
3324 		}
3325 
3326 		if (unlikely(ret &&
3327 			     test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
3328 				      &mvm->status)))
3329 			ret = 0;
3330 	} else {
3331 		ret = -EIO;
3332 	}
3333  out_unlock:
3334 	mutex_unlock(&mvm->mutex);
3335 
3336 	if (sta->tdls && ret == 0) {
3337 		if (old_state == IEEE80211_STA_NOTEXIST &&
3338 		    new_state == IEEE80211_STA_NONE)
3339 			ieee80211_reserve_tid(sta, IWL_MVM_TDLS_FW_TID);
3340 		else if (old_state == IEEE80211_STA_NONE &&
3341 			 new_state == IEEE80211_STA_NOTEXIST)
3342 			ieee80211_unreserve_tid(sta, IWL_MVM_TDLS_FW_TID);
3343 	}
3344 
3345 	return ret;
3346 }
3347 
3348 static int iwl_mvm_mac_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
3349 {
3350 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3351 
3352 	mvm->rts_threshold = value;
3353 
3354 	return 0;
3355 }
3356 
3357 static void iwl_mvm_sta_rc_update(struct ieee80211_hw *hw,
3358 				  struct ieee80211_vif *vif,
3359 				  struct ieee80211_sta *sta, u32 changed)
3360 {
3361 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3362 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3363 
3364 	if (changed & (IEEE80211_RC_BW_CHANGED |
3365 		       IEEE80211_RC_SUPP_RATES_CHANGED |
3366 		       IEEE80211_RC_NSS_CHANGED))
3367 		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3368 				     true);
3369 
3370 	if (vif->type == NL80211_IFTYPE_STATION &&
3371 	    changed & IEEE80211_RC_NSS_CHANGED)
3372 		iwl_mvm_sf_update(mvm, vif, false);
3373 }
3374 
3375 static int iwl_mvm_mac_conf_tx(struct ieee80211_hw *hw,
3376 			       struct ieee80211_vif *vif, u16 ac,
3377 			       const struct ieee80211_tx_queue_params *params)
3378 {
3379 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3380 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3381 
3382 	mvmvif->queue_params[ac] = *params;
3383 
3384 	/*
3385 	 * No need to update right away, we'll get BSS_CHANGED_QOS
3386 	 * The exception is P2P_DEVICE interface which needs immediate update.
3387 	 */
3388 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
3389 		int ret;
3390 
3391 		mutex_lock(&mvm->mutex);
3392 		ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3393 		mutex_unlock(&mvm->mutex);
3394 		return ret;
3395 	}
3396 	return 0;
3397 }
3398 
3399 static void iwl_mvm_mac_mgd_prepare_tx(struct ieee80211_hw *hw,
3400 				       struct ieee80211_vif *vif,
3401 				       u16 req_duration)
3402 {
3403 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3404 	u32 duration = IWL_MVM_TE_SESSION_PROTECTION_MAX_TIME_MS;
3405 	u32 min_duration = IWL_MVM_TE_SESSION_PROTECTION_MIN_TIME_MS;
3406 
3407 	/*
3408 	 * iwl_mvm_protect_session() reads directly from the device
3409 	 * (the system time), so make sure it is available.
3410 	 */
3411 	if (iwl_mvm_ref_sync(mvm, IWL_MVM_REF_PREPARE_TX))
3412 		return;
3413 
3414 	if (req_duration > duration)
3415 		duration = req_duration;
3416 
3417 	mutex_lock(&mvm->mutex);
3418 	/* Try really hard to protect the session and hear a beacon */
3419 	iwl_mvm_protect_session(mvm, vif, duration, min_duration, 500, false);
3420 	mutex_unlock(&mvm->mutex);
3421 
3422 	iwl_mvm_unref(mvm, IWL_MVM_REF_PREPARE_TX);
3423 }
3424 
3425 static int iwl_mvm_mac_sched_scan_start(struct ieee80211_hw *hw,
3426 					struct ieee80211_vif *vif,
3427 					struct cfg80211_sched_scan_request *req,
3428 					struct ieee80211_scan_ies *ies)
3429 {
3430 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3431 
3432 	int ret;
3433 
3434 	mutex_lock(&mvm->mutex);
3435 
3436 	if (!vif->bss_conf.idle) {
3437 		ret = -EBUSY;
3438 		goto out;
3439 	}
3440 
3441 	ret = iwl_mvm_sched_scan_start(mvm, vif, req, ies, IWL_MVM_SCAN_SCHED);
3442 
3443 out:
3444 	mutex_unlock(&mvm->mutex);
3445 	return ret;
3446 }
3447 
3448 static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
3449 				       struct ieee80211_vif *vif)
3450 {
3451 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3452 	int ret;
3453 
3454 	mutex_lock(&mvm->mutex);
3455 
3456 	/* Due to a race condition, it's possible that mac80211 asks
3457 	 * us to stop a sched_scan when it's already stopped.  This
3458 	 * can happen, for instance, if we stopped the scan ourselves,
3459 	 * called ieee80211_sched_scan_stopped() and the userspace called
3460 	 * stop sched scan scan before ieee80211_sched_scan_stopped_work()
3461 	 * could run.  To handle this, simply return if the scan is
3462 	 * not running.
3463 	*/
3464 	if (!(mvm->scan_status & IWL_MVM_SCAN_SCHED)) {
3465 		mutex_unlock(&mvm->mutex);
3466 		return 0;
3467 	}
3468 
3469 	ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, false);
3470 	mutex_unlock(&mvm->mutex);
3471 	iwl_mvm_wait_for_async_handlers(mvm);
3472 
3473 	return ret;
3474 }
3475 
3476 static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
3477 			       enum set_key_cmd cmd,
3478 			       struct ieee80211_vif *vif,
3479 			       struct ieee80211_sta *sta,
3480 			       struct ieee80211_key_conf *key)
3481 {
3482 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3483 	struct iwl_mvm_sta *mvmsta;
3484 	struct iwl_mvm_key_pn *ptk_pn;
3485 	int keyidx = key->keyidx;
3486 	int ret;
3487 	u8 key_offset;
3488 
3489 	if (iwlwifi_mod_params.swcrypto) {
3490 		IWL_DEBUG_MAC80211(mvm, "leave - hwcrypto disabled\n");
3491 		return -EOPNOTSUPP;
3492 	}
3493 
3494 	switch (key->cipher) {
3495 	case WLAN_CIPHER_SUITE_TKIP:
3496 		if (!mvm->trans->cfg->gen2) {
3497 			key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3498 			key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3499 		} else if (vif->type == NL80211_IFTYPE_STATION) {
3500 			key->flags |= IEEE80211_KEY_FLAG_PUT_MIC_SPACE;
3501 		} else {
3502 			IWL_DEBUG_MAC80211(mvm, "Use SW encryption for TKIP\n");
3503 			return -EOPNOTSUPP;
3504 		}
3505 		break;
3506 	case WLAN_CIPHER_SUITE_CCMP:
3507 	case WLAN_CIPHER_SUITE_GCMP:
3508 	case WLAN_CIPHER_SUITE_GCMP_256:
3509 		if (!iwl_mvm_has_new_tx_api(mvm))
3510 			key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3511 		break;
3512 	case WLAN_CIPHER_SUITE_AES_CMAC:
3513 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
3514 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
3515 		WARN_ON_ONCE(!ieee80211_hw_check(hw, MFP_CAPABLE));
3516 		break;
3517 	case WLAN_CIPHER_SUITE_WEP40:
3518 	case WLAN_CIPHER_SUITE_WEP104:
3519 		if (vif->type == NL80211_IFTYPE_STATION)
3520 			break;
3521 		if (iwl_mvm_has_new_tx_api(mvm))
3522 			return -EOPNOTSUPP;
3523 		/* support HW crypto on TX */
3524 		return 0;
3525 	default:
3526 		/* currently FW supports only one optional cipher scheme */
3527 		if (hw->n_cipher_schemes &&
3528 		    hw->cipher_schemes->cipher == key->cipher)
3529 			key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3530 		else
3531 			return -EOPNOTSUPP;
3532 	}
3533 
3534 	mutex_lock(&mvm->mutex);
3535 
3536 	switch (cmd) {
3537 	case SET_KEY:
3538 		if ((vif->type == NL80211_IFTYPE_ADHOC ||
3539 		     vif->type == NL80211_IFTYPE_AP) && !sta) {
3540 			/*
3541 			 * GTK on AP interface is a TX-only key, return 0;
3542 			 * on IBSS they're per-station and because we're lazy
3543 			 * we don't support them for RX, so do the same.
3544 			 * CMAC/GMAC in AP/IBSS modes must be done in software.
3545 			 */
3546 			if (key->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
3547 			    key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
3548 			    key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256)
3549 				ret = -EOPNOTSUPP;
3550 			else
3551 				ret = 0;
3552 
3553 			if (key->cipher != WLAN_CIPHER_SUITE_GCMP &&
3554 			    key->cipher != WLAN_CIPHER_SUITE_GCMP_256 &&
3555 			    !iwl_mvm_has_new_tx_api(mvm)) {
3556 				key->hw_key_idx = STA_KEY_IDX_INVALID;
3557 				break;
3558 			}
3559 		}
3560 
3561 		/* During FW restart, in order to restore the state as it was,
3562 		 * don't try to reprogram keys we previously failed for.
