xref: /linux/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c (revision 2c63221cd9e5c0dad0424029aeb1c40faada8330)
1 /******************************************************************************
2  *
3  * This file is provided under a dual BSD/GPLv2 license.  When using or
4  * redistributing this file, you may do so under either license.
5  *
6  * GPL LICENSE SUMMARY
7  *
8  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
9  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
10  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
11  * Copyright(c) 2018 - 2019 Intel Corporation
12  *
13  * This program is free software; you can redistribute it and/or modify
14  * it under the terms of version 2 of the GNU General Public License as
15  * published by the Free Software Foundation.
16  *
17  * This program is distributed in the hope that it will be useful, but
18  * WITHOUT ANY WARRANTY; without even the implied warranty of
19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
20  * General Public License for more details.
21  *
22  * The full GNU General Public License is included in this distribution
23  * in the file called COPYING.
24  *
25  * Contact Information:
26  *  Intel Linux Wireless <linuxwifi@intel.com>
27  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
28  *
29  * BSD LICENSE
30  *
31  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
32  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
33  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
34  * Copyright(c) 2018 - 2019 Intel Corporation
35  * All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  *
41  *  * Redistributions of source code must retain the above copyright
42  *    notice, this list of conditions and the following disclaimer.
43  *  * Redistributions in binary form must reproduce the above copyright
44  *    notice, this list of conditions and the following disclaimer in
45  *    the documentation and/or other materials provided with the
46  *    distribution.
47  *  * Neither the name Intel Corporation nor the names of its
48  *    contributors may be used to endorse or promote products derived
49  *    from this software without specific prior written permission.
50  *
51  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
52  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
53  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
54  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
55  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
56  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
57  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
58  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
59  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
60  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
61  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
62  *
63  *****************************************************************************/
64 #include <linux/kernel.h>
65 #include <linux/slab.h>
66 #include <linux/skbuff.h>
67 #include <linux/netdevice.h>
68 #include <linux/etherdevice.h>
69 #include <linux/ip.h>
70 #include <linux/if_arp.h>
71 #include <linux/time.h>
72 #include <net/mac80211.h>
73 #include <net/ieee80211_radiotap.h>
74 #include <net/tcp.h>
75 
76 #include "iwl-op-mode.h"
77 #include "iwl-io.h"
78 #include "mvm.h"
79 #include "sta.h"
80 #include "time-event.h"
81 #include "iwl-eeprom-parse.h"
82 #include "iwl-phy-db.h"
83 #include "testmode.h"
84 #include "fw/error-dump.h"
85 #include "iwl-prph.h"
86 #include "iwl-nvm-parse.h"
87 
88 static const struct ieee80211_iface_limit iwl_mvm_limits[] = {
89 	{
90 		.max = 1,
91 		.types = BIT(NL80211_IFTYPE_STATION),
92 	},
93 	{
94 		.max = 1,
95 		.types = BIT(NL80211_IFTYPE_AP) |
96 			BIT(NL80211_IFTYPE_P2P_CLIENT) |
97 			BIT(NL80211_IFTYPE_P2P_GO),
98 	},
99 	{
100 		.max = 1,
101 		.types = BIT(NL80211_IFTYPE_P2P_DEVICE),
102 	},
103 };
104 
105 static const struct ieee80211_iface_combination iwl_mvm_iface_combinations[] = {
106 	{
107 		.num_different_channels = 2,
108 		.max_interfaces = 3,
109 		.limits = iwl_mvm_limits,
110 		.n_limits = ARRAY_SIZE(iwl_mvm_limits),
111 	},
112 };
113 
114 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
115 /*
116  * Use the reserved field to indicate magic values.
117  * these values will only be used internally by the driver,
118  * and won't make it to the fw (reserved will be 0).
119  * BC_FILTER_MAGIC_IP - configure the val of this attribute to
120  *	be the vif's ip address. in case there is not a single
121  *	ip address (0, or more than 1), this attribute will
122  *	be skipped.
123  * BC_FILTER_MAGIC_MAC - set the val of this attribute to
124  *	the LSB bytes of the vif's mac address
125  */
126 enum {
127 	BC_FILTER_MAGIC_NONE = 0,
128 	BC_FILTER_MAGIC_IP,
129 	BC_FILTER_MAGIC_MAC,
130 };
131 
132 static const struct iwl_fw_bcast_filter iwl_mvm_default_bcast_filters[] = {
133 	{
134 		/* arp */
135 		.discard = 0,
136 		.frame_type = BCAST_FILTER_FRAME_TYPE_ALL,
137 		.attrs = {
138 			{
139 				/* frame type - arp, hw type - ethernet */
140 				.offset_type =
141 					BCAST_FILTER_OFFSET_PAYLOAD_START,
142 				.offset = sizeof(rfc1042_header),
143 				.val = cpu_to_be32(0x08060001),
144 				.mask = cpu_to_be32(0xffffffff),
145 			},
146 			{
147 				/* arp dest ip */
148 				.offset_type =
149 					BCAST_FILTER_OFFSET_PAYLOAD_START,
150 				.offset = sizeof(rfc1042_header) + 2 +
151 					  sizeof(struct arphdr) +
152 					  ETH_ALEN + sizeof(__be32) +
153 					  ETH_ALEN,
154 				.mask = cpu_to_be32(0xffffffff),
155 				/* mark it as special field */
156 				.reserved1 = cpu_to_le16(BC_FILTER_MAGIC_IP),
157 			},
158 		},
159 	},
160 	{
161 		/* dhcp offer bcast */
162 		.discard = 0,
163 		.frame_type = BCAST_FILTER_FRAME_TYPE_IPV4,
164 		.attrs = {
165 			{
166 				/* udp dest port - 68 (bootp client)*/
167 				.offset_type = BCAST_FILTER_OFFSET_IP_END,
168 				.offset = offsetof(struct udphdr, dest),
169 				.val = cpu_to_be32(0x00440000),
170 				.mask = cpu_to_be32(0xffff0000),
171 			},
172 			{
173 				/* dhcp - lsb bytes of client hw address */
174 				.offset_type = BCAST_FILTER_OFFSET_IP_END,
175 				.offset = 38,
176 				.mask = cpu_to_be32(0xffffffff),
177 				/* mark it as special field */
178 				.reserved1 = cpu_to_le16(BC_FILTER_MAGIC_MAC),
179 			},
180 		},
181 	},
182 	/* last filter must be empty */
183 	{},
184 };
185 #endif
186 
187 static const struct cfg80211_pmsr_capabilities iwl_mvm_pmsr_capa = {
188 	.max_peers = IWL_MVM_TOF_MAX_APS,
189 	.report_ap_tsf = 1,
190 	.randomize_mac_addr = 1,
191 
192 	.ftm = {
193 		.supported = 1,
194 		.asap = 1,
195 		.non_asap = 1,
196 		.request_lci = 1,
197 		.request_civicloc = 1,
198 		.max_bursts_exponent = -1, /* all supported */
199 		.max_ftms_per_burst = 0, /* no limits */
200 		.bandwidths = BIT(NL80211_CHAN_WIDTH_20_NOHT) |
201 			      BIT(NL80211_CHAN_WIDTH_20) |
202 			      BIT(NL80211_CHAN_WIDTH_40) |
203 			      BIT(NL80211_CHAN_WIDTH_80),
204 		.preambles = BIT(NL80211_PREAMBLE_LEGACY) |
205 			     BIT(NL80211_PREAMBLE_HT) |
206 			     BIT(NL80211_PREAMBLE_VHT),
207 	},
208 };
209 
210 static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
211 				 enum set_key_cmd cmd,
212 				 struct ieee80211_vif *vif,
213 				 struct ieee80211_sta *sta,
214 				 struct ieee80211_key_conf *key);
215 
216 static void iwl_mvm_reset_phy_ctxts(struct iwl_mvm *mvm)
217 {
218 	int i;
219 
220 	memset(mvm->phy_ctxts, 0, sizeof(mvm->phy_ctxts));
221 	for (i = 0; i < NUM_PHY_CTX; i++) {
222 		mvm->phy_ctxts[i].id = i;
223 		mvm->phy_ctxts[i].ref = 0;
224 	}
225 }
226 
227 struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
228 						  const char *alpha2,
229 						  enum iwl_mcc_source src_id,
230 						  bool *changed)
231 {
232 	struct ieee80211_regdomain *regd = NULL;
233 	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
234 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
235 	struct iwl_mcc_update_resp *resp;
236 
237 	IWL_DEBUG_LAR(mvm, "Getting regdomain data for %s from FW\n", alpha2);
238 
239 	lockdep_assert_held(&mvm->mutex);
240 
241 	resp = iwl_mvm_update_mcc(mvm, alpha2, src_id);
242 	if (IS_ERR_OR_NULL(resp)) {
243 		IWL_DEBUG_LAR(mvm, "Could not get update from FW %d\n",
244 			      PTR_ERR_OR_ZERO(resp));
245 		goto out;
246 	}
247 
248 	if (changed) {
249 		u32 status = le32_to_cpu(resp->status);
250 
251 		*changed = (status == MCC_RESP_NEW_CHAN_PROFILE ||
252 			    status == MCC_RESP_ILLEGAL);
253 	}
254 
255 	regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg,
256 				      __le32_to_cpu(resp->n_channels),
257 				      resp->channels,
258 				      __le16_to_cpu(resp->mcc),
259 				      __le16_to_cpu(resp->geo_info));
260 	/* Store the return source id */
261 	src_id = resp->source_id;
262 	kfree(resp);
263 	if (IS_ERR_OR_NULL(regd)) {
264 		IWL_DEBUG_LAR(mvm, "Could not get parse update from FW %d\n",
265 			      PTR_ERR_OR_ZERO(regd));
266 		goto out;
267 	}
268 
269 	IWL_DEBUG_LAR(mvm, "setting alpha2 from FW to %s (0x%x, 0x%x) src=%d\n",
270 		      regd->alpha2, regd->alpha2[0], regd->alpha2[1], src_id);
271 	mvm->lar_regdom_set = true;
272 	mvm->mcc_src = src_id;
273 
274 out:
275 	return regd;
276 }
277 
278 void iwl_mvm_update_changed_regdom(struct iwl_mvm *mvm)
279 {
280 	bool changed;
281 	struct ieee80211_regdomain *regd;
282 
283 	if (!iwl_mvm_is_lar_supported(mvm))
284 		return;
285 
286 	regd = iwl_mvm_get_current_regdomain(mvm, &changed);
287 	if (!IS_ERR_OR_NULL(regd)) {
288 		/* only update the regulatory core if changed */
289 		if (changed)
290 			regulatory_set_wiphy_regd(mvm->hw->wiphy, regd);
291 
292 		kfree(regd);
293 	}
294 }
295 
296 struct ieee80211_regdomain *iwl_mvm_get_current_regdomain(struct iwl_mvm *mvm,
297 							  bool *changed)
298 {
299 	return iwl_mvm_get_regdomain(mvm->hw->wiphy, "ZZ",
300 				     iwl_mvm_is_wifi_mcc_supported(mvm) ?
301 				     MCC_SOURCE_GET_CURRENT :
302 				     MCC_SOURCE_OLD_FW, changed);
303 }
304 
305 int iwl_mvm_init_fw_regd(struct iwl_mvm *mvm)
306 {
307 	enum iwl_mcc_source used_src;
308 	struct ieee80211_regdomain *regd;
309 	int ret;
310 	bool changed;
311 	const struct ieee80211_regdomain *r =
312 			rtnl_dereference(mvm->hw->wiphy->regd);
313 
314 	if (!r)
315 		return -ENOENT;
316 
317 	/* save the last source in case we overwrite it below */
318 	used_src = mvm->mcc_src;
319 	if (iwl_mvm_is_wifi_mcc_supported(mvm)) {
320 		/* Notify the firmware we support wifi location updates */
321 		regd = iwl_mvm_get_current_regdomain(mvm, NULL);
322 		if (!IS_ERR_OR_NULL(regd))
323 			kfree(regd);
324 	}
325 
326 	/* Now set our last stored MCC and source */
327 	regd = iwl_mvm_get_regdomain(mvm->hw->wiphy, r->alpha2, used_src,
328 				     &changed);
329 	if (IS_ERR_OR_NULL(regd))
330 		return -EIO;
331 
332 	/* update cfg80211 if the regdomain was changed */
333 	if (changed)
334 		ret = regulatory_set_wiphy_regd_sync_rtnl(mvm->hw->wiphy, regd);
335 	else
336 		ret = 0;
337 
338 	kfree(regd);
339 	return ret;
340 }
341 
342 static const u8 he_if_types_ext_capa_sta[] = {
343 	 [0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
344 	 [2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
345 	 [7] = WLAN_EXT_CAPA8_OPMODE_NOTIF,
346 	 [9] = WLAN_EXT_CAPA10_TWT_REQUESTER_SUPPORT,
347 };
348 
349 static const struct wiphy_iftype_ext_capab he_iftypes_ext_capa[] = {
350 	{
351 		.iftype = NL80211_IFTYPE_STATION,
352 		.extended_capabilities = he_if_types_ext_capa_sta,
353 		.extended_capabilities_mask = he_if_types_ext_capa_sta,
354 		.extended_capabilities_len = sizeof(he_if_types_ext_capa_sta),
355 	},
356 };
357 
358 int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
359 {
360 	struct ieee80211_hw *hw = mvm->hw;
361 	int num_mac, ret, i;
362 	static const u32 mvm_ciphers[] = {
363 		WLAN_CIPHER_SUITE_WEP40,
364 		WLAN_CIPHER_SUITE_WEP104,
365 		WLAN_CIPHER_SUITE_TKIP,
366 		WLAN_CIPHER_SUITE_CCMP,
367 	};
368 #ifdef CONFIG_PM_SLEEP
369 	bool unified = fw_has_capa(&mvm->fw->ucode_capa,
370 				   IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
371 #endif
372 
373 	/* Tell mac80211 our characteristics */
374 	ieee80211_hw_set(hw, SIGNAL_DBM);
375 	ieee80211_hw_set(hw, SPECTRUM_MGMT);
376 	ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
377 	ieee80211_hw_set(hw, WANT_MONITOR_VIF);
378 	ieee80211_hw_set(hw, SUPPORTS_PS);
379 	ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
380 	ieee80211_hw_set(hw, AMPDU_AGGREGATION);
381 	ieee80211_hw_set(hw, TIMING_BEACON_ONLY);
382 	ieee80211_hw_set(hw, CONNECTION_MONITOR);
383 	ieee80211_hw_set(hw, CHANCTX_STA_CSA);
384 	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
385 	ieee80211_hw_set(hw, SUPPORTS_CLONED_SKBS);
386 	ieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);
387 	ieee80211_hw_set(hw, NEEDS_UNIQUE_STA_ADDR);
388 	ieee80211_hw_set(hw, DEAUTH_NEED_MGD_TX_PREP);
389 	ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);
390 	ieee80211_hw_set(hw, BUFF_MMPDU_TXQ);
391 	ieee80211_hw_set(hw, STA_MMPDU_TXQ);
392 	/*
393 	 * On older devices, enabling TX A-MSDU occasionally leads to
394 	 * something getting messed up, the command read from the FIFO
395 	 * gets out of sync and isn't a TX command, so that we have an
396 	 * assert EDC.
