xref: /openbmc/linux/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c (revision dd2934a95701576203b2f61e8ded4e4a2f9183ea)
1 /******************************************************************************
2  *
3  * This file is provided under a dual BSD/GPLv2 license.  When using or
4  * redistributing this file, you may do so under either license.
5  *
6  * GPL LICENSE SUMMARY
7  *
8  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
9  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
10  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
11  * Copyright(c) 2018        Intel Corporation
12  *
13  * This program is free software; you can redistribute it and/or modify
14  * it under the terms of version 2 of the GNU General Public License as
15  * published by the Free Software Foundation.
16  *
17  * This program is distributed in the hope that it will be useful, but
18  * WITHOUT ANY WARRANTY; without even the implied warranty of
19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
20  * General Public License for more details.
21  *
22  * You should have received a copy of the GNU General Public License
23  * along with this program; if not, write to the Free Software
24  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
25  * USA
26  *
27  * The full GNU General Public License is included in this distribution
28  * in the file called COPYING.
29  *
30  * Contact Information:
31  *  Intel Linux Wireless <linuxwifi@intel.com>
32  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
33  *
34  * BSD LICENSE
35  *
36  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
37  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
38  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
39  * Copyright(c) 2018        Intel Corporation
40  * All rights reserved.
41  *
42  * Redistribution and use in source and binary forms, with or without
43  * modification, are permitted provided that the following conditions
44  * are met:
45  *
46  *  * Redistributions of source code must retain the above copyright
47  *    notice, this list of conditions and the following disclaimer.
48  *  * Redistributions in binary form must reproduce the above copyright
49  *    notice, this list of conditions and the following disclaimer in
50  *    the documentation and/or other materials provided with the
51  *    distribution.
52  *  * Neither the name Intel Corporation nor the names of its
53  *    contributors may be used to endorse or promote products derived
54  *    from this software without specific prior written permission.
55  *
56  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
57  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
58  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
59  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
60  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
61  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
62  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
63  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
64  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
65  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
66  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
67  *
68  *****************************************************************************/
69 #include <linux/kernel.h>
70 #include <linux/slab.h>
71 #include <linux/skbuff.h>
72 #include <linux/netdevice.h>
73 #include <linux/etherdevice.h>
74 #include <linux/ip.h>
75 #include <linux/if_arp.h>
76 #include <linux/time.h>
77 #include <net/mac80211.h>
78 #include <net/ieee80211_radiotap.h>
79 #include <net/tcp.h>
80 
81 #include "iwl-op-mode.h"
82 #include "iwl-io.h"
83 #include "mvm.h"
84 #include "sta.h"
85 #include "time-event.h"
86 #include "iwl-eeprom-parse.h"
87 #include "iwl-phy-db.h"
88 #include "testmode.h"
89 #include "fw/error-dump.h"
90 #include "iwl-prph.h"
91 #include "iwl-nvm-parse.h"
92 
93 static const struct ieee80211_iface_limit iwl_mvm_limits[] = {
94 	{
95 		.max = 1,
96 		.types = BIT(NL80211_IFTYPE_STATION),
97 	},
98 	{
99 		.max = 1,
100 		.types = BIT(NL80211_IFTYPE_AP) |
101 			BIT(NL80211_IFTYPE_P2P_CLIENT) |
102 			BIT(NL80211_IFTYPE_P2P_GO),
103 	},
104 	{
105 		.max = 1,
106 		.types = BIT(NL80211_IFTYPE_P2P_DEVICE),
107 	},
108 };
109 
110 static const struct ieee80211_iface_combination iwl_mvm_iface_combinations[] = {
111 	{
112 		.num_different_channels = 2,
113 		.max_interfaces = 3,
114 		.limits = iwl_mvm_limits,
115 		.n_limits = ARRAY_SIZE(iwl_mvm_limits),
116 	},
117 };
118 
119 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
120 /*
121  * Use the reserved field to indicate magic values.
122  * these values will only be used internally by the driver,
123  * and won't make it to the fw (reserved will be 0).
124  * BC_FILTER_MAGIC_IP - configure the val of this attribute to
125  *	be the vif's ip address. in case there is not a single
126  *	ip address (0, or more than 1), this attribute will
127  *	be skipped.
128  * BC_FILTER_MAGIC_MAC - set the val of this attribute to
129  *	the LSB bytes of the vif's mac address
130  */
131 enum {
132 	BC_FILTER_MAGIC_NONE = 0,
133 	BC_FILTER_MAGIC_IP,
134 	BC_FILTER_MAGIC_MAC,
135 };
136 
137 static const struct iwl_fw_bcast_filter iwl_mvm_default_bcast_filters[] = {
138 	{
139 		/* arp */
140 		.discard = 0,
141 		.frame_type = BCAST_FILTER_FRAME_TYPE_ALL,
142 		.attrs = {
143 			{
144 				/* frame type - arp, hw type - ethernet */
145 				.offset_type =
146 					BCAST_FILTER_OFFSET_PAYLOAD_START,
147 				.offset = sizeof(rfc1042_header),
148 				.val = cpu_to_be32(0x08060001),
149 				.mask = cpu_to_be32(0xffffffff),
150 			},
151 			{
152 				/* arp dest ip */
153 				.offset_type =
154 					BCAST_FILTER_OFFSET_PAYLOAD_START,
155 				.offset = sizeof(rfc1042_header) + 2 +
156 					  sizeof(struct arphdr) +
157 					  ETH_ALEN + sizeof(__be32) +
158 					  ETH_ALEN,
159 				.mask = cpu_to_be32(0xffffffff),
160 				/* mark it as special field */
161 				.reserved1 = cpu_to_le16(BC_FILTER_MAGIC_IP),
162 			},
163 		},
164 	},
165 	{
166 		/* dhcp offer bcast */
167 		.discard = 0,
168 		.frame_type = BCAST_FILTER_FRAME_TYPE_IPV4,
169 		.attrs = {
170 			{
171 				/* udp dest port - 68 (bootp client)*/
172 				.offset_type = BCAST_FILTER_OFFSET_IP_END,
173 				.offset = offsetof(struct udphdr, dest),
174 				.val = cpu_to_be32(0x00440000),
175 				.mask = cpu_to_be32(0xffff0000),
176 			},
177 			{
178 				/* dhcp - lsb bytes of client hw address */
179 				.offset_type = BCAST_FILTER_OFFSET_IP_END,
180 				.offset = 38,
181 				.mask = cpu_to_be32(0xffffffff),
182 				/* mark it as special field */
183 				.reserved1 = cpu_to_le16(BC_FILTER_MAGIC_MAC),
184 			},
185 		},
186 	},
187 	/* last filter must be empty */
188 	{},
189 };
190 #endif
191 
192 void iwl_mvm_ref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
193 {
194 	if (!iwl_mvm_is_d0i3_supported(mvm))
195 		return;
196 
197 	IWL_DEBUG_RPM(mvm, "Take mvm reference - type %d\n", ref_type);
198 	spin_lock_bh(&mvm->refs_lock);
199 	mvm->refs[ref_type]++;
200 	spin_unlock_bh(&mvm->refs_lock);
201 	iwl_trans_ref(mvm->trans);
202 }
203 
204 void iwl_mvm_unref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
205 {
206 	if (!iwl_mvm_is_d0i3_supported(mvm))
207 		return;
208 
209 	IWL_DEBUG_RPM(mvm, "Leave mvm reference - type %d\n", ref_type);
210 	spin_lock_bh(&mvm->refs_lock);
211 	if (WARN_ON(!mvm->refs[ref_type])) {
212 		spin_unlock_bh(&mvm->refs_lock);
213 		return;
214 	}
215 	mvm->refs[ref_type]--;
216 	spin_unlock_bh(&mvm->refs_lock);
217 	iwl_trans_unref(mvm->trans);
218 }
219 
220 static void iwl_mvm_unref_all_except(struct iwl_mvm *mvm,
221 				     enum iwl_mvm_ref_type except_ref)
222 {
223 	int i, j;
224 
225 	if (!iwl_mvm_is_d0i3_supported(mvm))
226 		return;
227 
228 	spin_lock_bh(&mvm->refs_lock);
229 	for (i = 0; i < IWL_MVM_REF_COUNT; i++) {
230 		if (except_ref == i || !mvm->refs[i])
231 			continue;
232 
233 		IWL_DEBUG_RPM(mvm, "Cleanup: remove mvm ref type %d (%d)\n",
234 			      i, mvm->refs[i]);
235 		for (j = 0; j < mvm->refs[i]; j++)
236 			iwl_trans_unref(mvm->trans);
237 		mvm->refs[i] = 0;
238 	}
239 	spin_unlock_bh(&mvm->refs_lock);
240 }
241 
242 bool iwl_mvm_ref_taken(struct iwl_mvm *mvm)
243 {
244 	int i;
245 	bool taken = false;
246 
247 	if (!iwl_mvm_is_d0i3_supported(mvm))
248 		return true;
249 
250 	spin_lock_bh(&mvm->refs_lock);
251 	for (i = 0; i < IWL_MVM_REF_COUNT; i++) {
252 		if (mvm->refs[i]) {
253 			taken = true;
254 			break;
255 		}
256 	}
257 	spin_unlock_bh(&mvm->refs_lock);
258 
259 	return taken;
260 }
261 
262 int iwl_mvm_ref_sync(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
263 {
264 	iwl_mvm_ref(mvm, ref_type);
265 
266 	if (!wait_event_timeout(mvm->d0i3_exit_waitq,
267 				!test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status),
268 				HZ)) {
269 		WARN_ON_ONCE(1);
270 		iwl_mvm_unref(mvm, ref_type);
271 		return -EIO;
272 	}
273 
274 	return 0;
275 }
276 
277 static void iwl_mvm_reset_phy_ctxts(struct iwl_mvm *mvm)
278 {
279 	int i;
280 
281 	memset(mvm->phy_ctxts, 0, sizeof(mvm->phy_ctxts));
282 	for (i = 0; i < NUM_PHY_CTX; i++) {
283 		mvm->phy_ctxts[i].id = i;
284 		mvm->phy_ctxts[i].ref = 0;
285 	}
286 }
287 
288 struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
289 						  const char *alpha2,
290 						  enum iwl_mcc_source src_id,
291 						  bool *changed)
292 {
293 	struct ieee80211_regdomain *regd = NULL;
294 	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
295 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
296 	struct iwl_mcc_update_resp *resp;
297 
298 	IWL_DEBUG_LAR(mvm, "Getting regdomain data for %s from FW\n", alpha2);
299 
300 	lockdep_assert_held(&mvm->mutex);
301 
302 	resp = iwl_mvm_update_mcc(mvm, alpha2, src_id);
303 	if (IS_ERR_OR_NULL(resp)) {
304 		IWL_DEBUG_LAR(mvm, "Could not get update from FW %d\n",
305 			      PTR_ERR_OR_ZERO(resp));
306 		goto out;
307 	}
308 
309 	if (changed)
310 		*changed = (resp->status == MCC_RESP_NEW_CHAN_PROFILE);
311 
312 	regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg,
313 				      __le32_to_cpu(resp->n_channels),
314 				      resp->channels,
315 				      __le16_to_cpu(resp->mcc),
316 				      __le16_to_cpu(resp->geo_info));
317 	/* Store the return source id */
318 	src_id = resp->source_id;
319 	kfree(resp);
320 	if (IS_ERR_OR_NULL(regd)) {
321 		IWL_DEBUG_LAR(mvm, "Could not get parse update from FW %d\n",
322 			      PTR_ERR_OR_ZERO(regd));
323 		goto out;
324 	}
325 
326 	IWL_DEBUG_LAR(mvm, "setting alpha2 from FW to %s (0x%x, 0x%x) src=%d\n",
327 		      regd->alpha2, regd->alpha2[0], regd->alpha2[1], src_id);
328 	mvm->lar_regdom_set = true;
329 	mvm->mcc_src = src_id;
330 
331 out:
332 	return regd;
333 }
334 
335 void iwl_mvm_update_changed_regdom(struct iwl_mvm *mvm)
336 {
337 	bool changed;
338 	struct ieee80211_regdomain *regd;
339 
340 	if (!iwl_mvm_is_lar_supported(mvm))
341 		return;
342 
343 	regd = iwl_mvm_get_current_regdomain(mvm, &changed);
344 	if (!IS_ERR_OR_NULL(regd)) {
345 		/* only update the regulatory core if changed */
346 		if (changed)
347 			regulatory_set_wiphy_regd(mvm->hw->wiphy, regd);
348 
349 		kfree(regd);
350 	}
351 }
352 
353 struct ieee80211_regdomain *iwl_mvm_get_current_regdomain(struct iwl_mvm *mvm,
354 							  bool *changed)
355 {
356 	return iwl_mvm_get_regdomain(mvm->hw->wiphy, "ZZ",
357 				     iwl_mvm_is_wifi_mcc_supported(mvm) ?
358 				     MCC_SOURCE_GET_CURRENT :
359 				     MCC_SOURCE_OLD_FW, changed);
360 }
361 
362 int iwl_mvm_init_fw_regd(struct iwl_mvm *mvm)
363 {
364 	enum iwl_mcc_source used_src;
365 	struct ieee80211_regdomain *regd;
366 	int ret;
367 	bool changed;
368 	const struct ieee80211_regdomain *r =
369 			rtnl_dereference(mvm->hw->wiphy->regd);
370 
371 	if (!r)
372 		return -ENOENT;
373 
374 	/* save the last source in case we overwrite it below */
375 	used_src = mvm->mcc_src;
376 	if (iwl_mvm_is_wifi_mcc_supported(mvm)) {
377 		/* Notify the firmware we support wifi location updates */
378 		regd = iwl_mvm_get_current_regdomain(mvm, NULL);
379 		if (!IS_ERR_OR_NULL(regd))
380 			kfree(regd);
381 	}
382 
383 	/* Now set our last stored MCC and source */
384 	regd = iwl_mvm_get_regdomain(mvm->hw->wiphy, r->alpha2, used_src,
385 				     &changed);
386 	if (IS_ERR_OR_NULL(regd))
387 		return -EIO;
388 
389 	/* update cfg80211 if the regdomain was changed */
390 	if (changed)
391 		ret = regulatory_set_wiphy_regd_sync_rtnl(mvm->hw->wiphy, regd);
392 	else
393 		ret = 0;
394 
395 	kfree(regd);
396 	return ret;
397 }
398 
399 int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
400 {
401 	struct ieee80211_hw *hw = mvm->hw;
402 	int num_mac, ret, i;
403 	static const u32 mvm_ciphers[] = {
404 		WLAN_CIPHER_SUITE_WEP40,
405 		WLAN_CIPHER_SUITE_WEP104,
406 		WLAN_CIPHER_SUITE_TKIP,
407 		WLAN_CIPHER_SUITE_CCMP,
408 	};
409 
410 	/* Tell mac80211 our characteristics */
411 	ieee80211_hw_set(hw, SIGNAL_DBM);
412 	ieee80211_hw_set(hw, SPECTRUM_MGMT);
413 	ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
414 	ieee80211_hw_set(hw, QUEUE_CONTROL);
415 	ieee80211_hw_set(hw, WANT_MONITOR_VIF);
416 	ieee80211_hw_set(hw, SUPPORTS_PS);
417 	ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
418 	ieee80211_hw_set(hw, AMPDU_AGGREGATION);
419 	ieee80211_hw_set(hw, TIMING_BEACON_ONLY);
420 	ieee80211_hw_set(hw, CONNECTION_MONITOR);
421 	ieee80211_hw_set(hw, CHANCTX_STA_CSA);
422 	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
423 	ieee80211_hw_set(hw, SUPPORTS_CLONED_SKBS);
424 	ieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);
425 	ieee80211_hw_set(hw, NEEDS_UNIQUE_STA_ADDR);
426 	ieee80211_hw_set(hw, DEAUTH_NEED_MGD_TX_PREP);
427 
428 	if (iwl_mvm_has_tlc_offload(mvm)) {
429 		ieee80211_hw_set(hw, TX_AMPDU_SETUP_IN_HW);
430 		ieee80211_hw_set(hw, HAS_RATE_CONTROL);
431 	}
432 
433 	if (iwl_mvm_has_new_rx_api(mvm))
434 		ieee80211_hw_set(hw, SUPPORTS_REORDERING_BUFFER);
435 
436 	if (fw_has_capa(&mvm->fw->ucode_capa,
437 			IWL_UCODE_TLV_CAPA_STA_PM_NOTIF)) {
438 		ieee80211_hw_set(hw, AP_LINK_PS);
439 	} else if (WARN_ON(iwl_mvm_has_new_tx_api(mvm))) {
440 		/*
441 		 * we absolutely need this for the new TX API since that comes
442 		 * with many more queues than the current code can deal with
443 		 * for station powersave
444 		 */
445 		return -EINVAL;
446 	}
447 
448 	if (mvm->trans->num_rx_queues > 1)
449 		ieee80211_hw_set(hw, USES_RSS);
450 
451 	if (mvm->trans->max_skb_frags)
452 		hw->netdev_features = NETIF_F_HIGHDMA | NETIF_F_SG;
453 
454 	hw->queues = IEEE80211_MAX_QUEUES;
455 	hw->offchannel_tx_hw_queue = IWL_MVM_OFFCHANNEL_QUEUE;
456 	hw->radiotap_mcs_details |= IEEE80211_RADIOTAP_MCS_HAVE_FEC |
457 				    IEEE80211_RADIOTAP_MCS_HAVE_STBC;
458 	hw->radiotap_vht_details |= IEEE80211_RADIOTAP_VHT_KNOWN_STBC |
459 		IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED;
460 
461 	hw->radiotap_timestamp.units_pos =
462 		IEEE80211_RADIOTAP_TIMESTAMP_UNIT_US |
463 		IEEE80211_RADIOTAP_TIMESTAMP_SPOS_PLCP_SIG_ACQ;
464 	/* this is the case for CCK frames, it's better (only 8) for OFDM */
465 	hw->radiotap_timestamp.accuracy = 22;
466 
467 	if (!iwl_mvm_has_tlc_offload(mvm))
468 		hw->rate_control_algorithm = RS_NAME;
469 
470 	hw->uapsd_queues = IWL_MVM_UAPSD_QUEUES;
471 	hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
472 
473 	BUILD_BUG_ON(ARRAY_SIZE(mvm->ciphers) < ARRAY_SIZE(mvm_ciphers) + 6);
474 	memcpy(mvm->ciphers, mvm_ciphers, sizeof(mvm_ciphers));
475 	hw->wiphy->n_cipher_suites = ARRAY_SIZE(mvm_ciphers);
476 	hw->wiphy->cipher_suites = mvm->ciphers;
477 
478 	if (iwl_mvm_has_new_rx_api(mvm)) {
479 		mvm->ciphers[hw->wiphy->n_cipher_suites] =
480 			WLAN_CIPHER_SUITE_GCMP;
481 		hw->wiphy->n_cipher_suites++;
482 		mvm->ciphers[hw->wiphy->n_cipher_suites] =
483 			WLAN_CIPHER_SUITE_GCMP_256;
484 		hw->wiphy->n_cipher_suites++;
485 	}
486 
487 	/* Enable 11w if software crypto is not enabled (as the
488 	 * firmware will interpret some mgmt packets, so enabling it
489 	 * with software crypto isn't safe).
490 	 */
491 	if (!iwlwifi_mod_params.swcrypto) {
492 		ieee80211_hw_set(hw, MFP_CAPABLE);
493 		mvm->ciphers[hw->wiphy->n_cipher_suites] =
494 			WLAN_CIPHER_SUITE_AES_CMAC;
495 		hw->wiphy->n_cipher_suites++;
496 		if (iwl_mvm_has_new_rx_api(mvm)) {
497 			mvm->ciphers[hw->wiphy->n_cipher_suites] =
498 				WLAN_CIPHER_SUITE_BIP_GMAC_128;
499 			hw->wiphy->n_cipher_suites++;
500 			mvm->ciphers[hw->wiphy->n_cipher_suites] =
501 				WLAN_CIPHER_SUITE_BIP_GMAC_256;
502 			hw->wiphy->n_cipher_suites++;
503 		}
504 	}
505 
506 	/* currently FW API supports only one optional cipher scheme */
507 	if (mvm->fw->cs[0].cipher) {
508 		const struct iwl_fw_cipher_scheme *fwcs = &mvm->fw->cs[0];
509 		struct ieee80211_cipher_scheme *cs = &mvm->cs[0];
510 
511 		mvm->hw->n_cipher_schemes = 1;
512 
513 		cs->cipher = le32_to_cpu(fwcs->cipher);
514 		cs->iftype = BIT(NL80211_IFTYPE_STATION);
515 		cs->hdr_len = fwcs->hdr_len;
516 		cs->pn_len = fwcs->pn_len;
517 		cs->pn_off = fwcs->pn_off;
518 		cs->key_idx_off = fwcs->key_idx_off;
519 		cs->key_idx_mask = fwcs->key_idx_mask;
520 		cs->key_idx_shift = fwcs->key_idx_shift;
521 		cs->mic_len = fwcs->mic_len;
522 
523 		mvm->hw->cipher_schemes = mvm->cs;
524 		mvm->ciphers[hw->wiphy->n_cipher_suites] = cs->cipher;
525 		hw->wiphy->n_cipher_suites++;
526 	}
527 
528 	ieee80211_hw_set(hw, SINGLE_SCAN_ON_ALL_BANDS);
529 	hw->wiphy->features |=
530 		NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR |
531 		NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR |
532 		NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
533 
534 	hw->sta_data_size = sizeof(struct iwl_mvm_sta);
535 	hw->vif_data_size = sizeof(struct iwl_mvm_vif);
536 	hw->chanctx_data_size = sizeof(u16);
537 
538 	hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
539 		BIT(NL80211_IFTYPE_P2P_CLIENT) |
540 		BIT(NL80211_IFTYPE_AP) |
541 		BIT(NL80211_IFTYPE_P2P_GO) |
542 		BIT(NL80211_IFTYPE_P2P_DEVICE) |
543 		BIT(NL80211_IFTYPE_ADHOC);
544 
545 	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
546 	hw->wiphy->regulatory_flags |= REGULATORY_ENABLE_RELAX_NO_IR;
547 	if (iwl_mvm_is_lar_supported(mvm))
548 		hw->wiphy->regulatory_flags |= REGULATORY_WIPHY_SELF_MANAGED;
549 	else
550 		hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG |
551 					       REGULATORY_DISABLE_BEACON_HINTS;
552 
553 	hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
554 	hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
555 
556 	hw->wiphy->iface_combinations = iwl_mvm_iface_combinations;
557 	hw->wiphy->n_iface_combinations =
558 		ARRAY_SIZE(iwl_mvm_iface_combinations);
559 
560 	hw->wiphy->max_remain_on_channel_duration = 10000;
561 	hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
562 	/* we can compensate an offset of up to 3 channels = 15 MHz */
563 	hw->wiphy->max_adj_channel_rssi_comp = 3 * 5;
564 
565 	/* Extract MAC address */
566 	memcpy(mvm->addresses[0].addr, mvm->nvm_data->hw_addr, ETH_ALEN);
567 	hw->wiphy->addresses = mvm->addresses;
568 	hw->wiphy->n_addresses = 1;
569 
570 	/* Extract additional MAC addresses if available */
571 	num_mac = (mvm->nvm_data->n_hw_addrs > 1) ?