3563 		 */
3564 		if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
3565 		    key->hw_key_idx == STA_KEY_IDX_INVALID) {
3566 			IWL_DEBUG_MAC80211(mvm,
3567 					   "skip invalid idx key programming during restart\n");
3568 			ret = 0;
3569 			break;
3570 		}
3571 
3572 		if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
3573 		    sta && iwl_mvm_has_new_rx_api(mvm) &&
3574 		    key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
3575 		    (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
3576 		     key->cipher == WLAN_CIPHER_SUITE_GCMP ||
3577 		     key->cipher == WLAN_CIPHER_SUITE_GCMP_256)) {
3578 			struct ieee80211_key_seq seq;
3579 			int tid, q;
3580 
3581 			mvmsta = iwl_mvm_sta_from_mac80211(sta);
3582 			WARN_ON(rcu_access_pointer(mvmsta->ptk_pn[keyidx]));
3583 			ptk_pn = kzalloc(struct_size(ptk_pn, q,
3584 						     mvm->trans->num_rx_queues),
3585 					 GFP_KERNEL);
3586 			if (!ptk_pn) {
3587 				ret = -ENOMEM;
3588 				break;
3589 			}
3590 
3591 			for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++) {
3592 				ieee80211_get_key_rx_seq(key, tid, &seq);
3593 				for (q = 0; q < mvm->trans->num_rx_queues; q++)
3594 					memcpy(ptk_pn->q[q].pn[tid],
3595 					       seq.ccmp.pn,
3596 					       IEEE80211_CCMP_PN_LEN);
3597 			}
3598 
3599 			rcu_assign_pointer(mvmsta->ptk_pn[keyidx], ptk_pn);
3600 		}
3601 
3602 		/* in HW restart reuse the index, otherwise request a new one */
3603 		if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
3604 			key_offset = key->hw_key_idx;
3605 		else
3606 			key_offset = STA_KEY_IDX_INVALID;
3607 
3608 		IWL_DEBUG_MAC80211(mvm, "set hwcrypto key\n");
3609 		ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, key_offset);
3610 		if (ret) {
3611 			IWL_WARN(mvm, "set key failed\n");
3612 			key->hw_key_idx = STA_KEY_IDX_INVALID;
3613 			/*
3614 			 * can't add key for RX, but we don't need it
3615 			 * in the device for TX so still return 0,
3616 			 * unless we have new TX API where we cannot
3617 			 * put key material into the TX_CMD
3618 			 */
3619 			if (iwl_mvm_has_new_tx_api(mvm))
3620 				ret = -EOPNOTSUPP;
3621 			else
3622 				ret = 0;
3623 		}
3624 
3625 		break;
3626 	case DISABLE_KEY:
3627 		if (key->hw_key_idx == STA_KEY_IDX_INVALID) {
3628 			ret = 0;
3629 			break;
3630 		}
3631 
3632 		if (sta && iwl_mvm_has_new_rx_api(mvm) &&
3633 		    key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
3634 		    (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
3635 		     key->cipher == WLAN_CIPHER_SUITE_GCMP ||
3636 		     key->cipher == WLAN_CIPHER_SUITE_GCMP_256)) {
3637 			mvmsta = iwl_mvm_sta_from_mac80211(sta);
3638 			ptk_pn = rcu_dereference_protected(
3639 						mvmsta->ptk_pn[keyidx],
3640 						lockdep_is_held(&mvm->mutex));
3641 			RCU_INIT_POINTER(mvmsta->ptk_pn[keyidx], NULL);
3642 			if (ptk_pn)
3643 				kfree_rcu(ptk_pn, rcu_head);
3644 		}
3645 
3646 		IWL_DEBUG_MAC80211(mvm, "disable hwcrypto key\n");
3647 		ret = iwl_mvm_remove_sta_key(mvm, vif, sta, key);
3648 		break;
3649 	default:
3650 		ret = -EINVAL;
3651 	}
3652 
3653 	mutex_unlock(&mvm->mutex);
3654 	return ret;
3655 }
3656 
3657 static void iwl_mvm_mac_update_tkip_key(struct ieee80211_hw *hw,
3658 					struct ieee80211_vif *vif,
3659 					struct ieee80211_key_conf *keyconf,
3660 					struct ieee80211_sta *sta,
3661 					u32 iv32, u16 *phase1key)
3662 {
3663 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3664 
3665 	if (keyconf->hw_key_idx == STA_KEY_IDX_INVALID)
3666 		return;
3667 
3668 	iwl_mvm_update_tkip_key(mvm, vif, keyconf, sta, iv32, phase1key);
3669 }
3670 
3671 
3672 static bool iwl_mvm_rx_aux_roc(struct iwl_notif_wait_data *notif_wait,
3673 			       struct iwl_rx_packet *pkt, void *data)
3674 {
3675 	struct iwl_mvm *mvm =
3676 		container_of(notif_wait, struct iwl_mvm, notif_wait);
3677 	struct iwl_hs20_roc_res *resp;
3678 	int resp_len = iwl_rx_packet_payload_len(pkt);
3679 	struct iwl_mvm_time_event_data *te_data = data;
3680 
3681 	if (WARN_ON(pkt->hdr.cmd != HOT_SPOT_CMD))
3682 		return true;
3683 
3684 	if (WARN_ON_ONCE(resp_len != sizeof(*resp))) {
3685 		IWL_ERR(mvm, "Invalid HOT_SPOT_CMD response\n");
3686 		return true;
3687 	}
3688 
3689 	resp = (void *)pkt->data;
3690 
3691 	IWL_DEBUG_TE(mvm,
3692 		     "Aux ROC: Received response from ucode: status=%d uid=%d\n",
3693 		     resp->status, resp->event_unique_id);
3694 
3695 	te_data->uid = le32_to_cpu(resp->event_unique_id);
3696 	IWL_DEBUG_TE(mvm, "TIME_EVENT_CMD response - UID = 0x%x\n",
3697 		     te_data->uid);
3698 
3699 	spin_lock_bh(&mvm->time_event_lock);
3700 	list_add_tail(&te_data->list, &mvm->aux_roc_te_list);
3701 	spin_unlock_bh(&mvm->time_event_lock);
3702 
3703 	return true;
3704 }
3705 
3706 #define AUX_ROC_MIN_DURATION MSEC_TO_TU(100)
3707 #define AUX_ROC_MIN_DELAY MSEC_TO_TU(200)
3708 #define AUX_ROC_MAX_DELAY MSEC_TO_TU(600)
3709 #define AUX_ROC_SAFETY_BUFFER MSEC_TO_TU(20)
3710 #define AUX_ROC_MIN_SAFETY_BUFFER MSEC_TO_TU(10)
3711 static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm,
3712 				    struct ieee80211_channel *channel,
3713 				    struct ieee80211_vif *vif,
3714 				    int duration)
3715 {
3716 	int res;
3717 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3718 	struct iwl_mvm_time_event_data *te_data = &mvmvif->hs_time_event_data;
3719 	static const u16 time_event_response[] = { HOT_SPOT_CMD };
3720 	struct iwl_notification_wait wait_time_event;
3721 	u32 dtim_interval = vif->bss_conf.dtim_period *
3722 		vif->bss_conf.beacon_int;
3723 	u32 req_dur, delay;
3724 	struct iwl_hs20_roc_req aux_roc_req = {
3725 		.action = cpu_to_le32(FW_CTXT_ACTION_ADD),
3726 		.id_and_color =
3727 			cpu_to_le32(FW_CMD_ID_AND_COLOR(MAC_INDEX_AUX, 0)),
3728 		.sta_id_and_color = cpu_to_le32(mvm->aux_sta.sta_id),
3729 	};
3730 	struct iwl_hs20_roc_req_tail *tail = iwl_mvm_chan_info_cmd_tail(mvm,
3731 		&aux_roc_req.channel_info);
3732 	u16 len = sizeof(aux_roc_req) - iwl_mvm_chan_info_padding(mvm);
3733 
3734 	/* Set the channel info data */
3735 	iwl_mvm_set_chan_info(mvm, &aux_roc_req.channel_info, channel->hw_value,
3736 			      (channel->band == NL80211_BAND_2GHZ) ?
3737 			       PHY_BAND_24 : PHY_BAND_5,
3738 			      PHY_VHT_CHANNEL_MODE20,
3739 			      0);
3740 
3741 	/* Set the time and duration */
3742 	tail->apply_time = cpu_to_le32(iwl_mvm_get_systime(mvm));
3743 
3744 	delay = AUX_ROC_MIN_DELAY;
3745 	req_dur = MSEC_TO_TU(duration);
3746 
3747 	/*
3748 	 * If we are associated we want the delay time to be at least one
3749 	 * dtim interval so that the FW can wait until after the DTIM and
3750 	 * then start the time event, this will potentially allow us to
3751 	 * remain off-channel for the max duration.
3752 	 * Since we want to use almost a whole dtim interval we would also
3753 	 * like the delay to be for 2-3 dtim intervals, in case there are
3754 	 * other time events with higher priority.
3755 	 */
3756 	if (vif->bss_conf.assoc) {
3757 		delay = min_t(u32, dtim_interval * 3, AUX_ROC_MAX_DELAY);
3758 		/* We cannot remain off-channel longer than the DTIM interval */
3759 		if (dtim_interval <= req_dur) {
3760 			req_dur = dtim_interval - AUX_ROC_SAFETY_BUFFER;
3761 			if (req_dur <= AUX_ROC_MIN_DURATION)
3762 				req_dur = dtim_interval -
3763 					AUX_ROC_MIN_SAFETY_BUFFER;
3764 		}
3765 	}
3766 
3767 	tail->duration = cpu_to_le32(req_dur);
3768 	tail->apply_time_max_delay = cpu_to_le32(delay);
3769 
3770 	IWL_DEBUG_TE(mvm,
3771 		     "ROC: Requesting to remain on channel %u for %ums (requested = %ums, max_delay = %ums, dtim_interval = %ums)\n",
3772 		     channel->hw_value, req_dur, duration, delay,
3773 		     dtim_interval);
3774 	/* Set the node address */
3775 	memcpy(tail->node_addr, vif->addr, ETH_ALEN);
3776 
3777 	lockdep_assert_held(&mvm->mutex);
3778 
3779 	spin_lock_bh(&mvm->time_event_lock);
3780 
3781 	if (WARN_ON(te_data->id == HOT_SPOT_CMD)) {
3782 		spin_unlock_bh(&mvm->time_event_lock);
3783 		return -EIO;
3784 	}
3785 
3786 	te_data->vif = vif;
3787 	te_data->duration = duration;
3788 	te_data->id = HOT_SPOT_CMD;
3789 
3790 	spin_unlock_bh(&mvm->time_event_lock);
3791 
3792 	/*
3793 	 * Use a notification wait, which really just processes the
3794 	 * command response and doesn't wait for anything, in order
3795 	 * to be able to process the response and get the UID inside
3796 	 * the RX path. Using CMD_WANT_SKB doesn't work because it
3797 	 * stores the buffer and then wakes up this thread, by which
3798 	 * time another notification (that the time event started)
3799 	 * might already be processed unsuccessfully.
