1 /******************************************************************************
2  *
3  * This file is provided under a dual BSD/GPLv2 license.  When using or
4  * redistributing this file, you may do so under either license.
5  *
6  * GPL LICENSE SUMMARY
7  *
8  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
9  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
10  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
11  * Copyright(c) 2018 - 2019 Intel Corporation
12  *
13  * This program is free software; you can redistribute it and/or modify
14  * it under the terms of version 2 of the GNU General Public License as
15  * published by the Free Software Foundation.
16  *
17  * This program is distributed in the hope that it will be useful, but
18  * WITHOUT ANY WARRANTY; without even the implied warranty of
19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
20  * General Public License for more details.
21  *
22  * The full GNU General Public License is included in this distribution
23  * in the file called COPYING.
24  *
25  * Contact Information:
26  *  Intel Linux Wireless <linuxwifi@intel.com>
27  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
28  *
29  * BSD LICENSE
30  *
31  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
32  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
33  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
34  * Copyright(c) 2018 - 2019 Intel Corporation
35  * All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  *
41  *  * Redistributions of source code must retain the above copyright
42  *    notice, this list of conditions and the following disclaimer.
43  *  * Redistributions in binary form must reproduce the above copyright
44  *    notice, this list of conditions and the following disclaimer in
45  *    the documentation and/or other materials provided with the
46  *    distribution.
47  *  * Neither the name Intel Corporation nor the names of its
48  *    contributors may be used to endorse or promote products derived
49  *    from this software without specific prior written permission.
50  *
51  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
52  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
53  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
54  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
55  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
56  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
57  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
58  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
59  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
60  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
61  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
62  *
63  *****************************************************************************/
64 #include <linux/kernel.h>
65 #include <linux/slab.h>
66 #include <linux/skbuff.h>
67 #include <linux/netdevice.h>
68 #include <linux/etherdevice.h>
69 #include <linux/ip.h>
70 #include <linux/if_arp.h>
71 #include <linux/time.h>
72 #include <net/mac80211.h>
73 #include <net/ieee80211_radiotap.h>
74 #include <net/tcp.h>
75 
76 #include "iwl-op-mode.h"
77 #include "iwl-io.h"
78 #include "mvm.h"
79 #include "sta.h"
80 #include "time-event.h"
81 #include "iwl-eeprom-parse.h"
82 #include "iwl-phy-db.h"
83 #include "testmode.h"
84 #include "fw/error-dump.h"
85 #include "iwl-prph.h"
86 #include "iwl-nvm-parse.h"
87 
88 static const struct ieee80211_iface_limit iwl_mvm_limits[] = {
89 	{
90 		.max = 1,
91 		.types = BIT(NL80211_IFTYPE_STATION),
92 	},
93 	{
94 		.max = 1,
95 		.types = BIT(NL80211_IFTYPE_AP) |
96 			BIT(NL80211_IFTYPE_P2P_CLIENT) |
97 			BIT(NL80211_IFTYPE_P2P_GO),
98 	},
99 	{
100 		.max = 1,
101 		.types = BIT(NL80211_IFTYPE_P2P_DEVICE),
102 	},
103 };
104 
105 static const struct ieee80211_iface_combination iwl_mvm_iface_combinations[] = {
106 	{
107 		.num_different_channels = 2,
108 		.max_interfaces = 3,
109 		.limits = iwl_mvm_limits,
110 		.n_limits = ARRAY_SIZE(iwl_mvm_limits),
111 	},
112 };
113 
114 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
115 /*
116  * Use the reserved field to indicate magic values.
117  * these values will only be used internally by the driver,
118  * and won't make it to the fw (reserved will be 0).
119  * BC_FILTER_MAGIC_IP - configure the val of this attribute to
120  *	be the vif's ip address. in case there is not a single
121  *	ip address (0, or more than 1), this attribute will
122  *	be skipped.
123  * BC_FILTER_MAGIC_MAC - set the val of this attribute to
124  *	the LSB bytes of the vif's mac address
125  */
126 enum {
127 	BC_FILTER_MAGIC_NONE = 0,
128 	BC_FILTER_MAGIC_IP,
129 	BC_FILTER_MAGIC_MAC,
130 };
131 
132 static const struct iwl_fw_bcast_filter iwl_mvm_default_bcast_filters[] = {
133 	{
134 		/* arp */
135 		.discard = 0,
136 		.frame_type = BCAST_FILTER_FRAME_TYPE_ALL,
137 		.attrs = {
138 			{
139 				/* frame type - arp, hw type - ethernet */
140 				.offset_type =
141 					BCAST_FILTER_OFFSET_PAYLOAD_START,
142 				.offset = sizeof(rfc1042_header),
143 				.val = cpu_to_be32(0x08060001),
144 				.mask = cpu_to_be32(0xffffffff),
145 			},
146 			{
147 				/* arp dest ip */
148 				.offset_type =
149 					BCAST_FILTER_OFFSET_PAYLOAD_START,
150 				.offset = sizeof(rfc1042_header) + 2 +
151 					  sizeof(struct arphdr) +
152 					  ETH_ALEN + sizeof(__be32) +
153 					  ETH_ALEN,
154 				.mask = cpu_to_be32(0xffffffff),
155 				/* mark it as special field */
156 				.reserved1 = cpu_to_le16(BC_FILTER_MAGIC_IP),
157 			},
158 		},
159 	},
160 	{
161 		/* dhcp offer bcast */
162 		.discard = 0,
163 		.frame_type = BCAST_FILTER_FRAME_TYPE_IPV4,
164 		.attrs = {
165 			{
166 				/* udp dest port - 68 (bootp client)*/
167 				.offset_type = BCAST_FILTER_OFFSET_IP_END,
168 				.offset = offsetof(struct udphdr, dest),
169 				.val = cpu_to_be32(0x00440000),
170 				.mask = cpu_to_be32(0xffff0000),
171 			},
172 			{
173 				/* dhcp - lsb bytes of client hw address */
174 				.offset_type = BCAST_FILTER_OFFSET_IP_END,
175 				.offset = 38,
176 				.mask = cpu_to_be32(0xffffffff),
177 				/* mark it as special field */
178 				.reserved1 = cpu_to_le16(BC_FILTER_MAGIC_MAC),
179 			},
180 		},
181 	},
182 	/* last filter must be empty */
183 	{},
184 };
185 #endif
186 
187 static const struct cfg80211_pmsr_capabilities iwl_mvm_pmsr_capa = {
188 	.max_peers = IWL_MVM_TOF_MAX_APS,
189 	.report_ap_tsf = 1,
190 	.randomize_mac_addr = 1,
191 
192 	.ftm = {
193 		.supported = 1,
194 		.asap = 1,
195 		.non_asap = 1,
196 		.request_lci = 1,
197 		.request_civicloc = 1,
198 		.max_bursts_exponent = -1, /* all supported */
199 		.max_ftms_per_burst = 0, /* no limits */
200 		.bandwidths = BIT(NL80211_CHAN_WIDTH_20_NOHT) |
201 			      BIT(NL80211_CHAN_WIDTH_20) |
202 			      BIT(NL80211_CHAN_WIDTH_40) |
203 			      BIT(NL80211_CHAN_WIDTH_80),
204 		.preambles = BIT(NL80211_PREAMBLE_LEGACY) |
205 			     BIT(NL80211_PREAMBLE_HT) |
206 			     BIT(NL80211_PREAMBLE_VHT),
207 	},
208 };
209 
210 static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
211 				 enum set_key_cmd cmd,
212 				 struct ieee80211_vif *vif,
213 				 struct ieee80211_sta *sta,
214 				 struct ieee80211_key_conf *key);
215 
216 static void iwl_mvm_reset_phy_ctxts(struct iwl_mvm *mvm)
217 {
218 	int i;
219 
220 	memset(mvm->phy_ctxts, 0, sizeof(mvm->phy_ctxts));
221 	for (i = 0; i < NUM_PHY_CTX; i++) {
222 		mvm->phy_ctxts[i].id = i;
223 		mvm->phy_ctxts[i].ref = 0;
224 	}
225 }
226 
227 struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
228 						  const char *alpha2,
229 						  enum iwl_mcc_source src_id,
230 						  bool *changed)
231 {
232 	struct ieee80211_regdomain *regd = NULL;
233 	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
234 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
235 	struct iwl_mcc_update_resp *resp;
236 
237 	IWL_DEBUG_LAR(mvm, "Getting regdomain data for %s from FW\n", alpha2);
238 
239 	lockdep_assert_held(&mvm->mutex);
240 
241 	resp = iwl_mvm_update_mcc(mvm, alpha2, src_id);
242 	if (IS_ERR_OR_NULL(resp)) {
243 		IWL_DEBUG_LAR(mvm, "Could not get update from FW %d\n",
244 			      PTR_ERR_OR_ZERO(resp));
245 		goto out;
246 	}
247 
248 	if (changed) {
249 		u32 status = le32_to_cpu(resp->status);
250 
251 		*changed = (status == MCC_RESP_NEW_CHAN_PROFILE ||
252 			    status == MCC_RESP_ILLEGAL);
253 	}
254 
255 	regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg,
256 				      __le32_to_cpu(resp->n_channels),
257 				      resp->channels,
258 				      __le16_to_cpu(resp->mcc),
259 				      __le16_to_cpu(resp->geo_info));
260 	/* Store the return source id */
261 	src_id = resp->source_id;
262 	kfree(resp);
263 	if (IS_ERR_OR_NULL(regd)) {
264 		IWL_DEBUG_LAR(mvm, "Could not get parse update from FW %d\n",
265 			      PTR_ERR_OR_ZERO(regd));
266 		goto out;
267 	}
268 
269 	IWL_DEBUG_LAR(mvm, "setting alpha2 from FW to %s (0x%x, 0x%x) src=%d\n",
270 		      regd->alpha2, regd->alpha2[0], regd->alpha2[1], src_id);
271 	mvm->lar_regdom_set = true;
272 	mvm->mcc_src = src_id;
273 
274 out:
275 	return regd;
276 }
277 
278 void iwl_mvm_update_changed_regdom(struct iwl_mvm *mvm)
279 {
280 	bool changed;
281 	struct ieee80211_regdomain *regd;
282 
283 	if (!iwl_mvm_is_lar_supported(mvm))
284 		return;
285 
286 	regd = iwl_mvm_get_current_regdomain(mvm, &changed);
287 	if (!IS_ERR_OR_NULL(regd)) {
288 		/* only update the regulatory core if changed */
289 		if (changed)
290 			regulatory_set_wiphy_regd(mvm->hw->wiphy, regd);
291 
292 		kfree(regd);
293 	}
294 }
295 
296 struct ieee80211_regdomain *iwl_mvm_get_current_regdomain(struct iwl_mvm *mvm,
297 							  bool *changed)
298 {
299 	return iwl_mvm_get_regdomain(mvm->hw->wiphy, "ZZ",
300 				     iwl_mvm_is_wifi_mcc_supported(mvm) ?
301 				     MCC_SOURCE_GET_CURRENT :
302 				     MCC_SOURCE_OLD_FW, changed);
303 }
304 
305 int iwl_mvm_init_fw_regd(struct iwl_mvm *mvm)
306 {
307 	enum iwl_mcc_source used_src;
308 	struct ieee80211_regdomain *regd;
309 	int ret;
310 	bool changed;
311 	const struct ieee80211_regdomain *r =
312 			rtnl_dereference(mvm->hw->wiphy->regd);
313 
314 	if (!r)
315 		return -ENOENT;
316 
317 	/* save the last source in case we overwrite it below */
318 	used_src = mvm->mcc_src;
319 	if (iwl_mvm_is_wifi_mcc_supported(mvm)) {
320 		/* Notify the firmware we support wifi location updates */
321 		regd = iwl_mvm_get_current_regdomain(mvm, NULL);
322 		if (!IS_ERR_OR_NULL(regd))
323 			kfree(regd);
324 	}
325 
326 	/* Now set our last stored MCC and source */
327 	regd = iwl_mvm_get_regdomain(mvm->hw->wiphy, r->alpha2, used_src,
328 				     &changed);
329 	if (IS_ERR_OR_NULL(regd))
330 		return -EIO;
331 
332 	/* update cfg80211 if the regdomain was changed */
333 	if (changed)
334 		ret = regulatory_set_wiphy_regd_sync_rtnl(mvm->hw->wiphy, regd);
335 	else
336 		ret = 0;
337 
338 	kfree(regd);
339 	return ret;
340 }
341 
342 const static u8 he_if_types_ext_capa_sta[] = {
343 	 [0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
344 	 [2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
345 	 [7] = WLAN_EXT_CAPA8_OPMODE_NOTIF,
346 	 [9] = WLAN_EXT_CAPA10_TWT_REQUESTER_SUPPORT,
347 };
348 
349 const static struct wiphy_iftype_ext_capab he_iftypes_ext_capa[] = {
350 	{
351 		.iftype = NL80211_IFTYPE_STATION,
352 		.extended_capabilities = he_if_types_ext_capa_sta,
353 		.extended_capabilities_mask = he_if_types_ext_capa_sta,
354 		.extended_capabilities_len = sizeof(he_if_types_ext_capa_sta),
355 	},
356 };
357 
358 int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
359 {
360 	struct ieee80211_hw *hw = mvm->hw;
361 	int num_mac, ret, i;
362 	static const u32 mvm_ciphers[] = {
363 		WLAN_CIPHER_SUITE_WEP40,
364 		WLAN_CIPHER_SUITE_WEP104,
365 		WLAN_CIPHER_SUITE_TKIP,
366 		WLAN_CIPHER_SUITE_CCMP,
367 	};
368 #ifdef CONFIG_PM_SLEEP
369 	bool unified = fw_has_capa(&mvm->fw->ucode_capa,
370 				   IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
371 #endif
372 
373 	/* Tell mac80211 our characteristics */
374 	ieee80211_hw_set(hw, SIGNAL_DBM);
375 	ieee80211_hw_set(hw, SPECTRUM_MGMT);
376 	ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
377 	ieee80211_hw_set(hw, WANT_MONITOR_VIF);
378 	ieee80211_hw_set(hw, SUPPORTS_PS);
379 	ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
380 	ieee80211_hw_set(hw, AMPDU_AGGREGATION);
381 	ieee80211_hw_set(hw, TIMING_BEACON_ONLY);
382 	ieee80211_hw_set(hw, CONNECTION_MONITOR);
383 	ieee80211_hw_set(hw, CHANCTX_STA_CSA);
384 	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
385 	ieee80211_hw_set(hw, SUPPORTS_CLONED_SKBS);
386 	ieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);
387 	ieee80211_hw_set(hw, NEEDS_UNIQUE_STA_ADDR);
388 	ieee80211_hw_set(hw, DEAUTH_NEED_MGD_TX_PREP);
389 	ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);
390 	ieee80211_hw_set(hw, BUFF_MMPDU_TXQ);
391 	ieee80211_hw_set(hw, STA_MMPDU_TXQ);
392 	/*
393 	 * On older devices, enabling TX A-MSDU occasionally leads to
394 	 * something getting messed up, the command read from the FIFO
395 	 * gets out of sync and isn't a TX command, so that we have an
396 	 * assert EDC.
397 	 *
398 	 * It's not clear where the bug is, but since we didn't used to
399 	 * support A-MSDU until moving the mac80211 iTXQs, just leave it
400 	 * for older devices. We also don't see this issue on any newer
401 	 * devices.
402 	 */
403 	if (mvm->trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_9000)
404 		ieee80211_hw_set(hw, TX_AMSDU);
405 	ieee80211_hw_set(hw, TX_FRAG_LIST);
406 
407 	if (iwl_mvm_has_tlc_offload(mvm)) {
408 		ieee80211_hw_set(hw, TX_AMPDU_SETUP_IN_HW);
409 		ieee80211_hw_set(hw, HAS_RATE_CONTROL);
410 	}
411 
412 	if (iwl_mvm_has_new_rx_api(mvm))
413 		ieee80211_hw_set(hw, SUPPORTS_REORDERING_BUFFER);
414 
415 	if (fw_has_capa(&mvm->fw->ucode_capa,
416 			IWL_UCODE_TLV_CAPA_STA_PM_NOTIF)) {
417 		ieee80211_hw_set(hw, AP_LINK_PS);
418 	} else if (WARN_ON(iwl_mvm_has_new_tx_api(mvm))) {
419 		/*
420 		 * we absolutely need this for the new TX API since that comes
421 		 * with many more queues than the current code can deal with
422 		 * for station powersave
423 		 */
424 		return -EINVAL;
425 	}
426 
427 	if (mvm->trans->num_rx_queues > 1)
428 		ieee80211_hw_set(hw, USES_RSS);
429 
430 	if (mvm->trans->max_skb_frags)
431 		hw->netdev_features = NETIF_F_HIGHDMA | NETIF_F_SG;
432 
433 	hw->queues = IEEE80211_MAX_QUEUES;
434 	hw->offchannel_tx_hw_queue = IWL_MVM_OFFCHANNEL_QUEUE;
435 	hw->radiotap_mcs_details |= IEEE80211_RADIOTAP_MCS_HAVE_FEC |
436 				    IEEE80211_RADIOTAP_MCS_HAVE_STBC;
437 	hw->radiotap_vht_details |= IEEE80211_RADIOTAP_VHT_KNOWN_STBC |
438 		IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED;
439 
440 	hw->radiotap_timestamp.units_pos =
441 		IEEE80211_RADIOTAP_TIMESTAMP_UNIT_US |
442 		IEEE80211_RADIOTAP_TIMESTAMP_SPOS_PLCP_SIG_ACQ;
443 	/* this is the case for CCK frames, it's better (only 8) for OFDM */
444 	hw->radiotap_timestamp.accuracy = 22;
445 
446 	if (!iwl_mvm_has_tlc_offload(mvm))
447 		hw->rate_control_algorithm = RS_NAME;
448 
449 	hw->uapsd_queues = IWL_MVM_UAPSD_QUEUES;
450 	hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
451 	hw->max_tx_fragments = mvm->trans->max_skb_frags;
452 
453 	BUILD_BUG_ON(ARRAY_SIZE(mvm->ciphers) < ARRAY_SIZE(mvm_ciphers) + 6);
454 	memcpy(mvm->ciphers, mvm_ciphers, sizeof(mvm_ciphers));
455 	hw->wiphy->n_cipher_suites = ARRAY_SIZE(mvm_ciphers);
456 	hw->wiphy->cipher_suites = mvm->ciphers;
457 
458 	if (iwl_mvm_has_new_rx_api(mvm)) {
459 		mvm->ciphers[hw->wiphy->n_cipher_suites] =
460 			WLAN_CIPHER_SUITE_GCMP;
461 		hw->wiphy->n_cipher_suites++;
462 		mvm->ciphers[hw->wiphy->n_cipher_suites] =
463 			WLAN_CIPHER_SUITE_GCMP_256;
464 		hw->wiphy->n_cipher_suites++;
465 	}
466 
467 	/* Enable 11w if software crypto is not enabled (as the
468 	 * firmware will interpret some mgmt packets, so enabling it
469 	 * with software crypto isn't safe).
470 	 */
471 	if (!iwlwifi_mod_params.swcrypto) {
472 		ieee80211_hw_set(hw, MFP_CAPABLE);
473 		mvm->ciphers[hw->wiphy->n_cipher_suites] =
474 			WLAN_CIPHER_SUITE_AES_CMAC;
475 		hw->wiphy->n_cipher_suites++;
476 		if (iwl_mvm_has_new_rx_api(mvm)) {
477 			mvm->ciphers[hw->wiphy->n_cipher_suites] =
478 				WLAN_CIPHER_SUITE_BIP_GMAC_128;
479 			hw->wiphy->n_cipher_suites++;
480 			mvm->ciphers[hw->wiphy->n_cipher_suites] =
481 				WLAN_CIPHER_SUITE_BIP_GMAC_256;
482 			hw->wiphy->n_cipher_suites++;
483 		}
484 	}
485 
486 	/* currently FW API supports only one optional cipher scheme */
487 	if (mvm->fw->cs[0].cipher) {
488 		const struct iwl_fw_cipher_scheme *fwcs = &mvm->fw->cs[0];
489 		struct ieee80211_cipher_scheme *cs = &mvm->cs[0];
490 
491 		mvm->hw->n_cipher_schemes = 1;
492 
493 		cs->cipher = le32_to_cpu(fwcs->cipher);
494 		cs->iftype = BIT(NL80211_IFTYPE_STATION);
495 		cs->hdr_len = fwcs->hdr_len;
496 		cs->pn_len = fwcs->pn_len;
497 		cs->pn_off = fwcs->pn_off;
498 		cs->key_idx_off = fwcs->key_idx_off;
499 		cs->key_idx_mask = fwcs->key_idx_mask;
500 		cs->key_idx_shift = fwcs->key_idx_shift;
501 		cs->mic_len = fwcs->mic_len;
502 
503 		mvm->hw->cipher_schemes = mvm->cs;
504 		mvm->ciphers[hw->wiphy->n_cipher_suites] = cs->cipher;
505 		hw->wiphy->n_cipher_suites++;
506 	}
507 
508 	if (fw_has_capa(&mvm->fw->ucode_capa,
509 			IWL_UCODE_TLV_CAPA_FTM_CALIBRATED)) {
510 		wiphy_ext_feature_set(hw->wiphy,
511 				      NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
512 		hw->wiphy->pmsr_capa = &iwl_mvm_pmsr_capa;
513 	}
514 
515 	ieee80211_hw_set(hw, SINGLE_SCAN_ON_ALL_BANDS);
516 	hw->wiphy->features |=
517 		NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR |
518 		NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR |
519 		NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
520 
521 	hw->sta_data_size = sizeof(struct iwl_mvm_sta);
522 	hw->vif_data_size = sizeof(struct iwl_mvm_vif);
523 	hw->chanctx_data_size = sizeof(u16);
524 	hw->txq_data_size = sizeof(struct iwl_mvm_txq);
525 
526 	hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
527 		BIT(NL80211_IFTYPE_P2P_CLIENT) |
528 		BIT(NL80211_IFTYPE_AP) |
529 		BIT(NL80211_IFTYPE_P2P_GO) |
530 		BIT(NL80211_IFTYPE_P2P_DEVICE) |
531 		BIT(NL80211_IFTYPE_ADHOC);
532 
533 	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
534 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
535 	hw->wiphy->features |= NL80211_FEATURE_HT_IBSS;
536 
537 	hw->wiphy->regulatory_flags |= REGULATORY_ENABLE_RELAX_NO_IR;
538 	if (iwl_mvm_is_lar_supported(mvm))
539 		hw->wiphy->regulatory_flags |= REGULATORY_WIPHY_SELF_MANAGED;
540 	else
541 		hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG |
542 					       REGULATORY_DISABLE_BEACON_HINTS;
543 
544 	hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
545 	hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
546 
547 	hw->wiphy->iface_combinations = iwl_mvm_iface_combinations;
548 	hw->wiphy->n_iface_combinations =
549 		ARRAY_SIZE(iwl_mvm_iface_combinations);
550 
551 	hw->wiphy->max_remain_on_channel_duration = 10000;
552 	hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
553 
554 	/* Extract MAC address */
555 	memcpy(mvm->addresses[0].addr, mvm->nvm_data->hw_addr, ETH_ALEN);
556 	hw->wiphy->addresses = mvm->addresses;
557 	hw->wiphy->n_addresses = 1;
558 
559 	/* Extract additional MAC addresses if available */
560 	num_mac = (mvm->nvm_data->n_hw_addrs > 1) ?
561 		min(IWL_MVM_MAX_ADDRESSES, mvm->nvm_data->n_hw_addrs) : 1;
562 
563 	for (i = 1; i < num_mac; i++) {
564 		memcpy(mvm->addresses[i].addr, mvm->addresses[i-1].addr,
565 		       ETH_ALEN);
566 		mvm->addresses[i].addr[5]++;
567 		hw->wiphy->n_addresses++;
568 	}
569 
570 	iwl_mvm_reset_phy_ctxts(mvm);
571 
572 	hw->wiphy->max_scan_ie_len = iwl_mvm_max_scan_ie_len(mvm);
573 
574 	hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
575 
576 	BUILD_BUG_ON(IWL_MVM_SCAN_STOPPING_MASK & IWL_MVM_SCAN_MASK);
577 	BUILD_BUG_ON(IWL_MVM_MAX_UMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK) ||
578 		     IWL_MVM_MAX_LMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK));
579 
580 	if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
581 		mvm->max_scans = IWL_MVM_MAX_UMAC_SCANS;
582 	else
583 		mvm->max_scans = IWL_MVM_MAX_LMAC_SCANS;
584 
585 	if (mvm->nvm_data->bands[NL80211_BAND_2GHZ].n_channels)
586 		hw->wiphy->bands[NL80211_BAND_2GHZ] =
587 			&mvm->nvm_data->bands[NL80211_BAND_2GHZ];
588 	if (mvm->nvm_data->bands[NL80211_BAND_5GHZ].n_channels) {
589 		hw->wiphy->bands[NL80211_BAND_5GHZ] =
590 			&mvm->nvm_data->bands[NL80211_BAND_5GHZ];
591 
592 		if (fw_has_capa(&mvm->fw->ucode_capa,
593 				IWL_UCODE_TLV_CAPA_BEAMFORMER) &&
594 		    fw_has_api(&mvm->fw->ucode_capa,
595 			       IWL_UCODE_TLV_API_LQ_SS_PARAMS))
596 			hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.cap |=
597 				IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
598 	}
599 
600 	hw->wiphy->hw_version = mvm->trans->hw_id;
601 
602 	if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM)
603 		hw->wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
604 	else
605 		hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
606 
607 	hw->wiphy->max_sched_scan_reqs = 1;
608 	hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
609 	hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
610 	/* we create the 802.11 header and zero length SSID IE. */
611 	hw->wiphy->max_sched_scan_ie_len =
612 		SCAN_OFFLOAD_PROBE_REQ_SIZE - 24 - 2;
613 	hw->wiphy->max_sched_scan_plans = IWL_MAX_SCHED_SCAN_PLANS;
614 	hw->wiphy->max_sched_scan_plan_interval = U16_MAX;
615 
616 	/*
617 	 * the firmware uses u8 for num of iterations, but 0xff is saved for
618 	 * infinite loop, so the maximum number of iterations is actually 254.