572 		min(IWL_MVM_MAX_ADDRESSES, mvm->nvm_data->n_hw_addrs) : 1;
573 
574 	for (i = 1; i < num_mac; i++) {
575 		memcpy(mvm->addresses[i].addr, mvm->addresses[i-1].addr,
576 		       ETH_ALEN);
577 		mvm->addresses[i].addr[5]++;
578 		hw->wiphy->n_addresses++;
579 	}
580 
581 	iwl_mvm_reset_phy_ctxts(mvm);
582 
583 	hw->wiphy->max_scan_ie_len = iwl_mvm_max_scan_ie_len(mvm);
584 
585 	hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
586 
587 	BUILD_BUG_ON(IWL_MVM_SCAN_STOPPING_MASK & IWL_MVM_SCAN_MASK);
588 	BUILD_BUG_ON(IWL_MVM_MAX_UMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK) ||
589 		     IWL_MVM_MAX_LMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK));
590 
591 	if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
592 		mvm->max_scans = IWL_MVM_MAX_UMAC_SCANS;
593 	else
594 		mvm->max_scans = IWL_MVM_MAX_LMAC_SCANS;
595 
596 	if (mvm->nvm_data->bands[NL80211_BAND_2GHZ].n_channels)
597 		hw->wiphy->bands[NL80211_BAND_2GHZ] =
598 			&mvm->nvm_data->bands[NL80211_BAND_2GHZ];
599 	if (mvm->nvm_data->bands[NL80211_BAND_5GHZ].n_channels) {
600 		hw->wiphy->bands[NL80211_BAND_5GHZ] =
601 			&mvm->nvm_data->bands[NL80211_BAND_5GHZ];
602 
603 		if (fw_has_capa(&mvm->fw->ucode_capa,
604 				IWL_UCODE_TLV_CAPA_BEAMFORMER) &&
605 		    fw_has_api(&mvm->fw->ucode_capa,
606 			       IWL_UCODE_TLV_API_LQ_SS_PARAMS))
607 			hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.cap |=
608 				IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
609 	}
610 
611 	hw->wiphy->hw_version = mvm->trans->hw_id;
612 
613 	if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM)
614 		hw->wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
615 	else
616 		hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
617 
618 	hw->wiphy->max_sched_scan_reqs = 1;
619 	hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
620 	hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
621 	/* we create the 802.11 header and zero length SSID IE. */
622 	hw->wiphy->max_sched_scan_ie_len =
623 		SCAN_OFFLOAD_PROBE_REQ_SIZE - 24 - 2;
624 	hw->wiphy->max_sched_scan_plans = IWL_MAX_SCHED_SCAN_PLANS;
625 	hw->wiphy->max_sched_scan_plan_interval = U16_MAX;
626 
627 	/*
628 	 * the firmware uses u8 for num of iterations, but 0xff is saved for
629 	 * infinite loop, so the maximum number of iterations is actually 254.
630 	 */
631 	hw->wiphy->max_sched_scan_plan_iterations = 254;
632 
633 	hw->wiphy->features |= NL80211_FEATURE_P2P_GO_CTWIN |
634 			       NL80211_FEATURE_LOW_PRIORITY_SCAN |
635 			       NL80211_FEATURE_P2P_GO_OPPPS |
636 			       NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
637 			       NL80211_FEATURE_DYNAMIC_SMPS |
638 			       NL80211_FEATURE_STATIC_SMPS |
639 			       NL80211_FEATURE_SUPPORTS_WMM_ADMISSION;
640 
641 	if (fw_has_capa(&mvm->fw->ucode_capa,
642 			IWL_UCODE_TLV_CAPA_TXPOWER_INSERTION_SUPPORT))
643 		hw->wiphy->features |= NL80211_FEATURE_TX_POWER_INSERTION;
644 	if (fw_has_capa(&mvm->fw->ucode_capa,
645 			IWL_UCODE_TLV_CAPA_QUIET_PERIOD_SUPPORT))
646 		hw->wiphy->features |= NL80211_FEATURE_QUIET;
647 
648 	if (fw_has_capa(&mvm->fw->ucode_capa,
649 			IWL_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT))
650 		hw->wiphy->features |=
651 			NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES;
652 
653 	if (fw_has_capa(&mvm->fw->ucode_capa,
654 			IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT))
655 		hw->wiphy->features |= NL80211_FEATURE_WFA_TPC_IE_IN_PROBES;
656 
657 	if (fw_has_api(&mvm->fw->ucode_capa,
658 		       IWL_UCODE_TLV_API_SCAN_TSF_REPORT)) {
659 		wiphy_ext_feature_set(hw->wiphy,
660 				      NL80211_EXT_FEATURE_SCAN_START_TIME);
661 		wiphy_ext_feature_set(hw->wiphy,
662 				      NL80211_EXT_FEATURE_BSS_PARENT_TSF);
663 		wiphy_ext_feature_set(hw->wiphy,
664 				      NL80211_EXT_FEATURE_SET_SCAN_DWELL);
665 	}
666 
667 	if (iwl_mvm_is_oce_supported(mvm)) {
668 		wiphy_ext_feature_set(hw->wiphy,
669 			NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP);
670 		wiphy_ext_feature_set(hw->wiphy,
671 			NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME);
672 		wiphy_ext_feature_set(hw->wiphy,
673 			NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION);
674 		wiphy_ext_feature_set(hw->wiphy,
675 			NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE);
676 	}
677 
678 	mvm->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
679 
680 #ifdef CONFIG_PM_SLEEP
681 	if (iwl_mvm_is_d0i3_supported(mvm) &&
682 	    device_can_wakeup(mvm->trans->dev)) {
683 		mvm->wowlan.flags = WIPHY_WOWLAN_ANY;
684 		hw->wiphy->wowlan = &mvm->wowlan;
685 	}
686 
687 	if (mvm->fw->img[IWL_UCODE_WOWLAN].num_sec &&
688 	    mvm->trans->ops->d3_suspend &&
689 	    mvm->trans->ops->d3_resume &&
690 	    device_can_wakeup(mvm->trans->dev)) {
691 		mvm->wowlan.flags |= WIPHY_WOWLAN_MAGIC_PKT |
692 				     WIPHY_WOWLAN_DISCONNECT |
693 				     WIPHY_WOWLAN_EAP_IDENTITY_REQ |
694 				     WIPHY_WOWLAN_RFKILL_RELEASE |
695 				     WIPHY_WOWLAN_NET_DETECT;
696 		if (!iwlwifi_mod_params.swcrypto)
697 			mvm->wowlan.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY |
698 					     WIPHY_WOWLAN_GTK_REKEY_FAILURE |
699 					     WIPHY_WOWLAN_4WAY_HANDSHAKE;
700 
701 		mvm->wowlan.n_patterns = IWL_WOWLAN_MAX_PATTERNS;
702 		mvm->wowlan.pattern_min_len = IWL_WOWLAN_MIN_PATTERN_LEN;
703 		mvm->wowlan.pattern_max_len = IWL_WOWLAN_MAX_PATTERN_LEN;
704 		mvm->wowlan.max_nd_match_sets = IWL_SCAN_MAX_PROFILES;
705 		hw->wiphy->wowlan = &mvm->wowlan;
706 	}
707 #endif
708 
709 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
710 	/* assign default bcast filtering configuration */
711 	mvm->bcast_filters = iwl_mvm_default_bcast_filters;
712 #endif
713 
714 	ret = iwl_mvm_leds_init(mvm);
715 	if (ret)
716 		return ret;
717 
718 	if (fw_has_capa(&mvm->fw->ucode_capa,
719 			IWL_UCODE_TLV_CAPA_TDLS_SUPPORT)) {
720 		IWL_DEBUG_TDLS(mvm, "TDLS supported\n");
721 		hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
722 		ieee80211_hw_set(hw, TDLS_WIDER_BW);
723 	}
724 
725 	if (fw_has_capa(&mvm->fw->ucode_capa,
726 			IWL_UCODE_TLV_CAPA_TDLS_CHANNEL_SWITCH)) {
727 		IWL_DEBUG_TDLS(mvm, "TDLS channel switch supported\n");
728 		hw->wiphy->features |= NL80211_FEATURE_TDLS_CHANNEL_SWITCH;
729 	}
730 
731 	hw->netdev_features |= mvm->cfg->features;
732 	if (!iwl_mvm_is_csum_supported(mvm)) {
733 		hw->netdev_features &= ~(IWL_TX_CSUM_NETIF_FLAGS |
734 					 NETIF_F_RXCSUM);
735 		/* We may support SW TX CSUM */
736 		if (IWL_MVM_SW_TX_CSUM_OFFLOAD)
737 			hw->netdev_features |= IWL_TX_CSUM_NETIF_FLAGS;
738 	}
739 
740 	ret = ieee80211_register_hw(mvm->hw);
741 	if (ret)
742 		iwl_mvm_leds_exit(mvm);
743 	mvm->init_status |= IWL_MVM_INIT_STATUS_REG_HW_INIT_COMPLETE;
744 
745 	if (mvm->cfg->vht_mu_mimo_supported)
746 		wiphy_ext_feature_set(hw->wiphy,
747 				      NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER);
748 
749 	return ret;
750 }
751 
752 static bool iwl_mvm_defer_tx(struct iwl_mvm *mvm,
753 			     struct ieee80211_sta *sta,
754 			     struct sk_buff *skb)
755 {
756 	struct iwl_mvm_sta *mvmsta;
757 	bool defer = false;
758 
759 	/*
760 	 * double check the IN_D0I3 flag both before and after
761 	 * taking the spinlock, in order to prevent taking
762 	 * the spinlock when not needed.
763 	 */
764 	if (likely(!test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status)))
765 		return false;
766 
767 	spin_lock(&mvm->d0i3_tx_lock);
768 	/*
769 	 * testing the flag again ensures the skb dequeue
770 	 * loop (on d0i3 exit) hasn't run yet.
771 	 */
772 	if (!test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status))
773 		goto out;
774 
775 	mvmsta = iwl_mvm_sta_from_mac80211(sta);
776 	if (mvmsta->sta_id == IWL_MVM_INVALID_STA ||
777 	    mvmsta->sta_id != mvm->d0i3_ap_sta_id)
778 		goto out;
779 
780 	__skb_queue_tail(&mvm->d0i3_tx, skb);
781 	ieee80211_stop_queues(mvm->hw);
782 
783 	/* trigger wakeup */
784 	iwl_mvm_ref(mvm, IWL_MVM_REF_TX);
785 	iwl_mvm_unref(mvm, IWL_MVM_REF_TX);
786 
787 	defer = true;
788 out:
789 	spin_unlock(&mvm->d0i3_tx_lock);
790 	return defer;
791 }
792 
793 static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
794 			   struct ieee80211_tx_control *control,
795 			   struct sk_buff *skb)
796 {
797 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
798 	struct ieee80211_sta *sta = control->sta;
799 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
800 	struct ieee80211_hdr *hdr = (void *)skb->data;
801 
802 	if (iwl_mvm_is_radio_killed(mvm)) {
803 		IWL_DEBUG_DROP(mvm, "Dropping - RF/CT KILL\n");
804 		goto drop;
805 	}
806 
807 	if (info->hw_queue == IWL_MVM_OFFCHANNEL_QUEUE &&
808 	    !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status) &&
809 	    !test_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status))
810 		goto drop;
811 
812 	/* treat non-bufferable MMPDUs on AP interfaces as broadcast */
813 	if ((info->control.vif->type == NL80211_IFTYPE_AP ||
814 	     info->control.vif->type == NL80211_IFTYPE_ADHOC) &&
815 	    ieee80211_is_mgmt(hdr->frame_control) &&
816 	    !ieee80211_is_bufferable_mmpdu(hdr->frame_control))
817 		sta = NULL;
818 
819 	if (sta) {
820 		if (iwl_mvm_defer_tx(mvm, sta, skb))
821 			return;
822 		if (iwl_mvm_tx_skb(mvm, skb, sta))
823 			goto drop;
824 		return;
825 	}
826 
827 	if (iwl_mvm_tx_skb_non_sta(mvm, skb))
828 		goto drop;
829 	return;
830  drop:
831 	ieee80211_free_txskb(hw, skb);
832 }
833 
834 static inline bool iwl_enable_rx_ampdu(const struct iwl_cfg *cfg)
835 {
836 	if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG)
837 		return false;
838 	return true;
839 }
840 
841 static inline bool iwl_enable_tx_ampdu(const struct iwl_cfg *cfg)
842 {
843 	if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG)
844 		return false;
845 	if (iwlwifi_mod_params.disable_11n & IWL_ENABLE_HT_TXAGG)
846 		return true;
847 
848 	/* enabled by default */
849 	return true;
850 }
851 
852 #define CHECK_BA_TRIGGER(_mvm, _trig, _tid_bm, _tid, _fmt...)		\
853 	do {								\
854 		if (!(le16_to_cpu(_tid_bm) & BIT(_tid)))		\
855 			break;						\
856 		iwl_fw_dbg_collect_trig(&(_mvm)->fwrt, _trig, _fmt);	\
857 	} while (0)
858 
859 static void
860 iwl_mvm_ampdu_check_trigger(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
861 			    struct ieee80211_sta *sta, u16 tid, u16 rx_ba_ssn,
862 			    enum ieee80211_ampdu_mlme_action action)
863 {
864 	struct iwl_fw_dbg_trigger_tlv *trig;
865 	struct iwl_fw_dbg_trigger_ba *ba_trig;
866 
867 	if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_BA))
868 		return;
869 
870 	trig = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_BA);
871 	ba_trig = (void *)trig->data;
872 
873 	if (!iwl_fw_dbg_trigger_check_stop(&mvm->fwrt,
874 					   ieee80211_vif_to_wdev(vif), trig))
875 		return;
876 
877 	switch (action) {
878 	case IEEE80211_AMPDU_TX_OPERATIONAL: {
879 		struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
880 		struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
881 
882 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_start, tid,
883 				 "TX AGG START: MAC %pM tid %d ssn %d\n",
884 				 sta->addr, tid, tid_data->ssn);
885 		break;
886 		}
887 	case IEEE80211_AMPDU_TX_STOP_CONT:
888 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_stop, tid,
889 				 "TX AGG STOP: MAC %pM tid %d\n",
890 				 sta->addr, tid);
891 		break;
892 	case IEEE80211_AMPDU_RX_START:
893 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_start, tid,
894 				 "RX AGG START: MAC %pM tid %d ssn %d\n",
895 				 sta->addr, tid, rx_ba_ssn);
896 		break;
897 	case IEEE80211_AMPDU_RX_STOP:
898 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_stop, tid,
899 				 "RX AGG STOP: MAC %pM tid %d\n",
900 				 sta->addr, tid);
901 		break;
902 	default:
903 		break;
904 	}
905 }
906 
907 static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
908 				    struct ieee80211_vif *vif,
909 				    struct ieee80211_ampdu_params *params)
910 {
911 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
912 	int ret;
913 	bool tx_agg_ref = false;
914 	struct ieee80211_sta *sta = params->sta;
915 	enum ieee80211_ampdu_mlme_action action = params->action;
916 	u16 tid = params->tid;
917 	u16 *ssn = &params->ssn;
918 	u16 buf_size = params->buf_size;
919 	bool amsdu = params->amsdu;
920 	u16 timeout = params->timeout;
921 
922 	IWL_DEBUG_HT(mvm, "A-MPDU action on addr %pM tid %d: action %d\n",
923 		     sta->addr, tid, action);
924 
925 	if (!(mvm->nvm_data->sku_cap_11n_enable))
926 		return -EACCES;
927 
928 	/* return from D0i3 before starting a new Tx aggregation */
929 	switch (action) {
930 	case IEEE80211_AMPDU_TX_START:
931 	case IEEE80211_AMPDU_TX_STOP_CONT:
932 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
933 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
934 	case IEEE80211_AMPDU_TX_OPERATIONAL:
935 		/*
936 		 * for tx start, wait synchronously until D0i3 exit to
937 		 * get the correct sequence number for the tid.
938 		 * additionally, some other ampdu actions use direct
939 		 * target access, which is not handled automatically
940 		 * by the trans layer (unlike commands), so wait for
941 		 * d0i3 exit in these cases as well.
942 		 */
943 		ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_TX_AGG);
944 		if (ret)
945 			return ret;
946 
947 		tx_agg_ref = true;
948 		break;
949 	default:
950 		break;
951 	}
952 
953 	mutex_lock(&mvm->mutex);
954 
955 	switch (action) {
956 	case IEEE80211_AMPDU_RX_START:
957 		if (iwl_mvm_vif_from_mac80211(vif)->ap_sta_id ==
958 				iwl_mvm_sta_from_mac80211(sta)->sta_id) {
959 			struct iwl_mvm_vif *mvmvif;
960 			u16 macid = iwl_mvm_vif_from_mac80211(vif)->id;
961 			struct iwl_mvm_tcm_mac *mdata = &mvm->tcm.data[macid];
962 
963 			mdata->opened_rx_ba_sessions = true;
964 			mvmvif = iwl_mvm_vif_from_mac80211(vif);
965 			cancel_delayed_work(&mvmvif->uapsd_nonagg_detected_wk);
966 		}
967 		if (!iwl_enable_rx_ampdu(mvm->cfg)) {
968 			ret = -EINVAL;
969 			break;
970 		}
971 		ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, *ssn, true, buf_size,
972 					 timeout);
973 		break;
974 	case IEEE80211_AMPDU_RX_STOP:
975 		ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, 0, false, buf_size,
976 					 timeout);
977 		break;
978 	case IEEE80211_AMPDU_TX_START:
979 		if (!iwl_enable_tx_ampdu(mvm->cfg)) {
980 			ret = -EINVAL;
981 			break;
982 		}
983 		ret = iwl_mvm_sta_tx_agg_start(mvm, vif, sta, tid, ssn);
984 		break;
985 	case IEEE80211_AMPDU_TX_STOP_CONT:
986 		ret = iwl_mvm_sta_tx_agg_stop(mvm, vif, sta, tid);
987 		break;
988 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
989 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
990 		ret = iwl_mvm_sta_tx_agg_flush(mvm, vif, sta, tid);
991 		break;
992 	case IEEE80211_AMPDU_TX_OPERATIONAL:
993 		ret = iwl_mvm_sta_tx_agg_oper(mvm, vif, sta, tid,
994 					      buf_size, amsdu);
995 		break;
996 	default:
997 		WARN_ON_ONCE(1);
998 		ret = -EINVAL;
999 		break;
1000 	}
1001 
1002 	if (!ret) {
1003 		u16 rx_ba_ssn = 0;
1004 
1005 		if (action == IEEE80211_AMPDU_RX_START)
1006 			rx_ba_ssn = *ssn;
1007 
1008 		iwl_mvm_ampdu_check_trigger(mvm, vif, sta, tid,
1009 					    rx_ba_ssn, action);
1010 	}
1011 	mutex_unlock(&mvm->mutex);
1012 
1013 	/*
1014 	 * If the tid is marked as started, we won't use it for offloaded
1015 	 * traffic on the next D0i3 entry. It's safe to unref.
1016 	 */
1017 	if (tx_agg_ref)
1018 		iwl_mvm_unref(mvm, IWL_MVM_REF_TX_AGG);
1019 
1020 	return ret;
1021 }
1022 
1023 static void iwl_mvm_cleanup_iterator(void *data, u8 *mac,
1024 				     struct ieee80211_vif *vif)
1025 {
1026 	struct iwl_mvm *mvm = data;
1027 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1028 
1029 	mvmvif->uploaded = false;
1030 	mvmvif->ap_sta_id = IWL_MVM_INVALID_STA;
1031 
1032 	spin_lock_bh(&mvm->time_event_lock);
1033 	iwl_mvm_te_clear_data(mvm, &mvmvif->time_event_data);
1034 	spin_unlock_bh(&mvm->time_event_lock);
1035 
1036 	mvmvif->phy_ctxt = NULL;
1037 	memset(&mvmvif->bf_data, 0, sizeof(mvmvif->bf_data));
1038 }
1039 
1040 static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
1041 {
1042 	/* clear the D3 reconfig, we only need it to avoid dumping a
1043 	 * firmware coredump on reconfiguration, we shouldn't do that
1044 	 * on D3->D0 transition
1045 	 */
1046 	if (!test_and_clear_bit(IWL_MVM_STATUS_D3_RECONFIG, &mvm->status)) {
1047 		mvm->fwrt.dump.desc = &iwl_dump_desc_assert;
1048 		iwl_fw_error_dump(&mvm->fwrt);
1049 	}
1050 
1051 	/* cleanup all stale references (scan, roc), but keep the
1052 	 * ucode_down ref until reconfig is complete
1053 	 */
1054 	iwl_mvm_unref_all_except(mvm, IWL_MVM_REF_UCODE_DOWN);
1055 
1056 	iwl_mvm_stop_device(mvm);
1057 
1058 	mvm->scan_status = 0;
1059 	mvm->ps_disabled = false;
1060 	mvm->calibrating = false;
1061 
1062 	/* just in case one was running */
1063 	iwl_mvm_cleanup_roc_te(mvm);
1064 	ieee80211_remain_on_channel_expired(mvm->hw);
1065 
1066 	/*
1067 	 * cleanup all interfaces, even inactive ones, as some might have
1068 	 * gone down during the HW restart
1069 	 */
1070 	ieee80211_iterate_interfaces(mvm->hw, 0, iwl_mvm_cleanup_iterator, mvm);
1071 
1072 	mvm->p2p_device_vif = NULL;
1073 	mvm->d0i3_ap_sta_id = IWL_MVM_INVALID_STA;
1074 
1075 	iwl_mvm_reset_phy_ctxts(mvm);
1076 	memset(mvm->fw_key_table, 0, sizeof(mvm->fw_key_table));
1077 	memset(mvm->sta_deferred_frames, 0, sizeof(mvm->sta_deferred_frames));
1078 	memset(&mvm->last_bt_notif, 0, sizeof(mvm->last_bt_notif));
1079 	memset(&mvm->last_bt_ci_cmd, 0, sizeof(mvm->last_bt_ci_cmd));
1080 
1081 	ieee80211_wake_queues(mvm->hw);
1082 
1083 	/* clear any stale d0i3 state */
1084 	clear_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status);
1085 
1086 	mvm->vif_count = 0;
1087 	mvm->rx_ba_sessions = 0;
1088 	mvm->fwrt.dump.conf = FW_DBG_INVALID;
1089 	mvm->monitor_on = false;
1090 
1091 	/* keep statistics ticking */
1092 	iwl_mvm_accu_radio_stats(mvm);
1093 }
1094 
1095 int __iwl_mvm_mac_start(struct iwl_mvm *mvm)
1096 {
1097 	int ret;
1098 
1099 	lockdep_assert_held(&mvm->mutex);
1100 
1101 	if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status)) {
1102 		/*
1103 		 * Now convert the HW_RESTART_REQUESTED flag to IN_HW_RESTART
1104 		 * so later code will - from now on - see that we're doing it.
1105 		 */
1106 		set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1107 		clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status);
1108 		/* Clean up some internal and mac80211 state on restart */
1109 		iwl_mvm_restart_cleanup(mvm);
1110 	} else {
1111 		/* Hold the reference to prevent runtime suspend while
1112 		 * the start procedure runs.  It's a bit confusing
1113 		 * that the UCODE_DOWN reference is taken, but it just
1114 		 * means "UCODE is not UP yet". ( TODO: rename this
1115 		 * reference).
1116 		 */
1117 		iwl_mvm_ref(mvm, IWL_MVM_REF_UCODE_DOWN);
1118 	}
1119 	ret = iwl_mvm_up(mvm);
1120 
1121 	if (ret && test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
1122 		/* Something went wrong - we need to finish some cleanup
1123 		 * that normally iwl_mvm_mac_restart_complete() below
1124 		 * would do.
1125 		 */
1126 		clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1127 		iwl_mvm_d0i3_enable_tx(mvm, NULL);
1128 	}
1129 
1130 	return ret;
1131 }
1132 
1133 static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
1134 {
1135 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1136 	int ret;
1137 
1138 	/* Some hw restart cleanups must not hold the mutex */
1139 	if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
1140 		/*
1141 		 * Make sure we are out of d0i3. This is needed
1142 		 * to make sure the reference accounting is correct
1143 		 * (and there is no stale d0i3_exit_work).