3800 	 */
3801 	iwl_init_notification_wait(&mvm->notif_wait, &wait_time_event,
3802 				   time_event_response,
3803 				   ARRAY_SIZE(time_event_response),
3804 				   iwl_mvm_rx_aux_roc, te_data);
3805 
3806 	res = iwl_mvm_send_cmd_pdu(mvm, HOT_SPOT_CMD, 0, len,
3807 				   &aux_roc_req);
3808 
3809 	if (res) {
3810 		IWL_ERR(mvm, "Couldn't send HOT_SPOT_CMD: %d\n", res);
3811 		iwl_remove_notification(&mvm->notif_wait, &wait_time_event);
3812 		goto out_clear_te;
3813 	}
3814 
3815 	/* No need to wait for anything, so just pass 1 (0 isn't valid) */
3816 	res = iwl_wait_notification(&mvm->notif_wait, &wait_time_event, 1);
3817 	/* should never fail */
3818 	WARN_ON_ONCE(res);
3819 
3820 	if (res) {
3821  out_clear_te:
3822 		spin_lock_bh(&mvm->time_event_lock);
3823 		iwl_mvm_te_clear_data(mvm, te_data);
3824 		spin_unlock_bh(&mvm->time_event_lock);
3825 	}
3826 
3827 	return res;
3828 }
3829 
3830 static int iwl_mvm_roc(struct ieee80211_hw *hw,
3831 		       struct ieee80211_vif *vif,
3832 		       struct ieee80211_channel *channel,
3833 		       int duration,
3834 		       enum ieee80211_roc_type type)
3835 {
3836 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3837 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3838 	struct cfg80211_chan_def chandef;
3839 	struct iwl_mvm_phy_ctxt *phy_ctxt;
3840 	int ret, i;
3841 
3842 	IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value,
3843 			   duration, type);
3844 
3845 	/*
3846 	 * Flush the done work, just in case it's still pending, so that
3847 	 * the work it does can complete and we can accept new frames.
3848 	 */
3849 	flush_work(&mvm->roc_done_wk);
3850 
3851 	mutex_lock(&mvm->mutex);
3852 
3853 	switch (vif->type) {
3854 	case NL80211_IFTYPE_STATION:
3855 		if (fw_has_capa(&mvm->fw->ucode_capa,
3856 				IWL_UCODE_TLV_CAPA_HOTSPOT_SUPPORT)) {
3857 			/* Use aux roc framework (HS20) */
3858 			ret = iwl_mvm_send_aux_roc_cmd(mvm, channel,
3859 						       vif, duration);
3860 			goto out_unlock;
3861 		}
3862 		IWL_ERR(mvm, "hotspot not supported\n");
3863 		ret = -EINVAL;
3864 		goto out_unlock;
3865 	case NL80211_IFTYPE_P2P_DEVICE:
3866 		/* handle below */
3867 		break;
3868 	default:
3869 		IWL_ERR(mvm, "vif isn't P2P_DEVICE: %d\n", vif->type);
3870 		ret = -EINVAL;
3871 		goto out_unlock;
3872 	}
3873 
3874 	for (i = 0; i < NUM_PHY_CTX; i++) {
3875 		phy_ctxt = &mvm->phy_ctxts[i];
3876 		if (phy_ctxt->ref == 0 || mvmvif->phy_ctxt == phy_ctxt)
3877 			continue;
3878 
3879 		if (phy_ctxt->ref && channel == phy_ctxt->channel) {
3880 			/*
3881 			 * Unbind the P2P_DEVICE from the current PHY context,
3882 			 * and if the PHY context is not used remove it.
3883 			 */
3884 			ret = iwl_mvm_binding_remove_vif(mvm, vif);
3885 			if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3886 				goto out_unlock;
3887 
3888 			iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3889 
3890 			/* Bind the P2P_DEVICE to the current PHY Context */
3891 			mvmvif->phy_ctxt = phy_ctxt;
3892 
3893 			ret = iwl_mvm_binding_add_vif(mvm, vif);
3894 			if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3895 				goto out_unlock;
3896 
3897 			iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3898 			goto schedule_time_event;
3899 		}
3900 	}
3901 
3902 	/* Need to update the PHY context only if the ROC channel changed */
3903 	if (channel == mvmvif->phy_ctxt->channel)
3904 		goto schedule_time_event;
3905 
3906 	cfg80211_chandef_create(&chandef, channel, NL80211_CHAN_NO_HT);
3907 
3908 	/*
3909 	 * Change the PHY context configuration as it is currently referenced
3910 	 * only by the P2P Device MAC
3911 	 */
3912 	if (mvmvif->phy_ctxt->ref == 1) {
3913 		ret = iwl_mvm_phy_ctxt_changed(mvm, mvmvif->phy_ctxt,
3914 					       &chandef, 1, 1);
3915 		if (ret)
3916 			goto out_unlock;
3917 	} else {
3918 		/*
3919 		 * The PHY context is shared with other MACs. Need to remove the
3920 		 * P2P Device from the binding, allocate an new PHY context and
3921 		 * create a new binding
3922 		 */
3923 		phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3924 		if (!phy_ctxt) {
3925 			ret = -ENOSPC;
3926 			goto out_unlock;
3927 		}
3928 
3929 		ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &chandef,
3930 					       1, 1);
3931 		if (ret) {
3932 			IWL_ERR(mvm, "Failed to change PHY context\n");
3933 			goto out_unlock;
3934 		}
3935 
3936 		/* Unbind the P2P_DEVICE from the current PHY context */
3937 		ret = iwl_mvm_binding_remove_vif(mvm, vif);
3938 		if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3939 			goto out_unlock;
3940 
3941 		iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3942 
3943 		/* Bind the P2P_DEVICE to the new allocated PHY context */
3944 		mvmvif->phy_ctxt = phy_ctxt;
3945 
3946 		ret = iwl_mvm_binding_add_vif(mvm, vif);
3947 		if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3948 			goto out_unlock;
3949 
3950 		iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3951 	}
3952 
3953 schedule_time_event:
3954 	/* Schedule the time events */
3955 	ret = iwl_mvm_start_p2p_roc(mvm, vif, duration, type);
3956 
3957 out_unlock:
3958 	mutex_unlock(&mvm->mutex);
3959 	IWL_DEBUG_MAC80211(mvm, "leave\n");
3960 	return ret;
3961 }
3962 
3963 static int iwl_mvm_cancel_roc(struct ieee80211_hw *hw)
3964 {
3965 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3966 
3967 	IWL_DEBUG_MAC80211(mvm, "enter\n");
3968 
3969 	mutex_lock(&mvm->mutex);
3970 	iwl_mvm_stop_roc(mvm);
3971 	mutex_unlock(&mvm->mutex);
3972 
3973 	IWL_DEBUG_MAC80211(mvm, "leave\n");
3974 	return 0;
3975 }
3976 
3977 struct iwl_mvm_ftm_responder_iter_data {
3978 	bool responder;
3979 	struct ieee80211_chanctx_conf *ctx;
3980 };
3981 
3982 static void iwl_mvm_ftm_responder_chanctx_iter(void *_data, u8 *mac,
3983 					       struct ieee80211_vif *vif)
3984 {
3985 	struct iwl_mvm_ftm_responder_iter_data *data = _data;
3986 
3987 	if (rcu_access_pointer(vif->chanctx_conf) == data->ctx &&
3988 	    vif->type == NL80211_IFTYPE_AP && vif->bss_conf.ftmr_params)
3989 		data->responder = true;
3990 }
3991 
3992 static bool iwl_mvm_is_ftm_responder_chanctx(struct iwl_mvm *mvm,
3993 					     struct ieee80211_chanctx_conf *ctx)
3994 {
3995 	struct iwl_mvm_ftm_responder_iter_data data = {
3996 		.responder = false,
3997 		.ctx = ctx,
3998 	};
3999 
4000 	ieee80211_iterate_active_interfaces_atomic(mvm->hw,
4001 					IEEE80211_IFACE_ITER_NORMAL,
