1 /******************************************************************************
2  *
3  * This file is provided under a dual BSD/GPLv2 license.  When using or
4  * redistributing this file, you may do so under either license.
5  *
6  * GPL LICENSE SUMMARY
7  *
8  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
9  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
10  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
11  *
12  * This program is free software; you can redistribute it and/or modify
13  * it under the terms of version 2 of the GNU General Public License as
14  * published by the Free Software Foundation.
15  *
16  * This program is distributed in the hope that it will be useful, but
17  * WITHOUT ANY WARRANTY; without even the implied warranty of
18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
19  * General Public License for more details.
20  *
21  * You should have received a copy of the GNU General Public License
22  * along with this program; if not, write to the Free Software
23  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
24  * USA
25  *
26  * The full GNU General Public License is included in this distribution
27  * in the file called COPYING.
28  *
29  * Contact Information:
30  *  Intel Linux Wireless <linuxwifi@intel.com>
31  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
32  *
33  * BSD LICENSE
34  *
35  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
36  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
37  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
38  * All rights reserved.
39  *
40  * Redistribution and use in source and binary forms, with or without
41  * modification, are permitted provided that the following conditions
42  * are met:
43  *
44  *  * Redistributions of source code must retain the above copyright
45  *    notice, this list of conditions and the following disclaimer.
46  *  * Redistributions in binary form must reproduce the above copyright
47  *    notice, this list of conditions and the following disclaimer in
48  *    the documentation and/or other materials provided with the
49  *    distribution.
50  *  * Neither the name Intel Corporation nor the names of its
51  *    contributors may be used to endorse or promote products derived
52  *    from this software without specific prior written permission.
53  *
54  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
55  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
56  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
57  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
58  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
59  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
60  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
61  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
62  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
63  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
64  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
65  *
66  *****************************************************************************/
67 #include <linux/kernel.h>
68 #include <linux/slab.h>
69 #include <linux/skbuff.h>
70 #include <linux/netdevice.h>
71 #include <linux/etherdevice.h>
72 #include <linux/ip.h>
73 #include <linux/if_arp.h>
74 #include <linux/time.h>
75 #include <net/mac80211.h>
76 #include <net/ieee80211_radiotap.h>
77 #include <net/tcp.h>
78 
79 #include "iwl-op-mode.h"
80 #include "iwl-io.h"
81 #include "mvm.h"
82 #include "sta.h"
83 #include "time-event.h"
84 #include "iwl-eeprom-parse.h"
85 #include "iwl-phy-db.h"
86 #include "testmode.h"
87 #include "fw/error-dump.h"
88 #include "iwl-prph.h"
89 #include "iwl-nvm-parse.h"
90 
91 static const struct ieee80211_iface_limit iwl_mvm_limits[] = {
92 	{
93 		.max = 1,
94 		.types = BIT(NL80211_IFTYPE_STATION),
95 	},
96 	{
97 		.max = 1,
98 		.types = BIT(NL80211_IFTYPE_AP) |
99 			BIT(NL80211_IFTYPE_P2P_CLIENT) |
100 			BIT(NL80211_IFTYPE_P2P_GO),
101 	},
102 	{
103 		.max = 1,
104 		.types = BIT(NL80211_IFTYPE_P2P_DEVICE),
105 	},
106 };
107 
108 static const struct ieee80211_iface_combination iwl_mvm_iface_combinations[] = {
109 	{
110 		.num_different_channels = 2,
111 		.max_interfaces = 3,
112 		.limits = iwl_mvm_limits,
113 		.n_limits = ARRAY_SIZE(iwl_mvm_limits),
114 	},
115 };
116 
117 #ifdef CONFIG_PM_SLEEP
118 static const struct nl80211_wowlan_tcp_data_token_feature
119 iwl_mvm_wowlan_tcp_token_feature = {
120 	.min_len = 0,
121 	.max_len = 255,
122 	.bufsize = IWL_WOWLAN_REMOTE_WAKE_MAX_TOKENS,
123 };
124 
125 static const struct wiphy_wowlan_tcp_support iwl_mvm_wowlan_tcp_support = {
126 	.tok = &iwl_mvm_wowlan_tcp_token_feature,
127 	.data_payload_max = IWL_WOWLAN_TCP_MAX_PACKET_LEN -
128 			    sizeof(struct ethhdr) -
129 			    sizeof(struct iphdr) -
130 			    sizeof(struct tcphdr),
131 	.data_interval_max = 65535, /* __le16 in API */
132 	.wake_payload_max = IWL_WOWLAN_REMOTE_WAKE_MAX_PACKET_LEN -
133 			    sizeof(struct ethhdr) -
134 			    sizeof(struct iphdr) -
135 			    sizeof(struct tcphdr),
136 	.seq = true,
137 };
138 #endif
139 
140 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
141 /*
142  * Use the reserved field to indicate magic values.
143  * these values will only be used internally by the driver,
144  * and won't make it to the fw (reserved will be 0).
145  * BC_FILTER_MAGIC_IP - configure the val of this attribute to
146  *	be the vif's ip address. in case there is not a single
147  *	ip address (0, or more than 1), this attribute will
148  *	be skipped.
149  * BC_FILTER_MAGIC_MAC - set the val of this attribute to
150  *	the LSB bytes of the vif's mac address
151  */
152 enum {
153 	BC_FILTER_MAGIC_NONE = 0,
154 	BC_FILTER_MAGIC_IP,
155 	BC_FILTER_MAGIC_MAC,
156 };
157 
158 static const struct iwl_fw_bcast_filter iwl_mvm_default_bcast_filters[] = {
159 	{
160 		/* arp */
161 		.discard = 0,
162 		.frame_type = BCAST_FILTER_FRAME_TYPE_ALL,
163 		.attrs = {
164 			{
165 				/* frame type - arp, hw type - ethernet */
166 				.offset_type =
167 					BCAST_FILTER_OFFSET_PAYLOAD_START,
168 				.offset = sizeof(rfc1042_header),
169 				.val = cpu_to_be32(0x08060001),
170 				.mask = cpu_to_be32(0xffffffff),
171 			},
172 			{
173 				/* arp dest ip */
174 				.offset_type =
175 					BCAST_FILTER_OFFSET_PAYLOAD_START,
176 				.offset = sizeof(rfc1042_header) + 2 +
177 					  sizeof(struct arphdr) +
178 					  ETH_ALEN + sizeof(__be32) +
179 					  ETH_ALEN,
180 				.mask = cpu_to_be32(0xffffffff),
181 				/* mark it as special field */
182 				.reserved1 = cpu_to_le16(BC_FILTER_MAGIC_IP),
183 			},
184 		},
185 	},
186 	{
187 		/* dhcp offer bcast */
188 		.discard = 0,
189 		.frame_type = BCAST_FILTER_FRAME_TYPE_IPV4,
190 		.attrs = {
191 			{
192 				/* udp dest port - 68 (bootp client)*/
193 				.offset_type = BCAST_FILTER_OFFSET_IP_END,
194 				.offset = offsetof(struct udphdr, dest),
195 				.val = cpu_to_be32(0x00440000),
196 				.mask = cpu_to_be32(0xffff0000),
197 			},
198 			{
199 				/* dhcp - lsb bytes of client hw address */
200 				.offset_type = BCAST_FILTER_OFFSET_IP_END,
201 				.offset = 38,
202 				.mask = cpu_to_be32(0xffffffff),
203 				/* mark it as special field */
204 				.reserved1 = cpu_to_le16(BC_FILTER_MAGIC_MAC),
205 			},
206 		},
207 	},
208 	/* last filter must be empty */
209 	{},
210 };
211 #endif
212 
213 void iwl_mvm_ref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
214 {
215 	if (!iwl_mvm_is_d0i3_supported(mvm))
216 		return;
217 
218 	IWL_DEBUG_RPM(mvm, "Take mvm reference - type %d\n", ref_type);
219 	spin_lock_bh(&mvm->refs_lock);
220 	mvm->refs[ref_type]++;
221 	spin_unlock_bh(&mvm->refs_lock);
222 	iwl_trans_ref(mvm->trans);
223 }
224 
225 void iwl_mvm_unref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
226 {
227 	if (!iwl_mvm_is_d0i3_supported(mvm))
228 		return;
229 
230 	IWL_DEBUG_RPM(mvm, "Leave mvm reference - type %d\n", ref_type);
231 	spin_lock_bh(&mvm->refs_lock);
232 	if (WARN_ON(!mvm->refs[ref_type])) {
233 		spin_unlock_bh(&mvm->refs_lock);
234 		return;
235 	}
236 	mvm->refs[ref_type]--;
237 	spin_unlock_bh(&mvm->refs_lock);
238 	iwl_trans_unref(mvm->trans);
239 }
240 
241 static void iwl_mvm_unref_all_except(struct iwl_mvm *mvm,
242 				     enum iwl_mvm_ref_type except_ref)
243 {
244 	int i, j;
245 
246 	if (!iwl_mvm_is_d0i3_supported(mvm))
247 		return;
248 
249 	spin_lock_bh(&mvm->refs_lock);
250 	for (i = 0; i < IWL_MVM_REF_COUNT; i++) {
251 		if (except_ref == i || !mvm->refs[i])
252 			continue;
253 
254 		IWL_DEBUG_RPM(mvm, "Cleanup: remove mvm ref type %d (%d)\n",
255 			      i, mvm->refs[i]);
256 		for (j = 0; j < mvm->refs[i]; j++)
257 			iwl_trans_unref(mvm->trans);
258 		mvm->refs[i] = 0;
259 	}
260 	spin_unlock_bh(&mvm->refs_lock);
261 }
262 
263 bool iwl_mvm_ref_taken(struct iwl_mvm *mvm)
264 {
265 	int i;
266 	bool taken = false;
267 
268 	if (!iwl_mvm_is_d0i3_supported(mvm))
269 		return true;
270 
271 	spin_lock_bh(&mvm->refs_lock);
272 	for (i = 0; i < IWL_MVM_REF_COUNT; i++) {
273 		if (mvm->refs[i]) {
274 			taken = true;
275 			break;
276 		}
277 	}
278 	spin_unlock_bh(&mvm->refs_lock);
279 
280 	return taken;
281 }
282 
283 int iwl_mvm_ref_sync(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
284 {
285 	iwl_mvm_ref(mvm, ref_type);
286 
287 	if (!wait_event_timeout(mvm->d0i3_exit_waitq,
288 				!test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status),
289 				HZ)) {
290 		WARN_ON_ONCE(1);
291 		iwl_mvm_unref(mvm, ref_type);
292 		return -EIO;
293 	}
294 
295 	return 0;
296 }
297 
298 static void iwl_mvm_reset_phy_ctxts(struct iwl_mvm *mvm)
299 {
300 	int i;
301 
302 	memset(mvm->phy_ctxts, 0, sizeof(mvm->phy_ctxts));
303 	for (i = 0; i < NUM_PHY_CTX; i++) {
304 		mvm->phy_ctxts[i].id = i;
305 		mvm->phy_ctxts[i].ref = 0;
306 	}
307 }
308 
309 struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
310 						  const char *alpha2,
311 						  enum iwl_mcc_source src_id,
312 						  bool *changed)
313 {
314 	struct ieee80211_regdomain *regd = NULL;
315 	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
316 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
317 	struct iwl_mcc_update_resp *resp;
318 
319 	IWL_DEBUG_LAR(mvm, "Getting regdomain data for %s from FW\n", alpha2);
320 
321 	lockdep_assert_held(&mvm->mutex);
322 
323 	resp = iwl_mvm_update_mcc(mvm, alpha2, src_id);
324 	if (IS_ERR_OR_NULL(resp)) {
325 		IWL_DEBUG_LAR(mvm, "Could not get update from FW %d\n",
326 			      PTR_ERR_OR_ZERO(resp));
327 		goto out;
328 	}
329 
330 	if (changed)
331 		*changed = (resp->status == MCC_RESP_NEW_CHAN_PROFILE);
332 
333 	regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg,
334 				      __le32_to_cpu(resp->n_channels),
335 				      resp->channels,
336 				      __le16_to_cpu(resp->mcc));
337 	/* Store the return source id */
338 	src_id = resp->source_id;
339 	kfree(resp);
340 	if (IS_ERR_OR_NULL(regd)) {
341 		IWL_DEBUG_LAR(mvm, "Could not get parse update from FW %d\n",
342 			      PTR_ERR_OR_ZERO(regd));
343 		goto out;
344 	}
345 
346 	IWL_DEBUG_LAR(mvm, "setting alpha2 from FW to %s (0x%x, 0x%x) src=%d\n",
347 		      regd->alpha2, regd->alpha2[0], regd->alpha2[1], src_id);
348 	mvm->lar_regdom_set = true;
349 	mvm->mcc_src = src_id;
350 
351 out:
352 	return regd;
353 }
354 
355 void iwl_mvm_update_changed_regdom(struct iwl_mvm *mvm)
356 {
357 	bool changed;
358 	struct ieee80211_regdomain *regd;
359 
360 	if (!iwl_mvm_is_lar_supported(mvm))
361 		return;
362 
363 	regd = iwl_mvm_get_current_regdomain(mvm, &changed);
364 	if (!IS_ERR_OR_NULL(regd)) {
365 		/* only update the regulatory core if changed */
366 		if (changed)
367 			regulatory_set_wiphy_regd(mvm->hw->wiphy, regd);
368 
369 		kfree(regd);
370 	}
371 }
372 
373 struct ieee80211_regdomain *iwl_mvm_get_current_regdomain(struct iwl_mvm *mvm,
374 							  bool *changed)
375 {
376 	return iwl_mvm_get_regdomain(mvm->hw->wiphy, "ZZ",
377 				     iwl_mvm_is_wifi_mcc_supported(mvm) ?
378 				     MCC_SOURCE_GET_CURRENT :
379 				     MCC_SOURCE_OLD_FW, changed);
380 }
381 
382 int iwl_mvm_init_fw_regd(struct iwl_mvm *mvm)
383 {
384 	enum iwl_mcc_source used_src;
385 	struct ieee80211_regdomain *regd;
386 	int ret;
387 	bool changed;
388 	const struct ieee80211_regdomain *r =
389 			rtnl_dereference(mvm->hw->wiphy->regd);
390 
391 	if (!r)
392 		return -ENOENT;
393 
394 	/* save the last source in case we overwrite it below */
395 	used_src = mvm->mcc_src;
396 	if (iwl_mvm_is_wifi_mcc_supported(mvm)) {
397 		/* Notify the firmware we support wifi location updates */
398 		regd = iwl_mvm_get_current_regdomain(mvm, NULL);
399 		if (!IS_ERR_OR_NULL(regd))
400 			kfree(regd);
401 	}
402 
403 	/* Now set our last stored MCC and source */
404 	regd = iwl_mvm_get_regdomain(mvm->hw->wiphy, r->alpha2, used_src,
405 				     &changed);
406 	if (IS_ERR_OR_NULL(regd))
407 		return -EIO;
408 
409 	/* update cfg80211 if the regdomain was changed */
410 	if (changed)
411 		ret = regulatory_set_wiphy_regd_sync_rtnl(mvm->hw->wiphy, regd);
412 	else
413 		ret = 0;
414 
415 	kfree(regd);
416 	return ret;
417 }
418 
419 int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
420 {
421 	struct ieee80211_hw *hw = mvm->hw;
422 	int num_mac, ret, i;
423 	static const u32 mvm_ciphers[] = {
424 		WLAN_CIPHER_SUITE_WEP40,
425 		WLAN_CIPHER_SUITE_WEP104,
426 		WLAN_CIPHER_SUITE_TKIP,
427 		WLAN_CIPHER_SUITE_CCMP,
428 	};
429 
430 	/* Tell mac80211 our characteristics */
431 	ieee80211_hw_set(hw, SIGNAL_DBM);
432 	ieee80211_hw_set(hw, SPECTRUM_MGMT);
433 	ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
434 	ieee80211_hw_set(hw, QUEUE_CONTROL);
435 	ieee80211_hw_set(hw, WANT_MONITOR_VIF);
436 	ieee80211_hw_set(hw, SUPPORTS_PS);
437 	ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
438 	ieee80211_hw_set(hw, AMPDU_AGGREGATION);
439 	ieee80211_hw_set(hw, TIMING_BEACON_ONLY);
440 	ieee80211_hw_set(hw, CONNECTION_MONITOR);
441 	ieee80211_hw_set(hw, CHANCTX_STA_CSA);
442 	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
443 	ieee80211_hw_set(hw, SUPPORTS_CLONED_SKBS);
444 	ieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);
445 	ieee80211_hw_set(hw, NEEDS_UNIQUE_STA_ADDR);
446 	if (iwl_mvm_has_new_rx_api(mvm))
447 		ieee80211_hw_set(hw, SUPPORTS_REORDERING_BUFFER);
448 
449 	if (fw_has_capa(&mvm->fw->ucode_capa,
450 			IWL_UCODE_TLV_CAPA_STA_PM_NOTIF)) {
451 		ieee80211_hw_set(hw, AP_LINK_PS);
452 	} else if (WARN_ON(iwl_mvm_has_new_tx_api(mvm))) {
453 		/*
454 		 * we absolutely need this for the new TX API since that comes
455 		 * with many more queues than the current code can deal with
456 		 * for station powersave
457 		 */
458 		return -EINVAL;
459 	}
460 
461 	if (mvm->trans->num_rx_queues > 1)
462 		ieee80211_hw_set(hw, USES_RSS);
463 
464 	if (mvm->trans->max_skb_frags)
465 		hw->netdev_features = NETIF_F_HIGHDMA | NETIF_F_SG;
466 
467 	hw->queues = IEEE80211_MAX_QUEUES;
468 	hw->offchannel_tx_hw_queue = IWL_MVM_OFFCHANNEL_QUEUE;
469 	hw->radiotap_mcs_details |= IEEE80211_RADIOTAP_MCS_HAVE_FEC |
470 				    IEEE80211_RADIOTAP_MCS_HAVE_STBC;
471 	hw->radiotap_vht_details |= IEEE80211_RADIOTAP_VHT_KNOWN_STBC |
472 		IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED;
473 
474 	hw->radiotap_timestamp.units_pos =
475 		IEEE80211_RADIOTAP_TIMESTAMP_UNIT_US |
476 		IEEE80211_RADIOTAP_TIMESTAMP_SPOS_PLCP_SIG_ACQ;
477 	/* this is the case for CCK frames, it's better (only 8) for OFDM */
478 	hw->radiotap_timestamp.accuracy = 22;
479 
480 	hw->rate_control_algorithm = "iwl-mvm-rs";
481 	hw->uapsd_queues = IWL_MVM_UAPSD_QUEUES;
482 	hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
483 
484 	BUILD_BUG_ON(ARRAY_SIZE(mvm->ciphers) < ARRAY_SIZE(mvm_ciphers) + 6);
485 	memcpy(mvm->ciphers, mvm_ciphers, sizeof(mvm_ciphers));
486 	hw->wiphy->n_cipher_suites = ARRAY_SIZE(mvm_ciphers);
487 	hw->wiphy->cipher_suites = mvm->ciphers;
488 
489 	if (iwl_mvm_has_new_rx_api(mvm)) {
490 		mvm->ciphers[hw->wiphy->n_cipher_suites] =
491 			WLAN_CIPHER_SUITE_GCMP;
492 		hw->wiphy->n_cipher_suites++;
493 		mvm->ciphers[hw->wiphy->n_cipher_suites] =
494 			WLAN_CIPHER_SUITE_GCMP_256;
495 		hw->wiphy->n_cipher_suites++;
496 	}
497 
498 	/* Enable 11w if software crypto is not enabled (as the
499 	 * firmware will interpret some mgmt packets, so enabling it
500 	 * with software crypto isn't safe).
501 	 */
502 	if (!iwlwifi_mod_params.swcrypto) {
503 		ieee80211_hw_set(hw, MFP_CAPABLE);
504 		mvm->ciphers[hw->wiphy->n_cipher_suites] =
505 			WLAN_CIPHER_SUITE_AES_CMAC;
506 		hw->wiphy->n_cipher_suites++;
507 		if (iwl_mvm_has_new_rx_api(mvm)) {
508 			mvm->ciphers[hw->wiphy->n_cipher_suites] =
509 				WLAN_CIPHER_SUITE_BIP_GMAC_128;
510 			hw->wiphy->n_cipher_suites++;
511 			mvm->ciphers[hw->wiphy->n_cipher_suites] =
512 				WLAN_CIPHER_SUITE_BIP_GMAC_256;
513 			hw->wiphy->n_cipher_suites++;
514 		}
515 	}
516 
517 	/* currently FW API supports only one optional cipher scheme */
518 	if (mvm->fw->cs[0].cipher) {
519 		const struct iwl_fw_cipher_scheme *fwcs = &mvm->fw->cs[0];
520 		struct ieee80211_cipher_scheme *cs = &mvm->cs[0];
521 
522 		mvm->hw->n_cipher_schemes = 1;
523 
524 		cs->cipher = le32_to_cpu(fwcs->cipher);
525 		cs->iftype = BIT(NL80211_IFTYPE_STATION);
526 		cs->hdr_len = fwcs->hdr_len;
527 		cs->pn_len = fwcs->pn_len;
528 		cs->pn_off = fwcs->pn_off;
529 		cs->key_idx_off = fwcs->key_idx_off;
530 		cs->key_idx_mask = fwcs->key_idx_mask;
531 		cs->key_idx_shift = fwcs->key_idx_shift;
532 		cs->mic_len = fwcs->mic_len;
533 
534 		mvm->hw->cipher_schemes = mvm->cs;
535 		mvm->ciphers[hw->wiphy->n_cipher_suites] = cs->cipher;
536 		hw->wiphy->n_cipher_suites++;
537 	}
538 
539 	ieee80211_hw_set(hw, SINGLE_SCAN_ON_ALL_BANDS);
540 	hw->wiphy->features |=
541 		NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR |
542 		NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR |
543 		NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
544 
545 	hw->sta_data_size = sizeof(struct iwl_mvm_sta);
546 	hw->vif_data_size = sizeof(struct iwl_mvm_vif);
547 	hw->chanctx_data_size = sizeof(u16);
548 
549 	hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
550 		BIT(NL80211_IFTYPE_P2P_CLIENT) |
551 		BIT(NL80211_IFTYPE_AP) |
552 		BIT(NL80211_IFTYPE_P2P_GO) |
553 		BIT(NL80211_IFTYPE_P2P_DEVICE) |
554 		BIT(NL80211_IFTYPE_ADHOC);
555 
556 	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
557 	hw->wiphy->regulatory_flags |= REGULATORY_ENABLE_RELAX_NO_IR;
558 	if (iwl_mvm_is_lar_supported(mvm))
559 		hw->wiphy->regulatory_flags |= REGULATORY_WIPHY_SELF_MANAGED;
560 	else
561 		hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG |
562 					       REGULATORY_DISABLE_BEACON_HINTS;
563 
564 	hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
565 	hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
566 
567 	hw->wiphy->iface_combinations = iwl_mvm_iface_combinations;
568 	hw->wiphy->n_iface_combinations =
569 		ARRAY_SIZE(iwl_mvm_iface_combinations);
570 
571 	hw->wiphy->max_remain_on_channel_duration = 10000;
572 	hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
573 	/* we can compensate an offset of up to 3 channels = 15 MHz */
574 	hw->wiphy->max_adj_channel_rssi_comp = 3 * 5;
575 
576 	/* Extract MAC address */
577 	memcpy(mvm->addresses[0].addr, mvm->nvm_data->hw_addr, ETH_ALEN);
578 	hw->wiphy->addresses = mvm->addresses;
579 	hw->wiphy->n_addresses = 1;
580 
581 	/* Extract additional MAC addresses if available */
582 	num_mac = (mvm->nvm_data->n_hw_addrs > 1) ?