1144 		 */
1145 		wait_event_timeout(mvm->d0i3_exit_waitq,
1146 				   !test_bit(IWL_MVM_STATUS_IN_D0I3,
1147 					     &mvm->status),
1148 				   HZ);
1149 	}
1150 
1151 	mutex_lock(&mvm->mutex);
1152 	ret = __iwl_mvm_mac_start(mvm);
1153 	mutex_unlock(&mvm->mutex);
1154 
1155 	return ret;
1156 }
1157 
1158 static void iwl_mvm_restart_complete(struct iwl_mvm *mvm)
1159 {
1160 	int ret;
1161 
1162 	mutex_lock(&mvm->mutex);
1163 
1164 	clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1165 	iwl_mvm_d0i3_enable_tx(mvm, NULL);
1166 	ret = iwl_mvm_update_quotas(mvm, true, NULL);
1167 	if (ret)
1168 		IWL_ERR(mvm, "Failed to update quotas after restart (%d)\n",
1169 			ret);
1170 
1171 	/* allow transport/FW low power modes */
1172 	iwl_mvm_unref(mvm, IWL_MVM_REF_UCODE_DOWN);
1173 
1174 	/*
1175 	 * If we have TDLS peers, remove them. We don't know the last seqno/PN
1176 	 * of packets the FW sent out, so we must reconnect.
1177 	 */
1178 	iwl_mvm_teardown_tdls_peers(mvm);
1179 
1180 	mutex_unlock(&mvm->mutex);
1181 }
1182 
1183 static void iwl_mvm_resume_complete(struct iwl_mvm *mvm)
1184 {
1185 	if (iwl_mvm_is_d0i3_supported(mvm) &&
1186 	    iwl_mvm_enter_d0i3_on_suspend(mvm))
1187 		WARN_ONCE(!wait_event_timeout(mvm->d0i3_exit_waitq,
1188 					      !test_bit(IWL_MVM_STATUS_IN_D0I3,
1189 							&mvm->status),
1190 					      HZ),
1191 			  "D0i3 exit on resume timed out\n");
1192 }
1193 
1194 static void
1195 iwl_mvm_mac_reconfig_complete(struct ieee80211_hw *hw,
1196 			      enum ieee80211_reconfig_type reconfig_type)
1197 {
1198 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1199 
1200 	switch (reconfig_type) {
1201 	case IEEE80211_RECONFIG_TYPE_RESTART:
1202 		iwl_mvm_restart_complete(mvm);
1203 		break;
1204 	case IEEE80211_RECONFIG_TYPE_SUSPEND:
1205 		iwl_mvm_resume_complete(mvm);
1206 		break;
1207 	}
1208 }
1209 
1210 void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
1211 {
1212 	lockdep_assert_held(&mvm->mutex);
1213 
1214 	/* firmware counters are obviously reset now, but we shouldn't
1215 	 * partially track so also clear the fw_reset_accu counters.
1216 	 */
1217 	memset(&mvm->accu_radio_stats, 0, sizeof(mvm->accu_radio_stats));
1218 
1219 	/* async_handlers_wk is now blocked */
1220 
1221 	/*
1222 	 * The work item could be running or queued if the
1223 	 * ROC time event stops just as we get here.
1224 	 */
1225 	flush_work(&mvm->roc_done_wk);
1226 
1227 	iwl_mvm_stop_device(mvm);
1228 
1229 	iwl_mvm_async_handlers_purge(mvm);
1230 	/* async_handlers_list is empty and will stay empty: HW is stopped */
1231 
1232 	/* the fw is stopped, the aux sta is dead: clean up driver state */
1233 	iwl_mvm_del_aux_sta(mvm);
1234 
1235 	/*
1236 	 * Clear IN_HW_RESTART flag when stopping the hw (as restart_complete()
1237 	 * won't be called in this case).
1238 	 * But make sure to cleanup interfaces that have gone down before/during
1239 	 * HW restart was requested.
1240 	 */
1241 	if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
1242 		ieee80211_iterate_interfaces(mvm->hw, 0,
1243 					     iwl_mvm_cleanup_iterator, mvm);
1244 
1245 	/* We shouldn't have any UIDs still set.  Loop over all the UIDs to
1246 	 * make sure there's nothing left there and warn if any is found.
1247 	 */
1248 	if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1249 		int i;
1250 
1251 		for (i = 0; i < mvm->max_scans; i++) {
1252 			if (WARN_ONCE(mvm->scan_uid_status[i],
1253 				      "UMAC scan UID %d status was not cleaned\n",
1254 				      i))
1255 				mvm->scan_uid_status[i] = 0;
1256 		}
1257 	}
1258 }
1259 
1260 static void iwl_mvm_mac_stop(struct ieee80211_hw *hw)
1261 {
1262 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1263 
1264 	flush_work(&mvm->d0i3_exit_work);
1265 	flush_work(&mvm->async_handlers_wk);
1266 	flush_work(&mvm->add_stream_wk);
1267 
1268 	/*
1269 	 * Lock and clear the firmware running bit here already, so that
1270 	 * new commands coming in elsewhere, e.g. from debugfs, will not
1271 	 * be able to proceed. This is important here because one of those
1272 	 * debugfs files causes the firmware dump to be triggered, and if we
1273 	 * don't stop debugfs accesses before canceling that it could be
1274 	 * retriggered after we flush it but before we've cleared the bit.
1275 	 */
1276 	clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status);
1277 
1278 	iwl_fw_cancel_dump(&mvm->fwrt);
1279 	cancel_delayed_work_sync(&mvm->cs_tx_unblock_dwork);
1280 	cancel_delayed_work_sync(&mvm->scan_timeout_dwork);
1281 	iwl_fw_free_dump_desc(&mvm->fwrt);
1282 
1283 	mutex_lock(&mvm->mutex);
1284 	__iwl_mvm_mac_stop(mvm);
1285 	mutex_unlock(&mvm->mutex);
1286 
1287 	/*
1288 	 * The worker might have been waiting for the mutex, let it run and
1289 	 * discover that its list is now empty.
1290 	 */
1291 	cancel_work_sync(&mvm->async_handlers_wk);
1292 }
1293 
1294 static struct iwl_mvm_phy_ctxt *iwl_mvm_get_free_phy_ctxt(struct iwl_mvm *mvm)
1295 {
1296 	u16 i;
1297 
1298 	lockdep_assert_held(&mvm->mutex);
1299 
1300 	for (i = 0; i < NUM_PHY_CTX; i++)
1301 		if (!mvm->phy_ctxts[i].ref)
1302 			return &mvm->phy_ctxts[i];
1303 
1304 	IWL_ERR(mvm, "No available PHY context\n");
1305 	return NULL;
1306 }
1307 
1308 static int iwl_mvm_set_tx_power(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1309 				s16 tx_power)
1310 {
1311 	struct iwl_dev_tx_power_cmd cmd = {
1312 		.v3.set_mode = cpu_to_le32(IWL_TX_POWER_MODE_SET_MAC),
1313 		.v3.mac_context_id =
1314 			cpu_to_le32(iwl_mvm_vif_from_mac80211(vif)->id),
1315 		.v3.pwr_restriction = cpu_to_le16(8 * tx_power),
1316 	};
1317 	int len = sizeof(cmd);
1318 
1319 	if (tx_power == IWL_DEFAULT_MAX_TX_POWER)
1320 		cmd.v3.pwr_restriction = cpu_to_le16(IWL_DEV_MAX_TX_POWER);
1321 
1322 	if (!fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_TX_POWER_ACK))
1323 		len = sizeof(cmd.v3);
1324 
1325 	return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, 0, len, &cmd);
1326 }
1327 
1328 static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
1329 				     struct ieee80211_vif *vif)
1330 {
1331 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1332 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1333 	int ret;
1334 
1335 	mvmvif->mvm = mvm;
1336 
1337 	/*
1338 	 * make sure D0i3 exit is completed, otherwise a target access
1339 	 * during tx queue configuration could be done when still in
1340 	 * D0i3 state.
1341 	 */
1342 	ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_ADD_IF);
1343 	if (ret)
1344 		return ret;
1345 
1346 	/*
1347 	 * Not much to do here. The stack will not allow interface
1348 	 * types or combinations that we didn't advertise, so we
1349 	 * don't really have to check the types.
1350 	 */
1351 
1352 	mutex_lock(&mvm->mutex);
1353 
1354 	/* make sure that beacon statistics don't go backwards with FW reset */
1355 	if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
1356 		mvmvif->beacon_stats.accu_num_beacons +=
1357 			mvmvif->beacon_stats.num_beacons;
1358 
1359 	/* Allocate resources for the MAC context, and add it to the fw  */
1360 	ret = iwl_mvm_mac_ctxt_init(mvm, vif);
1361 	if (ret)
1362 		goto out_unlock;
1363 
1364 	/* Counting number of interfaces is needed for legacy PM */
1365 	if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1366 		mvm->vif_count++;
1367 
1368 	/*
1369 	 * The AP binding flow can be done only after the beacon
1370 	 * template is configured (which happens only in the mac80211
1371 	 * start_ap() flow), and adding the broadcast station can happen
1372 	 * only after the binding.
1373 	 * In addition, since modifying the MAC before adding a bcast
1374 	 * station is not allowed by the FW, delay the adding of MAC context to
1375 	 * the point where we can also add the bcast station.
1376 	 * In short: there's not much we can do at this point, other than
1377 	 * allocating resources :)
1378 	 */
1379 	if (vif->type == NL80211_IFTYPE_AP ||
1380 	    vif->type == NL80211_IFTYPE_ADHOC) {
1381 		ret = iwl_mvm_alloc_bcast_sta(mvm, vif);
1382 		if (ret) {
1383 			IWL_ERR(mvm, "Failed to allocate bcast sta\n");
1384 			goto out_release;
1385 		}
1386 
1387 		/*
1388 		 * Only queue for this station is the mcast queue,
1389 		 * which shouldn't be in TFD mask anyway
1390 		 */
1391 		ret = iwl_mvm_allocate_int_sta(mvm, &mvmvif->mcast_sta,
1392 					       0, vif->type,
1393 					       IWL_STA_MULTICAST);
1394 		if (ret)
1395 			goto out_release;
1396 
1397 		iwl_mvm_vif_dbgfs_register(mvm, vif);
1398 		goto out_unlock;
1399 	}
1400 
1401 	mvmvif->features |= hw->netdev_features;
1402 
1403 	ret = iwl_mvm_mac_ctxt_add(mvm, vif);
1404 	if (ret)
1405 		goto out_release;
1406 
1407 	ret = iwl_mvm_power_update_mac(mvm);
1408 	if (ret)
1409 		goto out_remove_mac;
1410 
1411 	/* beacon filtering */
1412 	ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
1413 	if (ret)
1414 		goto out_remove_mac;
1415 
1416 	if (!mvm->bf_allowed_vif &&
1417 	    vif->type == NL80211_IFTYPE_STATION && !vif->p2p) {
1418 		mvm->bf_allowed_vif = mvmvif;
1419 		vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
1420 				     IEEE80211_VIF_SUPPORTS_CQM_RSSI;
1421 	}
1422 
1423 	/*
1424 	 * P2P_DEVICE interface does not have a channel context assigned to it,
1425 	 * so a dedicated PHY context is allocated to it and the corresponding
1426 	 * MAC context is bound to it at this stage.
1427 	 */
1428 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1429 
1430 		mvmvif->phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
1431 		if (!mvmvif->phy_ctxt) {
1432 			ret = -ENOSPC;
1433 			goto out_free_bf;
1434 		}
1435 
1436 		iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
1437 		ret = iwl_mvm_binding_add_vif(mvm, vif);
1438 		if (ret)
1439 			goto out_unref_phy;
1440 
1441 		ret = iwl_mvm_add_p2p_bcast_sta(mvm, vif);
1442 		if (ret)
1443 			goto out_unbind;
1444 
1445 		/* Save a pointer to p2p device vif, so it can later be used to
1446 		 * update the p2p device MAC when a GO is started/stopped */
1447 		mvm->p2p_device_vif = vif;
1448 	}
1449 
1450 	iwl_mvm_tcm_add_vif(mvm, vif);
1451 
1452 	if (vif->type == NL80211_IFTYPE_MONITOR)
1453 		mvm->monitor_on = true;
1454 
1455 	iwl_mvm_vif_dbgfs_register(mvm, vif);
1456 	goto out_unlock;
1457 
1458  out_unbind:
1459 	iwl_mvm_binding_remove_vif(mvm, vif);
1460  out_unref_phy:
1461 	iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1462  out_free_bf:
1463 	if (mvm->bf_allowed_vif == mvmvif) {
1464 		mvm->bf_allowed_vif = NULL;
1465 		vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1466 				       IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1467 	}
1468  out_remove_mac:
1469 	mvmvif->phy_ctxt = NULL;
1470 	iwl_mvm_mac_ctxt_remove(mvm, vif);
1471  out_release:
1472 	if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1473 		mvm->vif_count--;
1474  out_unlock:
1475 	mutex_unlock(&mvm->mutex);
1476 
1477 	iwl_mvm_unref(mvm, IWL_MVM_REF_ADD_IF);
1478 
1479 	return ret;
1480 }
1481 
1482 static void iwl_mvm_prepare_mac_removal(struct iwl_mvm *mvm,
1483 					struct ieee80211_vif *vif)
1484 {
1485 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1486 		/*
1487 		 * Flush the ROC worker which will flush the OFFCHANNEL queue.
1488 		 * We assume here that all the packets sent to the OFFCHANNEL
1489 		 * queue are sent in ROC session.
1490 		 */
1491 		flush_work(&mvm->roc_done_wk);
1492 	}
1493 }
1494 
1495 static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
1496 					 struct ieee80211_vif *vif)
1497 {
1498 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1499 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1500 
1501 	iwl_mvm_prepare_mac_removal(mvm, vif);
1502 
1503 	if (!(vif->type == NL80211_IFTYPE_AP ||
1504 	      vif->type == NL80211_IFTYPE_ADHOC))
1505 		iwl_mvm_tcm_rm_vif(mvm, vif);
1506 
1507 	mutex_lock(&mvm->mutex);
1508 
1509 	if (mvm->bf_allowed_vif == mvmvif) {
1510 		mvm->bf_allowed_vif = NULL;
1511 		vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1512 				       IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1513 	}
1514 
1515 	iwl_mvm_vif_dbgfs_clean(mvm, vif);
1516 
1517 	/*
1518 	 * For AP/GO interface, the tear down of the resources allocated to the
1519 	 * interface is be handled as part of the stop_ap flow.
1520 	 */
1521 	if (vif->type == NL80211_IFTYPE_AP ||
1522 	    vif->type == NL80211_IFTYPE_ADHOC) {
1523 #ifdef CONFIG_NL80211_TESTMODE
1524 		if (vif == mvm->noa_vif) {
1525 			mvm->noa_vif = NULL;
1526 			mvm->noa_duration = 0;
1527 		}
1528 #endif
1529 		iwl_mvm_dealloc_int_sta(mvm, &mvmvif->mcast_sta);
1530 		iwl_mvm_dealloc_bcast_sta(mvm, vif);
1531 		goto out_release;
1532 	}
1533 
1534 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1535 		mvm->p2p_device_vif = NULL;
1536 		iwl_mvm_rm_p2p_bcast_sta(mvm, vif);
1537 		iwl_mvm_binding_remove_vif(mvm, vif);
1538 		iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1539 		mvmvif->phy_ctxt = NULL;
1540 	}
1541 
1542 	if (mvm->vif_count && vif->type != NL80211_IFTYPE_P2P_DEVICE)
1543 		mvm->vif_count--;
1544 
1545 	iwl_mvm_power_update_mac(mvm);
1546 	iwl_mvm_mac_ctxt_remove(mvm, vif);
1547 
1548 	if (vif->type == NL80211_IFTYPE_MONITOR)
1549 		mvm->monitor_on = false;
1550 
1551 out_release:
1552 	mutex_unlock(&mvm->mutex);
1553 }
1554 
1555 static int iwl_mvm_mac_config(struct ieee80211_hw *hw, u32 changed)
1556 {
1557 	return 0;
1558 }
1559 
1560 struct iwl_mvm_mc_iter_data {
1561 	struct iwl_mvm *mvm;
1562 	int port_id;
1563 };
1564 
1565 static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
1566 				      struct ieee80211_vif *vif)
1567 {
1568 	struct iwl_mvm_mc_iter_data *data = _data;
1569 	struct iwl_mvm *mvm = data->mvm;
1570 	struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd;
1571 	struct iwl_host_cmd hcmd = {
1572 		.id = MCAST_FILTER_CMD,
1573 		.flags = CMD_ASYNC,
1574 		.dataflags[0] = IWL_HCMD_DFL_NOCOPY,
1575 	};
1576 	int ret, len;
1577 
1578 	/* if we don't have free ports, mcast frames will be dropped */
1579 	if (WARN_ON_ONCE(data->port_id >= MAX_PORT_ID_NUM))
1580 		return;
1581 
1582 	if (vif->type != NL80211_IFTYPE_STATION ||
1583 	    !vif->bss_conf.assoc)
1584 		return;
1585 
1586 	cmd->port_id = data->port_id++;
1587 	memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
1588 	len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4);
1589 
1590 	hcmd.len[0] = len;
1591 	hcmd.data[0] = cmd;
1592 
1593 	ret = iwl_mvm_send_cmd(mvm, &hcmd);
1594 	if (ret)
1595 		IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret);
1596 }
1597 
1598 static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm)
1599 {
1600 	struct iwl_mvm_mc_iter_data iter_data = {
1601 		.mvm = mvm,
1602 	};
1603 
1604 	lockdep_assert_held(&mvm->mutex);
1605 
1606 	if (WARN_ON_ONCE(!mvm->mcast_filter_cmd))
1607 		return;
1608 
1609 	ieee80211_iterate_active_interfaces_atomic(
1610 		mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1611 		iwl_mvm_mc_iface_iterator, &iter_data);
1612 }
1613 
1614 static u64 iwl_mvm_prepare_multicast(struct ieee80211_hw *hw,
1615 				     struct netdev_hw_addr_list *mc_list)
1616 {
1617 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1618 	struct iwl_mcast_filter_cmd *cmd;
1619 	struct netdev_hw_addr *addr;
1620 	int addr_count;
1621 	bool pass_all;
1622 	int len;
1623 
1624 	addr_count = netdev_hw_addr_list_count(mc_list);
1625 	pass_all = addr_count > MAX_MCAST_FILTERING_ADDRESSES ||
1626 		   IWL_MVM_FW_MCAST_FILTER_PASS_ALL;
1627 	if (pass_all)
1628 		addr_count = 0;
1629 
1630 	len = roundup(sizeof(*cmd) + addr_count * ETH_ALEN, 4);
1631 	cmd = kzalloc(len, GFP_ATOMIC);
1632 	if (!cmd)
1633 		return 0;
1634 
1635 	if (pass_all) {
1636 		cmd->pass_all = 1;
1637 		return (u64)(unsigned long)cmd;
1638 	}
1639 
1640 	netdev_hw_addr_list_for_each(addr, mc_list) {
1641 		IWL_DEBUG_MAC80211(mvm, "mcast addr (%d): %pM\n",
1642 				   cmd->count, addr->addr);
1643 		memcpy(&cmd->addr_list[cmd->count * ETH_ALEN],
1644 		       addr->addr, ETH_ALEN);
1645 		cmd->count++;
1646 	}
1647 
1648 	return (u64)(unsigned long)cmd;
1649 }
1650 
1651 static void iwl_mvm_configure_filter(struct ieee80211_hw *hw,
1652 				     unsigned int changed_flags,
1653 				     unsigned int *total_flags,
1654 				     u64 multicast)
1655 {
1656 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1657 	struct iwl_mcast_filter_cmd *cmd = (void *)(unsigned long)multicast;
1658 
1659 	mutex_lock(&mvm->mutex);
1660 
1661 	/* replace previous configuration */
1662 	kfree(mvm->mcast_filter_cmd);
1663 	mvm->mcast_filter_cmd = cmd;
1664 
1665 	if (!cmd)
1666 		goto out;
1667 
1668 	if (changed_flags & FIF_ALLMULTI)
1669 		cmd->pass_all = !!(*total_flags & FIF_ALLMULTI);
1670 
1671 	if (cmd->pass_all)
1672 		cmd->count = 0;
1673 
1674 	iwl_mvm_recalc_multicast(mvm);
1675 out:
1676 	mutex_unlock(&mvm->mutex);
1677 	*total_flags = 0;
1678 }
1679 
1680 static void iwl_mvm_config_iface_filter(struct ieee80211_hw *hw,
1681 					struct ieee80211_vif *vif,
1682 					unsigned int filter_flags,
1683 					unsigned int changed_flags)
1684 {
1685 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1686 
1687 	/* We support only filter for probe requests */
1688 	if (!(changed_flags & FIF_PROBE_REQ))
1689 		return;
1690 
1691 	/* Supported only for p2p client interfaces */
1692 	if (vif->type != NL80211_IFTYPE_STATION || !vif->bss_conf.assoc ||
1693 	    !vif->p2p)
1694 		return;
1695 
1696 	mutex_lock(&mvm->mutex);
1697 	iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
1698 	mutex_unlock(&mvm->mutex);
1699 }
1700 
1701 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
1702 struct iwl_bcast_iter_data {
1703 	struct iwl_mvm *mvm;
1704 	struct iwl_bcast_filter_cmd *cmd;
1705 	u8 current_filter;
1706 };
1707 
1708 static void
1709 iwl_mvm_set_bcast_filter(struct ieee80211_vif *vif,
1710 			 const struct iwl_fw_bcast_filter *in_filter,
1711 			 struct iwl_fw_bcast_filter *out_filter)
1712 {
1713 	struct iwl_fw_bcast_filter_attr *attr;
1714 	int i;
1715 
1716 	memcpy(out_filter, in_filter, sizeof(*out_filter));
1717 
1718 	for (i = 0; i < ARRAY_SIZE(out_filter->attrs); i++) {
1719 		attr = &out_filter->attrs[i];
1720 
1721 		if (!attr->mask)
1722 			break;
1723 
1724 		switch (attr->reserved1) {
1725 		case cpu_to_le16(BC_FILTER_MAGIC_IP):
1726 			if (vif->bss_conf.arp_addr_cnt != 1) {
1727 				attr->mask = 0;
1728 				continue;
1729 			}
1730 
1731 			attr->val = vif->bss_conf.arp_addr_list[0];
1732 			break;
1733 		case cpu_to_le16(BC_FILTER_MAGIC_MAC):
1734 			attr->val = *(__be32 *)&vif->addr[2];
1735 			break;
1736 		default:
1737 			break;
1738 		}
1739 		attr->reserved1 = 0;
1740 		out_filter->num_attrs++;
1741 	}
1742 }
1743 
1744 static void iwl_mvm_bcast_filter_iterator(void *_data, u8 *mac,
1745 					  struct ieee80211_vif *vif)
1746 {
1747 	struct iwl_bcast_iter_data *data = _data;
1748 	struct iwl_mvm *mvm = data->mvm;
1749 	struct iwl_bcast_filter_cmd *cmd = data->cmd;
1750 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1751 	struct iwl_fw_bcast_mac *bcast_mac;
1752 	int i;
1753 
1754 	if (WARN_ON(mvmvif->id >= ARRAY_SIZE(cmd->macs)))
1755 		return;
1756 
1757 	bcast_mac = &cmd->macs[mvmvif->id];
1758 
1759 	/*
1760 	 * enable filtering only for associated stations, but not for P2P
1761 	 * Clients
1762 	 */
1763 	if (vif->type != NL80211_IFTYPE_STATION || vif->p2p ||
1764 	    !vif->bss_conf.assoc)
1765 		return;
1766 
1767 	bcast_mac->default_discard = 1;
1768 
1769 	/* copy all configured filters */
1770 	for (i = 0; mvm->bcast_filters[i].attrs[0].mask; i++) {
1771 		/*
1772 		 * Make sure we don't exceed our filters limit.