397 	 *
398 	 * It's not clear where the bug is, but since we didn't used to
399 	 * support A-MSDU until moving the mac80211 iTXQs, just leave it
400 	 * for older devices. We also don't see this issue on any newer
401 	 * devices.
402 	 */
403 	if (mvm->trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_9000)
404 		ieee80211_hw_set(hw, TX_AMSDU);
405 	ieee80211_hw_set(hw, TX_FRAG_LIST);
406 
407 	if (iwl_mvm_has_tlc_offload(mvm)) {
408 		ieee80211_hw_set(hw, TX_AMPDU_SETUP_IN_HW);
409 		ieee80211_hw_set(hw, HAS_RATE_CONTROL);
410 	}
411 
412 	if (iwl_mvm_has_new_rx_api(mvm))
413 		ieee80211_hw_set(hw, SUPPORTS_REORDERING_BUFFER);
414 
415 	if (fw_has_capa(&mvm->fw->ucode_capa,
416 			IWL_UCODE_TLV_CAPA_STA_PM_NOTIF)) {
417 		ieee80211_hw_set(hw, AP_LINK_PS);
418 	} else if (WARN_ON(iwl_mvm_has_new_tx_api(mvm))) {
419 		/*
420 		 * we absolutely need this for the new TX API since that comes
421 		 * with many more queues than the current code can deal with
422 		 * for station powersave
423 		 */
424 		return -EINVAL;
425 	}
426 
427 	if (mvm->trans->num_rx_queues > 1)
428 		ieee80211_hw_set(hw, USES_RSS);
429 
430 	if (mvm->trans->max_skb_frags)
431 		hw->netdev_features = NETIF_F_HIGHDMA | NETIF_F_SG;
432 
433 	hw->queues = IEEE80211_MAX_QUEUES;
434 	hw->offchannel_tx_hw_queue = IWL_MVM_OFFCHANNEL_QUEUE;
435 	hw->radiotap_mcs_details |= IEEE80211_RADIOTAP_MCS_HAVE_FEC |
436 				    IEEE80211_RADIOTAP_MCS_HAVE_STBC;
437 	hw->radiotap_vht_details |= IEEE80211_RADIOTAP_VHT_KNOWN_STBC |
438 		IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED;
439 
440 	hw->radiotap_timestamp.units_pos =
441 		IEEE80211_RADIOTAP_TIMESTAMP_UNIT_US |
442 		IEEE80211_RADIOTAP_TIMESTAMP_SPOS_PLCP_SIG_ACQ;
443 	/* this is the case for CCK frames, it's better (only 8) for OFDM */
444 	hw->radiotap_timestamp.accuracy = 22;
445 
446 	if (!iwl_mvm_has_tlc_offload(mvm))
447 		hw->rate_control_algorithm = RS_NAME;
448 
449 	hw->uapsd_queues = IWL_MVM_UAPSD_QUEUES;
450 	hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
451 	hw->max_tx_fragments = mvm->trans->max_skb_frags;
452 
453 	BUILD_BUG_ON(ARRAY_SIZE(mvm->ciphers) < ARRAY_SIZE(mvm_ciphers) + 6);
454 	memcpy(mvm->ciphers, mvm_ciphers, sizeof(mvm_ciphers));
455 	hw->wiphy->n_cipher_suites = ARRAY_SIZE(mvm_ciphers);
456 	hw->wiphy->cipher_suites = mvm->ciphers;
457 
458 	if (iwl_mvm_has_new_rx_api(mvm)) {
459 		mvm->ciphers[hw->wiphy->n_cipher_suites] =
460 			WLAN_CIPHER_SUITE_GCMP;
461 		hw->wiphy->n_cipher_suites++;
462 		mvm->ciphers[hw->wiphy->n_cipher_suites] =
463 			WLAN_CIPHER_SUITE_GCMP_256;
464 		hw->wiphy->n_cipher_suites++;
465 	}
466 
467 	/* Enable 11w if software crypto is not enabled (as the
468 	 * firmware will interpret some mgmt packets, so enabling it
469 	 * with software crypto isn't safe).
470 	 */
471 	if (!iwlwifi_mod_params.swcrypto) {
472 		ieee80211_hw_set(hw, MFP_CAPABLE);
473 		mvm->ciphers[hw->wiphy->n_cipher_suites] =
474 			WLAN_CIPHER_SUITE_AES_CMAC;
475 		hw->wiphy->n_cipher_suites++;
476 		if (iwl_mvm_has_new_rx_api(mvm)) {
477 			mvm->ciphers[hw->wiphy->n_cipher_suites] =
478 				WLAN_CIPHER_SUITE_BIP_GMAC_128;
479 			hw->wiphy->n_cipher_suites++;
480 			mvm->ciphers[hw->wiphy->n_cipher_suites] =
481 				WLAN_CIPHER_SUITE_BIP_GMAC_256;
482 			hw->wiphy->n_cipher_suites++;
483 		}
484 	}
485 
486 	/* currently FW API supports only one optional cipher scheme */
487 	if (mvm->fw->cs[0].cipher) {
488 		const struct iwl_fw_cipher_scheme *fwcs = &mvm->fw->cs[0];
489 		struct ieee80211_cipher_scheme *cs = &mvm->cs[0];
490 
491 		mvm->hw->n_cipher_schemes = 1;
492 
493 		cs->cipher = le32_to_cpu(fwcs->cipher);
494 		cs->iftype = BIT(NL80211_IFTYPE_STATION);
495 		cs->hdr_len = fwcs->hdr_len;
496 		cs->pn_len = fwcs->pn_len;
497 		cs->pn_off = fwcs->pn_off;
498 		cs->key_idx_off = fwcs->key_idx_off;
499 		cs->key_idx_mask = fwcs->key_idx_mask;
500 		cs->key_idx_shift = fwcs->key_idx_shift;
501 		cs->mic_len = fwcs->mic_len;
502 
503 		mvm->hw->cipher_schemes = mvm->cs;
504 		mvm->ciphers[hw->wiphy->n_cipher_suites] = cs->cipher;
505 		hw->wiphy->n_cipher_suites++;
506 	}
507 
508 	if (fw_has_capa(&mvm->fw->ucode_capa,
509 			IWL_UCODE_TLV_CAPA_FTM_CALIBRATED)) {
510 		wiphy_ext_feature_set(hw->wiphy,
511 				      NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
512 		hw->wiphy->pmsr_capa = &iwl_mvm_pmsr_capa;
513 	}
514 
515 	ieee80211_hw_set(hw, SINGLE_SCAN_ON_ALL_BANDS);
516 	hw->wiphy->features |=
517 		NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR |
518 		NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR |
519 		NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
520 
521 	hw->sta_data_size = sizeof(struct iwl_mvm_sta);
522 	hw->vif_data_size = sizeof(struct iwl_mvm_vif);
523 	hw->chanctx_data_size = sizeof(u16);
524 	hw->txq_data_size = sizeof(struct iwl_mvm_txq);
525 
526 	hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
527 		BIT(NL80211_IFTYPE_P2P_CLIENT) |
528 		BIT(NL80211_IFTYPE_AP) |
529 		BIT(NL80211_IFTYPE_P2P_GO) |
530 		BIT(NL80211_IFTYPE_P2P_DEVICE) |
531 		BIT(NL80211_IFTYPE_ADHOC);
532 
533 	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
534 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
535 	hw->wiphy->features |= NL80211_FEATURE_HT_IBSS;
536 
537 	hw->wiphy->regulatory_flags |= REGULATORY_ENABLE_RELAX_NO_IR;
538 	if (iwl_mvm_is_lar_supported(mvm))
539 		hw->wiphy->regulatory_flags |= REGULATORY_WIPHY_SELF_MANAGED;
540 	else
541 		hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG |
542 					       REGULATORY_DISABLE_BEACON_HINTS;
543 
544 	hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
545 	hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
546 
547 	hw->wiphy->iface_combinations = iwl_mvm_iface_combinations;
548 	hw->wiphy->n_iface_combinations =
549 		ARRAY_SIZE(iwl_mvm_iface_combinations);
550 
551 	hw->wiphy->max_remain_on_channel_duration = 10000;
552 	hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
553 
554 	/* Extract MAC address */
555 	memcpy(mvm->addresses[0].addr, mvm->nvm_data->hw_addr, ETH_ALEN);
556 	hw->wiphy->addresses = mvm->addresses;
557 	hw->wiphy->n_addresses = 1;
558 
559 	/* Extract additional MAC addresses if available */
560 	num_mac = (mvm->nvm_data->n_hw_addrs > 1) ?
561 		min(IWL_MVM_MAX_ADDRESSES, mvm->nvm_data->n_hw_addrs) : 1;
562 
563 	for (i = 1; i < num_mac; i++) {
564 		memcpy(mvm->addresses[i].addr, mvm->addresses[i-1].addr,
565 		       ETH_ALEN);
566 		mvm->addresses[i].addr[5]++;
567 		hw->wiphy->n_addresses++;
568 	}
569 
570 	iwl_mvm_reset_phy_ctxts(mvm);
571 
572 	hw->wiphy->max_scan_ie_len = iwl_mvm_max_scan_ie_len(mvm);
573 
574 	hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
575 
576 	BUILD_BUG_ON(IWL_MVM_SCAN_STOPPING_MASK & IWL_MVM_SCAN_MASK);
577 	BUILD_BUG_ON(IWL_MVM_MAX_UMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK) ||
578 		     IWL_MVM_MAX_LMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK));
579 
580 	if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
581 		mvm->max_scans = IWL_MVM_MAX_UMAC_SCANS;
582 	else
583 		mvm->max_scans = IWL_MVM_MAX_LMAC_SCANS;
584 
585 	if (mvm->nvm_data->bands[NL80211_BAND_2GHZ].n_channels)
586 		hw->wiphy->bands[NL80211_BAND_2GHZ] =
587 			&mvm->nvm_data->bands[NL80211_BAND_2GHZ];
588 	if (mvm->nvm_data->bands[NL80211_BAND_5GHZ].n_channels) {
589 		hw->wiphy->bands[NL80211_BAND_5GHZ] =
590 			&mvm->nvm_data->bands[NL80211_BAND_5GHZ];
591 
592 		if (fw_has_capa(&mvm->fw->ucode_capa,
593 				IWL_UCODE_TLV_CAPA_BEAMFORMER) &&
594 		    fw_has_api(&mvm->fw->ucode_capa,
595 			       IWL_UCODE_TLV_API_LQ_SS_PARAMS))
596 			hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.cap |=
597 				IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
598 	}
599 
600 	hw->wiphy->hw_version = mvm->trans->hw_id;
601 
602 	if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM)
603 		hw->wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
604 	else
605 		hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
606 
607 	hw->wiphy->max_sched_scan_reqs = 1;
608 	hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
609 	hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
610 	/* we create the 802.11 header and zero length SSID IE. */
611 	hw->wiphy->max_sched_scan_ie_len =
612 		SCAN_OFFLOAD_PROBE_REQ_SIZE - 24 - 2;
613 	hw->wiphy->max_sched_scan_plans = IWL_MAX_SCHED_SCAN_PLANS;
614 	hw->wiphy->max_sched_scan_plan_interval = U16_MAX;
615 
616 	/*
617 	 * the firmware uses u8 for num of iterations, but 0xff is saved for
618 	 * infinite loop, so the maximum number of iterations is actually 254.