619 	 */
620 	hw->wiphy->max_sched_scan_plan_iterations = 254;
621 
622 	hw->wiphy->features |= NL80211_FEATURE_P2P_GO_CTWIN |
623 			       NL80211_FEATURE_LOW_PRIORITY_SCAN |
624 			       NL80211_FEATURE_P2P_GO_OPPPS |
625 			       NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
626 			       NL80211_FEATURE_DYNAMIC_SMPS |
627 			       NL80211_FEATURE_STATIC_SMPS |
628 			       NL80211_FEATURE_SUPPORTS_WMM_ADMISSION;
629 
630 	if (fw_has_capa(&mvm->fw->ucode_capa,
631 			IWL_UCODE_TLV_CAPA_TXPOWER_INSERTION_SUPPORT))
632 		hw->wiphy->features |= NL80211_FEATURE_TX_POWER_INSERTION;
633 	if (fw_has_capa(&mvm->fw->ucode_capa,
634 			IWL_UCODE_TLV_CAPA_QUIET_PERIOD_SUPPORT))
635 		hw->wiphy->features |= NL80211_FEATURE_QUIET;
636 
637 	if (fw_has_capa(&mvm->fw->ucode_capa,
638 			IWL_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT))
639 		hw->wiphy->features |=
640 			NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES;
641 
642 	if (fw_has_capa(&mvm->fw->ucode_capa,
643 			IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT))
644 		hw->wiphy->features |= NL80211_FEATURE_WFA_TPC_IE_IN_PROBES;
645 
646 	if (fw_has_api(&mvm->fw->ucode_capa,
647 		       IWL_UCODE_TLV_API_SCAN_TSF_REPORT)) {
648 		wiphy_ext_feature_set(hw->wiphy,
649 				      NL80211_EXT_FEATURE_SCAN_START_TIME);
650 		wiphy_ext_feature_set(hw->wiphy,
651 				      NL80211_EXT_FEATURE_BSS_PARENT_TSF);
652 		wiphy_ext_feature_set(hw->wiphy,
653 				      NL80211_EXT_FEATURE_SET_SCAN_DWELL);
654 	}
655 
656 	if (iwl_mvm_is_oce_supported(mvm)) {
657 		wiphy_ext_feature_set(hw->wiphy,
658 			NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP);
659 		wiphy_ext_feature_set(hw->wiphy,
660 			NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME);
661 		wiphy_ext_feature_set(hw->wiphy,
662 			NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION);
663 		wiphy_ext_feature_set(hw->wiphy,
664 			NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE);
665 	}
666 
667 	if (mvm->nvm_data->sku_cap_11ax_enable &&
668 	    !iwlwifi_mod_params.disable_11ax) {
669 		hw->wiphy->iftype_ext_capab = he_iftypes_ext_capa;
670 		hw->wiphy->num_iftype_ext_capab =
671 			ARRAY_SIZE(he_iftypes_ext_capa);
672 
673 		ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
674 		ieee80211_hw_set(hw, SUPPORTS_ONLY_HE_MULTI_BSSID);
675 	}
676 
677 	mvm->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
678 
679 #ifdef CONFIG_PM_SLEEP
680 	if ((unified || mvm->fw->img[IWL_UCODE_WOWLAN].num_sec) &&
681 	    mvm->trans->ops->d3_suspend &&
682 	    mvm->trans->ops->d3_resume &&
683 	    device_can_wakeup(mvm->trans->dev)) {
684 		mvm->wowlan.flags |= WIPHY_WOWLAN_MAGIC_PKT |
685 				     WIPHY_WOWLAN_DISCONNECT |
686 				     WIPHY_WOWLAN_EAP_IDENTITY_REQ |
687 				     WIPHY_WOWLAN_RFKILL_RELEASE |
688 				     WIPHY_WOWLAN_NET_DETECT;
689 		if (!iwlwifi_mod_params.swcrypto)
690 			mvm->wowlan.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY |
691 					     WIPHY_WOWLAN_GTK_REKEY_FAILURE |
692 					     WIPHY_WOWLAN_4WAY_HANDSHAKE;
693 
694 		mvm->wowlan.n_patterns = IWL_WOWLAN_MAX_PATTERNS;
695 		mvm->wowlan.pattern_min_len = IWL_WOWLAN_MIN_PATTERN_LEN;
696 		mvm->wowlan.pattern_max_len = IWL_WOWLAN_MAX_PATTERN_LEN;
697 		mvm->wowlan.max_nd_match_sets = IWL_SCAN_MAX_PROFILES;
698 		hw->wiphy->wowlan = &mvm->wowlan;
699 	}
700 #endif
701 
702 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
703 	/* assign default bcast filtering configuration */
704 	mvm->bcast_filters = iwl_mvm_default_bcast_filters;
705 #endif
706 
707 	ret = iwl_mvm_leds_init(mvm);
708 	if (ret)
709 		return ret;
710 
711 	if (fw_has_capa(&mvm->fw->ucode_capa,
712 			IWL_UCODE_TLV_CAPA_TDLS_SUPPORT)) {
713 		IWL_DEBUG_TDLS(mvm, "TDLS supported\n");
714 		hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
715 		ieee80211_hw_set(hw, TDLS_WIDER_BW);
716 	}
717 
718 	if (fw_has_capa(&mvm->fw->ucode_capa,
719 			IWL_UCODE_TLV_CAPA_TDLS_CHANNEL_SWITCH)) {
720 		IWL_DEBUG_TDLS(mvm, "TDLS channel switch supported\n");
721 		hw->wiphy->features |= NL80211_FEATURE_TDLS_CHANNEL_SWITCH;
722 	}
723 
724 	hw->netdev_features |= mvm->cfg->features;
725 	if (!iwl_mvm_is_csum_supported(mvm)) {
726 		hw->netdev_features &= ~(IWL_TX_CSUM_NETIF_FLAGS |
727 					 NETIF_F_RXCSUM);
728 		/* We may support SW TX CSUM */
729 		if (IWL_MVM_SW_TX_CSUM_OFFLOAD)
730 			hw->netdev_features |= IWL_TX_CSUM_NETIF_FLAGS;
731 	}
732 
733 	if (mvm->cfg->vht_mu_mimo_supported)
734 		wiphy_ext_feature_set(hw->wiphy,
735 				      NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER);
736 
737 	ret = ieee80211_register_hw(mvm->hw);
738 	if (ret) {
739 		iwl_mvm_leds_exit(mvm);
740 	}
741 
742 	return ret;
743 }
744 
745 static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
746 			   struct ieee80211_tx_control *control,
747 			   struct sk_buff *skb)
748 {
749 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
750 	struct ieee80211_sta *sta = control->sta;
751 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
752 	struct ieee80211_hdr *hdr = (void *)skb->data;
753 	bool offchannel = IEEE80211_SKB_CB(skb)->flags &
754 		IEEE80211_TX_CTL_TX_OFFCHAN;
755 
756 	if (iwl_mvm_is_radio_killed(mvm)) {
757 		IWL_DEBUG_DROP(mvm, "Dropping - RF/CT KILL\n");
758 		goto drop;
759 	}
760 
761 	if (offchannel &&
762 	    !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status) &&
763 	    !test_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status))
764 		goto drop;
765 
766 	/* treat non-bufferable MMPDUs on AP interfaces as broadcast */
767 	if ((info->control.vif->type == NL80211_IFTYPE_AP ||
768 	     info->control.vif->type == NL80211_IFTYPE_ADHOC) &&
769 	    ieee80211_is_mgmt(hdr->frame_control) &&
770 	    !ieee80211_is_bufferable_mmpdu(hdr->frame_control))
771 		sta = NULL;
772 
773 	/* If there is no sta, and it's not offchannel - send through AP */
774 	if (!sta && info->control.vif->type == NL80211_IFTYPE_STATION &&
775 	    !offchannel) {
776 		struct iwl_mvm_vif *mvmvif =
777 			iwl_mvm_vif_from_mac80211(info->control.vif);
778 		u8 ap_sta_id = READ_ONCE(mvmvif->ap_sta_id);
779 
780 		if (ap_sta_id < IWL_MVM_STATION_COUNT) {
781 			/* mac80211 holds rcu read lock */
782 			sta = rcu_dereference(mvm->fw_id_to_mac_id[ap_sta_id]);
783 			if (IS_ERR_OR_NULL(sta))
784 				goto drop;
785 		}
786 	}
787 
788 	if (sta) {
789 		if (iwl_mvm_tx_skb(mvm, skb, sta))
790 			goto drop;
791 		return;
792 	}
793 
794 	if (iwl_mvm_tx_skb_non_sta(mvm, skb))
795 		goto drop;
796 	return;
797  drop:
798 	ieee80211_free_txskb(hw, skb);
799 }
800 
801 void iwl_mvm_mac_itxq_xmit(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
802 {
803 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
804 	struct iwl_mvm_txq *mvmtxq = iwl_mvm_txq_from_mac80211(txq);
805 	struct sk_buff *skb = NULL;
806 
807 	/*
808 	 * No need for threads to be pending here, they can leave the first
809 	 * taker all the work.
810 	 *
811 	 * mvmtxq->tx_request logic:
812 	 *
813 	 * If 0, no one is currently TXing, set to 1 to indicate current thread
814 	 * will now start TX and other threads should quit.
815 	 *
816 	 * If 1, another thread is currently TXing, set to 2 to indicate to
817 	 * that thread that there was another request. Since that request may
818 	 * have raced with the check whether the queue is empty, the TXing
819 	 * thread should check the queue's status one more time before leaving.
820 	 * This check is done in order to not leave any TX hanging in the queue
821 	 * until the next TX invocation (which may not even happen).
822 	 *
823 	 * If 2, another thread is currently TXing, and it will already double
824 	 * check the queue, so do nothing.
825 	 */
826 	if (atomic_fetch_add_unless(&mvmtxq->tx_request, 1, 2))
827 		return;
828 
829 	rcu_read_lock();
830 	do {
831 		while (likely(!mvmtxq->stopped &&
832 			      (mvm->trans->system_pm_mode ==
833 			       IWL_PLAT_PM_MODE_DISABLED))) {
834 			skb = ieee80211_tx_dequeue(hw, txq);
835 
836 			if (!skb) {
837 				if (txq->sta)
838 					IWL_DEBUG_TX(mvm,
839 						     "TXQ of sta %pM tid %d is now empty\n",
840 						     txq->sta->addr,
841 						     txq->tid);
842 				break;
843 			}
844 
845 			if (!txq->sta)
846 				iwl_mvm_tx_skb_non_sta(mvm, skb);
847 			else
848 				iwl_mvm_tx_skb(mvm, skb, txq->sta);
849 		}
850 	} while (atomic_dec_return(&mvmtxq->tx_request));
851 	rcu_read_unlock();
852 }
853 
854 static void iwl_mvm_mac_wake_tx_queue(struct ieee80211_hw *hw,
855 				      struct ieee80211_txq *txq)
856 {
857 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
858 	struct iwl_mvm_txq *mvmtxq = iwl_mvm_txq_from_mac80211(txq);
859 
860 	/*
861 	 * Please note that racing is handled very carefully here:
862 	 * mvmtxq->txq_id is updated during allocation, and mvmtxq->list is
863 	 * deleted afterwards.
864 	 * This means that if:
865 	 * mvmtxq->txq_id != INVALID_QUEUE && list_empty(&mvmtxq->list):
866 	 *	queue is allocated and we can TX.
867 	 * mvmtxq->txq_id != INVALID_QUEUE && !list_empty(&mvmtxq->list):
868 	 *	a race, should defer the frame.
869 	 * mvmtxq->txq_id == INVALID_QUEUE && list_empty(&mvmtxq->list):
870 	 *	need to allocate the queue and defer the frame.
871 	 * mvmtxq->txq_id == INVALID_QUEUE && !list_empty(&mvmtxq->list):
872 	 *	queue is already scheduled for allocation, no need to allocate,
873 	 *	should defer the frame.
874 	 */
875 
876 	/* If the queue is allocated TX and return. */
877 	if (!txq->sta || mvmtxq->txq_id != IWL_MVM_INVALID_QUEUE) {
878 		/*
879 		 * Check that list is empty to avoid a race where txq_id is
880 		 * already updated, but the queue allocation work wasn't
881 		 * finished
882 		 */
883 		if (unlikely(txq->sta && !list_empty(&mvmtxq->list)))
884 			return;
885 
886 		iwl_mvm_mac_itxq_xmit(hw, txq);
887 		return;
888 	}
889 
890 	/* The list is being deleted only after the queue is fully allocated. */
891 	if (!list_empty(&mvmtxq->list))
892 		return;
893 
894 	list_add_tail(&mvmtxq->list, &mvm->add_stream_txqs);
895 	schedule_work(&mvm->add_stream_wk);
896 }
897 
898 #define CHECK_BA_TRIGGER(_mvm, _trig, _tid_bm, _tid, _fmt...)		\
899 	do {								\
900 		if (!(le16_to_cpu(_tid_bm) & BIT(_tid)))		\
901 			break;						\
902 		iwl_fw_dbg_collect_trig(&(_mvm)->fwrt, _trig, _fmt);	\
903 	} while (0)
904 
905 static void
906 iwl_mvm_ampdu_check_trigger(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
907 			    struct ieee80211_sta *sta, u16 tid, u16 rx_ba_ssn,
908 			    enum ieee80211_ampdu_mlme_action action)
909 {
910 	struct iwl_fw_dbg_trigger_tlv *trig;
911 	struct iwl_fw_dbg_trigger_ba *ba_trig;
912 
913 	trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
914 				     FW_DBG_TRIGGER_BA);
915 	if (!trig)
916 		return;
917 
918 	ba_trig = (void *)trig->data;
919 
920 	switch (action) {
921 	case IEEE80211_AMPDU_TX_OPERATIONAL: {
922 		struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
923 		struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
924 
925 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_start, tid,
926 				 "TX AGG START: MAC %pM tid %d ssn %d\n",
927 				 sta->addr, tid, tid_data->ssn);
928 		break;
929 		}
930 	case IEEE80211_AMPDU_TX_STOP_CONT:
931 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_stop, tid,
932 				 "TX AGG STOP: MAC %pM tid %d\n",
933 				 sta->addr, tid);
934 		break;
935 	case IEEE80211_AMPDU_RX_START:
936 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_start, tid,
937 				 "RX AGG START: MAC %pM tid %d ssn %d\n",
938 				 sta->addr, tid, rx_ba_ssn);
939 		break;
940 	case IEEE80211_AMPDU_RX_STOP:
941 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_stop, tid,
942 				 "RX AGG STOP: MAC %pM tid %d\n",
943 				 sta->addr, tid);
944 		break;
945 	default:
946 		break;
947 	}
948 }
949 
950 static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
951 				    struct ieee80211_vif *vif,
952 				    struct ieee80211_ampdu_params *params)
953 {
954 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
955 	int ret;
956 	struct ieee80211_sta *sta = params->sta;
957 	enum ieee80211_ampdu_mlme_action action = params->action;
958 	u16 tid = params->tid;
959 	u16 *ssn = &params->ssn;
960 	u16 buf_size = params->buf_size;
961 	bool amsdu = params->amsdu;
962 	u16 timeout = params->timeout;
963 
964 	IWL_DEBUG_HT(mvm, "A-MPDU action on addr %pM tid %d: action %d\n",
965 		     sta->addr, tid, action);
966 
967 	if (!(mvm->nvm_data->sku_cap_11n_enable))
968 		return -EACCES;
969 
970 	mutex_lock(&mvm->mutex);
971 
972 	switch (action) {
973 	case IEEE80211_AMPDU_RX_START:
974 		if (iwl_mvm_vif_from_mac80211(vif)->ap_sta_id ==
975 				iwl_mvm_sta_from_mac80211(sta)->sta_id) {
976 			struct iwl_mvm_vif *mvmvif;
977 			u16 macid = iwl_mvm_vif_from_mac80211(vif)->id;
978 			struct iwl_mvm_tcm_mac *mdata = &mvm->tcm.data[macid];
979 
980 			mdata->opened_rx_ba_sessions = true;
981 			mvmvif = iwl_mvm_vif_from_mac80211(vif);
982 			cancel_delayed_work(&mvmvif->uapsd_nonagg_detected_wk);
983 		}
984 		if (!iwl_enable_rx_ampdu()) {
985 			ret = -EINVAL;
986 			break;
987 		}
988 		ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, *ssn, true, buf_size,
989 					 timeout);
990 		break;
991 	case IEEE80211_AMPDU_RX_STOP:
992 		ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, 0, false, buf_size,
993 					 timeout);
994 		break;
995 	case IEEE80211_AMPDU_TX_START:
996 		if (!iwl_enable_tx_ampdu()) {
997 			ret = -EINVAL;
998 			break;
999 		}
1000 		ret = iwl_mvm_sta_tx_agg_start(mvm, vif, sta, tid, ssn);
1001 		break;
1002 	case IEEE80211_AMPDU_TX_STOP_CONT:
1003 		ret = iwl_mvm_sta_tx_agg_stop(mvm, vif, sta, tid);
1004 		break;
1005 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
1006 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
1007 		ret = iwl_mvm_sta_tx_agg_flush(mvm, vif, sta, tid);
1008 		break;
1009 	case IEEE80211_AMPDU_TX_OPERATIONAL:
1010 		ret = iwl_mvm_sta_tx_agg_oper(mvm, vif, sta, tid,
1011 					      buf_size, amsdu);
1012 		break;
1013 	default:
1014 		WARN_ON_ONCE(1);
1015 		ret = -EINVAL;
1016 		break;
1017 	}
1018 
1019 	if (!ret) {
1020 		u16 rx_ba_ssn = 0;
1021 
1022 		if (action == IEEE80211_AMPDU_RX_START)
1023 			rx_ba_ssn = *ssn;
1024 
1025 		iwl_mvm_ampdu_check_trigger(mvm, vif, sta, tid,
1026 					    rx_ba_ssn, action);
1027 	}
1028 	mutex_unlock(&mvm->mutex);
1029 
1030 	return ret;
1031 }
1032 
1033 static void iwl_mvm_cleanup_iterator(void *data, u8 *mac,
1034 				     struct ieee80211_vif *vif)
1035 {
1036 	struct iwl_mvm *mvm = data;
1037 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1038 
1039 	mvmvif->uploaded = false;
1040 	mvmvif->ap_sta_id = IWL_MVM_INVALID_STA;
1041 
1042 	spin_lock_bh(&mvm->time_event_lock);
1043 	iwl_mvm_te_clear_data(mvm, &mvmvif->time_event_data);
1044 	spin_unlock_bh(&mvm->time_event_lock);
1045 
1046 	mvmvif->phy_ctxt = NULL;
1047 	memset(&mvmvif->bf_data, 0, sizeof(mvmvif->bf_data));
1048 	memset(&mvmvif->probe_resp_data, 0, sizeof(mvmvif->probe_resp_data));
1049 }
1050 
1051 static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
1052 {
1053 	iwl_mvm_stop_device(mvm);
1054 
1055 	mvm->cur_aid = 0;
1056 
1057 	mvm->scan_status = 0;
1058 	mvm->ps_disabled = false;
1059 	mvm->rfkill_safe_init_done = false;
1060 
1061 	/* just in case one was running */
1062 	iwl_mvm_cleanup_roc_te(mvm);
1063 	ieee80211_remain_on_channel_expired(mvm->hw);
1064 
1065 	iwl_mvm_ftm_restart(mvm);
1066 
1067 	/*
1068 	 * cleanup all interfaces, even inactive ones, as some might have
1069 	 * gone down during the HW restart
1070 	 */
1071 	ieee80211_iterate_interfaces(mvm->hw, 0, iwl_mvm_cleanup_iterator, mvm);
1072 
1073 	mvm->p2p_device_vif = NULL;
1074 
1075 	iwl_mvm_reset_phy_ctxts(mvm);
1076 	memset(mvm->fw_key_table, 0, sizeof(mvm->fw_key_table));
1077 	memset(&mvm->last_bt_notif, 0, sizeof(mvm->last_bt_notif));
1078 	memset(&mvm->last_bt_ci_cmd, 0, sizeof(mvm->last_bt_ci_cmd));
1079 
1080 	ieee80211_wake_queues(mvm->hw);
1081 
1082 	mvm->vif_count = 0;
1083 	mvm->rx_ba_sessions = 0;
1084 	mvm->fwrt.dump.conf = FW_DBG_INVALID;
1085 	mvm->monitor_on = false;
1086 
1087 	/* keep statistics ticking */
1088 	iwl_mvm_accu_radio_stats(mvm);
1089 }
1090 
1091 int __iwl_mvm_mac_start(struct iwl_mvm *mvm)
1092 {
1093 	int ret;
1094 
1095 	lockdep_assert_held(&mvm->mutex);
1096 
1097 	if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status)) {
1098 		/*
1099 		 * Now convert the HW_RESTART_REQUESTED flag to IN_HW_RESTART
1100 		 * so later code will - from now on - see that we're doing it.
1101 		 */
1102 		set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1103 		clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status);
1104 		/* Clean up some internal and mac80211 state on restart */
1105 		iwl_mvm_restart_cleanup(mvm);
1106 	}
1107 	ret = iwl_mvm_up(mvm);
1108 
1109 	iwl_dbg_tlv_time_point(&mvm->fwrt, IWL_FW_INI_TIME_POINT_POST_INIT,
1110 			       NULL);
1111 	iwl_dbg_tlv_time_point(&mvm->fwrt, IWL_FW_INI_TIME_POINT_PERIODIC,
1112 			       NULL);
1113 
1114 	if (ret && test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
1115 		/* Something went wrong - we need to finish some cleanup
1116 		 * that normally iwl_mvm_mac_restart_complete() below
1117 		 * would do.
1118 		 */
1119 		clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1120 	}
1121 
1122 	return ret;
1123 }
1124 
1125 static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
1126 {
1127 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1128 	int ret;
1129 
1130 	mutex_lock(&mvm->mutex);
1131 	ret = __iwl_mvm_mac_start(mvm);
1132 	mutex_unlock(&mvm->mutex);
1133 
1134 	return ret;
1135 }
1136 
1137 static void iwl_mvm_restart_complete(struct iwl_mvm *mvm)
1138 {
1139 	int ret;
1140 
1141 	mutex_lock(&mvm->mutex);
1142 
1143 	clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1144 
1145 	ret = iwl_mvm_update_quotas(mvm, true, NULL);
1146 	if (ret)
1147 		IWL_ERR(mvm, "Failed to update quotas after restart (%d)\n",
1148 			ret);
1149 
1150 	iwl_mvm_send_recovery_cmd(mvm, ERROR_RECOVERY_END_OF_RECOVERY);
1151 
1152 	/*
1153 	 * If we have TDLS peers, remove them. We don't know the last seqno/PN
1154 	 * of packets the FW sent out, so we must reconnect.
1155 	 */
1156 	iwl_mvm_teardown_tdls_peers(mvm);
1157 
1158 	mutex_unlock(&mvm->mutex);
1159 }
1160 
1161 static void
1162 iwl_mvm_mac_reconfig_complete(struct ieee80211_hw *hw,
1163 			      enum ieee80211_reconfig_type reconfig_type)
1164 {
1165 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1166 
1167 	switch (reconfig_type) {
1168 	case IEEE80211_RECONFIG_TYPE_RESTART:
1169 		iwl_mvm_restart_complete(mvm);
1170 		break;
1171 	case IEEE80211_RECONFIG_TYPE_SUSPEND:
1172 		break;
1173 	}
1174 }
1175 
1176 void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
1177 {
1178 	lockdep_assert_held(&mvm->mutex);
1179 
1180 	/* firmware counters are obviously reset now, but we shouldn't
1181 	 * partially track so also clear the fw_reset_accu counters.
1182 	 */
1183 	memset(&mvm->accu_radio_stats, 0, sizeof(mvm->accu_radio_stats));
1184 
1185 	/* async_handlers_wk is now blocked */
1186 
1187 	/*
1188 	 * The work item could be running or queued if the
1189 	 * ROC time event stops just as we get here.
1190 	 */
1191 	flush_work(&mvm->roc_done_wk);
1192 
1193 	iwl_mvm_stop_device(mvm);
1194 
1195 	iwl_mvm_async_handlers_purge(mvm);
1196 	/* async_handlers_list is empty and will stay empty: HW is stopped */
1197 
1198 	/* the fw is stopped, the aux sta is dead: clean up driver state */
1199 	iwl_mvm_del_aux_sta(mvm);
1200 
1201 	/*
1202 	 * Clear IN_HW_RESTART and HW_RESTART_REQUESTED flag when stopping the
1203 	 * hw (as restart_complete() won't be called in this case) and mac80211
1204 	 * won't execute the restart.
1205 	 * But make sure to cleanup interfaces that have gone down before/during
1206 	 * HW restart was requested.
1207 	 */
1208 	if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) ||
1209 	    test_and_clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
1210 			       &mvm->status))
1211 		ieee80211_iterate_interfaces(mvm->hw, 0,
1212 					     iwl_mvm_cleanup_iterator, mvm);
1213 
1214 	/* We shouldn't have any UIDs still set.  Loop over all the UIDs to
1215 	 * make sure there's nothing left there and warn if any is found.
1216 	 */
1217 	if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1218 		int i;
1219 
1220 		for (i = 0; i < mvm->max_scans; i++) {
1221 			if (WARN_ONCE(mvm->scan_uid_status[i],
1222 				      "UMAC scan UID %d status was not cleaned\n",
1223 				      i))
1224 				mvm->scan_uid_status[i] = 0;
1225 		}
1226 	}
1227 }
1228 
1229 static void iwl_mvm_mac_stop(struct ieee80211_hw *hw)
1230 {
1231 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1232 
1233 	flush_work(&mvm->async_handlers_wk);
1234 	flush_work(&mvm->add_stream_wk);
1235 
1236 	/*
1237 	 * Lock and clear the firmware running bit here already, so that
1238 	 * new commands coming in elsewhere, e.g. from debugfs, will not
1239 	 * be able to proceed. This is important here because one of those
1240 	 * debugfs files causes the firmware dump to be triggered, and if we
1241 	 * don't stop debugfs accesses before canceling that it could be
1242 	 * retriggered after we flush it but before we've cleared the bit.