1773 		 * if there is still a valid filter to be configured,
1774 		 * be on the safe side and just allow bcast for this mac.
1775 		 */
1776 		if (WARN_ON_ONCE(data->current_filter >=
1777 				 ARRAY_SIZE(cmd->filters))) {
1778 			bcast_mac->default_discard = 0;
1779 			bcast_mac->attached_filters = 0;
1780 			break;
1781 		}
1782 
1783 		iwl_mvm_set_bcast_filter(vif,
1784 					 &mvm->bcast_filters[i],
1785 					 &cmd->filters[data->current_filter]);
1786 
1787 		/* skip current filter if it contains no attributes */
1788 		if (!cmd->filters[data->current_filter].num_attrs)
1789 			continue;
1790 
1791 		/* attach the filter to current mac */
1792 		bcast_mac->attached_filters |=
1793 				cpu_to_le16(BIT(data->current_filter));
1794 
1795 		data->current_filter++;
1796 	}
1797 }
1798 
1799 bool iwl_mvm_bcast_filter_build_cmd(struct iwl_mvm *mvm,
1800 				    struct iwl_bcast_filter_cmd *cmd)
1801 {
1802 	struct iwl_bcast_iter_data iter_data = {
1803 		.mvm = mvm,
1804 		.cmd = cmd,
1805 	};
1806 
1807 	if (IWL_MVM_FW_BCAST_FILTER_PASS_ALL)
1808 		return false;
1809 
1810 	memset(cmd, 0, sizeof(*cmd));
1811 	cmd->max_bcast_filters = ARRAY_SIZE(cmd->filters);
1812 	cmd->max_macs = ARRAY_SIZE(cmd->macs);
1813 
1814 #ifdef CONFIG_IWLWIFI_DEBUGFS
1815 	/* use debugfs filters/macs if override is configured */
1816 	if (mvm->dbgfs_bcast_filtering.override) {
1817 		memcpy(cmd->filters, &mvm->dbgfs_bcast_filtering.cmd.filters,
1818 		       sizeof(cmd->filters));
1819 		memcpy(cmd->macs, &mvm->dbgfs_bcast_filtering.cmd.macs,
1820 		       sizeof(cmd->macs));
1821 		return true;
1822 	}
1823 #endif
1824 
1825 	/* if no filters are configured, do nothing */
1826 	if (!mvm->bcast_filters)
1827 		return false;
1828 
1829 	/* configure and attach these filters for each associated sta vif */
1830 	ieee80211_iterate_active_interfaces(
1831 		mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1832 		iwl_mvm_bcast_filter_iterator, &iter_data);
1833 
1834 	return true;
1835 }
1836 
1837 static int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
1838 {
1839 	struct iwl_bcast_filter_cmd cmd;
1840 
1841 	if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BCAST_FILTERING))
1842 		return 0;
1843 
1844 	if (!iwl_mvm_bcast_filter_build_cmd(mvm, &cmd))
1845 		return 0;
1846 
1847 	return iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, 0,
1848 				    sizeof(cmd), &cmd);
1849 }
1850 #else
1851 static inline int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
1852 {
1853 	return 0;
1854 }
1855 #endif
1856 
1857 static int iwl_mvm_update_mu_groups(struct iwl_mvm *mvm,
1858 				    struct ieee80211_vif *vif)
1859 {
1860 	struct iwl_mu_group_mgmt_cmd cmd = {};
1861 
1862 	memcpy(cmd.membership_status, vif->bss_conf.mu_group.membership,
1863 	       WLAN_MEMBERSHIP_LEN);
1864 	memcpy(cmd.user_position, vif->bss_conf.mu_group.position,
1865 	       WLAN_USER_POSITION_LEN);
1866 
1867 	return iwl_mvm_send_cmd_pdu(mvm,
1868 				    WIDE_ID(DATA_PATH_GROUP,
1869 					    UPDATE_MU_GROUPS_CMD),
1870 				    0, sizeof(cmd), &cmd);
1871 }
1872 
1873 static void iwl_mvm_mu_mimo_iface_iterator(void *_data, u8 *mac,
1874 					   struct ieee80211_vif *vif)
1875 {
1876 	if (vif->mu_mimo_owner) {
1877 		struct iwl_mu_group_mgmt_notif *notif = _data;
1878 
1879 		/*
1880 		 * MU-MIMO Group Id action frame is little endian. We treat
1881 		 * the data received from firmware as if it came from the
1882 		 * action frame, so no conversion is needed.
1883 		 */
1884 		ieee80211_update_mu_groups(vif,
1885 					   (u8 *)&notif->membership_status,
1886 					   (u8 *)&notif->user_position);
1887 	}
1888 }
1889 
1890 void iwl_mvm_mu_mimo_grp_notif(struct iwl_mvm *mvm,
1891 			       struct iwl_rx_cmd_buffer *rxb)
1892 {
1893 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
1894 	struct iwl_mu_group_mgmt_notif *notif = (void *)pkt->data;
1895 
1896 	ieee80211_iterate_active_interfaces_atomic(
1897 			mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1898 			iwl_mvm_mu_mimo_iface_iterator, notif);
1899 }
1900 
1901 static u8 iwl_mvm_he_get_ppe_val(u8 *ppe, u8 ppe_pos_bit)
1902 {
1903 	u8 byte_num = ppe_pos_bit / 8;
1904 	u8 bit_num = ppe_pos_bit % 8;
1905 	u8 residue_bits;
1906 	u8 res;
1907 
1908 	if (bit_num <= 5)
1909 		return (ppe[byte_num] >> bit_num) &
1910 		       (BIT(IEEE80211_PPE_THRES_INFO_PPET_SIZE) - 1);
1911 
1912 	/*
1913 	 * If bit_num > 5, we have to combine bits with next byte.
1914 	 * Calculate how many bits we need to take from current byte (called
1915 	 * here "residue_bits"), and add them to bits from next byte.
1916 	 */
1917 
1918 	residue_bits = 8 - bit_num;
1919 
1920 	res = (ppe[byte_num + 1] &
1921 	       (BIT(IEEE80211_PPE_THRES_INFO_PPET_SIZE - residue_bits) - 1)) <<
1922 	      residue_bits;
1923 	res += (ppe[byte_num] >> bit_num) & (BIT(residue_bits) - 1);
1924 
1925 	return res;
1926 }
1927 
1928 static void iwl_mvm_cfg_he_sta(struct iwl_mvm *mvm,
1929 			       struct ieee80211_vif *vif, u8 sta_id)
1930 {
1931 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1932 	struct iwl_he_sta_context_cmd sta_ctxt_cmd = {
1933 		.sta_id = sta_id,
1934 		.tid_limit = IWL_MAX_TID_COUNT,
1935 		.bss_color = vif->bss_conf.bss_color,
1936 		.htc_trig_based_pkt_ext = vif->bss_conf.htc_trig_based_pkt_ext,
1937 		.frame_time_rts_th =
1938 			cpu_to_le16(vif->bss_conf.frame_time_rts_th),
1939 	};
1940 	struct ieee80211_sta *sta;
1941 	u32 flags;
1942 	int i;
1943 
1944 	rcu_read_lock();
1945 
1946 	sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_ctxt_cmd.sta_id]);
1947 	if (IS_ERR(sta)) {
1948 		rcu_read_unlock();
1949 		WARN(1, "Can't find STA to configure HE\n");
1950 		return;
1951 	}
1952 
1953 	if (!sta->he_cap.has_he) {
1954 		rcu_read_unlock();
1955 		return;
1956 	}
1957 
1958 	flags = 0;
1959 
1960 	/* HTC flags */
1961 	if (sta->he_cap.he_cap_elem.mac_cap_info[0] &
1962 	    IEEE80211_HE_MAC_CAP0_HTC_HE)
1963 		sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_SUPPORT);
1964 	if ((sta->he_cap.he_cap_elem.mac_cap_info[1] &
1965 	      IEEE80211_HE_MAC_CAP1_LINK_ADAPTATION) ||
1966 	    (sta->he_cap.he_cap_elem.mac_cap_info[2] &
1967 	      IEEE80211_HE_MAC_CAP2_LINK_ADAPTATION)) {
1968 		u8 link_adap =
1969 			((sta->he_cap.he_cap_elem.mac_cap_info[2] &
1970 			  IEEE80211_HE_MAC_CAP2_LINK_ADAPTATION) << 1) +
1971 			 (sta->he_cap.he_cap_elem.mac_cap_info[1] &
1972 			  IEEE80211_HE_MAC_CAP1_LINK_ADAPTATION);
1973 
1974 		if (link_adap == 2)
1975 			sta_ctxt_cmd.htc_flags |=
1976 				cpu_to_le32(IWL_HE_HTC_LINK_ADAP_UNSOLICITED);
1977 		else if (link_adap == 3)
1978 			sta_ctxt_cmd.htc_flags |=
1979 				cpu_to_le32(IWL_HE_HTC_LINK_ADAP_BOTH);
1980 	}
1981 	if (sta->he_cap.he_cap_elem.mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
1982 		sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_BSR_SUPP);
1983 	if (sta->he_cap.he_cap_elem.mac_cap_info[3] &
1984 	    IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
1985 		sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_OMI_SUPP);
1986 	if (sta->he_cap.he_cap_elem.mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
1987 		sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_BQR_SUPP);
1988 
1989 	/* If PPE Thresholds exist, parse them into a FW-familiar format */
1990 	if (sta->he_cap.he_cap_elem.phy_cap_info[6] &
1991 	    IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT) {
1992 		u8 nss = (sta->he_cap.ppe_thres[0] &
1993 			  IEEE80211_PPE_THRES_NSS_MASK) + 1;
1994 		u8 ru_index_bitmap =
1995 			(sta->he_cap.ppe_thres[0] &
1996 			 IEEE80211_PPE_THRES_RU_INDEX_BITMASK_MASK) >>
1997 			IEEE80211_PPE_THRES_RU_INDEX_BITMASK_POS;
1998 		u8 *ppe = &sta->he_cap.ppe_thres[0];
1999 		u8 ppe_pos_bit = 7; /* Starting after PPE header */
2000 
2001 		/*
2002 		 * FW currently supports only nss == MAX_HE_SUPP_NSS
2003 		 *
2004 		 * If nss > MAX: we can ignore values we don't support
2005 		 * If nss < MAX: we can set zeros in other streams
2006 		 */
2007 		if (nss > MAX_HE_SUPP_NSS) {
2008 			IWL_INFO(mvm, "Got NSS = %d - trimming to %d\n", nss,
2009 				 MAX_HE_SUPP_NSS);
2010 			nss = MAX_HE_SUPP_NSS;
2011 		}
2012 
2013 		for (i = 0; i < nss; i++) {
2014 			u8 ru_index_tmp = ru_index_bitmap << 1;
2015 			u8 bw;
2016 
2017 			for (bw = 0; bw < MAX_HE_CHANNEL_BW_INDX; bw++) {
2018 				ru_index_tmp >>= 1;
2019 				if (!(ru_index_tmp & 1))
2020 					continue;
2021 
2022 				sta_ctxt_cmd.pkt_ext.pkt_ext_qam_th[i][bw][1] =
2023 					iwl_mvm_he_get_ppe_val(ppe,
2024 							       ppe_pos_bit);
2025 				ppe_pos_bit +=
2026 					IEEE80211_PPE_THRES_INFO_PPET_SIZE;
2027 				sta_ctxt_cmd.pkt_ext.pkt_ext_qam_th[i][bw][0] =
2028 					iwl_mvm_he_get_ppe_val(ppe,
2029 							       ppe_pos_bit);
2030 				ppe_pos_bit +=
2031 					IEEE80211_PPE_THRES_INFO_PPET_SIZE;
2032 			}
2033 		}
2034 
2035 		flags |= STA_CTXT_HE_PACKET_EXT;
2036 	}
2037 	rcu_read_unlock();
2038 
2039 	/* Mark MU EDCA as enabled, unless none detected on some AC */
2040 	flags |= STA_CTXT_HE_MU_EDCA_CW;
2041 	for (i = 0; i < AC_NUM; i++) {
2042 		struct ieee80211_he_mu_edca_param_ac_rec *mu_edca =
2043 			&mvmvif->queue_params[i].mu_edca_param_rec;
2044 
2045 		if (!mvmvif->queue_params[i].mu_edca) {
2046 			flags &= ~STA_CTXT_HE_MU_EDCA_CW;
2047 			break;
2048 		}
2049 
2050 		sta_ctxt_cmd.trig_based_txf[i].cwmin =
2051 			cpu_to_le16(mu_edca->ecw_min_max & 0xf);
2052 		sta_ctxt_cmd.trig_based_txf[i].cwmax =
2053 			cpu_to_le16((mu_edca->ecw_min_max & 0xf0) >> 4);
2054 		sta_ctxt_cmd.trig_based_txf[i].aifsn =
2055 			cpu_to_le16(mu_edca->aifsn);
2056 		sta_ctxt_cmd.trig_based_txf[i].mu_time =
2057 			cpu_to_le16(mu_edca->mu_edca_timer);
2058 	}
2059 
2060 	if (vif->bss_conf.multi_sta_back_32bit)
2061 		flags |= STA_CTXT_HE_32BIT_BA_BITMAP;
2062 
2063 	if (vif->bss_conf.ack_enabled)
2064 		flags |= STA_CTXT_HE_ACK_ENABLED;
2065 
2066 	if (vif->bss_conf.uora_exists) {
2067 		flags |= STA_CTXT_HE_TRIG_RND_ALLOC;
2068 
2069 		sta_ctxt_cmd.rand_alloc_ecwmin =
2070 			vif->bss_conf.uora_ocw_range & 0x7;
2071 		sta_ctxt_cmd.rand_alloc_ecwmax =
2072 			(vif->bss_conf.uora_ocw_range >> 3) & 0x7;
2073 	}
2074 
2075 	/* TODO: support Multi BSSID IE */
2076 
2077 	sta_ctxt_cmd.flags = cpu_to_le32(flags);
2078 
2079 	if (iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(STA_HE_CTXT_CMD,
2080 						 DATA_PATH_GROUP, 0),
2081 				 0, sizeof(sta_ctxt_cmd), &sta_ctxt_cmd))
2082 		IWL_ERR(mvm, "Failed to config FW to work HE!\n");
2083 }
2084 
2085 static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
2086 					     struct ieee80211_vif *vif,
2087 					     struct ieee80211_bss_conf *bss_conf,
2088 					     u32 changes)
2089 {
2090 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2091 	int ret;
2092 
2093 	/*
2094 	 * Re-calculate the tsf id, as the master-slave relations depend on the
2095 	 * beacon interval, which was not known when the station interface was
2096 	 * added.
2097 	 */
2098 	if (changes & BSS_CHANGED_ASSOC && bss_conf->assoc) {
2099 		if (vif->bss_conf.he_support &&
2100 		    !iwlwifi_mod_params.disable_11ax)
2101 			iwl_mvm_cfg_he_sta(mvm, vif, mvmvif->ap_sta_id);
2102 
2103 		iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
2104 	}
2105 
2106 	/*
2107 	 * If we're not associated yet, take the (new) BSSID before associating
2108 	 * so the firmware knows. If we're already associated, then use the old
2109 	 * BSSID here, and we'll send a cleared one later in the CHANGED_ASSOC
2110 	 * branch for disassociation below.
2111 	 */
2112 	if (changes & BSS_CHANGED_BSSID && !mvmvif->associated)
2113 		memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
2114 
2115 	ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, mvmvif->bssid);
2116 	if (ret)
2117 		IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
2118 
2119 	/* after sending it once, adopt mac80211 data */
2120 	memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
2121 	mvmvif->associated = bss_conf->assoc;
2122 
2123 	if (changes & BSS_CHANGED_ASSOC) {
2124 		if (bss_conf->assoc) {
2125 			/* clear statistics to get clean beacon counter */
2126 			iwl_mvm_request_statistics(mvm, true);
2127 			memset(&mvmvif->beacon_stats, 0,
2128 			       sizeof(mvmvif->beacon_stats));
2129 
2130 			/* add quota for this interface */
2131 			ret = iwl_mvm_update_quotas(mvm, true, NULL);
2132 			if (ret) {
2133 				IWL_ERR(mvm, "failed to update quotas\n");
2134 				return;
2135 			}
2136 
2137 			if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
2138 				     &mvm->status)) {
2139 				/*
2140 				 * If we're restarting then the firmware will
2141 				 * obviously have lost synchronisation with
2142 				 * the AP. It will attempt to synchronise by
2143 				 * itself, but we can make it more reliable by
2144 				 * scheduling a session protection time event.
2145 				 *
2146 				 * The firmware needs to receive a beacon to
2147 				 * catch up with synchronisation, use 110% of
2148 				 * the beacon interval.
2149 				 *
2150 				 * Set a large maximum delay to allow for more
2151 				 * than a single interface.
2152 				 */
2153 				u32 dur = (11 * vif->bss_conf.beacon_int) / 10;
2154 				iwl_mvm_protect_session(mvm, vif, dur, dur,
2155 							5 * dur, false);
2156 			}
2157 
2158 			iwl_mvm_sf_update(mvm, vif, false);
2159 			iwl_mvm_power_vif_assoc(mvm, vif);
2160 			if (vif->p2p) {
2161 				iwl_mvm_ref(mvm, IWL_MVM_REF_P2P_CLIENT);
2162 				iwl_mvm_update_smps(mvm, vif,
2163 						    IWL_MVM_SMPS_REQ_PROT,
2164 						    IEEE80211_SMPS_DYNAMIC);
2165 			}
2166 		} else if (mvmvif->ap_sta_id != IWL_MVM_INVALID_STA) {
2167 			/*
2168 			 * If update fails - SF might be running in associated
2169 			 * mode while disassociated - which is forbidden.
2170 			 */
2171 			WARN_ONCE(iwl_mvm_sf_update(mvm, vif, false),
2172 				  "Failed to update SF upon disassociation\n");
2173 
2174 			/*
2175 			 * If we get an assert during the connection (after the
2176 			 * station has been added, but before the vif is set
2177 			 * to associated), mac80211 will re-add the station and
2178 			 * then configure the vif. Since the vif is not
2179 			 * associated, we would remove the station here and
2180 			 * this would fail the recovery.
2181 			 */
2182 			if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
2183 				      &mvm->status)) {
2184 				/*
2185 				 * Remove AP station now that
2186 				 * the MAC is unassoc
2187 				 */
2188 				ret = iwl_mvm_rm_sta_id(mvm, vif,
2189 							mvmvif->ap_sta_id);
2190 				if (ret)
2191 					IWL_ERR(mvm,
2192 						"failed to remove AP station\n");
2193 
2194 				if (mvm->d0i3_ap_sta_id == mvmvif->ap_sta_id)
2195 					mvm->d0i3_ap_sta_id =
2196 						IWL_MVM_INVALID_STA;
2197 				mvmvif->ap_sta_id = IWL_MVM_INVALID_STA;
2198 			}
2199 
2200 			/* remove quota for this interface */
2201 			ret = iwl_mvm_update_quotas(mvm, false, NULL);
2202 			if (ret)
2203 				IWL_ERR(mvm, "failed to update quotas\n");
2204 
2205 			if (vif->p2p)
2206 				iwl_mvm_unref(mvm, IWL_MVM_REF_P2P_CLIENT);
2207 
2208 			/* this will take the cleared BSSID from bss_conf */
2209 			ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
2210 			if (ret)
2211 				IWL_ERR(mvm,
2212 					"failed to update MAC %pM (clear after unassoc)\n",
2213 					vif->addr);
2214 		}
2215 
2216 		/*
2217 		 * The firmware tracks the MU-MIMO group on its own.
2218 		 * However, on HW restart we should restore this data.
2219 		 */
2220 		if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
2221 		    (changes & BSS_CHANGED_MU_GROUPS) && vif->mu_mimo_owner) {
2222 			ret = iwl_mvm_update_mu_groups(mvm, vif);
2223 			if (ret)
2224 				IWL_ERR(mvm,
2225 					"failed to update VHT MU_MIMO groups\n");
2226 		}
2227 
2228 		iwl_mvm_recalc_multicast(mvm);
2229 		iwl_mvm_configure_bcast_filter(mvm);
2230 
2231 		/* reset rssi values */
2232 		mvmvif->bf_data.ave_beacon_signal = 0;
2233 
2234 		iwl_mvm_bt_coex_vif_change(mvm);
2235 		iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_TT,
2236 				    IEEE80211_SMPS_AUTOMATIC);
2237 		if (fw_has_capa(&mvm->fw->ucode_capa,
2238 				IWL_UCODE_TLV_CAPA_UMAC_SCAN))
2239 			iwl_mvm_config_scan(mvm);
2240 	}
2241 
2242 	if (changes & BSS_CHANGED_BEACON_INFO) {
2243 		/*
2244 		 * We received a beacon from the associated AP so
2245 		 * remove the session protection.
2246 		 */
2247 		iwl_mvm_stop_session_protection(mvm, vif);
2248 
2249 		iwl_mvm_sf_update(mvm, vif, false);
2250 		WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
2251 	}
2252 
2253 	if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS | BSS_CHANGED_QOS |
2254 		       /*
2255 			* Send power command on every beacon change,
2256 			* because we may have not enabled beacon abort yet.
2257 			*/
2258 		       BSS_CHANGED_BEACON_INFO)) {
2259 		ret = iwl_mvm_power_update_mac(mvm);
2260 		if (ret)
2261 			IWL_ERR(mvm, "failed to update power mode\n");
2262 	}
2263 
2264 	if (changes & BSS_CHANGED_TXPOWER) {
2265 		IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2266 				bss_conf->txpower);
2267 		iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2268 	}
2269 
2270 	if (changes & BSS_CHANGED_CQM) {
2271 		IWL_DEBUG_MAC80211(mvm, "cqm info_changed\n");
2272 		/* reset cqm events tracking */
2273 		mvmvif->bf_data.last_cqm_event = 0;
2274 		if (mvmvif->bf_data.bf_enabled) {
2275 			ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
2276 			if (ret)
2277 				IWL_ERR(mvm,
2278 					"failed to update CQM thresholds\n");
2279 		}
2280 	}
2281 
2282 	if (changes & BSS_CHANGED_ARP_FILTER) {
2283 		IWL_DEBUG_MAC80211(mvm, "arp filter changed\n");
2284 		iwl_mvm_configure_bcast_filter(mvm);
2285 	}
2286 }
2287 
2288 static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
2289 				 struct ieee80211_vif *vif)
2290 {
2291 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2292 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2293 	int ret;
2294 
2295 	/*
2296 	 * iwl_mvm_mac_ctxt_add() might read directly from the device
2297 	 * (the system time), so make sure it is available.
2298 	 */
2299 	ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_START_AP);
2300 	if (ret)
2301 		return ret;
2302 
2303 	mutex_lock(&mvm->mutex);
2304 
2305 	/* Send the beacon template */
2306 	ret = iwl_mvm_mac_ctxt_beacon_changed(mvm, vif);
2307 	if (ret)
2308 		goto out_unlock;
2309 
2310 	/*
2311 	 * Re-calculate the tsf id, as the master-slave relations depend on the
2312 	 * beacon interval, which was not known when the AP interface was added.