4002 					iwl_mvm_ftm_responder_chanctx_iter,
4003 					&data);
4004 	return data.responder;
4005 }
4006 
4007 static int __iwl_mvm_add_chanctx(struct iwl_mvm *mvm,
4008 				 struct ieee80211_chanctx_conf *ctx)
4009 {
4010 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
4011 	struct iwl_mvm_phy_ctxt *phy_ctxt;
4012 	bool responder = iwl_mvm_is_ftm_responder_chanctx(mvm, ctx);
4013 	struct cfg80211_chan_def *def = responder ? &ctx->def : &ctx->min_def;
4014 	int ret;
4015 
4016 	lockdep_assert_held(&mvm->mutex);
4017 
4018 	IWL_DEBUG_MAC80211(mvm, "Add channel context\n");
4019 
4020 	phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
4021 	if (!phy_ctxt) {
4022 		ret = -ENOSPC;
4023 		goto out;
4024 	}
4025 
4026 	ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, def,
4027 				       ctx->rx_chains_static,
4028 				       ctx->rx_chains_dynamic);
4029 	if (ret) {
4030 		IWL_ERR(mvm, "Failed to add PHY context\n");
4031 		goto out;
4032 	}
4033 
4034 	iwl_mvm_phy_ctxt_ref(mvm, phy_ctxt);
4035 	*phy_ctxt_id = phy_ctxt->id;
4036 out:
4037 	return ret;
4038 }
4039 
4040 static int iwl_mvm_add_chanctx(struct ieee80211_hw *hw,
4041 			       struct ieee80211_chanctx_conf *ctx)
4042 {
4043 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4044 	int ret;
4045 
4046 	mutex_lock(&mvm->mutex);
4047 	ret = __iwl_mvm_add_chanctx(mvm, ctx);
4048 	mutex_unlock(&mvm->mutex);
4049 
4050 	return ret;
4051 }
4052 
4053 static void __iwl_mvm_remove_chanctx(struct iwl_mvm *mvm,
4054 				     struct ieee80211_chanctx_conf *ctx)
4055 {
4056 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
4057 	struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
4058 
4059 	lockdep_assert_held(&mvm->mutex);
4060 
4061 	iwl_mvm_phy_ctxt_unref(mvm, phy_ctxt);
4062 }
4063 
4064 static void iwl_mvm_remove_chanctx(struct ieee80211_hw *hw,
4065 				   struct ieee80211_chanctx_conf *ctx)
4066 {
4067 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4068 
4069 	mutex_lock(&mvm->mutex);
4070 	__iwl_mvm_remove_chanctx(mvm, ctx);
4071 	mutex_unlock(&mvm->mutex);
4072 }
4073 
4074 static void iwl_mvm_change_chanctx(struct ieee80211_hw *hw,
4075 				   struct ieee80211_chanctx_conf *ctx,
4076 				   u32 changed)
4077 {
4078 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4079 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
4080 	struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
4081 	bool responder = iwl_mvm_is_ftm_responder_chanctx(mvm, ctx);
4082 	struct cfg80211_chan_def *def = responder ? &ctx->def : &ctx->min_def;
4083 
4084 	if (WARN_ONCE((phy_ctxt->ref > 1) &&
4085 		      (changed & ~(IEEE80211_CHANCTX_CHANGE_WIDTH |
4086 				   IEEE80211_CHANCTX_CHANGE_RX_CHAINS |
4087 				   IEEE80211_CHANCTX_CHANGE_RADAR |
4088 				   IEEE80211_CHANCTX_CHANGE_MIN_WIDTH)),
4089 		      "Cannot change PHY. Ref=%d, changed=0x%X\n",
4090 		      phy_ctxt->ref, changed))
4091 		return;
4092 
4093 	mutex_lock(&mvm->mutex);
4094 
4095 	/* we are only changing the min_width, may be a noop */
4096 	if (changed == IEEE80211_CHANCTX_CHANGE_MIN_WIDTH) {
4097 		if (phy_ctxt->width == def->width)
4098 			goto out_unlock;
4099 
4100 		/* we are just toggling between 20_NOHT and 20 */
4101 		if (phy_ctxt->width <= NL80211_CHAN_WIDTH_20 &&
4102 		    def->width <= NL80211_CHAN_WIDTH_20)
4103 			goto out_unlock;
4104 	}
4105 
4106 	iwl_mvm_bt_coex_vif_change(mvm);
4107 	iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, def,
4108 				 ctx->rx_chains_static,
4109 				 ctx->rx_chains_dynamic);
4110 
4111 out_unlock:
4112 	mutex_unlock(&mvm->mutex);
4113 }
4114 
4115 static int __iwl_mvm_assign_vif_chanctx(struct iwl_mvm *mvm,
4116 					struct ieee80211_vif *vif,
4117 					struct ieee80211_chanctx_conf *ctx,
4118 					bool switching_chanctx)
4119 {
4120 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
4121 	struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
4122 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4123 	int ret;
4124 
4125 	lockdep_assert_held(&mvm->mutex);
4126 
4127 	mvmvif->phy_ctxt = phy_ctxt;
4128 
4129 	switch (vif->type) {
4130 	case NL80211_IFTYPE_AP:
4131 		/* only needed if we're switching chanctx (i.e. during CSA) */
4132 		if (switching_chanctx) {
4133 			mvmvif->ap_ibss_active = true;
4134 			break;
4135 		}
4136 		/* fall through */
4137 	case NL80211_IFTYPE_ADHOC:
4138 		/*
4139 		 * The AP binding flow is handled as part of the start_ap flow
4140 		 * (in bss_info_changed), similarly for IBSS.
4141 		 */
4142 		ret = 0;
4143 		goto out;
4144 	case NL80211_IFTYPE_STATION:
4145 		mvmvif->csa_bcn_pending = false;
4146 		break;
4147 	case NL80211_IFTYPE_MONITOR:
4148 		/* always disable PS when a monitor interface is active */
4149 		mvmvif->ps_disabled = true;
4150 		break;
4151 	default:
4152 		ret = -EINVAL;
4153 		goto out;
4154 	}
4155 
4156 	ret = iwl_mvm_binding_add_vif(mvm, vif);
4157 	if (ret)
4158 		goto out;
4159 
4160 	/*
4161 	 * Power state must be updated before quotas,
4162 	 * otherwise fw will complain.
4163 	 */
4164 	iwl_mvm_power_update_mac(mvm);
4165 
4166 	/* Setting the quota at this stage is only required for monitor
4167 	 * interfaces. For the other types, the bss_info changed flow
4168 	 * will handle quota settings.
4169 	 */
4170 	if (vif->type == NL80211_IFTYPE_MONITOR) {
4171 		mvmvif->monitor_active = true;
4172 		ret = iwl_mvm_update_quotas(mvm, false, NULL);
4173 		if (ret)
4174 			goto out_remove_binding;
4175 
4176 		ret = iwl_mvm_add_snif_sta(mvm, vif);
4177 		if (ret)
4178 			goto out_remove_binding;
4179 
4180 	}
4181 
4182 	/* Handle binding during CSA */
4183 	if (vif->type == NL80211_IFTYPE_AP) {
4184 		iwl_mvm_update_quotas(mvm, false, NULL);
4185 		iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
4186 	}
4187 
4188 	if (switching_chanctx && vif->type == NL80211_IFTYPE_STATION) {
4189 		mvmvif->csa_bcn_pending = true;
4190 
4191 		if (!fw_has_capa(&mvm->fw->ucode_capa,
4192 				 IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
4193 			u32 duration = 3 * vif->bss_conf.beacon_int;
4194 
4195 
4196 			/* iwl_mvm_protect_session() reads directly from the
4197 			 * device (the system time), so make sure it is
4198 			 * available.
4199 			 */
4200 			ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_PROTECT_CSA);
4201 			if (ret)
4202 				goto out_remove_binding;
4203 
4204 			/* Protect the session to make sure we hear the first
4205 			 * beacon on the new channel.