1243 	 */
1244 	clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status);
1245 
1246 	cancel_delayed_work_sync(&mvm->cs_tx_unblock_dwork);
1247 	cancel_delayed_work_sync(&mvm->scan_timeout_dwork);
1248 	iwl_fw_free_dump_desc(&mvm->fwrt);
1249 
1250 	mutex_lock(&mvm->mutex);
1251 	__iwl_mvm_mac_stop(mvm);
1252 	mutex_unlock(&mvm->mutex);
1253 
1254 	/*
1255 	 * The worker might have been waiting for the mutex, let it run and
1256 	 * discover that its list is now empty.
1257 	 */
1258 	cancel_work_sync(&mvm->async_handlers_wk);
1259 }
1260 
1261 static struct iwl_mvm_phy_ctxt *iwl_mvm_get_free_phy_ctxt(struct iwl_mvm *mvm)
1262 {
1263 	u16 i;
1264 
1265 	lockdep_assert_held(&mvm->mutex);
1266 
1267 	for (i = 0; i < NUM_PHY_CTX; i++)
1268 		if (!mvm->phy_ctxts[i].ref)
1269 			return &mvm->phy_ctxts[i];
1270 
1271 	IWL_ERR(mvm, "No available PHY context\n");
1272 	return NULL;
1273 }
1274 
1275 static int iwl_mvm_set_tx_power(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1276 				s16 tx_power)
1277 {
1278 	int len;
1279 	union {
1280 		struct iwl_dev_tx_power_cmd v5;
1281 		struct iwl_dev_tx_power_cmd_v4 v4;
1282 	} cmd = {
1283 		.v5.v3.set_mode = cpu_to_le32(IWL_TX_POWER_MODE_SET_MAC),
1284 		.v5.v3.mac_context_id =
1285 			cpu_to_le32(iwl_mvm_vif_from_mac80211(vif)->id),
1286 		.v5.v3.pwr_restriction = cpu_to_le16(8 * tx_power),
1287 	};
1288 
1289 	if (tx_power == IWL_DEFAULT_MAX_TX_POWER)
1290 		cmd.v5.v3.pwr_restriction = cpu_to_le16(IWL_DEV_MAX_TX_POWER);
1291 
1292 	if (fw_has_api(&mvm->fw->ucode_capa,
1293 		       IWL_UCODE_TLV_API_REDUCE_TX_POWER))
1294 		len = sizeof(cmd.v5);
1295 	else if (fw_has_capa(&mvm->fw->ucode_capa,
1296 			     IWL_UCODE_TLV_CAPA_TX_POWER_ACK))
1297 		len = sizeof(cmd.v4);
1298 	else
1299 		len = sizeof(cmd.v4.v3);
1300 
1301 	return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, 0, len, &cmd);
1302 }
1303 
1304 static int iwl_mvm_post_channel_switch(struct ieee80211_hw *hw,
1305 				       struct ieee80211_vif *vif)
1306 {
1307 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1308 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1309 	int ret;
1310 
1311 	mutex_lock(&mvm->mutex);
1312 
1313 	if (mvmvif->csa_failed) {
1314 		mvmvif->csa_failed = false;
1315 		ret = -EIO;
1316 		goto out_unlock;
1317 	}
1318 
1319 	if (vif->type == NL80211_IFTYPE_STATION) {
1320 		struct iwl_mvm_sta *mvmsta;
1321 
1322 		mvmvif->csa_bcn_pending = false;
1323 		mvmsta = iwl_mvm_sta_from_staid_protected(mvm,
1324 							  mvmvif->ap_sta_id);
1325 
1326 		if (WARN_ON(!mvmsta)) {
1327 			ret = -EIO;
1328 			goto out_unlock;
1329 		}
1330 
1331 		if (!fw_has_capa(&mvm->fw->ucode_capa,
1332 				 IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD))
1333 			iwl_mvm_sta_modify_disable_tx(mvm, mvmsta, false);
1334 
1335 		iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
1336 
1337 		if (!fw_has_capa(&mvm->fw->ucode_capa,
1338 				 IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
1339 			ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
1340 			if (ret)
1341 				goto out_unlock;
1342 
1343 			iwl_mvm_stop_session_protection(mvm, vif);
1344 		}
1345 	}
1346 
1347 	mvmvif->ps_disabled = false;
1348 
1349 	ret = iwl_mvm_power_update_ps(mvm);
1350 
1351 out_unlock:
1352 	mutex_unlock(&mvm->mutex);
1353 
1354 	return ret;
1355 }
1356 
1357 static void iwl_mvm_abort_channel_switch(struct ieee80211_hw *hw,
1358 					 struct ieee80211_vif *vif)
1359 {
1360 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1361 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1362 	struct iwl_chan_switch_te_cmd cmd = {
1363 		.mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
1364 							  mvmvif->color)),
1365 		.action = cpu_to_le32(FW_CTXT_ACTION_REMOVE),
1366 	};
1367 
1368 	IWL_DEBUG_MAC80211(mvm, "Abort CSA on mac %d\n", mvmvif->id);
1369 
1370 	mutex_lock(&mvm->mutex);
1371 	WARN_ON(iwl_mvm_send_cmd_pdu(mvm,
1372 				     WIDE_ID(MAC_CONF_GROUP,
1373 					     CHANNEL_SWITCH_TIME_EVENT_CMD),
1374 				     0, sizeof(cmd), &cmd));
1375 	mutex_unlock(&mvm->mutex);
1376 
1377 	WARN_ON(iwl_mvm_post_channel_switch(hw, vif));
1378 }
1379 
1380 static void iwl_mvm_channel_switch_disconnect_wk(struct work_struct *wk)
1381 {
1382 	struct iwl_mvm *mvm;
1383 	struct iwl_mvm_vif *mvmvif;
1384 	struct ieee80211_vif *vif;
1385 
1386 	mvmvif = container_of(wk, struct iwl_mvm_vif, csa_work.work);
1387 	vif = container_of((void *)mvmvif, struct ieee80211_vif, drv_priv);
1388 	mvm = mvmvif->mvm;
1389 
1390 	iwl_mvm_abort_channel_switch(mvm->hw, vif);
1391 	ieee80211_chswitch_done(vif, false);
1392 }
1393 
1394 static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
1395 				     struct ieee80211_vif *vif)
1396 {
1397 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1398 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1399 	int ret;
1400 
1401 	mvmvif->mvm = mvm;
1402 	RCU_INIT_POINTER(mvmvif->probe_resp_data, NULL);
1403 
1404 	/*
1405 	 * Not much to do here. The stack will not allow interface
1406 	 * types or combinations that we didn't advertise, so we
1407 	 * don't really have to check the types.
1408 	 */
1409 
1410 	mutex_lock(&mvm->mutex);
1411 
1412 	/* make sure that beacon statistics don't go backwards with FW reset */
1413 	if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
1414 		mvmvif->beacon_stats.accu_num_beacons +=
1415 			mvmvif->beacon_stats.num_beacons;
1416 
1417 	/* Allocate resources for the MAC context, and add it to the fw  */
1418 	ret = iwl_mvm_mac_ctxt_init(mvm, vif);
1419 	if (ret)
1420 		goto out_unlock;
1421 
1422 	rcu_assign_pointer(mvm->vif_id_to_mac[mvmvif->id], vif);
1423 
1424 	/* Counting number of interfaces is needed for legacy PM */
1425 	if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1426 		mvm->vif_count++;
1427 
1428 	/*
1429 	 * The AP binding flow can be done only after the beacon
1430 	 * template is configured (which happens only in the mac80211
1431 	 * start_ap() flow), and adding the broadcast station can happen
1432 	 * only after the binding.
1433 	 * In addition, since modifying the MAC before adding a bcast
1434 	 * station is not allowed by the FW, delay the adding of MAC context to
1435 	 * the point where we can also add the bcast station.
1436 	 * In short: there's not much we can do at this point, other than
1437 	 * allocating resources :)
1438 	 */
1439 	if (vif->type == NL80211_IFTYPE_AP ||
1440 	    vif->type == NL80211_IFTYPE_ADHOC) {
1441 		ret = iwl_mvm_alloc_bcast_sta(mvm, vif);
1442 		if (ret) {
1443 			IWL_ERR(mvm, "Failed to allocate bcast sta\n");
1444 			goto out_release;
1445 		}
1446 
1447 		/*
1448 		 * Only queue for this station is the mcast queue,
1449 		 * which shouldn't be in TFD mask anyway
1450 		 */
1451 		ret = iwl_mvm_allocate_int_sta(mvm, &mvmvif->mcast_sta,
1452 					       0, vif->type,
1453 					       IWL_STA_MULTICAST);
1454 		if (ret)
1455 			goto out_release;
1456 
1457 		iwl_mvm_vif_dbgfs_register(mvm, vif);
1458 		goto out_unlock;
1459 	}
1460 
1461 	mvmvif->features |= hw->netdev_features;
1462 
1463 	ret = iwl_mvm_mac_ctxt_add(mvm, vif);
1464 	if (ret)
1465 		goto out_release;
1466 
1467 	ret = iwl_mvm_power_update_mac(mvm);
1468 	if (ret)
1469 		goto out_remove_mac;
1470 
1471 	/* beacon filtering */
1472 	ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
1473 	if (ret)
1474 		goto out_remove_mac;
1475 
1476 	if (!mvm->bf_allowed_vif &&
1477 	    vif->type == NL80211_IFTYPE_STATION && !vif->p2p) {
1478 		mvm->bf_allowed_vif = mvmvif;
1479 		vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
1480 				     IEEE80211_VIF_SUPPORTS_CQM_RSSI;
1481 	}
1482 
1483 	/*
1484 	 * P2P_DEVICE interface does not have a channel context assigned to it,
1485 	 * so a dedicated PHY context is allocated to it and the corresponding
1486 	 * MAC context is bound to it at this stage.
1487 	 */
1488 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1489 
1490 		mvmvif->phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
1491 		if (!mvmvif->phy_ctxt) {
1492 			ret = -ENOSPC;
1493 			goto out_free_bf;
1494 		}
1495 
1496 		iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
1497 		ret = iwl_mvm_binding_add_vif(mvm, vif);
1498 		if (ret)
1499 			goto out_unref_phy;
1500 
1501 		ret = iwl_mvm_add_p2p_bcast_sta(mvm, vif);
1502 		if (ret)
1503 			goto out_unbind;
1504 
1505 		/* Save a pointer to p2p device vif, so it can later be used to
1506 		 * update the p2p device MAC when a GO is started/stopped */
1507 		mvm->p2p_device_vif = vif;
1508 	}
1509 
1510 	iwl_mvm_tcm_add_vif(mvm, vif);
1511 	INIT_DELAYED_WORK(&mvmvif->csa_work,
1512 			  iwl_mvm_channel_switch_disconnect_wk);
1513 
1514 	if (vif->type == NL80211_IFTYPE_MONITOR)
1515 		mvm->monitor_on = true;
1516 
1517 	iwl_mvm_vif_dbgfs_register(mvm, vif);
1518 	goto out_unlock;
1519 
1520  out_unbind:
1521 	iwl_mvm_binding_remove_vif(mvm, vif);
1522  out_unref_phy:
1523 	iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1524  out_free_bf:
1525 	if (mvm->bf_allowed_vif == mvmvif) {
1526 		mvm->bf_allowed_vif = NULL;
1527 		vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1528 				       IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1529 	}
1530  out_remove_mac:
1531 	mvmvif->phy_ctxt = NULL;
1532 	iwl_mvm_mac_ctxt_remove(mvm, vif);
1533  out_release:
1534 	if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1535 		mvm->vif_count--;
1536  out_unlock:
1537 	mutex_unlock(&mvm->mutex);
1538 
1539 	return ret;
1540 }
1541 
1542 static void iwl_mvm_prepare_mac_removal(struct iwl_mvm *mvm,
1543 					struct ieee80211_vif *vif)
1544 {
1545 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1546 		/*
1547 		 * Flush the ROC worker which will flush the OFFCHANNEL queue.
1548 		 * We assume here that all the packets sent to the OFFCHANNEL
1549 		 * queue are sent in ROC session.
1550 		 */
1551 		flush_work(&mvm->roc_done_wk);
1552 	}
1553 }
1554 
1555 static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
1556 					 struct ieee80211_vif *vif)
1557 {
1558 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1559 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1560 	struct iwl_probe_resp_data *probe_data;
1561 
1562 	iwl_mvm_prepare_mac_removal(mvm, vif);
1563 
1564 	if (!(vif->type == NL80211_IFTYPE_AP ||
1565 	      vif->type == NL80211_IFTYPE_ADHOC))
1566 		iwl_mvm_tcm_rm_vif(mvm, vif);
1567 
1568 	mutex_lock(&mvm->mutex);
1569 
1570 	probe_data = rcu_dereference_protected(mvmvif->probe_resp_data,
1571 					       lockdep_is_held(&mvm->mutex));
1572 	RCU_INIT_POINTER(mvmvif->probe_resp_data, NULL);
1573 	if (probe_data)
1574 		kfree_rcu(probe_data, rcu_head);
1575 
1576 	if (mvm->bf_allowed_vif == mvmvif) {
1577 		mvm->bf_allowed_vif = NULL;
1578 		vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1579 				       IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1580 	}
1581 
1582 	if (vif->bss_conf.ftm_responder)
1583 		memset(&mvm->ftm_resp_stats, 0, sizeof(mvm->ftm_resp_stats));
1584 
1585 	iwl_mvm_vif_dbgfs_clean(mvm, vif);
1586 
1587 	/*
1588 	 * For AP/GO interface, the tear down of the resources allocated to the
1589 	 * interface is be handled as part of the stop_ap flow.
1590 	 */
1591 	if (vif->type == NL80211_IFTYPE_AP ||
1592 	    vif->type == NL80211_IFTYPE_ADHOC) {
1593 #ifdef CONFIG_NL80211_TESTMODE
1594 		if (vif == mvm->noa_vif) {
1595 			mvm->noa_vif = NULL;
1596 			mvm->noa_duration = 0;
1597 		}
1598 #endif
1599 		iwl_mvm_dealloc_int_sta(mvm, &mvmvif->mcast_sta);
1600 		iwl_mvm_dealloc_bcast_sta(mvm, vif);
1601 		goto out_release;
1602 	}
1603 
1604 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1605 		mvm->p2p_device_vif = NULL;
1606 		iwl_mvm_rm_p2p_bcast_sta(mvm, vif);
1607 		iwl_mvm_binding_remove_vif(mvm, vif);
1608 		iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1609 		mvmvif->phy_ctxt = NULL;
1610 	}
1611 
1612 	if (mvm->vif_count && vif->type != NL80211_IFTYPE_P2P_DEVICE)
1613 		mvm->vif_count--;
1614 
1615 	iwl_mvm_power_update_mac(mvm);
1616 	iwl_mvm_mac_ctxt_remove(mvm, vif);
1617 
1618 	RCU_INIT_POINTER(mvm->vif_id_to_mac[mvmvif->id], NULL);
1619 
1620 	if (vif->type == NL80211_IFTYPE_MONITOR)
1621 		mvm->monitor_on = false;
1622 
1623 out_release:
1624 	mutex_unlock(&mvm->mutex);
1625 }
1626 
1627 static int iwl_mvm_mac_config(struct ieee80211_hw *hw, u32 changed)
1628 {
1629 	return 0;
1630 }
1631 
1632 struct iwl_mvm_mc_iter_data {
1633 	struct iwl_mvm *mvm;
1634 	int port_id;
1635 };
1636 
1637 static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
1638 				      struct ieee80211_vif *vif)
1639 {
1640 	struct iwl_mvm_mc_iter_data *data = _data;
1641 	struct iwl_mvm *mvm = data->mvm;
1642 	struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd;
1643 	struct iwl_host_cmd hcmd = {
1644 		.id = MCAST_FILTER_CMD,
1645 		.flags = CMD_ASYNC,
1646 		.dataflags[0] = IWL_HCMD_DFL_NOCOPY,
1647 	};
1648 	int ret, len;
1649 
1650 	/* if we don't have free ports, mcast frames will be dropped */
1651 	if (WARN_ON_ONCE(data->port_id >= MAX_PORT_ID_NUM))
1652 		return;
1653 
1654 	if (vif->type != NL80211_IFTYPE_STATION ||
1655 	    !vif->bss_conf.assoc)
1656 		return;
1657 
1658 	cmd->port_id = data->port_id++;
1659 	memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
1660 	len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4);
1661 
1662 	hcmd.len[0] = len;
1663 	hcmd.data[0] = cmd;
1664 
1665 	ret = iwl_mvm_send_cmd(mvm, &hcmd);
1666 	if (ret)
1667 		IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret);
1668 }
1669 
1670 static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm)
1671 {
1672 	struct iwl_mvm_mc_iter_data iter_data = {
1673 		.mvm = mvm,
1674 	};
1675 
1676 	lockdep_assert_held(&mvm->mutex);
1677 
1678 	if (WARN_ON_ONCE(!mvm->mcast_filter_cmd))
1679 		return;
1680 
1681 	ieee80211_iterate_active_interfaces_atomic(
1682 		mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1683 		iwl_mvm_mc_iface_iterator, &iter_data);
1684 }
1685 
1686 static u64 iwl_mvm_prepare_multicast(struct ieee80211_hw *hw,
1687 				     struct netdev_hw_addr_list *mc_list)
1688 {
1689 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1690 	struct iwl_mcast_filter_cmd *cmd;
1691 	struct netdev_hw_addr *addr;
1692 	int addr_count;
1693 	bool pass_all;
1694 	int len;
1695 
1696 	addr_count = netdev_hw_addr_list_count(mc_list);
1697 	pass_all = addr_count > MAX_MCAST_FILTERING_ADDRESSES ||
1698 		   IWL_MVM_FW_MCAST_FILTER_PASS_ALL;
1699 	if (pass_all)
1700 		addr_count = 0;
1701 
1702 	len = roundup(sizeof(*cmd) + addr_count * ETH_ALEN, 4);
1703 	cmd = kzalloc(len, GFP_ATOMIC);
1704 	if (!cmd)
1705 		return 0;
1706 
1707 	if (pass_all) {
1708 		cmd->pass_all = 1;
1709 		return (u64)(unsigned long)cmd;
1710 	}
1711 
1712 	netdev_hw_addr_list_for_each(addr, mc_list) {
1713 		IWL_DEBUG_MAC80211(mvm, "mcast addr (%d): %pM\n",
1714 				   cmd->count, addr->addr);
1715 		memcpy(&cmd->addr_list[cmd->count * ETH_ALEN],
1716 		       addr->addr, ETH_ALEN);
1717 		cmd->count++;
1718 	}
1719 
1720 	return (u64)(unsigned long)cmd;
1721 }
1722 
1723 static void iwl_mvm_configure_filter(struct ieee80211_hw *hw,
1724 				     unsigned int changed_flags,
1725 				     unsigned int *total_flags,
1726 				     u64 multicast)
1727 {
1728 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1729 	struct iwl_mcast_filter_cmd *cmd = (void *)(unsigned long)multicast;
1730 
1731 	mutex_lock(&mvm->mutex);
1732 
1733 	/* replace previous configuration */
1734 	kfree(mvm->mcast_filter_cmd);
1735 	mvm->mcast_filter_cmd = cmd;
1736 
1737 	if (!cmd)
1738 		goto out;
1739 
1740 	if (changed_flags & FIF_ALLMULTI)
1741 		cmd->pass_all = !!(*total_flags & FIF_ALLMULTI);
1742 
1743 	if (cmd->pass_all)
1744 		cmd->count = 0;
1745 
1746 	iwl_mvm_recalc_multicast(mvm);
1747 out:
1748 	mutex_unlock(&mvm->mutex);
1749 	*total_flags = 0;
1750 }
1751 
1752 static void iwl_mvm_config_iface_filter(struct ieee80211_hw *hw,
1753 					struct ieee80211_vif *vif,
1754 					unsigned int filter_flags,
1755 					unsigned int changed_flags)
1756 {
1757 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1758 
1759 	/* We support only filter for probe requests */
1760 	if (!(changed_flags & FIF_PROBE_REQ))
1761 		return;
1762 
1763 	/* Supported only for p2p client interfaces */
1764 	if (vif->type != NL80211_IFTYPE_STATION || !vif->bss_conf.assoc ||
1765 	    !vif->p2p)
1766 		return;
1767 
1768 	mutex_lock(&mvm->mutex);
1769 	iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
1770 	mutex_unlock(&mvm->mutex);
1771 }
1772 
1773 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
1774 struct iwl_bcast_iter_data {
1775 	struct iwl_mvm *mvm;
1776 	struct iwl_bcast_filter_cmd *cmd;
1777 	u8 current_filter;
1778 };
1779 
1780 static void
1781 iwl_mvm_set_bcast_filter(struct ieee80211_vif *vif,
1782 			 const struct iwl_fw_bcast_filter *in_filter,
1783 			 struct iwl_fw_bcast_filter *out_filter)
1784 {
1785 	struct iwl_fw_bcast_filter_attr *attr;
1786 	int i;
1787 
1788 	memcpy(out_filter, in_filter, sizeof(*out_filter));
1789 
1790 	for (i = 0; i < ARRAY_SIZE(out_filter->attrs); i++) {
1791 		attr = &out_filter->attrs[i];
1792 
1793 		if (!attr->mask)
1794 			break;
1795 
1796 		switch (attr->reserved1) {
1797 		case cpu_to_le16(BC_FILTER_MAGIC_IP):
1798 			if (vif->bss_conf.arp_addr_cnt != 1) {
1799 				attr->mask = 0;
1800 				continue;
1801 			}
1802 
1803 			attr->val = vif->bss_conf.arp_addr_list[0];
1804 			break;
1805 		case cpu_to_le16(BC_FILTER_MAGIC_MAC):
1806 			attr->val = *(__be32 *)&vif->addr[2];
1807 			break;
1808 		default:
1809 			break;
1810 		}
1811 		attr->reserved1 = 0;
1812 		out_filter->num_attrs++;
1813 	}
1814 }
1815 
1816 static void iwl_mvm_bcast_filter_iterator(void *_data, u8 *mac,
1817 					  struct ieee80211_vif *vif)
1818 {
1819 	struct iwl_bcast_iter_data *data = _data;
1820 	struct iwl_mvm *mvm = data->mvm;
1821 	struct iwl_bcast_filter_cmd *cmd = data->cmd;
1822 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1823 	struct iwl_fw_bcast_mac *bcast_mac;
1824 	int i;
1825 
1826 	if (WARN_ON(mvmvif->id >= ARRAY_SIZE(cmd->macs)))
1827 		return;
1828 
1829 	bcast_mac = &cmd->macs[mvmvif->id];
1830 
1831 	/*
1832 	 * enable filtering only for associated stations, but not for P2P
1833 	 * Clients
1834 	 */
1835 	if (vif->type != NL80211_IFTYPE_STATION || vif->p2p ||
1836 	    !vif->bss_conf.assoc)
1837 		return;
1838 
1839 	bcast_mac->default_discard = 1;
1840 
1841 	/* copy all configured filters */
1842 	for (i = 0; mvm->bcast_filters[i].attrs[0].mask; i++) {
1843 		/*
1844 		 * Make sure we don't exceed our filters limit.
1845 		 * if there is still a valid filter to be configured,
1846 		 * be on the safe side and just allow bcast for this mac.
1847 		 */
1848 		if (WARN_ON_ONCE(data->current_filter >=
1849 				 ARRAY_SIZE(cmd->filters))) {
1850 			bcast_mac->default_discard = 0;
1851 			bcast_mac->attached_filters = 0;
1852 			break;
1853 		}
1854 
1855 		iwl_mvm_set_bcast_filter(vif,
1856 					 &mvm->bcast_filters[i],
1857 					 &cmd->filters[data->current_filter]);
1858 
1859 		/* skip current filter if it contains no attributes */
1860 		if (!cmd->filters[data->current_filter].num_attrs)
1861 			continue;
1862 
1863 		/* attach the filter to current mac */
1864 		bcast_mac->attached_filters |=
1865 				cpu_to_le16(BIT(data->current_filter));
1866 
1867 		data->current_filter++;
1868 	}
1869 }
1870 
1871 bool iwl_mvm_bcast_filter_build_cmd(struct iwl_mvm *mvm,
1872 				    struct iwl_bcast_filter_cmd *cmd)
1873 {
1874 	struct iwl_bcast_iter_data iter_data = {
1875 		.mvm = mvm,
1876 		.cmd = cmd,
1877 	};
1878 
1879 	if (IWL_MVM_FW_BCAST_FILTER_PASS_ALL)
1880 		return false;
1881 
1882 	memset(cmd, 0, sizeof(*cmd));
1883 	cmd->max_bcast_filters = ARRAY_SIZE(cmd->filters);
1884 	cmd->max_macs = ARRAY_SIZE(cmd->macs);
1885 
1886 #ifdef CONFIG_IWLWIFI_DEBUGFS
1887 	/* use debugfs filters/macs if override is configured */
1888 	if (mvm->dbgfs_bcast_filtering.override) {
1889 		memcpy(cmd->filters, &mvm->dbgfs_bcast_filtering.cmd.filters,
1890 		       sizeof(cmd->filters));
1891 		memcpy(cmd->macs, &mvm->dbgfs_bcast_filtering.cmd.macs,
1892 		       sizeof(cmd->macs));
1893 		return true;
1894 	}
1895 #endif
1896 
1897 	/* if no filters are configured, do nothing */
1898 	if (!mvm->bcast_filters)
1899 		return false;
1900 
1901 	/* configure and attach these filters for each associated sta vif */
1902 	ieee80211_iterate_active_interfaces(
1903 		mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1904 		iwl_mvm_bcast_filter_iterator, &iter_data);
1905 
1906 	return true;
1907 }
1908 
1909 static int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
1910 {
1911 	struct iwl_bcast_filter_cmd cmd;
1912 
1913 	if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BCAST_FILTERING))
1914 		return 0;
1915 
1916 	if (!iwl_mvm_bcast_filter_build_cmd(mvm, &cmd))
1917 		return 0;
1918 
1919 	return iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, 0,
1920 				    sizeof(cmd), &cmd);
1921 }
1922 #else
1923 static inline int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
1924 {
1925 	return 0;
1926 }
1927 #endif
1928 
1929 static int iwl_mvm_update_mu_groups(struct iwl_mvm *mvm,
1930 				    struct ieee80211_vif *vif)
1931 {
1932 	struct iwl_mu_group_mgmt_cmd cmd = {};
1933 
1934 	memcpy(cmd.membership_status, vif->bss_conf.mu_group.membership,
1935 	       WLAN_MEMBERSHIP_LEN);
1936 	memcpy(cmd.user_position, vif->bss_conf.mu_group.position,
1937 	       WLAN_USER_POSITION_LEN);
1938 
1939 	return iwl_mvm_send_cmd_pdu(mvm,
1940 				    WIDE_ID(DATA_PATH_GROUP,
1941 					    UPDATE_MU_GROUPS_CMD),
1942 				    0, sizeof(cmd), &cmd);
1943 }
1944 
1945 static void iwl_mvm_mu_mimo_iface_iterator(void *_data, u8 *mac,
1946 					   struct ieee80211_vif *vif)
1947 {
1948 	if (vif->mu_mimo_owner) {
1949 		struct iwl_mu_group_mgmt_notif *notif = _data;
1950 
1951 		/*
1952 		 * MU-MIMO Group Id action frame is little endian. We treat
1953 		 * the data received from firmware as if it came from the
1954 		 * action frame, so no conversion is needed.