2313 	 */
2314 	if (vif->type == NL80211_IFTYPE_AP)
2315 		iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
2316 
2317 	mvmvif->ap_assoc_sta_count = 0;
2318 
2319 	/* Add the mac context */
2320 	ret = iwl_mvm_mac_ctxt_add(mvm, vif);
2321 	if (ret)
2322 		goto out_unlock;
2323 
2324 	/* Perform the binding */
2325 	ret = iwl_mvm_binding_add_vif(mvm, vif);
2326 	if (ret)
2327 		goto out_remove;
2328 
2329 	/*
2330 	 * This is not very nice, but the simplest:
2331 	 * For older FWs adding the mcast sta before the bcast station may
2332 	 * cause assert 0x2b00.
2333 	 * This is fixed in later FW so make the order of removal depend on
2334 	 * the TLV
2335 	 */
2336 	if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE)) {
2337 		ret = iwl_mvm_add_mcast_sta(mvm, vif);
2338 		if (ret)
2339 			goto out_unbind;
2340 		/*
2341 		 * Send the bcast station. At this stage the TBTT and DTIM time
2342 		 * events are added and applied to the scheduler
2343 		 */
2344 		ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
2345 		if (ret) {
2346 			iwl_mvm_rm_mcast_sta(mvm, vif);
2347 			goto out_unbind;
2348 		}
2349 	} else {
2350 		/*
2351 		 * Send the bcast station. At this stage the TBTT and DTIM time
2352 		 * events are added and applied to the scheduler
2353 		 */
2354 		ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
2355 		if (ret)
2356 			goto out_unbind;
2357 		ret = iwl_mvm_add_mcast_sta(mvm, vif);
2358 		if (ret) {
2359 			iwl_mvm_send_rm_bcast_sta(mvm, vif);
2360 			goto out_unbind;
2361 		}
2362 	}
2363 
2364 	/* must be set before quota calculations */
2365 	mvmvif->ap_ibss_active = true;
2366 
2367 	/* power updated needs to be done before quotas */
2368 	iwl_mvm_power_update_mac(mvm);
2369 
2370 	ret = iwl_mvm_update_quotas(mvm, false, NULL);
2371 	if (ret)
2372 		goto out_quota_failed;
2373 
2374 	/* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2375 	if (vif->p2p && mvm->p2p_device_vif)
2376 		iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2377 
2378 	iwl_mvm_ref(mvm, IWL_MVM_REF_AP_IBSS);
2379 
2380 	iwl_mvm_bt_coex_vif_change(mvm);
2381 
2382 	/* we don't support TDLS during DCM */
2383 	if (iwl_mvm_phy_ctx_count(mvm) > 1)
2384 		iwl_mvm_teardown_tdls_peers(mvm);
2385 
2386 	goto out_unlock;
2387 
2388 out_quota_failed:
2389 	iwl_mvm_power_update_mac(mvm);
2390 	mvmvif->ap_ibss_active = false;
2391 	iwl_mvm_send_rm_bcast_sta(mvm, vif);
2392 	iwl_mvm_rm_mcast_sta(mvm, vif);
2393 out_unbind:
2394 	iwl_mvm_binding_remove_vif(mvm, vif);
2395 out_remove:
2396 	iwl_mvm_mac_ctxt_remove(mvm, vif);
2397 out_unlock:
2398 	mutex_unlock(&mvm->mutex);
2399 	iwl_mvm_unref(mvm, IWL_MVM_REF_START_AP);
2400 	return ret;
2401 }
2402 
2403 static void iwl_mvm_stop_ap_ibss(struct ieee80211_hw *hw,
2404 				 struct ieee80211_vif *vif)
2405 {
2406 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2407 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2408 
2409 	iwl_mvm_prepare_mac_removal(mvm, vif);
2410 
2411 	mutex_lock(&mvm->mutex);
2412 
2413 	/* Handle AP stop while in CSA */
2414 	if (rcu_access_pointer(mvm->csa_vif) == vif) {
2415 		iwl_mvm_remove_time_event(mvm, mvmvif,
2416 					  &mvmvif->time_event_data);
2417 		RCU_INIT_POINTER(mvm->csa_vif, NULL);
2418 		mvmvif->csa_countdown = false;
2419 	}
2420 
2421 	if (rcu_access_pointer(mvm->csa_tx_blocked_vif) == vif) {
2422 		RCU_INIT_POINTER(mvm->csa_tx_blocked_vif, NULL);
2423 		mvm->csa_tx_block_bcn_timeout = 0;
2424 	}
2425 
2426 	mvmvif->ap_ibss_active = false;
2427 	mvm->ap_last_beacon_gp2 = 0;
2428 
2429 	iwl_mvm_bt_coex_vif_change(mvm);
2430 
2431 	iwl_mvm_unref(mvm, IWL_MVM_REF_AP_IBSS);
2432 
2433 	/* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2434 	if (vif->p2p && mvm->p2p_device_vif)
2435 		iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2436 
2437 	iwl_mvm_update_quotas(mvm, false, NULL);
2438 
2439 	/*
2440 	 * This is not very nice, but the simplest:
2441 	 * For older FWs removing the mcast sta before the bcast station may
2442 	 * cause assert 0x2b00.
2443 	 * This is fixed in later FW (which will stop beaconing when removing
2444 	 * bcast station).
2445 	 * So make the order of removal depend on the TLV
2446 	 */
2447 	if (!fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE))
2448 		iwl_mvm_rm_mcast_sta(mvm, vif);
2449 	iwl_mvm_send_rm_bcast_sta(mvm, vif);
2450 	if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE))
2451 		iwl_mvm_rm_mcast_sta(mvm, vif);
2452 	iwl_mvm_binding_remove_vif(mvm, vif);
2453 
2454 	iwl_mvm_power_update_mac(mvm);
2455 
2456 	iwl_mvm_mac_ctxt_remove(mvm, vif);
2457 
2458 	mutex_unlock(&mvm->mutex);
2459 }
2460 
2461 static void
2462 iwl_mvm_bss_info_changed_ap_ibss(struct iwl_mvm *mvm,
2463 				 struct ieee80211_vif *vif,
2464 				 struct ieee80211_bss_conf *bss_conf,
2465 				 u32 changes)
2466 {
2467 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2468 
2469 	/* Changes will be applied when the AP/IBSS is started */
2470 	if (!mvmvif->ap_ibss_active)
2471 		return;
2472 
2473 	if (changes & (BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_HT |
2474 		       BSS_CHANGED_BANDWIDTH | BSS_CHANGED_QOS) &&
2475 	    iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL))
2476 		IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
2477 
2478 	/* Need to send a new beacon template to the FW */
2479 	if (changes & BSS_CHANGED_BEACON &&
2480 	    iwl_mvm_mac_ctxt_beacon_changed(mvm, vif))
2481 		IWL_WARN(mvm, "Failed updating beacon data\n");
2482 
2483 	if (changes & BSS_CHANGED_TXPOWER) {
2484 		IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2485 				bss_conf->txpower);
2486 		iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2487 	}
2488 }
2489 
2490 static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw,
2491 				     struct ieee80211_vif *vif,
2492 				     struct ieee80211_bss_conf *bss_conf,
2493 				     u32 changes)
2494 {
2495 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2496 
2497 	/*
2498 	 * iwl_mvm_bss_info_changed_station() might call
2499 	 * iwl_mvm_protect_session(), which reads directly from
2500 	 * the device (the system time), so make sure it is available.
2501 	 */
2502 	if (iwl_mvm_ref_sync(mvm, IWL_MVM_REF_BSS_CHANGED))
2503 		return;
2504 
2505 	mutex_lock(&mvm->mutex);
2506 
2507 	if (changes & BSS_CHANGED_IDLE && !bss_conf->idle)
2508 		iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true);
2509 
2510 	switch (vif->type) {
2511 	case NL80211_IFTYPE_STATION:
2512 		iwl_mvm_bss_info_changed_station(mvm, vif, bss_conf, changes);
2513 		break;
2514 	case NL80211_IFTYPE_AP:
2515 	case NL80211_IFTYPE_ADHOC:
2516 		iwl_mvm_bss_info_changed_ap_ibss(mvm, vif, bss_conf, changes);
2517 		break;
2518 	case NL80211_IFTYPE_MONITOR:
2519 		if (changes & BSS_CHANGED_MU_GROUPS)
2520 			iwl_mvm_update_mu_groups(mvm, vif);
2521 		break;
2522 	default:
2523 		/* shouldn't happen */
2524 		WARN_ON_ONCE(1);
2525 	}
2526 
2527 	mutex_unlock(&mvm->mutex);
2528 	iwl_mvm_unref(mvm, IWL_MVM_REF_BSS_CHANGED);
2529 }
2530 
2531 static int iwl_mvm_mac_hw_scan(struct ieee80211_hw *hw,
2532 			       struct ieee80211_vif *vif,
2533 			       struct ieee80211_scan_request *hw_req)
2534 {
2535 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2536 	int ret;
2537 
2538 	if (hw_req->req.n_channels == 0 ||
2539 	    hw_req->req.n_channels > mvm->fw->ucode_capa.n_scan_channels)
2540 		return -EINVAL;
2541 
2542 	mutex_lock(&mvm->mutex);
2543 	ret = iwl_mvm_reg_scan_start(mvm, vif, &hw_req->req, &hw_req->ies);
2544 	mutex_unlock(&mvm->mutex);
2545 
2546 	return ret;
2547 }
2548 
2549 static void iwl_mvm_mac_cancel_hw_scan(struct ieee80211_hw *hw,
2550 				       struct ieee80211_vif *vif)
2551 {
2552 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2553 
2554 	mutex_lock(&mvm->mutex);
2555 
2556 	/* Due to a race condition, it's possible that mac80211 asks
2557 	 * us to stop a hw_scan when it's already stopped.  This can
2558 	 * happen, for instance, if we stopped the scan ourselves,
2559 	 * called ieee80211_scan_completed() and the userspace called
2560 	 * cancel scan scan before ieee80211_scan_work() could run.
2561 	 * To handle that, simply return if the scan is not running.
2562 	*/
2563 	if (mvm->scan_status & IWL_MVM_SCAN_REGULAR)
2564 		iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true);
2565 
2566 	mutex_unlock(&mvm->mutex);
2567 }
2568 
2569 static void
2570 iwl_mvm_mac_allow_buffered_frames(struct ieee80211_hw *hw,
2571 				  struct ieee80211_sta *sta, u16 tids,
2572 				  int num_frames,
2573 				  enum ieee80211_frame_release_type reason,
2574 				  bool more_data)
2575 {
2576 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2577 
2578 	/* Called when we need to transmit (a) frame(s) from mac80211 */
2579 
2580 	iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2581 					  tids, more_data, false);
2582 }
2583 
2584 static void
2585 iwl_mvm_mac_release_buffered_frames(struct ieee80211_hw *hw,
2586 				    struct ieee80211_sta *sta, u16 tids,
2587 				    int num_frames,
2588 				    enum ieee80211_frame_release_type reason,
2589 				    bool more_data)
2590 {
2591 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2592 
2593 	/* Called when we need to transmit (a) frame(s) from agg or dqa queue */
2594 
2595 	iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2596 					  tids, more_data, true);
2597 }
2598 
2599 static void __iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
2600 				     enum sta_notify_cmd cmd,
2601 				     struct ieee80211_sta *sta)
2602 {
2603 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2604 	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
2605 	unsigned long txqs = 0, tids = 0;
2606 	int tid;
2607 
2608 	/*
2609 	 * If we have TVQM then we get too high queue numbers - luckily
2610 	 * we really shouldn't get here with that because such hardware
2611 	 * should have firmware supporting buffer station offload.
2612 	 */
2613 	if (WARN_ON(iwl_mvm_has_new_tx_api(mvm)))
2614 		return;
2615 
2616 	spin_lock_bh(&mvmsta->lock);
2617 	for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++) {
2618 		struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
2619 
2620 		if (tid_data->txq_id == IWL_MVM_INVALID_QUEUE)
2621 			continue;
2622 
2623 		__set_bit(tid_data->txq_id, &txqs);
2624 
2625 		if (iwl_mvm_tid_queued(mvm, tid_data) == 0)
2626 			continue;
2627 
2628 		__set_bit(tid, &tids);
2629 	}
2630 
2631 	switch (cmd) {
2632 	case STA_NOTIFY_SLEEP:
2633 		for_each_set_bit(tid, &tids, IWL_MAX_TID_COUNT)
2634 			ieee80211_sta_set_buffered(sta, tid, true);
2635 
2636 		if (txqs)
2637 			iwl_trans_freeze_txq_timer(mvm->trans, txqs, true);
2638 		/*
2639 		 * The fw updates the STA to be asleep. Tx packets on the Tx
2640 		 * queues to this station will not be transmitted. The fw will
2641 		 * send a Tx response with TX_STATUS_FAIL_DEST_PS.
2642 		 */
2643 		break;
2644 	case STA_NOTIFY_AWAKE:
2645 		if (WARN_ON(mvmsta->sta_id == IWL_MVM_INVALID_STA))
2646 			break;
2647 
2648 		if (txqs)
2649 			iwl_trans_freeze_txq_timer(mvm->trans, txqs, false);
2650 		iwl_mvm_sta_modify_ps_wake(mvm, sta);
2651 		break;
2652 	default:
2653 		break;
2654 	}
2655 	spin_unlock_bh(&mvmsta->lock);
2656 }
2657 
2658 static void iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
2659 				   struct ieee80211_vif *vif,
2660 				   enum sta_notify_cmd cmd,
2661 				   struct ieee80211_sta *sta)
2662 {
2663 	__iwl_mvm_mac_sta_notify(hw, cmd, sta);
2664 }
2665 
2666 void iwl_mvm_sta_pm_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
2667 {
2668 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
2669 	struct iwl_mvm_pm_state_notification *notif = (void *)pkt->data;
2670 	struct ieee80211_sta *sta;
2671 	struct iwl_mvm_sta *mvmsta;
2672 	bool sleeping = (notif->type != IWL_MVM_PM_EVENT_AWAKE);
2673 
2674 	if (WARN_ON(notif->sta_id >= ARRAY_SIZE(mvm->fw_id_to_mac_id)))
2675 		return;
2676 
2677 	rcu_read_lock();
2678 	sta = rcu_dereference(mvm->fw_id_to_mac_id[notif->sta_id]);
2679 	if (WARN_ON(IS_ERR_OR_NULL(sta))) {
2680 		rcu_read_unlock();
2681 		return;
2682 	}
2683 
2684 	mvmsta = iwl_mvm_sta_from_mac80211(sta);
2685 
2686 	if (!mvmsta->vif ||
2687 	    mvmsta->vif->type != NL80211_IFTYPE_AP) {
2688 		rcu_read_unlock();
2689 		return;
2690 	}
2691 
2692 	if (mvmsta->sleeping != sleeping) {
2693 		mvmsta->sleeping = sleeping;
2694 		__iwl_mvm_mac_sta_notify(mvm->hw,
2695 			sleeping ? STA_NOTIFY_SLEEP : STA_NOTIFY_AWAKE,
2696 			sta);
2697 		ieee80211_sta_ps_transition(sta, sleeping);
2698 	}
2699 
2700 	if (sleeping) {
2701 		switch (notif->type) {
2702 		case IWL_MVM_PM_EVENT_AWAKE:
2703 		case IWL_MVM_PM_EVENT_ASLEEP:
2704 			break;
2705 		case IWL_MVM_PM_EVENT_UAPSD:
2706 			ieee80211_sta_uapsd_trigger(sta, IEEE80211_NUM_TIDS);
2707 			break;
2708 		case IWL_MVM_PM_EVENT_PS_POLL:
2709 			ieee80211_sta_pspoll(sta);
2710 			break;
2711 		default:
2712 			break;
2713 		}
2714 	}
2715 
2716 	rcu_read_unlock();
2717 }
2718 
2719 static void iwl_mvm_sta_pre_rcu_remove(struct ieee80211_hw *hw,
2720 				       struct ieee80211_vif *vif,
2721 				       struct ieee80211_sta *sta)
2722 {
2723 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2724 	struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
2725 
2726 	/*
2727 	 * This is called before mac80211 does RCU synchronisation,
2728 	 * so here we already invalidate our internal RCU-protected
2729 	 * station pointer. The rest of the code will thus no longer
2730 	 * be able to find the station this way, and we don't rely
2731 	 * on further RCU synchronisation after the sta_state()
2732 	 * callback deleted the station.
2733 	 */
2734 	mutex_lock(&mvm->mutex);
2735 	if (sta == rcu_access_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id]))
2736 		rcu_assign_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id],
2737 				   ERR_PTR(-ENOENT));
2738 
2739 	mutex_unlock(&mvm->mutex);
2740 }
2741 
2742 static void iwl_mvm_check_uapsd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
2743 				const u8 *bssid)
2744 {
2745 	int i;
2746 
2747 	if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
2748 		struct iwl_mvm_tcm_mac *mdata;
2749 
2750 		mdata = &mvm->tcm.data[iwl_mvm_vif_from_mac80211(vif)->id];
2751 		ewma_rate_init(&mdata->uapsd_nonagg_detect.rate);
2752 		mdata->opened_rx_ba_sessions = false;
2753 	}
2754 
2755 	if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT))
2756 		return;
2757 
2758 	if (vif->p2p && !iwl_mvm_is_p2p_scm_uapsd_supported(mvm)) {
2759 		vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2760 		return;
2761 	}
2762 
2763 	if (!vif->p2p &&
2764 	    (iwlwifi_mod_params.uapsd_disable & IWL_DISABLE_UAPSD_BSS)) {
2765 		vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2766 		return;
2767 	}
2768 
2769 	for (i = 0; i < IWL_MVM_UAPSD_NOAGG_LIST_LEN; i++) {
2770 		if (ether_addr_equal(mvm->uapsd_noagg_bssids[i].addr, bssid)) {
2771 			vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2772 			return;
2773 		}
2774 	}
2775 
2776 	vif->driver_flags |= IEEE80211_VIF_SUPPORTS_UAPSD;
2777 }
2778 
2779 static void
2780 iwl_mvm_tdls_check_trigger(struct iwl_mvm *mvm,
2781 			   struct ieee80211_vif *vif, u8 *peer_addr,
2782 			   enum nl80211_tdls_operation action)
2783 {
2784 	struct iwl_fw_dbg_trigger_tlv *trig;
2785 	struct iwl_fw_dbg_trigger_tdls *tdls_trig;
2786 
2787 	if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_TDLS))
2788 		return;
2789 
2790 	trig = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_TDLS);
2791 	tdls_trig = (void *)trig->data;
2792 	if (!iwl_fw_dbg_trigger_check_stop(&mvm->fwrt,
2793 					   ieee80211_vif_to_wdev(vif), trig))
2794 		return;
2795 
2796 	if (!(tdls_trig->action_bitmap & BIT(action)))
2797 		return;
2798 
2799 	if (tdls_trig->peer_mode &&
2800 	    memcmp(tdls_trig->peer, peer_addr, ETH_ALEN) != 0)
2801 		return;
2802 
2803 	iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
2804 				"TDLS event occurred, peer %pM, action %d",
2805 				peer_addr, action);
2806 }
2807 
2808 static void iwl_mvm_purge_deferred_tx_frames(struct iwl_mvm *mvm,
2809 					     struct iwl_mvm_sta *mvm_sta)
2810 {
2811 	struct iwl_mvm_tid_data *tid_data;
2812 	struct sk_buff *skb;
2813 	int i;
2814 
2815 	spin_lock_bh(&mvm_sta->lock);
2816 	for (i = 0; i <= IWL_MAX_TID_COUNT; i++) {
2817 		tid_data = &mvm_sta->tid_data[i];
2818 
2819 		while ((skb = __skb_dequeue(&tid_data->deferred_tx_frames))) {
2820 			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
2821 
2822 			/*
2823 			 * The first deferred frame should've stopped the MAC
2824 			 * queues, so we should never get a second deferred
2825 			 * frame for the RA/TID.
2826 			 */
2827 			iwl_mvm_start_mac_queues(mvm, BIT(info->hw_queue));
2828 			ieee80211_free_txskb(mvm->hw, skb);
2829 		}
2830 	}
2831 	spin_unlock_bh(&mvm_sta->lock);
2832 }
2833 
2834 static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
2835 				 struct ieee80211_vif *vif,
2836 				 struct ieee80211_sta *sta,
2837 				 enum ieee80211_sta_state old_state,
2838 				 enum ieee80211_sta_state new_state)
2839 {
2840 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2841 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2842 	struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
2843 	int ret;
2844 
2845 	IWL_DEBUG_MAC80211(mvm, "station %pM state change %d->%d\n",
2846 			   sta->addr, old_state, new_state);
2847 
2848 	/* this would be a mac80211 bug ... but don't crash */
2849 	if (WARN_ON_ONCE(!mvmvif->phy_ctxt))
2850 		return -EINVAL;
2851 
2852 	/*
2853 	 * If we are in a STA removal flow and in DQA mode:
2854 	 *
2855 	 * This is after the sync_rcu part, so the queues have already been
2856 	 * flushed. No more TXs on their way in mac80211's path, and no more in
2857 	 * the queues.
2858 	 * Also, we won't be getting any new TX frames for this station.
2859 	 * What we might have are deferred TX frames that need to be taken care
2860 	 * of.
2861 	 *
2862 	 * Drop any still-queued deferred-frame before removing the STA, and
2863 	 * make sure the worker is no longer handling frames for this STA.
2864 	 */
2865 	if (old_state == IEEE80211_STA_NONE &&
2866 	    new_state == IEEE80211_STA_NOTEXIST) {
2867 		iwl_mvm_purge_deferred_tx_frames(mvm, mvm_sta);
2868 		flush_work(&mvm->add_stream_wk);
2869 
2870 		/*
2871 		 * No need to make sure deferred TX indication is off since the
2872 		 * worker will already remove it if it was on
2873 		 */
2874 	}
2875 
2876 	mutex_lock(&mvm->mutex);
2877 	/* track whether or not the station is associated */
2878 	mvm_sta->sta_state = new_state;
2879 
2880 	if (old_state == IEEE80211_STA_NOTEXIST &&
2881 	    new_state == IEEE80211_STA_NONE) {
2882 		/*
2883 		 * Firmware bug - it'll crash if the beacon interval is less
2884 		 * than 16. We can't avoid connecting at all, so refuse the
2885 		 * station state change, this will cause mac80211 to abandon
2886 		 * attempts to connect to this AP, and eventually wpa_s will
2887 		 * blacklist the AP...
2888 		 */
2889 		if (vif->type == NL80211_IFTYPE_STATION &&
2890 		    vif->bss_conf.beacon_int < 16) {
2891 			IWL_ERR(mvm,
2892 				"AP %pM beacon interval is %d, refusing due to firmware bug!\n",
2893 				sta->addr, vif->bss_conf.beacon_int);
2894 			ret = -EINVAL;
2895 			goto out_unlock;
2896 		}
2897 
2898 		if (sta->tdls &&
2899 		    (vif->p2p ||
2900 		     iwl_mvm_tdls_sta_count(mvm, NULL) ==
2901 						IWL_MVM_TDLS_STA_COUNT ||
2902 		     iwl_mvm_phy_ctx_count(mvm) > 1)) {
2903 			IWL_DEBUG_MAC80211(mvm, "refusing TDLS sta\n");
2904 			ret = -EBUSY;
2905 			goto out_unlock;
2906 		}
2907 
2908 		ret = iwl_mvm_add_sta(mvm, vif, sta);
2909 		if (sta->tdls && ret == 0) {
2910 			iwl_mvm_recalc_tdls_state(mvm, vif, true);
2911 			iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
2912 						   NL80211_TDLS_SETUP);
2913 		}
2914 	} else if (old_state == IEEE80211_STA_NONE &&
2915 		   new_state == IEEE80211_STA_AUTH) {
2916 		/*
2917 		 * EBS may be disabled due to previous failures reported by FW.