583 		min(IWL_MVM_MAX_ADDRESSES, mvm->nvm_data->n_hw_addrs) : 1;
584 
585 	for (i = 1; i < num_mac; i++) {
586 		memcpy(mvm->addresses[i].addr, mvm->addresses[i-1].addr,
587 		       ETH_ALEN);
588 		mvm->addresses[i].addr[5]++;
589 		hw->wiphy->n_addresses++;
590 	}
591 
592 	iwl_mvm_reset_phy_ctxts(mvm);
593 
594 	hw->wiphy->max_scan_ie_len = iwl_mvm_max_scan_ie_len(mvm);
595 
596 	hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
597 
598 	BUILD_BUG_ON(IWL_MVM_SCAN_STOPPING_MASK & IWL_MVM_SCAN_MASK);
599 	BUILD_BUG_ON(IWL_MVM_MAX_UMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK) ||
600 		     IWL_MVM_MAX_LMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK));
601 
602 	if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
603 		mvm->max_scans = IWL_MVM_MAX_UMAC_SCANS;
604 	else
605 		mvm->max_scans = IWL_MVM_MAX_LMAC_SCANS;
606 
607 	if (mvm->nvm_data->bands[NL80211_BAND_2GHZ].n_channels)
608 		hw->wiphy->bands[NL80211_BAND_2GHZ] =
609 			&mvm->nvm_data->bands[NL80211_BAND_2GHZ];
610 	if (mvm->nvm_data->bands[NL80211_BAND_5GHZ].n_channels) {
611 		hw->wiphy->bands[NL80211_BAND_5GHZ] =
612 			&mvm->nvm_data->bands[NL80211_BAND_5GHZ];
613 
614 		if (fw_has_capa(&mvm->fw->ucode_capa,
615 				IWL_UCODE_TLV_CAPA_BEAMFORMER) &&
616 		    fw_has_api(&mvm->fw->ucode_capa,
617 			       IWL_UCODE_TLV_API_LQ_SS_PARAMS))
618 			hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.cap |=
619 				IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
620 	}
621 
622 	hw->wiphy->hw_version = mvm->trans->hw_id;
623 
624 	if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM)
625 		hw->wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
626 	else
627 		hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
628 
629 	hw->wiphy->max_sched_scan_reqs = 1;
630 	hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
631 	hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
632 	/* we create the 802.11 header and zero length SSID IE. */
633 	hw->wiphy->max_sched_scan_ie_len =
634 		SCAN_OFFLOAD_PROBE_REQ_SIZE - 24 - 2;
635 	hw->wiphy->max_sched_scan_plans = IWL_MAX_SCHED_SCAN_PLANS;
636 	hw->wiphy->max_sched_scan_plan_interval = U16_MAX;
637 
638 	/*
639 	 * the firmware uses u8 for num of iterations, but 0xff is saved for
640 	 * infinite loop, so the maximum number of iterations is actually 254.
641 	 */
642 	hw->wiphy->max_sched_scan_plan_iterations = 254;
643 
644 	hw->wiphy->features |= NL80211_FEATURE_P2P_GO_CTWIN |
645 			       NL80211_FEATURE_LOW_PRIORITY_SCAN |
646 			       NL80211_FEATURE_P2P_GO_OPPPS |
647 			       NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
648 			       NL80211_FEATURE_DYNAMIC_SMPS |
649 			       NL80211_FEATURE_STATIC_SMPS |
650 			       NL80211_FEATURE_SUPPORTS_WMM_ADMISSION;
651 
652 	if (fw_has_capa(&mvm->fw->ucode_capa,
653 			IWL_UCODE_TLV_CAPA_TXPOWER_INSERTION_SUPPORT))
654 		hw->wiphy->features |= NL80211_FEATURE_TX_POWER_INSERTION;
655 	if (fw_has_capa(&mvm->fw->ucode_capa,
656 			IWL_UCODE_TLV_CAPA_QUIET_PERIOD_SUPPORT))
657 		hw->wiphy->features |= NL80211_FEATURE_QUIET;
658 
659 	if (fw_has_capa(&mvm->fw->ucode_capa,
660 			IWL_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT))
661 		hw->wiphy->features |=
662 			NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES;
663 
664 	if (fw_has_capa(&mvm->fw->ucode_capa,
665 			IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT))
666 		hw->wiphy->features |= NL80211_FEATURE_WFA_TPC_IE_IN_PROBES;
667 
668 	if (fw_has_api(&mvm->fw->ucode_capa,
669 		       IWL_UCODE_TLV_API_SCAN_TSF_REPORT)) {
670 		wiphy_ext_feature_set(hw->wiphy,
671 				      NL80211_EXT_FEATURE_SCAN_START_TIME);
672 		wiphy_ext_feature_set(hw->wiphy,
673 				      NL80211_EXT_FEATURE_BSS_PARENT_TSF);
674 		wiphy_ext_feature_set(hw->wiphy,
675 				      NL80211_EXT_FEATURE_SET_SCAN_DWELL);
676 	}
677 
678 	mvm->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
679 
680 #ifdef CONFIG_PM_SLEEP
681 	if (iwl_mvm_is_d0i3_supported(mvm) &&
682 	    device_can_wakeup(mvm->trans->dev)) {
683 		mvm->wowlan.flags = WIPHY_WOWLAN_ANY;
684 		hw->wiphy->wowlan = &mvm->wowlan;
685 	}
686 
687 	if (mvm->fw->img[IWL_UCODE_WOWLAN].num_sec &&
688 	    mvm->trans->ops->d3_suspend &&
689 	    mvm->trans->ops->d3_resume &&
690 	    device_can_wakeup(mvm->trans->dev)) {
691 		mvm->wowlan.flags |= WIPHY_WOWLAN_MAGIC_PKT |
692 				     WIPHY_WOWLAN_DISCONNECT |
693 				     WIPHY_WOWLAN_EAP_IDENTITY_REQ |
694 				     WIPHY_WOWLAN_RFKILL_RELEASE |
695 				     WIPHY_WOWLAN_NET_DETECT;
696 		if (!iwlwifi_mod_params.swcrypto)
697 			mvm->wowlan.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY |
698 					     WIPHY_WOWLAN_GTK_REKEY_FAILURE |
699 					     WIPHY_WOWLAN_4WAY_HANDSHAKE;
700 
701 		mvm->wowlan.n_patterns = IWL_WOWLAN_MAX_PATTERNS;
702 		mvm->wowlan.pattern_min_len = IWL_WOWLAN_MIN_PATTERN_LEN;
703 		mvm->wowlan.pattern_max_len = IWL_WOWLAN_MAX_PATTERN_LEN;
704 		mvm->wowlan.max_nd_match_sets = IWL_SCAN_MAX_PROFILES;
705 		mvm->wowlan.tcp = &iwl_mvm_wowlan_tcp_support;
706 		hw->wiphy->wowlan = &mvm->wowlan;
707 	}
708 #endif
709 
710 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
711 	/* assign default bcast filtering configuration */
712 	mvm->bcast_filters = iwl_mvm_default_bcast_filters;
713 #endif
714 
715 	ret = iwl_mvm_leds_init(mvm);
716 	if (ret)
717 		return ret;
718 
719 	if (fw_has_capa(&mvm->fw->ucode_capa,
720 			IWL_UCODE_TLV_CAPA_TDLS_SUPPORT)) {
721 		IWL_DEBUG_TDLS(mvm, "TDLS supported\n");
722 		hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
723 		ieee80211_hw_set(hw, TDLS_WIDER_BW);
724 	}
725 
726 	if (fw_has_capa(&mvm->fw->ucode_capa,
727 			IWL_UCODE_TLV_CAPA_TDLS_CHANNEL_SWITCH)) {
728 		IWL_DEBUG_TDLS(mvm, "TDLS channel switch supported\n");
729 		hw->wiphy->features |= NL80211_FEATURE_TDLS_CHANNEL_SWITCH;
730 	}
731 
732 	hw->netdev_features |= mvm->cfg->features;
733 	if (!iwl_mvm_is_csum_supported(mvm)) {
734 		hw->netdev_features &= ~(IWL_TX_CSUM_NETIF_FLAGS |
735 					 NETIF_F_RXCSUM);
736 		/* We may support SW TX CSUM */
737 		if (IWL_MVM_SW_TX_CSUM_OFFLOAD)
738 			hw->netdev_features |= IWL_TX_CSUM_NETIF_FLAGS;
739 	}
740 
741 	ret = ieee80211_register_hw(mvm->hw);
742 	if (ret)
743 		iwl_mvm_leds_exit(mvm);
744 	mvm->init_status |= IWL_MVM_INIT_STATUS_REG_HW_INIT_COMPLETE;
745 
746 	if (mvm->cfg->vht_mu_mimo_supported)
747 		wiphy_ext_feature_set(hw->wiphy,
748 				      NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER);
749 
750 	return ret;
751 }
752 
753 static bool iwl_mvm_defer_tx(struct iwl_mvm *mvm,
754 			     struct ieee80211_sta *sta,
755 			     struct sk_buff *skb)
756 {
757 	struct iwl_mvm_sta *mvmsta;
758 	bool defer = false;
759 
760 	/*
761 	 * double check the IN_D0I3 flag both before and after
762 	 * taking the spinlock, in order to prevent taking
763 	 * the spinlock when not needed.
764 	 */
765 	if (likely(!test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status)))
766 		return false;
767 
768 	spin_lock(&mvm->d0i3_tx_lock);
769 	/*
770 	 * testing the flag again ensures the skb dequeue
771 	 * loop (on d0i3 exit) hasn't run yet.
772 	 */
773 	if (!test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status))
774 		goto out;
775 
776 	mvmsta = iwl_mvm_sta_from_mac80211(sta);
777 	if (mvmsta->sta_id == IWL_MVM_INVALID_STA ||
778 	    mvmsta->sta_id != mvm->d0i3_ap_sta_id)
779 		goto out;
780 
781 	__skb_queue_tail(&mvm->d0i3_tx, skb);
782 	ieee80211_stop_queues(mvm->hw);
783 
784 	/* trigger wakeup */
785 	iwl_mvm_ref(mvm, IWL_MVM_REF_TX);
786 	iwl_mvm_unref(mvm, IWL_MVM_REF_TX);
787 
788 	defer = true;
789 out:
790 	spin_unlock(&mvm->d0i3_tx_lock);
791 	return defer;
792 }
793 
794 static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
795 			   struct ieee80211_tx_control *control,
796 			   struct sk_buff *skb)
797 {
798 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
799 	struct ieee80211_sta *sta = control->sta;
800 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
801 	struct ieee80211_hdr *hdr = (void *)skb->data;
802 
803 	if (iwl_mvm_is_radio_killed(mvm)) {
804 		IWL_DEBUG_DROP(mvm, "Dropping - RF/CT KILL\n");
805 		goto drop;
806 	}
807 
808 	if (info->hw_queue == IWL_MVM_OFFCHANNEL_QUEUE &&
809 	    !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status) &&
810 	    !test_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status))
811 		goto drop;
812 
813 	/* treat non-bufferable MMPDUs on AP interfaces as broadcast */
814 	if ((info->control.vif->type == NL80211_IFTYPE_AP ||
815 	     info->control.vif->type == NL80211_IFTYPE_ADHOC) &&
816 	    ieee80211_is_mgmt(hdr->frame_control) &&
817 	    !ieee80211_is_bufferable_mmpdu(hdr->frame_control))
818 		sta = NULL;
819 
820 	if (sta) {
821 		if (iwl_mvm_defer_tx(mvm, sta, skb))
822 			return;
823 		if (iwl_mvm_tx_skb(mvm, skb, sta))
824 			goto drop;
825 		return;
826 	}
827 
828 	if (iwl_mvm_tx_skb_non_sta(mvm, skb))
829 		goto drop;
830 	return;
831  drop:
832 	ieee80211_free_txskb(hw, skb);
833 }
834 
835 static inline bool iwl_enable_rx_ampdu(const struct iwl_cfg *cfg)
836 {
837 	if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG)
838 		return false;
839 	return true;
840 }
841 
842 static inline bool iwl_enable_tx_ampdu(const struct iwl_cfg *cfg)
843 {
844 	if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG)
845 		return false;
846 	if (iwlwifi_mod_params.disable_11n & IWL_ENABLE_HT_TXAGG)
847 		return true;
848 
849 	/* enabled by default */
850 	return true;
851 }
852 
853 #define CHECK_BA_TRIGGER(_mvm, _trig, _tid_bm, _tid, _fmt...)		\
854 	do {								\
855 		if (!(le16_to_cpu(_tid_bm) & BIT(_tid)))		\
856 			break;						\
857 		iwl_fw_dbg_collect_trig(&(_mvm)->fwrt, _trig, _fmt);	\
858 	} while (0)
859 
860 static void
861 iwl_mvm_ampdu_check_trigger(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
862 			    struct ieee80211_sta *sta, u16 tid, u16 rx_ba_ssn,
863 			    enum ieee80211_ampdu_mlme_action action)
864 {
865 	struct iwl_fw_dbg_trigger_tlv *trig;
866 	struct iwl_fw_dbg_trigger_ba *ba_trig;
867 
868 	if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_BA))
869 		return;
870 
871 	trig = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_BA);
872 	ba_trig = (void *)trig->data;
873 
874 	if (!iwl_fw_dbg_trigger_check_stop(&mvm->fwrt,
875 					   ieee80211_vif_to_wdev(vif), trig))
876 		return;
877 
878 	switch (action) {
879 	case IEEE80211_AMPDU_TX_OPERATIONAL: {
880 		struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
881 		struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
882 
883 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_start, tid,
884 				 "TX AGG START: MAC %pM tid %d ssn %d\n",
885 				 sta->addr, tid, tid_data->ssn);
886 		break;
887 		}
888 	case IEEE80211_AMPDU_TX_STOP_CONT:
889 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_stop, tid,
890 				 "TX AGG STOP: MAC %pM tid %d\n",
891 				 sta->addr, tid);
892 		break;
893 	case IEEE80211_AMPDU_RX_START:
894 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_start, tid,
895 				 "RX AGG START: MAC %pM tid %d ssn %d\n",
896 				 sta->addr, tid, rx_ba_ssn);
897 		break;
898 	case IEEE80211_AMPDU_RX_STOP:
899 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_stop, tid,
900 				 "RX AGG STOP: MAC %pM tid %d\n",
901 				 sta->addr, tid);
902 		break;
903 	default:
904 		break;
905 	}
906 }
907 
908 static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
909 				    struct ieee80211_vif *vif,
910 				    struct ieee80211_ampdu_params *params)
911 {
912 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
913 	int ret;
914 	bool tx_agg_ref = false;
915 	struct ieee80211_sta *sta = params->sta;
916 	enum ieee80211_ampdu_mlme_action action = params->action;
917 	u16 tid = params->tid;
918 	u16 *ssn = &params->ssn;
919 	u8 buf_size = params->buf_size;
920 	bool amsdu = params->amsdu;
921 	u16 timeout = params->timeout;
922 
923 	IWL_DEBUG_HT(mvm, "A-MPDU action on addr %pM tid %d: action %d\n",
924 		     sta->addr, tid, action);
925 
926 	if (!(mvm->nvm_data->sku_cap_11n_enable))
927 		return -EACCES;
928 
929 	/* return from D0i3 before starting a new Tx aggregation */
930 	switch (action) {
931 	case IEEE80211_AMPDU_TX_START:
932 	case IEEE80211_AMPDU_TX_STOP_CONT:
933 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
934 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
935 	case IEEE80211_AMPDU_TX_OPERATIONAL:
936 		/*
937 		 * for tx start, wait synchronously until D0i3 exit to
938 		 * get the correct sequence number for the tid.
939 		 * additionally, some other ampdu actions use direct
940 		 * target access, which is not handled automatically
941 		 * by the trans layer (unlike commands), so wait for
942 		 * d0i3 exit in these cases as well.
943 		 */
944 		ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_TX_AGG);
945 		if (ret)
946 			return ret;
947 
948 		tx_agg_ref = true;
949 		break;
950 	default:
951 		break;
952 	}
953 
954 	mutex_lock(&mvm->mutex);
955 
956 	switch (action) {
957 	case IEEE80211_AMPDU_RX_START:
958 		if (!iwl_enable_rx_ampdu(mvm->cfg)) {
959 			ret = -EINVAL;
960 			break;
961 		}
962 		ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, *ssn, true, buf_size,
963 					 timeout);
964 		break;
965 	case IEEE80211_AMPDU_RX_STOP:
966 		ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, 0, false, buf_size,
967 					 timeout);
968 		break;
969 	case IEEE80211_AMPDU_TX_START:
970 		if (!iwl_enable_tx_ampdu(mvm->cfg)) {
971 			ret = -EINVAL;
972 			break;
973 		}
974 		ret = iwl_mvm_sta_tx_agg_start(mvm, vif, sta, tid, ssn);
975 		break;
976 	case IEEE80211_AMPDU_TX_STOP_CONT:
977 		ret = iwl_mvm_sta_tx_agg_stop(mvm, vif, sta, tid);
978 		break;
979 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
980 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
981 		ret = iwl_mvm_sta_tx_agg_flush(mvm, vif, sta, tid);
982 		break;
983 	case IEEE80211_AMPDU_TX_OPERATIONAL:
984 		ret = iwl_mvm_sta_tx_agg_oper(mvm, vif, sta, tid,
985 					      buf_size, amsdu);
986 		break;
987 	default:
988 		WARN_ON_ONCE(1);
989 		ret = -EINVAL;
990 		break;
991 	}
992 
993 	if (!ret) {
994 		u16 rx_ba_ssn = 0;
995 
996 		if (action == IEEE80211_AMPDU_RX_START)
997 			rx_ba_ssn = *ssn;
998 
999 		iwl_mvm_ampdu_check_trigger(mvm, vif, sta, tid,
1000 					    rx_ba_ssn, action);
1001 	}
1002 	mutex_unlock(&mvm->mutex);
1003 
1004 	/*
1005 	 * If the tid is marked as started, we won't use it for offloaded
1006 	 * traffic on the next D0i3 entry. It's safe to unref.
1007 	 */
1008 	if (tx_agg_ref)
1009 		iwl_mvm_unref(mvm, IWL_MVM_REF_TX_AGG);
1010 
1011 	return ret;
1012 }
1013 
1014 static void iwl_mvm_cleanup_iterator(void *data, u8 *mac,
1015 				     struct ieee80211_vif *vif)
1016 {
1017 	struct iwl_mvm *mvm = data;
1018 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1019 
1020 	mvmvif->uploaded = false;
1021 	mvmvif->ap_sta_id = IWL_MVM_INVALID_STA;
1022 
1023 	spin_lock_bh(&mvm->time_event_lock);
1024 	iwl_mvm_te_clear_data(mvm, &mvmvif->time_event_data);
1025 	spin_unlock_bh(&mvm->time_event_lock);
1026 
1027 	mvmvif->phy_ctxt = NULL;
1028 	memset(&mvmvif->bf_data, 0, sizeof(mvmvif->bf_data));
1029 }
1030 
1031 static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
1032 {
1033 	/* clear the D3 reconfig, we only need it to avoid dumping a
1034 	 * firmware coredump on reconfiguration, we shouldn't do that
1035 	 * on D3->D0 transition
1036 	 */
1037 	if (!test_and_clear_bit(IWL_MVM_STATUS_D3_RECONFIG, &mvm->status)) {
1038 		mvm->fwrt.dump.desc = &iwl_dump_desc_assert;
1039 		iwl_fw_error_dump(&mvm->fwrt);
1040 	}
1041 
1042 	/* cleanup all stale references (scan, roc), but keep the
1043 	 * ucode_down ref until reconfig is complete
1044 	 */
1045 	iwl_mvm_unref_all_except(mvm, IWL_MVM_REF_UCODE_DOWN);
1046 
1047 	iwl_mvm_stop_device(mvm);
1048 
1049 	mvm->scan_status = 0;
1050 	mvm->ps_disabled = false;
1051 	mvm->calibrating = false;
1052 
1053 	/* just in case one was running */
1054 	iwl_mvm_cleanup_roc_te(mvm);
1055 	ieee80211_remain_on_channel_expired(mvm->hw);
1056 
1057 	/*
1058 	 * cleanup all interfaces, even inactive ones, as some might have
1059 	 * gone down during the HW restart
1060 	 */
1061 	ieee80211_iterate_interfaces(mvm->hw, 0, iwl_mvm_cleanup_iterator, mvm);
1062 
1063 	mvm->p2p_device_vif = NULL;
1064 	mvm->d0i3_ap_sta_id = IWL_MVM_INVALID_STA;
1065 
1066 	iwl_mvm_reset_phy_ctxts(mvm);
1067 	memset(mvm->fw_key_table, 0, sizeof(mvm->fw_key_table));
1068 	memset(mvm->sta_deferred_frames, 0, sizeof(mvm->sta_deferred_frames));
1069 	memset(&mvm->last_bt_notif, 0, sizeof(mvm->last_bt_notif));
1070 	memset(&mvm->last_bt_ci_cmd, 0, sizeof(mvm->last_bt_ci_cmd));
1071 
1072 	ieee80211_wake_queues(mvm->hw);
1073 
1074 	/* clear any stale d0i3 state */
1075 	clear_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status);
1076 
1077 	mvm->vif_count = 0;
1078 	mvm->rx_ba_sessions = 0;
1079 	mvm->fwrt.dump.conf = FW_DBG_INVALID;
1080 	mvm->monitor_on = false;
1081 
1082 	/* keep statistics ticking */
1083 	iwl_mvm_accu_radio_stats(mvm);
1084 }
1085 
1086 int __iwl_mvm_mac_start(struct iwl_mvm *mvm)
1087 {
1088 	int ret;
1089 
1090 	lockdep_assert_held(&mvm->mutex);
1091 
1092 	if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status)) {
1093 		/*
1094 		 * Now convert the HW_RESTART_REQUESTED flag to IN_HW_RESTART
1095 		 * so later code will - from now on - see that we're doing it.