619 	 */
620 	hw->wiphy->max_sched_scan_plan_iterations = 254;
621 
622 	hw->wiphy->features |= NL80211_FEATURE_P2P_GO_CTWIN |
623 			       NL80211_FEATURE_LOW_PRIORITY_SCAN |
624 			       NL80211_FEATURE_P2P_GO_OPPPS |
625 			       NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
626 			       NL80211_FEATURE_DYNAMIC_SMPS |
627 			       NL80211_FEATURE_STATIC_SMPS |
628 			       NL80211_FEATURE_SUPPORTS_WMM_ADMISSION;
629 
630 	if (fw_has_capa(&mvm->fw->ucode_capa,
631 			IWL_UCODE_TLV_CAPA_TXPOWER_INSERTION_SUPPORT))
632 		hw->wiphy->features |= NL80211_FEATURE_TX_POWER_INSERTION;
633 	if (fw_has_capa(&mvm->fw->ucode_capa,
634 			IWL_UCODE_TLV_CAPA_QUIET_PERIOD_SUPPORT))
635 		hw->wiphy->features |= NL80211_FEATURE_QUIET;
636 
637 	if (fw_has_capa(&mvm->fw->ucode_capa,
638 			IWL_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT))
639 		hw->wiphy->features |=
640 			NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES;
641 
642 	if (fw_has_capa(&mvm->fw->ucode_capa,
643 			IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT))
644 		hw->wiphy->features |= NL80211_FEATURE_WFA_TPC_IE_IN_PROBES;
645 
646 	if (fw_has_api(&mvm->fw->ucode_capa,
647 		       IWL_UCODE_TLV_API_SCAN_TSF_REPORT)) {
648 		wiphy_ext_feature_set(hw->wiphy,
649 				      NL80211_EXT_FEATURE_SCAN_START_TIME);
650 		wiphy_ext_feature_set(hw->wiphy,
651 				      NL80211_EXT_FEATURE_BSS_PARENT_TSF);
652 		wiphy_ext_feature_set(hw->wiphy,
653 				      NL80211_EXT_FEATURE_SET_SCAN_DWELL);
654 	}
655 
656 	if (iwl_mvm_is_oce_supported(mvm)) {
657 		wiphy_ext_feature_set(hw->wiphy,
658 			NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP);
659 		wiphy_ext_feature_set(hw->wiphy,
660 			NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME);
661 		wiphy_ext_feature_set(hw->wiphy,
662 			NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION);
663 		wiphy_ext_feature_set(hw->wiphy,
664 			NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE);
665 	}
666 
667 	if (mvm->nvm_data->sku_cap_11ax_enable &&
668 	    !iwlwifi_mod_params.disable_11ax) {
669 		hw->wiphy->iftype_ext_capab = he_iftypes_ext_capa;
670 		hw->wiphy->num_iftype_ext_capab =
671 			ARRAY_SIZE(he_iftypes_ext_capa);
672 
673 		ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
674 		ieee80211_hw_set(hw, SUPPORTS_ONLY_HE_MULTI_BSSID);
675 	}
676 
677 	mvm->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
678 
679 #ifdef CONFIG_PM_SLEEP
680 	if ((unified || mvm->fw->img[IWL_UCODE_WOWLAN].num_sec) &&
681 	    mvm->trans->ops->d3_suspend &&
682 	    mvm->trans->ops->d3_resume &&
683 	    device_can_wakeup(mvm->trans->dev)) {
684 		mvm->wowlan.flags |= WIPHY_WOWLAN_MAGIC_PKT |
685 				     WIPHY_WOWLAN_DISCONNECT |
686 				     WIPHY_WOWLAN_EAP_IDENTITY_REQ |
687 				     WIPHY_WOWLAN_RFKILL_RELEASE |
688 				     WIPHY_WOWLAN_NET_DETECT;
689 		if (!iwlwifi_mod_params.swcrypto)
690 			mvm->wowlan.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY |
691 					     WIPHY_WOWLAN_GTK_REKEY_FAILURE |
692 					     WIPHY_WOWLAN_4WAY_HANDSHAKE;
693 
694 		mvm->wowlan.n_patterns = IWL_WOWLAN_MAX_PATTERNS;
695 		mvm->wowlan.pattern_min_len = IWL_WOWLAN_MIN_PATTERN_LEN;
696 		mvm->wowlan.pattern_max_len = IWL_WOWLAN_MAX_PATTERN_LEN;
697 		mvm->wowlan.max_nd_match_sets = IWL_SCAN_MAX_PROFILES;
698 		hw->wiphy->wowlan = &mvm->wowlan;
699 	}
700 #endif
701 
702 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
703 	/* assign default bcast filtering configuration */
704 	mvm->bcast_filters = iwl_mvm_default_bcast_filters;
705 #endif
706 
707 	ret = iwl_mvm_leds_init(mvm);
708 	if (ret)
709 		return ret;
710 
711 	if (fw_has_capa(&mvm->fw->ucode_capa,
712 			IWL_UCODE_TLV_CAPA_TDLS_SUPPORT)) {
713 		IWL_DEBUG_TDLS(mvm, "TDLS supported\n");
714 		hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
715 		ieee80211_hw_set(hw, TDLS_WIDER_BW);
716 	}
717 
718 	if (fw_has_capa(&mvm->fw->ucode_capa,
719 			IWL_UCODE_TLV_CAPA_TDLS_CHANNEL_SWITCH)) {
720 		IWL_DEBUG_TDLS(mvm, "TDLS channel switch supported\n");
721 		hw->wiphy->features |= NL80211_FEATURE_TDLS_CHANNEL_SWITCH;
722 	}
723 
724 	hw->netdev_features |= mvm->cfg->features;
725 	if (!iwl_mvm_is_csum_supported(mvm)) {
726 		hw->netdev_features &= ~(IWL_TX_CSUM_NETIF_FLAGS |
727 					 NETIF_F_RXCSUM);
728 		/* We may support SW TX CSUM */
729 		if (IWL_MVM_SW_TX_CSUM_OFFLOAD)
730 			hw->netdev_features |= IWL_TX_CSUM_NETIF_FLAGS;
731 	}
732 
733 	if (mvm->cfg->vht_mu_mimo_supported)
734 		wiphy_ext_feature_set(hw->wiphy,
735 				      NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER);
736 
737 	ret = ieee80211_register_hw(mvm->hw);
738 	if (ret) {
739 		iwl_mvm_leds_exit(mvm);
740 	}
741 
742 	return ret;
743 }
744 
745 static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
746 			   struct ieee80211_tx_control *control,
747 			   struct sk_buff *skb)
748 {
749 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
750 	struct ieee80211_sta *sta = control->sta;
751 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
752 	struct ieee80211_hdr *hdr = (void *)skb->data;
753 	bool offchannel = IEEE80211_SKB_CB(skb)->flags &
754 		IEEE80211_TX_CTL_TX_OFFCHAN;
755 
756 	if (iwl_mvm_is_radio_killed(mvm)) {
757 		IWL_DEBUG_DROP(mvm, "Dropping - RF/CT KILL\n");
758 		goto drop;
759 	}
760 
761 	if (offchannel &&
762 	    !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status) &&
763 	    !test_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status))
764 		goto drop;
765 
766 	/* treat non-bufferable MMPDUs on AP interfaces as broadcast */
767 	if ((info->control.vif->type == NL80211_IFTYPE_AP ||
768 	     info->control.vif->type == NL80211_IFTYPE_ADHOC) &&
769 	    ieee80211_is_mgmt(hdr->frame_control) &&
770 	    !ieee80211_is_bufferable_mmpdu(hdr->frame_control))
771 		sta = NULL;
772 
773 	/* If there is no sta, and it's not offchannel - send through AP */
774 	if (!sta && info->control.vif->type == NL80211_IFTYPE_STATION &&
775 	    !offchannel) {
776 		struct iwl_mvm_vif *mvmvif =
777 			iwl_mvm_vif_from_mac80211(info->control.vif);
778 		u8 ap_sta_id = READ_ONCE(mvmvif->ap_sta_id);
779 
780 		if (ap_sta_id < IWL_MVM_STATION_COUNT) {
781 			/* mac80211 holds rcu read lock */
782 			sta = rcu_dereference(mvm->fw_id_to_mac_id[ap_sta_id]);
783 			if (IS_ERR_OR_NULL(sta))
784 				goto drop;
785 		}
786 	}
787 
788 	if (sta) {
789 		if (iwl_mvm_tx_skb(mvm, skb, sta))
790 			goto drop;
791 		return;
792 	}
793 
794 	if (iwl_mvm_tx_skb_non_sta(mvm, skb))
795 		goto drop;
796 	return;
797  drop:
798 	ieee80211_free_txskb(hw, skb);
799 }
800 
801 void iwl_mvm_mac_itxq_xmit(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
802 {
803 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
804 	struct iwl_mvm_txq *mvmtxq = iwl_mvm_txq_from_mac80211(txq);
805 	struct sk_buff *skb = NULL;
806 
807 	/*
808 	 * No need for threads to be pending here, they can leave the first
809 	 * taker all the work.
810 	 *
811 	 * mvmtxq->tx_request logic:
812 	 *
813 	 * If 0, no one is currently TXing, set to 1 to indicate current thread
814 	 * will now start TX and other threads should quit.
815 	 *
816 	 * If 1, another thread is currently TXing, set to 2 to indicate to
817 	 * that thread that there was another request. Since that request may
818 	 * have raced with the check whether the queue is empty, the TXing
819 	 * thread should check the queue's status one more time before leaving.
820 	 * This check is done in order to not leave any TX hanging in the queue
821 	 * until the next TX invocation (which may not even happen).
822 	 *
823 	 * If 2, another thread is currently TXing, and it will already double
824 	 * check the queue, so do nothing.
825 	 */
826 	if (atomic_fetch_add_unless(&mvmtxq->tx_request, 1, 2))
827 		return;
828 
829 	rcu_read_lock();
830 	do {
831 		while (likely(!mvmtxq->stopped &&
832 			      (mvm->trans->system_pm_mode ==
833 			       IWL_PLAT_PM_MODE_DISABLED))) {
834 			skb = ieee80211_tx_dequeue(hw, txq);
835 
836 			if (!skb) {
837 				if (txq->sta)
838 					IWL_DEBUG_TX(mvm,
839 						     "TXQ of sta %pM tid %d is now empty\n",
840 						     txq->sta->addr,
841 						     txq->tid);
842 				break;
843 			}
844 
845 			if (!txq->sta)
846 				iwl_mvm_tx_skb_non_sta(mvm, skb);
847 			else
848 				iwl_mvm_tx_skb(mvm, skb, txq->sta);
849 		}
850 	} while (atomic_dec_return(&mvmtxq->tx_request));
851 	rcu_read_unlock();
852 }
853 
854 static void iwl_mvm_mac_wake_tx_queue(struct ieee80211_hw *hw,
855 				      struct ieee80211_txq *txq)
856 {
857 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
858 	struct iwl_mvm_txq *mvmtxq = iwl_mvm_txq_from_mac80211(txq);
859 
860 	/*
861 	 * Please note that racing is handled very carefully here:
862 	 * mvmtxq->txq_id is updated during allocation, and mvmtxq->list is
863 	 * deleted afterwards.
864 	 * This means that if:
865 	 * mvmtxq->txq_id != INVALID_QUEUE && list_empty(&mvmtxq->list):
866 	 *	queue is allocated and we can TX.
867 	 * mvmtxq->txq_id != INVALID_QUEUE && !list_empty(&mvmtxq->list):
868 	 *	a race, should defer the frame.
869 	 * mvmtxq->txq_id == INVALID_QUEUE && list_empty(&mvmtxq->list):
870 	 *	need to allocate the queue and defer the frame.
871 	 * mvmtxq->txq_id == INVALID_QUEUE && !list_empty(&mvmtxq->list):
872 	 *	queue is already scheduled for allocation, no need to allocate,
873 	 *	should defer the frame.