2918 		 * Reset EBS status here assuming environment has been changed.
2919 		 */
2920 		mvm->last_ebs_successful = true;
2921 		iwl_mvm_check_uapsd(mvm, vif, sta->addr);
2922 		ret = 0;
2923 	} else if (old_state == IEEE80211_STA_AUTH &&
2924 		   new_state == IEEE80211_STA_ASSOC) {
2925 		if (vif->type == NL80211_IFTYPE_AP) {
2926 			mvmvif->ap_assoc_sta_count++;
2927 			iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
2928 		}
2929 
2930 		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band);
2931 		ret = iwl_mvm_update_sta(mvm, vif, sta);
2932 	} else if (old_state == IEEE80211_STA_ASSOC &&
2933 		   new_state == IEEE80211_STA_AUTHORIZED) {
2934 
2935 		/* we don't support TDLS during DCM */
2936 		if (iwl_mvm_phy_ctx_count(mvm) > 1)
2937 			iwl_mvm_teardown_tdls_peers(mvm);
2938 
2939 		if (sta->tdls)
2940 			iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
2941 						   NL80211_TDLS_ENABLE_LINK);
2942 
2943 		/* enable beacon filtering */
2944 		WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
2945 
2946 		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band);
2947 
2948 		ret = 0;
2949 	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
2950 		   new_state == IEEE80211_STA_ASSOC) {
2951 		/* disable beacon filtering */
2952 		WARN_ON(iwl_mvm_disable_beacon_filter(mvm, vif, 0));
2953 		ret = 0;
2954 	} else if (old_state == IEEE80211_STA_ASSOC &&
2955 		   new_state == IEEE80211_STA_AUTH) {
2956 		if (vif->type == NL80211_IFTYPE_AP) {
2957 			mvmvif->ap_assoc_sta_count--;
2958 			iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
2959 		}
2960 		ret = 0;
2961 	} else if (old_state == IEEE80211_STA_AUTH &&
2962 		   new_state == IEEE80211_STA_NONE) {
2963 		ret = 0;
2964 	} else if (old_state == IEEE80211_STA_NONE &&
2965 		   new_state == IEEE80211_STA_NOTEXIST) {
2966 		ret = iwl_mvm_rm_sta(mvm, vif, sta);
2967 		if (sta->tdls) {
2968 			iwl_mvm_recalc_tdls_state(mvm, vif, false);
2969 			iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
2970 						   NL80211_TDLS_DISABLE_LINK);
2971 		}
2972 	} else {
2973 		ret = -EIO;
2974 	}
2975  out_unlock:
2976 	mutex_unlock(&mvm->mutex);
2977 
2978 	if (sta->tdls && ret == 0) {
2979 		if (old_state == IEEE80211_STA_NOTEXIST &&
2980 		    new_state == IEEE80211_STA_NONE)
2981 			ieee80211_reserve_tid(sta, IWL_MVM_TDLS_FW_TID);
2982 		else if (old_state == IEEE80211_STA_NONE &&
2983 			 new_state == IEEE80211_STA_NOTEXIST)
2984 			ieee80211_unreserve_tid(sta, IWL_MVM_TDLS_FW_TID);
2985 	}
2986 
2987 	return ret;
2988 }
2989 
2990 static int iwl_mvm_mac_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
2991 {
2992 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2993 
2994 	mvm->rts_threshold = value;
2995 
2996 	return 0;
2997 }
2998 
2999 static void iwl_mvm_sta_rc_update(struct ieee80211_hw *hw,
3000 				  struct ieee80211_vif *vif,
3001 				  struct ieee80211_sta *sta, u32 changed)
3002 {
3003 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3004 
3005 	if (vif->type == NL80211_IFTYPE_STATION &&
3006 	    changed & IEEE80211_RC_NSS_CHANGED)
3007 		iwl_mvm_sf_update(mvm, vif, false);
3008 }
3009 
3010 static int iwl_mvm_mac_conf_tx(struct ieee80211_hw *hw,
3011 			       struct ieee80211_vif *vif, u16 ac,
3012 			       const struct ieee80211_tx_queue_params *params)
3013 {
3014 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3015 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3016 
3017 	mvmvif->queue_params[ac] = *params;
3018 
3019 	/*
3020 	 * No need to update right away, we'll get BSS_CHANGED_QOS
3021 	 * The exception is P2P_DEVICE interface which needs immediate update.
3022 	 */
3023 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
3024 		int ret;
3025 
3026 		mutex_lock(&mvm->mutex);
3027 		ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3028 		mutex_unlock(&mvm->mutex);
3029 		return ret;
3030 	}
3031 	return 0;
3032 }
3033 
3034 static void iwl_mvm_mac_mgd_prepare_tx(struct ieee80211_hw *hw,
3035 				       struct ieee80211_vif *vif,
3036 				       u16 req_duration)
3037 {
3038 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3039 	u32 duration = IWL_MVM_TE_SESSION_PROTECTION_MAX_TIME_MS;
3040 	u32 min_duration = IWL_MVM_TE_SESSION_PROTECTION_MIN_TIME_MS;
3041 
3042 	/*
3043 	 * iwl_mvm_protect_session() reads directly from the device
3044 	 * (the system time), so make sure it is available.
3045 	 */
3046 	if (iwl_mvm_ref_sync(mvm, IWL_MVM_REF_PREPARE_TX))
3047 		return;
3048 
3049 	if (req_duration > duration)
3050 		duration = req_duration;
3051 
3052 	mutex_lock(&mvm->mutex);
3053 	/* Try really hard to protect the session and hear a beacon */
3054 	iwl_mvm_protect_session(mvm, vif, duration, min_duration, 500, false);
3055 	mutex_unlock(&mvm->mutex);
3056 
3057 	iwl_mvm_unref(mvm, IWL_MVM_REF_PREPARE_TX);
3058 }
3059 
3060 static int iwl_mvm_mac_sched_scan_start(struct ieee80211_hw *hw,
3061 					struct ieee80211_vif *vif,
3062 					struct cfg80211_sched_scan_request *req,
3063 					struct ieee80211_scan_ies *ies)
3064 {
3065 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3066 
3067 	int ret;
3068 
3069 	mutex_lock(&mvm->mutex);
3070 
3071 	if (!vif->bss_conf.idle) {
3072 		ret = -EBUSY;
3073 		goto out;
3074 	}
3075 
3076 	ret = iwl_mvm_sched_scan_start(mvm, vif, req, ies, IWL_MVM_SCAN_SCHED);
3077 
3078 out:
3079 	mutex_unlock(&mvm->mutex);
3080 	return ret;
3081 }
3082 
3083 static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
3084 				       struct ieee80211_vif *vif)
3085 {
3086 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3087 	int ret;
3088 
3089 	mutex_lock(&mvm->mutex);
3090 
3091 	/* Due to a race condition, it's possible that mac80211 asks
3092 	 * us to stop a sched_scan when it's already stopped.  This
3093 	 * can happen, for instance, if we stopped the scan ourselves,
3094 	 * called ieee80211_sched_scan_stopped() and the userspace called
3095 	 * stop sched scan scan before ieee80211_sched_scan_stopped_work()
3096 	 * could run.  To handle this, simply return if the scan is
3097 	 * not running.
3098 	*/
3099 	if (!(mvm->scan_status & IWL_MVM_SCAN_SCHED)) {
3100 		mutex_unlock(&mvm->mutex);
3101 		return 0;
3102 	}
3103 
3104 	ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, false);
3105 	mutex_unlock(&mvm->mutex);
3106 	iwl_mvm_wait_for_async_handlers(mvm);
3107 
3108 	return ret;
3109 }
3110 
3111 static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
3112 			       enum set_key_cmd cmd,
3113 			       struct ieee80211_vif *vif,
3114 			       struct ieee80211_sta *sta,
3115 			       struct ieee80211_key_conf *key)
3116 {
3117 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3118 	struct iwl_mvm_sta *mvmsta;
3119 	struct iwl_mvm_key_pn *ptk_pn;
3120 	int keyidx = key->keyidx;
3121 	int ret;
3122 	u8 key_offset;
3123 
3124 	if (iwlwifi_mod_params.swcrypto) {
3125 		IWL_DEBUG_MAC80211(mvm, "leave - hwcrypto disabled\n");
3126 		return -EOPNOTSUPP;
3127 	}
3128 
3129 	switch (key->cipher) {
3130 	case WLAN_CIPHER_SUITE_TKIP:
3131 		key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3132 		key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3133 		break;
3134 	case WLAN_CIPHER_SUITE_CCMP:
3135 	case WLAN_CIPHER_SUITE_GCMP:
3136 	case WLAN_CIPHER_SUITE_GCMP_256:
3137 		if (!iwl_mvm_has_new_tx_api(mvm))
3138 			key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3139 		break;
3140 	case WLAN_CIPHER_SUITE_AES_CMAC:
3141 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
3142 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
3143 		WARN_ON_ONCE(!ieee80211_hw_check(hw, MFP_CAPABLE));
3144 		break;
3145 	case WLAN_CIPHER_SUITE_WEP40:
3146 	case WLAN_CIPHER_SUITE_WEP104:
3147 		/* For non-client mode, only use WEP keys for TX as we probably
3148 		 * don't have a station yet anyway and would then have to keep
3149 		 * track of the keys, linking them to each of the clients/peers
3150 		 * as they appear. For now, don't do that, for performance WEP
3151 		 * offload doesn't really matter much, but we need it for some
3152 		 * other offload features in client mode.
3153 		 */
3154 		if (vif->type != NL80211_IFTYPE_STATION)
3155 			return 0;
3156 		break;
3157 	default:
3158 		/* currently FW supports only one optional cipher scheme */
3159 		if (hw->n_cipher_schemes &&
3160 		    hw->cipher_schemes->cipher == key->cipher)
3161 			key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3162 		else
3163 			return -EOPNOTSUPP;
3164 	}
3165 
3166 	mutex_lock(&mvm->mutex);
3167 
3168 	switch (cmd) {
3169 	case SET_KEY:
3170 		if ((vif->type == NL80211_IFTYPE_ADHOC ||
3171 		     vif->type == NL80211_IFTYPE_AP) && !sta) {
3172 			/*
3173 			 * GTK on AP interface is a TX-only key, return 0;
3174 			 * on IBSS they're per-station and because we're lazy
3175 			 * we don't support them for RX, so do the same.
3176 			 * CMAC/GMAC in AP/IBSS modes must be done in software.
3177 			 */
3178 			if (key->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
3179 			    key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
3180 			    key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256)
3181 				ret = -EOPNOTSUPP;
3182 			else
3183 				ret = 0;
3184 
3185 			if (key->cipher != WLAN_CIPHER_SUITE_GCMP &&
3186 			    key->cipher != WLAN_CIPHER_SUITE_GCMP_256 &&
3187 			    !iwl_mvm_has_new_tx_api(mvm)) {
3188 				key->hw_key_idx = STA_KEY_IDX_INVALID;
3189 				break;
3190 			}
3191 		}
3192 
3193 		/* During FW restart, in order to restore the state as it was,
3194 		 * don't try to reprogram keys we previously failed for.
3195 		 */
3196 		if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
3197 		    key->hw_key_idx == STA_KEY_IDX_INVALID) {
3198 			IWL_DEBUG_MAC80211(mvm,
3199 					   "skip invalid idx key programming during restart\n");
3200 			ret = 0;
3201 			break;
3202 		}
3203 
3204 		if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
3205 		    sta && iwl_mvm_has_new_rx_api(mvm) &&
3206 		    key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
3207 		    (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
3208 		     key->cipher == WLAN_CIPHER_SUITE_GCMP ||
3209 		     key->cipher == WLAN_CIPHER_SUITE_GCMP_256)) {
3210 			struct ieee80211_key_seq seq;
3211 			int tid, q;
3212 
3213 			mvmsta = iwl_mvm_sta_from_mac80211(sta);
3214 			WARN_ON(rcu_access_pointer(mvmsta->ptk_pn[keyidx]));
3215 			ptk_pn = kzalloc(struct_size(ptk_pn, q,
3216 						     mvm->trans->num_rx_queues),
3217 					 GFP_KERNEL);
3218 			if (!ptk_pn) {
3219 				ret = -ENOMEM;
3220 				break;
3221 			}
3222 
3223 			for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++) {
3224 				ieee80211_get_key_rx_seq(key, tid, &seq);
3225 				for (q = 0; q < mvm->trans->num_rx_queues; q++)
3226 					memcpy(ptk_pn->q[q].pn[tid],
3227 					       seq.ccmp.pn,
3228 					       IEEE80211_CCMP_PN_LEN);
3229 			}
3230 
3231 			rcu_assign_pointer(mvmsta->ptk_pn[keyidx], ptk_pn);
3232 		}
3233 
3234 		/* in HW restart reuse the index, otherwise request a new one */
3235 		if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
3236 			key_offset = key->hw_key_idx;
3237 		else
3238 			key_offset = STA_KEY_IDX_INVALID;
3239 
3240 		IWL_DEBUG_MAC80211(mvm, "set hwcrypto key\n");
3241 		ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, key_offset);
3242 		if (ret) {
3243 			IWL_WARN(mvm, "set key failed\n");
3244 			/*
3245 			 * can't add key for RX, but we don't need it
3246 			 * in the device for TX so still return 0
3247 			 */
3248 			key->hw_key_idx = STA_KEY_IDX_INVALID;
3249 			ret = 0;
3250 		}
3251 
3252 		break;
3253 	case DISABLE_KEY:
3254 		if (key->hw_key_idx == STA_KEY_IDX_INVALID) {
3255 			ret = 0;
3256 			break;
3257 		}
3258 
3259 		if (sta && iwl_mvm_has_new_rx_api(mvm) &&
3260 		    key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
3261 		    (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
3262 		     key->cipher == WLAN_CIPHER_SUITE_GCMP ||
3263 		     key->cipher == WLAN_CIPHER_SUITE_GCMP_256)) {
3264 			mvmsta = iwl_mvm_sta_from_mac80211(sta);
3265 			ptk_pn = rcu_dereference_protected(
3266 						mvmsta->ptk_pn[keyidx],
3267 						lockdep_is_held(&mvm->mutex));
3268 			RCU_INIT_POINTER(mvmsta->ptk_pn[keyidx], NULL);
3269 			if (ptk_pn)
3270 				kfree_rcu(ptk_pn, rcu_head);
3271 		}
3272 
3273 		IWL_DEBUG_MAC80211(mvm, "disable hwcrypto key\n");
3274 		ret = iwl_mvm_remove_sta_key(mvm, vif, sta, key);
3275 		break;
3276 	default:
3277 		ret = -EINVAL;
3278 	}
3279 
3280 	mutex_unlock(&mvm->mutex);
3281 	return ret;
3282 }
3283 
3284 static void iwl_mvm_mac_update_tkip_key(struct ieee80211_hw *hw,
3285 					struct ieee80211_vif *vif,
3286 					struct ieee80211_key_conf *keyconf,
3287 					struct ieee80211_sta *sta,
3288 					u32 iv32, u16 *phase1key)
3289 {
3290 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3291 
3292 	if (keyconf->hw_key_idx == STA_KEY_IDX_INVALID)
3293 		return;
3294 
3295 	iwl_mvm_update_tkip_key(mvm, vif, keyconf, sta, iv32, phase1key);
3296 }
3297 
3298 
3299 static bool iwl_mvm_rx_aux_roc(struct iwl_notif_wait_data *notif_wait,
3300 			       struct iwl_rx_packet *pkt, void *data)
3301 {
3302 	struct iwl_mvm *mvm =
3303 		container_of(notif_wait, struct iwl_mvm, notif_wait);
3304 	struct iwl_hs20_roc_res *resp;
3305 	int resp_len = iwl_rx_packet_payload_len(pkt);
3306 	struct iwl_mvm_time_event_data *te_data = data;
3307 
3308 	if (WARN_ON(pkt->hdr.cmd != HOT_SPOT_CMD))
3309 		return true;
3310 
3311 	if (WARN_ON_ONCE(resp_len != sizeof(*resp))) {
3312 		IWL_ERR(mvm, "Invalid HOT_SPOT_CMD response\n");
3313 		return true;
3314 	}
3315 
3316 	resp = (void *)pkt->data;
3317 
3318 	IWL_DEBUG_TE(mvm,
3319 		     "Aux ROC: Recieved response from ucode: status=%d uid=%d\n",
3320 		     resp->status, resp->event_unique_id);
3321 
3322 	te_data->uid = le32_to_cpu(resp->event_unique_id);
3323 	IWL_DEBUG_TE(mvm, "TIME_EVENT_CMD response - UID = 0x%x\n",
3324 		     te_data->uid);
3325 
3326 	spin_lock_bh(&mvm->time_event_lock);
3327 	list_add_tail(&te_data->list, &mvm->aux_roc_te_list);
3328 	spin_unlock_bh(&mvm->time_event_lock);
3329 
3330 	return true;
3331 }
3332 
3333 #define AUX_ROC_MIN_DURATION MSEC_TO_TU(100)
3334 #define AUX_ROC_MIN_DELAY MSEC_TO_TU(200)
3335 #define AUX_ROC_MAX_DELAY MSEC_TO_TU(600)
3336 #define AUX_ROC_SAFETY_BUFFER MSEC_TO_TU(20)
3337 #define AUX_ROC_MIN_SAFETY_BUFFER MSEC_TO_TU(10)
3338 static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm,
3339 				    struct ieee80211_channel *channel,
3340 				    struct ieee80211_vif *vif,
3341 				    int duration)
3342 {
3343 	int res, time_reg = DEVICE_SYSTEM_TIME_REG;
3344 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3345 	struct iwl_mvm_time_event_data *te_data = &mvmvif->hs_time_event_data;
3346 	static const u16 time_event_response[] = { HOT_SPOT_CMD };
3347 	struct iwl_notification_wait wait_time_event;
3348 	u32 dtim_interval = vif->bss_conf.dtim_period *
3349 		vif->bss_conf.beacon_int;
3350 	u32 req_dur, delay;
3351 	struct iwl_hs20_roc_req aux_roc_req = {
3352 		.action = cpu_to_le32(FW_CTXT_ACTION_ADD),
3353 		.id_and_color =
3354 			cpu_to_le32(FW_CMD_ID_AND_COLOR(MAC_INDEX_AUX, 0)),
3355 		.sta_id_and_color = cpu_to_le32(mvm->aux_sta.sta_id),
3356 		/* Set the channel info data */
3357 		.channel_info.band = (channel->band == NL80211_BAND_2GHZ) ?
3358 			PHY_BAND_24 : PHY_BAND_5,
3359 		.channel_info.channel = channel->hw_value,
3360 		.channel_info.width = PHY_VHT_CHANNEL_MODE20,
3361 		/* Set the time and duration */
3362 		.apply_time = cpu_to_le32(iwl_read_prph(mvm->trans, time_reg)),
3363 	 };
3364 
3365 	delay = AUX_ROC_MIN_DELAY;
3366 	req_dur = MSEC_TO_TU(duration);
3367 
3368 	/*
3369 	 * If we are associated we want the delay time to be at least one
3370 	 * dtim interval so that the FW can wait until after the DTIM and
3371 	 * then start the time event, this will potentially allow us to
3372 	 * remain off-channel for the max duration.
3373 	 * Since we want to use almost a whole dtim interval we would also
3374 	 * like the delay to be for 2-3 dtim intervals, in case there are
3375 	 * other time events with higher priority.
3376 	 */
3377 	if (vif->bss_conf.assoc) {
3378 		delay = min_t(u32, dtim_interval * 3, AUX_ROC_MAX_DELAY);
3379 		/* We cannot remain off-channel longer than the DTIM interval */
3380 		if (dtim_interval <= req_dur) {
3381 			req_dur = dtim_interval - AUX_ROC_SAFETY_BUFFER;
3382 			if (req_dur <= AUX_ROC_MIN_DURATION)
3383 				req_dur = dtim_interval -
3384 					AUX_ROC_MIN_SAFETY_BUFFER;
3385 		}
3386 	}
3387 
3388 	aux_roc_req.duration = cpu_to_le32(req_dur);
3389 	aux_roc_req.apply_time_max_delay = cpu_to_le32(delay);
3390 
3391 	IWL_DEBUG_TE(mvm,
3392 		     "ROC: Requesting to remain on channel %u for %ums (requested = %ums, max_delay = %ums, dtim_interval = %ums)\n",
3393 		     channel->hw_value, req_dur, duration, delay,
3394 		     dtim_interval);
3395 	/* Set the node address */
3396 	memcpy(aux_roc_req.node_addr, vif->addr, ETH_ALEN);
3397 
3398 	lockdep_assert_held(&mvm->mutex);
3399 
3400 	spin_lock_bh(&mvm->time_event_lock);
3401 
3402 	if (WARN_ON(te_data->id == HOT_SPOT_CMD)) {
3403 		spin_unlock_bh(&mvm->time_event_lock);
3404 		return -EIO;
3405 	}
3406 
3407 	te_data->vif = vif;
3408 	te_data->duration = duration;
3409 	te_data->id = HOT_SPOT_CMD;
3410 
3411 	spin_unlock_bh(&mvm->time_event_lock);
3412 
3413 	/*
3414 	 * Use a notification wait, which really just processes the
3415 	 * command response and doesn't wait for anything, in order
3416 	 * to be able to process the response and get the UID inside
3417 	 * the RX path. Using CMD_WANT_SKB doesn't work because it
3418 	 * stores the buffer and then wakes up this thread, by which
3419 	 * time another notification (that the time event started)
3420 	 * might already be processed unsuccessfully.
3421 	 */
3422 	iwl_init_notification_wait(&mvm->notif_wait, &wait_time_event,
3423 				   time_event_response,
3424 				   ARRAY_SIZE(time_event_response),
3425 				   iwl_mvm_rx_aux_roc, te_data);
3426 
3427 	res = iwl_mvm_send_cmd_pdu(mvm, HOT_SPOT_CMD, 0, sizeof(aux_roc_req),
3428 				   &aux_roc_req);
3429 
3430 	if (res) {
3431 		IWL_ERR(mvm, "Couldn't send HOT_SPOT_CMD: %d\n", res);
3432 		iwl_remove_notification(&mvm->notif_wait, &wait_time_event);
3433 		goto out_clear_te;
3434 	}
3435 
3436 	/* No need to wait for anything, so just pass 1 (0 isn't valid) */
3437 	res = iwl_wait_notification(&mvm->notif_wait, &wait_time_event, 1);
3438 	/* should never fail */
3439 	WARN_ON_ONCE(res);
3440 
3441 	if (res) {
3442  out_clear_te:
3443 		spin_lock_bh(&mvm->time_event_lock);
3444 		iwl_mvm_te_clear_data(mvm, te_data);
3445 		spin_unlock_bh(&mvm->time_event_lock);
3446 	}
3447 
3448 	return res;
3449 }
3450 
3451 static int iwl_mvm_roc(struct ieee80211_hw *hw,
3452 		       struct ieee80211_vif *vif,
3453 		       struct ieee80211_channel *channel,
3454 		       int duration,
3455 		       enum ieee80211_roc_type type)
3456 {
3457 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3458 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3459 	struct cfg80211_chan_def chandef;
3460 	struct iwl_mvm_phy_ctxt *phy_ctxt;
3461 	int ret, i;
3462 
3463 	IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value,
3464 			   duration, type);
3465 
3466 	/*
3467 	 * Flush the done work, just in case it's still pending, so that
3468 	 * the work it does can complete and we can accept new frames.