1096 		 */
1097 		set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1098 		clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status);
1099 		/* Clean up some internal and mac80211 state on restart */
1100 		iwl_mvm_restart_cleanup(mvm);
1101 	} else {
1102 		/* Hold the reference to prevent runtime suspend while
1103 		 * the start procedure runs.  It's a bit confusing
1104 		 * that the UCODE_DOWN reference is taken, but it just
1105 		 * means "UCODE is not UP yet". ( TODO: rename this
1106 		 * reference).
1107 		 */
1108 		iwl_mvm_ref(mvm, IWL_MVM_REF_UCODE_DOWN);
1109 	}
1110 	ret = iwl_mvm_up(mvm);
1111 
1112 	if (ret && test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
1113 		/* Something went wrong - we need to finish some cleanup
1114 		 * that normally iwl_mvm_mac_restart_complete() below
1115 		 * would do.
1116 		 */
1117 		clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1118 		iwl_mvm_d0i3_enable_tx(mvm, NULL);
1119 	}
1120 
1121 	return ret;
1122 }
1123 
1124 static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
1125 {
1126 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1127 	int ret;
1128 
1129 	/* Some hw restart cleanups must not hold the mutex */
1130 	if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
1131 		/*
1132 		 * Make sure we are out of d0i3. This is needed
1133 		 * to make sure the reference accounting is correct
1134 		 * (and there is no stale d0i3_exit_work).
1135 		 */
1136 		wait_event_timeout(mvm->d0i3_exit_waitq,
1137 				   !test_bit(IWL_MVM_STATUS_IN_D0I3,
1138 					     &mvm->status),
1139 				   HZ);
1140 	}
1141 
1142 	mutex_lock(&mvm->mutex);
1143 	ret = __iwl_mvm_mac_start(mvm);
1144 	mutex_unlock(&mvm->mutex);
1145 
1146 	return ret;
1147 }
1148 
1149 static void iwl_mvm_restart_complete(struct iwl_mvm *mvm)
1150 {
1151 	int ret;
1152 
1153 	mutex_lock(&mvm->mutex);
1154 
1155 	clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1156 	iwl_mvm_d0i3_enable_tx(mvm, NULL);
1157 	ret = iwl_mvm_update_quotas(mvm, true, NULL);
1158 	if (ret)
1159 		IWL_ERR(mvm, "Failed to update quotas after restart (%d)\n",
1160 			ret);
1161 
1162 	/* allow transport/FW low power modes */
1163 	iwl_mvm_unref(mvm, IWL_MVM_REF_UCODE_DOWN);
1164 
1165 	/*
1166 	 * If we have TDLS peers, remove them. We don't know the last seqno/PN
1167 	 * of packets the FW sent out, so we must reconnect.
1168 	 */
1169 	iwl_mvm_teardown_tdls_peers(mvm);
1170 
1171 	mutex_unlock(&mvm->mutex);
1172 }
1173 
1174 static void iwl_mvm_resume_complete(struct iwl_mvm *mvm)
1175 {
1176 	if (iwl_mvm_is_d0i3_supported(mvm) &&
1177 	    iwl_mvm_enter_d0i3_on_suspend(mvm))
1178 		WARN_ONCE(!wait_event_timeout(mvm->d0i3_exit_waitq,
1179 					      !test_bit(IWL_MVM_STATUS_IN_D0I3,
1180 							&mvm->status),
1181 					      HZ),
1182 			  "D0i3 exit on resume timed out\n");
1183 }
1184 
1185 static void
1186 iwl_mvm_mac_reconfig_complete(struct ieee80211_hw *hw,
1187 			      enum ieee80211_reconfig_type reconfig_type)
1188 {
1189 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1190 
1191 	switch (reconfig_type) {
1192 	case IEEE80211_RECONFIG_TYPE_RESTART:
1193 		iwl_mvm_restart_complete(mvm);
1194 		break;
1195 	case IEEE80211_RECONFIG_TYPE_SUSPEND:
1196 		iwl_mvm_resume_complete(mvm);
1197 		break;
1198 	}
1199 }
1200 
1201 void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
1202 {
1203 	lockdep_assert_held(&mvm->mutex);
1204 
1205 	/* firmware counters are obviously reset now, but we shouldn't
1206 	 * partially track so also clear the fw_reset_accu counters.
1207 	 */
1208 	memset(&mvm->accu_radio_stats, 0, sizeof(mvm->accu_radio_stats));
1209 
1210 	/* async_handlers_wk is now blocked */
1211 
1212 	/*
1213 	 * The work item could be running or queued if the
1214 	 * ROC time event stops just as we get here.
1215 	 */
1216 	flush_work(&mvm->roc_done_wk);
1217 
1218 	iwl_mvm_stop_device(mvm);
1219 
1220 	iwl_mvm_async_handlers_purge(mvm);
1221 	/* async_handlers_list is empty and will stay empty: HW is stopped */
1222 
1223 	/* the fw is stopped, the aux sta is dead: clean up driver state */
1224 	iwl_mvm_del_aux_sta(mvm);
1225 
1226 	/*
1227 	 * Clear IN_HW_RESTART flag when stopping the hw (as restart_complete()
1228 	 * won't be called in this case).
1229 	 * But make sure to cleanup interfaces that have gone down before/during
1230 	 * HW restart was requested.
1231 	 */
1232 	if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
1233 		ieee80211_iterate_interfaces(mvm->hw, 0,
1234 					     iwl_mvm_cleanup_iterator, mvm);
1235 
1236 	/* We shouldn't have any UIDs still set.  Loop over all the UIDs to
1237 	 * make sure there's nothing left there and warn if any is found.
1238 	 */
1239 	if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1240 		int i;
1241 
1242 		for (i = 0; i < mvm->max_scans; i++) {
1243 			if (WARN_ONCE(mvm->scan_uid_status[i],
1244 				      "UMAC scan UID %d status was not cleaned\n",
1245 				      i))
1246 				mvm->scan_uid_status[i] = 0;
1247 		}
1248 	}
1249 }
1250 
1251 static void iwl_mvm_mac_stop(struct ieee80211_hw *hw)
1252 {
1253 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1254 
1255 	flush_work(&mvm->d0i3_exit_work);
1256 	flush_work(&mvm->async_handlers_wk);
1257 	flush_work(&mvm->add_stream_wk);
1258 
1259 	/*
1260 	 * Lock and clear the firmware running bit here already, so that
1261 	 * new commands coming in elsewhere, e.g. from debugfs, will not
1262 	 * be able to proceed. This is important here because one of those
1263 	 * debugfs files causes the firmware dump to be triggered, and if we
1264 	 * don't stop debugfs accesses before canceling that it could be
1265 	 * retriggered after we flush it but before we've cleared the bit.
1266 	 */
1267 	clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status);
1268 
1269 	iwl_fw_cancel_dump(&mvm->fwrt);
1270 	cancel_delayed_work_sync(&mvm->cs_tx_unblock_dwork);
1271 	cancel_delayed_work_sync(&mvm->scan_timeout_dwork);
1272 	iwl_fw_free_dump_desc(&mvm->fwrt);
1273 
1274 	mutex_lock(&mvm->mutex);
1275 	__iwl_mvm_mac_stop(mvm);
1276 	mutex_unlock(&mvm->mutex);
1277 
1278 	/*
1279 	 * The worker might have been waiting for the mutex, let it run and
1280 	 * discover that its list is now empty.
1281 	 */
1282 	cancel_work_sync(&mvm->async_handlers_wk);
1283 }
1284 
1285 static struct iwl_mvm_phy_ctxt *iwl_mvm_get_free_phy_ctxt(struct iwl_mvm *mvm)
1286 {
1287 	u16 i;
1288 
1289 	lockdep_assert_held(&mvm->mutex);
1290 
1291 	for (i = 0; i < NUM_PHY_CTX; i++)
1292 		if (!mvm->phy_ctxts[i].ref)
1293 			return &mvm->phy_ctxts[i];
1294 
1295 	IWL_ERR(mvm, "No available PHY context\n");
1296 	return NULL;
1297 }
1298 
1299 static int iwl_mvm_set_tx_power(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1300 				s16 tx_power)
1301 {
1302 	struct iwl_dev_tx_power_cmd cmd = {
1303 		.v3.set_mode = cpu_to_le32(IWL_TX_POWER_MODE_SET_MAC),
1304 		.v3.mac_context_id =
1305 			cpu_to_le32(iwl_mvm_vif_from_mac80211(vif)->id),
1306 		.v3.pwr_restriction = cpu_to_le16(8 * tx_power),
1307 	};
1308 	int len = sizeof(cmd);
1309 
1310 	if (tx_power == IWL_DEFAULT_MAX_TX_POWER)
1311 		cmd.v3.pwr_restriction = cpu_to_le16(IWL_DEV_MAX_TX_POWER);
1312 
1313 	if (!fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_TX_POWER_ACK))
1314 		len = sizeof(cmd.v3);
1315 
1316 	return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, 0, len, &cmd);
1317 }
1318 
1319 static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
1320 				     struct ieee80211_vif *vif)
1321 {
1322 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1323 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1324 	int ret;
1325 
1326 	mvmvif->mvm = mvm;
1327 
1328 	/*
1329 	 * make sure D0i3 exit is completed, otherwise a target access
1330 	 * during tx queue configuration could be done when still in
1331 	 * D0i3 state.
1332 	 */
1333 	ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_ADD_IF);
1334 	if (ret)
1335 		return ret;
1336 
1337 	/*
1338 	 * Not much to do here. The stack will not allow interface
1339 	 * types or combinations that we didn't advertise, so we
1340 	 * don't really have to check the types.
1341 	 */
1342 
1343 	mutex_lock(&mvm->mutex);
1344 
1345 	/* make sure that beacon statistics don't go backwards with FW reset */
1346 	if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
1347 		mvmvif->beacon_stats.accu_num_beacons +=
1348 			mvmvif->beacon_stats.num_beacons;
1349 
1350 	/* Allocate resources for the MAC context, and add it to the fw  */
1351 	ret = iwl_mvm_mac_ctxt_init(mvm, vif);
1352 	if (ret)
1353 		goto out_unlock;
1354 
1355 	/* Counting number of interfaces is needed for legacy PM */
1356 	if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1357 		mvm->vif_count++;
1358 
1359 	/*
1360 	 * The AP binding flow can be done only after the beacon
1361 	 * template is configured (which happens only in the mac80211
1362 	 * start_ap() flow), and adding the broadcast station can happen
1363 	 * only after the binding.
1364 	 * In addition, since modifying the MAC before adding a bcast
1365 	 * station is not allowed by the FW, delay the adding of MAC context to
1366 	 * the point where we can also add the bcast station.
1367 	 * In short: there's not much we can do at this point, other than
1368 	 * allocating resources :)
1369 	 */
1370 	if (vif->type == NL80211_IFTYPE_AP ||
1371 	    vif->type == NL80211_IFTYPE_ADHOC) {
1372 		ret = iwl_mvm_alloc_bcast_sta(mvm, vif);
1373 		if (ret) {
1374 			IWL_ERR(mvm, "Failed to allocate bcast sta\n");
1375 			goto out_release;
1376 		}
1377 
1378 		/*
1379 		 * Only queue for this station is the mcast queue,
1380 		 * which shouldn't be in TFD mask anyway
1381 		 */
1382 		ret = iwl_mvm_allocate_int_sta(mvm, &mvmvif->mcast_sta,
1383 					       0, vif->type,
1384 					       IWL_STA_MULTICAST);
1385 		if (ret)
1386 			goto out_release;
1387 
1388 		iwl_mvm_vif_dbgfs_register(mvm, vif);
1389 		goto out_unlock;
1390 	}
1391 
1392 	mvmvif->features |= hw->netdev_features;
1393 
1394 	ret = iwl_mvm_mac_ctxt_add(mvm, vif);
1395 	if (ret)
1396 		goto out_release;
1397 
1398 	ret = iwl_mvm_power_update_mac(mvm);
1399 	if (ret)
1400 		goto out_remove_mac;
1401 
1402 	/* beacon filtering */
1403 	ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
1404 	if (ret)
1405 		goto out_remove_mac;
1406 
1407 	if (!mvm->bf_allowed_vif &&
1408 	    vif->type == NL80211_IFTYPE_STATION && !vif->p2p) {
1409 		mvm->bf_allowed_vif = mvmvif;
1410 		vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
1411 				     IEEE80211_VIF_SUPPORTS_CQM_RSSI;
1412 	}
1413 
1414 	/*
1415 	 * P2P_DEVICE interface does not have a channel context assigned to it,
1416 	 * so a dedicated PHY context is allocated to it and the corresponding
1417 	 * MAC context is bound to it at this stage.
1418 	 */
1419 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1420 
1421 		mvmvif->phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
1422 		if (!mvmvif->phy_ctxt) {
1423 			ret = -ENOSPC;
1424 			goto out_free_bf;
1425 		}
1426 
1427 		iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
1428 		ret = iwl_mvm_binding_add_vif(mvm, vif);
1429 		if (ret)
1430 			goto out_unref_phy;
1431 
1432 		ret = iwl_mvm_add_p2p_bcast_sta(mvm, vif);
1433 		if (ret)
1434 			goto out_unbind;
1435 
1436 		/* Save a pointer to p2p device vif, so it can later be used to
1437 		 * update the p2p device MAC when a GO is started/stopped */
1438 		mvm->p2p_device_vif = vif;
1439 	}
1440 
1441 	if (vif->type == NL80211_IFTYPE_MONITOR)
1442 		mvm->monitor_on = true;
1443 
1444 	iwl_mvm_vif_dbgfs_register(mvm, vif);
1445 	goto out_unlock;
1446 
1447  out_unbind:
1448 	iwl_mvm_binding_remove_vif(mvm, vif);
1449  out_unref_phy:
1450 	iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1451  out_free_bf:
1452 	if (mvm->bf_allowed_vif == mvmvif) {
1453 		mvm->bf_allowed_vif = NULL;
1454 		vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1455 				       IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1456 	}
1457  out_remove_mac:
1458 	mvmvif->phy_ctxt = NULL;
1459 	iwl_mvm_mac_ctxt_remove(mvm, vif);
1460  out_release:
1461 	if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1462 		mvm->vif_count--;
1463  out_unlock:
1464 	mutex_unlock(&mvm->mutex);
1465 
1466 	iwl_mvm_unref(mvm, IWL_MVM_REF_ADD_IF);
1467 
1468 	return ret;
1469 }
1470 
1471 static void iwl_mvm_prepare_mac_removal(struct iwl_mvm *mvm,
1472 					struct ieee80211_vif *vif)
1473 {
1474 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1475 		/*
1476 		 * Flush the ROC worker which will flush the OFFCHANNEL queue.
1477 		 * We assume here that all the packets sent to the OFFCHANNEL
1478 		 * queue are sent in ROC session.
1479 		 */
1480 		flush_work(&mvm->roc_done_wk);
1481 	}
1482 }
1483 
1484 static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
1485 					 struct ieee80211_vif *vif)
1486 {
1487 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1488 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1489 
1490 	iwl_mvm_prepare_mac_removal(mvm, vif);
1491 
1492 	mutex_lock(&mvm->mutex);
1493 
1494 	if (mvm->bf_allowed_vif == mvmvif) {
1495 		mvm->bf_allowed_vif = NULL;
1496 		vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1497 				       IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1498 	}
1499 
1500 	iwl_mvm_vif_dbgfs_clean(mvm, vif);
1501 
1502 	/*
1503 	 * For AP/GO interface, the tear down of the resources allocated to the
1504 	 * interface is be handled as part of the stop_ap flow.
1505 	 */
1506 	if (vif->type == NL80211_IFTYPE_AP ||
1507 	    vif->type == NL80211_IFTYPE_ADHOC) {
1508 #ifdef CONFIG_NL80211_TESTMODE
1509 		if (vif == mvm->noa_vif) {
1510 			mvm->noa_vif = NULL;
1511 			mvm->noa_duration = 0;
1512 		}
1513 #endif
1514 		iwl_mvm_dealloc_int_sta(mvm, &mvmvif->mcast_sta);
1515 		iwl_mvm_dealloc_bcast_sta(mvm, vif);
1516 		goto out_release;
1517 	}
1518 
1519 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1520 		mvm->p2p_device_vif = NULL;
1521 		iwl_mvm_rm_p2p_bcast_sta(mvm, vif);
1522 		iwl_mvm_binding_remove_vif(mvm, vif);
1523 		iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1524 		mvmvif->phy_ctxt = NULL;
1525 	}
1526 
1527 	if (mvm->vif_count && vif->type != NL80211_IFTYPE_P2P_DEVICE)
1528 		mvm->vif_count--;
1529 
1530 	iwl_mvm_power_update_mac(mvm);
1531 	iwl_mvm_mac_ctxt_remove(mvm, vif);
1532 
1533 	if (vif->type == NL80211_IFTYPE_MONITOR)
1534 		mvm->monitor_on = false;
1535 
1536 out_release:
1537 	mutex_unlock(&mvm->mutex);
1538 }
1539 
1540 static int iwl_mvm_mac_config(struct ieee80211_hw *hw, u32 changed)
1541 {
1542 	return 0;
1543 }
1544 
1545 struct iwl_mvm_mc_iter_data {
1546 	struct iwl_mvm *mvm;
1547 	int port_id;
1548 };
1549 
1550 static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
1551 				      struct ieee80211_vif *vif)
1552 {
1553 	struct iwl_mvm_mc_iter_data *data = _data;
1554 	struct iwl_mvm *mvm = data->mvm;
1555 	struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd;
1556 	struct iwl_host_cmd hcmd = {
1557 		.id = MCAST_FILTER_CMD,
1558 		.flags = CMD_ASYNC,
1559 		.dataflags[0] = IWL_HCMD_DFL_NOCOPY,
1560 	};
1561 	int ret, len;
1562 
1563 	/* if we don't have free ports, mcast frames will be dropped */
1564 	if (WARN_ON_ONCE(data->port_id >= MAX_PORT_ID_NUM))
1565 		return;
1566 
1567 	if (vif->type != NL80211_IFTYPE_STATION ||
1568 	    !vif->bss_conf.assoc)
1569 		return;
1570 
1571 	cmd->port_id = data->port_id++;
1572 	memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
1573 	len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4);
1574 
1575 	hcmd.len[0] = len;
1576 	hcmd.data[0] = cmd;
1577 
1578 	ret = iwl_mvm_send_cmd(mvm, &hcmd);
1579 	if (ret)
1580 		IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret);
1581 }
1582 
1583 static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm)
1584 {
1585 	struct iwl_mvm_mc_iter_data iter_data = {
1586 		.mvm = mvm,
1587 	};
1588 
1589 	lockdep_assert_held(&mvm->mutex);
1590 
1591 	if (WARN_ON_ONCE(!mvm->mcast_filter_cmd))
1592 		return;
1593 
1594 	ieee80211_iterate_active_interfaces_atomic(
1595 		mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1596 		iwl_mvm_mc_iface_iterator, &iter_data);
1597 }
1598 
1599 static u64 iwl_mvm_prepare_multicast(struct ieee80211_hw *hw,
1600 				     struct netdev_hw_addr_list *mc_list)
1601 {
1602 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1603 	struct iwl_mcast_filter_cmd *cmd;
1604 	struct netdev_hw_addr *addr;
1605 	int addr_count;
1606 	bool pass_all;
1607 	int len;
1608 
1609 	addr_count = netdev_hw_addr_list_count(mc_list);
1610 	pass_all = addr_count > MAX_MCAST_FILTERING_ADDRESSES ||
1611 		   IWL_MVM_FW_MCAST_FILTER_PASS_ALL;
1612 	if (pass_all)
1613 		addr_count = 0;
1614 
1615 	len = roundup(sizeof(*cmd) + addr_count * ETH_ALEN, 4);
1616 	cmd = kzalloc(len, GFP_ATOMIC);
1617 	if (!cmd)
1618 		return 0;
1619 
1620 	if (pass_all) {
1621 		cmd->pass_all = 1;
1622 		return (u64)(unsigned long)cmd;
1623 	}
1624 
1625 	netdev_hw_addr_list_for_each(addr, mc_list) {
1626 		IWL_DEBUG_MAC80211(mvm, "mcast addr (%d): %pM\n",
1627 				   cmd->count, addr->addr);
1628 		memcpy(&cmd->addr_list[cmd->count * ETH_ALEN],
1629 		       addr->addr, ETH_ALEN);
1630 		cmd->count++;
1631 	}
1632 
1633 	return (u64)(unsigned long)cmd;
1634 }
1635 
1636 static void iwl_mvm_configure_filter(struct ieee80211_hw *hw,
1637 				     unsigned int changed_flags,
1638 				     unsigned int *total_flags,
1639 				     u64 multicast)
1640 {
1641 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1642 	struct iwl_mcast_filter_cmd *cmd = (void *)(unsigned long)multicast;
1643 
1644 	mutex_lock(&mvm->mutex);
1645 
1646 	/* replace previous configuration */
1647 	kfree(mvm->mcast_filter_cmd);
1648 	mvm->mcast_filter_cmd = cmd;
1649 
1650 	if (!cmd)
1651 		goto out;
1652 
1653 	if (changed_flags & FIF_ALLMULTI)
1654 		cmd->pass_all = !!(*total_flags & FIF_ALLMULTI);
1655 
1656 	if (cmd->pass_all)
1657 		cmd->count = 0;
1658 
1659 	iwl_mvm_recalc_multicast(mvm);
1660 out:
1661 	mutex_unlock(&mvm->mutex);
1662 	*total_flags = 0;
1663 }
1664 
1665 static void iwl_mvm_config_iface_filter(struct ieee80211_hw *hw,
1666 					struct ieee80211_vif *vif,
1667 					unsigned int filter_flags,
1668 					unsigned int changed_flags)
1669 {
1670 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1671 
1672 	/* We support only filter for probe requests */
1673 	if (!(changed_flags & FIF_PROBE_REQ))
1674 		return;
1675 
1676 	/* Supported only for p2p client interfaces */
1677 	if (vif->type != NL80211_IFTYPE_STATION || !vif->bss_conf.assoc ||
1678 	    !vif->p2p)
1679 		return;
1680 
1681 	mutex_lock(&mvm->mutex);
1682 	iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
1683 	mutex_unlock(&mvm->mutex);
1684 }
1685 
1686 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
1687 struct iwl_bcast_iter_data {
1688 	struct iwl_mvm *mvm;
1689 	struct iwl_bcast_filter_cmd *cmd;
1690 	u8 current_filter;
1691 };
1692 
1693 static void
1694 iwl_mvm_set_bcast_filter(struct ieee80211_vif *vif,
1695 			 const struct iwl_fw_bcast_filter *in_filter,
1696 			 struct iwl_fw_bcast_filter *out_filter)
1697 {
1698 	struct iwl_fw_bcast_filter_attr *attr;
1699 	int i;
1700 
1701 	memcpy(out_filter, in_filter, sizeof(*out_filter));
1702 
1703 	for (i = 0; i < ARRAY_SIZE(out_filter->attrs); i++) {
1704 		attr = &out_filter->attrs[i];
1705 
1706 		if (!attr->mask)
1707 			break;
1708 
1709 		switch (attr->reserved1) {
1710 		case cpu_to_le16(BC_FILTER_MAGIC_IP):
1711 			if (vif->bss_conf.arp_addr_cnt != 1) {
1712 				attr->mask = 0;
1713 				continue;
1714 			}
1715 
1716 			attr->val = vif->bss_conf.arp_addr_list[0];
1717 			break;
1718 		case cpu_to_le16(BC_FILTER_MAGIC_MAC):
1719 			attr->val = *(__be32 *)&vif->addr[2];
1720 			break;
1721 		default:
1722 			break;
1723 		}
1724 		attr->reserved1 = 0;
1725 		out_filter->num_attrs++;
1726 	}
1727 }
1728 
1729 static void iwl_mvm_bcast_filter_iterator(void *_data, u8 *mac,
1730 					  struct ieee80211_vif *vif)
1731 {
1732 	struct iwl_bcast_iter_data *data = _data;
1733 	struct iwl_mvm *mvm = data->mvm;
1734 	struct iwl_bcast_filter_cmd *cmd = data->cmd;
1735 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1736 	struct iwl_fw_bcast_mac *bcast_mac;
1737 	int i;
1738 
1739 	if (WARN_ON(mvmvif->id >= ARRAY_SIZE(cmd->macs)))
1740 		return;
1741 
1742 	bcast_mac = &cmd->macs[mvmvif->id];
1743 
1744 	/*
1745 	 * enable filtering only for associated stations, but not for P2P
1746 	 * Clients
1747 	 */
1748 	if (vif->type != NL80211_IFTYPE_STATION || vif->p2p ||
1749 	    !vif->bss_conf.assoc)
1750 		return;
1751 
1752 	bcast_mac->default_discard = 1;
1753 
1754 	/* copy all configured filters */
1755 	for (i = 0; mvm->bcast_filters[i].attrs[0].mask; i++) {
1756 		/*
1757 		 * Make sure we don't exceed our filters limit.