1955 		 */
1956 		ieee80211_update_mu_groups(vif,
1957 					   (u8 *)&notif->membership_status,
1958 					   (u8 *)&notif->user_position);
1959 	}
1960 }
1961 
1962 void iwl_mvm_mu_mimo_grp_notif(struct iwl_mvm *mvm,
1963 			       struct iwl_rx_cmd_buffer *rxb)
1964 {
1965 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
1966 	struct iwl_mu_group_mgmt_notif *notif = (void *)pkt->data;
1967 
1968 	ieee80211_iterate_active_interfaces_atomic(
1969 			mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1970 			iwl_mvm_mu_mimo_iface_iterator, notif);
1971 }
1972 
1973 static u8 iwl_mvm_he_get_ppe_val(u8 *ppe, u8 ppe_pos_bit)
1974 {
1975 	u8 byte_num = ppe_pos_bit / 8;
1976 	u8 bit_num = ppe_pos_bit % 8;
1977 	u8 residue_bits;
1978 	u8 res;
1979 
1980 	if (bit_num <= 5)
1981 		return (ppe[byte_num] >> bit_num) &
1982 		       (BIT(IEEE80211_PPE_THRES_INFO_PPET_SIZE) - 1);
1983 
1984 	/*
1985 	 * If bit_num > 5, we have to combine bits with next byte.
1986 	 * Calculate how many bits we need to take from current byte (called
1987 	 * here "residue_bits"), and add them to bits from next byte.
1988 	 */
1989 
1990 	residue_bits = 8 - bit_num;
1991 
1992 	res = (ppe[byte_num + 1] &
1993 	       (BIT(IEEE80211_PPE_THRES_INFO_PPET_SIZE - residue_bits) - 1)) <<
1994 	      residue_bits;
1995 	res += (ppe[byte_num] >> bit_num) & (BIT(residue_bits) - 1);
1996 
1997 	return res;
1998 }
1999 
2000 static void iwl_mvm_cfg_he_sta(struct iwl_mvm *mvm,
2001 			       struct ieee80211_vif *vif, u8 sta_id)
2002 {
2003 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2004 	struct iwl_he_sta_context_cmd sta_ctxt_cmd = {
2005 		.sta_id = sta_id,
2006 		.tid_limit = IWL_MAX_TID_COUNT,
2007 		.bss_color = vif->bss_conf.bss_color,
2008 		.htc_trig_based_pkt_ext = vif->bss_conf.htc_trig_based_pkt_ext,
2009 		.frame_time_rts_th =
2010 			cpu_to_le16(vif->bss_conf.frame_time_rts_th),
2011 	};
2012 	int size = fw_has_api(&mvm->fw->ucode_capa,
2013 			      IWL_UCODE_TLV_API_MBSSID_HE) ?
2014 		   sizeof(sta_ctxt_cmd) :
2015 		   sizeof(struct iwl_he_sta_context_cmd_v1);
2016 	struct ieee80211_sta *sta;
2017 	u32 flags;
2018 	int i;
2019 
2020 	rcu_read_lock();
2021 
2022 	sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_ctxt_cmd.sta_id]);
2023 	if (IS_ERR(sta)) {
2024 		rcu_read_unlock();
2025 		WARN(1, "Can't find STA to configure HE\n");
2026 		return;
2027 	}
2028 
2029 	if (!sta->he_cap.has_he) {
2030 		rcu_read_unlock();
2031 		return;
2032 	}
2033 
2034 	flags = 0;
2035 
2036 	/* Block 26-tone RU OFDMA transmissions */
2037 	if (mvmvif->he_ru_2mhz_block)
2038 		flags |= STA_CTXT_HE_RU_2MHZ_BLOCK;
2039 
2040 	/* HTC flags */
2041 	if (sta->he_cap.he_cap_elem.mac_cap_info[0] &
2042 	    IEEE80211_HE_MAC_CAP0_HTC_HE)
2043 		sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_SUPPORT);
2044 	if ((sta->he_cap.he_cap_elem.mac_cap_info[1] &
2045 	      IEEE80211_HE_MAC_CAP1_LINK_ADAPTATION) ||
2046 	    (sta->he_cap.he_cap_elem.mac_cap_info[2] &
2047 	      IEEE80211_HE_MAC_CAP2_LINK_ADAPTATION)) {
2048 		u8 link_adap =
2049 			((sta->he_cap.he_cap_elem.mac_cap_info[2] &
2050 			  IEEE80211_HE_MAC_CAP2_LINK_ADAPTATION) << 1) +
2051 			 (sta->he_cap.he_cap_elem.mac_cap_info[1] &
2052 			  IEEE80211_HE_MAC_CAP1_LINK_ADAPTATION);
2053 
2054 		if (link_adap == 2)
2055 			sta_ctxt_cmd.htc_flags |=
2056 				cpu_to_le32(IWL_HE_HTC_LINK_ADAP_UNSOLICITED);
2057 		else if (link_adap == 3)
2058 			sta_ctxt_cmd.htc_flags |=
2059 				cpu_to_le32(IWL_HE_HTC_LINK_ADAP_BOTH);
2060 	}
2061 	if (sta->he_cap.he_cap_elem.mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
2062 		sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_BSR_SUPP);
2063 	if (sta->he_cap.he_cap_elem.mac_cap_info[3] &
2064 	    IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
2065 		sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_OMI_SUPP);
2066 	if (sta->he_cap.he_cap_elem.mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
2067 		sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_BQR_SUPP);
2068 
2069 	/*
2070 	 * Initialize the PPE thresholds to "None" (7), as described in Table
2071 	 * 9-262ac of 80211.ax/D3.0.
2072 	 */
2073 	memset(&sta_ctxt_cmd.pkt_ext, 7, sizeof(sta_ctxt_cmd.pkt_ext));
2074 
2075 	/* If PPE Thresholds exist, parse them into a FW-familiar format. */
2076 	if (sta->he_cap.he_cap_elem.phy_cap_info[6] &
2077 	    IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT) {
2078 		u8 nss = (sta->he_cap.ppe_thres[0] &
2079 			  IEEE80211_PPE_THRES_NSS_MASK) + 1;
2080 		u8 ru_index_bitmap =
2081 			(sta->he_cap.ppe_thres[0] &
2082 			 IEEE80211_PPE_THRES_RU_INDEX_BITMASK_MASK) >>
2083 			IEEE80211_PPE_THRES_RU_INDEX_BITMASK_POS;
2084 		u8 *ppe = &sta->he_cap.ppe_thres[0];
2085 		u8 ppe_pos_bit = 7; /* Starting after PPE header */
2086 
2087 		/*
2088 		 * FW currently supports only nss == MAX_HE_SUPP_NSS
2089 		 *
2090 		 * If nss > MAX: we can ignore values we don't support
2091 		 * If nss < MAX: we can set zeros in other streams
2092 		 */
2093 		if (nss > MAX_HE_SUPP_NSS) {
2094 			IWL_INFO(mvm, "Got NSS = %d - trimming to %d\n", nss,
2095 				 MAX_HE_SUPP_NSS);
2096 			nss = MAX_HE_SUPP_NSS;
2097 		}
2098 
2099 		for (i = 0; i < nss; i++) {
2100 			u8 ru_index_tmp = ru_index_bitmap << 1;
2101 			u8 bw;
2102 
2103 			for (bw = 0; bw < MAX_HE_CHANNEL_BW_INDX; bw++) {
2104 				ru_index_tmp >>= 1;
2105 				if (!(ru_index_tmp & 1))
2106 					continue;
2107 
2108 				sta_ctxt_cmd.pkt_ext.pkt_ext_qam_th[i][bw][1] =
2109 					iwl_mvm_he_get_ppe_val(ppe,
2110 							       ppe_pos_bit);
2111 				ppe_pos_bit +=
2112 					IEEE80211_PPE_THRES_INFO_PPET_SIZE;
2113 				sta_ctxt_cmd.pkt_ext.pkt_ext_qam_th[i][bw][0] =
2114 					iwl_mvm_he_get_ppe_val(ppe,
2115 							       ppe_pos_bit);
2116 				ppe_pos_bit +=
2117 					IEEE80211_PPE_THRES_INFO_PPET_SIZE;
2118 			}
2119 		}
2120 
2121 		flags |= STA_CTXT_HE_PACKET_EXT;
2122 	} else if ((sta->he_cap.he_cap_elem.phy_cap_info[9] &
2123 		    IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_MASK) !=
2124 		  IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_RESERVED) {
2125 		int low_th = -1;
2126 		int high_th = -1;
2127 
2128 		/* Take the PPE thresholds from the nominal padding info */
2129 		switch (sta->he_cap.he_cap_elem.phy_cap_info[9] &
2130 			IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_MASK) {
2131 		case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_0US:
2132 			low_th = IWL_HE_PKT_EXT_NONE;
2133 			high_th = IWL_HE_PKT_EXT_NONE;
2134 			break;
2135 		case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_8US:
2136 			low_th = IWL_HE_PKT_EXT_BPSK;
2137 			high_th = IWL_HE_PKT_EXT_NONE;
2138 			break;
2139 		case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_16US:
2140 			low_th = IWL_HE_PKT_EXT_NONE;
2141 			high_th = IWL_HE_PKT_EXT_BPSK;
2142 			break;
2143 		}
2144 
2145 		/* Set the PPE thresholds accordingly */
2146 		if (low_th >= 0 && high_th >= 0) {
2147 			struct iwl_he_pkt_ext *pkt_ext =
2148 				(struct iwl_he_pkt_ext *)&sta_ctxt_cmd.pkt_ext;
2149 
2150 			for (i = 0; i < MAX_HE_SUPP_NSS; i++) {
2151 				u8 bw;
2152 
2153 				for (bw = 0; bw < MAX_HE_CHANNEL_BW_INDX;
2154 				     bw++) {
2155 					pkt_ext->pkt_ext_qam_th[i][bw][0] =
2156 						low_th;
2157 					pkt_ext->pkt_ext_qam_th[i][bw][1] =
2158 						high_th;
2159 				}
2160 			}
2161 
2162 			flags |= STA_CTXT_HE_PACKET_EXT;
2163 		}
2164 	}
2165 	rcu_read_unlock();
2166 
2167 	/* Mark MU EDCA as enabled, unless none detected on some AC */
2168 	flags |= STA_CTXT_HE_MU_EDCA_CW;
2169 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
2170 		struct ieee80211_he_mu_edca_param_ac_rec *mu_edca =
2171 			&mvmvif->queue_params[i].mu_edca_param_rec;
2172 		u8 ac = iwl_mvm_mac80211_ac_to_ucode_ac(i);
2173 
2174 		if (!mvmvif->queue_params[i].mu_edca) {
2175 			flags &= ~STA_CTXT_HE_MU_EDCA_CW;
2176 			break;
2177 		}
2178 
2179 		sta_ctxt_cmd.trig_based_txf[ac].cwmin =
2180 			cpu_to_le16(mu_edca->ecw_min_max & 0xf);
2181 		sta_ctxt_cmd.trig_based_txf[ac].cwmax =
2182 			cpu_to_le16((mu_edca->ecw_min_max & 0xf0) >> 4);
2183 		sta_ctxt_cmd.trig_based_txf[ac].aifsn =
2184 			cpu_to_le16(mu_edca->aifsn);
2185 		sta_ctxt_cmd.trig_based_txf[ac].mu_time =
2186 			cpu_to_le16(mu_edca->mu_edca_timer);
2187 	}
2188 
2189 	if (vif->bss_conf.multi_sta_back_32bit)
2190 		flags |= STA_CTXT_HE_32BIT_BA_BITMAP;
2191 
2192 	if (vif->bss_conf.ack_enabled)
2193 		flags |= STA_CTXT_HE_ACK_ENABLED;
2194 
2195 	if (vif->bss_conf.uora_exists) {
2196 		flags |= STA_CTXT_HE_TRIG_RND_ALLOC;
2197 
2198 		sta_ctxt_cmd.rand_alloc_ecwmin =
2199 			vif->bss_conf.uora_ocw_range & 0x7;
2200 		sta_ctxt_cmd.rand_alloc_ecwmax =
2201 			(vif->bss_conf.uora_ocw_range >> 3) & 0x7;
2202 	}
2203 
2204 	if (vif->bss_conf.nontransmitted) {
2205 		flags |= STA_CTXT_HE_REF_BSSID_VALID;
2206 		ether_addr_copy(sta_ctxt_cmd.ref_bssid_addr,
2207 				vif->bss_conf.transmitter_bssid);
2208 		sta_ctxt_cmd.max_bssid_indicator =
2209 			vif->bss_conf.bssid_indicator;
2210 		sta_ctxt_cmd.bssid_index = vif->bss_conf.bssid_index;
2211 		sta_ctxt_cmd.ema_ap = vif->bss_conf.ema_ap;
2212 		sta_ctxt_cmd.profile_periodicity =
2213 			vif->bss_conf.profile_periodicity;
2214 	}
2215 
2216 	sta_ctxt_cmd.flags = cpu_to_le32(flags);
2217 
2218 	if (iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(STA_HE_CTXT_CMD,
2219 						 DATA_PATH_GROUP, 0),
2220 				 0, size, &sta_ctxt_cmd))
2221 		IWL_ERR(mvm, "Failed to config FW to work HE!\n");
2222 }
2223 
2224 static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
2225 					     struct ieee80211_vif *vif,
2226 					     struct ieee80211_bss_conf *bss_conf,
2227 					     u32 changes)
2228 {
2229 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2230 	int ret;
2231 
2232 	/*
2233 	 * Re-calculate the tsf id, as the master-slave relations depend on the
2234 	 * beacon interval, which was not known when the station interface was
2235 	 * added.
2236 	 */
2237 	if (changes & BSS_CHANGED_ASSOC && bss_conf->assoc) {
2238 		if (vif->bss_conf.he_support &&
2239 		    !iwlwifi_mod_params.disable_11ax)
2240 			iwl_mvm_cfg_he_sta(mvm, vif, mvmvif->ap_sta_id);
2241 
2242 		iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
2243 	}
2244 
2245 	/* Update MU EDCA params */
2246 	if (changes & BSS_CHANGED_QOS && mvmvif->associated &&
2247 	    bss_conf->assoc && vif->bss_conf.he_support &&
2248 	    !iwlwifi_mod_params.disable_11ax)
2249 		iwl_mvm_cfg_he_sta(mvm, vif, mvmvif->ap_sta_id);
2250 
2251 	/*
2252 	 * If we're not associated yet, take the (new) BSSID before associating
2253 	 * so the firmware knows. If we're already associated, then use the old
2254 	 * BSSID here, and we'll send a cleared one later in the CHANGED_ASSOC
2255 	 * branch for disassociation below.
2256 	 */
2257 	if (changes & BSS_CHANGED_BSSID && !mvmvif->associated)
2258 		memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
2259 
2260 	ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, mvmvif->bssid);
2261 	if (ret)
2262 		IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
2263 
2264 	/* after sending it once, adopt mac80211 data */
2265 	memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
2266 	mvmvif->associated = bss_conf->assoc;
2267 
2268 	if (changes & BSS_CHANGED_ASSOC) {
2269 		if (bss_conf->assoc) {
2270 			/* clear statistics to get clean beacon counter */
2271 			iwl_mvm_request_statistics(mvm, true);
2272 			memset(&mvmvif->beacon_stats, 0,
2273 			       sizeof(mvmvif->beacon_stats));
2274 
2275 			/* add quota for this interface */
2276 			ret = iwl_mvm_update_quotas(mvm, true, NULL);
2277 			if (ret) {
2278 				IWL_ERR(mvm, "failed to update quotas\n");
2279 				return;
2280 			}
2281 
2282 			if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
2283 				     &mvm->status)) {
2284 				/*
2285 				 * If we're restarting then the firmware will
2286 				 * obviously have lost synchronisation with
2287 				 * the AP. It will attempt to synchronise by
2288 				 * itself, but we can make it more reliable by
2289 				 * scheduling a session protection time event.
2290 				 *
2291 				 * The firmware needs to receive a beacon to
2292 				 * catch up with synchronisation, use 110% of
2293 				 * the beacon interval.
2294 				 *
2295 				 * Set a large maximum delay to allow for more
2296 				 * than a single interface.
2297 				 */
2298 				u32 dur = (11 * vif->bss_conf.beacon_int) / 10;
2299 				iwl_mvm_protect_session(mvm, vif, dur, dur,
2300 							5 * dur, false);
2301 			}
2302 
2303 			iwl_mvm_sf_update(mvm, vif, false);
2304 			iwl_mvm_power_vif_assoc(mvm, vif);
2305 			if (vif->p2p) {
2306 				iwl_mvm_update_smps(mvm, vif,
2307 						    IWL_MVM_SMPS_REQ_PROT,
2308 						    IEEE80211_SMPS_DYNAMIC);
2309 			}
2310 		} else if (mvmvif->ap_sta_id != IWL_MVM_INVALID_STA) {
2311 			/*
2312 			 * If update fails - SF might be running in associated
2313 			 * mode while disassociated - which is forbidden.
2314 			 */
2315 			ret = iwl_mvm_sf_update(mvm, vif, false);
2316 			WARN_ONCE(ret &&
2317 				  !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
2318 					    &mvm->status),
2319 				  "Failed to update SF upon disassociation\n");
2320 
2321 			/*
2322 			 * If we get an assert during the connection (after the
2323 			 * station has been added, but before the vif is set
2324 			 * to associated), mac80211 will re-add the station and
2325 			 * then configure the vif. Since the vif is not
2326 			 * associated, we would remove the station here and
2327 			 * this would fail the recovery.
2328 			 */
2329 			if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
2330 				      &mvm->status)) {
2331 				/*
2332 				 * Remove AP station now that
2333 				 * the MAC is unassoc
2334 				 */
2335 				ret = iwl_mvm_rm_sta_id(mvm, vif,
2336 							mvmvif->ap_sta_id);
2337 				if (ret)
2338 					IWL_ERR(mvm,
2339 						"failed to remove AP station\n");
2340 
2341 				mvmvif->ap_sta_id = IWL_MVM_INVALID_STA;
2342 			}
2343 
2344 			/* remove quota for this interface */
2345 			ret = iwl_mvm_update_quotas(mvm, false, NULL);
2346 			if (ret)
2347 				IWL_ERR(mvm, "failed to update quotas\n");
2348 
2349 			/* this will take the cleared BSSID from bss_conf */
2350 			ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
2351 			if (ret)
2352 				IWL_ERR(mvm,
2353 					"failed to update MAC %pM (clear after unassoc)\n",
2354 					vif->addr);
2355 		}
2356 
2357 		/*
2358 		 * The firmware tracks the MU-MIMO group on its own.
2359 		 * However, on HW restart we should restore this data.
2360 		 */
2361 		if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
2362 		    (changes & BSS_CHANGED_MU_GROUPS) && vif->mu_mimo_owner) {
2363 			ret = iwl_mvm_update_mu_groups(mvm, vif);
2364 			if (ret)
2365 				IWL_ERR(mvm,
2366 					"failed to update VHT MU_MIMO groups\n");
2367 		}
2368 
2369 		iwl_mvm_recalc_multicast(mvm);
2370 		iwl_mvm_configure_bcast_filter(mvm);
2371 
2372 		/* reset rssi values */
2373 		mvmvif->bf_data.ave_beacon_signal = 0;
2374 
2375 		iwl_mvm_bt_coex_vif_change(mvm);
2376 		iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_TT,
2377 				    IEEE80211_SMPS_AUTOMATIC);
2378 		if (fw_has_capa(&mvm->fw->ucode_capa,
2379 				IWL_UCODE_TLV_CAPA_UMAC_SCAN))
2380 			iwl_mvm_config_scan(mvm);
2381 	}
2382 
2383 	if (changes & BSS_CHANGED_BEACON_INFO) {
2384 		/*
2385 		 * We received a beacon from the associated AP so
2386 		 * remove the session protection.
2387 		 */
2388 		iwl_mvm_stop_session_protection(mvm, vif);
2389 
2390 		iwl_mvm_sf_update(mvm, vif, false);
2391 		WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
2392 	}
2393 
2394 	if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS | BSS_CHANGED_QOS |
2395 		       /*
2396 			* Send power command on every beacon change,
2397 			* because we may have not enabled beacon abort yet.
2398 			*/
2399 		       BSS_CHANGED_BEACON_INFO)) {
2400 		ret = iwl_mvm_power_update_mac(mvm);
2401 		if (ret)
2402 			IWL_ERR(mvm, "failed to update power mode\n");
2403 	}
2404 
2405 	if (changes & BSS_CHANGED_TXPOWER) {
2406 		IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2407 				bss_conf->txpower);
2408 		iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2409 	}
2410 
2411 	if (changes & BSS_CHANGED_CQM) {
2412 		IWL_DEBUG_MAC80211(mvm, "cqm info_changed\n");
2413 		/* reset cqm events tracking */
2414 		mvmvif->bf_data.last_cqm_event = 0;
2415 		if (mvmvif->bf_data.bf_enabled) {
2416 			ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
2417 			if (ret)
2418 				IWL_ERR(mvm,
2419 					"failed to update CQM thresholds\n");
2420 		}
2421 	}
2422 
2423 	if (changes & BSS_CHANGED_ARP_FILTER) {
2424 		IWL_DEBUG_MAC80211(mvm, "arp filter changed\n");
2425 		iwl_mvm_configure_bcast_filter(mvm);
2426 	}
2427 }
2428 
2429 static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
2430 				 struct ieee80211_vif *vif)
2431 {
2432 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2433 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2434 	int ret, i;
2435 
2436 	mutex_lock(&mvm->mutex);
2437 
2438 	/* Send the beacon template */
2439 	ret = iwl_mvm_mac_ctxt_beacon_changed(mvm, vif);
2440 	if (ret)
2441 		goto out_unlock;
2442 
2443 	/*
2444 	 * Re-calculate the tsf id, as the master-slave relations depend on the
2445 	 * beacon interval, which was not known when the AP interface was added.
2446 	 */
2447 	if (vif->type == NL80211_IFTYPE_AP)
2448 		iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
2449 
2450 	mvmvif->ap_assoc_sta_count = 0;
2451 
2452 	/* Add the mac context */
2453 	ret = iwl_mvm_mac_ctxt_add(mvm, vif);
2454 	if (ret)
2455 		goto out_unlock;
2456 
2457 	/* Perform the binding */
2458 	ret = iwl_mvm_binding_add_vif(mvm, vif);
2459 	if (ret)
2460 		goto out_remove;
2461 
2462 	/*
2463 	 * This is not very nice, but the simplest:
2464 	 * For older FWs adding the mcast sta before the bcast station may
2465 	 * cause assert 0x2b00.