3469 	 */
3470 	flush_work(&mvm->roc_done_wk);
3471 
3472 	mutex_lock(&mvm->mutex);
3473 
3474 	switch (vif->type) {
3475 	case NL80211_IFTYPE_STATION:
3476 		if (fw_has_capa(&mvm->fw->ucode_capa,
3477 				IWL_UCODE_TLV_CAPA_HOTSPOT_SUPPORT)) {
3478 			/* Use aux roc framework (HS20) */
3479 			ret = iwl_mvm_send_aux_roc_cmd(mvm, channel,
3480 						       vif, duration);
3481 			goto out_unlock;
3482 		}
3483 		IWL_ERR(mvm, "hotspot not supported\n");
3484 		ret = -EINVAL;
3485 		goto out_unlock;
3486 	case NL80211_IFTYPE_P2P_DEVICE:
3487 		/* handle below */
3488 		break;
3489 	default:
3490 		IWL_ERR(mvm, "vif isn't P2P_DEVICE: %d\n", vif->type);
3491 		ret = -EINVAL;
3492 		goto out_unlock;
3493 	}
3494 
3495 	for (i = 0; i < NUM_PHY_CTX; i++) {
3496 		phy_ctxt = &mvm->phy_ctxts[i];
3497 		if (phy_ctxt->ref == 0 || mvmvif->phy_ctxt == phy_ctxt)
3498 			continue;
3499 
3500 		if (phy_ctxt->ref && channel == phy_ctxt->channel) {
3501 			/*
3502 			 * Unbind the P2P_DEVICE from the current PHY context,
3503 			 * and if the PHY context is not used remove it.
3504 			 */
3505 			ret = iwl_mvm_binding_remove_vif(mvm, vif);
3506 			if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3507 				goto out_unlock;
3508 
3509 			iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3510 
3511 			/* Bind the P2P_DEVICE to the current PHY Context */
3512 			mvmvif->phy_ctxt = phy_ctxt;
3513 
3514 			ret = iwl_mvm_binding_add_vif(mvm, vif);
3515 			if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3516 				goto out_unlock;
3517 
3518 			iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3519 			goto schedule_time_event;
3520 		}
3521 	}
3522 
3523 	/* Need to update the PHY context only if the ROC channel changed */
3524 	if (channel == mvmvif->phy_ctxt->channel)
3525 		goto schedule_time_event;
3526 
3527 	cfg80211_chandef_create(&chandef, channel, NL80211_CHAN_NO_HT);
3528 
3529 	/*
3530 	 * Change the PHY context configuration as it is currently referenced
3531 	 * only by the P2P Device MAC
3532 	 */
3533 	if (mvmvif->phy_ctxt->ref == 1) {
3534 		ret = iwl_mvm_phy_ctxt_changed(mvm, mvmvif->phy_ctxt,
3535 					       &chandef, 1, 1);
3536 		if (ret)
3537 			goto out_unlock;
3538 	} else {
3539 		/*
3540 		 * The PHY context is shared with other MACs. Need to remove the
3541 		 * P2P Device from the binding, allocate an new PHY context and
3542 		 * create a new binding
3543 		 */
3544 		phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3545 		if (!phy_ctxt) {
3546 			ret = -ENOSPC;
3547 			goto out_unlock;
3548 		}
3549 
3550 		ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &chandef,
3551 					       1, 1);
3552 		if (ret) {
3553 			IWL_ERR(mvm, "Failed to change PHY context\n");
3554 			goto out_unlock;
3555 		}
3556 
3557 		/* Unbind the P2P_DEVICE from the current PHY context */
3558 		ret = iwl_mvm_binding_remove_vif(mvm, vif);
3559 		if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3560 			goto out_unlock;
3561 
3562 		iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3563 
3564 		/* Bind the P2P_DEVICE to the new allocated PHY context */
3565 		mvmvif->phy_ctxt = phy_ctxt;
3566 
3567 		ret = iwl_mvm_binding_add_vif(mvm, vif);
3568 		if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3569 			goto out_unlock;
3570 
3571 		iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3572 	}
3573 
3574 schedule_time_event:
3575 	/* Schedule the time events */
3576 	ret = iwl_mvm_start_p2p_roc(mvm, vif, duration, type);
3577 
3578 out_unlock:
3579 	mutex_unlock(&mvm->mutex);
3580 	IWL_DEBUG_MAC80211(mvm, "leave\n");
3581 	return ret;
3582 }
3583 
3584 static int iwl_mvm_cancel_roc(struct ieee80211_hw *hw)
3585 {
3586 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3587 
3588 	IWL_DEBUG_MAC80211(mvm, "enter\n");
3589 
3590 	mutex_lock(&mvm->mutex);
3591 	iwl_mvm_stop_roc(mvm);
3592 	mutex_unlock(&mvm->mutex);
3593 
3594 	IWL_DEBUG_MAC80211(mvm, "leave\n");
3595 	return 0;
3596 }
3597 
3598 static int __iwl_mvm_add_chanctx(struct iwl_mvm *mvm,
3599 				 struct ieee80211_chanctx_conf *ctx)
3600 {
3601 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3602 	struct iwl_mvm_phy_ctxt *phy_ctxt;
3603 	int ret;
3604 
3605 	lockdep_assert_held(&mvm->mutex);
3606 
3607 	IWL_DEBUG_MAC80211(mvm, "Add channel context\n");
3608 
3609 	phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3610 	if (!phy_ctxt) {
3611 		ret = -ENOSPC;
3612 		goto out;
3613 	}
3614 
3615 	ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx->min_def,
3616 				       ctx->rx_chains_static,
3617 				       ctx->rx_chains_dynamic);
3618 	if (ret) {
3619 		IWL_ERR(mvm, "Failed to add PHY context\n");
3620 		goto out;
3621 	}
3622 
3623 	iwl_mvm_phy_ctxt_ref(mvm, phy_ctxt);
3624 	*phy_ctxt_id = phy_ctxt->id;
3625 out:
3626 	return ret;
3627 }
3628 
3629 static int iwl_mvm_add_chanctx(struct ieee80211_hw *hw,
3630 			       struct ieee80211_chanctx_conf *ctx)
3631 {
3632 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3633 	int ret;
3634 
3635 	mutex_lock(&mvm->mutex);
3636 	ret = __iwl_mvm_add_chanctx(mvm, ctx);
3637 	mutex_unlock(&mvm->mutex);
3638 
3639 	return ret;
3640 }
3641 
3642 static void __iwl_mvm_remove_chanctx(struct iwl_mvm *mvm,
3643 				     struct ieee80211_chanctx_conf *ctx)
3644 {
3645 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3646 	struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3647 
3648 	lockdep_assert_held(&mvm->mutex);
3649 
3650 	iwl_mvm_phy_ctxt_unref(mvm, phy_ctxt);
3651 }
3652 
3653 static void iwl_mvm_remove_chanctx(struct ieee80211_hw *hw,
3654 				   struct ieee80211_chanctx_conf *ctx)
3655 {
3656 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3657 
3658 	mutex_lock(&mvm->mutex);
3659 	__iwl_mvm_remove_chanctx(mvm, ctx);
3660 	mutex_unlock(&mvm->mutex);
3661 }
3662 
3663 static void iwl_mvm_change_chanctx(struct ieee80211_hw *hw,
3664 				   struct ieee80211_chanctx_conf *ctx,
3665 				   u32 changed)
3666 {
3667 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3668 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3669 	struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3670 
3671 	if (WARN_ONCE((phy_ctxt->ref > 1) &&
3672 		      (changed & ~(IEEE80211_CHANCTX_CHANGE_WIDTH |
3673 				   IEEE80211_CHANCTX_CHANGE_RX_CHAINS |
3674 				   IEEE80211_CHANCTX_CHANGE_RADAR |
3675 				   IEEE80211_CHANCTX_CHANGE_MIN_WIDTH)),
3676 		      "Cannot change PHY. Ref=%d, changed=0x%X\n",
3677 		      phy_ctxt->ref, changed))
3678 		return;
3679 
3680 	mutex_lock(&mvm->mutex);
3681 
3682 	/* we are only changing the min_width, may be a noop */
3683 	if (changed == IEEE80211_CHANCTX_CHANGE_MIN_WIDTH) {
3684 		if (phy_ctxt->width == ctx->min_def.width)
3685 			goto out_unlock;
3686 
3687 		/* we are just toggling between 20_NOHT and 20 */
3688 		if (phy_ctxt->width <= NL80211_CHAN_WIDTH_20 &&
3689 		    ctx->min_def.width <= NL80211_CHAN_WIDTH_20)
3690 			goto out_unlock;
3691 	}
3692 
3693 	iwl_mvm_bt_coex_vif_change(mvm);
3694 	iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx->min_def,
3695 				 ctx->rx_chains_static,
3696 				 ctx->rx_chains_dynamic);
3697 
3698 out_unlock:
3699 	mutex_unlock(&mvm->mutex);
3700 }
3701 
3702 static int __iwl_mvm_assign_vif_chanctx(struct iwl_mvm *mvm,
3703 					struct ieee80211_vif *vif,
3704 					struct ieee80211_chanctx_conf *ctx,
3705 					bool switching_chanctx)
3706 {
3707 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3708 	struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3709 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3710 	int ret;
3711 
3712 	lockdep_assert_held(&mvm->mutex);
3713 
3714 	mvmvif->phy_ctxt = phy_ctxt;
3715 
3716 	switch (vif->type) {
3717 	case NL80211_IFTYPE_AP:
3718 		/* only needed if we're switching chanctx (i.e. during CSA) */
3719 		if (switching_chanctx) {
3720 			mvmvif->ap_ibss_active = true;
3721 			break;
3722 		}
3723 	case NL80211_IFTYPE_ADHOC:
3724 		/*
3725 		 * The AP binding flow is handled as part of the start_ap flow
3726 		 * (in bss_info_changed), similarly for IBSS.
3727 		 */
3728 		ret = 0;
3729 		goto out;
3730 	case NL80211_IFTYPE_STATION:
3731 		mvmvif->csa_bcn_pending = false;
3732 		break;
3733 	case NL80211_IFTYPE_MONITOR:
3734 		/* always disable PS when a monitor interface is active */
3735 		mvmvif->ps_disabled = true;
3736 		break;
3737 	default:
3738 		ret = -EINVAL;
3739 		goto out;
3740 	}
3741 
3742 	ret = iwl_mvm_binding_add_vif(mvm, vif);
3743 	if (ret)
3744 		goto out;
3745 
3746 	/*
3747 	 * Power state must be updated before quotas,
3748 	 * otherwise fw will complain.
3749 	 */
3750 	iwl_mvm_power_update_mac(mvm);
3751 
3752 	/* Setting the quota at this stage is only required for monitor
3753 	 * interfaces. For the other types, the bss_info changed flow
3754 	 * will handle quota settings.
3755 	 */
3756 	if (vif->type == NL80211_IFTYPE_MONITOR) {
3757 		mvmvif->monitor_active = true;
3758 		ret = iwl_mvm_update_quotas(mvm, false, NULL);
3759 		if (ret)
3760 			goto out_remove_binding;
3761 
3762 		ret = iwl_mvm_add_snif_sta(mvm, vif);
3763 		if (ret)
3764 			goto out_remove_binding;
3765 
3766 	}
3767 
3768 	/* Handle binding during CSA */
3769 	if (vif->type == NL80211_IFTYPE_AP) {
3770 		iwl_mvm_update_quotas(mvm, false, NULL);
3771 		iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3772 	}
3773 
3774 	if (switching_chanctx && vif->type == NL80211_IFTYPE_STATION) {
3775 		u32 duration = 3 * vif->bss_conf.beacon_int;
3776 
3777 		/* iwl_mvm_protect_session() reads directly from the
3778 		 * device (the system time), so make sure it is
3779 		 * available.
3780 		 */
3781 		ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_PROTECT_CSA);
3782 		if (ret)
3783 			goto out_remove_binding;
3784 
3785 		/* Protect the session to make sure we hear the first
3786 		 * beacon on the new channel.
3787 		 */
3788 		mvmvif->csa_bcn_pending = true;
3789 		iwl_mvm_protect_session(mvm, vif, duration, duration,
3790 					vif->bss_conf.beacon_int / 2,
3791 					true);
3792 
3793 		iwl_mvm_unref(mvm, IWL_MVM_REF_PROTECT_CSA);
3794 
3795 		iwl_mvm_update_quotas(mvm, false, NULL);
3796 	}
3797 
3798 	goto out;
3799 
3800 out_remove_binding:
3801 	iwl_mvm_binding_remove_vif(mvm, vif);
3802 	iwl_mvm_power_update_mac(mvm);
3803 out:
3804 	if (ret)
3805 		mvmvif->phy_ctxt = NULL;
3806 	return ret;
3807 }
3808 static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
3809 				      struct ieee80211_vif *vif,
3810 				      struct ieee80211_chanctx_conf *ctx)
3811 {
3812 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3813 	int ret;
3814 
3815 	mutex_lock(&mvm->mutex);
3816 	ret = __iwl_mvm_assign_vif_chanctx(mvm, vif, ctx, false);
3817 	mutex_unlock(&mvm->mutex);
3818 
3819 	return ret;
3820 }
3821 
3822 static void __iwl_mvm_unassign_vif_chanctx(struct iwl_mvm *mvm,
3823 					   struct ieee80211_vif *vif,
3824 					   struct ieee80211_chanctx_conf *ctx,
3825 					   bool switching_chanctx)
3826 {
3827 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3828 	struct ieee80211_vif *disabled_vif = NULL;
3829 
3830 	lockdep_assert_held(&mvm->mutex);
3831 
3832 	iwl_mvm_remove_time_event(mvm, mvmvif, &mvmvif->time_event_data);
3833 
3834 	switch (vif->type) {
3835 	case NL80211_IFTYPE_ADHOC:
3836 		goto out;
3837 	case NL80211_IFTYPE_MONITOR:
3838 		mvmvif->monitor_active = false;
3839 		mvmvif->ps_disabled = false;
3840 		iwl_mvm_rm_snif_sta(mvm, vif);
3841 		break;
3842 	case NL80211_IFTYPE_AP:
3843 		/* This part is triggered only during CSA */
3844 		if (!switching_chanctx || !mvmvif->ap_ibss_active)
3845 			goto out;
3846 
3847 		mvmvif->csa_countdown = false;
3848 
3849 		/* Set CS bit on all the stations */
3850 		iwl_mvm_modify_all_sta_disable_tx(mvm, mvmvif, true);
3851 
3852 		/* Save blocked iface, the timeout is set on the next beacon */
3853 		rcu_assign_pointer(mvm->csa_tx_blocked_vif, vif);
3854 
3855 		mvmvif->ap_ibss_active = false;
3856 		break;
3857 	case NL80211_IFTYPE_STATION:
3858 		if (!switching_chanctx)
3859 			break;
3860 
3861 		disabled_vif = vif;
3862 
3863 		iwl_mvm_mac_ctxt_changed(mvm, vif, true, NULL);
3864 		break;
3865 	default:
3866 		break;
3867 	}
3868 
3869 	iwl_mvm_update_quotas(mvm, false, disabled_vif);
3870 	iwl_mvm_binding_remove_vif(mvm, vif);
3871 
3872 out:
3873 	mvmvif->phy_ctxt = NULL;
3874 	iwl_mvm_power_update_mac(mvm);
3875 }
3876 
3877 static void iwl_mvm_unassign_vif_chanctx(struct ieee80211_hw *hw,
3878 					 struct ieee80211_vif *vif,
3879 					 struct ieee80211_chanctx_conf *ctx)
3880 {
3881 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3882 
3883 	mutex_lock(&mvm->mutex);
3884 	__iwl_mvm_unassign_vif_chanctx(mvm, vif, ctx, false);
3885 	mutex_unlock(&mvm->mutex);
3886 }
3887 
3888 static int
3889 iwl_mvm_switch_vif_chanctx_swap(struct iwl_mvm *mvm,
3890 				struct ieee80211_vif_chanctx_switch *vifs)
3891 {
3892 	int ret;
3893 
3894 	mutex_lock(&mvm->mutex);
3895 	__iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
3896 	__iwl_mvm_remove_chanctx(mvm, vifs[0].old_ctx);
3897 
3898 	ret = __iwl_mvm_add_chanctx(mvm, vifs[0].new_ctx);
3899 	if (ret) {
3900 		IWL_ERR(mvm, "failed to add new_ctx during channel switch\n");
3901 		goto out_reassign;
3902 	}
3903 
3904 	ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
3905 					   true);
3906 	if (ret) {
3907 		IWL_ERR(mvm,
3908 			"failed to assign new_ctx during channel switch\n");
3909 		goto out_remove;
3910 	}
3911 
3912 	/* we don't support TDLS during DCM - can be caused by channel switch */
3913 	if (iwl_mvm_phy_ctx_count(mvm) > 1)
3914 		iwl_mvm_teardown_tdls_peers(mvm);
3915 
3916 	goto out;
3917 
3918 out_remove:
3919 	__iwl_mvm_remove_chanctx(mvm, vifs[0].new_ctx);
3920 
3921 out_reassign:
3922 	if (__iwl_mvm_add_chanctx(mvm, vifs[0].old_ctx)) {
3923 		IWL_ERR(mvm, "failed to add old_ctx back after failure.\n");
3924 		goto out_restart;
3925 	}
3926 
3927 	if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
3928 					 true)) {
3929 		IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
3930 		goto out_restart;
3931 	}
3932 
3933 	goto out;
3934 
3935 out_restart:
3936 	/* things keep failing, better restart the hw */
3937 	iwl_mvm_nic_restart(mvm, false);
3938 
3939 out:
3940 	mutex_unlock(&mvm->mutex);
3941 
3942 	return ret;
3943 }
3944 
3945 static int
3946 iwl_mvm_switch_vif_chanctx_reassign(struct iwl_mvm *mvm,
3947 				    struct ieee80211_vif_chanctx_switch *vifs)
3948 {
3949 	int ret;
3950 
3951 	mutex_lock(&mvm->mutex);
3952 	__iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
3953 
3954 	ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
3955 					   true);
3956 	if (ret) {
3957 		IWL_ERR(mvm,
3958 			"failed to assign new_ctx during channel switch\n");
3959 		goto out_reassign;
3960 	}
3961 
3962 	goto out;
3963 
3964 out_reassign:
3965 	if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
3966 					 true)) {
3967 		IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
3968 		goto out_restart;
3969 	}
3970 
3971 	goto out;
3972 
3973 out_restart:
3974 	/* things keep failing, better restart the hw */
3975 	iwl_mvm_nic_restart(mvm, false);
3976 
3977 out:
3978 	mutex_unlock(&mvm->mutex);
3979 
3980 	return ret;
3981 }
3982 
3983 static int iwl_mvm_switch_vif_chanctx(struct ieee80211_hw *hw,
3984 				      struct ieee80211_vif_chanctx_switch *vifs,
3985 				      int n_vifs,
3986 				      enum ieee80211_chanctx_switch_mode mode)
3987 {
3988 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3989 	int ret;
3990 
3991 	/* we only support a single-vif right now */
3992 	if (n_vifs > 1)
3993 		return -EOPNOTSUPP;
3994 
3995 	switch (mode) {
3996 	case CHANCTX_SWMODE_SWAP_CONTEXTS:
3997 		ret = iwl_mvm_switch_vif_chanctx_swap(mvm, vifs);
3998 		break;
3999 	case CHANCTX_SWMODE_REASSIGN_VIF:
4000 		ret = iwl_mvm_switch_vif_chanctx_reassign(mvm, vifs);
4001 		break;
4002 	default:
4003 		ret = -EOPNOTSUPP;
4004 		break;
4005 	}
4006 
4007 	return ret;
4008 }
4009 
4010 static int iwl_mvm_tx_last_beacon(struct ieee80211_hw *hw)
4011 {
4012 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4013 
4014 	return mvm->ibss_manager;
4015 }
4016 
4017 static int iwl_mvm_set_tim(struct ieee80211_hw *hw,
4018 			   struct ieee80211_sta *sta,
4019 			   bool set)
4020 {
4021 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4022 	struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
4023 
4024 	if (!mvm_sta || !mvm_sta->vif) {
4025 		IWL_ERR(mvm, "Station is not associated to a vif\n");
4026 		return -EINVAL;
4027 	}
4028 
4029 	return iwl_mvm_mac_ctxt_beacon_changed(mvm, mvm_sta->vif);
4030 }
4031 
4032 #ifdef CONFIG_NL80211_TESTMODE
4033 static const struct nla_policy iwl_mvm_tm_policy[IWL_MVM_TM_ATTR_MAX + 1] = {
4034 	[IWL_MVM_TM_ATTR_CMD] = { .type = NLA_U32 },
4035 	[IWL_MVM_TM_ATTR_NOA_DURATION] = { .type = NLA_U32 },
4036 	[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE] = { .type = NLA_U32 },
4037 };
4038 
4039 static int __iwl_mvm_mac_testmode_cmd(struct iwl_mvm *mvm,
4040 				      struct ieee80211_vif *vif,
4041 				      void *data, int len)
4042 {
4043 	struct nlattr *tb[IWL_MVM_TM_ATTR_MAX + 1];
4044 	int err;
4045 	u32 noa_duration;
4046 
4047 	err = nla_parse(tb, IWL_MVM_TM_ATTR_MAX, data, len, iwl_mvm_tm_policy,
4048 			NULL);
4049 	if (err)
4050 		return err;
4051 
4052 	if (!tb[IWL_MVM_TM_ATTR_CMD])
4053 		return -EINVAL;
4054 
4055 	switch (nla_get_u32(tb[IWL_MVM_TM_ATTR_CMD])) {
4056 	case IWL_MVM_TM_CMD_SET_NOA:
4057 		if (!vif || vif->type != NL80211_IFTYPE_AP || !vif->p2p ||
4058 		    !vif->bss_conf.enable_beacon ||
4059 		    !tb[IWL_MVM_TM_ATTR_NOA_DURATION])
4060 			return -EINVAL;
4061 
4062 		noa_duration = nla_get_u32(tb[IWL_MVM_TM_ATTR_NOA_DURATION]);
4063 		if (noa_duration >= vif->bss_conf.beacon_int)
4064 			return -EINVAL;
4065 
4066 		mvm->noa_duration = noa_duration;
4067 		mvm->noa_vif = vif;
4068 
4069 		return iwl_mvm_update_quotas(mvm, true, NULL);
4070 	case IWL_MVM_TM_CMD_SET_BEACON_FILTER:
4071 		/* must be associated client vif - ignore authorized */
4072 		if (!vif || vif->type != NL80211_IFTYPE_STATION ||
4073 		    !vif->bss_conf.assoc || !vif->bss_conf.dtim_period ||
4074 		    !tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE])
4075 			return -EINVAL;
4076 
4077 		if (nla_get_u32(tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE]))
4078 			return iwl_mvm_enable_beacon_filter(mvm, vif, 0);
4079 		return iwl_mvm_disable_beacon_filter(mvm, vif, 0);
4080 	}
4081 
4082 	return -EOPNOTSUPP;
4083 }
4084 
4085 static int iwl_mvm_mac_testmode_cmd(struct ieee80211_hw *hw,
4086 				    struct ieee80211_vif *vif,
4087 				    void *data, int len)
4088 {
4089 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4090 	int err;
4091 
4092 	mutex_lock(&mvm->mutex);
4093 	err = __iwl_mvm_mac_testmode_cmd(mvm, vif, data, len);
4094 	mutex_unlock(&mvm->mutex);
4095 
4096 	return err;
4097 }
4098 #endif
4099 
4100 static void iwl_mvm_channel_switch(struct ieee80211_hw *hw,
4101 				   struct ieee80211_vif *vif,
4102 				   struct ieee80211_channel_switch *chsw)
4103 {
4104 	/* By implementing this operation, we prevent mac80211 from
4105 	 * starting its own channel switch timer, so that we can call
4106 	 * ieee80211_chswitch_done() ourselves at the right time
4107 	 * (which is when the absence time event starts).