1758 		 * if there is still a valid filter to be configured,
1759 		 * be on the safe side and just allow bcast for this mac.
1760 		 */
1761 		if (WARN_ON_ONCE(data->current_filter >=
1762 				 ARRAY_SIZE(cmd->filters))) {
1763 			bcast_mac->default_discard = 0;
1764 			bcast_mac->attached_filters = 0;
1765 			break;
1766 		}
1767 
1768 		iwl_mvm_set_bcast_filter(vif,
1769 					 &mvm->bcast_filters[i],
1770 					 &cmd->filters[data->current_filter]);
1771 
1772 		/* skip current filter if it contains no attributes */
1773 		if (!cmd->filters[data->current_filter].num_attrs)
1774 			continue;
1775 
1776 		/* attach the filter to current mac */
1777 		bcast_mac->attached_filters |=
1778 				cpu_to_le16(BIT(data->current_filter));
1779 
1780 		data->current_filter++;
1781 	}
1782 }
1783 
1784 bool iwl_mvm_bcast_filter_build_cmd(struct iwl_mvm *mvm,
1785 				    struct iwl_bcast_filter_cmd *cmd)
1786 {
1787 	struct iwl_bcast_iter_data iter_data = {
1788 		.mvm = mvm,
1789 		.cmd = cmd,
1790 	};
1791 
1792 	if (IWL_MVM_FW_BCAST_FILTER_PASS_ALL)
1793 		return false;
1794 
1795 	memset(cmd, 0, sizeof(*cmd));
1796 	cmd->max_bcast_filters = ARRAY_SIZE(cmd->filters);
1797 	cmd->max_macs = ARRAY_SIZE(cmd->macs);
1798 
1799 #ifdef CONFIG_IWLWIFI_DEBUGFS
1800 	/* use debugfs filters/macs if override is configured */
1801 	if (mvm->dbgfs_bcast_filtering.override) {
1802 		memcpy(cmd->filters, &mvm->dbgfs_bcast_filtering.cmd.filters,
1803 		       sizeof(cmd->filters));
1804 		memcpy(cmd->macs, &mvm->dbgfs_bcast_filtering.cmd.macs,
1805 		       sizeof(cmd->macs));
1806 		return true;
1807 	}
1808 #endif
1809 
1810 	/* if no filters are configured, do nothing */
1811 	if (!mvm->bcast_filters)
1812 		return false;
1813 
1814 	/* configure and attach these filters for each associated sta vif */
1815 	ieee80211_iterate_active_interfaces(
1816 		mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1817 		iwl_mvm_bcast_filter_iterator, &iter_data);
1818 
1819 	return true;
1820 }
1821 
1822 static int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
1823 {
1824 	struct iwl_bcast_filter_cmd cmd;
1825 
1826 	if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BCAST_FILTERING))
1827 		return 0;
1828 
1829 	if (!iwl_mvm_bcast_filter_build_cmd(mvm, &cmd))
1830 		return 0;
1831 
1832 	return iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, 0,
1833 				    sizeof(cmd), &cmd);
1834 }
1835 #else
1836 static inline int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
1837 {
1838 	return 0;
1839 }
1840 #endif
1841 
1842 static int iwl_mvm_update_mu_groups(struct iwl_mvm *mvm,
1843 				    struct ieee80211_vif *vif)
1844 {
1845 	struct iwl_mu_group_mgmt_cmd cmd = {};
1846 
1847 	memcpy(cmd.membership_status, vif->bss_conf.mu_group.membership,
1848 	       WLAN_MEMBERSHIP_LEN);
1849 	memcpy(cmd.user_position, vif->bss_conf.mu_group.position,
1850 	       WLAN_USER_POSITION_LEN);
1851 
1852 	return iwl_mvm_send_cmd_pdu(mvm,
1853 				    WIDE_ID(DATA_PATH_GROUP,
1854 					    UPDATE_MU_GROUPS_CMD),
1855 				    0, sizeof(cmd), &cmd);
1856 }
1857 
1858 static void iwl_mvm_mu_mimo_iface_iterator(void *_data, u8 *mac,
1859 					   struct ieee80211_vif *vif)
1860 {
1861 	if (vif->mu_mimo_owner) {
1862 		struct iwl_mu_group_mgmt_notif *notif = _data;
1863 
1864 		/*
1865 		 * MU-MIMO Group Id action frame is little endian. We treat
1866 		 * the data received from firmware as if it came from the
1867 		 * action frame, so no conversion is needed.
1868 		 */
1869 		ieee80211_update_mu_groups(vif,
1870 					   (u8 *)&notif->membership_status,
1871 					   (u8 *)&notif->user_position);
1872 	}
1873 }
1874 
1875 void iwl_mvm_mu_mimo_grp_notif(struct iwl_mvm *mvm,
1876 			       struct iwl_rx_cmd_buffer *rxb)
1877 {
1878 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
1879 	struct iwl_mu_group_mgmt_notif *notif = (void *)pkt->data;
1880 
1881 	ieee80211_iterate_active_interfaces_atomic(
1882 			mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1883 			iwl_mvm_mu_mimo_iface_iterator, notif);
1884 }
1885 
1886 static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
1887 					     struct ieee80211_vif *vif,
1888 					     struct ieee80211_bss_conf *bss_conf,
1889 					     u32 changes)
1890 {
1891 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1892 	int ret;
1893 
1894 	/*
1895 	 * Re-calculate the tsf id, as the master-slave relations depend on the
1896 	 * beacon interval, which was not known when the station interface was
1897 	 * added.
1898 	 */
1899 	if (changes & BSS_CHANGED_ASSOC && bss_conf->assoc)
1900 		iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
1901 
1902 	if (changes & BSS_CHANGED_ASSOC && !bss_conf->assoc &&
1903 	    mvmvif->lqm_active)
1904 		iwl_mvm_send_lqm_cmd(vif, LQM_CMD_OPERATION_STOP_MEASUREMENT,
1905 				     0, 0);
1906 
1907 	/*
1908 	 * If we're not associated yet, take the (new) BSSID before associating
1909 	 * so the firmware knows. If we're already associated, then use the old
1910 	 * BSSID here, and we'll send a cleared one later in the CHANGED_ASSOC
1911 	 * branch for disassociation below.
1912 	 */
1913 	if (changes & BSS_CHANGED_BSSID && !mvmvif->associated)
1914 		memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
1915 
1916 	ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, mvmvif->bssid);
1917 	if (ret)
1918 		IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
1919 
1920 	/* after sending it once, adopt mac80211 data */
1921 	memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
1922 	mvmvif->associated = bss_conf->assoc;
1923 
1924 	if (changes & BSS_CHANGED_ASSOC) {
1925 		if (bss_conf->assoc) {
1926 			/* clear statistics to get clean beacon counter */
1927 			iwl_mvm_request_statistics(mvm, true);
1928 			memset(&mvmvif->beacon_stats, 0,
1929 			       sizeof(mvmvif->beacon_stats));
1930 
1931 			/* add quota for this interface */
1932 			ret = iwl_mvm_update_quotas(mvm, true, NULL);
1933 			if (ret) {
1934 				IWL_ERR(mvm, "failed to update quotas\n");
1935 				return;
1936 			}
1937 
1938 			if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
1939 				     &mvm->status)) {
1940 				/*
1941 				 * If we're restarting then the firmware will
1942 				 * obviously have lost synchronisation with
1943 				 * the AP. It will attempt to synchronise by
1944 				 * itself, but we can make it more reliable by
1945 				 * scheduling a session protection time event.
1946 				 *
1947 				 * The firmware needs to receive a beacon to
1948 				 * catch up with synchronisation, use 110% of
1949 				 * the beacon interval.
1950 				 *
1951 				 * Set a large maximum delay to allow for more
1952 				 * than a single interface.
1953 				 */
1954 				u32 dur = (11 * vif->bss_conf.beacon_int) / 10;
1955 				iwl_mvm_protect_session(mvm, vif, dur, dur,
1956 							5 * dur, false);
1957 			}
1958 
1959 			iwl_mvm_sf_update(mvm, vif, false);
1960 			iwl_mvm_power_vif_assoc(mvm, vif);
1961 			if (vif->p2p) {
1962 				iwl_mvm_ref(mvm, IWL_MVM_REF_P2P_CLIENT);
1963 				iwl_mvm_update_smps(mvm, vif,
1964 						    IWL_MVM_SMPS_REQ_PROT,
1965 						    IEEE80211_SMPS_DYNAMIC);
1966 			}
1967 		} else if (mvmvif->ap_sta_id != IWL_MVM_INVALID_STA) {
1968 			/*
1969 			 * If update fails - SF might be running in associated
1970 			 * mode while disassociated - which is forbidden.
1971 			 */
1972 			WARN_ONCE(iwl_mvm_sf_update(mvm, vif, false),
1973 				  "Failed to update SF upon disassociation\n");
1974 
1975 			/*
1976 			 * If we get an assert during the connection (after the
1977 			 * station has been added, but before the vif is set
1978 			 * to associated), mac80211 will re-add the station and
1979 			 * then configure the vif. Since the vif is not
1980 			 * associated, we would remove the station here and
1981 			 * this would fail the recovery.
1982 			 */
1983 			if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
1984 				      &mvm->status)) {
1985 				/*
1986 				 * Remove AP station now that
1987 				 * the MAC is unassoc
1988 				 */
1989 				ret = iwl_mvm_rm_sta_id(mvm, vif,
1990 							mvmvif->ap_sta_id);
1991 				if (ret)
1992 					IWL_ERR(mvm,
1993 						"failed to remove AP station\n");
1994 
1995 				if (mvm->d0i3_ap_sta_id == mvmvif->ap_sta_id)
1996 					mvm->d0i3_ap_sta_id =
1997 						IWL_MVM_INVALID_STA;
1998 				mvmvif->ap_sta_id = IWL_MVM_INVALID_STA;
1999 			}
2000 
2001 			/* remove quota for this interface */
2002 			ret = iwl_mvm_update_quotas(mvm, false, NULL);
2003 			if (ret)
2004 				IWL_ERR(mvm, "failed to update quotas\n");
2005 
2006 			if (vif->p2p)
2007 				iwl_mvm_unref(mvm, IWL_MVM_REF_P2P_CLIENT);
2008 
2009 			/* this will take the cleared BSSID from bss_conf */
2010 			ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
2011 			if (ret)
2012 				IWL_ERR(mvm,
2013 					"failed to update MAC %pM (clear after unassoc)\n",
2014 					vif->addr);
2015 		}
2016 
2017 		/*
2018 		 * The firmware tracks the MU-MIMO group on its own.
2019 		 * However, on HW restart we should restore this data.
2020 		 */
2021 		if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
2022 		    (changes & BSS_CHANGED_MU_GROUPS) && vif->mu_mimo_owner) {
2023 			ret = iwl_mvm_update_mu_groups(mvm, vif);
2024 			if (ret)
2025 				IWL_ERR(mvm,
2026 					"failed to update VHT MU_MIMO groups\n");
2027 		}
2028 
2029 		iwl_mvm_recalc_multicast(mvm);
2030 		iwl_mvm_configure_bcast_filter(mvm);
2031 
2032 		/* reset rssi values */
2033 		mvmvif->bf_data.ave_beacon_signal = 0;
2034 
2035 		iwl_mvm_bt_coex_vif_change(mvm);
2036 		iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_TT,
2037 				    IEEE80211_SMPS_AUTOMATIC);
2038 		if (fw_has_capa(&mvm->fw->ucode_capa,
2039 				IWL_UCODE_TLV_CAPA_UMAC_SCAN))
2040 			iwl_mvm_config_scan(mvm);
2041 	}
2042 
2043 	if (changes & BSS_CHANGED_BEACON_INFO) {
2044 		/*
2045 		 * We received a beacon from the associated AP so
2046 		 * remove the session protection.
2047 		 */
2048 		iwl_mvm_stop_session_protection(mvm, vif);
2049 
2050 		iwl_mvm_sf_update(mvm, vif, false);
2051 		WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
2052 	}
2053 
2054 	if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS | BSS_CHANGED_QOS |
2055 		       /*
2056 			* Send power command on every beacon change,
2057 			* because we may have not enabled beacon abort yet.
2058 			*/
2059 		       BSS_CHANGED_BEACON_INFO)) {
2060 		ret = iwl_mvm_power_update_mac(mvm);
2061 		if (ret)
2062 			IWL_ERR(mvm, "failed to update power mode\n");
2063 	}
2064 
2065 	if (changes & BSS_CHANGED_TXPOWER) {
2066 		IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2067 				bss_conf->txpower);
2068 		iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2069 	}
2070 
2071 	if (changes & BSS_CHANGED_CQM) {
2072 		IWL_DEBUG_MAC80211(mvm, "cqm info_changed\n");
2073 		/* reset cqm events tracking */
2074 		mvmvif->bf_data.last_cqm_event = 0;
2075 		if (mvmvif->bf_data.bf_enabled) {
2076 			ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
2077 			if (ret)
2078 				IWL_ERR(mvm,
2079 					"failed to update CQM thresholds\n");
2080 		}
2081 	}
2082 
2083 	if (changes & BSS_CHANGED_ARP_FILTER) {
2084 		IWL_DEBUG_MAC80211(mvm, "arp filter changed\n");
2085 		iwl_mvm_configure_bcast_filter(mvm);
2086 	}
2087 }
2088 
2089 static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
2090 				 struct ieee80211_vif *vif)
2091 {
2092 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2093 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2094 	int ret;
2095 
2096 	/*
2097 	 * iwl_mvm_mac_ctxt_add() might read directly from the device
2098 	 * (the system time), so make sure it is available.
2099 	 */
2100 	ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_START_AP);
2101 	if (ret)
2102 		return ret;
2103 
2104 	mutex_lock(&mvm->mutex);
2105 
2106 	/* Send the beacon template */
2107 	ret = iwl_mvm_mac_ctxt_beacon_changed(mvm, vif);
2108 	if (ret)
2109 		goto out_unlock;
2110 
2111 	/*
2112 	 * Re-calculate the tsf id, as the master-slave relations depend on the
2113 	 * beacon interval, which was not known when the AP interface was added.
2114 	 */
2115 	if (vif->type == NL80211_IFTYPE_AP)
2116 		iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
2117 
2118 	mvmvif->ap_assoc_sta_count = 0;
2119 
2120 	/* Add the mac context */
2121 	ret = iwl_mvm_mac_ctxt_add(mvm, vif);
2122 	if (ret)
2123 		goto out_unlock;
2124 
2125 	/* Perform the binding */
2126 	ret = iwl_mvm_binding_add_vif(mvm, vif);
2127 	if (ret)
2128 		goto out_remove;
2129 
2130 	ret = iwl_mvm_add_mcast_sta(mvm, vif);
2131 	if (ret)
2132 		goto out_unbind;
2133 
2134 	/* Send the bcast station. At this stage the TBTT and DTIM time events
2135 	 * are added and applied to the scheduler */
2136 	ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
2137 	if (ret)
2138 		goto out_rm_mcast;
2139 
2140 	/* must be set before quota calculations */
2141 	mvmvif->ap_ibss_active = true;
2142 
2143 	/* power updated needs to be done before quotas */
2144 	iwl_mvm_power_update_mac(mvm);
2145 
2146 	ret = iwl_mvm_update_quotas(mvm, false, NULL);
2147 	if (ret)
2148 		goto out_quota_failed;
2149 
2150 	/* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2151 	if (vif->p2p && mvm->p2p_device_vif)
2152 		iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2153 
2154 	iwl_mvm_ref(mvm, IWL_MVM_REF_AP_IBSS);
2155 
2156 	iwl_mvm_bt_coex_vif_change(mvm);
2157 
2158 	/* we don't support TDLS during DCM */
2159 	if (iwl_mvm_phy_ctx_count(mvm) > 1)
2160 		iwl_mvm_teardown_tdls_peers(mvm);
2161 
2162 	goto out_unlock;
2163 
2164 out_quota_failed:
2165 	iwl_mvm_power_update_mac(mvm);
2166 	mvmvif->ap_ibss_active = false;
2167 	iwl_mvm_send_rm_bcast_sta(mvm, vif);
2168 out_rm_mcast:
2169 	iwl_mvm_rm_mcast_sta(mvm, vif);
2170 out_unbind:
2171 	iwl_mvm_binding_remove_vif(mvm, vif);
2172 out_remove:
2173 	iwl_mvm_mac_ctxt_remove(mvm, vif);
2174 out_unlock:
2175 	mutex_unlock(&mvm->mutex);
2176 	iwl_mvm_unref(mvm, IWL_MVM_REF_START_AP);
2177 	return ret;
2178 }
2179 
2180 static void iwl_mvm_stop_ap_ibss(struct ieee80211_hw *hw,
2181 				 struct ieee80211_vif *vif)
2182 {
2183 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2184 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2185 
2186 	iwl_mvm_prepare_mac_removal(mvm, vif);
2187 
2188 	mutex_lock(&mvm->mutex);
2189 
2190 	/* Handle AP stop while in CSA */
2191 	if (rcu_access_pointer(mvm->csa_vif) == vif) {
2192 		iwl_mvm_remove_time_event(mvm, mvmvif,
2193 					  &mvmvif->time_event_data);
2194 		RCU_INIT_POINTER(mvm->csa_vif, NULL);
2195 		mvmvif->csa_countdown = false;
2196 	}
2197 
2198 	if (rcu_access_pointer(mvm->csa_tx_blocked_vif) == vif) {
2199 		RCU_INIT_POINTER(mvm->csa_tx_blocked_vif, NULL);
2200 		mvm->csa_tx_block_bcn_timeout = 0;
2201 	}
2202 
2203 	mvmvif->ap_ibss_active = false;
2204 	mvm->ap_last_beacon_gp2 = 0;
2205 
2206 	iwl_mvm_bt_coex_vif_change(mvm);
2207 
2208 	iwl_mvm_unref(mvm, IWL_MVM_REF_AP_IBSS);
2209 
2210 	/* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2211 	if (vif->p2p && mvm->p2p_device_vif)
2212 		iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2213 
2214 	iwl_mvm_update_quotas(mvm, false, NULL);
2215 
2216 	/*
2217 	 * This is not very nice, but the simplest:
2218 	 * For older FWs removing the mcast sta before the bcast station may
2219 	 * cause assert 0x2b00.
2220 	 * This is fixed in later FW (which will stop beaconing when removing
2221 	 * bcast station).