4206 			 */
4207 			iwl_mvm_protect_session(mvm, vif, duration, duration,
4208 						vif->bss_conf.beacon_int / 2,
4209 						true);
4210 
4211 			iwl_mvm_unref(mvm, IWL_MVM_REF_PROTECT_CSA);
4212 		}
4213 
4214 		iwl_mvm_update_quotas(mvm, false, NULL);
4215 	}
4216 
4217 	goto out;
4218 
4219 out_remove_binding:
4220 	iwl_mvm_binding_remove_vif(mvm, vif);
4221 	iwl_mvm_power_update_mac(mvm);
4222 out:
4223 	if (ret)
4224 		mvmvif->phy_ctxt = NULL;
4225 	return ret;
4226 }
4227 static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
4228 				      struct ieee80211_vif *vif,
4229 				      struct ieee80211_chanctx_conf *ctx)
4230 {
4231 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4232 	int ret;
4233 
4234 	mutex_lock(&mvm->mutex);
4235 	ret = __iwl_mvm_assign_vif_chanctx(mvm, vif, ctx, false);
4236 	mutex_unlock(&mvm->mutex);
4237 
4238 	return ret;
4239 }
4240 
4241 static void __iwl_mvm_unassign_vif_chanctx(struct iwl_mvm *mvm,
4242 					   struct ieee80211_vif *vif,
4243 					   struct ieee80211_chanctx_conf *ctx,
4244 					   bool switching_chanctx)
4245 {
4246 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4247 	struct ieee80211_vif *disabled_vif = NULL;
4248 
4249 	lockdep_assert_held(&mvm->mutex);
4250 
4251 	iwl_mvm_remove_time_event(mvm, mvmvif, &mvmvif->time_event_data);
4252 
4253 	switch (vif->type) {
4254 	case NL80211_IFTYPE_ADHOC:
4255 		goto out;
4256 	case NL80211_IFTYPE_MONITOR:
4257 		mvmvif->monitor_active = false;
4258 		mvmvif->ps_disabled = false;
4259 		iwl_mvm_rm_snif_sta(mvm, vif);
4260 		break;
4261 	case NL80211_IFTYPE_AP:
4262 		/* This part is triggered only during CSA */
4263 		if (!switching_chanctx || !mvmvif->ap_ibss_active)
4264 			goto out;
4265 
4266 		mvmvif->csa_countdown = false;
4267 
4268 		/* Set CS bit on all the stations */
4269 		iwl_mvm_modify_all_sta_disable_tx(mvm, mvmvif, true);
4270 
4271 		/* Save blocked iface, the timeout is set on the next beacon */
4272 		rcu_assign_pointer(mvm->csa_tx_blocked_vif, vif);
4273 
4274 		mvmvif->ap_ibss_active = false;
4275 		break;
4276 	case NL80211_IFTYPE_STATION:
4277 		if (!switching_chanctx)
4278 			break;
4279 
4280 		disabled_vif = vif;
4281 
4282 		if (!fw_has_capa(&mvm->fw->ucode_capa,
4283 				 IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD))
4284 			iwl_mvm_mac_ctxt_changed(mvm, vif, true, NULL);
4285 		break;
4286 	default:
4287 		break;
4288 	}
4289 
4290 	iwl_mvm_update_quotas(mvm, false, disabled_vif);
4291 	iwl_mvm_binding_remove_vif(mvm, vif);
4292 
4293 out:
4294 	mvmvif->phy_ctxt = NULL;
4295 	iwl_mvm_power_update_mac(mvm);
4296 }
4297 
4298 static void iwl_mvm_unassign_vif_chanctx(struct ieee80211_hw *hw,
4299 					 struct ieee80211_vif *vif,
4300 					 struct ieee80211_chanctx_conf *ctx)
4301 {
4302 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4303 
4304 	mutex_lock(&mvm->mutex);
4305 	__iwl_mvm_unassign_vif_chanctx(mvm, vif, ctx, false);
4306 	mutex_unlock(&mvm->mutex);
4307 }
4308 
4309 static int
4310 iwl_mvm_switch_vif_chanctx_swap(struct iwl_mvm *mvm,
4311 				struct ieee80211_vif_chanctx_switch *vifs)
4312 {
4313 	int ret;
4314 
4315 	mutex_lock(&mvm->mutex);
4316 	__iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
4317 	__iwl_mvm_remove_chanctx(mvm, vifs[0].old_ctx);
4318 
4319 	ret = __iwl_mvm_add_chanctx(mvm, vifs[0].new_ctx);
4320 	if (ret) {
4321 		IWL_ERR(mvm, "failed to add new_ctx during channel switch\n");
4322 		goto out_reassign;
4323 	}
4324 
4325 	ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
4326 					   true);
4327 	if (ret) {
4328 		IWL_ERR(mvm,
4329 			"failed to assign new_ctx during channel switch\n");
4330 		goto out_remove;
4331 	}
4332 
4333 	/* we don't support TDLS during DCM - can be caused by channel switch */
4334 	if (iwl_mvm_phy_ctx_count(mvm) > 1)
4335 		iwl_mvm_teardown_tdls_peers(mvm);
4336 
4337 	goto out;
4338 
4339 out_remove:
4340 	__iwl_mvm_remove_chanctx(mvm, vifs[0].new_ctx);
4341 
4342 out_reassign:
4343 	if (__iwl_mvm_add_chanctx(mvm, vifs[0].old_ctx)) {
4344 		IWL_ERR(mvm, "failed to add old_ctx back after failure.\n");
4345 		goto out_restart;
4346 	}
4347 
4348 	if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
4349 					 true)) {
4350 		IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
4351 		goto out_restart;
4352 	}
4353 
4354 	goto out;
4355 
4356 out_restart:
4357 	/* things keep failing, better restart the hw */
4358 	iwl_mvm_nic_restart(mvm, false);
4359 
4360 out:
4361 	mutex_unlock(&mvm->mutex);
4362 
4363 	return ret;
4364 }
4365 
4366 static int
4367 iwl_mvm_switch_vif_chanctx_reassign(struct iwl_mvm *mvm,
4368 				    struct ieee80211_vif_chanctx_switch *vifs)
4369 {
4370 	int ret;
4371 
4372 	mutex_lock(&mvm->mutex);
4373 	__iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
4374 
4375 	ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
4376 					   true);
4377 	if (ret) {
4378 		IWL_ERR(mvm,
4379 			"failed to assign new_ctx during channel switch\n");
4380 		goto out_reassign;
4381 	}
4382 
4383 	goto out;
4384 
4385 out_reassign:
4386 	if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
4387 					 true)) {
4388 		IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
4389 		goto out_restart;
4390 	}
4391 
4392 	goto out;
4393 
4394 out_restart:
4395 	/* things keep failing, better restart the hw */
4396 	iwl_mvm_nic_restart(mvm, false);
4397 
4398 out:
4399 	mutex_unlock(&mvm->mutex);
4400 
4401 	return ret;
4402 }
4403 
4404 static int iwl_mvm_switch_vif_chanctx(struct ieee80211_hw *hw,
4405 				      struct ieee80211_vif_chanctx_switch *vifs,
4406 				      int n_vifs,
4407 				      enum ieee80211_chanctx_switch_mode mode)
4408 {
4409 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4410 	int ret;
4411 
4412 	/* we only support a single-vif right now */
4413 	if (n_vifs > 1)
4414 		return -EOPNOTSUPP;
4415 
4416 	switch (mode) {
4417 	case CHANCTX_SWMODE_SWAP_CONTEXTS:
4418 		ret = iwl_mvm_switch_vif_chanctx_swap(mvm, vifs);
4419 		break;
4420 	case CHANCTX_SWMODE_REASSIGN_VIF:
4421 		ret = iwl_mvm_switch_vif_chanctx_reassign(mvm, vifs);
4422 		break;
4423 	default:
4424 		ret = -EOPNOTSUPP;
4425 		break;
4426 	}
4427 
4428 	return ret;
4429 }
4430 
4431 static int iwl_mvm_tx_last_beacon(struct ieee80211_hw *hw)
4432 {
4433 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4434 
4435 	return mvm->ibss_manager;
4436 }
4437 
4438 static int iwl_mvm_set_tim(struct ieee80211_hw *hw,
4439 			   struct ieee80211_sta *sta,
4440 			   bool set)
4441 {
4442 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4443 	struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
4444 
4445 	if (!mvm_sta || !mvm_sta->vif) {
4446 		IWL_ERR(mvm, "Station is not associated to a vif\n");
4447 		return -EINVAL;
4448 	}
4449 
4450 	return iwl_mvm_mac_ctxt_beacon_changed(mvm, mvm_sta->vif);
4451 }
4452 
4453 #ifdef CONFIG_NL80211_TESTMODE
4454 static const struct nla_policy iwl_mvm_tm_policy[IWL_MVM_TM_ATTR_MAX + 1] = {
4455 	[IWL_MVM_TM_ATTR_CMD] = { .type = NLA_U32 },
4456 	[IWL_MVM_TM_ATTR_NOA_DURATION] = { .type = NLA_U32 },
4457 	[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE] = { .type = NLA_U32 },
4458 };
4459 
4460 static int __iwl_mvm_mac_testmode_cmd(struct iwl_mvm *mvm,
4461 				      struct ieee80211_vif *vif,
4462 				      void *data, int len)
4463 {
4464 	struct nlattr *tb[IWL_MVM_TM_ATTR_MAX + 1];
4465 	int err;
4466 	u32 noa_duration;
4467 
4468 	err = nla_parse_deprecated(tb, IWL_MVM_TM_ATTR_MAX, data, len,
4469 				   iwl_mvm_tm_policy, NULL);
4470 	if (err)
4471 		return err;
4472 
4473 	if (!tb[IWL_MVM_TM_ATTR_CMD])
4474 		return -EINVAL;
4475 
4476 	switch (nla_get_u32(tb[IWL_MVM_TM_ATTR_CMD])) {
4477 	case IWL_MVM_TM_CMD_SET_NOA:
4478 		if (!vif || vif->type != NL80211_IFTYPE_AP || !vif->p2p ||
4479 		    !vif->bss_conf.enable_beacon ||
4480 		    !tb[IWL_MVM_TM_ATTR_NOA_DURATION])
4481 			return -EINVAL;
4482 
4483 		noa_duration = nla_get_u32(tb[IWL_MVM_TM_ATTR_NOA_DURATION]);
4484 		if (noa_duration >= vif->bss_conf.beacon_int)
4485 			return -EINVAL;
4486 
4487 		mvm->noa_duration = noa_duration;
4488 		mvm->noa_vif = vif;
4489 
4490 		return iwl_mvm_update_quotas(mvm, true, NULL);
4491 	case IWL_MVM_TM_CMD_SET_BEACON_FILTER:
4492 		/* must be associated client vif - ignore authorized */
4493 		if (!vif || vif->type != NL80211_IFTYPE_STATION ||
4494 		    !vif->bss_conf.assoc || !vif->bss_conf.dtim_period ||
4495 		    !tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE])
4496 			return -EINVAL;
4497 
4498 		if (nla_get_u32(tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE]))
4499 			return iwl_mvm_enable_beacon_filter(mvm, vif, 0);
4500 		return iwl_mvm_disable_beacon_filter(mvm, vif, 0);
4501 	}
4502 
4503 	return -EOPNOTSUPP;
4504 }
4505 
4506 static int iwl_mvm_mac_testmode_cmd(struct ieee80211_hw *hw,
4507 				    struct ieee80211_vif *vif,
4508 				    void *data, int len)
4509 {
4510 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4511 	int err;
4512 
4513 	mutex_lock(&mvm->mutex);
4514 	err = __iwl_mvm_mac_testmode_cmd(mvm, vif, data, len);
4515 	mutex_unlock(&mvm->mutex);
4516 
4517 	return err;
4518 }
4519 #endif
4520 
4521 static void iwl_mvm_channel_switch(struct ieee80211_hw *hw,
4522 				   struct ieee80211_vif *vif,
4523 				   struct ieee80211_channel_switch *chsw)
4524 {
4525 	/* By implementing this operation, we prevent mac80211 from
4526 	 * starting its own channel switch timer, so that we can call
4527 	 * ieee80211_chswitch_done() ourselves at the right time
4528 	 * (which is when the absence time event starts).