4108 	 */
4109 
4110 	IWL_DEBUG_MAC80211(IWL_MAC80211_GET_MVM(hw),
4111 			   "dummy channel switch op\n");
4112 }
4113 
4114 static int iwl_mvm_pre_channel_switch(struct ieee80211_hw *hw,
4115 				      struct ieee80211_vif *vif,
4116 				      struct ieee80211_channel_switch *chsw)
4117 {
4118 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4119 	struct ieee80211_vif *csa_vif;
4120 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4121 	u32 apply_time;
4122 	int ret;
4123 
4124 	mutex_lock(&mvm->mutex);
4125 
4126 	mvmvif->csa_failed = false;
4127 
4128 	IWL_DEBUG_MAC80211(mvm, "pre CSA to freq %d\n",
4129 			   chsw->chandef.center_freq1);
4130 
4131 	iwl_fw_dbg_trigger_simple_stop(&mvm->fwrt,
4132 				       ieee80211_vif_to_wdev(vif),
4133 				       FW_DBG_TRIGGER_CHANNEL_SWITCH);
4134 
4135 	switch (vif->type) {
4136 	case NL80211_IFTYPE_AP:
4137 		csa_vif =
4138 			rcu_dereference_protected(mvm->csa_vif,
4139 						  lockdep_is_held(&mvm->mutex));
4140 		if (WARN_ONCE(csa_vif && csa_vif->csa_active,
4141 			      "Another CSA is already in progress")) {
4142 			ret = -EBUSY;
4143 			goto out_unlock;
4144 		}
4145 
4146 		/* we still didn't unblock tx. prevent new CS meanwhile */
4147 		if (rcu_dereference_protected(mvm->csa_tx_blocked_vif,
4148 					      lockdep_is_held(&mvm->mutex))) {
4149 			ret = -EBUSY;
4150 			goto out_unlock;
4151 		}
4152 
4153 		rcu_assign_pointer(mvm->csa_vif, vif);
4154 
4155 		if (WARN_ONCE(mvmvif->csa_countdown,
4156 			      "Previous CSA countdown didn't complete")) {
4157 			ret = -EBUSY;
4158 			goto out_unlock;
4159 		}
4160 
4161 		mvmvif->csa_target_freq = chsw->chandef.chan->center_freq;
4162 
4163 		break;
4164 	case NL80211_IFTYPE_STATION:
4165 		/* Schedule the time event to a bit before beacon 1,
4166 		 * to make sure we're in the new channel when the
4167 		 * GO/AP arrives. In case count <= 1 immediately schedule the
4168 		 * TE (this might result with some packet loss or connection
4169 		 * loss).
4170 		 */
4171 		if (chsw->count <= 1)
4172 			apply_time = 0;
4173 		else
4174 			apply_time = chsw->device_timestamp +
4175 				((vif->bss_conf.beacon_int * (chsw->count - 1) -
4176 				  IWL_MVM_CHANNEL_SWITCH_TIME_CLIENT) * 1024);
4177 
4178 		if (chsw->block_tx)
4179 			iwl_mvm_csa_client_absent(mvm, vif);
4180 
4181 		iwl_mvm_schedule_csa_period(mvm, vif, vif->bss_conf.beacon_int,
4182 					    apply_time);
4183 		if (mvmvif->bf_data.bf_enabled) {
4184 			ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
4185 			if (ret)
4186 				goto out_unlock;
4187 		}
4188 
4189 		break;
4190 	default:
4191 		break;
4192 	}
4193 
4194 	mvmvif->ps_disabled = true;
4195 
4196 	ret = iwl_mvm_power_update_ps(mvm);
4197 	if (ret)
4198 		goto out_unlock;
4199 
4200 	/* we won't be on this channel any longer */
4201 	iwl_mvm_teardown_tdls_peers(mvm);
4202 
4203 out_unlock:
4204 	mutex_unlock(&mvm->mutex);
4205 
4206 	return ret;
4207 }
4208 
4209 static int iwl_mvm_post_channel_switch(struct ieee80211_hw *hw,
4210 				       struct ieee80211_vif *vif)
4211 {
4212 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4213 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4214 	int ret;
4215 
4216 	mutex_lock(&mvm->mutex);
4217 
4218 	if (mvmvif->csa_failed) {
4219 		mvmvif->csa_failed = false;
4220 		ret = -EIO;
4221 		goto out_unlock;
4222 	}
4223 
4224 	if (vif->type == NL80211_IFTYPE_STATION) {
4225 		struct iwl_mvm_sta *mvmsta;
4226 
4227 		mvmvif->csa_bcn_pending = false;
4228 		mvmsta = iwl_mvm_sta_from_staid_protected(mvm,
4229 							  mvmvif->ap_sta_id);
4230 
4231 		if (WARN_ON(!mvmsta)) {
4232 			ret = -EIO;
4233 			goto out_unlock;
4234 		}
4235 
4236 		iwl_mvm_sta_modify_disable_tx(mvm, mvmsta, false);
4237 
4238 		iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
4239 
4240 		ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
4241 		if (ret)
4242 			goto out_unlock;
4243 
4244 		iwl_mvm_stop_session_protection(mvm, vif);
4245 	}
4246 
4247 	mvmvif->ps_disabled = false;
4248 
4249 	ret = iwl_mvm_power_update_ps(mvm);
4250 
4251 out_unlock:
4252 	mutex_unlock(&mvm->mutex);
4253 
4254 	return ret;
4255 }
4256 
4257 static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop)
4258 {
4259 	int i;
4260 
4261 	if (!iwl_mvm_has_new_tx_api(mvm)) {
4262 		if (drop) {
4263 			mutex_lock(&mvm->mutex);
4264 			iwl_mvm_flush_tx_path(mvm,
4265 				iwl_mvm_flushable_queues(mvm) & queues, 0);
4266 			mutex_unlock(&mvm->mutex);
4267 		} else {
4268 			iwl_trans_wait_tx_queues_empty(mvm->trans, queues);
4269 		}
4270 		return;
4271 	}
4272 
4273 	mutex_lock(&mvm->mutex);
4274 	for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
4275 		struct ieee80211_sta *sta;
4276 
4277 		sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
4278 						lockdep_is_held(&mvm->mutex));
4279 		if (IS_ERR_OR_NULL(sta))
4280 			continue;
4281 
4282 		if (drop)
4283 			iwl_mvm_flush_sta_tids(mvm, i, 0xFF, 0);
4284 		else
4285 			iwl_mvm_wait_sta_queues_empty(mvm,
4286 					iwl_mvm_sta_from_mac80211(sta));
4287 	}
4288 	mutex_unlock(&mvm->mutex);
4289 }
4290 
4291 static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
4292 			      struct ieee80211_vif *vif, u32 queues, bool drop)
4293 {
4294 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4295 	struct iwl_mvm_vif *mvmvif;
4296 	struct iwl_mvm_sta *mvmsta;
4297 	struct ieee80211_sta *sta;
4298 	int i;
4299 	u32 msk = 0;
4300 
4301 	if (!vif) {
4302 		iwl_mvm_flush_no_vif(mvm, queues, drop);
4303 		return;
4304 	}
4305 
4306 	if (vif->type != NL80211_IFTYPE_STATION)
4307 		return;
4308 
4309 	/* Make sure we're done with the deferred traffic before flushing */
4310 	flush_work(&mvm->add_stream_wk);
4311 
4312 	mutex_lock(&mvm->mutex);
4313 	mvmvif = iwl_mvm_vif_from_mac80211(vif);
4314 
4315 	/* flush the AP-station and all TDLS peers */
4316 	for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
4317 		sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
4318 						lockdep_is_held(&mvm->mutex));
4319 		if (IS_ERR_OR_NULL(sta))
4320 			continue;
4321 
4322 		mvmsta = iwl_mvm_sta_from_mac80211(sta);
4323 		if (mvmsta->vif != vif)
4324 			continue;
4325 
4326 		/* make sure only TDLS peers or the AP are flushed */
4327 		WARN_ON(i != mvmvif->ap_sta_id && !sta->tdls);
4328 
4329 		if (drop) {
4330 			if (iwl_mvm_flush_sta(mvm, mvmsta, false, 0))
4331 				IWL_ERR(mvm, "flush request fail\n");
4332 		} else {
4333 			msk |= mvmsta->tfd_queue_msk;
4334 			if (iwl_mvm_has_new_tx_api(mvm))
4335 				iwl_mvm_wait_sta_queues_empty(mvm, mvmsta);
4336 		}
4337 	}
4338 
4339 	mutex_unlock(&mvm->mutex);
4340 
4341 	/* this can take a while, and we may need/want other operations
4342 	 * to succeed while doing this, so do it without the mutex held
4343 	 */
4344 	if (!drop && !iwl_mvm_has_new_tx_api(mvm))
4345 		iwl_trans_wait_tx_queues_empty(mvm->trans, msk);
4346 }
4347 
4348 static int iwl_mvm_mac_get_survey(struct ieee80211_hw *hw, int idx,
4349 				  struct survey_info *survey)
4350 {
4351 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4352 	int ret;
4353 
4354 	memset(survey, 0, sizeof(*survey));
4355 
4356 	/* only support global statistics right now */
4357 	if (idx != 0)
4358 		return -ENOENT;
4359 
4360 	if (!fw_has_capa(&mvm->fw->ucode_capa,
4361 			 IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
4362 		return -ENOENT;
4363 
4364 	mutex_lock(&mvm->mutex);
4365 
4366 	if (iwl_mvm_firmware_running(mvm)) {
4367 		ret = iwl_mvm_request_statistics(mvm, false);
4368 		if (ret)
4369 			goto out;
4370 	}
4371 
4372 	survey->filled = SURVEY_INFO_TIME |
4373 			 SURVEY_INFO_TIME_RX |
4374 			 SURVEY_INFO_TIME_TX |
4375 			 SURVEY_INFO_TIME_SCAN;
4376 	survey->time = mvm->accu_radio_stats.on_time_rf +
4377 		       mvm->radio_stats.on_time_rf;
4378 	do_div(survey->time, USEC_PER_MSEC);
4379 
4380 	survey->time_rx = mvm->accu_radio_stats.rx_time +
4381 			  mvm->radio_stats.rx_time;
4382 	do_div(survey->time_rx, USEC_PER_MSEC);
4383 
4384 	survey->time_tx = mvm->accu_radio_stats.tx_time +
4385 			  mvm->radio_stats.tx_time;
4386 	do_div(survey->time_tx, USEC_PER_MSEC);
4387 
4388 	survey->time_scan = mvm->accu_radio_stats.on_time_scan +
4389 			    mvm->radio_stats.on_time_scan;
4390 	do_div(survey->time_scan, USEC_PER_MSEC);
4391 
4392 	ret = 0;
4393  out:
4394 	mutex_unlock(&mvm->mutex);
4395 	return ret;
4396 }
4397 
4398 static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,
4399 				       struct ieee80211_vif *vif,
4400 				       struct ieee80211_sta *sta,
4401 				       struct station_info *sinfo)
4402 {
4403 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4404 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4405 	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
4406 
4407 	if (mvmsta->avg_energy) {
4408 		sinfo->signal_avg = mvmsta->avg_energy;
4409 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
4410 	}
4411 
4412 	if (!fw_has_capa(&mvm->fw->ucode_capa,
4413 			 IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
4414 		return;
4415 
4416 	/* if beacon filtering isn't on mac80211 does it anyway */
4417 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
4418 		return;
4419 
4420 	if (!vif->bss_conf.assoc)
4421 		return;
4422 
4423 	mutex_lock(&mvm->mutex);
4424 
4425 	if (mvmvif->ap_sta_id != mvmsta->sta_id)
4426 		goto unlock;
4427 
4428 	if (iwl_mvm_request_statistics(mvm, false))
4429 		goto unlock;
4430 
4431 	sinfo->rx_beacon = mvmvif->beacon_stats.num_beacons +
4432 			   mvmvif->beacon_stats.accu_num_beacons;
4433 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_RX);
4434 	if (mvmvif->beacon_stats.avg_signal) {
4435 		/* firmware only reports a value after RXing a few beacons */
4436 		sinfo->rx_beacon_signal_avg = mvmvif->beacon_stats.avg_signal;
4437 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG);
4438 	}
4439  unlock:
4440 	mutex_unlock(&mvm->mutex);
4441 }
4442 
4443 static void iwl_mvm_event_mlme_callback(struct iwl_mvm *mvm,
4444 					struct ieee80211_vif *vif,
4445 					const struct ieee80211_event *event)
4446 {
4447 #define CHECK_MLME_TRIGGER(_cnt, _fmt...)				\
4448 	do {								\
4449 		if ((trig_mlme->_cnt) && --(trig_mlme->_cnt))		\
4450 			break;						\
4451 		iwl_fw_dbg_collect_trig(&(mvm)->fwrt, trig, _fmt);	\
4452 	} while (0)
4453 
4454 	struct iwl_fw_dbg_trigger_tlv *trig;
4455 	struct iwl_fw_dbg_trigger_mlme *trig_mlme;
4456 
4457 	if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_MLME))
4458 		return;
4459 
4460 	trig = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_MLME);
4461 	trig_mlme = (void *)trig->data;
4462 	if (!iwl_fw_dbg_trigger_check_stop(&mvm->fwrt,
4463 					   ieee80211_vif_to_wdev(vif), trig))
4464 		return;
4465 
4466 	if (event->u.mlme.data == ASSOC_EVENT) {
4467 		if (event->u.mlme.status == MLME_DENIED)
4468 			CHECK_MLME_TRIGGER(stop_assoc_denied,
4469 					   "DENIED ASSOC: reason %d",
4470 					    event->u.mlme.reason);
4471 		else if (event->u.mlme.status == MLME_TIMEOUT)
4472 			CHECK_MLME_TRIGGER(stop_assoc_timeout,
4473 					   "ASSOC TIMEOUT");
4474 	} else if (event->u.mlme.data == AUTH_EVENT) {
4475 		if (event->u.mlme.status == MLME_DENIED)
4476 			CHECK_MLME_TRIGGER(stop_auth_denied,
4477 					   "DENIED AUTH: reason %d",
4478 					   event->u.mlme.reason);
4479 		else if (event->u.mlme.status == MLME_TIMEOUT)
4480 			CHECK_MLME_TRIGGER(stop_auth_timeout,
4481 					   "AUTH TIMEOUT");
4482 	} else if (event->u.mlme.data == DEAUTH_RX_EVENT) {
4483 		CHECK_MLME_TRIGGER(stop_rx_deauth,
4484 				   "DEAUTH RX %d", event->u.mlme.reason);
4485 	} else if (event->u.mlme.data == DEAUTH_TX_EVENT) {
4486 		CHECK_MLME_TRIGGER(stop_tx_deauth,
4487 				   "DEAUTH TX %d", event->u.mlme.reason);
4488 	}
4489 #undef CHECK_MLME_TRIGGER
4490 }
4491 
4492 static void iwl_mvm_event_bar_rx_callback(struct iwl_mvm *mvm,
4493 					  struct ieee80211_vif *vif,
4494 					  const struct ieee80211_event *event)
4495 {
4496 	struct iwl_fw_dbg_trigger_tlv *trig;
4497 	struct iwl_fw_dbg_trigger_ba *ba_trig;
4498 
4499 	if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_BA))
4500 		return;
4501 
4502 	trig = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_BA);
4503 	ba_trig = (void *)trig->data;
4504 	if (!iwl_fw_dbg_trigger_check_stop(&mvm->fwrt,
4505 					   ieee80211_vif_to_wdev(vif), trig))
4506 		return;
4507 
4508 	if (!(le16_to_cpu(ba_trig->rx_bar) & BIT(event->u.ba.tid)))
4509 		return;
4510 
4511 	iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
4512 				"BAR received from %pM, tid %d, ssn %d",
4513 				event->u.ba.sta->addr, event->u.ba.tid,
4514 				event->u.ba.ssn);
4515 }
4516 
4517 static void iwl_mvm_mac_event_callback(struct ieee80211_hw *hw,
4518 				       struct ieee80211_vif *vif,
4519 				       const struct ieee80211_event *event)
4520 {
4521 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4522 
4523 	switch (event->type) {
4524 	case MLME_EVENT:
4525 		iwl_mvm_event_mlme_callback(mvm, vif, event);
4526 		break;
4527 	case BAR_RX_EVENT:
4528 		iwl_mvm_event_bar_rx_callback(mvm, vif, event);
4529 		break;
4530 	case BA_FRAME_TIMEOUT:
4531 		iwl_mvm_event_frame_timeout_callback(mvm, vif, event->u.ba.sta,
4532 						     event->u.ba.tid);
4533 		break;
4534 	default:
4535 		break;
4536 	}
4537 }
4538 
4539 void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm,
4540 				     struct iwl_mvm_internal_rxq_notif *notif,
4541 				     u32 size)
4542 {
4543 	u32 qmask = BIT(mvm->trans->num_rx_queues) - 1;
4544 	int ret;
4545 
4546 	lockdep_assert_held(&mvm->mutex);
4547 
4548 	if (!iwl_mvm_has_new_rx_api(mvm))
4549 		return;
4550 
4551 	notif->cookie = mvm->queue_sync_cookie;
4552 
4553 	if (notif->sync)
4554 		atomic_set(&mvm->queue_sync_counter,
4555 			   mvm->trans->num_rx_queues);
4556 
4557 	ret = iwl_mvm_notify_rx_queue(mvm, qmask, (u8 *)notif, size);
4558 	if (ret) {
4559 		IWL_ERR(mvm, "Failed to trigger RX queues sync (%d)\n", ret);
4560 		goto out;
4561 	}
4562 
4563 	if (notif->sync) {
4564 		ret = wait_event_timeout(mvm->rx_sync_waitq,
4565 					 atomic_read(&mvm->queue_sync_counter) == 0 ||
4566 					 iwl_mvm_is_radio_killed(mvm),
4567 					 HZ);
4568 		WARN_ON_ONCE(!ret && !iwl_mvm_is_radio_killed(mvm));
4569 	}
4570 
4571 out:
4572 	atomic_set(&mvm->queue_sync_counter, 0);
4573 	mvm->queue_sync_cookie++;
4574 }
4575 
4576 static void iwl_mvm_sync_rx_queues(struct ieee80211_hw *hw)
4577 {
4578 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4579 	struct iwl_mvm_internal_rxq_notif data = {
4580 		.type = IWL_MVM_RXQ_EMPTY,
4581 		.sync = 1,
4582 	};
4583 
4584 	mutex_lock(&mvm->mutex);
4585 	iwl_mvm_sync_rx_queues_internal(mvm, &data, sizeof(data));
4586 	mutex_unlock(&mvm->mutex);
4587 }
4588 
4589 const struct ieee80211_ops iwl_mvm_hw_ops = {
4590 	.tx = iwl_mvm_mac_tx,
4591 	.ampdu_action = iwl_mvm_mac_ampdu_action,
4592 	.start = iwl_mvm_mac_start,
4593 	.reconfig_complete = iwl_mvm_mac_reconfig_complete,
4594 	.stop = iwl_mvm_mac_stop,
4595 	.add_interface = iwl_mvm_mac_add_interface,
4596 	.remove_interface = iwl_mvm_mac_remove_interface,
4597 	.config = iwl_mvm_mac_config,
4598 	.prepare_multicast = iwl_mvm_prepare_multicast,
4599 	.configure_filter = iwl_mvm_configure_filter,
4600 	.config_iface_filter = iwl_mvm_config_iface_filter,
4601 	.bss_info_changed = iwl_mvm_bss_info_changed,
4602 	.hw_scan = iwl_mvm_mac_hw_scan,
4603 	.cancel_hw_scan = iwl_mvm_mac_cancel_hw_scan,
4604 	.sta_pre_rcu_remove = iwl_mvm_sta_pre_rcu_remove,
4605 	.sta_state = iwl_mvm_mac_sta_state,
4606 	.sta_notify = iwl_mvm_mac_sta_notify,
4607 	.allow_buffered_frames = iwl_mvm_mac_allow_buffered_frames,
4608 	.release_buffered_frames = iwl_mvm_mac_release_buffered_frames,
4609 	.set_rts_threshold = iwl_mvm_mac_set_rts_threshold,
4610 	.sta_rc_update = iwl_mvm_sta_rc_update,
4611 	.conf_tx = iwl_mvm_mac_conf_tx,
4612 	.mgd_prepare_tx = iwl_mvm_mac_mgd_prepare_tx,
4613 	.mgd_protect_tdls_discover = iwl_mvm_mac_mgd_protect_tdls_discover,
4614 	.flush = iwl_mvm_mac_flush,
4615 	.sched_scan_start = iwl_mvm_mac_sched_scan_start,
4616 	.sched_scan_stop = iwl_mvm_mac_sched_scan_stop,
4617 	.set_key = iwl_mvm_mac_set_key,
4618 	.update_tkip_key = iwl_mvm_mac_update_tkip_key,
4619 	.remain_on_channel = iwl_mvm_roc,
4620 	.cancel_remain_on_channel = iwl_mvm_cancel_roc,
4621 	.add_chanctx = iwl_mvm_add_chanctx,
4622 	.remove_chanctx = iwl_mvm_remove_chanctx,
4623 	.change_chanctx = iwl_mvm_change_chanctx,
4624 	.assign_vif_chanctx = iwl_mvm_assign_vif_chanctx,
4625 	.unassign_vif_chanctx = iwl_mvm_unassign_vif_chanctx,
4626 	.switch_vif_chanctx = iwl_mvm_switch_vif_chanctx,
4627 
4628 	.start_ap = iwl_mvm_start_ap_ibss,
4629 	.stop_ap = iwl_mvm_stop_ap_ibss,
4630 	.join_ibss = iwl_mvm_start_ap_ibss,
4631 	.leave_ibss = iwl_mvm_stop_ap_ibss,
4632 
4633 	.tx_last_beacon = iwl_mvm_tx_last_beacon,
4634 
4635 	.set_tim = iwl_mvm_set_tim,
4636 
4637 	.channel_switch = iwl_mvm_channel_switch,
4638 	.pre_channel_switch = iwl_mvm_pre_channel_switch,
4639 	.post_channel_switch = iwl_mvm_post_channel_switch,
4640 
4641 	.tdls_channel_switch = iwl_mvm_tdls_channel_switch,
4642 	.tdls_cancel_channel_switch = iwl_mvm_tdls_cancel_channel_switch,
4643 	.tdls_recv_channel_switch = iwl_mvm_tdls_recv_channel_switch,
4644 
4645 	.event_callback = iwl_mvm_mac_event_callback,
4646 
4647 	.sync_rx_queues = iwl_mvm_sync_rx_queues,
4648 
4649 	CFG80211_TESTMODE_CMD(iwl_mvm_mac_testmode_cmd)
4650 
4651 #ifdef CONFIG_PM_SLEEP
4652 	/* look at d3.c */
4653 	.suspend = iwl_mvm_suspend,
4654 	.resume = iwl_mvm_resume,
4655 	.set_wakeup = iwl_mvm_set_wakeup,
4656 	.set_rekey_data = iwl_mvm_set_rekey_data,
4657 #if IS_ENABLED(CONFIG_IPV6)
4658 	.ipv6_addr_change = iwl_mvm_ipv6_addr_change,
4659 #endif
4660 	.set_default_unicast_key = iwl_mvm_set_default_unicast_key,
4661 #endif
4662 	.get_survey = iwl_mvm_mac_get_survey,
4663 	.sta_statistics = iwl_mvm_mac_sta_statistics,
4664 #ifdef CONFIG_IWLWIFI_DEBUGFS
4665 	.sta_add_debugfs = iwl_mvm_sta_add_debugfs,
4666 #endif
4667 };
4668