2222 	 * So make the order of removal depend on the TLV
2223 	 */
2224 	if (!fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE))
2225 		iwl_mvm_rm_mcast_sta(mvm, vif);
2226 	iwl_mvm_send_rm_bcast_sta(mvm, vif);
2227 	if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE))
2228 		iwl_mvm_rm_mcast_sta(mvm, vif);
2229 	iwl_mvm_binding_remove_vif(mvm, vif);
2230 
2231 	iwl_mvm_power_update_mac(mvm);
2232 
2233 	iwl_mvm_mac_ctxt_remove(mvm, vif);
2234 
2235 	mutex_unlock(&mvm->mutex);
2236 }
2237 
2238 static void
2239 iwl_mvm_bss_info_changed_ap_ibss(struct iwl_mvm *mvm,
2240 				 struct ieee80211_vif *vif,
2241 				 struct ieee80211_bss_conf *bss_conf,
2242 				 u32 changes)
2243 {
2244 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2245 
2246 	/* Changes will be applied when the AP/IBSS is started */
2247 	if (!mvmvif->ap_ibss_active)
2248 		return;
2249 
2250 	if (changes & (BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_HT |
2251 		       BSS_CHANGED_BANDWIDTH | BSS_CHANGED_QOS) &&
2252 	    iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL))
2253 		IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
2254 
2255 	/* Need to send a new beacon template to the FW */
2256 	if (changes & BSS_CHANGED_BEACON &&
2257 	    iwl_mvm_mac_ctxt_beacon_changed(mvm, vif))
2258 		IWL_WARN(mvm, "Failed updating beacon data\n");
2259 
2260 	if (changes & BSS_CHANGED_TXPOWER) {
2261 		IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2262 				bss_conf->txpower);
2263 		iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2264 	}
2265 }
2266 
2267 static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw,
2268 				     struct ieee80211_vif *vif,
2269 				     struct ieee80211_bss_conf *bss_conf,
2270 				     u32 changes)
2271 {
2272 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2273 
2274 	/*
2275 	 * iwl_mvm_bss_info_changed_station() might call
2276 	 * iwl_mvm_protect_session(), which reads directly from
2277 	 * the device (the system time), so make sure it is available.
2278 	 */
2279 	if (iwl_mvm_ref_sync(mvm, IWL_MVM_REF_BSS_CHANGED))
2280 		return;
2281 
2282 	mutex_lock(&mvm->mutex);
2283 
2284 	if (changes & BSS_CHANGED_IDLE && !bss_conf->idle)
2285 		iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true);
2286 
2287 	switch (vif->type) {
2288 	case NL80211_IFTYPE_STATION:
2289 		iwl_mvm_bss_info_changed_station(mvm, vif, bss_conf, changes);
2290 		break;
2291 	case NL80211_IFTYPE_AP:
2292 	case NL80211_IFTYPE_ADHOC:
2293 		iwl_mvm_bss_info_changed_ap_ibss(mvm, vif, bss_conf, changes);
2294 		break;
2295 	case NL80211_IFTYPE_MONITOR:
2296 		if (changes & BSS_CHANGED_MU_GROUPS)
2297 			iwl_mvm_update_mu_groups(mvm, vif);
2298 		break;
2299 	default:
2300 		/* shouldn't happen */
2301 		WARN_ON_ONCE(1);
2302 	}
2303 
2304 	mutex_unlock(&mvm->mutex);
2305 	iwl_mvm_unref(mvm, IWL_MVM_REF_BSS_CHANGED);
2306 }
2307 
2308 static int iwl_mvm_mac_hw_scan(struct ieee80211_hw *hw,
2309 			       struct ieee80211_vif *vif,
2310 			       struct ieee80211_scan_request *hw_req)
2311 {
2312 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2313 	int ret;
2314 
2315 	if (hw_req->req.n_channels == 0 ||
2316 	    hw_req->req.n_channels > mvm->fw->ucode_capa.n_scan_channels)
2317 		return -EINVAL;
2318 
2319 	mutex_lock(&mvm->mutex);
2320 	ret = iwl_mvm_reg_scan_start(mvm, vif, &hw_req->req, &hw_req->ies);
2321 	mutex_unlock(&mvm->mutex);
2322 
2323 	return ret;
2324 }
2325 
2326 static void iwl_mvm_mac_cancel_hw_scan(struct ieee80211_hw *hw,
2327 				       struct ieee80211_vif *vif)
2328 {
2329 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2330 
2331 	mutex_lock(&mvm->mutex);
2332 
2333 	/* Due to a race condition, it's possible that mac80211 asks
2334 	 * us to stop a hw_scan when it's already stopped.  This can
2335 	 * happen, for instance, if we stopped the scan ourselves,
2336 	 * called ieee80211_scan_completed() and the userspace called
2337 	 * cancel scan scan before ieee80211_scan_work() could run.
2338 	 * To handle that, simply return if the scan is not running.
2339 	*/
2340 	if (mvm->scan_status & IWL_MVM_SCAN_REGULAR)
2341 		iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true);
2342 
2343 	mutex_unlock(&mvm->mutex);
2344 }
2345 
2346 static void
2347 iwl_mvm_mac_allow_buffered_frames(struct ieee80211_hw *hw,
2348 				  struct ieee80211_sta *sta, u16 tids,
2349 				  int num_frames,
2350 				  enum ieee80211_frame_release_type reason,
2351 				  bool more_data)
2352 {
2353 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2354 
2355 	/* Called when we need to transmit (a) frame(s) from mac80211 */
2356 
2357 	iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2358 					  tids, more_data, false);
2359 }
2360 
2361 static void
2362 iwl_mvm_mac_release_buffered_frames(struct ieee80211_hw *hw,
2363 				    struct ieee80211_sta *sta, u16 tids,
2364 				    int num_frames,
2365 				    enum ieee80211_frame_release_type reason,
2366 				    bool more_data)
2367 {
2368 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2369 
2370 	/* Called when we need to transmit (a) frame(s) from agg or dqa queue */
2371 
2372 	iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2373 					  tids, more_data, true);
2374 }
2375 
2376 static void __iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
2377 				     enum sta_notify_cmd cmd,
2378 				     struct ieee80211_sta *sta)
2379 {
2380 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2381 	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
2382 	unsigned long txqs = 0, tids = 0;
2383 	int tid;
2384 
2385 	/*
2386 	 * If we have TVQM then we get too high queue numbers - luckily
2387 	 * we really shouldn't get here with that because such hardware
2388 	 * should have firmware supporting buffer station offload.
2389 	 */
2390 	if (WARN_ON(iwl_mvm_has_new_tx_api(mvm)))
2391 		return;
2392 
2393 	spin_lock_bh(&mvmsta->lock);
2394 	for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++) {
2395 		struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
2396 
2397 		if (tid_data->txq_id == IWL_MVM_INVALID_QUEUE)
2398 			continue;
2399 
2400 		__set_bit(tid_data->txq_id, &txqs);
2401 
2402 		if (iwl_mvm_tid_queued(mvm, tid_data) == 0)
2403 			continue;
2404 
2405 		__set_bit(tid, &tids);
2406 	}
2407 
2408 	switch (cmd) {
2409 	case STA_NOTIFY_SLEEP:
2410 		for_each_set_bit(tid, &tids, IWL_MAX_TID_COUNT)
2411 			ieee80211_sta_set_buffered(sta, tid, true);
2412 
2413 		if (txqs)
2414 			iwl_trans_freeze_txq_timer(mvm->trans, txqs, true);
2415 		/*
2416 		 * The fw updates the STA to be asleep. Tx packets on the Tx
2417 		 * queues to this station will not be transmitted. The fw will
2418 		 * send a Tx response with TX_STATUS_FAIL_DEST_PS.
2419 		 */
2420 		break;
2421 	case STA_NOTIFY_AWAKE:
2422 		if (WARN_ON(mvmsta->sta_id == IWL_MVM_INVALID_STA))
2423 			break;
2424 
2425 		if (txqs)
2426 			iwl_trans_freeze_txq_timer(mvm->trans, txqs, false);
2427 		iwl_mvm_sta_modify_ps_wake(mvm, sta);
2428 		break;
2429 	default:
2430 		break;
2431 	}
2432 	spin_unlock_bh(&mvmsta->lock);
2433 }
2434 
2435 static void iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
2436 				   struct ieee80211_vif *vif,
2437 				   enum sta_notify_cmd cmd,
2438 				   struct ieee80211_sta *sta)
2439 {
2440 	__iwl_mvm_mac_sta_notify(hw, cmd, sta);
2441 }
2442 
2443 void iwl_mvm_sta_pm_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
2444 {
2445 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
2446 	struct iwl_mvm_pm_state_notification *notif = (void *)pkt->data;
2447 	struct ieee80211_sta *sta;
2448 	struct iwl_mvm_sta *mvmsta;
2449 	bool sleeping = (notif->type != IWL_MVM_PM_EVENT_AWAKE);
2450 
2451 	if (WARN_ON(notif->sta_id >= ARRAY_SIZE(mvm->fw_id_to_mac_id)))
2452 		return;
2453 
2454 	rcu_read_lock();
2455 	sta = rcu_dereference(mvm->fw_id_to_mac_id[notif->sta_id]);
2456 	if (WARN_ON(IS_ERR_OR_NULL(sta))) {
2457 		rcu_read_unlock();
2458 		return;
2459 	}
2460 
2461 	mvmsta = iwl_mvm_sta_from_mac80211(sta);
2462 
2463 	if (!mvmsta->vif ||
2464 	    mvmsta->vif->type != NL80211_IFTYPE_AP) {
2465 		rcu_read_unlock();
2466 		return;
2467 	}
2468 
2469 	if (mvmsta->sleeping != sleeping) {
2470 		mvmsta->sleeping = sleeping;
2471 		__iwl_mvm_mac_sta_notify(mvm->hw,
2472 			sleeping ? STA_NOTIFY_SLEEP : STA_NOTIFY_AWAKE,
2473 			sta);
2474 		ieee80211_sta_ps_transition(sta, sleeping);
2475 	}
2476 
2477 	if (sleeping) {
2478 		switch (notif->type) {
2479 		case IWL_MVM_PM_EVENT_AWAKE:
2480 		case IWL_MVM_PM_EVENT_ASLEEP:
2481 			break;
2482 		case IWL_MVM_PM_EVENT_UAPSD:
2483 			ieee80211_sta_uapsd_trigger(sta, IEEE80211_NUM_TIDS);
2484 			break;
2485 		case IWL_MVM_PM_EVENT_PS_POLL:
2486 			ieee80211_sta_pspoll(sta);
2487 			break;
2488 		default:
2489 			break;
2490 		}
2491 	}
2492 
2493 	rcu_read_unlock();
2494 }
2495 
2496 static void iwl_mvm_sta_pre_rcu_remove(struct ieee80211_hw *hw,
2497 				       struct ieee80211_vif *vif,
2498 				       struct ieee80211_sta *sta)
2499 {
2500 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2501 	struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
2502 
2503 	/*
2504 	 * This is called before mac80211 does RCU synchronisation,
2505 	 * so here we already invalidate our internal RCU-protected
2506 	 * station pointer. The rest of the code will thus no longer
2507 	 * be able to find the station this way, and we don't rely
2508 	 * on further RCU synchronisation after the sta_state()
2509 	 * callback deleted the station.
2510 	 */
2511 	mutex_lock(&mvm->mutex);
2512 	if (sta == rcu_access_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id]))
2513 		rcu_assign_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id],
2514 				   ERR_PTR(-ENOENT));
2515 
2516 	mutex_unlock(&mvm->mutex);
2517 }
2518 
2519 static void iwl_mvm_check_uapsd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
2520 				const u8 *bssid)
2521 {
2522 	if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT))
2523 		return;
2524 
2525 	if (vif->p2p && !iwl_mvm_is_p2p_scm_uapsd_supported(mvm)) {
2526 		vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2527 		return;
2528 	}
2529 
2530 	if (!vif->p2p &&
2531 	    (iwlwifi_mod_params.uapsd_disable & IWL_DISABLE_UAPSD_BSS)) {
2532 		vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2533 		return;
2534 	}
2535 
2536 	vif->driver_flags |= IEEE80211_VIF_SUPPORTS_UAPSD;
2537 }
2538 
2539 static void
2540 iwl_mvm_tdls_check_trigger(struct iwl_mvm *mvm,
2541 			   struct ieee80211_vif *vif, u8 *peer_addr,
2542 			   enum nl80211_tdls_operation action)
2543 {
2544 	struct iwl_fw_dbg_trigger_tlv *trig;
2545 	struct iwl_fw_dbg_trigger_tdls *tdls_trig;
2546 
2547 	if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_TDLS))
2548 		return;
2549 
2550 	trig = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_TDLS);
2551 	tdls_trig = (void *)trig->data;
2552 	if (!iwl_fw_dbg_trigger_check_stop(&mvm->fwrt,
2553 					   ieee80211_vif_to_wdev(vif), trig))
2554 		return;
2555 
2556 	if (!(tdls_trig->action_bitmap & BIT(action)))
2557 		return;
2558 
2559 	if (tdls_trig->peer_mode &&
2560 	    memcmp(tdls_trig->peer, peer_addr, ETH_ALEN) != 0)
2561 		return;
2562 
2563 	iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
2564 				"TDLS event occurred, peer %pM, action %d",
2565 				peer_addr, action);
2566 }
2567 
2568 static void iwl_mvm_purge_deferred_tx_frames(struct iwl_mvm *mvm,
2569 					     struct iwl_mvm_sta *mvm_sta)
2570 {
2571 	struct iwl_mvm_tid_data *tid_data;
2572 	struct sk_buff *skb;
2573 	int i;
2574 
2575 	spin_lock_bh(&mvm_sta->lock);
2576 	for (i = 0; i <= IWL_MAX_TID_COUNT; i++) {
2577 		tid_data = &mvm_sta->tid_data[i];
2578 
2579 		while ((skb = __skb_dequeue(&tid_data->deferred_tx_frames))) {
2580 			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
2581 
2582 			/*
2583 			 * The first deferred frame should've stopped the MAC
2584 			 * queues, so we should never get a second deferred
2585 			 * frame for the RA/TID.
2586 			 */
2587 			iwl_mvm_start_mac_queues(mvm, BIT(info->hw_queue));
2588 			ieee80211_free_txskb(mvm->hw, skb);
2589 		}
2590 	}
2591 	spin_unlock_bh(&mvm_sta->lock);
2592 }
2593 
2594 static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
2595 				 struct ieee80211_vif *vif,
2596 				 struct ieee80211_sta *sta,
2597 				 enum ieee80211_sta_state old_state,
2598 				 enum ieee80211_sta_state new_state)
2599 {
2600 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2601 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2602 	struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
2603 	int ret;
2604 
2605 	IWL_DEBUG_MAC80211(mvm, "station %pM state change %d->%d\n",
2606 			   sta->addr, old_state, new_state);
2607 
2608 	/* this would be a mac80211 bug ... but don't crash */
2609 	if (WARN_ON_ONCE(!mvmvif->phy_ctxt))
2610 		return -EINVAL;
2611 
2612 	/*
2613 	 * If we are in a STA removal flow and in DQA mode:
2614 	 *
2615 	 * This is after the sync_rcu part, so the queues have already been
2616 	 * flushed. No more TXs on their way in mac80211's path, and no more in
2617 	 * the queues.
2618 	 * Also, we won't be getting any new TX frames for this station.
2619 	 * What we might have are deferred TX frames that need to be taken care
2620 	 * of.
2621 	 *
2622 	 * Drop any still-queued deferred-frame before removing the STA, and
2623 	 * make sure the worker is no longer handling frames for this STA.
2624 	 */
2625 	if (old_state == IEEE80211_STA_NONE &&
2626 	    new_state == IEEE80211_STA_NOTEXIST) {
2627 		iwl_mvm_purge_deferred_tx_frames(mvm, mvm_sta);
2628 		flush_work(&mvm->add_stream_wk);
2629 
2630 		/*
2631 		 * No need to make sure deferred TX indication is off since the
2632 		 * worker will already remove it if it was on
2633 		 */
2634 	}
2635 
2636 	mutex_lock(&mvm->mutex);
2637 	/* track whether or not the station is associated */
2638 	mvm_sta->associated = new_state >= IEEE80211_STA_ASSOC;
2639 
2640 	if (old_state == IEEE80211_STA_NOTEXIST &&
2641 	    new_state == IEEE80211_STA_NONE) {
2642 		/*
2643 		 * Firmware bug - it'll crash if the beacon interval is less
2644 		 * than 16. We can't avoid connecting at all, so refuse the
2645 		 * station state change, this will cause mac80211 to abandon
2646 		 * attempts to connect to this AP, and eventually wpa_s will
2647 		 * blacklist the AP...
2648 		 */
2649 		if (vif->type == NL80211_IFTYPE_STATION &&
2650 		    vif->bss_conf.beacon_int < 16) {
2651 			IWL_ERR(mvm,
2652 				"AP %pM beacon interval is %d, refusing due to firmware bug!\n",
2653 				sta->addr, vif->bss_conf.beacon_int);
2654 			ret = -EINVAL;
2655 			goto out_unlock;
2656 		}
2657 
2658 		if (sta->tdls &&
2659 		    (vif->p2p ||
2660 		     iwl_mvm_tdls_sta_count(mvm, NULL) ==
2661 						IWL_MVM_TDLS_STA_COUNT ||
2662 		     iwl_mvm_phy_ctx_count(mvm) > 1)) {
2663 			IWL_DEBUG_MAC80211(mvm, "refusing TDLS sta\n");
2664 			ret = -EBUSY;
2665 			goto out_unlock;
2666 		}
2667 
2668 		ret = iwl_mvm_add_sta(mvm, vif, sta);
2669 		if (sta->tdls && ret == 0) {
2670 			iwl_mvm_recalc_tdls_state(mvm, vif, true);
2671 			iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
2672 						   NL80211_TDLS_SETUP);
2673 		}
2674 	} else if (old_state == IEEE80211_STA_NONE &&
2675 		   new_state == IEEE80211_STA_AUTH) {
2676 		/*
2677 		 * EBS may be disabled due to previous failures reported by FW.
2678 		 * Reset EBS status here assuming environment has been changed.
2679 		 */
2680 		mvm->last_ebs_successful = true;
2681 		iwl_mvm_check_uapsd(mvm, vif, sta->addr);
2682 		ret = 0;
2683 	} else if (old_state == IEEE80211_STA_AUTH &&
2684 		   new_state == IEEE80211_STA_ASSOC) {
2685 		if (vif->type == NL80211_IFTYPE_AP) {
2686 			mvmvif->ap_assoc_sta_count++;
2687 			iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
2688 		}
2689 
2690 		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
2691 				     true);
2692 		ret = iwl_mvm_update_sta(mvm, vif, sta);
2693 	} else if (old_state == IEEE80211_STA_ASSOC &&
2694 		   new_state == IEEE80211_STA_AUTHORIZED) {
2695 
2696 		/* we don't support TDLS during DCM */
2697 		if (iwl_mvm_phy_ctx_count(mvm) > 1)
2698 			iwl_mvm_teardown_tdls_peers(mvm);
2699 
2700 		if (sta->tdls)
2701 			iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
2702 						   NL80211_TDLS_ENABLE_LINK);
2703 
2704 		/* enable beacon filtering */
2705 		WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
2706 		ret = 0;
2707 	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
2708 		   new_state == IEEE80211_STA_ASSOC) {
2709 		/* disable beacon filtering */
2710 		WARN_ON(iwl_mvm_disable_beacon_filter(mvm, vif, 0));
2711 		ret = 0;
2712 	} else if (old_state == IEEE80211_STA_ASSOC &&
2713 		   new_state == IEEE80211_STA_AUTH) {
2714 		if (vif->type == NL80211_IFTYPE_AP) {
2715 			mvmvif->ap_assoc_sta_count--;
2716 			iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
2717 		}
2718 		ret = 0;
2719 	} else if (old_state == IEEE80211_STA_AUTH &&
2720 		   new_state == IEEE80211_STA_NONE) {
2721 		ret = 0;
2722 	} else if (old_state == IEEE80211_STA_NONE &&
2723 		   new_state == IEEE80211_STA_NOTEXIST) {
2724 		ret = iwl_mvm_rm_sta(mvm, vif, sta);
2725 		if (sta->tdls) {
2726 			iwl_mvm_recalc_tdls_state(mvm, vif, false);
2727 			iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
2728 						   NL80211_TDLS_DISABLE_LINK);
2729 		}
2730 	} else {
2731 		ret = -EIO;
2732 	}
2733  out_unlock:
2734 	mutex_unlock(&mvm->mutex);
2735 
2736 	if (sta->tdls && ret == 0) {
2737 		if (old_state == IEEE80211_STA_NOTEXIST &&
2738 		    new_state == IEEE80211_STA_NONE)
2739 			ieee80211_reserve_tid(sta, IWL_MVM_TDLS_FW_TID);
2740 		else if (old_state == IEEE80211_STA_NONE &&
2741 			 new_state == IEEE80211_STA_NOTEXIST)
2742 			ieee80211_unreserve_tid(sta, IWL_MVM_TDLS_FW_TID);
2743 	}
2744 
2745 	return ret;
2746 }
2747 
2748 static int iwl_mvm_mac_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
2749 {
2750 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2751 
2752 	mvm->rts_threshold = value;
2753 
2754 	return 0;
2755 }
2756 
2757 static void iwl_mvm_sta_rc_update(struct ieee80211_hw *hw,
2758 				  struct ieee80211_vif *vif,
2759 				  struct ieee80211_sta *sta, u32 changed)
2760 {
2761 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2762 
2763 	if (vif->type == NL80211_IFTYPE_STATION &&
2764 	    changed & IEEE80211_RC_NSS_CHANGED)
2765 		iwl_mvm_sf_update(mvm, vif, false);
2766 }
2767 
2768 static int iwl_mvm_mac_conf_tx(struct ieee80211_hw *hw,
2769 			       struct ieee80211_vif *vif, u16 ac,
2770 			       const struct ieee80211_tx_queue_params *params)
2771 {
2772 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2773 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2774 
2775 	mvmvif->queue_params[ac] = *params;
2776 
2777 	/*
2778 	 * No need to update right away, we'll get BSS_CHANGED_QOS
2779 	 * The exception is P2P_DEVICE interface which needs immediate update.