4529 	 */
4530 
4531 	IWL_DEBUG_MAC80211(IWL_MAC80211_GET_MVM(hw),
4532 			   "dummy channel switch op\n");
4533 }
4534 
4535 static int iwl_mvm_schedule_client_csa(struct iwl_mvm *mvm,
4536 				       struct ieee80211_vif *vif,
4537 				       struct ieee80211_channel_switch *chsw)
4538 {
4539 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4540 	struct iwl_chan_switch_te_cmd cmd = {
4541 		.mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
4542 							  mvmvif->color)),
4543 		.action = cpu_to_le32(FW_CTXT_ACTION_ADD),
4544 		.tsf = cpu_to_le32(chsw->timestamp),
4545 		.cs_count = chsw->count,
4546 		.cs_mode = chsw->block_tx,
4547 	};
4548 
4549 	lockdep_assert_held(&mvm->mutex);
4550 
4551 	if (chsw->delay)
4552 		cmd.cs_delayed_bcn_count =
4553 			DIV_ROUND_UP(chsw->delay, vif->bss_conf.beacon_int);
4554 
4555 	return iwl_mvm_send_cmd_pdu(mvm,
4556 				    WIDE_ID(MAC_CONF_GROUP,
4557 					    CHANNEL_SWITCH_TIME_EVENT_CMD),
4558 				    0, sizeof(cmd), &cmd);
4559 }
4560 
4561 #define IWL_MAX_CSA_BLOCK_TX 1500
4562 static int iwl_mvm_pre_channel_switch(struct ieee80211_hw *hw,
4563 				      struct ieee80211_vif *vif,
4564 				      struct ieee80211_channel_switch *chsw)
4565 {
4566 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4567 	struct ieee80211_vif *csa_vif;
4568 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4569 	u32 apply_time;
4570 	int ret;
4571 
4572 	mutex_lock(&mvm->mutex);
4573 
4574 	mvmvif->csa_failed = false;
4575 
4576 	IWL_DEBUG_MAC80211(mvm, "pre CSA to freq %d\n",
4577 			   chsw->chandef.center_freq1);
4578 
4579 	iwl_fw_dbg_trigger_simple_stop(&mvm->fwrt,
4580 				       ieee80211_vif_to_wdev(vif),
4581 				       FW_DBG_TRIGGER_CHANNEL_SWITCH);
4582 
4583 	switch (vif->type) {
4584 	case NL80211_IFTYPE_AP:
4585 		csa_vif =
4586 			rcu_dereference_protected(mvm->csa_vif,
4587 						  lockdep_is_held(&mvm->mutex));
4588 		if (WARN_ONCE(csa_vif && csa_vif->csa_active,
4589 			      "Another CSA is already in progress")) {
4590 			ret = -EBUSY;
4591 			goto out_unlock;
4592 		}
4593 
4594 		/* we still didn't unblock tx. prevent new CS meanwhile */
4595 		if (rcu_dereference_protected(mvm->csa_tx_blocked_vif,
4596 					      lockdep_is_held(&mvm->mutex))) {
4597 			ret = -EBUSY;
4598 			goto out_unlock;
4599 		}
4600 
4601 		rcu_assign_pointer(mvm->csa_vif, vif);
4602 
4603 		if (WARN_ONCE(mvmvif->csa_countdown,
4604 			      "Previous CSA countdown didn't complete")) {
4605 			ret = -EBUSY;
4606 			goto out_unlock;
4607 		}
4608 
4609 		mvmvif->csa_target_freq = chsw->chandef.chan->center_freq;
4610 
4611 		break;
4612 	case NL80211_IFTYPE_STATION:
4613 		/* Schedule the time event to a bit before beacon 1,
4614 		 * to make sure we're in the new channel when the
4615 		 * GO/AP arrives. In case count <= 1 immediately schedule the
4616 		 * TE (this might result with some packet loss or connection
4617 		 * loss).
4618 		 */
4619 		if (chsw->count <= 1)
4620 			apply_time = 0;
4621 		else
4622 			apply_time = chsw->device_timestamp +
4623 				((vif->bss_conf.beacon_int * (chsw->count - 1) -
4624 				  IWL_MVM_CHANNEL_SWITCH_TIME_CLIENT) * 1024);
4625 
4626 		if (chsw->block_tx) {
4627 			iwl_mvm_csa_client_absent(mvm, vif);
4628 			/*
4629 			 * In case of undetermined / long time with immediate
4630 			 * quiet monitor status to gracefully disconnect
4631 			 */
4632 			if (!chsw->count ||
4633 			    chsw->count * vif->bss_conf.beacon_int >
4634 			    IWL_MAX_CSA_BLOCK_TX)
4635 				schedule_delayed_work(&mvmvif->csa_work,
4636 						      msecs_to_jiffies(IWL_MAX_CSA_BLOCK_TX));
4637 		}
4638 
4639 		if (mvmvif->bf_data.bf_enabled) {
4640 			ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
4641 			if (ret)
4642 				goto out_unlock;
4643 		}
4644 
4645 		if (fw_has_capa(&mvm->fw->ucode_capa,
4646 				IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD))
4647 			iwl_mvm_schedule_client_csa(mvm, vif, chsw);
4648 		else
4649 			iwl_mvm_schedule_csa_period(mvm, vif,
4650 						    vif->bss_conf.beacon_int,
4651 						    apply_time);
4652 
4653 		mvmvif->csa_count = chsw->count;
4654 		mvmvif->csa_misbehave = false;
4655 		break;
4656 	default:
4657 		break;
4658 	}
4659 
4660 	mvmvif->ps_disabled = true;
4661 
4662 	ret = iwl_mvm_power_update_ps(mvm);
4663 	if (ret)
4664 		goto out_unlock;
4665 
4666 	/* we won't be on this channel any longer */
4667 	iwl_mvm_teardown_tdls_peers(mvm);
4668 
4669 out_unlock:
4670 	mutex_unlock(&mvm->mutex);
4671 
4672 	return ret;
4673 }
4674 
4675 static void iwl_mvm_channel_switch_rx_beacon(struct ieee80211_hw *hw,
4676 					     struct ieee80211_vif *vif,
4677 					     struct ieee80211_channel_switch *chsw)
4678 {
4679 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4680 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4681 	struct iwl_chan_switch_te_cmd cmd = {
4682 		.mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
4683 							  mvmvif->color)),
4684 		.action = cpu_to_le32(FW_CTXT_ACTION_MODIFY),
4685 		.tsf = cpu_to_le32(chsw->timestamp),
4686 		.cs_count = chsw->count,
4687 		.cs_mode = chsw->block_tx,
4688 	};
4689 
4690 	if (!fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_CS_MODIFY))
4691 		return;
4692 
4693 	if (chsw->count >= mvmvif->csa_count && chsw->block_tx) {
4694 		if (mvmvif->csa_misbehave) {
4695 			/* Second time, give up on this AP*/
4696 			iwl_mvm_abort_channel_switch(hw, vif);
4697 			ieee80211_chswitch_done(vif, false);
4698 			mvmvif->csa_misbehave = false;
4699 			return;
4700 		}
4701 		mvmvif->csa_misbehave = true;
4702 	}
4703 	mvmvif->csa_count = chsw->count;
4704 
4705 	IWL_DEBUG_MAC80211(mvm, "Modify CSA on mac %d\n", mvmvif->id);
4706 
4707 	WARN_ON(iwl_mvm_send_cmd_pdu(mvm,
4708 				     WIDE_ID(MAC_CONF_GROUP,
4709 					     CHANNEL_SWITCH_TIME_EVENT_CMD),
4710 				     CMD_ASYNC, sizeof(cmd), &cmd));
4711 }
4712 
4713 static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop)
4714 {
4715 	int i;
4716 
4717 	if (!iwl_mvm_has_new_tx_api(mvm)) {
4718 		if (drop) {
4719 			mutex_lock(&mvm->mutex);
4720 			iwl_mvm_flush_tx_path(mvm,
4721 				iwl_mvm_flushable_queues(mvm) & queues, 0);
4722 			mutex_unlock(&mvm->mutex);
4723 		} else {
4724 			iwl_trans_wait_tx_queues_empty(mvm->trans, queues);
4725 		}
4726 		return;
4727 	}
4728 
4729 	mutex_lock(&mvm->mutex);
4730 	for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
4731 		struct ieee80211_sta *sta;
4732 
4733 		sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
4734 						lockdep_is_held(&mvm->mutex));
4735 		if (IS_ERR_OR_NULL(sta))
4736 			continue;
4737 
4738 		if (drop)
4739 			iwl_mvm_flush_sta_tids(mvm, i, 0xFF, 0);
4740 		else
4741 			iwl_mvm_wait_sta_queues_empty(mvm,
4742 					iwl_mvm_sta_from_mac80211(sta));
4743 	}
4744 	mutex_unlock(&mvm->mutex);
4745 }
4746 
4747 static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
4748 			      struct ieee80211_vif *vif, u32 queues, bool drop)
4749 {
4750 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4751 	struct iwl_mvm_vif *mvmvif;
4752 	struct iwl_mvm_sta *mvmsta;
4753 	struct ieee80211_sta *sta;
4754 	int i;
4755 	u32 msk = 0;
4756 
4757 	if (!vif) {
4758 		iwl_mvm_flush_no_vif(mvm, queues, drop);
4759 		return;
4760 	}
4761 
4762 	if (vif->type != NL80211_IFTYPE_STATION)
4763 		return;
4764 
4765 	/* Make sure we're done with the deferred traffic before flushing */
4766 	flush_work(&mvm->add_stream_wk);