2466 	 * This is fixed in later FW so make the order of removal depend on
2467 	 * the TLV
2468 	 */
2469 	if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE)) {
2470 		ret = iwl_mvm_add_mcast_sta(mvm, vif);
2471 		if (ret)
2472 			goto out_unbind;
2473 		/*
2474 		 * Send the bcast station. At this stage the TBTT and DTIM time
2475 		 * events are added and applied to the scheduler
2476 		 */
2477 		ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
2478 		if (ret) {
2479 			iwl_mvm_rm_mcast_sta(mvm, vif);
2480 			goto out_unbind;
2481 		}
2482 	} else {
2483 		/*
2484 		 * Send the bcast station. At this stage the TBTT and DTIM time
2485 		 * events are added and applied to the scheduler
2486 		 */
2487 		ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
2488 		if (ret)
2489 			goto out_unbind;
2490 		ret = iwl_mvm_add_mcast_sta(mvm, vif);
2491 		if (ret) {
2492 			iwl_mvm_send_rm_bcast_sta(mvm, vif);
2493 			goto out_unbind;
2494 		}
2495 	}
2496 
2497 	/* must be set before quota calculations */
2498 	mvmvif->ap_ibss_active = true;
2499 
2500 	/* send all the early keys to the device now */
2501 	for (i = 0; i < ARRAY_SIZE(mvmvif->ap_early_keys); i++) {
2502 		struct ieee80211_key_conf *key = mvmvif->ap_early_keys[i];
2503 
2504 		if (!key)
2505 			continue;
2506 
2507 		mvmvif->ap_early_keys[i] = NULL;
2508 
2509 		ret = __iwl_mvm_mac_set_key(hw, SET_KEY, vif, NULL, key);
2510 		if (ret)
2511 			goto out_quota_failed;
2512 	}
2513 
2514 	if (vif->type == NL80211_IFTYPE_AP && !vif->p2p) {
2515 		iwl_mvm_vif_set_low_latency(mvmvif, true,
2516 					    LOW_LATENCY_VIF_TYPE);
2517 		iwl_mvm_send_low_latency_cmd(mvm, true, mvmvif->id);
2518 	}
2519 
2520 	/* power updated needs to be done before quotas */
2521 	iwl_mvm_power_update_mac(mvm);
2522 
2523 	ret = iwl_mvm_update_quotas(mvm, false, NULL);
2524 	if (ret)
2525 		goto out_quota_failed;
2526 
2527 	/* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2528 	if (vif->p2p && mvm->p2p_device_vif)
2529 		iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2530 
2531 	iwl_mvm_bt_coex_vif_change(mvm);
2532 
2533 	/* we don't support TDLS during DCM */
2534 	if (iwl_mvm_phy_ctx_count(mvm) > 1)
2535 		iwl_mvm_teardown_tdls_peers(mvm);
2536 
2537 	iwl_mvm_ftm_restart_responder(mvm, vif);
2538 
2539 	goto out_unlock;
2540 
2541 out_quota_failed:
2542 	iwl_mvm_power_update_mac(mvm);
2543 	mvmvif->ap_ibss_active = false;
2544 	iwl_mvm_send_rm_bcast_sta(mvm, vif);
2545 	iwl_mvm_rm_mcast_sta(mvm, vif);
2546 out_unbind:
2547 	iwl_mvm_binding_remove_vif(mvm, vif);
2548 out_remove:
2549 	iwl_mvm_mac_ctxt_remove(mvm, vif);
2550 out_unlock:
2551 	mutex_unlock(&mvm->mutex);
2552 	return ret;
2553 }
2554 
2555 static void iwl_mvm_stop_ap_ibss(struct ieee80211_hw *hw,
2556 				 struct ieee80211_vif *vif)
2557 {
2558 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2559 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2560 
2561 	iwl_mvm_prepare_mac_removal(mvm, vif);
2562 
2563 	mutex_lock(&mvm->mutex);
2564 
2565 	/* Handle AP stop while in CSA */
2566 	if (rcu_access_pointer(mvm->csa_vif) == vif) {
2567 		iwl_mvm_remove_time_event(mvm, mvmvif,
2568 					  &mvmvif->time_event_data);
2569 		RCU_INIT_POINTER(mvm->csa_vif, NULL);
2570 		mvmvif->csa_countdown = false;
2571 	}
2572 
2573 	if (rcu_access_pointer(mvm->csa_tx_blocked_vif) == vif) {
2574 		RCU_INIT_POINTER(mvm->csa_tx_blocked_vif, NULL);
2575 		mvm->csa_tx_block_bcn_timeout = 0;
2576 	}
2577 
2578 	mvmvif->ap_ibss_active = false;
2579 	mvm->ap_last_beacon_gp2 = 0;
2580 
2581 	if (vif->type == NL80211_IFTYPE_AP && !vif->p2p) {
2582 		iwl_mvm_vif_set_low_latency(mvmvif, false,
2583 					    LOW_LATENCY_VIF_TYPE);
2584 		iwl_mvm_send_low_latency_cmd(mvm, false,  mvmvif->id);
2585 	}
2586 
2587 	iwl_mvm_bt_coex_vif_change(mvm);
2588 
2589 	/* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2590 	if (vif->p2p && mvm->p2p_device_vif)
2591 		iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2592 
2593 	iwl_mvm_update_quotas(mvm, false, NULL);
2594 
2595 	/*
2596 	 * This is not very nice, but the simplest:
2597 	 * For older FWs removing the mcast sta before the bcast station may
2598 	 * cause assert 0x2b00.
2599 	 * This is fixed in later FW (which will stop beaconing when removing
2600 	 * bcast station).
2601 	 * So make the order of removal depend on the TLV
2602 	 */
2603 	if (!fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE))
2604 		iwl_mvm_rm_mcast_sta(mvm, vif);
2605 	iwl_mvm_send_rm_bcast_sta(mvm, vif);
2606 	if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE))
2607 		iwl_mvm_rm_mcast_sta(mvm, vif);
2608 	iwl_mvm_binding_remove_vif(mvm, vif);
2609 
2610 	iwl_mvm_power_update_mac(mvm);
2611 
2612 	iwl_mvm_mac_ctxt_remove(mvm, vif);
2613 
2614 	mutex_unlock(&mvm->mutex);
2615 }
2616 
2617 static void
2618 iwl_mvm_bss_info_changed_ap_ibss(struct iwl_mvm *mvm,
2619 				 struct ieee80211_vif *vif,
2620 				 struct ieee80211_bss_conf *bss_conf,
2621 				 u32 changes)
2622 {
2623 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2624 
2625 	/* Changes will be applied when the AP/IBSS is started */
2626 	if (!mvmvif->ap_ibss_active)
2627 		return;
2628 
2629 	if (changes & (BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_HT |
2630 		       BSS_CHANGED_BANDWIDTH | BSS_CHANGED_QOS) &&
2631 	    iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL))
2632 		IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
2633 
2634 	/* Need to send a new beacon template to the FW */
2635 	if (changes & BSS_CHANGED_BEACON &&
2636 	    iwl_mvm_mac_ctxt_beacon_changed(mvm, vif))
2637 		IWL_WARN(mvm, "Failed updating beacon data\n");
2638 
2639 	if (changes & BSS_CHANGED_TXPOWER) {
2640 		IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2641 				bss_conf->txpower);
2642 		iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2643 	}
2644 
2645 	if (changes & BSS_CHANGED_FTM_RESPONDER) {
2646 		int ret = iwl_mvm_ftm_start_responder(mvm, vif);
2647 
2648 		if (ret)
2649 			IWL_WARN(mvm, "Failed to enable FTM responder (%d)\n",
2650 				 ret);
2651 	}
2652 
2653 }
2654 
2655 static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw,
2656 				     struct ieee80211_vif *vif,
2657 				     struct ieee80211_bss_conf *bss_conf,
2658 				     u32 changes)
2659 {
2660 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2661 
2662 	mutex_lock(&mvm->mutex);
2663 
2664 	if (changes & BSS_CHANGED_IDLE && !bss_conf->idle)
2665 		iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true);
2666 
2667 	switch (vif->type) {
2668 	case NL80211_IFTYPE_STATION:
2669 		iwl_mvm_bss_info_changed_station(mvm, vif, bss_conf, changes);
2670 		break;
2671 	case NL80211_IFTYPE_AP:
2672 	case NL80211_IFTYPE_ADHOC:
2673 		iwl_mvm_bss_info_changed_ap_ibss(mvm, vif, bss_conf, changes);
2674 		break;
2675 	case NL80211_IFTYPE_MONITOR:
2676 		if (changes & BSS_CHANGED_MU_GROUPS)
2677 			iwl_mvm_update_mu_groups(mvm, vif);
2678 		break;
2679 	default:
2680 		/* shouldn't happen */
2681 		WARN_ON_ONCE(1);
2682 	}
2683 
2684 	mutex_unlock(&mvm->mutex);
2685 }
2686 
2687 static int iwl_mvm_mac_hw_scan(struct ieee80211_hw *hw,
2688 			       struct ieee80211_vif *vif,
2689 			       struct ieee80211_scan_request *hw_req)
2690 {
2691 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2692 	int ret;
2693 
2694 	if (hw_req->req.n_channels == 0 ||
2695 	    hw_req->req.n_channels > mvm->fw->ucode_capa.n_scan_channels)
2696 		return -EINVAL;
2697 
2698 	mutex_lock(&mvm->mutex);
2699 	ret = iwl_mvm_reg_scan_start(mvm, vif, &hw_req->req, &hw_req->ies);
2700 	mutex_unlock(&mvm->mutex);
2701 
2702 	return ret;
2703 }
2704 
2705 static void iwl_mvm_mac_cancel_hw_scan(struct ieee80211_hw *hw,
2706 				       struct ieee80211_vif *vif)
2707 {
2708 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2709 
2710 	mutex_lock(&mvm->mutex);
2711 
2712 	/* Due to a race condition, it's possible that mac80211 asks
2713 	 * us to stop a hw_scan when it's already stopped.  This can
2714 	 * happen, for instance, if we stopped the scan ourselves,
2715 	 * called ieee80211_scan_completed() and the userspace called
2716 	 * cancel scan scan before ieee80211_scan_work() could run.
2717 	 * To handle that, simply return if the scan is not running.
2718 	*/
2719 	if (mvm->scan_status & IWL_MVM_SCAN_REGULAR)
2720 		iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true);
2721 
2722 	mutex_unlock(&mvm->mutex);
2723 }
2724 
2725 static void
2726 iwl_mvm_mac_allow_buffered_frames(struct ieee80211_hw *hw,
2727 				  struct ieee80211_sta *sta, u16 tids,
2728 				  int num_frames,
2729 				  enum ieee80211_frame_release_type reason,
2730 				  bool more_data)
2731 {
2732 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2733 
2734 	/* Called when we need to transmit (a) frame(s) from mac80211 */
2735 
2736 	iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2737 					  tids, more_data, false);
2738 }
2739 
2740 static void
2741 iwl_mvm_mac_release_buffered_frames(struct ieee80211_hw *hw,
2742 				    struct ieee80211_sta *sta, u16 tids,
2743 				    int num_frames,
2744 				    enum ieee80211_frame_release_type reason,
2745 				    bool more_data)
2746 {
2747 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2748 
2749 	/* Called when we need to transmit (a) frame(s) from agg or dqa queue */
2750 
2751 	iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2752 					  tids, more_data, true);
2753 }
2754 
2755 static void __iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
2756 				     enum sta_notify_cmd cmd,
2757 				     struct ieee80211_sta *sta)
2758 {
2759 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2760 	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
2761 	unsigned long txqs = 0, tids = 0;
2762 	int tid;
2763 
2764 	/*
2765 	 * If we have TVQM then we get too high queue numbers - luckily
2766 	 * we really shouldn't get here with that because such hardware
2767 	 * should have firmware supporting buffer station offload.
2768 	 */
2769 	if (WARN_ON(iwl_mvm_has_new_tx_api(mvm)))
2770 		return;
2771 
2772 	spin_lock_bh(&mvmsta->lock);
2773 	for (tid = 0; tid < ARRAY_SIZE(mvmsta->tid_data); tid++) {
2774 		struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
2775 
2776 		if (tid_data->txq_id == IWL_MVM_INVALID_QUEUE)
2777 			continue;
2778 
2779 		__set_bit(tid_data->txq_id, &txqs);
2780 
2781 		if (iwl_mvm_tid_queued(mvm, tid_data) == 0)
2782 			continue;
2783 
2784 		__set_bit(tid, &tids);
2785 	}
2786 
2787 	switch (cmd) {
2788 	case STA_NOTIFY_SLEEP:
2789 		for_each_set_bit(tid, &tids, IWL_MAX_TID_COUNT)
2790 			ieee80211_sta_set_buffered(sta, tid, true);
2791 
2792 		if (txqs)
2793 			iwl_trans_freeze_txq_timer(mvm->trans, txqs, true);
2794 		/*
2795 		 * The fw updates the STA to be asleep. Tx packets on the Tx
2796 		 * queues to this station will not be transmitted. The fw will
2797 		 * send a Tx response with TX_STATUS_FAIL_DEST_PS.
2798 		 */
2799 		break;
2800 	case STA_NOTIFY_AWAKE:
2801 		if (WARN_ON(mvmsta->sta_id == IWL_MVM_INVALID_STA))
2802 			break;
2803 
2804 		if (txqs)
2805 			iwl_trans_freeze_txq_timer(mvm->trans, txqs, false);
2806 		iwl_mvm_sta_modify_ps_wake(mvm, sta);
2807 		break;
2808 	default:
2809 		break;
2810 	}
2811 	spin_unlock_bh(&mvmsta->lock);
2812 }
2813 
2814 static void iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
2815 				   struct ieee80211_vif *vif,
2816 				   enum sta_notify_cmd cmd,
2817 				   struct ieee80211_sta *sta)
2818 {
2819 	__iwl_mvm_mac_sta_notify(hw, cmd, sta);
2820 }
2821 
2822 void iwl_mvm_sta_pm_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
2823 {
2824 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
2825 	struct iwl_mvm_pm_state_notification *notif = (void *)pkt->data;
2826 	struct ieee80211_sta *sta;
2827 	struct iwl_mvm_sta *mvmsta;
2828 	bool sleeping = (notif->type != IWL_MVM_PM_EVENT_AWAKE);
2829 
2830 	if (WARN_ON(notif->sta_id >= ARRAY_SIZE(mvm->fw_id_to_mac_id)))
2831 		return;
2832 
2833 	rcu_read_lock();
2834 	sta = rcu_dereference(mvm->fw_id_to_mac_id[notif->sta_id]);
2835 	if (WARN_ON(IS_ERR_OR_NULL(sta))) {
2836 		rcu_read_unlock();
2837 		return;
2838 	}
2839 
2840 	mvmsta = iwl_mvm_sta_from_mac80211(sta);
2841 
2842 	if (!mvmsta->vif ||
2843 	    mvmsta->vif->type != NL80211_IFTYPE_AP) {
2844 		rcu_read_unlock();
2845 		return;
2846 	}
2847 
2848 	if (mvmsta->sleeping != sleeping) {
2849 		mvmsta->sleeping = sleeping;
2850 		__iwl_mvm_mac_sta_notify(mvm->hw,
2851 			sleeping ? STA_NOTIFY_SLEEP : STA_NOTIFY_AWAKE,
2852 			sta);
2853 		ieee80211_sta_ps_transition(sta, sleeping);
2854 	}
2855 
2856 	if (sleeping) {
2857 		switch (notif->type) {
2858 		case IWL_MVM_PM_EVENT_AWAKE:
2859 		case IWL_MVM_PM_EVENT_ASLEEP:
2860 			break;
2861 		case IWL_MVM_PM_EVENT_UAPSD:
2862 			ieee80211_sta_uapsd_trigger(sta, IEEE80211_NUM_TIDS);
2863 			break;
2864 		case IWL_MVM_PM_EVENT_PS_POLL:
2865 			ieee80211_sta_pspoll(sta);
2866 			break;
2867 		default:
2868 			break;
2869 		}
2870 	}
2871 
2872 	rcu_read_unlock();
2873 }
2874 
2875 static void iwl_mvm_sta_pre_rcu_remove(struct ieee80211_hw *hw,
2876 				       struct ieee80211_vif *vif,
2877 				       struct ieee80211_sta *sta)
2878 {
2879 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2880 	struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
2881 
2882 	/*
2883 	 * This is called before mac80211 does RCU synchronisation,
2884 	 * so here we already invalidate our internal RCU-protected
2885 	 * station pointer. The rest of the code will thus no longer
2886 	 * be able to find the station this way, and we don't rely
2887 	 * on further RCU synchronisation after the sta_state()
2888 	 * callback deleted the station.
2889 	 */
2890 	mutex_lock(&mvm->mutex);
2891 	if (sta == rcu_access_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id]))
2892 		rcu_assign_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id],
2893 				   ERR_PTR(-ENOENT));
2894 
2895 	mutex_unlock(&mvm->mutex);
2896 }
2897 
2898 static void iwl_mvm_check_uapsd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
2899 				const u8 *bssid)
2900 {
2901 	int i;
2902 
2903 	if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
2904 		struct iwl_mvm_tcm_mac *mdata;
2905 
2906 		mdata = &mvm->tcm.data[iwl_mvm_vif_from_mac80211(vif)->id];
2907 		ewma_rate_init(&mdata->uapsd_nonagg_detect.rate);
2908 		mdata->opened_rx_ba_sessions = false;
2909 	}
2910 
2911 	if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT))
2912 		return;
2913 
2914 	if (vif->p2p && !iwl_mvm_is_p2p_scm_uapsd_supported(mvm)) {
2915 		vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2916 		return;
2917 	}
2918 
2919 	if (!vif->p2p &&
2920 	    (iwlwifi_mod_params.uapsd_disable & IWL_DISABLE_UAPSD_BSS)) {
2921 		vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2922 		return;
2923 	}
2924 
2925 	for (i = 0; i < IWL_MVM_UAPSD_NOAGG_LIST_LEN; i++) {
2926 		if (ether_addr_equal(mvm->uapsd_noagg_bssids[i].addr, bssid)) {
2927 			vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2928 			return;
2929 		}
2930 	}
2931 
2932 	vif->driver_flags |= IEEE80211_VIF_SUPPORTS_UAPSD;
2933 }
2934 
2935 static void
2936 iwl_mvm_tdls_check_trigger(struct iwl_mvm *mvm,
2937 			   struct ieee80211_vif *vif, u8 *peer_addr,
2938 			   enum nl80211_tdls_operation action)
2939 {
2940 	struct iwl_fw_dbg_trigger_tlv *trig;
2941 	struct iwl_fw_dbg_trigger_tdls *tdls_trig;
2942 
2943 	trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
2944 				     FW_DBG_TRIGGER_TDLS);
2945 	if (!trig)
2946 		return;
2947 
2948 	tdls_trig = (void *)trig->data;
2949 
2950 	if (!(tdls_trig->action_bitmap & BIT(action)))
2951 		return;
2952 
2953 	if (tdls_trig->peer_mode &&
2954 	    memcmp(tdls_trig->peer, peer_addr, ETH_ALEN) != 0)
2955 		return;
2956 
2957 	iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
2958 				"TDLS event occurred, peer %pM, action %d",
2959 				peer_addr, action);
2960 }
2961 
2962 struct iwl_mvm_he_obss_narrow_bw_ru_data {
2963 	bool tolerated;
2964 };
2965 
2966 static void iwl_mvm_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
2967 						    struct cfg80211_bss *bss,
2968 						    void *_data)
2969 {
2970 	struct iwl_mvm_he_obss_narrow_bw_ru_data *data = _data;
2971 	const struct element *elem;
2972 
2973 	elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY, bss->ies->data,
2974 				  bss->ies->len);
2975 
2976 	if (!elem || elem->datalen < 10 ||
2977 	    !(elem->data[10] &
2978 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT)) {
2979 		data->tolerated = false;
2980 	}
2981 }
2982 
2983 static void iwl_mvm_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
2984 					       struct ieee80211_vif *vif)
2985 {
2986 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2987 	struct iwl_mvm_he_obss_narrow_bw_ru_data iter_data = {
2988 		.tolerated = true,
2989 	};
2990 
2991 	if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR)) {
2992 		mvmvif->he_ru_2mhz_block = false;
2993 		return;
2994 	}
2995 
2996 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
2997 			  iwl_mvm_check_he_obss_narrow_bw_ru_iter,
2998 			  &iter_data);
2999 
3000 	/*
3001 	 * If there is at least one AP on radar channel that cannot
3002 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
3003 	 */
3004 	mvmvif->he_ru_2mhz_block = !iter_data.tolerated;
3005 }
3006 
3007 static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
3008 				 struct ieee80211_vif *vif,
3009 				 struct ieee80211_sta *sta,
3010 				 enum ieee80211_sta_state old_state,
3011 				 enum ieee80211_sta_state new_state)
3012 {
3013 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3014 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3015 	struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
3016 	int ret;
3017 
3018 	IWL_DEBUG_MAC80211(mvm, "station %pM state change %d->%d\n",
3019 			   sta->addr, old_state, new_state);
3020 
3021 	/* this would be a mac80211 bug ... but don't crash */
3022 	if (WARN_ON_ONCE(!mvmvif->phy_ctxt))
3023 		return -EINVAL;
3024 
3025 	/*
3026 	 * If we are in a STA removal flow and in DQA mode:
3027 	 *
3028 	 * This is after the sync_rcu part, so the queues have already been
3029 	 * flushed. No more TXs on their way in mac80211's path, and no more in
3030 	 * the queues.
3031 	 * Also, we won't be getting any new TX frames for this station.
3032 	 * What we might have are deferred TX frames that need to be taken care
3033 	 * of.
3034 	 *
3035 	 * Drop any still-queued deferred-frame before removing the STA, and
3036 	 * make sure the worker is no longer handling frames for this STA.
3037 	 */
3038 	if (old_state == IEEE80211_STA_NONE &&
3039 	    new_state == IEEE80211_STA_NOTEXIST) {
3040 		flush_work(&mvm->add_stream_wk);
3041 
3042 		/*
3043 		 * No need to make sure deferred TX indication is off since the
3044 		 * worker will already remove it if it was on
3045 		 */
3046 	}
3047 
3048 	mutex_lock(&mvm->mutex);
3049 	/* track whether or not the station is associated */
3050 	mvm_sta->sta_state = new_state;
3051 
3052 	if (old_state == IEEE80211_STA_NOTEXIST &&
3053 	    new_state == IEEE80211_STA_NONE) {
3054 		/*
3055 		 * Firmware bug - it'll crash if the beacon interval is less
3056 		 * than 16. We can't avoid connecting at all, so refuse the
3057 		 * station state change, this will cause mac80211 to abandon
3058 		 * attempts to connect to this AP, and eventually wpa_s will
3059 		 * blacklist the AP...
3060 		 */
3061 		if (vif->type == NL80211_IFTYPE_STATION &&
3062 		    vif->bss_conf.beacon_int < 16) {
3063 			IWL_ERR(mvm,
3064 				"AP %pM beacon interval is %d, refusing due to firmware bug!\n",
3065 				sta->addr, vif->bss_conf.beacon_int);
3066 			ret = -EINVAL;
3067 			goto out_unlock;
3068 		}
3069 
3070 		if (sta->tdls &&
3071 		    (vif->p2p ||
3072 		     iwl_mvm_tdls_sta_count(mvm, NULL) ==
3073 						IWL_MVM_TDLS_STA_COUNT ||
3074 		     iwl_mvm_phy_ctx_count(mvm) > 1)) {
3075 			IWL_DEBUG_MAC80211(mvm, "refusing TDLS sta\n");
3076 			ret = -EBUSY;
3077 			goto out_unlock;
3078 		}
3079 
3080 		ret = iwl_mvm_add_sta(mvm, vif, sta);
3081 		if (sta->tdls && ret == 0) {
3082 			iwl_mvm_recalc_tdls_state(mvm, vif, true);
3083 			iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3084 						   NL80211_TDLS_SETUP);
3085 		}
3086 
3087 		sta->max_rc_amsdu_len = 1;
3088 	} else if (old_state == IEEE80211_STA_NONE &&
3089 		   new_state == IEEE80211_STA_AUTH) {
3090 		/*
3091 		 * EBS may be disabled due to previous failures reported by FW.
3092 		 * Reset EBS status here assuming environment has been changed.
3093 		 */
3094 		mvm->last_ebs_successful = true;
3095 		iwl_mvm_check_uapsd(mvm, vif, sta->addr);
3096 		ret = 0;
3097 	} else if (old_state == IEEE80211_STA_AUTH &&
3098 		   new_state == IEEE80211_STA_ASSOC) {
3099 		if (vif->type == NL80211_IFTYPE_AP) {
3100 			vif->bss_conf.he_support = sta->he_cap.has_he;
3101 			mvmvif->ap_assoc_sta_count++;
3102 			iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3103 			if (vif->bss_conf.he_support &&
3104 			    !iwlwifi_mod_params.disable_11ax)
3105 				iwl_mvm_cfg_he_sta(mvm, vif, mvm_sta->sta_id);
3106 		} else if (vif->type == NL80211_IFTYPE_STATION) {
3107 			vif->bss_conf.he_support = sta->he_cap.has_he;
3108 
3109 			mvmvif->he_ru_2mhz_block = false;
3110 			if (sta->he_cap.has_he)
3111 				iwl_mvm_check_he_obss_narrow_bw_ru(hw, vif);
3112 
3113 			iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3114 		}
3115 
3116 		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3117 				     false);
3118 		ret = iwl_mvm_update_sta(mvm, vif, sta);
3119 	} else if (old_state == IEEE80211_STA_ASSOC &&
3120 		   new_state == IEEE80211_STA_AUTHORIZED) {
3121 		ret = 0;
3122 
3123 		/* we don't support TDLS during DCM */
3124 		if (iwl_mvm_phy_ctx_count(mvm) > 1)
3125 			iwl_mvm_teardown_tdls_peers(mvm);
3126 
3127 		if (sta->tdls)
3128 			iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3129 						   NL80211_TDLS_ENABLE_LINK);
3130 
3131 		/* enable beacon filtering */
3132 		WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
3133 
3134 		/*
3135 		 * Now that the station is authorized, i.e., keys were already
3136 		 * installed, need to indicate to the FW that
3137 		 * multicast data frames can be forwarded to the driver
3138 		 */
3139 		iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3140 
3141 		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3142 				     true);
3143 	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
3144 		   new_state == IEEE80211_STA_ASSOC) {
3145 		/* Multicast data frames are no longer allowed */
3146 		iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3147 
3148 		/* disable beacon filtering */
3149 		ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
3150 		WARN_ON(ret &&
3151 			!test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
3152 				  &mvm->status));
3153 		ret = 0;
3154 	} else if (old_state == IEEE80211_STA_ASSOC &&
3155 		   new_state == IEEE80211_STA_AUTH) {
3156 		if (vif->type == NL80211_IFTYPE_AP) {
3157 			mvmvif->ap_assoc_sta_count--;
3158 			iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3159 		}
3160 		ret = 0;
3161 	} else if (old_state == IEEE80211_STA_AUTH &&
3162 		   new_state == IEEE80211_STA_NONE) {
3163 		ret = 0;
3164 	} else if (old_state == IEEE80211_STA_NONE &&
3165 		   new_state == IEEE80211_STA_NOTEXIST) {
3166 		ret = iwl_mvm_rm_sta(mvm, vif, sta);
3167 		if (sta->tdls) {
3168 			iwl_mvm_recalc_tdls_state(mvm, vif, false);
3169 			iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3170 						   NL80211_TDLS_DISABLE_LINK);
3171 		}
3172 
3173 		if (unlikely(ret &&
3174 			     test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
3175 				      &mvm->status)))
3176 			ret = 0;
3177 	} else {
3178 		ret = -EIO;
3179 	}
3180  out_unlock:
3181 	mutex_unlock(&mvm->mutex);
3182 
3183 	if (sta->tdls && ret == 0) {
3184 		if (old_state == IEEE80211_STA_NOTEXIST &&
3185 		    new_state == IEEE80211_STA_NONE)
3186 			ieee80211_reserve_tid(sta, IWL_MVM_TDLS_FW_TID);
3187 		else if (old_state == IEEE80211_STA_NONE &&
3188 			 new_state == IEEE80211_STA_NOTEXIST)
3189 			ieee80211_unreserve_tid(sta, IWL_MVM_TDLS_FW_TID);
3190 	}
3191 
3192 	return ret;
3193 }
3194 
3195 static int iwl_mvm_mac_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
3196 {
3197 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3198 
3199 	mvm->rts_threshold = value;
3200 
3201 	return 0;
3202 }
3203 
3204 static void iwl_mvm_sta_rc_update(struct ieee80211_hw *hw,
3205 				  struct ieee80211_vif *vif,
3206 				  struct ieee80211_sta *sta, u32 changed)
3207 {
3208 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3209 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3210 
3211 	if (changed & (IEEE80211_RC_BW_CHANGED |
3212 		       IEEE80211_RC_SUPP_RATES_CHANGED |
3213 		       IEEE80211_RC_NSS_CHANGED))
3214 		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3215 				     true);
3216 
3217 	if (vif->type == NL80211_IFTYPE_STATION &&
3218 	    changed & IEEE80211_RC_NSS_CHANGED)
3219 		iwl_mvm_sf_update(mvm, vif, false);
3220 }
3221 
3222 static int iwl_mvm_mac_conf_tx(struct ieee80211_hw *hw,
3223 			       struct ieee80211_vif *vif, u16 ac,
3224 			       const struct ieee80211_tx_queue_params *params)
3225 {
3226 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3227 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3228 
3229 	mvmvif->queue_params[ac] = *params;
3230 
3231 	/*
3232 	 * No need to update right away, we'll get BSS_CHANGED_QOS
3233 	 * The exception is P2P_DEVICE interface which needs immediate update.