2780 	 */
2781 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
2782 		int ret;
2783 
2784 		mutex_lock(&mvm->mutex);
2785 		ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
2786 		mutex_unlock(&mvm->mutex);
2787 		return ret;
2788 	}
2789 	return 0;
2790 }
2791 
2792 static void iwl_mvm_mac_mgd_prepare_tx(struct ieee80211_hw *hw,
2793 				      struct ieee80211_vif *vif)
2794 {
2795 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2796 	u32 duration = IWL_MVM_TE_SESSION_PROTECTION_MAX_TIME_MS;
2797 	u32 min_duration = IWL_MVM_TE_SESSION_PROTECTION_MIN_TIME_MS;
2798 
2799 	if (WARN_ON_ONCE(vif->bss_conf.assoc))
2800 		return;
2801 
2802 	/*
2803 	 * iwl_mvm_protect_session() reads directly from the device
2804 	 * (the system time), so make sure it is available.
2805 	 */
2806 	if (iwl_mvm_ref_sync(mvm, IWL_MVM_REF_PREPARE_TX))
2807 		return;
2808 
2809 	mutex_lock(&mvm->mutex);
2810 	/* Try really hard to protect the session and hear a beacon */
2811 	iwl_mvm_protect_session(mvm, vif, duration, min_duration, 500, false);
2812 	mutex_unlock(&mvm->mutex);
2813 
2814 	iwl_mvm_unref(mvm, IWL_MVM_REF_PREPARE_TX);
2815 }
2816 
2817 static int iwl_mvm_mac_sched_scan_start(struct ieee80211_hw *hw,
2818 					struct ieee80211_vif *vif,
2819 					struct cfg80211_sched_scan_request *req,
2820 					struct ieee80211_scan_ies *ies)
2821 {
2822 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2823 
2824 	int ret;
2825 
2826 	mutex_lock(&mvm->mutex);
2827 
2828 	if (!vif->bss_conf.idle) {
2829 		ret = -EBUSY;
2830 		goto out;
2831 	}
2832 
2833 	ret = iwl_mvm_sched_scan_start(mvm, vif, req, ies, IWL_MVM_SCAN_SCHED);
2834 
2835 out:
2836 	mutex_unlock(&mvm->mutex);
2837 	return ret;
2838 }
2839 
2840 static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
2841 				       struct ieee80211_vif *vif)
2842 {
2843 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2844 	int ret;
2845 
2846 	mutex_lock(&mvm->mutex);
2847 
2848 	/* Due to a race condition, it's possible that mac80211 asks
2849 	 * us to stop a sched_scan when it's already stopped.  This
2850 	 * can happen, for instance, if we stopped the scan ourselves,
2851 	 * called ieee80211_sched_scan_stopped() and the userspace called
2852 	 * stop sched scan scan before ieee80211_sched_scan_stopped_work()
2853 	 * could run.  To handle this, simply return if the scan is
2854 	 * not running.
2855 	*/
2856 	if (!(mvm->scan_status & IWL_MVM_SCAN_SCHED)) {
2857 		mutex_unlock(&mvm->mutex);
2858 		return 0;
2859 	}
2860 
2861 	ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, false);
2862 	mutex_unlock(&mvm->mutex);
2863 	iwl_mvm_wait_for_async_handlers(mvm);
2864 
2865 	return ret;
2866 }
2867 
2868 static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
2869 			       enum set_key_cmd cmd,
2870 			       struct ieee80211_vif *vif,
2871 			       struct ieee80211_sta *sta,
2872 			       struct ieee80211_key_conf *key)
2873 {
2874 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2875 	struct iwl_mvm_sta *mvmsta;
2876 	struct iwl_mvm_key_pn *ptk_pn;
2877 	int keyidx = key->keyidx;
2878 	int ret;
2879 	u8 key_offset;
2880 
2881 	if (iwlwifi_mod_params.swcrypto) {
2882 		IWL_DEBUG_MAC80211(mvm, "leave - hwcrypto disabled\n");
2883 		return -EOPNOTSUPP;
2884 	}
2885 
2886 	switch (key->cipher) {
2887 	case WLAN_CIPHER_SUITE_TKIP:
2888 		key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
2889 		key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
2890 		break;
2891 	case WLAN_CIPHER_SUITE_CCMP:
2892 	case WLAN_CIPHER_SUITE_GCMP:
2893 	case WLAN_CIPHER_SUITE_GCMP_256:
2894 		if (!iwl_mvm_has_new_tx_api(mvm))
2895 			key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
2896 		break;
2897 	case WLAN_CIPHER_SUITE_AES_CMAC:
2898 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
2899 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
2900 		WARN_ON_ONCE(!ieee80211_hw_check(hw, MFP_CAPABLE));
2901 		break;
2902 	case WLAN_CIPHER_SUITE_WEP40:
2903 	case WLAN_CIPHER_SUITE_WEP104:
2904 		/* For non-client mode, only use WEP keys for TX as we probably
2905 		 * don't have a station yet anyway and would then have to keep
2906 		 * track of the keys, linking them to each of the clients/peers
2907 		 * as they appear. For now, don't do that, for performance WEP
2908 		 * offload doesn't really matter much, but we need it for some
2909 		 * other offload features in client mode.
2910 		 */
2911 		if (vif->type != NL80211_IFTYPE_STATION)
2912 			return 0;
2913 		break;
2914 	default:
2915 		/* currently FW supports only one optional cipher scheme */
2916 		if (hw->n_cipher_schemes &&
2917 		    hw->cipher_schemes->cipher == key->cipher)
2918 			key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
2919 		else
2920 			return -EOPNOTSUPP;
2921 	}
2922 
2923 	mutex_lock(&mvm->mutex);
2924 
2925 	switch (cmd) {
2926 	case SET_KEY:
2927 		if ((vif->type == NL80211_IFTYPE_ADHOC ||
2928 		     vif->type == NL80211_IFTYPE_AP) && !sta) {
2929 			/*
2930 			 * GTK on AP interface is a TX-only key, return 0;
2931 			 * on IBSS they're per-station and because we're lazy
2932 			 * we don't support them for RX, so do the same.
2933 			 * CMAC/GMAC in AP/IBSS modes must be done in software.
2934 			 */
2935 			if (key->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
2936 			    key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
2937 			    key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256)
2938 				ret = -EOPNOTSUPP;
2939 			else
2940 				ret = 0;
2941 
2942 			if (key->cipher != WLAN_CIPHER_SUITE_GCMP &&
2943 			    key->cipher != WLAN_CIPHER_SUITE_GCMP_256 &&
2944 			    !iwl_mvm_has_new_tx_api(mvm)) {
2945 				key->hw_key_idx = STA_KEY_IDX_INVALID;
2946 				break;
2947 			}
2948 		}
2949 
2950 		/* During FW restart, in order to restore the state as it was,
2951 		 * don't try to reprogram keys we previously failed for.
2952 		 */
2953 		if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
2954 		    key->hw_key_idx == STA_KEY_IDX_INVALID) {
2955 			IWL_DEBUG_MAC80211(mvm,
2956 					   "skip invalid idx key programming during restart\n");
2957 			ret = 0;
2958 			break;
2959 		}
2960 
2961 		if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
2962 		    sta && iwl_mvm_has_new_rx_api(mvm) &&
2963 		    key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
2964 		    (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
2965 		     key->cipher == WLAN_CIPHER_SUITE_GCMP ||
2966 		     key->cipher == WLAN_CIPHER_SUITE_GCMP_256)) {
2967 			struct ieee80211_key_seq seq;
2968 			int tid, q;
2969 
2970 			mvmsta = iwl_mvm_sta_from_mac80211(sta);
2971 			WARN_ON(rcu_access_pointer(mvmsta->ptk_pn[keyidx]));
2972 			ptk_pn = kzalloc(sizeof(*ptk_pn) +
2973 					 mvm->trans->num_rx_queues *
2974 						sizeof(ptk_pn->q[0]),
2975 					 GFP_KERNEL);
2976 			if (!ptk_pn) {
2977 				ret = -ENOMEM;
2978 				break;
2979 			}
2980 
2981 			for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++) {
2982 				ieee80211_get_key_rx_seq(key, tid, &seq);
2983 				for (q = 0; q < mvm->trans->num_rx_queues; q++)
2984 					memcpy(ptk_pn->q[q].pn[tid],
2985 					       seq.ccmp.pn,
2986 					       IEEE80211_CCMP_PN_LEN);
2987 			}
2988 
2989 			rcu_assign_pointer(mvmsta->ptk_pn[keyidx], ptk_pn);
2990 		}
2991 
2992 		/* in HW restart reuse the index, otherwise request a new one */
2993 		if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
2994 			key_offset = key->hw_key_idx;
2995 		else
2996 			key_offset = STA_KEY_IDX_INVALID;
2997 
2998 		IWL_DEBUG_MAC80211(mvm, "set hwcrypto key\n");
2999 		ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, key_offset);
3000 		if (ret) {
3001 			IWL_WARN(mvm, "set key failed\n");
3002 			/*
3003 			 * can't add key for RX, but we don't need it
3004 			 * in the device for TX so still return 0
3005 			 */
3006 			key->hw_key_idx = STA_KEY_IDX_INVALID;
3007 			ret = 0;
3008 		}
3009 
3010 		break;
3011 	case DISABLE_KEY:
3012 		if (key->hw_key_idx == STA_KEY_IDX_INVALID) {
3013 			ret = 0;
3014 			break;
3015 		}
3016 
3017 		if (sta && iwl_mvm_has_new_rx_api(mvm) &&
3018 		    key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
3019 		    (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
3020 		     key->cipher == WLAN_CIPHER_SUITE_GCMP ||
3021 		     key->cipher == WLAN_CIPHER_SUITE_GCMP_256)) {
3022 			mvmsta = iwl_mvm_sta_from_mac80211(sta);
3023 			ptk_pn = rcu_dereference_protected(
3024 						mvmsta->ptk_pn[keyidx],
3025 						lockdep_is_held(&mvm->mutex));
3026 			RCU_INIT_POINTER(mvmsta->ptk_pn[keyidx], NULL);
3027 			if (ptk_pn)
3028 				kfree_rcu(ptk_pn, rcu_head);
3029 		}
3030 
3031 		IWL_DEBUG_MAC80211(mvm, "disable hwcrypto key\n");
3032 		ret = iwl_mvm_remove_sta_key(mvm, vif, sta, key);
3033 		break;
3034 	default:
3035 		ret = -EINVAL;
3036 	}
3037 
3038 	mutex_unlock(&mvm->mutex);
3039 	return ret;
3040 }
3041 
3042 static void iwl_mvm_mac_update_tkip_key(struct ieee80211_hw *hw,
3043 					struct ieee80211_vif *vif,
3044 					struct ieee80211_key_conf *keyconf,
3045 					struct ieee80211_sta *sta,
3046 					u32 iv32, u16 *phase1key)
3047 {
3048 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3049 
3050 	if (keyconf->hw_key_idx == STA_KEY_IDX_INVALID)
3051 		return;
3052 
3053 	iwl_mvm_update_tkip_key(mvm, vif, keyconf, sta, iv32, phase1key);
3054 }
3055 
3056 
3057 static bool iwl_mvm_rx_aux_roc(struct iwl_notif_wait_data *notif_wait,
3058 			       struct iwl_rx_packet *pkt, void *data)
3059 {
3060 	struct iwl_mvm *mvm =
3061 		container_of(notif_wait, struct iwl_mvm, notif_wait);
3062 	struct iwl_hs20_roc_res *resp;
3063 	int resp_len = iwl_rx_packet_payload_len(pkt);
3064 	struct iwl_mvm_time_event_data *te_data = data;
3065 
3066 	if (WARN_ON(pkt->hdr.cmd != HOT_SPOT_CMD))
3067 		return true;
3068 
3069 	if (WARN_ON_ONCE(resp_len != sizeof(*resp))) {
3070 		IWL_ERR(mvm, "Invalid HOT_SPOT_CMD response\n");
3071 		return true;
3072 	}
3073 
3074 	resp = (void *)pkt->data;
3075 
3076 	IWL_DEBUG_TE(mvm,
3077 		     "Aux ROC: Recieved response from ucode: status=%d uid=%d\n",
3078 		     resp->status, resp->event_unique_id);
3079 
3080 	te_data->uid = le32_to_cpu(resp->event_unique_id);
3081 	IWL_DEBUG_TE(mvm, "TIME_EVENT_CMD response - UID = 0x%x\n",
3082 		     te_data->uid);
3083 
3084 	spin_lock_bh(&mvm->time_event_lock);
3085 	list_add_tail(&te_data->list, &mvm->aux_roc_te_list);
3086 	spin_unlock_bh(&mvm->time_event_lock);
3087 
3088 	return true;
3089 }
3090 
3091 #define AUX_ROC_MIN_DURATION MSEC_TO_TU(100)
3092 #define AUX_ROC_MIN_DELAY MSEC_TO_TU(200)
3093 #define AUX_ROC_MAX_DELAY MSEC_TO_TU(600)
3094 #define AUX_ROC_SAFETY_BUFFER MSEC_TO_TU(20)
3095 #define AUX_ROC_MIN_SAFETY_BUFFER MSEC_TO_TU(10)
3096 static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm,
3097 				    struct ieee80211_channel *channel,
3098 				    struct ieee80211_vif *vif,
3099 				    int duration)
3100 {
3101 	int res, time_reg = DEVICE_SYSTEM_TIME_REG;
3102 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3103 	struct iwl_mvm_time_event_data *te_data = &mvmvif->hs_time_event_data;
3104 	static const u16 time_event_response[] = { HOT_SPOT_CMD };
3105 	struct iwl_notification_wait wait_time_event;
3106 	u32 dtim_interval = vif->bss_conf.dtim_period *
3107 		vif->bss_conf.beacon_int;
3108 	u32 req_dur, delay;
3109 	struct iwl_hs20_roc_req aux_roc_req = {
3110 		.action = cpu_to_le32(FW_CTXT_ACTION_ADD),
3111 		.id_and_color =
3112 			cpu_to_le32(FW_CMD_ID_AND_COLOR(MAC_INDEX_AUX, 0)),
3113 		.sta_id_and_color = cpu_to_le32(mvm->aux_sta.sta_id),
3114 		/* Set the channel info data */
3115 		.channel_info.band = (channel->band == NL80211_BAND_2GHZ) ?
3116 			PHY_BAND_24 : PHY_BAND_5,
3117 		.channel_info.channel = channel->hw_value,
3118 		.channel_info.width = PHY_VHT_CHANNEL_MODE20,
3119 		/* Set the time and duration */
3120 		.apply_time = cpu_to_le32(iwl_read_prph(mvm->trans, time_reg)),
3121 	 };
3122 
3123 	delay = AUX_ROC_MIN_DELAY;
3124 	req_dur = MSEC_TO_TU(duration);
3125 
3126 	/*
3127 	 * If we are associated we want the delay time to be at least one
3128 	 * dtim interval so that the FW can wait until after the DTIM and
3129 	 * then start the time event, this will potentially allow us to
3130 	 * remain off-channel for the max duration.
3131 	 * Since we want to use almost a whole dtim interval we would also
3132 	 * like the delay to be for 2-3 dtim intervals, in case there are
3133 	 * other time events with higher priority.
3134 	 */
3135 	if (vif->bss_conf.assoc) {
3136 		delay = min_t(u32, dtim_interval * 3, AUX_ROC_MAX_DELAY);
3137 		/* We cannot remain off-channel longer than the DTIM interval */
3138 		if (dtim_interval <= req_dur) {
3139 			req_dur = dtim_interval - AUX_ROC_SAFETY_BUFFER;
3140 			if (req_dur <= AUX_ROC_MIN_DURATION)
3141 				req_dur = dtim_interval -
3142 					AUX_ROC_MIN_SAFETY_BUFFER;
3143 		}
3144 	}
3145 
3146 	aux_roc_req.duration = cpu_to_le32(req_dur);
3147 	aux_roc_req.apply_time_max_delay = cpu_to_le32(delay);
3148 
3149 	IWL_DEBUG_TE(mvm,
3150 		     "ROC: Requesting to remain on channel %u for %ums (requested = %ums, max_delay = %ums, dtim_interval = %ums)\n",
3151 		     channel->hw_value, req_dur, duration, delay,
3152 		     dtim_interval);
3153 	/* Set the node address */
3154 	memcpy(aux_roc_req.node_addr, vif->addr, ETH_ALEN);
3155 
3156 	lockdep_assert_held(&mvm->mutex);
3157 
3158 	spin_lock_bh(&mvm->time_event_lock);
3159 
3160 	if (WARN_ON(te_data->id == HOT_SPOT_CMD)) {
3161 		spin_unlock_bh(&mvm->time_event_lock);
3162 		return -EIO;
3163 	}
3164 
3165 	te_data->vif = vif;
3166 	te_data->duration = duration;
3167 	te_data->id = HOT_SPOT_CMD;
3168 
3169 	spin_unlock_bh(&mvm->time_event_lock);
3170 
3171 	/*
3172 	 * Use a notification wait, which really just processes the
3173 	 * command response and doesn't wait for anything, in order
3174 	 * to be able to process the response and get the UID inside
3175 	 * the RX path. Using CMD_WANT_SKB doesn't work because it
3176 	 * stores the buffer and then wakes up this thread, by which
3177 	 * time another notification (that the time event started)
3178 	 * might already be processed unsuccessfully.
3179 	 */
3180 	iwl_init_notification_wait(&mvm->notif_wait, &wait_time_event,
3181 				   time_event_response,
3182 				   ARRAY_SIZE(time_event_response),
3183 				   iwl_mvm_rx_aux_roc, te_data);
3184 
3185 	res = iwl_mvm_send_cmd_pdu(mvm, HOT_SPOT_CMD, 0, sizeof(aux_roc_req),
3186 				   &aux_roc_req);
3187 
3188 	if (res) {
3189 		IWL_ERR(mvm, "Couldn't send HOT_SPOT_CMD: %d\n", res);
3190 		iwl_remove_notification(&mvm->notif_wait, &wait_time_event);
3191 		goto out_clear_te;
3192 	}
3193 
3194 	/* No need to wait for anything, so just pass 1 (0 isn't valid) */
3195 	res = iwl_wait_notification(&mvm->notif_wait, &wait_time_event, 1);
3196 	/* should never fail */
3197 	WARN_ON_ONCE(res);
3198 
3199 	if (res) {
3200  out_clear_te:
3201 		spin_lock_bh(&mvm->time_event_lock);
3202 		iwl_mvm_te_clear_data(mvm, te_data);
3203 		spin_unlock_bh(&mvm->time_event_lock);
3204 	}
3205 
3206 	return res;
3207 }
3208 
3209 static int iwl_mvm_roc(struct ieee80211_hw *hw,
3210 		       struct ieee80211_vif *vif,
3211 		       struct ieee80211_channel *channel,
3212 		       int duration,
3213 		       enum ieee80211_roc_type type)
3214 {
3215 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3216 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3217 	struct cfg80211_chan_def chandef;
3218 	struct iwl_mvm_phy_ctxt *phy_ctxt;
3219 	int ret, i;
3220 
3221 	IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value,
3222 			   duration, type);
3223 
3224 	flush_work(&mvm->roc_done_wk);
3225 
3226 	mutex_lock(&mvm->mutex);
3227 
3228 	switch (vif->type) {
3229 	case NL80211_IFTYPE_STATION:
3230 		if (fw_has_capa(&mvm->fw->ucode_capa,
3231 				IWL_UCODE_TLV_CAPA_HOTSPOT_SUPPORT)) {
3232 			/* Use aux roc framework (HS20) */
3233 			ret = iwl_mvm_send_aux_roc_cmd(mvm, channel,
3234 						       vif, duration);
3235 			goto out_unlock;
3236 		}
3237 		IWL_ERR(mvm, "hotspot not supported\n");
3238 		ret = -EINVAL;
3239 		goto out_unlock;
3240 	case NL80211_IFTYPE_P2P_DEVICE:
3241 		/* handle below */
3242 		break;
3243 	default:
3244 		IWL_ERR(mvm, "vif isn't P2P_DEVICE: %d\n", vif->type);
3245 		ret = -EINVAL;
3246 		goto out_unlock;
3247 	}
3248 
3249 	for (i = 0; i < NUM_PHY_CTX; i++) {
3250 		phy_ctxt = &mvm->phy_ctxts[i];
3251 		if (phy_ctxt->ref == 0 || mvmvif->phy_ctxt == phy_ctxt)
3252 			continue;
3253 
3254 		if (phy_ctxt->ref && channel == phy_ctxt->channel) {
3255 			/*
3256 			 * Unbind the P2P_DEVICE from the current PHY context,
3257 			 * and if the PHY context is not used remove it.