874 	 */
875 
876 	/* If the queue is allocated TX and return. */
877 	if (!txq->sta || mvmtxq->txq_id != IWL_MVM_INVALID_QUEUE) {
878 		/*
879 		 * Check that list is empty to avoid a race where txq_id is
880 		 * already updated, but the queue allocation work wasn't
881 		 * finished
882 		 */
883 		if (unlikely(txq->sta && !list_empty(&mvmtxq->list)))
884 			return;
885 
886 		iwl_mvm_mac_itxq_xmit(hw, txq);
887 		return;
888 	}
889 
890 	/* The list is being deleted only after the queue is fully allocated. */
891 	if (!list_empty(&mvmtxq->list))
892 		return;
893 
894 	list_add_tail(&mvmtxq->list, &mvm->add_stream_txqs);
895 	schedule_work(&mvm->add_stream_wk);
896 }
897 
898 #define CHECK_BA_TRIGGER(_mvm, _trig, _tid_bm, _tid, _fmt...)		\
899 	do {								\
900 		if (!(le16_to_cpu(_tid_bm) & BIT(_tid)))		\
901 			break;						\
902 		iwl_fw_dbg_collect_trig(&(_mvm)->fwrt, _trig, _fmt);	\
903 	} while (0)
904 
905 static void
906 iwl_mvm_ampdu_check_trigger(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
907 			    struct ieee80211_sta *sta, u16 tid, u16 rx_ba_ssn,
908 			    enum ieee80211_ampdu_mlme_action action)
909 {
910 	struct iwl_fw_dbg_trigger_tlv *trig;
911 	struct iwl_fw_dbg_trigger_ba *ba_trig;
912 
913 	trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
914 				     FW_DBG_TRIGGER_BA);
915 	if (!trig)
916 		return;
917 
918 	ba_trig = (void *)trig->data;
919 
920 	switch (action) {
921 	case IEEE80211_AMPDU_TX_OPERATIONAL: {
922 		struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
923 		struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
924 
925 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_start, tid,
926 				 "TX AGG START: MAC %pM tid %d ssn %d\n",
927 				 sta->addr, tid, tid_data->ssn);
928 		break;
929 		}
930 	case IEEE80211_AMPDU_TX_STOP_CONT:
931 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_stop, tid,
932 				 "TX AGG STOP: MAC %pM tid %d\n",
933 				 sta->addr, tid);
934 		break;
935 	case IEEE80211_AMPDU_RX_START:
936 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_start, tid,
937 				 "RX AGG START: MAC %pM tid %d ssn %d\n",
938 				 sta->addr, tid, rx_ba_ssn);
939 		break;
940 	case IEEE80211_AMPDU_RX_STOP:
941 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_stop, tid,
942 				 "RX AGG STOP: MAC %pM tid %d\n",
943 				 sta->addr, tid);
944 		break;
945 	default:
946 		break;
947 	}
948 }
949 
950 static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
951 				    struct ieee80211_vif *vif,
952 				    struct ieee80211_ampdu_params *params)
953 {
954 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
955 	int ret;
956 	struct ieee80211_sta *sta = params->sta;
957 	enum ieee80211_ampdu_mlme_action action = params->action;
958 	u16 tid = params->tid;
959 	u16 *ssn = &params->ssn;
960 	u16 buf_size = params->buf_size;
961 	bool amsdu = params->amsdu;
962 	u16 timeout = params->timeout;
963 
964 	IWL_DEBUG_HT(mvm, "A-MPDU action on addr %pM tid %d: action %d\n",
965 		     sta->addr, tid, action);
966 
967 	if (!(mvm->nvm_data->sku_cap_11n_enable))
968 		return -EACCES;
969 
970 	mutex_lock(&mvm->mutex);
971 
972 	switch (action) {
973 	case IEEE80211_AMPDU_RX_START:
974 		if (iwl_mvm_vif_from_mac80211(vif)->ap_sta_id ==
975 				iwl_mvm_sta_from_mac80211(sta)->sta_id) {
976 			struct iwl_mvm_vif *mvmvif;
977 			u16 macid = iwl_mvm_vif_from_mac80211(vif)->id;
978 			struct iwl_mvm_tcm_mac *mdata = &mvm->tcm.data[macid];
979 
980 			mdata->opened_rx_ba_sessions = true;
981 			mvmvif = iwl_mvm_vif_from_mac80211(vif);
982 			cancel_delayed_work(&mvmvif->uapsd_nonagg_detected_wk);
983 		}
984 		if (!iwl_enable_rx_ampdu()) {
985 			ret = -EINVAL;
986 			break;
987 		}
988 		ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, *ssn, true, buf_size,
989 					 timeout);
990 		break;
991 	case IEEE80211_AMPDU_RX_STOP:
992 		ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, 0, false, buf_size,
993 					 timeout);
994 		break;
995 	case IEEE80211_AMPDU_TX_START:
996 		if (!iwl_enable_tx_ampdu()) {
997 			ret = -EINVAL;
998 			break;
999 		}
1000 		ret = iwl_mvm_sta_tx_agg_start(mvm, vif, sta, tid, ssn);
1001 		break;
1002 	case IEEE80211_AMPDU_TX_STOP_CONT:
1003 		ret = iwl_mvm_sta_tx_agg_stop(mvm, vif, sta, tid);
1004 		break;
1005 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
1006 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
1007 		ret = iwl_mvm_sta_tx_agg_flush(mvm, vif, sta, tid);
1008 		break;
1009 	case IEEE80211_AMPDU_TX_OPERATIONAL:
1010 		ret = iwl_mvm_sta_tx_agg_oper(mvm, vif, sta, tid,
1011 					      buf_size, amsdu);
1012 		break;
1013 	default:
1014 		WARN_ON_ONCE(1);
1015 		ret = -EINVAL;
1016 		break;
1017 	}
1018 
1019 	if (!ret) {
1020 		u16 rx_ba_ssn = 0;
1021 
1022 		if (action == IEEE80211_AMPDU_RX_START)
1023 			rx_ba_ssn = *ssn;
1024 
1025 		iwl_mvm_ampdu_check_trigger(mvm, vif, sta, tid,
1026 					    rx_ba_ssn, action);
1027 	}
1028 	mutex_unlock(&mvm->mutex);
1029 
1030 	return ret;
1031 }
1032 
1033 static void iwl_mvm_cleanup_iterator(void *data, u8 *mac,
1034 				     struct ieee80211_vif *vif)
1035 {
1036 	struct iwl_mvm *mvm = data;
1037 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1038 
1039 	mvmvif->uploaded = false;
1040 	mvmvif->ap_sta_id = IWL_MVM_INVALID_STA;
1041 
1042 	spin_lock_bh(&mvm->time_event_lock);
1043 	iwl_mvm_te_clear_data(mvm, &mvmvif->time_event_data);
1044 	spin_unlock_bh(&mvm->time_event_lock);
1045 
1046 	mvmvif->phy_ctxt = NULL;
1047 	memset(&mvmvif->bf_data, 0, sizeof(mvmvif->bf_data));
1048 	memset(&mvmvif->probe_resp_data, 0, sizeof(mvmvif->probe_resp_data));
1049 }
1050 
1051 static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
1052 {
1053 	iwl_mvm_stop_device(mvm);
1054 
1055 	mvm->cur_aid = 0;
1056 
1057 	mvm->scan_status = 0;
1058 	mvm->ps_disabled = false;
1059 	mvm->rfkill_safe_init_done = false;
1060 
1061 	/* just in case one was running */
1062 	iwl_mvm_cleanup_roc_te(mvm);
1063 	ieee80211_remain_on_channel_expired(mvm->hw);
1064 
1065 	iwl_mvm_ftm_restart(mvm);
1066 
1067 	/*
1068 	 * cleanup all interfaces, even inactive ones, as some might have
1069 	 * gone down during the HW restart
1070 	 */
1071 	ieee80211_iterate_interfaces(mvm->hw, 0, iwl_mvm_cleanup_iterator, mvm);
1072 
1073 	mvm->p2p_device_vif = NULL;
1074 
1075 	iwl_mvm_reset_phy_ctxts(mvm);
1076 	memset(mvm->fw_key_table, 0, sizeof(mvm->fw_key_table));
1077 	memset(&mvm->last_bt_notif, 0, sizeof(mvm->last_bt_notif));
1078 	memset(&mvm->last_bt_ci_cmd, 0, sizeof(mvm->last_bt_ci_cmd));
1079 
1080 	ieee80211_wake_queues(mvm->hw);
1081 
1082 	mvm->vif_count = 0;
1083 	mvm->rx_ba_sessions = 0;
1084 	mvm->fwrt.dump.conf = FW_DBG_INVALID;
1085 	mvm->monitor_on = false;
1086 
1087 	/* keep statistics ticking */
1088 	iwl_mvm_accu_radio_stats(mvm);
1089 }
1090 
1091 int __iwl_mvm_mac_start(struct iwl_mvm *mvm)
1092 {
1093 	int ret;
1094 
1095 	lockdep_assert_held(&mvm->mutex);
1096 
1097 	if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status)) {
1098 		/*
1099 		 * Now convert the HW_RESTART_REQUESTED flag to IN_HW_RESTART
1100 		 * so later code will - from now on - see that we're doing it.
1101 		 */
1102 		set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1103 		clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status);
1104 		/* Clean up some internal and mac80211 state on restart */
1105 		iwl_mvm_restart_cleanup(mvm);
1106 	}
1107 	ret = iwl_mvm_up(mvm);
1108 
1109 	iwl_dbg_tlv_time_point(&mvm->fwrt, IWL_FW_INI_TIME_POINT_POST_INIT,
1110 			       NULL);
1111 	iwl_dbg_tlv_time_point(&mvm->fwrt, IWL_FW_INI_TIME_POINT_PERIODIC,
1112 			       NULL);
1113 
1114 	if (ret && test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
1115 		/* Something went wrong - we need to finish some cleanup
1116 		 * that normally iwl_mvm_mac_restart_complete() below
1117 		 * would do.
1118 		 */
1119 		clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1120 	}
1121 
1122 	return ret;
1123 }
1124 
1125 static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
1126 {
1127 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1128 	int ret;
1129 
1130 	mutex_lock(&mvm->mutex);
1131 	ret = __iwl_mvm_mac_start(mvm);
1132 	mutex_unlock(&mvm->mutex);
1133 
1134 	return ret;
1135 }
1136 
1137 static void iwl_mvm_restart_complete(struct iwl_mvm *mvm)
1138 {
1139 	int ret;
1140 
1141 	mutex_lock(&mvm->mutex);
1142 
1143 	clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1144 
1145 	ret = iwl_mvm_update_quotas(mvm, true, NULL);
1146 	if (ret)
1147 		IWL_ERR(mvm, "Failed to update quotas after restart (%d)\n",
1148 			ret);
1149 
1150 	iwl_mvm_send_recovery_cmd(mvm, ERROR_RECOVERY_END_OF_RECOVERY);
1151 
1152 	/*
1153 	 * If we have TDLS peers, remove them. We don't know the last seqno/PN
1154 	 * of packets the FW sent out, so we must reconnect.
1155 	 */
1156 	iwl_mvm_teardown_tdls_peers(mvm);
1157 
1158 	mutex_unlock(&mvm->mutex);
1159 }
1160 
1161 static void
1162 iwl_mvm_mac_reconfig_complete(struct ieee80211_hw *hw,
1163 			      enum ieee80211_reconfig_type reconfig_type)
1164 {
1165 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1166 
1167 	switch (reconfig_type) {
1168 	case IEEE80211_RECONFIG_TYPE_RESTART:
1169 		iwl_mvm_restart_complete(mvm);
1170 		break;
1171 	case IEEE80211_RECONFIG_TYPE_SUSPEND:
1172 		break;
1173 	}
1174 }
1175 
1176 void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
1177 {
1178 	lockdep_assert_held(&mvm->mutex);
1179 
1180 	/* firmware counters are obviously reset now, but we shouldn't
1181 	 * partially track so also clear the fw_reset_accu counters.
1182 	 */
1183 	memset(&mvm->accu_radio_stats, 0, sizeof(mvm->accu_radio_stats));
1184 
1185 	/* async_handlers_wk is now blocked */
1186 
1187 	/*
1188 	 * The work item could be running or queued if the
1189 	 * ROC time event stops just as we get here.
1190 	 */
1191 	flush_work(&mvm->roc_done_wk);
1192 
1193 	iwl_mvm_stop_device(mvm);
1194 
1195 	iwl_mvm_async_handlers_purge(mvm);
1196 	/* async_handlers_list is empty and will stay empty: HW is stopped */
1197 
1198 	/* the fw is stopped, the aux sta is dead: clean up driver state */
1199 	iwl_mvm_del_aux_sta(mvm);
1200 
1201 	/*
1202 	 * Clear IN_HW_RESTART and HW_RESTART_REQUESTED flag when stopping the
1203 	 * hw (as restart_complete() won't be called in this case) and mac80211
1204 	 * won't execute the restart.
1205 	 * But make sure to cleanup interfaces that have gone down before/during
1206 	 * HW restart was requested.
1207 	 */
1208 	if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) ||
1209 	    test_and_clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
1210 			       &mvm->status))
1211 		ieee80211_iterate_interfaces(mvm->hw, 0,
1212 					     iwl_mvm_cleanup_iterator, mvm);
1213 
1214 	/* We shouldn't have any UIDs still set.  Loop over all the UIDs to
1215 	 * make sure there's nothing left there and warn if any is found.
1216 	 */
1217 	if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1218 		int i;
1219 
1220 		for (i = 0; i < mvm->max_scans; i++) {
1221 			if (WARN_ONCE(mvm->scan_uid_status[i],
1222 				      "UMAC scan UID %d status was not cleaned\n",
1223 				      i))
1224 				mvm->scan_uid_status[i] = 0;
1225 		}
1226 	}
1227 }
1228 
1229 static void iwl_mvm_mac_stop(struct ieee80211_hw *hw)
1230 {
1231 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1232 
1233 	flush_work(&mvm->async_handlers_wk);
1234 	flush_work(&mvm->add_stream_wk);
1235 
1236 	/*
1237 	 * Lock and clear the firmware running bit here already, so that
1238 	 * new commands coming in elsewhere, e.g. from debugfs, will not
1239 	 * be able to proceed. This is important here because one of those
1240 	 * debugfs files causes the firmware dump to be triggered, and if we
1241 	 * don't stop debugfs accesses before canceling that it could be
1242 	 * retriggered after we flush it but before we've cleared the bit.
1243 	 */
1244 	clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status);
1245 
1246 	cancel_delayed_work_sync(&mvm->cs_tx_unblock_dwork);
1247 	cancel_delayed_work_sync(&mvm->scan_timeout_dwork);
1248 	iwl_fw_free_dump_desc(&mvm->fwrt);
1249 
1250 	mutex_lock(&mvm->mutex);
1251 	__iwl_mvm_mac_stop(mvm);
1252 	mutex_unlock(&mvm->mutex);
1253 
1254 	/*
1255 	 * The worker might have been waiting for the mutex, let it run and
1256 	 * discover that its list is now empty.
1257 	 */
1258 	cancel_work_sync(&mvm->async_handlers_wk);
1259 }
1260 
1261 static struct iwl_mvm_phy_ctxt *iwl_mvm_get_free_phy_ctxt(struct iwl_mvm *mvm)
1262 {
1263 	u16 i;
1264 
1265 	lockdep_assert_held(&mvm->mutex);
1266 
1267 	for (i = 0; i < NUM_PHY_CTX; i++)
1268 		if (!mvm->phy_ctxts[i].ref)
1269 			return &mvm->phy_ctxts[i];
1270 
1271 	IWL_ERR(mvm, "No available PHY context\n");
1272 	return NULL;
1273 }
1274 
1275 static int iwl_mvm_set_tx_power(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1276 				s16 tx_power)
1277 {
1278 	int len;
1279 	union {
1280 		struct iwl_dev_tx_power_cmd v5;
1281 		struct iwl_dev_tx_power_cmd_v4 v4;
1282 	} cmd = {
1283 		.v5.v3.set_mode = cpu_to_le32(IWL_TX_POWER_MODE_SET_MAC),
1284 		.v5.v3.mac_context_id =
1285 			cpu_to_le32(iwl_mvm_vif_from_mac80211(vif)->id),
1286 		.v5.v3.pwr_restriction = cpu_to_le16(8 * tx_power),
1287 	};
1288 
1289 	if (tx_power == IWL_DEFAULT_MAX_TX_POWER)
1290 		cmd.v5.v3.pwr_restriction = cpu_to_le16(IWL_DEV_MAX_TX_POWER);
1291 
1292 	if (fw_has_api(&mvm->fw->ucode_capa,
1293 		       IWL_UCODE_TLV_API_REDUCE_TX_POWER))
1294 		len = sizeof(cmd.v5);
1295 	else if (fw_has_capa(&mvm->fw->ucode_capa,
1296 			     IWL_UCODE_TLV_CAPA_TX_POWER_ACK))
1297 		len = sizeof(cmd.v4);
1298 	else
1299 		len = sizeof(cmd.v4.v3);
1300 
1301 	return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, 0, len, &cmd);
1302 }
1303 
1304 static int iwl_mvm_post_channel_switch(struct ieee80211_hw *hw,
1305 				       struct ieee80211_vif *vif)
1306 {
1307 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1308 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1309 	int ret;
1310 
1311 	mutex_lock(&mvm->mutex);
1312 
1313 	if (mvmvif->csa_failed) {
1314 		mvmvif->csa_failed = false;
1315 		ret = -EIO;
1316 		goto out_unlock;
1317 	}
1318 
1319 	if (vif->type == NL80211_IFTYPE_STATION) {
1320 		struct iwl_mvm_sta *mvmsta;
1321 
1322 		mvmvif->csa_bcn_pending = false;
1323 		mvmsta = iwl_mvm_sta_from_staid_protected(mvm,
1324 							  mvmvif->ap_sta_id);
1325 
1326 		if (WARN_ON(!mvmsta)) {
1327 			ret = -EIO;
1328 			goto out_unlock;
1329 		}
1330 
1331 		if (!fw_has_capa(&mvm->fw->ucode_capa,
1332 				 IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD))
1333 			iwl_mvm_sta_modify_disable_tx(mvm, mvmsta, false);
1334 
1335 		iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
1336 
1337 		if (!fw_has_capa(&mvm->fw->ucode_capa,
1338 				 IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
1339 			ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
1340 			if (ret)
1341 				goto out_unlock;
1342 
1343 			iwl_mvm_stop_session_protection(mvm, vif);
1344 		}
1345 	}
1346 
1347 	mvmvif->ps_disabled = false;
1348 
1349 	ret = iwl_mvm_power_update_ps(mvm);
1350 
1351 out_unlock:
1352 	mutex_unlock(&mvm->mutex);
1353 
1354 	return ret;
1355 }
1356 
1357 static void iwl_mvm_abort_channel_switch(struct ieee80211_hw *hw,
1358 					 struct ieee80211_vif *vif)
1359 {
1360 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1361 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1362 	struct iwl_chan_switch_te_cmd cmd = {
1363 		.mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
1364 							  mvmvif->color)),
1365 		.action = cpu_to_le32(FW_CTXT_ACTION_REMOVE),
1366 	};
1367 
1368 	IWL_DEBUG_MAC80211(mvm, "Abort CSA on mac %d\n", mvmvif->id);
1369 
1370 	mutex_lock(&mvm->mutex);
1371 	WARN_ON(iwl_mvm_send_cmd_pdu(mvm,
1372 				     WIDE_ID(MAC_CONF_GROUP,
1373 					     CHANNEL_SWITCH_TIME_EVENT_CMD),
1374 				     0, sizeof(cmd), &cmd));
1375 	mutex_unlock(&mvm->mutex);
1376 
1377 	WARN_ON(iwl_mvm_post_channel_switch(hw, vif));
1378 }
1379 
1380 static void iwl_mvm_channel_switch_disconnect_wk(struct work_struct *wk)
1381 {
1382 	struct iwl_mvm *mvm;
1383 	struct iwl_mvm_vif *mvmvif;
1384 	struct ieee80211_vif *vif;
1385 
1386 	mvmvif = container_of(wk, struct iwl_mvm_vif, csa_work.work);
1387 	vif = container_of((void *)mvmvif, struct ieee80211_vif, drv_priv);
1388 	mvm = mvmvif->mvm;
1389 
1390 	iwl_mvm_abort_channel_switch(mvm->hw, vif);
1391 	ieee80211_chswitch_done(vif, false);
1392 }
1393 
1394 static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
1395 				     struct ieee80211_vif *vif)
1396 {
1397 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1398 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1399 	int ret;
1400 
1401 	mvmvif->mvm = mvm;
1402 	RCU_INIT_POINTER(mvmvif->probe_resp_data, NULL);
1403 
1404 	/*
1405 	 * Not much to do here. The stack will not allow interface
1406 	 * types or combinations that we didn't advertise, so we
1407 	 * don't really have to check the types.