3234 	 */
3235 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
3236 		int ret;
3237 
3238 		mutex_lock(&mvm->mutex);
3239 		ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3240 		mutex_unlock(&mvm->mutex);
3241 		return ret;
3242 	}
3243 	return 0;
3244 }
3245 
3246 static void iwl_mvm_mac_mgd_prepare_tx(struct ieee80211_hw *hw,
3247 				       struct ieee80211_vif *vif,
3248 				       u16 req_duration)
3249 {
3250 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3251 	u32 duration = IWL_MVM_TE_SESSION_PROTECTION_MAX_TIME_MS;
3252 	u32 min_duration = IWL_MVM_TE_SESSION_PROTECTION_MIN_TIME_MS;
3253 
3254 	if (req_duration > duration)
3255 		duration = req_duration;
3256 
3257 	mutex_lock(&mvm->mutex);
3258 	/* Try really hard to protect the session and hear a beacon */
3259 	iwl_mvm_protect_session(mvm, vif, duration, min_duration, 500, false);
3260 	mutex_unlock(&mvm->mutex);
3261 }
3262 
3263 static int iwl_mvm_mac_sched_scan_start(struct ieee80211_hw *hw,
3264 					struct ieee80211_vif *vif,
3265 					struct cfg80211_sched_scan_request *req,
3266 					struct ieee80211_scan_ies *ies)
3267 {
3268 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3269 
3270 	int ret;
3271 
3272 	mutex_lock(&mvm->mutex);
3273 
3274 	if (!vif->bss_conf.idle) {
3275 		ret = -EBUSY;
3276 		goto out;
3277 	}
3278 
3279 	ret = iwl_mvm_sched_scan_start(mvm, vif, req, ies, IWL_MVM_SCAN_SCHED);
3280 
3281 out:
3282 	mutex_unlock(&mvm->mutex);
3283 	return ret;
3284 }
3285 
3286 static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
3287 				       struct ieee80211_vif *vif)
3288 {
3289 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3290 	int ret;
3291 
3292 	mutex_lock(&mvm->mutex);
3293 
3294 	/* Due to a race condition, it's possible that mac80211 asks
3295 	 * us to stop a sched_scan when it's already stopped.  This
3296 	 * can happen, for instance, if we stopped the scan ourselves,
3297 	 * called ieee80211_sched_scan_stopped() and the userspace called
3298 	 * stop sched scan scan before ieee80211_sched_scan_stopped_work()
3299 	 * could run.  To handle this, simply return if the scan is
3300 	 * not running.
3301 	*/
3302 	if (!(mvm->scan_status & IWL_MVM_SCAN_SCHED)) {
3303 		mutex_unlock(&mvm->mutex);
3304 		return 0;
3305 	}
3306 
3307 	ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, false);
3308 	mutex_unlock(&mvm->mutex);
3309 	iwl_mvm_wait_for_async_handlers(mvm);
3310 
3311 	return ret;
3312 }
3313 
3314 static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
3315 				 enum set_key_cmd cmd,
3316 				 struct ieee80211_vif *vif,
3317 				 struct ieee80211_sta *sta,
3318 				 struct ieee80211_key_conf *key)
3319 {
3320 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3321 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3322 	struct iwl_mvm_sta *mvmsta;
3323 	struct iwl_mvm_key_pn *ptk_pn;
3324 	int keyidx = key->keyidx;
3325 	int ret, i;
3326 	u8 key_offset;
3327 
3328 	if (iwlwifi_mod_params.swcrypto) {
3329 		IWL_DEBUG_MAC80211(mvm, "leave - hwcrypto disabled\n");
3330 		return -EOPNOTSUPP;
3331 	}
3332 
3333 	switch (key->cipher) {
3334 	case WLAN_CIPHER_SUITE_TKIP:
3335 		if (!mvm->trans->trans_cfg->gen2) {
3336 			key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3337 			key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3338 		} else if (vif->type == NL80211_IFTYPE_STATION) {
3339 			key->flags |= IEEE80211_KEY_FLAG_PUT_MIC_SPACE;
3340 		} else {
3341 			IWL_DEBUG_MAC80211(mvm, "Use SW encryption for TKIP\n");
3342 			return -EOPNOTSUPP;
3343 		}
3344 		break;
3345 	case WLAN_CIPHER_SUITE_CCMP:
3346 	case WLAN_CIPHER_SUITE_GCMP:
3347 	case WLAN_CIPHER_SUITE_GCMP_256:
3348 		if (!iwl_mvm_has_new_tx_api(mvm))
3349 			key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3350 		break;
3351 	case WLAN_CIPHER_SUITE_AES_CMAC:
3352 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
3353 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
3354 		WARN_ON_ONCE(!ieee80211_hw_check(hw, MFP_CAPABLE));
3355 		break;
3356 	case WLAN_CIPHER_SUITE_WEP40:
3357 	case WLAN_CIPHER_SUITE_WEP104:
3358 		if (vif->type == NL80211_IFTYPE_STATION)
3359 			break;
3360 		if (iwl_mvm_has_new_tx_api(mvm))
3361 			return -EOPNOTSUPP;
3362 		/* support HW crypto on TX */
3363 		return 0;
3364 	default:
3365 		/* currently FW supports only one optional cipher scheme */
3366 		if (hw->n_cipher_schemes &&
3367 		    hw->cipher_schemes->cipher == key->cipher)
3368 			key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3369 		else
3370 			return -EOPNOTSUPP;
3371 	}
3372 
3373 	switch (cmd) {
3374 	case SET_KEY:
3375 		if ((vif->type == NL80211_IFTYPE_ADHOC ||
3376 		     vif->type == NL80211_IFTYPE_AP) && !sta) {
3377 			/*
3378 			 * GTK on AP interface is a TX-only key, return 0;
3379 			 * on IBSS they're per-station and because we're lazy
3380 			 * we don't support them for RX, so do the same.
3381 			 * CMAC/GMAC in AP/IBSS modes must be done in software.
3382 			 */
3383 			if (key->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
3384 			    key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
3385 			    key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256)
3386 				ret = -EOPNOTSUPP;
3387 			else
3388 				ret = 0;
3389 
3390 			if (key->cipher != WLAN_CIPHER_SUITE_GCMP &&
3391 			    key->cipher != WLAN_CIPHER_SUITE_GCMP_256 &&
3392 			    !iwl_mvm_has_new_tx_api(mvm)) {
3393 				key->hw_key_idx = STA_KEY_IDX_INVALID;
3394 				break;
3395 			}
3396 
3397 			if (!mvmvif->ap_ibss_active) {
3398 				for (i = 0;
3399 				     i < ARRAY_SIZE(mvmvif->ap_early_keys);
3400 				     i++) {
3401 					if (!mvmvif->ap_early_keys[i]) {
3402 						mvmvif->ap_early_keys[i] = key;
3403 						break;
3404 					}
3405 				}
3406 
3407 				if (i >= ARRAY_SIZE(mvmvif->ap_early_keys))
3408 					ret = -ENOSPC;
3409 
3410 				break;
3411 			}
3412 		}
3413 
3414 		/* During FW restart, in order to restore the state as it was,
3415 		 * don't try to reprogram keys we previously failed for.
3416 		 */
3417 		if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
3418 		    key->hw_key_idx == STA_KEY_IDX_INVALID) {
3419 			IWL_DEBUG_MAC80211(mvm,
3420 					   "skip invalid idx key programming during restart\n");
3421 			ret = 0;
3422 			break;
3423 		}
3424 
3425 		if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
3426 		    sta && iwl_mvm_has_new_rx_api(mvm) &&
3427 		    key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
3428 		    (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
3429 		     key->cipher == WLAN_CIPHER_SUITE_GCMP ||
3430 		     key->cipher == WLAN_CIPHER_SUITE_GCMP_256)) {
3431 			struct ieee80211_key_seq seq;
3432 			int tid, q;
3433 
3434 			mvmsta = iwl_mvm_sta_from_mac80211(sta);
3435 			WARN_ON(rcu_access_pointer(mvmsta->ptk_pn[keyidx]));
3436 			ptk_pn = kzalloc(struct_size(ptk_pn, q,
3437 						     mvm->trans->num_rx_queues),
3438 					 GFP_KERNEL);
3439 			if (!ptk_pn) {
3440 				ret = -ENOMEM;
3441 				break;
3442 			}
3443 
3444 			for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++) {
3445 				ieee80211_get_key_rx_seq(key, tid, &seq);
3446 				for (q = 0; q < mvm->trans->num_rx_queues; q++)
3447 					memcpy(ptk_pn->q[q].pn[tid],
3448 					       seq.ccmp.pn,
3449 					       IEEE80211_CCMP_PN_LEN);
3450 			}
3451 
3452 			rcu_assign_pointer(mvmsta->ptk_pn[keyidx], ptk_pn);
3453 		}
3454 
3455 		/* in HW restart reuse the index, otherwise request a new one */
3456 		if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
3457 			key_offset = key->hw_key_idx;
3458 		else
3459 			key_offset = STA_KEY_IDX_INVALID;
3460 
3461 		IWL_DEBUG_MAC80211(mvm, "set hwcrypto key\n");
3462 		ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, key_offset);
3463 		if (ret) {
3464 			IWL_WARN(mvm, "set key failed\n");
3465 			key->hw_key_idx = STA_KEY_IDX_INVALID;
3466 			/*
3467 			 * can't add key for RX, but we don't need it
3468 			 * in the device for TX so still return 0,
3469 			 * unless we have new TX API where we cannot
3470 			 * put key material into the TX_CMD
3471 			 */
3472 			if (iwl_mvm_has_new_tx_api(mvm))
3473 				ret = -EOPNOTSUPP;
3474 			else
3475 				ret = 0;
3476 		}
3477 
3478 		break;
3479 	case DISABLE_KEY:
3480 		ret = -ENOENT;
3481 		for (i = 0; i < ARRAY_SIZE(mvmvif->ap_early_keys); i++) {
3482 			if (mvmvif->ap_early_keys[i] == key) {
3483 				mvmvif->ap_early_keys[i] = NULL;
3484 				ret = 0;
3485 			}
3486 		}
3487 
3488 		/* found in pending list - don't do anything else */
3489 		if (ret == 0)
3490 			break;
3491 
3492 		if (key->hw_key_idx == STA_KEY_IDX_INVALID) {
3493 			ret = 0;
3494 			break;
3495 		}
3496 
3497 		if (sta && iwl_mvm_has_new_rx_api(mvm) &&
3498 		    key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
3499 		    (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
3500 		     key->cipher == WLAN_CIPHER_SUITE_GCMP ||
3501 		     key->cipher == WLAN_CIPHER_SUITE_GCMP_256)) {
3502 			mvmsta = iwl_mvm_sta_from_mac80211(sta);
3503 			ptk_pn = rcu_dereference_protected(
3504 						mvmsta->ptk_pn[keyidx],
3505 						lockdep_is_held(&mvm->mutex));
3506 			RCU_INIT_POINTER(mvmsta->ptk_pn[keyidx], NULL);
3507 			if (ptk_pn)
3508 				kfree_rcu(ptk_pn, rcu_head);
3509 		}
3510 
3511 		IWL_DEBUG_MAC80211(mvm, "disable hwcrypto key\n");
3512 		ret = iwl_mvm_remove_sta_key(mvm, vif, sta, key);
3513 		break;
3514 	default:
3515 		ret = -EINVAL;
3516 	}
3517 
3518 	return ret;
3519 }
3520 
3521 static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
3522 			       enum set_key_cmd cmd,
3523 			       struct ieee80211_vif *vif,
3524 			       struct ieee80211_sta *sta,
3525 			       struct ieee80211_key_conf *key)
3526 {
3527 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3528 	int ret;
3529 
3530 	mutex_lock(&mvm->mutex);
3531 	ret = __iwl_mvm_mac_set_key(hw, cmd, vif, sta, key);
3532 	mutex_unlock(&mvm->mutex);
3533 
3534 	return ret;
3535 }
3536 
3537 static void iwl_mvm_mac_update_tkip_key(struct ieee80211_hw *hw,
3538 					struct ieee80211_vif *vif,
3539 					struct ieee80211_key_conf *keyconf,
3540 					struct ieee80211_sta *sta,
3541 					u32 iv32, u16 *phase1key)
3542 {
3543 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3544 
3545 	if (keyconf->hw_key_idx == STA_KEY_IDX_INVALID)
3546 		return;
3547 
3548 	iwl_mvm_update_tkip_key(mvm, vif, keyconf, sta, iv32, phase1key);
3549 }
3550 
3551 
3552 static bool iwl_mvm_rx_aux_roc(struct iwl_notif_wait_data *notif_wait,
3553 			       struct iwl_rx_packet *pkt, void *data)
3554 {
3555 	struct iwl_mvm *mvm =
3556 		container_of(notif_wait, struct iwl_mvm, notif_wait);
3557 	struct iwl_hs20_roc_res *resp;
3558 	int resp_len = iwl_rx_packet_payload_len(pkt);
3559 	struct iwl_mvm_time_event_data *te_data = data;
3560 
3561 	if (WARN_ON(pkt->hdr.cmd != HOT_SPOT_CMD))
3562 		return true;
3563 
3564 	if (WARN_ON_ONCE(resp_len != sizeof(*resp))) {
3565 		IWL_ERR(mvm, "Invalid HOT_SPOT_CMD response\n");
3566 		return true;
3567 	}
3568 
3569 	resp = (void *)pkt->data;
3570 
3571 	IWL_DEBUG_TE(mvm,
3572 		     "Aux ROC: Received response from ucode: status=%d uid=%d\n",
3573 		     resp->status, resp->event_unique_id);
3574 
3575 	te_data->uid = le32_to_cpu(resp->event_unique_id);
3576 	IWL_DEBUG_TE(mvm, "TIME_EVENT_CMD response - UID = 0x%x\n",
3577 		     te_data->uid);
3578 
3579 	spin_lock_bh(&mvm->time_event_lock);
3580 	list_add_tail(&te_data->list, &mvm->aux_roc_te_list);
3581 	spin_unlock_bh(&mvm->time_event_lock);
3582 
3583 	return true;
3584 }
3585 
3586 #define AUX_ROC_MIN_DURATION MSEC_TO_TU(100)
3587 #define AUX_ROC_MIN_DELAY MSEC_TO_TU(200)
3588 #define AUX_ROC_MAX_DELAY MSEC_TO_TU(600)
3589 #define AUX_ROC_SAFETY_BUFFER MSEC_TO_TU(20)
3590 #define AUX_ROC_MIN_SAFETY_BUFFER MSEC_TO_TU(10)
3591 static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm,
3592 				    struct ieee80211_channel *channel,
3593 				    struct ieee80211_vif *vif,
3594 				    int duration)
3595 {
3596 	int res;
3597 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3598 	struct iwl_mvm_time_event_data *te_data = &mvmvif->hs_time_event_data;
3599 	static const u16 time_event_response[] = { HOT_SPOT_CMD };
3600 	struct iwl_notification_wait wait_time_event;
3601 	u32 dtim_interval = vif->bss_conf.dtim_period *
3602 		vif->bss_conf.beacon_int;
3603 	u32 req_dur, delay;
3604 	struct iwl_hs20_roc_req aux_roc_req = {
3605 		.action = cpu_to_le32(FW_CTXT_ACTION_ADD),
3606 		.id_and_color =
3607 			cpu_to_le32(FW_CMD_ID_AND_COLOR(MAC_INDEX_AUX, 0)),
3608 		.sta_id_and_color = cpu_to_le32(mvm->aux_sta.sta_id),
3609 	};
3610 	struct iwl_hs20_roc_req_tail *tail = iwl_mvm_chan_info_cmd_tail(mvm,
3611 		&aux_roc_req.channel_info);
3612 	u16 len = sizeof(aux_roc_req) - iwl_mvm_chan_info_padding(mvm);
3613 
3614 	/* Set the channel info data */
3615 	iwl_mvm_set_chan_info(mvm, &aux_roc_req.channel_info, channel->hw_value,
3616 			      (channel->band == NL80211_BAND_2GHZ) ?
3617 			       PHY_BAND_24 : PHY_BAND_5,
3618 			      PHY_VHT_CHANNEL_MODE20,
3619 			      0);
3620 
3621 	/* Set the time and duration */
3622 	tail->apply_time = cpu_to_le32(iwl_mvm_get_systime(mvm));
3623 
3624 	delay = AUX_ROC_MIN_DELAY;
3625 	req_dur = MSEC_TO_TU(duration);
3626 
3627 	/*
3628 	 * If we are associated we want the delay time to be at least one
3629 	 * dtim interval so that the FW can wait until after the DTIM and
3630 	 * then start the time event, this will potentially allow us to
3631 	 * remain off-channel for the max duration.
3632 	 * Since we want to use almost a whole dtim interval we would also
3633 	 * like the delay to be for 2-3 dtim intervals, in case there are
3634 	 * other time events with higher priority.
3635 	 */
3636 	if (vif->bss_conf.assoc) {
3637 		delay = min_t(u32, dtim_interval * 3, AUX_ROC_MAX_DELAY);
3638 		/* We cannot remain off-channel longer than the DTIM interval */
3639 		if (dtim_interval <= req_dur) {
3640 			req_dur = dtim_interval - AUX_ROC_SAFETY_BUFFER;
3641 			if (req_dur <= AUX_ROC_MIN_DURATION)
3642 				req_dur = dtim_interval -
3643 					AUX_ROC_MIN_SAFETY_BUFFER;
3644 		}
3645 	}
3646 
3647 	tail->duration = cpu_to_le32(req_dur);
3648 	tail->apply_time_max_delay = cpu_to_le32(delay);
3649 
3650 	IWL_DEBUG_TE(mvm,
3651 		     "ROC: Requesting to remain on channel %u for %ums (requested = %ums, max_delay = %ums, dtim_interval = %ums)\n",
3652 		     channel->hw_value, req_dur, duration, delay,
3653 		     dtim_interval);
3654 	/* Set the node address */
3655 	memcpy(tail->node_addr, vif->addr, ETH_ALEN);
3656 
3657 	lockdep_assert_held(&mvm->mutex);
3658 
3659 	spin_lock_bh(&mvm->time_event_lock);
3660 
3661 	if (WARN_ON(te_data->id == HOT_SPOT_CMD)) {
3662 		spin_unlock_bh(&mvm->time_event_lock);
3663 		return -EIO;
3664 	}
3665 
3666 	te_data->vif = vif;
3667 	te_data->duration = duration;
3668 	te_data->id = HOT_SPOT_CMD;
3669 
3670 	spin_unlock_bh(&mvm->time_event_lock);
3671 
3672 	/*
3673 	 * Use a notification wait, which really just processes the
3674 	 * command response and doesn't wait for anything, in order
3675 	 * to be able to process the response and get the UID inside
3676 	 * the RX path. Using CMD_WANT_SKB doesn't work because it
3677 	 * stores the buffer and then wakes up this thread, by which
3678 	 * time another notification (that the time event started)
3679 	 * might already be processed unsuccessfully.
3680 	 */
3681 	iwl_init_notification_wait(&mvm->notif_wait, &wait_time_event,
3682 				   time_event_response,
3683 				   ARRAY_SIZE(time_event_response),
3684 				   iwl_mvm_rx_aux_roc, te_data);
3685 
3686 	res = iwl_mvm_send_cmd_pdu(mvm, HOT_SPOT_CMD, 0, len,
3687 				   &aux_roc_req);
3688 
3689 	if (res) {
3690 		IWL_ERR(mvm, "Couldn't send HOT_SPOT_CMD: %d\n", res);
3691 		iwl_remove_notification(&mvm->notif_wait, &wait_time_event);
3692 		goto out_clear_te;
3693 	}
3694 
3695 	/* No need to wait for anything, so just pass 1 (0 isn't valid) */
3696 	res = iwl_wait_notification(&mvm->notif_wait, &wait_time_event, 1);
3697 	/* should never fail */
3698 	WARN_ON_ONCE(res);
3699 
3700 	if (res) {
3701  out_clear_te:
3702 		spin_lock_bh(&mvm->time_event_lock);
3703 		iwl_mvm_te_clear_data(mvm, te_data);
3704 		spin_unlock_bh(&mvm->time_event_lock);
3705 	}
3706 
3707 	return res;
3708 }
3709 
3710 static int iwl_mvm_roc(struct ieee80211_hw *hw,
3711 		       struct ieee80211_vif *vif,
3712 		       struct ieee80211_channel *channel,
3713 		       int duration,
3714 		       enum ieee80211_roc_type type)
3715 {
3716 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3717 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3718 	struct cfg80211_chan_def chandef;
3719 	struct iwl_mvm_phy_ctxt *phy_ctxt;
3720 	int ret, i;
3721 
3722 	IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value,
3723 			   duration, type);
3724 
3725 	/*
3726 	 * Flush the done work, just in case it's still pending, so that
3727 	 * the work it does can complete and we can accept new frames.
3728 	 */
3729 	flush_work(&mvm->roc_done_wk);
3730 
3731 	mutex_lock(&mvm->mutex);
3732 
3733 	switch (vif->type) {
3734 	case NL80211_IFTYPE_STATION:
3735 		if (fw_has_capa(&mvm->fw->ucode_capa,
3736 				IWL_UCODE_TLV_CAPA_HOTSPOT_SUPPORT)) {
3737 			/* Use aux roc framework (HS20) */
3738 			ret = iwl_mvm_send_aux_roc_cmd(mvm, channel,
3739 						       vif, duration);
3740 			goto out_unlock;
3741 		}
3742 		IWL_ERR(mvm, "hotspot not supported\n");
3743 		ret = -EINVAL;
3744 		goto out_unlock;
3745 	case NL80211_IFTYPE_P2P_DEVICE:
3746 		/* handle below */
3747 		break;
3748 	default:
3749 		IWL_ERR(mvm, "vif isn't P2P_DEVICE: %d\n", vif->type);
3750 		ret = -EINVAL;
3751 		goto out_unlock;
3752 	}
3753 
3754 	for (i = 0; i < NUM_PHY_CTX; i++) {
3755 		phy_ctxt = &mvm->phy_ctxts[i];
3756 		if (phy_ctxt->ref == 0 || mvmvif->phy_ctxt == phy_ctxt)
3757 			continue;
3758 
3759 		if (phy_ctxt->ref && channel == phy_ctxt->channel) {
3760 			/*
3761 			 * Unbind the P2P_DEVICE from the current PHY context,
3762 			 * and if the PHY context is not used remove it.