4767 
4768 	mutex_lock(&mvm->mutex);
4769 	mvmvif = iwl_mvm_vif_from_mac80211(vif);
4770 
4771 	/* flush the AP-station and all TDLS peers */
4772 	for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
4773 		sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
4774 						lockdep_is_held(&mvm->mutex));
4775 		if (IS_ERR_OR_NULL(sta))
4776 			continue;
4777 
4778 		mvmsta = iwl_mvm_sta_from_mac80211(sta);
4779 		if (mvmsta->vif != vif)
4780 			continue;
4781 
4782 		/* make sure only TDLS peers or the AP are flushed */
4783 		WARN_ON(i != mvmvif->ap_sta_id && !sta->tdls);
4784 
4785 		if (drop) {
4786 			if (iwl_mvm_flush_sta(mvm, mvmsta, false, 0))
4787 				IWL_ERR(mvm, "flush request fail\n");
4788 		} else {
4789 			msk |= mvmsta->tfd_queue_msk;
4790 			if (iwl_mvm_has_new_tx_api(mvm))
4791 				iwl_mvm_wait_sta_queues_empty(mvm, mvmsta);
4792 		}
4793 	}
4794 
4795 	mutex_unlock(&mvm->mutex);
4796 
4797 	/* this can take a while, and we may need/want other operations
4798 	 * to succeed while doing this, so do it without the mutex held
4799 	 */
4800 	if (!drop && !iwl_mvm_has_new_tx_api(mvm))
4801 		iwl_trans_wait_tx_queues_empty(mvm->trans, msk);
4802 }
4803 
4804 static int iwl_mvm_mac_get_survey(struct ieee80211_hw *hw, int idx,
4805 				  struct survey_info *survey)
4806 {
4807 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4808 	int ret;
4809 
4810 	memset(survey, 0, sizeof(*survey));
4811 
4812 	/* only support global statistics right now */
4813 	if (idx != 0)
4814 		return -ENOENT;
4815 
4816 	if (!fw_has_capa(&mvm->fw->ucode_capa,
4817 			 IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
4818 		return -ENOENT;
4819 
4820 	mutex_lock(&mvm->mutex);
4821 
4822 	if (iwl_mvm_firmware_running(mvm)) {
4823 		ret = iwl_mvm_request_statistics(mvm, false);
4824 		if (ret)
4825 			goto out;
4826 	}
4827 
4828 	survey->filled = SURVEY_INFO_TIME |
4829 			 SURVEY_INFO_TIME_RX |
4830 			 SURVEY_INFO_TIME_TX |
4831 			 SURVEY_INFO_TIME_SCAN;
4832 	survey->time = mvm->accu_radio_stats.on_time_rf +
4833 		       mvm->radio_stats.on_time_rf;
4834 	do_div(survey->time, USEC_PER_MSEC);
4835 
4836 	survey->time_rx = mvm->accu_radio_stats.rx_time +
4837 			  mvm->radio_stats.rx_time;
4838 	do_div(survey->time_rx, USEC_PER_MSEC);
4839 
4840 	survey->time_tx = mvm->accu_radio_stats.tx_time +
4841 			  mvm->radio_stats.tx_time;
4842 	do_div(survey->time_tx, USEC_PER_MSEC);
4843 
4844 	survey->time_scan = mvm->accu_radio_stats.on_time_scan +
4845 			    mvm->radio_stats.on_time_scan;
4846 	do_div(survey->time_scan, USEC_PER_MSEC);
4847 
4848 	ret = 0;
4849  out:
4850 	mutex_unlock(&mvm->mutex);
4851 	return ret;
4852 }
4853 
4854 static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,
4855 				       struct ieee80211_vif *vif,
4856 				       struct ieee80211_sta *sta,
4857 				       struct station_info *sinfo)
4858 {
4859 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4860 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4861 	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
4862 
4863 	if (mvmsta->avg_energy) {
4864 		sinfo->signal_avg = mvmsta->avg_energy;
4865 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
4866 	}
4867 
4868 	/* if beacon filtering isn't on mac80211 does it anyway */
4869 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
4870 		return;
4871 
4872 	if (!vif->bss_conf.assoc)
4873 		return;
4874 
4875 	mutex_lock(&mvm->mutex);
4876 
4877 	if (mvmvif->ap_sta_id != mvmsta->sta_id)
4878 		goto unlock;
4879 
4880 	if (iwl_mvm_request_statistics(mvm, false))
4881 		goto unlock;
4882 
4883 	sinfo->rx_beacon = mvmvif->beacon_stats.num_beacons +
4884 			   mvmvif->beacon_stats.accu_num_beacons;
4885 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_RX);
4886 	if (mvmvif->beacon_stats.avg_signal) {
4887 		/* firmware only reports a value after RXing a few beacons */
4888 		sinfo->rx_beacon_signal_avg = mvmvif->beacon_stats.avg_signal;
4889 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG);
4890 	}
4891  unlock:
4892 	mutex_unlock(&mvm->mutex);
4893 }
4894 
4895 static void iwl_mvm_event_mlme_callback(struct iwl_mvm *mvm,
4896 					struct ieee80211_vif *vif,
4897 					const struct ieee80211_event *event)
4898 {
4899 #define CHECK_MLME_TRIGGER(_cnt, _fmt...)				\
4900 	do {								\
4901 		if ((trig_mlme->_cnt) && --(trig_mlme->_cnt))		\
4902 			break;						\
4903 		iwl_fw_dbg_collect_trig(&(mvm)->fwrt, trig, _fmt);	\
4904 	} while (0)
4905 
4906 	struct iwl_fw_dbg_trigger_tlv *trig;
4907 	struct iwl_fw_dbg_trigger_mlme *trig_mlme;
4908 
4909 	trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
4910 				     FW_DBG_TRIGGER_MLME);
4911 	if (!trig)
4912 		return;
4913 
4914 	trig_mlme = (void *)trig->data;
4915 
4916 	if (event->u.mlme.data == ASSOC_EVENT) {
4917 		if (event->u.mlme.status == MLME_DENIED)
4918 			CHECK_MLME_TRIGGER(stop_assoc_denied,
4919 					   "DENIED ASSOC: reason %d",
4920 					    event->u.mlme.reason);
4921 		else if (event->u.mlme.status == MLME_TIMEOUT)
4922 			CHECK_MLME_TRIGGER(stop_assoc_timeout,
4923 					   "ASSOC TIMEOUT");
4924 	} else if (event->u.mlme.data == AUTH_EVENT) {
4925 		if (event->u.mlme.status == MLME_DENIED)
4926 			CHECK_MLME_TRIGGER(stop_auth_denied,
4927 					   "DENIED AUTH: reason %d",
4928 					   event->u.mlme.reason);
4929 		else if (event->u.mlme.status == MLME_TIMEOUT)
4930 			CHECK_MLME_TRIGGER(stop_auth_timeout,
4931 					   "AUTH TIMEOUT");
4932 	} else if (event->u.mlme.data == DEAUTH_RX_EVENT) {
4933 		CHECK_MLME_TRIGGER(stop_rx_deauth,
4934 				   "DEAUTH RX %d", event->u.mlme.reason);
4935 	} else if (event->u.mlme.data == DEAUTH_TX_EVENT) {
4936 		CHECK_MLME_TRIGGER(stop_tx_deauth,
4937 				   "DEAUTH TX %d", event->u.mlme.reason);
4938 	}
4939 #undef CHECK_MLME_TRIGGER
4940 }
4941 
4942 static void iwl_mvm_event_bar_rx_callback(struct iwl_mvm *mvm,
4943 					  struct ieee80211_vif *vif,
4944 					  const struct ieee80211_event *event)
4945 {
4946 	struct iwl_fw_dbg_trigger_tlv *trig;
4947 	struct iwl_fw_dbg_trigger_ba *ba_trig;
4948 
4949 	trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
4950 				     FW_DBG_TRIGGER_BA);
4951 	if (!trig)
4952 		return;
4953 
4954 	ba_trig = (void *)trig->data;
4955 
4956 	if (!(le16_to_cpu(ba_trig->rx_bar) & BIT(event->u.ba.tid)))
4957 		return;
4958 
4959 	iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
4960 				"BAR received from %pM, tid %d, ssn %d",
4961 				event->u.ba.sta->addr, event->u.ba.tid,
4962 				event->u.ba.ssn);
4963 }
4964 
4965 static void iwl_mvm_mac_event_callback(struct ieee80211_hw *hw,
4966 				       struct ieee80211_vif *vif,
4967 				       const struct ieee80211_event *event)
4968 {
4969 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4970 
4971 	switch (event->type) {
4972 	case MLME_EVENT:
4973 		iwl_mvm_event_mlme_callback(mvm, vif, event);
4974 		break;
4975 	case BAR_RX_EVENT:
4976 		iwl_mvm_event_bar_rx_callback(mvm, vif, event);
4977 		break;
4978 	case BA_FRAME_TIMEOUT:
4979 		iwl_mvm_event_frame_timeout_callback(mvm, vif, event->u.ba.sta,
4980 						     event->u.ba.tid);
4981 		break;
4982 	default:
4983 		break;
4984 	}
4985 }
4986 
4987 void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm,
4988 				     struct iwl_mvm_internal_rxq_notif *notif,
4989 				     u32 size)
4990 {
4991 	u32 qmask = BIT(mvm->trans->num_rx_queues) - 1;
4992 	int ret;
4993 