3258 			 */
3259 			ret = iwl_mvm_binding_remove_vif(mvm, vif);
3260 			if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3261 				goto out_unlock;
3262 
3263 			iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3264 
3265 			/* Bind the P2P_DEVICE to the current PHY Context */
3266 			mvmvif->phy_ctxt = phy_ctxt;
3267 
3268 			ret = iwl_mvm_binding_add_vif(mvm, vif);
3269 			if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3270 				goto out_unlock;
3271 
3272 			iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3273 			goto schedule_time_event;
3274 		}
3275 	}
3276 
3277 	/* Need to update the PHY context only if the ROC channel changed */
3278 	if (channel == mvmvif->phy_ctxt->channel)
3279 		goto schedule_time_event;
3280 
3281 	cfg80211_chandef_create(&chandef, channel, NL80211_CHAN_NO_HT);
3282 
3283 	/*
3284 	 * Change the PHY context configuration as it is currently referenced
3285 	 * only by the P2P Device MAC
3286 	 */
3287 	if (mvmvif->phy_ctxt->ref == 1) {
3288 		ret = iwl_mvm_phy_ctxt_changed(mvm, mvmvif->phy_ctxt,
3289 					       &chandef, 1, 1);
3290 		if (ret)
3291 			goto out_unlock;
3292 	} else {
3293 		/*
3294 		 * The PHY context is shared with other MACs. Need to remove the
3295 		 * P2P Device from the binding, allocate an new PHY context and
3296 		 * create a new binding
3297 		 */
3298 		phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3299 		if (!phy_ctxt) {
3300 			ret = -ENOSPC;
3301 			goto out_unlock;
3302 		}
3303 
3304 		ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &chandef,
3305 					       1, 1);
3306 		if (ret) {
3307 			IWL_ERR(mvm, "Failed to change PHY context\n");
3308 			goto out_unlock;
3309 		}
3310 
3311 		/* Unbind the P2P_DEVICE from the current PHY context */
3312 		ret = iwl_mvm_binding_remove_vif(mvm, vif);
3313 		if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3314 			goto out_unlock;
3315 
3316 		iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3317 
3318 		/* Bind the P2P_DEVICE to the new allocated PHY context */
3319 		mvmvif->phy_ctxt = phy_ctxt;
3320 
3321 		ret = iwl_mvm_binding_add_vif(mvm, vif);
3322 		if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3323 			goto out_unlock;
3324 
3325 		iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3326 	}
3327 
3328 schedule_time_event:
3329 	/* Schedule the time events */
3330 	ret = iwl_mvm_start_p2p_roc(mvm, vif, duration, type);
3331 
3332 out_unlock:
3333 	mutex_unlock(&mvm->mutex);
3334 	IWL_DEBUG_MAC80211(mvm, "leave\n");
3335 	return ret;
3336 }
3337 
3338 static int iwl_mvm_cancel_roc(struct ieee80211_hw *hw)
3339 {
3340 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3341 
3342 	IWL_DEBUG_MAC80211(mvm, "enter\n");
3343 
3344 	mutex_lock(&mvm->mutex);
3345 	iwl_mvm_stop_roc(mvm);
3346 	mutex_unlock(&mvm->mutex);
3347 
3348 	IWL_DEBUG_MAC80211(mvm, "leave\n");
3349 	return 0;
3350 }
3351 
3352 static int __iwl_mvm_add_chanctx(struct iwl_mvm *mvm,
3353 				 struct ieee80211_chanctx_conf *ctx)
3354 {
3355 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3356 	struct iwl_mvm_phy_ctxt *phy_ctxt;
3357 	int ret;
3358 
3359 	lockdep_assert_held(&mvm->mutex);
3360 
3361 	IWL_DEBUG_MAC80211(mvm, "Add channel context\n");
3362 
3363 	phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3364 	if (!phy_ctxt) {
3365 		ret = -ENOSPC;
3366 		goto out;
3367 	}
3368 
3369 	ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx->min_def,
3370 				       ctx->rx_chains_static,
3371 				       ctx->rx_chains_dynamic);
3372 	if (ret) {
3373 		IWL_ERR(mvm, "Failed to add PHY context\n");
3374 		goto out;
3375 	}
3376 
3377 	iwl_mvm_phy_ctxt_ref(mvm, phy_ctxt);
3378 	*phy_ctxt_id = phy_ctxt->id;
3379 out:
3380 	return ret;
3381 }
3382 
3383 static int iwl_mvm_add_chanctx(struct ieee80211_hw *hw,
3384 			       struct ieee80211_chanctx_conf *ctx)
3385 {
3386 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3387 	int ret;
3388 
3389 	mutex_lock(&mvm->mutex);
3390 	ret = __iwl_mvm_add_chanctx(mvm, ctx);
3391 	mutex_unlock(&mvm->mutex);
3392 
3393 	return ret;
3394 }
3395 
3396 static void __iwl_mvm_remove_chanctx(struct iwl_mvm *mvm,
3397 				     struct ieee80211_chanctx_conf *ctx)
3398 {
3399 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3400 	struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3401 
3402 	lockdep_assert_held(&mvm->mutex);
3403 
3404 	iwl_mvm_phy_ctxt_unref(mvm, phy_ctxt);
3405 }
3406 
3407 static void iwl_mvm_remove_chanctx(struct ieee80211_hw *hw,
3408 				   struct ieee80211_chanctx_conf *ctx)
3409 {
3410 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3411 
3412 	mutex_lock(&mvm->mutex);
3413 	__iwl_mvm_remove_chanctx(mvm, ctx);
3414 	mutex_unlock(&mvm->mutex);
3415 }
3416 
3417 static void iwl_mvm_change_chanctx(struct ieee80211_hw *hw,
3418 				   struct ieee80211_chanctx_conf *ctx,
3419 				   u32 changed)
3420 {
3421 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3422 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3423 	struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3424 
3425 	if (WARN_ONCE((phy_ctxt->ref > 1) &&
3426 		      (changed & ~(IEEE80211_CHANCTX_CHANGE_WIDTH |
3427 				   IEEE80211_CHANCTX_CHANGE_RX_CHAINS |
3428 				   IEEE80211_CHANCTX_CHANGE_RADAR |
3429 				   IEEE80211_CHANCTX_CHANGE_MIN_WIDTH)),
3430 		      "Cannot change PHY. Ref=%d, changed=0x%X\n",
3431 		      phy_ctxt->ref, changed))
3432 		return;
3433 
3434 	mutex_lock(&mvm->mutex);
3435 	iwl_mvm_bt_coex_vif_change(mvm);
3436 	iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx->min_def,
3437 				 ctx->rx_chains_static,
3438 				 ctx->rx_chains_dynamic);
3439 	mutex_unlock(&mvm->mutex);
3440 }
3441 
3442 static int __iwl_mvm_assign_vif_chanctx(struct iwl_mvm *mvm,
3443 					struct ieee80211_vif *vif,
3444 					struct ieee80211_chanctx_conf *ctx,
3445 					bool switching_chanctx)
3446 {
3447 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3448 	struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3449 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3450 	int ret;
3451 
3452 	lockdep_assert_held(&mvm->mutex);
3453 
3454 	mvmvif->phy_ctxt = phy_ctxt;
3455 
3456 	switch (vif->type) {
3457 	case NL80211_IFTYPE_AP:
3458 		/* only needed if we're switching chanctx (i.e. during CSA) */
3459 		if (switching_chanctx) {
3460 			mvmvif->ap_ibss_active = true;
3461 			break;
3462 		}
3463 	case NL80211_IFTYPE_ADHOC:
3464 		/*
3465 		 * The AP binding flow is handled as part of the start_ap flow
3466 		 * (in bss_info_changed), similarly for IBSS.
3467 		 */
3468 		ret = 0;
3469 		goto out;
3470 	case NL80211_IFTYPE_STATION:
3471 		break;
3472 	case NL80211_IFTYPE_MONITOR:
3473 		/* always disable PS when a monitor interface is active */
3474 		mvmvif->ps_disabled = true;
3475 		break;
3476 	default:
3477 		ret = -EINVAL;
3478 		goto out;
3479 	}
3480 
3481 	ret = iwl_mvm_binding_add_vif(mvm, vif);
3482 	if (ret)
3483 		goto out;
3484 
3485 	/*
3486 	 * Power state must be updated before quotas,
3487 	 * otherwise fw will complain.
3488 	 */
3489 	iwl_mvm_power_update_mac(mvm);
3490 
3491 	/* Setting the quota at this stage is only required for monitor
3492 	 * interfaces. For the other types, the bss_info changed flow
3493 	 * will handle quota settings.
3494 	 */
3495 	if (vif->type == NL80211_IFTYPE_MONITOR) {
3496 		mvmvif->monitor_active = true;
3497 		ret = iwl_mvm_update_quotas(mvm, false, NULL);
3498 		if (ret)
3499 			goto out_remove_binding;
3500 
3501 		ret = iwl_mvm_add_snif_sta(mvm, vif);
3502 		if (ret)
3503 			goto out_remove_binding;
3504 
3505 	}
3506 
3507 	/* Handle binding during CSA */
3508 	if (vif->type == NL80211_IFTYPE_AP) {
3509 		iwl_mvm_update_quotas(mvm, false, NULL);
3510 		iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3511 	}
3512 
3513 	if (switching_chanctx && vif->type == NL80211_IFTYPE_STATION) {
3514 		u32 duration = 2 * vif->bss_conf.beacon_int;
3515 
3516 		/* iwl_mvm_protect_session() reads directly from the
3517 		 * device (the system time), so make sure it is
3518 		 * available.
3519 		 */
3520 		ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_PROTECT_CSA);
3521 		if (ret)
3522 			goto out_remove_binding;
3523 
3524 		/* Protect the session to make sure we hear the first
3525 		 * beacon on the new channel.
3526 		 */
3527 		iwl_mvm_protect_session(mvm, vif, duration, duration,
3528 					vif->bss_conf.beacon_int / 2,
3529 					true);
3530 
3531 		iwl_mvm_unref(mvm, IWL_MVM_REF_PROTECT_CSA);
3532 
3533 		iwl_mvm_update_quotas(mvm, false, NULL);
3534 	}
3535 
3536 	goto out;
3537 
3538 out_remove_binding:
3539 	iwl_mvm_binding_remove_vif(mvm, vif);
3540 	iwl_mvm_power_update_mac(mvm);
3541 out:
3542 	if (ret)
3543 		mvmvif->phy_ctxt = NULL;
3544 	return ret;
3545 }
3546 static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
3547 				      struct ieee80211_vif *vif,
3548 				      struct ieee80211_chanctx_conf *ctx)
3549 {
3550 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3551 	int ret;
3552 
3553 	mutex_lock(&mvm->mutex);
3554 	ret = __iwl_mvm_assign_vif_chanctx(mvm, vif, ctx, false);
3555 	mutex_unlock(&mvm->mutex);
3556 
3557 	return ret;
3558 }
3559 
3560 static void __iwl_mvm_unassign_vif_chanctx(struct iwl_mvm *mvm,
3561 					   struct ieee80211_vif *vif,
3562 					   struct ieee80211_chanctx_conf *ctx,
3563 					   bool switching_chanctx)
3564 {
3565 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3566 	struct ieee80211_vif *disabled_vif = NULL;
3567 
3568 	lockdep_assert_held(&mvm->mutex);
3569 
3570 	iwl_mvm_remove_time_event(mvm, mvmvif, &mvmvif->time_event_data);
3571 
3572 	switch (vif->type) {
3573 	case NL80211_IFTYPE_ADHOC:
3574 		goto out;
3575 	case NL80211_IFTYPE_MONITOR:
3576 		mvmvif->monitor_active = false;
3577 		mvmvif->ps_disabled = false;
3578 		iwl_mvm_rm_snif_sta(mvm, vif);
3579 		break;
3580 	case NL80211_IFTYPE_AP:
3581 		/* This part is triggered only during CSA */
3582 		if (!switching_chanctx || !mvmvif->ap_ibss_active)
3583 			goto out;
3584 
3585 		mvmvif->csa_countdown = false;
3586 
3587 		/* Set CS bit on all the stations */
3588 		iwl_mvm_modify_all_sta_disable_tx(mvm, mvmvif, true);
3589 
3590 		/* Save blocked iface, the timeout is set on the next beacon */
3591 		rcu_assign_pointer(mvm->csa_tx_blocked_vif, vif);
3592 
3593 		mvmvif->ap_ibss_active = false;
3594 		break;
3595 	case NL80211_IFTYPE_STATION:
3596 		if (!switching_chanctx)
3597 			break;
3598 
3599 		disabled_vif = vif;
3600 
3601 		iwl_mvm_mac_ctxt_changed(mvm, vif, true, NULL);
3602 		break;
3603 	default:
3604 		break;
3605 	}
3606 
3607 	iwl_mvm_update_quotas(mvm, false, disabled_vif);
3608 	iwl_mvm_binding_remove_vif(mvm, vif);
3609 
3610 out:
3611 	mvmvif->phy_ctxt = NULL;
3612 	iwl_mvm_power_update_mac(mvm);
3613 }
3614 
3615 static void iwl_mvm_unassign_vif_chanctx(struct ieee80211_hw *hw,
3616 					 struct ieee80211_vif *vif,
3617 					 struct ieee80211_chanctx_conf *ctx)
3618 {
3619 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3620 
3621 	mutex_lock(&mvm->mutex);
3622 	__iwl_mvm_unassign_vif_chanctx(mvm, vif, ctx, false);
3623 	mutex_unlock(&mvm->mutex);
3624 }
3625 
3626 static int
3627 iwl_mvm_switch_vif_chanctx_swap(struct iwl_mvm *mvm,
3628 				struct ieee80211_vif_chanctx_switch *vifs)
3629 {
3630 	int ret;
3631 
3632 	mutex_lock(&mvm->mutex);
3633 	__iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
3634 	__iwl_mvm_remove_chanctx(mvm, vifs[0].old_ctx);
3635 
3636 	ret = __iwl_mvm_add_chanctx(mvm, vifs[0].new_ctx);
3637 	if (ret) {
3638 		IWL_ERR(mvm, "failed to add new_ctx during channel switch\n");
3639 		goto out_reassign;
3640 	}
3641 
3642 	ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
3643 					   true);
3644 	if (ret) {
3645 		IWL_ERR(mvm,
3646 			"failed to assign new_ctx during channel switch\n");
3647 		goto out_remove;
3648 	}
3649 
3650 	/* we don't support TDLS during DCM - can be caused by channel switch */
3651 	if (iwl_mvm_phy_ctx_count(mvm) > 1)
3652 		iwl_mvm_teardown_tdls_peers(mvm);
3653 
3654 	goto out;
3655 
3656 out_remove:
3657 	__iwl_mvm_remove_chanctx(mvm, vifs[0].new_ctx);
3658 
3659 out_reassign:
3660 	if (__iwl_mvm_add_chanctx(mvm, vifs[0].old_ctx)) {
3661 		IWL_ERR(mvm, "failed to add old_ctx back after failure.\n");
3662 		goto out_restart;
3663 	}
3664 
3665 	if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
3666 					 true)) {
3667 		IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
3668 		goto out_restart;
3669 	}
3670 
3671 	goto out;
3672 
3673 out_restart:
3674 	/* things keep failing, better restart the hw */
3675 	iwl_mvm_nic_restart(mvm, false);
3676 
3677 out:
3678 	mutex_unlock(&mvm->mutex);
3679 
3680 	return ret;
3681 }
3682 
3683 static int
3684 iwl_mvm_switch_vif_chanctx_reassign(struct iwl_mvm *mvm,
3685 				    struct ieee80211_vif_chanctx_switch *vifs)
3686 {
3687 	int ret;
3688 
3689 	mutex_lock(&mvm->mutex);
3690 	__iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
3691 
3692 	ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
3693 					   true);
3694 	if (ret) {
3695 		IWL_ERR(mvm,
3696 			"failed to assign new_ctx during channel switch\n");
3697 		goto out_reassign;
3698 	}
3699 
3700 	goto out;
3701 
3702 out_reassign:
3703 	if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
3704 					 true)) {
3705 		IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
3706 		goto out_restart;
3707 	}
3708 
3709 	goto out;
3710 
3711 out_restart:
3712 	/* things keep failing, better restart the hw */
3713 	iwl_mvm_nic_restart(mvm, false);
3714 
3715 out:
3716 	mutex_unlock(&mvm->mutex);
3717 
3718 	return ret;
3719 }
3720 
3721 static int iwl_mvm_switch_vif_chanctx(struct ieee80211_hw *hw,
3722 				      struct ieee80211_vif_chanctx_switch *vifs,
3723 				      int n_vifs,
3724 				      enum ieee80211_chanctx_switch_mode mode)
3725 {
3726 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3727 	int ret;
3728 
3729 	/* we only support a single-vif right now */
3730 	if (n_vifs > 1)
3731 		return -EOPNOTSUPP;
3732 
3733 	switch (mode) {
3734 	case CHANCTX_SWMODE_SWAP_CONTEXTS:
3735 		ret = iwl_mvm_switch_vif_chanctx_swap(mvm, vifs);
3736 		break;
3737 	case CHANCTX_SWMODE_REASSIGN_VIF:
3738 		ret = iwl_mvm_switch_vif_chanctx_reassign(mvm, vifs);
3739 		break;
3740 	default:
3741 		ret = -EOPNOTSUPP;
3742 		break;
3743 	}
3744 
3745 	return ret;
3746 }
3747 
3748 static int iwl_mvm_tx_last_beacon(struct ieee80211_hw *hw)
3749 {
3750 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3751 
3752 	return mvm->ibss_manager;
3753 }
3754 
3755 static int iwl_mvm_set_tim(struct ieee80211_hw *hw,
3756 			   struct ieee80211_sta *sta,
3757 			   bool set)
3758 {
3759 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3760 	struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
3761 
3762 	if (!mvm_sta || !mvm_sta->vif) {
3763 		IWL_ERR(mvm, "Station is not associated to a vif\n");
3764 		return -EINVAL;
3765 	}
3766 
3767 	return iwl_mvm_mac_ctxt_beacon_changed(mvm, mvm_sta->vif);
3768 }
3769 
3770 #ifdef CONFIG_NL80211_TESTMODE
3771 static const struct nla_policy iwl_mvm_tm_policy[IWL_MVM_TM_ATTR_MAX + 1] = {
3772 	[IWL_MVM_TM_ATTR_CMD] = { .type = NLA_U32 },
3773 	[IWL_MVM_TM_ATTR_NOA_DURATION] = { .type = NLA_U32 },
3774 	[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE] = { .type = NLA_U32 },
3775 };
3776 
3777 static int __iwl_mvm_mac_testmode_cmd(struct iwl_mvm *mvm,
3778 				      struct ieee80211_vif *vif,
3779 				      void *data, int len)
3780 {
3781 	struct nlattr *tb[IWL_MVM_TM_ATTR_MAX + 1];
3782 	int err;
3783 	u32 noa_duration;
3784 
3785 	err = nla_parse(tb, IWL_MVM_TM_ATTR_MAX, data, len, iwl_mvm_tm_policy,
3786 			NULL);
3787 	if (err)
3788 		return err;
3789 
3790 	if (!tb[IWL_MVM_TM_ATTR_CMD])
3791 		return -EINVAL;
3792 
3793 	switch (nla_get_u32(tb[IWL_MVM_TM_ATTR_CMD])) {
3794 	case IWL_MVM_TM_CMD_SET_NOA:
3795 		if (!vif || vif->type != NL80211_IFTYPE_AP || !vif->p2p ||
3796 		    !vif->bss_conf.enable_beacon ||
3797 		    !tb[IWL_MVM_TM_ATTR_NOA_DURATION])
3798 			return -EINVAL;
3799 
3800 		noa_duration = nla_get_u32(tb[IWL_MVM_TM_ATTR_NOA_DURATION]);
3801 		if (noa_duration >= vif->bss_conf.beacon_int)
3802 			return -EINVAL;
3803 
3804 		mvm->noa_duration = noa_duration;
3805 		mvm->noa_vif = vif;
3806 
3807 		return iwl_mvm_update_quotas(mvm, false, NULL);
3808 	case IWL_MVM_TM_CMD_SET_BEACON_FILTER:
3809 		/* must be associated client vif - ignore authorized */
3810 		if (!vif || vif->type != NL80211_IFTYPE_STATION ||
3811 		    !vif->bss_conf.assoc || !vif->bss_conf.dtim_period ||
3812 		    !tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE])
3813 			return -EINVAL;
3814 
3815 		if (nla_get_u32(tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE]))
3816 			return iwl_mvm_enable_beacon_filter(mvm, vif, 0);
3817 		return iwl_mvm_disable_beacon_filter(mvm, vif, 0);
3818 	}
3819 
3820 	return -EOPNOTSUPP;
3821 }
3822 
3823 static int iwl_mvm_mac_testmode_cmd(struct ieee80211_hw *hw,
3824 				    struct ieee80211_vif *vif,
3825 				    void *data, int len)
3826 {
3827 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3828 	int err;
3829 
3830 	mutex_lock(&mvm->mutex);
3831 	err = __iwl_mvm_mac_testmode_cmd(mvm, vif, data, len);
3832 	mutex_unlock(&mvm->mutex);
3833 
3834 	return err;
3835 }
3836 #endif
3837 
3838 static void iwl_mvm_channel_switch(struct ieee80211_hw *hw,
3839 				   struct ieee80211_vif *vif,
3840 				   struct ieee80211_channel_switch *chsw)
3841 {
3842 	/* By implementing this operation, we prevent mac80211 from
3843 	 * starting its own channel switch timer, so that we can call
3844 	 * ieee80211_chswitch_done() ourselves at the right time
3845 	 * (which is when the absence time event starts).
3846 	 */
3847 
3848 	IWL_DEBUG_MAC80211(IWL_MAC80211_GET_MVM(hw),
3849 			   "dummy channel switch op\n");
3850 }
3851 
3852 static int iwl_mvm_pre_channel_switch(struct ieee80211_hw *hw,
3853 				      struct ieee80211_vif *vif,
3854 				      struct ieee80211_channel_switch *chsw)
3855 {
3856 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3857 	struct ieee80211_vif *csa_vif;
3858 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3859 	u32 apply_time;
3860 	int ret;
3861 
3862 	mutex_lock(&mvm->mutex);
3863 
3864 	mvmvif->csa_failed = false;
3865 
3866 	IWL_DEBUG_MAC80211(mvm, "pre CSA to freq %d\n",
3867 			   chsw->chandef.center_freq1);
3868 
3869 	iwl_fw_dbg_trigger_simple_stop(&mvm->fwrt,
3870 				       ieee80211_vif_to_wdev(vif),
3871 				       FW_DBG_TRIGGER_CHANNEL_SWITCH);
3872 
3873 	switch (vif->type) {
3874 	case NL80211_IFTYPE_AP:
3875 		csa_vif =
3876 			rcu_dereference_protected(mvm->csa_vif,
3877 						  lockdep_is_held(&mvm->mutex));
3878 		if (WARN_ONCE(csa_vif && csa_vif->csa_active,
3879 			      "Another CSA is already in progress")) {
3880 			ret = -EBUSY;
3881 			goto out_unlock;
3882 		}
3883 
3884 		/* we still didn't unblock tx. prevent new CS meanwhile */
3885 		if (rcu_dereference_protected(mvm->csa_tx_blocked_vif,
3886 					      lockdep_is_held(&mvm->mutex))) {
3887 			ret = -EBUSY;
3888 			goto out_unlock;
3889 		}
3890 
3891 		rcu_assign_pointer(mvm->csa_vif, vif);
3892 
3893 		if (WARN_ONCE(mvmvif->csa_countdown,
3894 			      "Previous CSA countdown didn't complete")) {
3895 			ret = -EBUSY;
3896 			goto out_unlock;
3897 		}
3898 
3899 		mvmvif->csa_target_freq = chsw->chandef.chan->center_freq;
3900 
3901 		break;
3902 	case NL80211_IFTYPE_STATION:
3903 		if (mvmvif->lqm_active)
3904 			iwl_mvm_send_lqm_cmd(vif,
3905 					     LQM_CMD_OPERATION_STOP_MEASUREMENT,
3906 					     0, 0);
3907 
3908 		/* Schedule the time event to a bit before beacon 1,
3909 		 * to make sure we're in the new channel when the
3910 		 * GO/AP arrives. In case count <= 1 immediately schedule the
3911 		 * TE (this might result with some packet loss or connection
3912 		 * loss).