3763 			 */
3764 			ret = iwl_mvm_binding_remove_vif(mvm, vif);
3765 			if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3766 				goto out_unlock;
3767 
3768 			iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3769 
3770 			/* Bind the P2P_DEVICE to the current PHY Context */
3771 			mvmvif->phy_ctxt = phy_ctxt;
3772 
3773 			ret = iwl_mvm_binding_add_vif(mvm, vif);
3774 			if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3775 				goto out_unlock;
3776 
3777 			iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3778 			goto schedule_time_event;
3779 		}
3780 	}
3781 
3782 	/* Need to update the PHY context only if the ROC channel changed */
3783 	if (channel == mvmvif->phy_ctxt->channel)
3784 		goto schedule_time_event;
3785 
3786 	cfg80211_chandef_create(&chandef, channel, NL80211_CHAN_NO_HT);
3787 
3788 	/*
3789 	 * Change the PHY context configuration as it is currently referenced
3790 	 * only by the P2P Device MAC
3791 	 */
3792 	if (mvmvif->phy_ctxt->ref == 1) {
3793 		ret = iwl_mvm_phy_ctxt_changed(mvm, mvmvif->phy_ctxt,
3794 					       &chandef, 1, 1);
3795 		if (ret)
3796 			goto out_unlock;
3797 	} else {
3798 		/*
3799 		 * The PHY context is shared with other MACs. Need to remove the
3800 		 * P2P Device from the binding, allocate an new PHY context and
3801 		 * create a new binding
3802 		 */
3803 		phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3804 		if (!phy_ctxt) {
3805 			ret = -ENOSPC;
3806 			goto out_unlock;
3807 		}
3808 
3809 		ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &chandef,
3810 					       1, 1);
3811 		if (ret) {
3812 			IWL_ERR(mvm, "Failed to change PHY context\n");
3813 			goto out_unlock;
3814 		}
3815 
3816 		/* Unbind the P2P_DEVICE from the current PHY context */
3817 		ret = iwl_mvm_binding_remove_vif(mvm, vif);
3818 		if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3819 			goto out_unlock;
3820 
3821 		iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3822 
3823 		/* Bind the P2P_DEVICE to the new allocated PHY context */
3824 		mvmvif->phy_ctxt = phy_ctxt;
3825 
3826 		ret = iwl_mvm_binding_add_vif(mvm, vif);
3827 		if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3828 			goto out_unlock;
3829 
3830 		iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3831 	}
3832 
3833 schedule_time_event:
3834 	/* Schedule the time events */
3835 	ret = iwl_mvm_start_p2p_roc(mvm, vif, duration, type);
3836 
3837 out_unlock:
3838 	mutex_unlock(&mvm->mutex);
3839 	IWL_DEBUG_MAC80211(mvm, "leave\n");
3840 	return ret;
3841 }
3842 
3843 static int iwl_mvm_cancel_roc(struct ieee80211_hw *hw,
3844 			      struct ieee80211_vif *vif)
3845 {
3846 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3847 
3848 	IWL_DEBUG_MAC80211(mvm, "enter\n");
3849 
3850 	mutex_lock(&mvm->mutex);
3851 	iwl_mvm_stop_roc(mvm);
3852 	mutex_unlock(&mvm->mutex);
3853 
3854 	IWL_DEBUG_MAC80211(mvm, "leave\n");
3855 	return 0;
3856 }
3857 
3858 struct iwl_mvm_ftm_responder_iter_data {
3859 	bool responder;
3860 	struct ieee80211_chanctx_conf *ctx;
3861 };
3862 
3863 static void iwl_mvm_ftm_responder_chanctx_iter(void *_data, u8 *mac,
3864 					       struct ieee80211_vif *vif)
3865 {
3866 	struct iwl_mvm_ftm_responder_iter_data *data = _data;
3867 
3868 	if (rcu_access_pointer(vif->chanctx_conf) == data->ctx &&
3869 	    vif->type == NL80211_IFTYPE_AP && vif->bss_conf.ftmr_params)
3870 		data->responder = true;
3871 }
3872 
3873 static bool iwl_mvm_is_ftm_responder_chanctx(struct iwl_mvm *mvm,
3874 					     struct ieee80211_chanctx_conf *ctx)
3875 {
3876 	struct iwl_mvm_ftm_responder_iter_data data = {
3877 		.responder = false,
3878 		.ctx = ctx,
3879 	};
3880 
3881 	ieee80211_iterate_active_interfaces_atomic(mvm->hw,
3882 					IEEE80211_IFACE_ITER_NORMAL,
3883 					iwl_mvm_ftm_responder_chanctx_iter,
3884 					&data);
3885 	return data.responder;
3886 }
3887 
3888 static int __iwl_mvm_add_chanctx(struct iwl_mvm *mvm,
3889 				 struct ieee80211_chanctx_conf *ctx)
3890 {
3891 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3892 	struct iwl_mvm_phy_ctxt *phy_ctxt;
3893 	bool responder = iwl_mvm_is_ftm_responder_chanctx(mvm, ctx);
3894 	struct cfg80211_chan_def *def = responder ? &ctx->def : &ctx->min_def;
3895 	int ret;
3896 
3897 	lockdep_assert_held(&mvm->mutex);
3898 
3899 	IWL_DEBUG_MAC80211(mvm, "Add channel context\n");
3900 
3901 	phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3902 	if (!phy_ctxt) {
3903 		ret = -ENOSPC;
3904 		goto out;
3905 	}
3906 
3907 	ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, def,
3908 				       ctx->rx_chains_static,
3909 				       ctx->rx_chains_dynamic);
3910 	if (ret) {
3911 		IWL_ERR(mvm, "Failed to add PHY context\n");
3912 		goto out;
3913 	}
3914 
3915 	iwl_mvm_phy_ctxt_ref(mvm, phy_ctxt);
3916 	*phy_ctxt_id = phy_ctxt->id;
3917 out:
3918 	return ret;
3919 }
3920 
3921 static int iwl_mvm_add_chanctx(struct ieee80211_hw *hw,
3922 			       struct ieee80211_chanctx_conf *ctx)
3923 {
3924 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3925 	int ret;
3926 
3927 	mutex_lock(&mvm->mutex);
3928 	ret = __iwl_mvm_add_chanctx(mvm, ctx);
3929 	mutex_unlock(&mvm->mutex);
3930 
3931 	return ret;
3932 }
3933 
3934 static void __iwl_mvm_remove_chanctx(struct iwl_mvm *mvm,
3935 				     struct ieee80211_chanctx_conf *ctx)
3936 {
3937 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3938 	struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3939 
3940 	lockdep_assert_held(&mvm->mutex);
3941 
3942 	iwl_mvm_phy_ctxt_unref(mvm, phy_ctxt);
3943 }
3944 
3945 static void iwl_mvm_remove_chanctx(struct ieee80211_hw *hw,
3946 				   struct ieee80211_chanctx_conf *ctx)
3947 {
3948 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3949 
3950 	mutex_lock(&mvm->mutex);
3951 	__iwl_mvm_remove_chanctx(mvm, ctx);
3952 	mutex_unlock(&mvm->mutex);
3953 }
3954 
3955 static void iwl_mvm_change_chanctx(struct ieee80211_hw *hw,
3956 				   struct ieee80211_chanctx_conf *ctx,
3957 				   u32 changed)
3958 {
3959 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3960 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3961 	struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3962 	bool responder = iwl_mvm_is_ftm_responder_chanctx(mvm, ctx);
3963 	struct cfg80211_chan_def *def = responder ? &ctx->def : &ctx->min_def;
3964 
3965 	if (WARN_ONCE((phy_ctxt->ref > 1) &&
3966 		      (changed & ~(IEEE80211_CHANCTX_CHANGE_WIDTH |
3967 				   IEEE80211_CHANCTX_CHANGE_RX_CHAINS |
3968 				   IEEE80211_CHANCTX_CHANGE_RADAR |
3969 				   IEEE80211_CHANCTX_CHANGE_MIN_WIDTH)),
3970 		      "Cannot change PHY. Ref=%d, changed=0x%X\n",
3971 		      phy_ctxt->ref, changed))
3972 		return;
3973 
3974 	mutex_lock(&mvm->mutex);
3975 
3976 	/* we are only changing the min_width, may be a noop */
3977 	if (changed == IEEE80211_CHANCTX_CHANGE_MIN_WIDTH) {
3978 		if (phy_ctxt->width == def->width)
3979 			goto out_unlock;
3980 
3981 		/* we are just toggling between 20_NOHT and 20 */
3982 		if (phy_ctxt->width <= NL80211_CHAN_WIDTH_20 &&
3983 		    def->width <= NL80211_CHAN_WIDTH_20)
3984 			goto out_unlock;
3985 	}
3986 
3987 	iwl_mvm_bt_coex_vif_change(mvm);
3988 	iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, def,
3989 				 ctx->rx_chains_static,
3990 				 ctx->rx_chains_dynamic);
3991 
3992 out_unlock:
3993 	mutex_unlock(&mvm->mutex);
3994 }
3995 
3996 static int __iwl_mvm_assign_vif_chanctx(struct iwl_mvm *mvm,
3997 					struct ieee80211_vif *vif,
3998 					struct ieee80211_chanctx_conf *ctx,
3999 					bool switching_chanctx)
4000 {
4001 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
4002 	struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
4003 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4004 	int ret;
4005 
4006 	lockdep_assert_held(&mvm->mutex);
4007 
4008 	mvmvif->phy_ctxt = phy_ctxt;
4009 
4010 	switch (vif->type) {
4011 	case NL80211_IFTYPE_AP:
4012 		/* only needed if we're switching chanctx (i.e. during CSA) */
4013 		if (switching_chanctx) {
4014 			mvmvif->ap_ibss_active = true;
4015 			break;
4016 		}
4017 		/* fall through */
4018 	case NL80211_IFTYPE_ADHOC:
4019 		/*
4020 		 * The AP binding flow is handled as part of the start_ap flow
4021 		 * (in bss_info_changed), similarly for IBSS.
4022 		 */
4023 		ret = 0;
4024 		goto out;
4025 	case NL80211_IFTYPE_STATION:
4026 		mvmvif->csa_bcn_pending = false;
4027 		break;
4028 	case NL80211_IFTYPE_MONITOR:
4029 		/* always disable PS when a monitor interface is active */
4030 		mvmvif->ps_disabled = true;
4031 		break;
4032 	default:
4033 		ret = -EINVAL;
4034 		goto out;
4035 	}
4036 
4037 	ret = iwl_mvm_binding_add_vif(mvm, vif);
4038 	if (ret)
4039 		goto out;
4040 
4041 	/*
4042 	 * Power state must be updated before quotas,
4043 	 * otherwise fw will complain.
4044 	 */
4045 	iwl_mvm_power_update_mac(mvm);
4046 
4047 	/* Setting the quota at this stage is only required for monitor
4048 	 * interfaces. For the other types, the bss_info changed flow
4049 	 * will handle quota settings.
4050 	 */
4051 	if (vif->type == NL80211_IFTYPE_MONITOR) {
4052 		mvmvif->monitor_active = true;
4053 		ret = iwl_mvm_update_quotas(mvm, false, NULL);
4054 		if (ret)
4055 			goto out_remove_binding;
4056 
4057 		ret = iwl_mvm_add_snif_sta(mvm, vif);
4058 		if (ret)
4059 			goto out_remove_binding;
4060 
4061 	}
4062 
4063 	/* Handle binding during CSA */
4064 	if (vif->type == NL80211_IFTYPE_AP) {
4065 		iwl_mvm_update_quotas(mvm, false, NULL);
4066 		iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
4067 	}
4068 
4069 	if (switching_chanctx && vif->type == NL80211_IFTYPE_STATION) {
4070 		mvmvif->csa_bcn_pending = true;
4071 
4072 		if (!fw_has_capa(&mvm->fw->ucode_capa,
4073 				 IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
4074 			u32 duration = 3 * vif->bss_conf.beacon_int;
4075 
4076 			/* Protect the session to make sure we hear the first
4077 			 * beacon on the new channel.
4078 			 */
4079 			iwl_mvm_protect_session(mvm, vif, duration, duration,
4080 						vif->bss_conf.beacon_int / 2,
4081 						true);
4082 		}
4083 
4084 		iwl_mvm_update_quotas(mvm, false, NULL);
4085 	}
4086 
4087 	goto out;
4088 
4089 out_remove_binding:
4090 	iwl_mvm_binding_remove_vif(mvm, vif);
4091 	iwl_mvm_power_update_mac(mvm);
4092 out:
4093 	if (ret)
4094 		mvmvif->phy_ctxt = NULL;
4095 	return ret;
4096 }
4097 static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
4098 				      struct ieee80211_vif *vif,
4099 				      struct ieee80211_chanctx_conf *ctx)
4100 {
4101 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4102 	int ret;
4103 
4104 	mutex_lock(&mvm->mutex);
4105 	ret = __iwl_mvm_assign_vif_chanctx(mvm, vif, ctx, false);
4106 	mutex_unlock(&mvm->mutex);
4107 
4108 	return ret;
4109 }
4110 
4111 static void __iwl_mvm_unassign_vif_chanctx(struct iwl_mvm *mvm,
4112 					   struct ieee80211_vif *vif,
4113 					   struct ieee80211_chanctx_conf *ctx,
4114 					   bool switching_chanctx)
4115 {
4116 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4117 	struct ieee80211_vif *disabled_vif = NULL;
4118 
4119 	lockdep_assert_held(&mvm->mutex);
4120 
4121 	iwl_mvm_remove_time_event(mvm, mvmvif, &mvmvif->time_event_data);
4122 
4123 	switch (vif->type) {
4124 	case NL80211_IFTYPE_ADHOC:
4125 		goto out;
4126 	case NL80211_IFTYPE_MONITOR:
4127 		mvmvif->monitor_active = false;
4128 		mvmvif->ps_disabled = false;
4129 		iwl_mvm_rm_snif_sta(mvm, vif);
4130 		break;
4131 	case NL80211_IFTYPE_AP:
4132 		/* This part is triggered only during CSA */
4133 		if (!switching_chanctx || !mvmvif->ap_ibss_active)
4134 			goto out;
4135 
4136 		mvmvif->csa_countdown = false;
4137 
4138 		/* Set CS bit on all the stations */
4139 		iwl_mvm_modify_all_sta_disable_tx(mvm, mvmvif, true);
4140 
4141 		/* Save blocked iface, the timeout is set on the next beacon */
4142 		rcu_assign_pointer(mvm->csa_tx_blocked_vif, vif);
4143 
4144 		mvmvif->ap_ibss_active = false;
4145 		break;
4146 	case NL80211_IFTYPE_STATION:
4147 		if (!switching_chanctx)
4148 			break;
4149 
4150 		disabled_vif = vif;
4151 
4152 		if (!fw_has_capa(&mvm->fw->ucode_capa,
4153 				 IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD))
4154 			iwl_mvm_mac_ctxt_changed(mvm, vif, true, NULL);
4155 		break;
4156 	default:
4157 		break;
4158 	}
4159 
4160 	iwl_mvm_update_quotas(mvm, false, disabled_vif);
4161 	iwl_mvm_binding_remove_vif(mvm, vif);
4162 
4163 out:
4164 	mvmvif->phy_ctxt = NULL;
4165 	iwl_mvm_power_update_mac(mvm);
4166 }
4167 
4168 static void iwl_mvm_unassign_vif_chanctx(struct ieee80211_hw *hw,
4169 					 struct ieee80211_vif *vif,
4170 					 struct ieee80211_chanctx_conf *ctx)
4171 {
4172 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4173 
4174 	mutex_lock(&mvm->mutex);
4175 	__iwl_mvm_unassign_vif_chanctx(mvm, vif, ctx, false);
4176 	mutex_unlock(&mvm->mutex);
4177 }
4178 
4179 static int
4180 iwl_mvm_switch_vif_chanctx_swap(struct iwl_mvm *mvm,
4181 				struct ieee80211_vif_chanctx_switch *vifs)
4182 {
4183 	int ret;
4184 
4185 	mutex_lock(&mvm->mutex);
4186 	__iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
4187 	__iwl_mvm_remove_chanctx(mvm, vifs[0].old_ctx);
4188 
4189 	ret = __iwl_mvm_add_chanctx(mvm, vifs[0].new_ctx);
4190 	if (ret) {
4191 		IWL_ERR(mvm, "failed to add new_ctx during channel switch\n");
4192 		goto out_reassign;
4193 	}
4194 
4195 	ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
4196 					   true);
4197 	if (ret) {
4198 		IWL_ERR(mvm,
4199 			"failed to assign new_ctx during channel switch\n");
4200 		goto out_remove;
4201 	}
4202 
4203 	/* we don't support TDLS during DCM - can be caused by channel switch */
4204 	if (iwl_mvm_phy_ctx_count(mvm) > 1)
4205 		iwl_mvm_teardown_tdls_peers(mvm);
4206 
4207 	goto out;
4208 
4209 out_remove:
4210 	__iwl_mvm_remove_chanctx(mvm, vifs[0].new_ctx);
4211 
4212 out_reassign:
4213 	if (__iwl_mvm_add_chanctx(mvm, vifs[0].old_ctx)) {
4214 		IWL_ERR(mvm, "failed to add old_ctx back after failure.\n");
4215 		goto out_restart;
4216 	}
4217 
4218 	if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
4219 					 true)) {
4220 		IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
4221 		goto out_restart;
4222 	}
4223 
4224 	goto out;
4225 
4226 out_restart:
4227 	/* things keep failing, better restart the hw */
4228 	iwl_mvm_nic_restart(mvm, false);
4229 
4230 out:
4231 	mutex_unlock(&mvm->mutex);
4232 
4233 	return ret;
4234 }
4235 
4236 static int
4237 iwl_mvm_switch_vif_chanctx_reassign(struct iwl_mvm *mvm,
4238 				    struct ieee80211_vif_chanctx_switch *vifs)
4239 {
4240 	int ret;
4241 
4242 	mutex_lock(&mvm->mutex);
4243 	__iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
4244 
4245 	ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
4246 					   true);
4247 	if (ret) {
4248 		IWL_ERR(mvm,
4249 			"failed to assign new_ctx during channel switch\n");
4250 		goto out_reassign;
4251 	}
4252 
4253 	goto out;
4254 
4255 out_reassign:
4256 	if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
4257 					 true)) {
4258 		IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
4259 		goto out_restart;
4260 	}
4261 
4262 	goto out;
4263 
4264 out_restart:
4265 	/* things keep failing, better restart the hw */
4266 	iwl_mvm_nic_restart(mvm, false);
4267 
4268 out:
4269 	mutex_unlock(&mvm->mutex);
4270 
4271 	return ret;
4272 }
4273 
4274 static int iwl_mvm_switch_vif_chanctx(struct ieee80211_hw *hw,
4275 				      struct ieee80211_vif_chanctx_switch *vifs,
4276 				      int n_vifs,
4277 				      enum ieee80211_chanctx_switch_mode mode)
4278 {
4279 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4280 	int ret;
4281 
4282 	/* we only support a single-vif right now */
4283 	if (n_vifs > 1)
4284 		return -EOPNOTSUPP;
4285 
4286 	switch (mode) {
4287 	case CHANCTX_SWMODE_SWAP_CONTEXTS:
4288 		ret = iwl_mvm_switch_vif_chanctx_swap(mvm, vifs);
4289 		break;
4290 	case CHANCTX_SWMODE_REASSIGN_VIF:
4291 		ret = iwl_mvm_switch_vif_chanctx_reassign(mvm, vifs);
4292 		break;
4293 	default:
4294 		ret = -EOPNOTSUPP;
4295 		break;
4296 	}
4297 
4298 	return ret;
4299 }
4300 
4301 static int iwl_mvm_tx_last_beacon(struct ieee80211_hw *hw)
4302 {
4303 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4304 
4305 	return mvm->ibss_manager;
4306 }
4307 
4308 static int iwl_mvm_set_tim(struct ieee80211_hw *hw,
4309 			   struct ieee80211_sta *sta,
4310 			   bool set)
4311 {
4312 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4313 	struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
4314 
4315 	if (!mvm_sta || !mvm_sta->vif) {
4316 		IWL_ERR(mvm, "Station is not associated to a vif\n");
4317 		return -EINVAL;
4318 	}
4319 
4320 	return iwl_mvm_mac_ctxt_beacon_changed(mvm, mvm_sta->vif);
4321 }
4322 
4323 #ifdef CONFIG_NL80211_TESTMODE
4324 static const struct nla_policy iwl_mvm_tm_policy[IWL_MVM_TM_ATTR_MAX + 1] = {
4325 	[IWL_MVM_TM_ATTR_CMD] = { .type = NLA_U32 },
4326 	[IWL_MVM_TM_ATTR_NOA_DURATION] = { .type = NLA_U32 },
4327 	[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE] = { .type = NLA_U32 },
4328 };
4329 
4330 static int __iwl_mvm_mac_testmode_cmd(struct iwl_mvm *mvm,
4331 				      struct ieee80211_vif *vif,
4332 				      void *data, int len)
4333 {
4334 	struct nlattr *tb[IWL_MVM_TM_ATTR_MAX + 1];
4335 	int err;
4336 	u32 noa_duration;
4337 
4338 	err = nla_parse_deprecated(tb, IWL_MVM_TM_ATTR_MAX, data, len,
4339 				   iwl_mvm_tm_policy, NULL);
4340 	if (err)
4341 		return err;
4342 
4343 	if (!tb[IWL_MVM_TM_ATTR_CMD])
4344 		return -EINVAL;
4345 
4346 	switch (nla_get_u32(tb[IWL_MVM_TM_ATTR_CMD])) {
4347 	case IWL_MVM_TM_CMD_SET_NOA:
4348 		if (!vif || vif->type != NL80211_IFTYPE_AP || !vif->p2p ||
4349 		    !vif->bss_conf.enable_beacon ||
4350 		    !tb[IWL_MVM_TM_ATTR_NOA_DURATION])
4351 			return -EINVAL;
4352 
4353 		noa_duration = nla_get_u32(tb[IWL_MVM_TM_ATTR_NOA_DURATION]);
4354 		if (noa_duration >= vif->bss_conf.beacon_int)
4355 			return -EINVAL;
4356 
4357 		mvm->noa_duration = noa_duration;
4358 		mvm->noa_vif = vif;
4359 
4360 		return iwl_mvm_update_quotas(mvm, true, NULL);
4361 	case IWL_MVM_TM_CMD_SET_BEACON_FILTER:
4362 		/* must be associated client vif - ignore authorized */
4363 		if (!vif || vif->type != NL80211_IFTYPE_STATION ||
4364 		    !vif->bss_conf.assoc || !vif->bss_conf.dtim_period ||
4365 		    !tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE])
4366 			return -EINVAL;
4367 
4368 		if (nla_get_u32(tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE]))
4369 			return iwl_mvm_enable_beacon_filter(mvm, vif, 0);
4370 		return iwl_mvm_disable_beacon_filter(mvm, vif, 0);
4371 	}
4372 
4373 	return -EOPNOTSUPP;
4374 }
4375 
4376 static int iwl_mvm_mac_testmode_cmd(struct ieee80211_hw *hw,
4377 				    struct ieee80211_vif *vif,
4378 				    void *data, int len)
4379 {
4380 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4381 	int err;
4382 
4383 	mutex_lock(&mvm->mutex);
4384 	err = __iwl_mvm_mac_testmode_cmd(mvm, vif, data, len);
4385 	mutex_unlock(&mvm->mutex);
4386 
4387 	return err;
4388 }
4389 #endif
4390 
4391 static void iwl_mvm_channel_switch(struct ieee80211_hw *hw,
4392 				   struct ieee80211_vif *vif,
4393 				   struct ieee80211_channel_switch *chsw)
4394 {
4395 	/* By implementing this operation, we prevent mac80211 from
4396 	 * starting its own channel switch timer, so that we can call
4397 	 * ieee80211_chswitch_done() ourselves at the right time
4398 	 * (which is when the absence time event starts).
4399 	 */
4400 
4401 	IWL_DEBUG_MAC80211(IWL_MAC80211_GET_MVM(hw),
4402 			   "dummy channel switch op\n");
4403 }
4404 
4405 static int iwl_mvm_schedule_client_csa(struct iwl_mvm *mvm,
4406 				       struct ieee80211_vif *vif,
4407 				       struct ieee80211_channel_switch *chsw)
4408 {
4409 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4410 	struct iwl_chan_switch_te_cmd cmd = {
4411 		.mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
4412 							  mvmvif->color)),
4413 		.action = cpu_to_le32(FW_CTXT_ACTION_ADD),
4414 		.tsf = cpu_to_le32(chsw->timestamp),
4415 		.cs_count = chsw->count,
4416 		.cs_mode = chsw->block_tx,
4417 	};
4418 
4419 	lockdep_assert_held(&mvm->mutex);
4420 
4421 	if (chsw->delay)
4422 		cmd.cs_delayed_bcn_count =
4423 			DIV_ROUND_UP(chsw->delay, vif->bss_conf.beacon_int);
4424 
4425 	return iwl_mvm_send_cmd_pdu(mvm,
4426 				    WIDE_ID(MAC_CONF_GROUP,
4427 					    CHANNEL_SWITCH_TIME_EVENT_CMD),
4428 				    0, sizeof(cmd), &cmd);
4429 }
4430 
4431 static int iwl_mvm_old_pre_chan_sw_sta(struct iwl_mvm *mvm,
4432 				       struct ieee80211_vif *vif,
4433 				       struct ieee80211_channel_switch *chsw)
4434 {
4435 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4436 	u32 apply_time;
4437 
4438 	/* Schedule the time event to a bit before beacon 1,
4439 	 * to make sure we're in the new channel when the
4440 	 * GO/AP arrives. In case count <= 1 immediately schedule the
4441 	 * TE (this might result with some packet loss or connection
4442 	 * loss).