1408 	 */
1409 
1410 	mutex_lock(&mvm->mutex);
1411 
1412 	/* make sure that beacon statistics don't go backwards with FW reset */
1413 	if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
1414 		mvmvif->beacon_stats.accu_num_beacons +=
1415 			mvmvif->beacon_stats.num_beacons;
1416 
1417 	/* Allocate resources for the MAC context, and add it to the fw  */
1418 	ret = iwl_mvm_mac_ctxt_init(mvm, vif);
1419 	if (ret)
1420 		goto out_unlock;
1421 
1422 	rcu_assign_pointer(mvm->vif_id_to_mac[mvmvif->id], vif);
1423 
1424 	/* Counting number of interfaces is needed for legacy PM */
1425 	if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1426 		mvm->vif_count++;
1427 
1428 	/*
1429 	 * The AP binding flow can be done only after the beacon
1430 	 * template is configured (which happens only in the mac80211
1431 	 * start_ap() flow), and adding the broadcast station can happen
1432 	 * only after the binding.
1433 	 * In addition, since modifying the MAC before adding a bcast
1434 	 * station is not allowed by the FW, delay the adding of MAC context to
1435 	 * the point where we can also add the bcast station.
1436 	 * In short: there's not much we can do at this point, other than
1437 	 * allocating resources :)
1438 	 */
1439 	if (vif->type == NL80211_IFTYPE_AP ||
1440 	    vif->type == NL80211_IFTYPE_ADHOC) {
1441 		ret = iwl_mvm_alloc_bcast_sta(mvm, vif);
1442 		if (ret) {
1443 			IWL_ERR(mvm, "Failed to allocate bcast sta\n");
1444 			goto out_release;
1445 		}
1446 
1447 		/*
1448 		 * Only queue for this station is the mcast queue,
1449 		 * which shouldn't be in TFD mask anyway
1450 		 */
1451 		ret = iwl_mvm_allocate_int_sta(mvm, &mvmvif->mcast_sta,
1452 					       0, vif->type,
1453 					       IWL_STA_MULTICAST);
1454 		if (ret)
1455 			goto out_release;
1456 
1457 		iwl_mvm_vif_dbgfs_register(mvm, vif);
1458 		goto out_unlock;
1459 	}
1460 
1461 	mvmvif->features |= hw->netdev_features;
1462 
1463 	ret = iwl_mvm_mac_ctxt_add(mvm, vif);
1464 	if (ret)
1465 		goto out_release;
1466 
1467 	ret = iwl_mvm_power_update_mac(mvm);
1468 	if (ret)
1469 		goto out_remove_mac;
1470 
1471 	/* beacon filtering */
1472 	ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
1473 	if (ret)
1474 		goto out_remove_mac;
1475 
1476 	if (!mvm->bf_allowed_vif &&
1477 	    vif->type == NL80211_IFTYPE_STATION && !vif->p2p) {
1478 		mvm->bf_allowed_vif = mvmvif;
1479 		vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
1480 				     IEEE80211_VIF_SUPPORTS_CQM_RSSI;
1481 	}
1482 
1483 	/*
1484 	 * P2P_DEVICE interface does not have a channel context assigned to it,
1485 	 * so a dedicated PHY context is allocated to it and the corresponding
1486 	 * MAC context is bound to it at this stage.
1487 	 */
1488 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1489 
1490 		mvmvif->phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
1491 		if (!mvmvif->phy_ctxt) {
1492 			ret = -ENOSPC;
1493 			goto out_free_bf;
1494 		}
1495 
1496 		iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
1497 		ret = iwl_mvm_binding_add_vif(mvm, vif);
1498 		if (ret)
1499 			goto out_unref_phy;
1500 
1501 		ret = iwl_mvm_add_p2p_bcast_sta(mvm, vif);
1502 		if (ret)
1503 			goto out_unbind;
1504 
1505 		/* Save a pointer to p2p device vif, so it can later be used to
1506 		 * update the p2p device MAC when a GO is started/stopped */
1507 		mvm->p2p_device_vif = vif;
1508 	}
1509 
1510 	iwl_mvm_tcm_add_vif(mvm, vif);
1511 	INIT_DELAYED_WORK(&mvmvif->csa_work,
1512 			  iwl_mvm_channel_switch_disconnect_wk);
1513 
1514 	if (vif->type == NL80211_IFTYPE_MONITOR)
1515 		mvm->monitor_on = true;
1516 
1517 	iwl_mvm_vif_dbgfs_register(mvm, vif);
1518 	goto out_unlock;
1519 
1520  out_unbind:
1521 	iwl_mvm_binding_remove_vif(mvm, vif);
1522  out_unref_phy:
1523 	iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1524  out_free_bf:
1525 	if (mvm->bf_allowed_vif == mvmvif) {
1526 		mvm->bf_allowed_vif = NULL;
1527 		vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1528 				       IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1529 	}
1530  out_remove_mac:
1531 	mvmvif->phy_ctxt = NULL;
1532 	iwl_mvm_mac_ctxt_remove(mvm, vif);
1533  out_release:
1534 	if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1535 		mvm->vif_count--;
1536  out_unlock:
1537 	mutex_unlock(&mvm->mutex);
1538 
1539 	return ret;
1540 }
1541 
1542 static void iwl_mvm_prepare_mac_removal(struct iwl_mvm *mvm,
1543 					struct ieee80211_vif *vif)
1544 {
1545 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1546 		/*
1547 		 * Flush the ROC worker which will flush the OFFCHANNEL queue.
1548 		 * We assume here that all the packets sent to the OFFCHANNEL
1549 		 * queue are sent in ROC session.
1550 		 */
1551 		flush_work(&mvm->roc_done_wk);
1552 	}
1553 }
1554 
1555 static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
1556 					 struct ieee80211_vif *vif)
1557 {
1558 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1559 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1560 	struct iwl_probe_resp_data *probe_data;
1561 
1562 	iwl_mvm_prepare_mac_removal(mvm, vif);
1563 
1564 	if (!(vif->type == NL80211_IFTYPE_AP ||
1565 	      vif->type == NL80211_IFTYPE_ADHOC))
1566 		iwl_mvm_tcm_rm_vif(mvm, vif);
1567 
1568 	mutex_lock(&mvm->mutex);
1569 
1570 	probe_data = rcu_dereference_protected(mvmvif->probe_resp_data,
1571 					       lockdep_is_held(&mvm->mutex));
1572 	RCU_INIT_POINTER(mvmvif->probe_resp_data, NULL);
1573 	if (probe_data)
1574 		kfree_rcu(probe_data, rcu_head);
1575 
1576 	if (mvm->bf_allowed_vif == mvmvif) {
1577 		mvm->bf_allowed_vif = NULL;
1578 		vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1579 				       IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1580 	}
1581 
1582 	if (vif->bss_conf.ftm_responder)
1583 		memset(&mvm->ftm_resp_stats, 0, sizeof(mvm->ftm_resp_stats));
1584 
1585 	iwl_mvm_vif_dbgfs_clean(mvm, vif);
1586 
1587 	/*
1588 	 * For AP/GO interface, the tear down of the resources allocated to the
1589 	 * interface is be handled as part of the stop_ap flow.
1590 	 */
1591 	if (vif->type == NL80211_IFTYPE_AP ||
1592 	    vif->type == NL80211_IFTYPE_ADHOC) {
1593 #ifdef CONFIG_NL80211_TESTMODE
1594 		if (vif == mvm->noa_vif) {
1595 			mvm->noa_vif = NULL;
1596 			mvm->noa_duration = 0;
1597 		}
1598 #endif
1599 		iwl_mvm_dealloc_int_sta(mvm, &mvmvif->mcast_sta);
1600 		iwl_mvm_dealloc_bcast_sta(mvm, vif);
1601 		goto out_release;
1602 	}
1603 
1604 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1605 		mvm->p2p_device_vif = NULL;
1606 		iwl_mvm_rm_p2p_bcast_sta(mvm, vif);
1607 		iwl_mvm_binding_remove_vif(mvm, vif);
1608 		iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1609 		mvmvif->phy_ctxt = NULL;
1610 	}
1611 
1612 	if (mvm->vif_count && vif->type != NL80211_IFTYPE_P2P_DEVICE)
1613 		mvm->vif_count--;
1614 
1615 	iwl_mvm_power_update_mac(mvm);
1616 	iwl_mvm_mac_ctxt_remove(mvm, vif);
1617 
1618 	RCU_INIT_POINTER(mvm->vif_id_to_mac[mvmvif->id], NULL);
1619 
1620 	if (vif->type == NL80211_IFTYPE_MONITOR)
1621 		mvm->monitor_on = false;
1622 
1623 out_release:
1624 	mutex_unlock(&mvm->mutex);
1625 }
1626 
1627 static int iwl_mvm_mac_config(struct ieee80211_hw *hw, u32 changed)
1628 {
1629 	return 0;
1630 }
1631 
1632 struct iwl_mvm_mc_iter_data {
1633 	struct iwl_mvm *mvm;
1634 	int port_id;
1635 };
1636 
1637 static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
1638 				      struct ieee80211_vif *vif)
1639 {
1640 	struct iwl_mvm_mc_iter_data *data = _data;
1641 	struct iwl_mvm *mvm = data->mvm;
1642 	struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd;
1643 	struct iwl_host_cmd hcmd = {
1644 		.id = MCAST_FILTER_CMD,
1645 		.flags = CMD_ASYNC,
1646 		.dataflags[0] = IWL_HCMD_DFL_NOCOPY,
1647 	};
1648 	int ret, len;
1649 
1650 	/* if we don't have free ports, mcast frames will be dropped */
1651 	if (WARN_ON_ONCE(data->port_id >= MAX_PORT_ID_NUM))
1652 		return;
1653 
1654 	if (vif->type != NL80211_IFTYPE_STATION ||
1655 	    !vif->bss_conf.assoc)
1656 		return;
1657 
1658 	cmd->port_id = data->port_id++;
1659 	memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
1660 	len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4);
1661 
1662 	hcmd.len[0] = len;
1663 	hcmd.data[0] = cmd;
1664 
1665 	ret = iwl_mvm_send_cmd(mvm, &hcmd);
1666 	if (ret)
1667 		IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret);
1668 }
1669 
1670 static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm)
1671 {
1672 	struct iwl_mvm_mc_iter_data iter_data = {
1673 		.mvm = mvm,
1674 	};
1675 
1676 	lockdep_assert_held(&mvm->mutex);
1677 
1678 	if (WARN_ON_ONCE(!mvm->mcast_filter_cmd))
1679 		return;
1680 
1681 	ieee80211_iterate_active_interfaces_atomic(
1682 		mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1683 		iwl_mvm_mc_iface_iterator, &iter_data);
1684 }
1685 
1686 static u64 iwl_mvm_prepare_multicast(struct ieee80211_hw *hw,
1687 				     struct netdev_hw_addr_list *mc_list)
1688 {
1689 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1690 	struct iwl_mcast_filter_cmd *cmd;
1691 	struct netdev_hw_addr *addr;
1692 	int addr_count;
1693 	bool pass_all;
1694 	int len;
1695 
1696 	addr_count = netdev_hw_addr_list_count(mc_list);
1697 	pass_all = addr_count > MAX_MCAST_FILTERING_ADDRESSES ||
1698 		   IWL_MVM_FW_MCAST_FILTER_PASS_ALL;
1699 	if (pass_all)
1700 		addr_count = 0;
1701 
1702 	len = roundup(sizeof(*cmd) + addr_count * ETH_ALEN, 4);
1703 	cmd = kzalloc(len, GFP_ATOMIC);
1704 	if (!cmd)
1705 		return 0;
1706 
1707 	if (pass_all) {
1708 		cmd->pass_all = 1;
1709 		return (u64)(unsigned long)cmd;
1710 	}
1711 
1712 	netdev_hw_addr_list_for_each(addr, mc_list) {
1713 		IWL_DEBUG_MAC80211(mvm, "mcast addr (%d): %pM\n",
1714 				   cmd->count, addr->addr);
1715 		memcpy(&cmd->addr_list[cmd->count * ETH_ALEN],
1716 		       addr->addr, ETH_ALEN);
1717 		cmd->count++;
1718 	}
1719 
1720 	return (u64)(unsigned long)cmd;
1721 }
1722 
1723 static void iwl_mvm_configure_filter(struct ieee80211_hw *hw,
1724 				     unsigned int changed_flags,
1725 				     unsigned int *total_flags,
1726 				     u64 multicast)
1727 {
1728 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1729 	struct iwl_mcast_filter_cmd *cmd = (void *)(unsigned long)multicast;
1730 
1731 	mutex_lock(&mvm->mutex);
1732 
1733 	/* replace previous configuration */
1734 	kfree(mvm->mcast_filter_cmd);
1735 	mvm->mcast_filter_cmd = cmd;
1736 
1737 	if (!cmd)
1738 		goto out;
1739 
1740 	if (changed_flags & FIF_ALLMULTI)
1741 		cmd->pass_all = !!(*total_flags & FIF_ALLMULTI);