4994 	lockdep_assert_held(&mvm->mutex);
4995 
4996 	if (!iwl_mvm_has_new_rx_api(mvm))
4997 		return;
4998 
4999 	notif->cookie = mvm->queue_sync_cookie;
5000 
5001 	if (notif->sync)
5002 		atomic_set(&mvm->queue_sync_counter,
5003 			   mvm->trans->num_rx_queues);
5004 
5005 	ret = iwl_mvm_notify_rx_queue(mvm, qmask, (u8 *)notif, size);
5006 	if (ret) {
5007 		IWL_ERR(mvm, "Failed to trigger RX queues sync (%d)\n", ret);
5008 		goto out;
5009 	}
5010 
5011 	if (notif->sync) {
5012 		ret = wait_event_timeout(mvm->rx_sync_waitq,
5013 					 atomic_read(&mvm->queue_sync_counter) == 0 ||
5014 					 iwl_mvm_is_radio_killed(mvm),
5015 					 HZ);
5016 		WARN_ON_ONCE(!ret && !iwl_mvm_is_radio_killed(mvm));
5017 	}
5018 
5019 out:
5020 	atomic_set(&mvm->queue_sync_counter, 0);
5021 	mvm->queue_sync_cookie++;
5022 }
5023 
5024 static void iwl_mvm_sync_rx_queues(struct ieee80211_hw *hw)
5025 {
5026 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
5027 	struct iwl_mvm_internal_rxq_notif data = {
5028 		.type = IWL_MVM_RXQ_EMPTY,
5029 		.sync = 1,
5030 	};
5031 
5032 	mutex_lock(&mvm->mutex);
5033 	iwl_mvm_sync_rx_queues_internal(mvm, &data, sizeof(data));
5034 	mutex_unlock(&mvm->mutex);
5035 }
5036 
5037 static int
5038 iwl_mvm_mac_get_ftm_responder_stats(struct ieee80211_hw *hw,
5039 				    struct ieee80211_vif *vif,
5040 				    struct cfg80211_ftm_responder_stats *stats)
5041 {
5042 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
5043 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
5044 
5045 	if (vif->p2p || vif->type != NL80211_IFTYPE_AP ||
5046 	    !mvmvif->ap_ibss_active || !vif->bss_conf.ftm_responder)
5047 		return -EINVAL;
5048 
5049 	mutex_lock(&mvm->mutex);
5050 	*stats = mvm->ftm_resp_stats;
5051 	mutex_unlock(&mvm->mutex);
5052 
5053 	stats->filled = BIT(NL80211_FTM_STATS_SUCCESS_NUM) |
5054 			BIT(NL80211_FTM_STATS_PARTIAL_NUM) |
5055 			BIT(NL80211_FTM_STATS_FAILED_NUM) |
5056 			BIT(NL80211_FTM_STATS_ASAP_NUM) |
5057 			BIT(NL80211_FTM_STATS_NON_ASAP_NUM) |
5058 			BIT(NL80211_FTM_STATS_TOTAL_DURATION_MSEC) |
5059 			BIT(NL80211_FTM_STATS_UNKNOWN_TRIGGERS_NUM) |
5060 			BIT(NL80211_FTM_STATS_RESCHEDULE_REQUESTS_NUM) |
5061 			BIT(NL80211_FTM_STATS_OUT_OF_WINDOW_TRIGGERS_NUM);
5062 
5063 	return 0;
5064 }
5065 
5066 static int iwl_mvm_start_pmsr(struct ieee80211_hw *hw,
5067 			      struct ieee80211_vif *vif,
5068 			      struct cfg80211_pmsr_request *request)
5069 {
5070 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
5071 	int ret;
5072 
5073 	mutex_lock(&mvm->mutex);
5074 	ret = iwl_mvm_ftm_start(mvm, vif, request);
5075 	mutex_unlock(&mvm->mutex);
5076 
5077 	return ret;
5078 }
5079 
5080 static void iwl_mvm_abort_pmsr(struct ieee80211_hw *hw,
5081 			       struct ieee80211_vif *vif,
5082 			       struct cfg80211_pmsr_request *request)
5083 {
5084 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
5085 
5086 	mutex_lock(&mvm->mutex);
5087 	iwl_mvm_ftm_abort(mvm, request);
5088 	mutex_unlock(&mvm->mutex);
5089 }
5090 
5091 static bool iwl_mvm_can_hw_csum(struct sk_buff *skb)
5092 {
5093 	u8 protocol = ip_hdr(skb)->protocol;
5094 
5095 	if (!IS_ENABLED(CONFIG_INET))
5096 		return false;
5097 
5098 	return protocol == IPPROTO_TCP || protocol == IPPROTO_UDP;
5099 }
5100 
5101 static bool iwl_mvm_mac_can_aggregate(struct ieee80211_hw *hw,
5102 				      struct sk_buff *head,
5103 				      struct sk_buff *skb)
5104 {
5105 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
5106 
5107 	/* For now don't aggregate IPv6 in AMSDU */
5108 	if (skb->protocol != htons(ETH_P_IP))
5109 		return false;
5110 
5111 	if (!iwl_mvm_is_csum_supported(mvm))
5112 		return true;
5113 
5114 	return iwl_mvm_can_hw_csum(skb) == iwl_mvm_can_hw_csum(head);
5115 }
5116 
5117 const struct ieee80211_ops iwl_mvm_hw_ops = {
5118 	.tx = iwl_mvm_mac_tx,
5119 	.wake_tx_queue = iwl_mvm_mac_wake_tx_queue,
5120 	.ampdu_action = iwl_mvm_mac_ampdu_action,
5121 	.start = iwl_mvm_mac_start,
5122 	.reconfig_complete = iwl_mvm_mac_reconfig_complete,
5123 	.stop = iwl_mvm_mac_stop,
5124 	.add_interface = iwl_mvm_mac_add_interface,
5125 	.remove_interface = iwl_mvm_mac_remove_interface,
5126 	.config = iwl_mvm_mac_config,
5127 	.prepare_multicast = iwl_mvm_prepare_multicast,
5128 	.configure_filter = iwl_mvm_configure_filter,
5129 	.config_iface_filter = iwl_mvm_config_iface_filter,
5130 	.bss_info_changed = iwl_mvm_bss_info_changed,
5131 	.hw_scan = iwl_mvm_mac_hw_scan,
5132 	.cancel_hw_scan = iwl_mvm_mac_cancel_hw_scan,
5133 	.sta_pre_rcu_remove = iwl_mvm_sta_pre_rcu_remove,
5134 	.sta_state = iwl_mvm_mac_sta_state,
5135 	.sta_notify = iwl_mvm_mac_sta_notify,
5136 	.allow_buffered_frames = iwl_mvm_mac_allow_buffered_frames,
5137 	.release_buffered_frames = iwl_mvm_mac_release_buffered_frames,
5138 	.set_rts_threshold = iwl_mvm_mac_set_rts_threshold,
5139 	.sta_rc_update = iwl_mvm_sta_rc_update,
5140 	.conf_tx = iwl_mvm_mac_conf_tx,
5141 	.mgd_prepare_tx = iwl_mvm_mac_mgd_prepare_tx,
5142 	.mgd_protect_tdls_discover = iwl_mvm_mac_mgd_protect_tdls_discover,
5143 	.flush = iwl_mvm_mac_flush,
5144 	.sched_scan_start = iwl_mvm_mac_sched_scan_start,
5145 	.sched_scan_stop = iwl_mvm_mac_sched_scan_stop,
5146 	.set_key = iwl_mvm_mac_set_key,
5147 	.update_tkip_key = iwl_mvm_mac_update_tkip_key,
5148 	.remain_on_channel = iwl_mvm_roc,
5149 	.cancel_remain_on_channel = iwl_mvm_cancel_roc,
5150 	.add_chanctx = iwl_mvm_add_chanctx,
5151 	.remove_chanctx = iwl_mvm_remove_chanctx,
5152 	.change_chanctx = iwl_mvm_change_chanctx,
5153 	.assign_vif_chanctx = iwl_mvm_assign_vif_chanctx,
5154 	.unassign_vif_chanctx = iwl_mvm_unassign_vif_chanctx,
5155 	.switch_vif_chanctx = iwl_mvm_switch_vif_chanctx,
5156 
5157 	.start_ap = iwl_mvm_start_ap_ibss,
5158 	.stop_ap = iwl_mvm_stop_ap_ibss,
5159 	.join_ibss = iwl_mvm_start_ap_ibss,
5160 	.leave_ibss = iwl_mvm_stop_ap_ibss,
5161 
5162 	.tx_last_beacon = iwl_mvm_tx_last_beacon,
5163 
5164 	.set_tim = iwl_mvm_set_tim,
5165 
5166 	.channel_switch = iwl_mvm_channel_switch,
5167 	.pre_channel_switch = iwl_mvm_pre_channel_switch,
5168 	.post_channel_switch = iwl_mvm_post_channel_switch,
5169 	.abort_channel_switch = iwl_mvm_abort_channel_switch,
5170 	.channel_switch_rx_beacon = iwl_mvm_channel_switch_rx_beacon,
5171 
5172 	.tdls_channel_switch = iwl_mvm_tdls_channel_switch,
5173 	.tdls_cancel_channel_switch = iwl_mvm_tdls_cancel_channel_switch,
5174 	.tdls_recv_channel_switch = iwl_mvm_tdls_recv_channel_switch,
5175 
5176 	.event_callback = iwl_mvm_mac_event_callback,
5177 
5178 	.sync_rx_queues = iwl_mvm_sync_rx_queues,
5179 
5180 	CFG80211_TESTMODE_CMD(iwl_mvm_mac_testmode_cmd)
5181 
5182 #ifdef CONFIG_PM_SLEEP
5183 	/* look at d3.c */
5184 	.suspend = iwl_mvm_suspend,
5185 	.resume = iwl_mvm_resume,
5186 	.set_wakeup = iwl_mvm_set_wakeup,
5187 	.set_rekey_data = iwl_mvm_set_rekey_data,
5188 #if IS_ENABLED(CONFIG_IPV6)
5189 	.ipv6_addr_change = iwl_mvm_ipv6_addr_change,
5190 #endif
5191 	.set_default_unicast_key = iwl_mvm_set_default_unicast_key,
5192 #endif
5193 	.get_survey = iwl_mvm_mac_get_survey,
5194 	.sta_statistics = iwl_mvm_mac_sta_statistics,
5195 	.get_ftm_responder_stats = iwl_mvm_mac_get_ftm_responder_stats,
5196 	.start_pmsr = iwl_mvm_start_pmsr,
5197 	.abort_pmsr = iwl_mvm_abort_pmsr,
5198 
5199 	.can_aggregate_in_amsdu = iwl_mvm_mac_can_aggregate,
5200 #ifdef CONFIG_IWLWIFI_DEBUGFS
5201 	.sta_add_debugfs = iwl_mvm_sta_add_debugfs,
5202 #endif
5203 };
5204