4443 	 */
4444 	if (chsw->count <= 1)
4445 		apply_time = 0;
4446 	else
4447 		apply_time = chsw->device_timestamp +
4448 			((vif->bss_conf.beacon_int * (chsw->count - 1) -
4449 			  IWL_MVM_CHANNEL_SWITCH_TIME_CLIENT) * 1024);
4450 
4451 	if (chsw->block_tx)
4452 		iwl_mvm_csa_client_absent(mvm, vif);
4453 
4454 	if (mvmvif->bf_data.bf_enabled) {
4455 		int ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
4456 
4457 		if (ret)
4458 			return ret;
4459 	}
4460 
4461 	iwl_mvm_schedule_csa_period(mvm, vif, vif->bss_conf.beacon_int,
4462 				    apply_time);
4463 
4464 	return 0;
4465 }
4466 
4467 #define IWL_MAX_CSA_BLOCK_TX 1500
4468 static int iwl_mvm_pre_channel_switch(struct ieee80211_hw *hw,
4469 				      struct ieee80211_vif *vif,
4470 				      struct ieee80211_channel_switch *chsw)
4471 {
4472 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4473 	struct ieee80211_vif *csa_vif;
4474 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4475 	int ret;
4476 
4477 	mutex_lock(&mvm->mutex);
4478 
4479 	mvmvif->csa_failed = false;
4480 
4481 	IWL_DEBUG_MAC80211(mvm, "pre CSA to freq %d\n",
4482 			   chsw->chandef.center_freq1);
4483 
4484 	iwl_fw_dbg_trigger_simple_stop(&mvm->fwrt,
4485 				       ieee80211_vif_to_wdev(vif),
4486 				       FW_DBG_TRIGGER_CHANNEL_SWITCH);
4487 
4488 	switch (vif->type) {
4489 	case NL80211_IFTYPE_AP:
4490 		csa_vif =
4491 			rcu_dereference_protected(mvm->csa_vif,
4492 						  lockdep_is_held(&mvm->mutex));
4493 		if (WARN_ONCE(csa_vif && csa_vif->csa_active,
4494 			      "Another CSA is already in progress")) {
4495 			ret = -EBUSY;
4496 			goto out_unlock;
4497 		}
4498 
4499 		/* we still didn't unblock tx. prevent new CS meanwhile */
4500 		if (rcu_dereference_protected(mvm->csa_tx_blocked_vif,
4501 					      lockdep_is_held(&mvm->mutex))) {
4502 			ret = -EBUSY;
4503 			goto out_unlock;
4504 		}
4505 
4506 		rcu_assign_pointer(mvm->csa_vif, vif);
4507 
4508 		if (WARN_ONCE(mvmvif->csa_countdown,
4509 			      "Previous CSA countdown didn't complete")) {
4510 			ret = -EBUSY;
4511 			goto out_unlock;
4512 		}
4513 
4514 		mvmvif->csa_target_freq = chsw->chandef.chan->center_freq;
4515 
4516 		break;
4517 	case NL80211_IFTYPE_STATION:
4518 		if (chsw->block_tx) {
4519 			/*
4520 			 * In case of undetermined / long time with immediate
4521 			 * quiet monitor status to gracefully disconnect
4522 			 */
4523 			if (!chsw->count ||
4524 			    chsw->count * vif->bss_conf.beacon_int >
4525 			    IWL_MAX_CSA_BLOCK_TX)
4526 				schedule_delayed_work(&mvmvif->csa_work,
4527 						      msecs_to_jiffies(IWL_MAX_CSA_BLOCK_TX));
4528 		}
4529 
4530 		if (!fw_has_capa(&mvm->fw->ucode_capa,
4531 				 IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
4532 			ret = iwl_mvm_old_pre_chan_sw_sta(mvm, vif, chsw);
4533 			if (ret)
4534 				goto out_unlock;
4535 		} else {
4536 			iwl_mvm_schedule_client_csa(mvm, vif, chsw);
4537 		}
4538 
4539 		mvmvif->csa_count = chsw->count;
4540 		mvmvif->csa_misbehave = false;
4541 		break;
4542 	default:
4543 		break;
4544 	}
4545 
4546 	mvmvif->ps_disabled = true;
4547 
4548 	ret = iwl_mvm_power_update_ps(mvm);
4549 	if (ret)
4550 		goto out_unlock;
4551 
4552 	/* we won't be on this channel any longer */
4553 	iwl_mvm_teardown_tdls_peers(mvm);
4554 
4555 out_unlock:
4556 	mutex_unlock(&mvm->mutex);
4557 
4558 	return ret;
4559 }
4560 
4561 static void iwl_mvm_channel_switch_rx_beacon(struct ieee80211_hw *hw,
4562 					     struct ieee80211_vif *vif,
4563 					     struct ieee80211_channel_switch *chsw)
4564 {
4565 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4566 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4567 	struct iwl_chan_switch_te_cmd cmd = {
4568 		.mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
4569 							  mvmvif->color)),
4570 		.action = cpu_to_le32(FW_CTXT_ACTION_MODIFY),
4571 		.tsf = cpu_to_le32(chsw->timestamp),
4572 		.cs_count = chsw->count,
4573 		.cs_mode = chsw->block_tx,
4574 	};
4575 
4576 	if (!fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_CS_MODIFY))
4577 		return;
4578 
4579 	if (chsw->count >= mvmvif->csa_count && chsw->block_tx) {
4580 		if (mvmvif->csa_misbehave) {
4581 			/* Second time, give up on this AP*/
4582 			iwl_mvm_abort_channel_switch(hw, vif);
4583 			ieee80211_chswitch_done(vif, false);
4584 			mvmvif->csa_misbehave = false;
4585 			return;
4586 		}
4587 		mvmvif->csa_misbehave = true;
4588 	}
4589 	mvmvif->csa_count = chsw->count;
4590 
4591 	IWL_DEBUG_MAC80211(mvm, "Modify CSA on mac %d\n", mvmvif->id);
4592 
4593 	WARN_ON(iwl_mvm_send_cmd_pdu(mvm,
4594 				     WIDE_ID(MAC_CONF_GROUP,
4595 					     CHANNEL_SWITCH_TIME_EVENT_CMD),
4596 				     CMD_ASYNC, sizeof(cmd), &cmd));
4597 }
4598 
4599 static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop)
4600 {
4601 	int i;
4602 
4603 	if (!iwl_mvm_has_new_tx_api(mvm)) {
4604 		if (drop) {
4605 			mutex_lock(&mvm->mutex);
4606 			iwl_mvm_flush_tx_path(mvm,
4607 				iwl_mvm_flushable_queues(mvm) & queues, 0);
4608 			mutex_unlock(&mvm->mutex);
4609 		} else {
4610 			iwl_trans_wait_tx_queues_empty(mvm->trans, queues);
4611 		}
4612 		return;
4613 	}
4614 
4615 	mutex_lock(&mvm->mutex);
4616 	for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
4617 		struct ieee80211_sta *sta;
4618 
4619 		sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
4620 						lockdep_is_held(&mvm->mutex));
4621 		if (IS_ERR_OR_NULL(sta))
4622 			continue;
4623 
4624 		if (drop)
4625 			iwl_mvm_flush_sta_tids(mvm, i, 0xFF, 0);
4626 		else
4627 			iwl_mvm_wait_sta_queues_empty(mvm,
4628 					iwl_mvm_sta_from_mac80211(sta));
4629 	}
4630 	mutex_unlock(&mvm->mutex);
4631 }
4632 
4633 static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
4634 			      struct ieee80211_vif *vif, u32 queues, bool drop)
4635 {
4636 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4637 	struct iwl_mvm_vif *mvmvif;
4638 	struct iwl_mvm_sta *mvmsta;
4639 	struct ieee80211_sta *sta;
4640 	int i;
4641 	u32 msk = 0;
4642 
4643 	if (!vif) {
4644 		iwl_mvm_flush_no_vif(mvm, queues, drop);
4645 		return;
4646 	}
4647 
4648 	if (vif->type != NL80211_IFTYPE_STATION)
4649 		return;
4650 
4651 	/* Make sure we're done with the deferred traffic before flushing */
4652 	flush_work(&mvm->add_stream_wk);
4653 
4654 	mutex_lock(&mvm->mutex);
4655 	mvmvif = iwl_mvm_vif_from_mac80211(vif);
4656 
4657 	/* flush the AP-station and all TDLS peers */
4658 	for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
4659 		sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
4660 						lockdep_is_held(&mvm->mutex));
4661 		if (IS_ERR_OR_NULL(sta))
4662 			continue;
4663 
4664 		mvmsta = iwl_mvm_sta_from_mac80211(sta);
4665 		if (mvmsta->vif != vif)
4666 			continue;
4667 
4668 		/* make sure only TDLS peers or the AP are flushed */
4669 		WARN_ON(i != mvmvif->ap_sta_id && !sta->tdls);
4670 
4671 		if (drop) {
4672 			if (iwl_mvm_flush_sta(mvm, mvmsta, false, 0))
4673 				IWL_ERR(mvm, "flush request fail\n");
4674 		} else {
4675 			msk |= mvmsta->tfd_queue_msk;
4676 			if (iwl_mvm_has_new_tx_api(mvm))
4677 				iwl_mvm_wait_sta_queues_empty(mvm, mvmsta);
4678 		}
4679 	}
4680 
4681 	mutex_unlock(&mvm->mutex);
4682 
4683 	/* this can take a while, and we may need/want other operations
4684 	 * to succeed while doing this, so do it without the mutex held
4685 	 */
4686 	if (!drop && !iwl_mvm_has_new_tx_api(mvm))
4687 		iwl_trans_wait_tx_queues_empty(mvm->trans, msk);
4688 }
4689 
4690 static int iwl_mvm_mac_get_survey(struct ieee80211_hw *hw, int idx,
4691 				  struct survey_info *survey)
4692 {
4693 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4694 	int ret;
4695 
4696 	memset(survey, 0, sizeof(*survey));
4697 
4698 	/* only support global statistics right now */
4699 	if (idx != 0)
4700 		return -ENOENT;
4701 
4702 	if (!fw_has_capa(&mvm->fw->ucode_capa,
4703 			 IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
4704 		return -ENOENT;
4705 
4706 	mutex_lock(&mvm->mutex);
4707 
4708 	if (iwl_mvm_firmware_running(mvm)) {
4709 		ret = iwl_mvm_request_statistics(mvm, false);
4710 		if (ret)
4711 			goto out;
4712 	}
4713 
4714 	survey->filled = SURVEY_INFO_TIME |
4715 			 SURVEY_INFO_TIME_RX |
4716 			 SURVEY_INFO_TIME_TX |
4717 			 SURVEY_INFO_TIME_SCAN;
4718 	survey->time = mvm->accu_radio_stats.on_time_rf +
4719 		       mvm->radio_stats.on_time_rf;
4720 	do_div(survey->time, USEC_PER_MSEC);
4721 
4722 	survey->time_rx = mvm->accu_radio_stats.rx_time +
4723 			  mvm->radio_stats.rx_time;
4724 	do_div(survey->time_rx, USEC_PER_MSEC);
4725 
4726 	survey->time_tx = mvm->accu_radio_stats.tx_time +
4727 			  mvm->radio_stats.tx_time;
4728 	do_div(survey->time_tx, USEC_PER_MSEC);
4729 
4730 	survey->time_scan = mvm->accu_radio_stats.on_time_scan +
4731 			    mvm->radio_stats.on_time_scan;
4732 	do_div(survey->time_scan, USEC_PER_MSEC);
4733 
4734 	ret = 0;
4735  out:
4736 	mutex_unlock(&mvm->mutex);
4737 	return ret;
4738 }
4739 
4740 static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,
4741 				       struct ieee80211_vif *vif,
4742 				       struct ieee80211_sta *sta,
4743 				       struct station_info *sinfo)
4744 {
4745 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4746 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4747 	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
4748 
4749 	if (mvmsta->avg_energy) {
4750 		sinfo->signal_avg = mvmsta->avg_energy;
4751 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
4752 	}
4753 
4754 	/* if beacon filtering isn't on mac80211 does it anyway */
4755 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
4756 		return;
4757 
4758 	if (!vif->bss_conf.assoc)
4759 		return;
4760 
4761 	mutex_lock(&mvm->mutex);
4762 
4763 	if (mvmvif->ap_sta_id != mvmsta->sta_id)
4764 		goto unlock;
4765 
4766 	if (iwl_mvm_request_statistics(mvm, false))
4767 		goto unlock;
4768 
4769 	sinfo->rx_beacon = mvmvif->beacon_stats.num_beacons +
4770 			   mvmvif->beacon_stats.accu_num_beacons;
4771 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_RX);
4772 	if (mvmvif->beacon_stats.avg_signal) {
4773 		/* firmware only reports a value after RXing a few beacons */
4774 		sinfo->rx_beacon_signal_avg = mvmvif->beacon_stats.avg_signal;
4775 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG);
4776 	}
4777  unlock:
4778 	mutex_unlock(&mvm->mutex);
4779 }
4780 
4781 static void iwl_mvm_event_mlme_callback(struct iwl_mvm *mvm,
4782 					struct ieee80211_vif *vif,
4783 					const struct ieee80211_event *event)
4784 {
4785 #define CHECK_MLME_TRIGGER(_cnt, _fmt...)				\
4786 	do {								\
4787 		if ((trig_mlme->_cnt) && --(trig_mlme->_cnt))		\
4788 			break;						\
4789 		iwl_fw_dbg_collect_trig(&(mvm)->fwrt, trig, _fmt);	\
4790 	} while (0)
4791 
4792 	struct iwl_fw_dbg_trigger_tlv *trig;
4793 	struct iwl_fw_dbg_trigger_mlme *trig_mlme;
4794 
4795 	trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
4796 				     FW_DBG_TRIGGER_MLME);
4797 	if (!trig)
4798 		return;
4799 
4800 	trig_mlme = (void *)trig->data;
4801 
4802 	if (event->u.mlme.data == ASSOC_EVENT) {
4803 		if (event->u.mlme.status == MLME_DENIED)
4804 			CHECK_MLME_TRIGGER(stop_assoc_denied,
4805 					   "DENIED ASSOC: reason %d",
4806 					    event->u.mlme.reason);
4807 		else if (event->u.mlme.status == MLME_TIMEOUT)
4808 			CHECK_MLME_TRIGGER(stop_assoc_timeout,
4809 					   "ASSOC TIMEOUT");
4810 	} else if (event->u.mlme.data == AUTH_EVENT) {
4811 		if (event->u.mlme.status == MLME_DENIED)
4812 			CHECK_MLME_TRIGGER(stop_auth_denied,
4813 					   "DENIED AUTH: reason %d",
4814 					   event->u.mlme.reason);
4815 		else if (event->u.mlme.status == MLME_TIMEOUT)
4816 			CHECK_MLME_TRIGGER(stop_auth_timeout,
4817 					   "AUTH TIMEOUT");
4818 	} else if (event->u.mlme.data == DEAUTH_RX_EVENT) {
4819 		CHECK_MLME_TRIGGER(stop_rx_deauth,
4820 				   "DEAUTH RX %d", event->u.mlme.reason);
4821 	} else if (event->u.mlme.data == DEAUTH_TX_EVENT) {
4822 		CHECK_MLME_TRIGGER(stop_tx_deauth,
4823 				   "DEAUTH TX %d", event->u.mlme.reason);
4824 	}
4825 #undef CHECK_MLME_TRIGGER
4826 }
4827 
4828 static void iwl_mvm_event_bar_rx_callback(struct iwl_mvm *mvm,
4829 					  struct ieee80211_vif *vif,
4830 					  const struct ieee80211_event *event)
4831 {
4832 	struct iwl_fw_dbg_trigger_tlv *trig;
4833 	struct iwl_fw_dbg_trigger_ba *ba_trig;
4834 
4835 	trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
4836 				     FW_DBG_TRIGGER_BA);
4837 	if (!trig)
4838 		return;
4839 
4840 	ba_trig = (void *)trig->data;
4841 
4842 	if (!(le16_to_cpu(ba_trig->rx_bar) & BIT(event->u.ba.tid)))
4843 		return;
4844 
4845 	iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
4846 				"BAR received from %pM, tid %d, ssn %d",
4847 				event->u.ba.sta->addr, event->u.ba.tid,
4848 				event->u.ba.ssn);
4849 }
4850 
4851 static void iwl_mvm_mac_event_callback(struct ieee80211_hw *hw,
4852 				       struct ieee80211_vif *vif,
4853 				       const struct ieee80211_event *event)
4854 {
4855 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4856 
4857 	switch (event->type) {
4858 	case MLME_EVENT:
4859 		iwl_mvm_event_mlme_callback(mvm, vif, event);
4860 		break;
4861 	case BAR_RX_EVENT:
4862 		iwl_mvm_event_bar_rx_callback(mvm, vif, event);
4863 		break;
4864 	case BA_FRAME_TIMEOUT:
4865 		iwl_mvm_event_frame_timeout_callback(mvm, vif, event->u.ba.sta,
4866 						     event->u.ba.tid);
4867 		break;
4868 	default:
4869 		break;
4870 	}
4871 }
4872 
4873 void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm,
4874 				     struct iwl_mvm_internal_rxq_notif *notif,
4875 				     u32 size)
4876 {
4877 	u32 qmask = BIT(mvm->trans->num_rx_queues) - 1;
4878 	int ret;
4879 
4880 
4881 	if (!iwl_mvm_has_new_rx_api(mvm))
4882 		return;
4883 
4884 	notif->cookie = mvm->queue_sync_cookie;
4885 
4886 	if (notif->sync)
4887 		atomic_set(&mvm->queue_sync_counter,
4888 			   mvm->trans->num_rx_queues);
4889 
4890 	ret = iwl_mvm_notify_rx_queue(mvm, qmask, (u8 *)notif,
4891 				      size, !notif->sync);
4892 	if (ret) {
4893 		IWL_ERR(mvm, "Failed to trigger RX queues sync (%d)\n", ret);
4894 		goto out;
4895 	}
4896 
4897 	if (notif->sync) {
4898 		lockdep_assert_held(&mvm->mutex);
4899 		ret = wait_event_timeout(mvm->rx_sync_waitq,
4900 					 atomic_read(&mvm->queue_sync_counter) == 0 ||
4901 					 iwl_mvm_is_radio_killed(mvm),
4902 					 HZ);
4903 		WARN_ON_ONCE(!ret && !iwl_mvm_is_radio_killed(mvm));
4904 	}
4905 
4906 out:
4907 	atomic_set(&mvm->queue_sync_counter, 0);
4908 	mvm->queue_sync_cookie++;
4909 }
4910 
4911 static void iwl_mvm_sync_rx_queues(struct ieee80211_hw *hw)
4912 {
4913 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4914 	struct iwl_mvm_internal_rxq_notif data = {
4915 		.type = IWL_MVM_RXQ_EMPTY,
4916 		.sync = 1,
4917 	};
4918 
4919 	mutex_lock(&mvm->mutex);
4920 	iwl_mvm_sync_rx_queues_internal(mvm, &data, sizeof(data));
4921 	mutex_unlock(&mvm->mutex);
4922 }
4923 
4924 static int
4925 iwl_mvm_mac_get_ftm_responder_stats(struct ieee80211_hw *hw,
4926 				    struct ieee80211_vif *vif,
4927 				    struct cfg80211_ftm_responder_stats *stats)
4928 {
4929 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4930 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4931 
4932 	if (vif->p2p || vif->type != NL80211_IFTYPE_AP ||
4933 	    !mvmvif->ap_ibss_active || !vif->bss_conf.ftm_responder)
4934 		return -EINVAL;
4935 
4936 	mutex_lock(&mvm->mutex);
4937 	*stats = mvm->ftm_resp_stats;
4938 	mutex_unlock(&mvm->mutex);
4939 
4940 	stats->filled = BIT(NL80211_FTM_STATS_SUCCESS_NUM) |
4941 			BIT(NL80211_FTM_STATS_PARTIAL_NUM) |
4942 			BIT(NL80211_FTM_STATS_FAILED_NUM) |
4943 			BIT(NL80211_FTM_STATS_ASAP_NUM) |
4944 			BIT(NL80211_FTM_STATS_NON_ASAP_NUM) |
4945 			BIT(NL80211_FTM_STATS_TOTAL_DURATION_MSEC) |
4946 			BIT(NL80211_FTM_STATS_UNKNOWN_TRIGGERS_NUM) |
4947 			BIT(NL80211_FTM_STATS_RESCHEDULE_REQUESTS_NUM) |
4948 			BIT(NL80211_FTM_STATS_OUT_OF_WINDOW_TRIGGERS_NUM);
4949 
4950 	return 0;
4951 }
4952 
4953 static int iwl_mvm_start_pmsr(struct ieee80211_hw *hw,
4954 			      struct ieee80211_vif *vif,
4955 			      struct cfg80211_pmsr_request *request)
4956 {
4957 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4958 	int ret;
4959 
4960 	mutex_lock(&mvm->mutex);
4961 	ret = iwl_mvm_ftm_start(mvm, vif, request);
4962 	mutex_unlock(&mvm->mutex);
4963 
4964 	return ret;
4965 }
4966 
4967 static void iwl_mvm_abort_pmsr(struct ieee80211_hw *hw,
4968 			       struct ieee80211_vif *vif,
4969 			       struct cfg80211_pmsr_request *request)
4970 {
4971 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4972 
4973 	mutex_lock(&mvm->mutex);
4974 	iwl_mvm_ftm_abort(mvm, request);
4975 	mutex_unlock(&mvm->mutex);
4976 }
4977 
4978 static bool iwl_mvm_can_hw_csum(struct sk_buff *skb)
4979 {
4980 	u8 protocol = ip_hdr(skb)->protocol;
4981 
4982 	if (!IS_ENABLED(CONFIG_INET))
4983 		return false;
4984 
4985 	return protocol == IPPROTO_TCP || protocol == IPPROTO_UDP;
4986 }
4987 
4988 static bool iwl_mvm_mac_can_aggregate(struct ieee80211_hw *hw,
4989 				      struct sk_buff *head,
4990 				      struct sk_buff *skb)
4991 {
4992 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4993 
4994 	/* For now don't aggregate IPv6 in AMSDU */
4995 	if (skb->protocol != htons(ETH_P_IP))
4996 		return false;
4997 
4998 	if (!iwl_mvm_is_csum_supported(mvm))
4999 		return true;
5000 
5001 	return iwl_mvm_can_hw_csum(skb) == iwl_mvm_can_hw_csum(head);
5002 }
5003 
5004 const struct ieee80211_ops iwl_mvm_hw_ops = {
5005 	.tx = iwl_mvm_mac_tx,
5006 	.wake_tx_queue = iwl_mvm_mac_wake_tx_queue,
5007 	.ampdu_action = iwl_mvm_mac_ampdu_action,
5008 	.start = iwl_mvm_mac_start,
5009 	.reconfig_complete = iwl_mvm_mac_reconfig_complete,
5010 	.stop = iwl_mvm_mac_stop,
5011 	.add_interface = iwl_mvm_mac_add_interface,
5012 	.remove_interface = iwl_mvm_mac_remove_interface,
5013 	.config = iwl_mvm_mac_config,
5014 	.prepare_multicast = iwl_mvm_prepare_multicast,
5015 	.configure_filter = iwl_mvm_configure_filter,
5016 	.config_iface_filter = iwl_mvm_config_iface_filter,
5017 	.bss_info_changed = iwl_mvm_bss_info_changed,
5018 	.hw_scan = iwl_mvm_mac_hw_scan,
5019 	.cancel_hw_scan = iwl_mvm_mac_cancel_hw_scan,
5020 	.sta_pre_rcu_remove = iwl_mvm_sta_pre_rcu_remove,
5021 	.sta_state = iwl_mvm_mac_sta_state,
5022 	.sta_notify = iwl_mvm_mac_sta_notify,
5023 	.allow_buffered_frames = iwl_mvm_mac_allow_buffered_frames,
5024 	.release_buffered_frames = iwl_mvm_mac_release_buffered_frames,
5025 	.set_rts_threshold = iwl_mvm_mac_set_rts_threshold,
5026 	.sta_rc_update = iwl_mvm_sta_rc_update,
5027 	.conf_tx = iwl_mvm_mac_conf_tx,
5028 	.mgd_prepare_tx = iwl_mvm_mac_mgd_prepare_tx,
5029 	.mgd_protect_tdls_discover = iwl_mvm_mac_mgd_protect_tdls_discover,
5030 	.flush = iwl_mvm_mac_flush,
5031 	.sched_scan_start = iwl_mvm_mac_sched_scan_start,
5032 	.sched_scan_stop = iwl_mvm_mac_sched_scan_stop,
5033 	.set_key = iwl_mvm_mac_set_key,
5034 	.update_tkip_key = iwl_mvm_mac_update_tkip_key,
5035 	.remain_on_channel = iwl_mvm_roc,
5036 	.cancel_remain_on_channel = iwl_mvm_cancel_roc,
5037 	.add_chanctx = iwl_mvm_add_chanctx,
5038 	.remove_chanctx = iwl_mvm_remove_chanctx,
5039 	.change_chanctx = iwl_mvm_change_chanctx,
5040 	.assign_vif_chanctx = iwl_mvm_assign_vif_chanctx,
5041 	.unassign_vif_chanctx = iwl_mvm_unassign_vif_chanctx,
5042 	.switch_vif_chanctx = iwl_mvm_switch_vif_chanctx,
5043 
5044 	.start_ap = iwl_mvm_start_ap_ibss,
5045 	.stop_ap = iwl_mvm_stop_ap_ibss,
5046 	.join_ibss = iwl_mvm_start_ap_ibss,
5047 	.leave_ibss = iwl_mvm_stop_ap_ibss,
5048 
5049 	.tx_last_beacon = iwl_mvm_tx_last_beacon,
5050 
5051 	.set_tim = iwl_mvm_set_tim,
5052 
5053 	.channel_switch = iwl_mvm_channel_switch,
5054 	.pre_channel_switch = iwl_mvm_pre_channel_switch,
5055 	.post_channel_switch = iwl_mvm_post_channel_switch,
5056 	.abort_channel_switch = iwl_mvm_abort_channel_switch,
5057 	.channel_switch_rx_beacon = iwl_mvm_channel_switch_rx_beacon,
5058 
5059 	.tdls_channel_switch = iwl_mvm_tdls_channel_switch,
5060 	.tdls_cancel_channel_switch = iwl_mvm_tdls_cancel_channel_switch,
5061 	.tdls_recv_channel_switch = iwl_mvm_tdls_recv_channel_switch,
5062 
5063 	.event_callback = iwl_mvm_mac_event_callback,
5064 
5065 	.sync_rx_queues = iwl_mvm_sync_rx_queues,
5066 
5067 	CFG80211_TESTMODE_CMD(iwl_mvm_mac_testmode_cmd)
5068 
5069 #ifdef CONFIG_PM_SLEEP
5070 	/* look at d3.c */
5071 	.suspend = iwl_mvm_suspend,
5072 	.resume = iwl_mvm_resume,
5073 	.set_wakeup = iwl_mvm_set_wakeup,
5074 	.set_rekey_data = iwl_mvm_set_rekey_data,
5075 #if IS_ENABLED(CONFIG_IPV6)
5076 	.ipv6_addr_change = iwl_mvm_ipv6_addr_change,
5077 #endif
5078 	.set_default_unicast_key = iwl_mvm_set_default_unicast_key,
5079 #endif
5080 	.get_survey = iwl_mvm_mac_get_survey,
5081 	.sta_statistics = iwl_mvm_mac_sta_statistics,
5082 	.get_ftm_responder_stats = iwl_mvm_mac_get_ftm_responder_stats,
5083 	.start_pmsr = iwl_mvm_start_pmsr,
5084 	.abort_pmsr = iwl_mvm_abort_pmsr,
5085 
5086 	.can_aggregate_in_amsdu = iwl_mvm_mac_can_aggregate,
5087 #ifdef CONFIG_IWLWIFI_DEBUGFS
5088 	.sta_add_debugfs = iwl_mvm_sta_add_debugfs,
5089 #endif
5090 };
5091