1742 
1743 	if (cmd->pass_all)
1744 		cmd->count = 0;
1745 
1746 	iwl_mvm_recalc_multicast(mvm);
1747 out:
1748 	mutex_unlock(&mvm->mutex);
1749 	*total_flags = 0;
1750 }
1751 
1752 static void iwl_mvm_config_iface_filter(struct ieee80211_hw *hw,
1753 					struct ieee80211_vif *vif,
1754 					unsigned int filter_flags,
1755 					unsigned int changed_flags)
1756 {
1757 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1758 
1759 	/* We support only filter for probe requests */
1760 	if (!(changed_flags & FIF_PROBE_REQ))
1761 		return;
1762 
1763 	/* Supported only for p2p client interfaces */
1764 	if (vif->type != NL80211_IFTYPE_STATION || !vif->bss_conf.assoc ||
1765 	    !vif->p2p)
1766 		return;
1767 
1768 	mutex_lock(&mvm->mutex);
1769 	iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
1770 	mutex_unlock(&mvm->mutex);
1771 }
1772 
1773 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
1774 struct iwl_bcast_iter_data {
1775 	struct iwl_mvm *mvm;
1776 	struct iwl_bcast_filter_cmd *cmd;
1777 	u8 current_filter;
1778 };
1779 
1780 static void
1781 iwl_mvm_set_bcast_filter(struct ieee80211_vif *vif,
1782 			 const struct iwl_fw_bcast_filter *in_filter,
1783 			 struct iwl_fw_bcast_filter *out_filter)
1784 {
1785 	struct iwl_fw_bcast_filter_attr *attr;
1786 	int i;
1787 
1788 	memcpy(out_filter, in_filter, sizeof(*out_filter));
1789 
1790 	for (i = 0; i < ARRAY_SIZE(out_filter->attrs); i++) {
1791 		attr = &out_filter->attrs[i];
1792 
1793 		if (!attr->mask)
1794 			break;
1795 
1796 		switch (attr->reserved1) {
1797 		case cpu_to_le16(BC_FILTER_MAGIC_IP):
1798 			if (vif->bss_conf.arp_addr_cnt != 1) {
1799 				attr->mask = 0;
1800 				continue;
1801 			}
1802 
1803 			attr->val = vif->bss_conf.arp_addr_list[0];
1804 			break;
1805 		case cpu_to_le16(BC_FILTER_MAGIC_MAC):
1806 			attr->val = *(__be32 *)&vif->addr[2];
1807 			break;
1808 		default:
1809 			break;
1810 		}
1811 		attr->reserved1 = 0;
1812 		out_filter->num_attrs++;
1813 	}
1814 }
1815 
1816 static void iwl_mvm_bcast_filter_iterator(void *_data, u8 *mac,
1817 					  struct ieee80211_vif *vif)
1818 {
1819 	struct iwl_bcast_iter_data *data = _data;
1820 	struct iwl_mvm *mvm = data->mvm;
1821 	struct iwl_bcast_filter_cmd *cmd = data->cmd;
1822 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1823 	struct iwl_fw_bcast_mac *bcast_mac;
1824 	int i;
1825 
1826 	if (WARN_ON(mvmvif->id >= ARRAY_SIZE(cmd->macs)))
1827 		return;
1828 
1829 	bcast_mac = &cmd->macs[mvmvif->id];
1830 
1831 	/*
1832 	 * enable filtering only for associated stations, but not for P2P
1833 	 * Clients
1834 	 */
1835 	if (vif->type != NL80211_IFTYPE_STATION || vif->p2p ||
1836 	    !vif->bss_conf.assoc)
1837 		return;
1838 
1839 	bcast_mac->default_discard = 1;
1840 
1841 	/* copy all configured filters */
1842 	for (i = 0; mvm->bcast_filters[i].attrs[0].mask; i++) {
1843 		/*
1844 		 * Make sure we don't exceed our filters limit.
1845 		 * if there is still a valid filter to be configured,
1846 		 * be on the safe side and just allow bcast for this mac.
1847 		 */
1848 		if (WARN_ON_ONCE(data->current_filter >=
1849 				 ARRAY_SIZE(cmd->filters))) {
1850 			bcast_mac->default_discard = 0;
1851 			bcast_mac->attached_filters = 0;
1852 			break;
1853 		}
1854 
1855 		iwl_mvm_set_bcast_filter(vif,
1856 					 &mvm->bcast_filters[i],
1857 					 &cmd->filters[data->current_filter]);
1858 
1859 		/* skip current filter if it contains no attributes */
1860 		if (!cmd->filters[data->current_filter].num_attrs)
1861 			continue;
1862 
1863 		/* attach the filter to current mac */
1864 		bcast_mac->attached_filters |=
1865 				cpu_to_le16(BIT(data->current_filter));
1866 
1867 		data->current_filter++;
1868 	}
1869 }
1870 
1871 bool iwl_mvm_bcast_filter_build_cmd(struct iwl_mvm *mvm,
1872 				    struct iwl_bcast_filter_cmd *cmd)
1873 {
1874 	struct iwl_bcast_iter_data iter_data = {
1875 		.mvm = mvm,
1876 		.cmd = cmd,
1877 	};
1878 
1879 	if (IWL_MVM_FW_BCAST_FILTER_PASS_ALL)
1880 		return false;
1881 
1882 	memset(cmd, 0, sizeof(*cmd));
1883 	cmd->max_bcast_filters = ARRAY_SIZE(cmd->filters);
1884 	cmd->max_macs = ARRAY_SIZE(cmd->macs);
1885 
1886 #ifdef CONFIG_IWLWIFI_DEBUGFS
1887 	/* use debugfs filters/macs if override is configured */
1888 	if (mvm->dbgfs_bcast_filtering.override) {
1889 		memcpy(cmd->filters, &mvm->dbgfs_bcast_filtering.cmd.filters,
1890 		       sizeof(cmd->filters));
1891 		memcpy(cmd->macs, &mvm->dbgfs_bcast_filtering.cmd.macs,
1892 		       sizeof(cmd->macs));
1893 		return true;
1894 	}
1895 #endif
1896 
1897 	/* if no filters are configured, do nothing */
1898 	if (!mvm->bcast_filters)
1899 		return false;
1900 
1901 	/* configure and attach these filters for each associated sta vif */
1902 	ieee80211_iterate_active_interfaces(
1903 		mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1904 		iwl_mvm_bcast_filter_iterator, &iter_data);
1905 
1906 	return true;
1907 }
1908 
1909 static int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
1910 {
1911 	struct iwl_bcast_filter_cmd cmd;
1912 
1913 	if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BCAST_FILTERING))
1914 		return 0;
1915 
1916 	if (!iwl_mvm_bcast_filter_build_cmd(mvm, &cmd))
1917 		return 0;
1918 
1919 	return iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, 0,
1920 				    sizeof(cmd), &cmd);
1921 }
1922 #else
1923 static inline int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
1924 {
1925 	return 0;
1926 }
1927 #endif
1928 
1929 static int iwl_mvm_update_mu_groups(struct iwl_mvm *mvm,
1930 				    struct ieee80211_vif *vif)
1931 {
1932 	struct iwl_mu_group_mgmt_cmd cmd = {};
1933 
1934 	memcpy(cmd.membership_status, vif->bss_conf.mu_group.membership,
1935 	       WLAN_MEMBERSHIP_LEN);
1936 	memcpy(cmd.user_position, vif->bss_conf.mu_group.position,
1937 	       WLAN_USER_POSITION_LEN);
1938 
1939 	return iwl_mvm_send_cmd_pdu(mvm,
1940 				    WIDE_ID(DATA_PATH_GROUP,
1941 					    UPDATE_MU_GROUPS_CMD),
1942 				    0, sizeof(cmd), &cmd);
1943 }
1944 
1945 static void iwl_mvm_mu_mimo_iface_iterator(void *_data, u8 *mac,
1946 					   struct ieee80211_vif *vif)
1947 {
1948 	if (vif->mu_mimo_owner) {
1949 		struct iwl_mu_group_mgmt_notif *notif = _data;
1950 
1951 		/*
1952 		 * MU-MIMO Group Id action frame is little endian. We treat
1953 		 * the data received from firmware as if it came from the
1954 		 * action frame, so no conversion is needed.
1955 		 */
1956 		ieee80211_update_mu_groups(vif,
1957 					   (u8 *)&notif->membership_status,
1958 					   (u8 *)&notif->user_position);
1959 	}
1960 }
1961 
1962 void iwl_mvm_mu_mimo_grp_notif(struct iwl_mvm *mvm,
1963 			       struct iwl_rx_cmd_buffer *rxb)
1964 {
1965 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
1966 	struct iwl_mu_group_mgmt_notif *notif = (void *)pkt->data;
1967 
1968 	ieee80211_iterate_active_interfaces_atomic(
1969 			mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1970 			iwl_mvm_mu_mimo_iface_iterator, notif);
1971 }
1972 
1973 static u8 iwl_mvm_he_get_ppe_val(u8 *ppe, u8 ppe_pos_bit)
1974 {
1975 	u8 byte_num = ppe_pos_bit / 8;
1976 	u8 bit_num = ppe_pos_bit % 8;
1977 	u8 residue_bits;
1978 	u8 res;
1979 
1980 	if (bit_num <= 5)
1981 		return (ppe[byte_num] >> bit_num) &
1982 		       (BIT(IEEE80211_PPE_THRES_INFO_PPET_SIZE) - 1);
1983 
1984 	/*
1985 	 * If bit_num > 5, we have to combine bits with next byte.
1986 	 * Calculate how many bits we need to take from current byte (called
1987 	 * here "residue_bits"), and add them to bits from next byte.
1988 	 */
1989 
1990 	residue_bits = 8 - bit_num;
1991 
1992 	res = (ppe[byte_num + 1] &
1993 	       (BIT(IEEE80211_PPE_THRES_INFO_PPET_SIZE - residue_bits) - 1)) <<
1994 	      residue_bits;
1995 	res += (ppe[byte_num] >> bit_num) & (BIT(residue_bits) - 1);
1996 
1997 	return res;
1998 }
1999 
2000 static void iwl_mvm_cfg_he_sta(struct iwl_mvm *mvm,
2001 			       struct ieee80211_vif *vif, u8 sta_id)
2002 {
2003 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2004 	struct iwl_he_sta_context_cmd sta_ctxt_cmd = {
2005 		.sta_id = sta_id,
2006 		.tid_limit = IWL_MAX_TID_COUNT,
2007 		.bss_color = vif->bss_conf.bss_color,
2008 		.htc_trig_based_pkt_ext = vif->bss_conf.htc_trig_based_pkt_ext,
2009 		.frame_time_rts_th =
2010 			cpu_to_le16(vif->bss_conf.frame_time_rts_th),
2011 	};
2012 	int size = fw_has_api(&mvm->fw->ucode_capa,
2013 			      IWL_UCODE_TLV_API_MBSSID_HE) ?
2014 		   sizeof(sta_ctxt_cmd) :
2015 		   sizeof(struct iwl_he_sta_context_cmd_v1);
2016 	struct ieee80211_sta *sta;
2017 	u32 flags;
2018 	int i;
2019 
2020 	rcu_read_lock();
2021 
2022 	sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_ctxt_cmd.sta_id]);
2023 	if (IS_ERR(sta)) {
2024 		rcu_read_unlock();
2025 		WARN(1, "Can't find STA to configure HE\n");
2026 		return;
2027 	}
2028 
2029 	if (!sta->he_cap.has_he) {
2030 		rcu_read_unlock();
2031 		return;
2032 	}
2033 
2034 	flags = 0;
2035 
2036 	/* Block 26-tone RU OFDMA transmissions */
2037 	if (mvmvif->he_ru_2mhz_block)
2038 		flags |= STA_CTXT_HE_RU_2MHZ_BLOCK;
2039 
2040 	/* HTC flags */
2041 	if (sta->he_cap.he_cap_elem.mac_cap_info[0] &
2042 	    IEEE80211_HE_MAC_CAP0_HTC_HE)
2043 		sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_SUPPORT);
2044 	if ((sta->he_cap.he_cap_elem.mac_cap_info[1] &
2045 	      IEEE80211_HE_MAC_CAP1_LINK_ADAPTATION) ||
2046 	    (sta->he_cap.he_cap_elem.mac_cap_info[2] &
2047 	      IEEE80211_HE_MAC_CAP2_LINK_ADAPTATION)) {
2048 		u8 link_adap =
2049 			((sta->he_cap.he_cap_elem.mac_cap_info[2] &
2050 			  IEEE80211_HE_MAC_CAP2_LINK_ADAPTATION) << 1) +
2051 			 (sta->he_cap.he_cap_elem.mac_cap_info[1] &
2052 			  IEEE80211_HE_MAC_CAP1_LINK_ADAPTATION);
2053 
2054 		if (link_adap == 2)
2055 			sta_ctxt_cmd.htc_flags |=
2056 				cpu_to_le32(IWL_HE_HTC_LINK_ADAP_UNSOLICITED);
2057 		else if (link_adap == 3)
2058 			sta_ctxt_cmd.htc_flags |=
2059 				cpu_to_le32(IWL_HE_HTC_LINK_ADAP_BOTH);
2060 	}
2061 	if (sta->he_cap.he_cap_elem.mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
2062 		sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_BSR_SUPP);
2063 	if (sta->he_cap.he_cap_elem.mac_cap_info[3] &
2064 	    IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
2065 		sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_OMI_SUPP);
2066 	if (sta->he_cap.he_cap_elem.mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
2067 		sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_BQR_SUPP);
2068 
2069 	/*
2070 	 * Initialize the PPE thresholds to "None" (7), as described in Table
2071 	 * 9-262ac of 80211.ax/D3.0.