3913 		 */
3914 		if (chsw->count <= 1)
3915 			apply_time = 0;
3916 		else
3917 			apply_time = chsw->device_timestamp +
3918 				((vif->bss_conf.beacon_int * (chsw->count - 1) -
3919 				  IWL_MVM_CHANNEL_SWITCH_TIME_CLIENT) * 1024);
3920 
3921 		if (chsw->block_tx)
3922 			iwl_mvm_csa_client_absent(mvm, vif);
3923 
3924 		iwl_mvm_schedule_csa_period(mvm, vif, vif->bss_conf.beacon_int,
3925 					    apply_time);
3926 		if (mvmvif->bf_data.bf_enabled) {
3927 			ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
3928 			if (ret)
3929 				goto out_unlock;
3930 		}
3931 
3932 		break;
3933 	default:
3934 		break;
3935 	}
3936 
3937 	mvmvif->ps_disabled = true;
3938 
3939 	ret = iwl_mvm_power_update_ps(mvm);
3940 	if (ret)
3941 		goto out_unlock;
3942 
3943 	/* we won't be on this channel any longer */
3944 	iwl_mvm_teardown_tdls_peers(mvm);
3945 
3946 out_unlock:
3947 	mutex_unlock(&mvm->mutex);
3948 
3949 	return ret;
3950 }
3951 
3952 static int iwl_mvm_post_channel_switch(struct ieee80211_hw *hw,
3953 				       struct ieee80211_vif *vif)
3954 {
3955 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3956 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3957 	int ret;
3958 
3959 	mutex_lock(&mvm->mutex);
3960 
3961 	if (mvmvif->csa_failed) {
3962 		mvmvif->csa_failed = false;
3963 		ret = -EIO;
3964 		goto out_unlock;
3965 	}
3966 
3967 	if (vif->type == NL80211_IFTYPE_STATION) {
3968 		struct iwl_mvm_sta *mvmsta;
3969 
3970 		mvmsta = iwl_mvm_sta_from_staid_protected(mvm,
3971 							  mvmvif->ap_sta_id);
3972 
3973 		if (WARN_ON(!mvmsta)) {
3974 			ret = -EIO;
3975 			goto out_unlock;
3976 		}
3977 
3978 		iwl_mvm_sta_modify_disable_tx(mvm, mvmsta, false);
3979 
3980 		iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3981 
3982 		ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
3983 		if (ret)
3984 			goto out_unlock;
3985 
3986 		iwl_mvm_stop_session_protection(mvm, vif);
3987 	}
3988 
3989 	mvmvif->ps_disabled = false;
3990 
3991 	ret = iwl_mvm_power_update_ps(mvm);
3992 
3993 out_unlock:
3994 	mutex_unlock(&mvm->mutex);
3995 
3996 	return ret;
3997 }
3998 
3999 static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop)
4000 {
4001 	if (drop) {
4002 		if (iwl_mvm_has_new_tx_api(mvm))
4003 			/* TODO new tx api */
4004 			WARN_ONCE(1,
4005 				  "Need to implement flush TX queue\n");
4006 		else
4007 			iwl_mvm_flush_tx_path(mvm,
4008 				iwl_mvm_flushable_queues(mvm) & queues,
4009 				0);
4010 	} else {
4011 		if (iwl_mvm_has_new_tx_api(mvm)) {
4012 			struct ieee80211_sta *sta;
4013 			int i;
4014 
4015 			mutex_lock(&mvm->mutex);
4016 
4017 			for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
4018 				sta = rcu_dereference_protected(
4019 						mvm->fw_id_to_mac_id[i],
4020 						lockdep_is_held(&mvm->mutex));
4021 				if (IS_ERR_OR_NULL(sta))
4022 					continue;
4023 
4024 				iwl_mvm_wait_sta_queues_empty(mvm,
4025 						iwl_mvm_sta_from_mac80211(sta));
4026 			}
4027 
4028 			mutex_unlock(&mvm->mutex);
4029 		} else {
4030 			iwl_trans_wait_tx_queues_empty(mvm->trans,
4031 						       queues);
4032 		}
4033 	}
4034 }
4035 
4036 static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
4037 			      struct ieee80211_vif *vif, u32 queues, bool drop)
4038 {
4039 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4040 	struct iwl_mvm_vif *mvmvif;
4041 	struct iwl_mvm_sta *mvmsta;
4042 	struct ieee80211_sta *sta;
4043 	int i;
4044 	u32 msk = 0;
4045 
4046 	if (!vif) {
4047 		iwl_mvm_flush_no_vif(mvm, queues, drop);
4048 		return;
4049 	}
4050 
4051 	if (vif->type != NL80211_IFTYPE_STATION)
4052 		return;
4053 
4054 	/* Make sure we're done with the deferred traffic before flushing */
4055 	flush_work(&mvm->add_stream_wk);
4056 
4057 	mutex_lock(&mvm->mutex);
4058 	mvmvif = iwl_mvm_vif_from_mac80211(vif);
4059 
4060 	/* flush the AP-station and all TDLS peers */
4061 	for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
4062 		sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
4063 						lockdep_is_held(&mvm->mutex));
4064 		if (IS_ERR_OR_NULL(sta))
4065 			continue;
4066 
4067 		mvmsta = iwl_mvm_sta_from_mac80211(sta);
4068 		if (mvmsta->vif != vif)
4069 			continue;
4070 
4071 		/* make sure only TDLS peers or the AP are flushed */
4072 		WARN_ON(i != mvmvif->ap_sta_id && !sta->tdls);
4073 
4074 		if (drop) {
4075 			if (iwl_mvm_flush_sta(mvm, mvmsta, false, 0))
4076 				IWL_ERR(mvm, "flush request fail\n");
4077 		} else {
4078 			msk |= mvmsta->tfd_queue_msk;
4079 			if (iwl_mvm_has_new_tx_api(mvm))
4080 				iwl_mvm_wait_sta_queues_empty(mvm, mvmsta);
4081 		}
4082 	}
4083 
4084 	mutex_unlock(&mvm->mutex);
4085 
4086 	/* this can take a while, and we may need/want other operations
4087 	 * to succeed while doing this, so do it without the mutex held
4088 	 */
4089 	if (!drop && !iwl_mvm_has_new_tx_api(mvm))
4090 		iwl_trans_wait_tx_queues_empty(mvm->trans, msk);
4091 }
4092 
4093 static int iwl_mvm_mac_get_survey(struct ieee80211_hw *hw, int idx,
4094 				  struct survey_info *survey)
4095 {
4096 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4097 	int ret;
4098 
4099 	memset(survey, 0, sizeof(*survey));
4100 
4101 	/* only support global statistics right now */
4102 	if (idx != 0)
4103 		return -ENOENT;
4104 
4105 	if (!fw_has_capa(&mvm->fw->ucode_capa,
4106 			 IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
4107 		return -ENOENT;
4108 
4109 	mutex_lock(&mvm->mutex);
4110 
4111 	if (iwl_mvm_firmware_running(mvm)) {
4112 		ret = iwl_mvm_request_statistics(mvm, false);
4113 		if (ret)
4114 			goto out;
4115 	}
4116 
4117 	survey->filled = SURVEY_INFO_TIME |
4118 			 SURVEY_INFO_TIME_RX |
4119 			 SURVEY_INFO_TIME_TX |
4120 			 SURVEY_INFO_TIME_SCAN;
4121 	survey->time = mvm->accu_radio_stats.on_time_rf +
4122 		       mvm->radio_stats.on_time_rf;
4123 	do_div(survey->time, USEC_PER_MSEC);
4124 
4125 	survey->time_rx = mvm->accu_radio_stats.rx_time +
4126 			  mvm->radio_stats.rx_time;
4127 	do_div(survey->time_rx, USEC_PER_MSEC);
4128 
4129 	survey->time_tx = mvm->accu_radio_stats.tx_time +
4130 			  mvm->radio_stats.tx_time;
4131 	do_div(survey->time_tx, USEC_PER_MSEC);
4132 
4133 	survey->time_scan = mvm->accu_radio_stats.on_time_scan +
4134 			    mvm->radio_stats.on_time_scan;
4135 	do_div(survey->time_scan, USEC_PER_MSEC);
4136 
4137 	ret = 0;
4138  out:
4139 	mutex_unlock(&mvm->mutex);
4140 	return ret;
4141 }
4142 
4143 static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,
4144 				       struct ieee80211_vif *vif,
4145 				       struct ieee80211_sta *sta,
4146 				       struct station_info *sinfo)
4147 {
4148 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4149 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4150 	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
4151 
4152 	if (mvmsta->avg_energy) {
4153 		sinfo->signal_avg = mvmsta->avg_energy;
4154 		sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL_AVG);
4155 	}
4156 
4157 	if (!fw_has_capa(&mvm->fw->ucode_capa,
4158 			 IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
4159 		return;
4160 
4161 	/* if beacon filtering isn't on mac80211 does it anyway */
4162 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
4163 		return;
4164 
4165 	if (!vif->bss_conf.assoc)
4166 		return;
4167 
4168 	mutex_lock(&mvm->mutex);
4169 
4170 	if (mvmvif->ap_sta_id != mvmsta->sta_id)
4171 		goto unlock;
4172 
4173 	if (iwl_mvm_request_statistics(mvm, false))
4174 		goto unlock;
4175 
4176 	sinfo->rx_beacon = mvmvif->beacon_stats.num_beacons +
4177 			   mvmvif->beacon_stats.accu_num_beacons;
4178 	sinfo->filled |= BIT(NL80211_STA_INFO_BEACON_RX);
4179 	if (mvmvif->beacon_stats.avg_signal) {
4180 		/* firmware only reports a value after RXing a few beacons */
4181 		sinfo->rx_beacon_signal_avg = mvmvif->beacon_stats.avg_signal;
4182 		sinfo->filled |= BIT(NL80211_STA_INFO_BEACON_SIGNAL_AVG);
4183 	}
4184  unlock:
4185 	mutex_unlock(&mvm->mutex);
4186 }
4187 
4188 static void iwl_mvm_event_mlme_callback(struct iwl_mvm *mvm,
4189 					struct ieee80211_vif *vif,
4190 					const struct ieee80211_event *event)
4191 {
4192 #define CHECK_MLME_TRIGGER(_cnt, _fmt...)				\
4193 	do {								\
4194 		if ((trig_mlme->_cnt) && --(trig_mlme->_cnt))		\
4195 			break;						\
4196 		iwl_fw_dbg_collect_trig(&(mvm)->fwrt, trig, _fmt);	\
4197 	} while (0)
4198 
4199 	struct iwl_fw_dbg_trigger_tlv *trig;
4200 	struct iwl_fw_dbg_trigger_mlme *trig_mlme;
4201 
4202 	if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_MLME))
4203 		return;
4204 
4205 	trig = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_MLME);
4206 	trig_mlme = (void *)trig->data;
4207 	if (!iwl_fw_dbg_trigger_check_stop(&mvm->fwrt,
4208 					   ieee80211_vif_to_wdev(vif), trig))
4209 		return;
4210 
4211 	if (event->u.mlme.data == ASSOC_EVENT) {
4212 		if (event->u.mlme.status == MLME_DENIED)
4213 			CHECK_MLME_TRIGGER(stop_assoc_denied,
4214 					   "DENIED ASSOC: reason %d",
4215 					    event->u.mlme.reason);
4216 		else if (event->u.mlme.status == MLME_TIMEOUT)
4217 			CHECK_MLME_TRIGGER(stop_assoc_timeout,
4218 					   "ASSOC TIMEOUT");
4219 	} else if (event->u.mlme.data == AUTH_EVENT) {
4220 		if (event->u.mlme.status == MLME_DENIED)
4221 			CHECK_MLME_TRIGGER(stop_auth_denied,
4222 					   "DENIED AUTH: reason %d",
4223 					   event->u.mlme.reason);
4224 		else if (event->u.mlme.status == MLME_TIMEOUT)
4225 			CHECK_MLME_TRIGGER(stop_auth_timeout,
4226 					   "AUTH TIMEOUT");
4227 	} else if (event->u.mlme.data == DEAUTH_RX_EVENT) {
4228 		CHECK_MLME_TRIGGER(stop_rx_deauth,
4229 				   "DEAUTH RX %d", event->u.mlme.reason);
4230 	} else if (event->u.mlme.data == DEAUTH_TX_EVENT) {
4231 		CHECK_MLME_TRIGGER(stop_tx_deauth,
4232 				   "DEAUTH TX %d", event->u.mlme.reason);
4233 	}
4234 #undef CHECK_MLME_TRIGGER
4235 }
4236 
4237 static void iwl_mvm_event_bar_rx_callback(struct iwl_mvm *mvm,
4238 					  struct ieee80211_vif *vif,
4239 					  const struct ieee80211_event *event)
4240 {
4241 	struct iwl_fw_dbg_trigger_tlv *trig;
4242 	struct iwl_fw_dbg_trigger_ba *ba_trig;
4243 
4244 	if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_BA))
4245 		return;
4246 
4247 	trig = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_BA);
4248 	ba_trig = (void *)trig->data;
4249 	if (!iwl_fw_dbg_trigger_check_stop(&mvm->fwrt,
4250 					   ieee80211_vif_to_wdev(vif), trig))
4251 		return;
4252 
4253 	if (!(le16_to_cpu(ba_trig->rx_bar) & BIT(event->u.ba.tid)))
4254 		return;
4255 
4256 	iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
4257 				"BAR received from %pM, tid %d, ssn %d",
4258 				event->u.ba.sta->addr, event->u.ba.tid,
4259 				event->u.ba.ssn);
4260 }
4261 
4262 static void
4263 iwl_mvm_event_frame_timeout_callback(struct iwl_mvm *mvm,
4264 				     struct ieee80211_vif *vif,
4265 				     const struct ieee80211_event *event)
4266 {
4267 	struct iwl_fw_dbg_trigger_tlv *trig;
4268 	struct iwl_fw_dbg_trigger_ba *ba_trig;
4269 
4270 	if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_BA))
4271 		return;
4272 
4273 	trig = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_BA);
4274 	ba_trig = (void *)trig->data;
4275 	if (!iwl_fw_dbg_trigger_check_stop(&mvm->fwrt,
4276 					   ieee80211_vif_to_wdev(vif), trig))
4277 		return;
4278 
4279 	if (!(le16_to_cpu(ba_trig->frame_timeout) & BIT(event->u.ba.tid)))
4280 		return;
4281 
4282 	iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
4283 				"Frame from %pM timed out, tid %d",
4284 				event->u.ba.sta->addr, event->u.ba.tid);
4285 }
4286 
4287 static void iwl_mvm_mac_event_callback(struct ieee80211_hw *hw,
4288 				       struct ieee80211_vif *vif,
4289 				       const struct ieee80211_event *event)
4290 {
4291 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4292 
4293 	switch (event->type) {
4294 	case MLME_EVENT:
4295 		iwl_mvm_event_mlme_callback(mvm, vif, event);
4296 		break;
4297 	case BAR_RX_EVENT:
4298 		iwl_mvm_event_bar_rx_callback(mvm, vif, event);
4299 		break;
4300 	case BA_FRAME_TIMEOUT:
4301 		iwl_mvm_event_frame_timeout_callback(mvm, vif, event);
4302 		break;
4303 	default:
4304 		break;
4305 	}
4306 }
4307 
4308 void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm,
4309 				     struct iwl_mvm_internal_rxq_notif *notif,
4310 				     u32 size)
4311 {
4312 	u32 qmask = BIT(mvm->trans->num_rx_queues) - 1;
4313 	int ret;
4314 
4315 	lockdep_assert_held(&mvm->mutex);
4316 
4317 	/* TODO - remove a000 disablement when we have RXQ config API */
4318 	if (!iwl_mvm_has_new_rx_api(mvm) ||
4319 	    mvm->trans->cfg->device_family == IWL_DEVICE_FAMILY_A000)
4320 		return;
4321 
4322 	notif->cookie = mvm->queue_sync_cookie;
4323 
4324 	if (notif->sync)
4325 		atomic_set(&mvm->queue_sync_counter,
4326 			   mvm->trans->num_rx_queues);
4327 
4328 	ret = iwl_mvm_notify_rx_queue(mvm, qmask, (u8 *)notif, size);
4329 	if (ret) {
4330 		IWL_ERR(mvm, "Failed to trigger RX queues sync (%d)\n", ret);
4331 		goto out;
4332 	}
4333 
4334 	if (notif->sync) {
4335 		ret = wait_event_timeout(mvm->rx_sync_waitq,
4336 					 atomic_read(&mvm->queue_sync_counter) == 0 ||
4337 					 iwl_mvm_is_radio_killed(mvm),
4338 					 HZ);
4339 		WARN_ON_ONCE(!ret && !iwl_mvm_is_radio_killed(mvm));
4340 	}
4341 
4342 out:
4343 	atomic_set(&mvm->queue_sync_counter, 0);
4344 	mvm->queue_sync_cookie++;
4345 }
4346 
4347 static void iwl_mvm_sync_rx_queues(struct ieee80211_hw *hw)
4348 {
4349 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4350 	struct iwl_mvm_internal_rxq_notif data = {
4351 		.type = IWL_MVM_RXQ_EMPTY,
4352 		.sync = 1,
4353 	};
4354 
4355 	mutex_lock(&mvm->mutex);
4356 	iwl_mvm_sync_rx_queues_internal(mvm, &data, sizeof(data));
4357 	mutex_unlock(&mvm->mutex);
4358 }
4359 
4360 const struct ieee80211_ops iwl_mvm_hw_ops = {
4361 	.tx = iwl_mvm_mac_tx,
4362 	.ampdu_action = iwl_mvm_mac_ampdu_action,
4363 	.start = iwl_mvm_mac_start,
4364 	.reconfig_complete = iwl_mvm_mac_reconfig_complete,
4365 	.stop = iwl_mvm_mac_stop,
4366 	.add_interface = iwl_mvm_mac_add_interface,
4367 	.remove_interface = iwl_mvm_mac_remove_interface,
4368 	.config = iwl_mvm_mac_config,
4369 	.prepare_multicast = iwl_mvm_prepare_multicast,
4370 	.configure_filter = iwl_mvm_configure_filter,
4371 	.config_iface_filter = iwl_mvm_config_iface_filter,
4372 	.bss_info_changed = iwl_mvm_bss_info_changed,
4373 	.hw_scan = iwl_mvm_mac_hw_scan,
4374 	.cancel_hw_scan = iwl_mvm_mac_cancel_hw_scan,
4375 	.sta_pre_rcu_remove = iwl_mvm_sta_pre_rcu_remove,
4376 	.sta_state = iwl_mvm_mac_sta_state,
4377 	.sta_notify = iwl_mvm_mac_sta_notify,
4378 	.allow_buffered_frames = iwl_mvm_mac_allow_buffered_frames,
4379 	.release_buffered_frames = iwl_mvm_mac_release_buffered_frames,
4380 	.set_rts_threshold = iwl_mvm_mac_set_rts_threshold,
4381 	.sta_rc_update = iwl_mvm_sta_rc_update,
4382 	.conf_tx = iwl_mvm_mac_conf_tx,
4383 	.mgd_prepare_tx = iwl_mvm_mac_mgd_prepare_tx,
4384 	.mgd_protect_tdls_discover = iwl_mvm_mac_mgd_protect_tdls_discover,
4385 	.flush = iwl_mvm_mac_flush,
4386 	.sched_scan_start = iwl_mvm_mac_sched_scan_start,
4387 	.sched_scan_stop = iwl_mvm_mac_sched_scan_stop,
4388 	.set_key = iwl_mvm_mac_set_key,
4389 	.update_tkip_key = iwl_mvm_mac_update_tkip_key,
4390 	.remain_on_channel = iwl_mvm_roc,
4391 	.cancel_remain_on_channel = iwl_mvm_cancel_roc,
4392 	.add_chanctx = iwl_mvm_add_chanctx,
4393 	.remove_chanctx = iwl_mvm_remove_chanctx,
4394 	.change_chanctx = iwl_mvm_change_chanctx,
4395 	.assign_vif_chanctx = iwl_mvm_assign_vif_chanctx,
4396 	.unassign_vif_chanctx = iwl_mvm_unassign_vif_chanctx,
4397 	.switch_vif_chanctx = iwl_mvm_switch_vif_chanctx,
4398 
4399 	.start_ap = iwl_mvm_start_ap_ibss,
4400 	.stop_ap = iwl_mvm_stop_ap_ibss,
4401 	.join_ibss = iwl_mvm_start_ap_ibss,
4402 	.leave_ibss = iwl_mvm_stop_ap_ibss,
4403 
4404 	.tx_last_beacon = iwl_mvm_tx_last_beacon,
4405 
4406 	.set_tim = iwl_mvm_set_tim,
4407 
4408 	.channel_switch = iwl_mvm_channel_switch,
4409 	.pre_channel_switch = iwl_mvm_pre_channel_switch,
4410 	.post_channel_switch = iwl_mvm_post_channel_switch,
4411 
4412 	.tdls_channel_switch = iwl_mvm_tdls_channel_switch,
4413 	.tdls_cancel_channel_switch = iwl_mvm_tdls_cancel_channel_switch,
4414 	.tdls_recv_channel_switch = iwl_mvm_tdls_recv_channel_switch,
4415 
4416 	.event_callback = iwl_mvm_mac_event_callback,
4417 
4418 	.sync_rx_queues = iwl_mvm_sync_rx_queues,
4419 
4420 	CFG80211_TESTMODE_CMD(iwl_mvm_mac_testmode_cmd)
4421 
4422 #ifdef CONFIG_PM_SLEEP
4423 	/* look at d3.c */
4424 	.suspend = iwl_mvm_suspend,
4425 	.resume = iwl_mvm_resume,
4426 	.set_wakeup = iwl_mvm_set_wakeup,
4427 	.set_rekey_data = iwl_mvm_set_rekey_data,
4428 #if IS_ENABLED(CONFIG_IPV6)
4429 	.ipv6_addr_change = iwl_mvm_ipv6_addr_change,
4430 #endif
4431 	.set_default_unicast_key = iwl_mvm_set_default_unicast_key,
4432 #endif
4433 	.get_survey = iwl_mvm_mac_get_survey,
4434 	.sta_statistics = iwl_mvm_mac_sta_statistics,
4435 };
4436