2072 	 */
2073 	memset(&sta_ctxt_cmd.pkt_ext, 7, sizeof(sta_ctxt_cmd.pkt_ext));
2074 
2075 	/* If PPE Thresholds exist, parse them into a FW-familiar format. */
2076 	if (sta->he_cap.he_cap_elem.phy_cap_info[6] &
2077 	    IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT) {
2078 		u8 nss = (sta->he_cap.ppe_thres[0] &
2079 			  IEEE80211_PPE_THRES_NSS_MASK) + 1;
2080 		u8 ru_index_bitmap =
2081 			(sta->he_cap.ppe_thres[0] &
2082 			 IEEE80211_PPE_THRES_RU_INDEX_BITMASK_MASK) >>
2083 			IEEE80211_PPE_THRES_RU_INDEX_BITMASK_POS;
2084 		u8 *ppe = &sta->he_cap.ppe_thres[0];
2085 		u8 ppe_pos_bit = 7; /* Starting after PPE header */
2086 
2087 		/*
2088 		 * FW currently supports only nss == MAX_HE_SUPP_NSS
2089 		 *
2090 		 * If nss > MAX: we can ignore values we don't support
2091 		 * If nss < MAX: we can set zeros in other streams
2092 		 */
2093 		if (nss > MAX_HE_SUPP_NSS) {
2094 			IWL_INFO(mvm, "Got NSS = %d - trimming to %d\n", nss,
2095 				 MAX_HE_SUPP_NSS);
2096 			nss = MAX_HE_SUPP_NSS;
2097 		}
2098 
2099 		for (i = 0; i < nss; i++) {
2100 			u8 ru_index_tmp = ru_index_bitmap << 1;
2101 			u8 bw;
2102 
2103 			for (bw = 0; bw < MAX_HE_CHANNEL_BW_INDX; bw++) {
2104 				ru_index_tmp >>= 1;
2105 				if (!(ru_index_tmp & 1))
2106 					continue;
2107 
2108 				sta_ctxt_cmd.pkt_ext.pkt_ext_qam_th[i][bw][1] =
2109 					iwl_mvm_he_get_ppe_val(ppe,
2110 							       ppe_pos_bit);
2111 				ppe_pos_bit +=
2112 					IEEE80211_PPE_THRES_INFO_PPET_SIZE;
2113 				sta_ctxt_cmd.pkt_ext.pkt_ext_qam_th[i][bw][0] =
2114 					iwl_mvm_he_get_ppe_val(ppe,
2115 							       ppe_pos_bit);
2116 				ppe_pos_bit +=
2117 					IEEE80211_PPE_THRES_INFO_PPET_SIZE;
2118 			}
2119 		}
2120 
2121 		flags |= STA_CTXT_HE_PACKET_EXT;
2122 	} else if ((sta->he_cap.he_cap_elem.phy_cap_info[9] &
2123 		    IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_MASK) !=
2124 		  IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_RESERVED) {
2125 		int low_th = -1;
2126 		int high_th = -1;
2127 
2128 		/* Take the PPE thresholds from the nominal padding info */
2129 		switch (sta->he_cap.he_cap_elem.phy_cap_info[9] &
2130 			IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_MASK) {
2131 		case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_0US:
2132 			low_th = IWL_HE_PKT_EXT_NONE;
2133 			high_th = IWL_HE_PKT_EXT_NONE;
2134 			break;
2135 		case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_8US:
2136 			low_th = IWL_HE_PKT_EXT_BPSK;
2137 			high_th = IWL_HE_PKT_EXT_NONE;
2138 			break;
2139 		case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_16US:
2140 			low_th = IWL_HE_PKT_EXT_NONE;
2141 			high_th = IWL_HE_PKT_EXT_BPSK;
2142 			break;
2143 		}
2144 
2145 		/* Set the PPE thresholds accordingly */
2146 		if (low_th >= 0 && high_th >= 0) {
2147 			struct iwl_he_pkt_ext *pkt_ext =
2148 				(struct iwl_he_pkt_ext *)&sta_ctxt_cmd.pkt_ext;
2149 
2150 			for (i = 0; i < MAX_HE_SUPP_NSS; i++) {
2151 				u8 bw;
2152 
2153 				for (bw = 0; bw < MAX_HE_CHANNEL_BW_INDX;
2154 				     bw++) {
2155 					pkt_ext->pkt_ext_qam_th[i][bw][0] =
2156 						low_th;
2157 					pkt_ext->pkt_ext_qam_th[i][bw][1] =
2158 						high_th;
2159 				}
2160 			}
2161 
2162 			flags |= STA_CTXT_HE_PACKET_EXT;
2163 		}
2164 	}
2165 	rcu_read_unlock();
2166 
2167 	/* Mark MU EDCA as enabled, unless none detected on some AC */
2168 	flags |= STA_CTXT_HE_MU_EDCA_CW;
2169 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
2170 		struct ieee80211_he_mu_edca_param_ac_rec *mu_edca =
2171 			&mvmvif->queue_params[i].mu_edca_param_rec;
2172 		u8 ac = iwl_mvm_mac80211_ac_to_ucode_ac(i);
2173 
2174 		if (!mvmvif->queue_params[i].mu_edca) {
2175 			flags &= ~STA_CTXT_HE_MU_EDCA_CW;
2176 			break;
2177 		}
2178 
2179 		sta_ctxt_cmd.trig_based_txf[ac].cwmin =
2180 			cpu_to_le16(mu_edca->ecw_min_max & 0xf);
2181 		sta_ctxt_cmd.trig_based_txf[ac].cwmax =
2182 			cpu_to_le16((mu_edca->ecw_min_max & 0xf0) >> 4);
2183 		sta_ctxt_cmd.trig_based_txf[ac].aifsn =
2184 			cpu_to_le16(mu_edca->aifsn);
2185 		sta_ctxt_cmd.trig_based_txf[ac].mu_time =
2186 			cpu_to_le16(mu_edca->mu_edca_timer);
2187 	}
2188 
2189 	if (vif->bss_conf.multi_sta_back_32bit)
2190 		flags |= STA_CTXT_HE_32BIT_BA_BITMAP;
2191 
2192 	if (vif->bss_conf.ack_enabled)
2193 		flags |= STA_CTXT_HE_ACK_ENABLED;
2194 
2195 	if (vif->bss_conf.uora_exists) {
2196 		flags |= STA_CTXT_HE_TRIG_RND_ALLOC;
2197 
2198 		sta_ctxt_cmd.rand_alloc_ecwmin =
2199 			vif->bss_conf.uora_ocw_range & 0x7;
2200 		sta_ctxt_cmd.rand_alloc_ecwmax =
2201 			(vif->bss_conf.uora_ocw_range >> 3) & 0x7;
2202 	}
2203 
2204 	if (vif->bss_conf.nontransmitted) {
2205 		flags |= STA_CTXT_HE_REF_BSSID_VALID;
2206 		ether_addr_copy(sta_ctxt_cmd.ref_bssid_addr,
2207 				vif->bss_conf.transmitter_bssid);
2208 		sta_ctxt_cmd.max_bssid_indicator =
2209 			vif->bss_conf.bssid_indicator;
2210 		sta_ctxt_cmd.bssid_index = vif->bss_conf.bssid_index;
2211 		sta_ctxt_cmd.ema_ap = vif->bss_conf.ema_ap;
2212 		sta_ctxt_cmd.profile_periodicity =
2213 			vif->bss_conf.profile_periodicity;
2214 	}
2215 
2216 	sta_ctxt_cmd.flags = cpu_to_le32(flags);
2217 
2218 	if (iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(STA_HE_CTXT_CMD,
2219 						 DATA_PATH_GROUP, 0),
2220 				 0, size, &sta_ctxt_cmd))
2221 		IWL_ERR(mvm, "Failed to config FW to work HE!\n");
2222 }
2223 
2224 static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
2225 					     struct ieee80211_vif *vif,
2226 					     struct ieee80211_bss_conf *bss_conf,
2227 					     u32 changes)
2228 {
2229 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2230 	int ret;
2231 
2232 	/*
2233 	 * Re-calculate the tsf id, as the master-slave relations depend on the
2234 	 * beacon interval, which was not known when the station interface was
2235 	 * added.
2236 	 */
2237 	if (changes & BSS_CHANGED_ASSOC && bss_conf->assoc) {
2238 		if (vif->bss_conf.he_support &&
2239 		    !iwlwifi_mod_params.disable_11ax)
2240 			iwl_mvm_cfg_he_sta(mvm, vif, mvmvif->ap_sta_id);
2241 
2242 		iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
2243 	}
2244 
2245 	/* Update MU EDCA params */
2246 	if (changes & BSS_CHANGED_QOS && mvmvif->associated &&
2247 	    bss_conf->assoc && vif->bss_conf.he_support &&
2248 	    !iwlwifi_mod_params.disable_11ax)
2249 		iwl_mvm_cfg_he_sta(mvm, vif, mvmvif->ap_sta_id);
2250 
2251 	/*
2252 	 * If we're not associated yet, take the (new) BSSID before associating
2253 	 * so the firmware knows. If we're already associated, then use the old
2254 	 * BSSID here, and we'll send a cleared one later in the CHANGED_ASSOC
2255 	 * branch for disassociation below.
2256 	 */
2257 	if (changes & BSS_CHANGED_BSSID && !mvmvif->associated)
2258 		memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
2259 
2260 	ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, mvmvif->bssid);
2261 	if (ret)
2262 		IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
2263 
2264 	/* after sending it once, adopt mac80211 data */
2265 	memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
2266 	mvmvif->associated = bss_conf->assoc;
2267 
2268 	if (changes & BSS_CHANGED_ASSOC) {
2269 		if (bss_conf->assoc) {
2270 			/* clear statistics to get clean beacon counter */
2271 			iwl_mvm_request_statistics(mvm, true);
2272 			memset(&mvmvif->beacon_stats, 0,
2273 			       sizeof(mvmvif->beacon_stats));
2274 
2275 			/* add quota for this interface */
2276 			ret = iwl_mvm_update_quotas(mvm, true, NULL);
2277 			if (ret) {
2278 				IWL_ERR(mvm, "failed to update quotas\n");
2279 				return;
2280 			}
2281 
2282 			if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
2283 				     &mvm->status) &&
2284 			    !fw_has_capa(&mvm->fw->ucode_capa,
2285 					 IWL_UCODE_TLV_CAPA_SESSION_PROT_CMD)) {
2286 				/*
2287 				 * If we're restarting then the firmware will
2288 				 * obviously have lost synchronisation with
2289 				 * the AP. It will attempt to synchronise by
2290 				 * itself, but we can make it more reliable by
2291 				 * scheduling a session protection time event.
2292 				 *
2293 				 * The firmware needs to receive a beacon to
2294 				 * catch up with synchronisation, use 110% of
2295 				 * the beacon interval.
2296 				 *
2297 				 * Set a large maximum delay to allow for more
2298 				 * than a single interface.
2299 				 *
2300 				 * For new firmware versions, rely on the
2301 				 * firmware. This is relevant for DCM scenarios
2302 				 * only anyway.
2303 				 */
2304 				u32 dur = (11 * vif->bss_conf.beacon_int) / 10;
2305 				iwl_mvm_protect_session(mvm, vif, dur, dur,
2306 							5 * dur, false);
2307 			}
2308 
2309 			iwl_mvm_sf_update(mvm, vif, false);
2310 			iwl_mvm_power_vif_assoc(mvm, vif);
2311 			if (vif->p2p) {
2312 				iwl_mvm_update_smps(mvm, vif,
2313 						    IWL_MVM_SMPS_REQ_PROT,
2314 						    IEEE80211_SMPS_DYNAMIC);
2315 			}
2316 		} else if (mvmvif->ap_sta_id != IWL_MVM_INVALID_STA) {
2317 			/*
2318 			 * If update fails - SF might be running in associated
2319 			 * mode while disassociated - which is forbidden.
2320 			 */
2321 			ret = iwl_mvm_sf_update(mvm, vif, false);
2322 			WARN_ONCE(ret &&
2323 				  !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
2324 					    &mvm->status),
2325 				  "Failed to update SF upon disassociation\n");
2326 
2327 			/*
2328 			 * If we get an assert during the connection (after the
2329 			 * station has been added, but before the vif is set
2330 			 * to associated), mac80211 will re-add the station and
2331 			 * then configure the vif. Since the vif is not
2332 			 * associated, we would remove the station here and
2333 			 * this would fail the recovery.
2334 			 */
2335 			if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
2336 				      &mvm->status)) {
2337 				/*
2338 				 * Remove AP station now that
2339 				 * the MAC is unassoc
2340 				 */
2341 				ret = iwl_mvm_rm_sta_id(mvm, vif,
2342 							mvmvif->ap_sta_id);
2343 				if (ret)
2344 					IWL_ERR(mvm,
2345 						"failed to remove AP station\n");
2346 
2347 				mvmvif->ap_sta_id = IWL_MVM_INVALID_STA;
2348 			}
2349 
2350 			/* remove quota for this interface */
2351 			ret = iwl_mvm_update_quotas(mvm, false, NULL);
2352 			if (ret)
2353 				IWL_ERR(mvm, "failed to update quotas\n");
2354 
2355 			/* this will take the cleared BSSID from bss_conf */
2356 			ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
2357 			if (ret)
2358 				IWL_ERR(mvm,
2359 					"failed to update MAC %pM (clear after unassoc)\n",
2360 					vif->addr);
2361 		}
2362 
2363 		/*
2364 		 * The firmware tracks the MU-MIMO group on its own.
2365 		 * However, on HW restart we should restore this data.
2366 		 */
2367 		if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
2368 		    (changes & BSS_CHANGED_MU_GROUPS) && vif->mu_mimo_owner) {
2369 			ret = iwl_mvm_update_mu_groups(mvm, vif);
2370 			if (ret)
2371 				IWL_ERR(mvm,
2372 					"failed to update VHT MU_MIMO groups\n");
2373 		}
2374 
2375 		iwl_mvm_recalc_multicast(mvm);
2376 		iwl_mvm_configure_bcast_filter(mvm);
2377 
2378 		/* reset rssi values */
2379 		mvmvif->bf_data.ave_beacon_signal = 0;
2380 
2381 		iwl_mvm_bt_coex_vif_change(mvm);
2382 		iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_TT,
2383 				    IEEE80211_SMPS_AUTOMATIC);
2384 		if (fw_has_capa(&mvm->fw->ucode_capa,
2385 				IWL_UCODE_TLV_CAPA_UMAC_SCAN))
2386 			iwl_mvm_config_scan(mvm);
2387 	}
2388 
2389 	if (changes & BSS_CHANGED_BEACON_INFO) {
2390 		/*
2391 		 * We received a beacon from the associated AP so
2392 		 * remove the session protection.
2393 		 * A firmware with the new API will remove it automatically.
2394 		 */
2395 		if (!fw_has_capa(&mvm->fw->ucode_capa,
2396 				 IWL_UCODE_TLV_CAPA_SESSION_PROT_CMD))
2397 			iwl_mvm_stop_session_protection(mvm, vif);
2398 
2399 		iwl_mvm_sf_update(mvm, vif, false);
2400 		WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
2401 	}
2402 
2403 	if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS | BSS_CHANGED_QOS |
2404 		       /*
2405 			* Send power command on every beacon change,
2406 			* because we may have not enabled beacon abort yet.
2407 			*/
2408 		       BSS_CHANGED_BEACON_INFO)) {
2409 		ret = iwl_mvm_power_update_mac(mvm);
2410 		if (ret)
2411 			IWL_ERR(mvm, "failed to update power mode\n");
2412 	}
2413 
2414 	if (changes & BSS_CHANGED_TXPOWER) {
2415 		IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2416 				bss_conf->txpower);
2417 		iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2418 	}
2419 
2420 	if (changes & BSS_CHANGED_CQM) {
2421 		IWL_DEBUG_MAC80211(mvm, "cqm info_changed\n");
2422 		/* reset cqm events tracking */
2423 		mvmvif->bf_data.last_cqm_event = 0;
2424 		if (mvmvif->bf_data.bf_enabled) {
2425 			ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
2426 			if (ret)
2427 				IWL_ERR(mvm,
2428 					"failed to update CQM thresholds\n");
2429 		}
2430 	}
2431 
2432 	if (changes & BSS_CHANGED_ARP_FILTER) {
2433 		IWL_DEBUG_MAC80211(mvm, "arp filter changed\n");
2434 		iwl_mvm_configure_bcast_filter(mvm);
2435 	}
2436 }
2437 
2438 static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
2439 				 struct ieee80211_vif *vif)
2440 {
2441 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2442 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2443 	int ret, i;
2444 
2445 	mutex_lock(&mvm->mutex);
2446 
2447 	/* Send the beacon template */
2448 	ret = iwl_mvm_mac_ctxt_beacon_changed(mvm, vif);
2449 	if (ret)
2450 		goto out_unlock;
2451 
2452 	/*
2453 	 * Re-calculate the tsf id, as the master-slave relations depend on the
2454 	 * beacon interval, which was not known when the AP interface was added.
2455 	 */
2456 	if (vif->type == NL80211_IFTYPE_AP)
2457 		iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
2458 
2459 	mvmvif->ap_assoc_sta_count = 0;
2460 
2461 	/* Add the mac context */
2462 	ret = iwl_mvm_mac_ctxt_add(mvm, vif);
2463 	if (ret)
2464 		goto out_unlock;
2465 
2466 	/* Perform the binding */
2467 	ret = iwl_mvm_binding_add_vif(mvm, vif);
2468 	if (ret)
2469 		goto out_remove;
2470 
2471 	/*
2472 	 * This is not very nice, but the simplest:
2473 	 * For older FWs adding the mcast sta before the bcast station may
2474 	 * cause assert 0x2b00.
2475 	 * This is fixed in later FW so make the order of removal depend on
2476 	 * the TLV
2477 	 */
2478 	if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE)) {
2479 		ret = iwl_mvm_add_mcast_sta(mvm, vif);
2480 		if (ret)
2481 			goto out_unbind;
2482 		/*
2483 		 * Send the bcast station. At this stage the TBTT and DTIM time
2484 		 * events are added and applied to the scheduler
2485 		 */
2486 		ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
2487 		if (ret) {
2488 			iwl_mvm_rm_mcast_sta(mvm, vif);
2489 			goto out_unbind;
2490 		}
2491 	} else {
2492 		/*
2493 		 * Send the bcast station. At this stage the TBTT and DTIM time
2494 		 * events are added and applied to the scheduler
2495 		 */
2496 		ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
2497 		if (ret)
2498 			goto out_unbind;
2499 		ret = iwl_mvm_add_mcast_sta(mvm, vif);
2500 		if (ret) {
2501 			iwl_mvm_send_rm_bcast_sta(mvm, vif);
2502 			goto out_unbind;
2503 		}
2504 	}
2505 
2506 	/* must be set before quota calculations */
2507 	mvmvif->ap_ibss_active = true;
2508 
2509 	/* send all the early keys to the device now */
2510 	for (i = 0; i < ARRAY_SIZE(mvmvif->ap_early_keys); i++) {
2511 		struct ieee80211_key_conf *key = mvmvif->ap_early_keys[i];
2512 
2513 		if (!key)
2514 			continue;
2515 
2516 		mvmvif->ap_early_keys[i] = NULL;
2517 
2518 		ret = __iwl_mvm_mac_set_key(hw, SET_KEY, vif, NULL, key);
2519 		if (ret)
2520 			goto out_quota_failed;
2521 	}
2522 
2523 	if (vif->type == NL80211_IFTYPE_AP && !vif->p2p) {
2524 		iwl_mvm_vif_set_low_latency(mvmvif, true,
2525 					    LOW_LATENCY_VIF_TYPE);
2526 		iwl_mvm_send_low_latency_cmd(mvm, true, mvmvif->id);
2527 	}
2528 
2529 	/* power updated needs to be done before quotas */
2530 	iwl_mvm_power_update_mac(mvm);
2531 
2532 	ret = iwl_mvm_update_quotas(mvm, false, NULL);
2533 	if (ret)
2534 		goto out_quota_failed;
2535 
2536 	/* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2537 	if (vif->p2p && mvm->p2p_device_vif)
2538 		iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2539 
2540 	iwl_mvm_bt_coex_vif_change(mvm);
2541 
2542 	/* we don't support TDLS during DCM */
2543 	if (iwl_mvm_phy_ctx_count(mvm) > 1)
2544 		iwl_mvm_teardown_tdls_peers(mvm);
2545 
2546 	iwl_mvm_ftm_restart_responder(mvm, vif);
2547 
2548 	goto out_unlock;
2549 
2550 out_quota_failed:
2551 	iwl_mvm_power_update_mac(mvm);
2552 	mvmvif->ap_ibss_active = false;
2553 	iwl_mvm_send_rm_bcast_sta(mvm, vif);
2554 	iwl_mvm_rm_mcast_sta(mvm, vif);
2555 out_unbind:
2556 	iwl_mvm_binding_remove_vif(mvm, vif);
2557 out_remove:
2558 	iwl_mvm_mac_ctxt_remove(mvm, vif);
2559 out_unlock:
2560 	mutex_unlock(&mvm->mutex);
2561 	return ret;
2562 }
2563 
2564 static void iwl_mvm_stop_ap_ibss(struct ieee80211_hw *hw,
2565 				 struct ieee80211_vif *vif)
2566 {
2567 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2568 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2569 
2570 	iwl_mvm_prepare_mac_removal(mvm, vif);
2571 
2572 	mutex_lock(&mvm->mutex);
2573 
2574 	/* Handle AP stop while in CSA */
2575 	if (rcu_access_pointer(mvm->csa_vif) == vif) {
2576 		iwl_mvm_remove_time_event(mvm, mvmvif,
2577 					  &mvmvif->time_event_data);
2578 		RCU_INIT_POINTER(mvm->csa_vif, NULL);
2579 		mvmvif->csa_countdown = false;
2580 	}
2581 
2582 	if (rcu_access_pointer(mvm->csa_tx_blocked_vif) == vif) {
2583 		RCU_INIT_POINTER(mvm->csa_tx_blocked_vif, NULL);
2584 		mvm->csa_tx_block_bcn_timeout = 0;
2585 	}
2586 
2587 	mvmvif->ap_ibss_active = false;
2588 	mvm->ap_last_beacon_gp2 = 0;
2589 
2590 	if (vif->type == NL80211_IFTYPE_AP && !vif->p2p) {
2591 		iwl_mvm_vif_set_low_latency(mvmvif, false,
2592 					    LOW_LATENCY_VIF_TYPE);
2593 		iwl_mvm_send_low_latency_cmd(mvm, false,  mvmvif->id);
2594 	}
2595 
2596 	iwl_mvm_bt_coex_vif_change(mvm);
2597 
2598 	/* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2599 	if (vif->p2p && mvm->p2p_device_vif)
2600 		iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2601 
2602 	iwl_mvm_update_quotas(mvm, false, NULL);
2603 
2604 	/*
2605 	 * This is not very nice, but the simplest:
2606 	 * For older FWs removing the mcast sta before the bcast station may
2607 	 * cause assert 0x2b00.
2608 	 * This is fixed in later FW (which will stop beaconing when removing
2609 	 * bcast station).
2610 	 * So make the order of removal depend on the TLV
2611 	 */
2612 	if (!fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE))
2613 		iwl_mvm_rm_mcast_sta(mvm, vif);
2614 	iwl_mvm_send_rm_bcast_sta(mvm, vif);
2615 	if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE))
2616 		iwl_mvm_rm_mcast_sta(mvm, vif);
2617 	iwl_mvm_binding_remove_vif(mvm, vif);
2618 
2619 	iwl_mvm_power_update_mac(mvm);
2620 
2621 	iwl_mvm_mac_ctxt_remove(mvm, vif);
2622 
2623 	mutex_unlock(&mvm->mutex);
2624 }
2625 
2626 static void
2627 iwl_mvm_bss_info_changed_ap_ibss(struct iwl_mvm *mvm,
2628 				 struct ieee80211_vif *vif,
2629 				 struct ieee80211_bss_conf *bss_conf,
2630 				 u32 changes)
2631 {
2632 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2633 
2634 	/* Changes will be applied when the AP/IBSS is started */
2635 	if (!mvmvif->ap_ibss_active)
2636 		return;
2637 
2638 	if (changes & (BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_HT |
2639 		       BSS_CHANGED_BANDWIDTH | BSS_CHANGED_QOS) &&
2640 	    iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL))
2641 		IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
2642 
2643 	/* Need to send a new beacon template to the FW */
2644 	if (changes & BSS_CHANGED_BEACON &&
2645 	    iwl_mvm_mac_ctxt_beacon_changed(mvm, vif))
2646 		IWL_WARN(mvm, "Failed updating beacon data\n");
2647 
2648 	if (changes & BSS_CHANGED_TXPOWER) {
2649 		IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2650 				bss_conf->txpower);
2651 		iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2652 	}
2653 
2654 	if (changes & BSS_CHANGED_FTM_RESPONDER) {
2655 		int ret = iwl_mvm_ftm_start_responder(mvm, vif);
2656 
2657 		if (ret)
2658 			IWL_WARN(mvm, "Failed to enable FTM responder (%d)\n",
2659 				 ret);
2660 	}
2661 
2662 }
2663 
2664 static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw,
2665 				     struct ieee80211_vif *vif,
2666 				     struct ieee80211_bss_conf *bss_conf,
2667 				     u32 changes)
2668 {
2669 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2670 
2671 	mutex_lock(&mvm->mutex);
2672 
2673 	if (changes & BSS_CHANGED_IDLE && !bss_conf->idle)
2674 		iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true);
2675 
2676 	switch (vif->type) {
2677 	case NL80211_IFTYPE_STATION:
2678 		iwl_mvm_bss_info_changed_station(mvm, vif, bss_conf, changes);
2679 		break;
2680 	case NL80211_IFTYPE_AP:
2681 	case NL80211_IFTYPE_ADHOC:
2682 		iwl_mvm_bss_info_changed_ap_ibss(mvm, vif, bss_conf, changes);
2683 		break;
2684 	case NL80211_IFTYPE_MONITOR:
2685 		if (changes & BSS_CHANGED_MU_GROUPS)
2686 			iwl_mvm_update_mu_groups(mvm, vif);
2687 		break;
2688 	default:
2689 		/* shouldn't happen */
2690 		WARN_ON_ONCE(1);
2691 	}
2692 
2693 	mutex_unlock(&mvm->mutex);
2694 }
2695 
2696 static int iwl_mvm_mac_hw_scan(struct ieee80211_hw *hw,
2697 			       struct ieee80211_vif *vif,
2698 			       struct ieee80211_scan_request *hw_req)
2699 {
2700 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2701 	int ret;
2702 
2703 	if (hw_req->req.n_channels == 0 ||
2704 	    hw_req->req.n_channels > mvm->fw->ucode_capa.n_scan_channels)
2705 		return -EINVAL;
2706 
2707 	mutex_lock(&mvm->mutex);
2708 	ret = iwl_mvm_reg_scan_start(mvm, vif, &hw_req->req, &hw_req->ies);
2709 	mutex_unlock(&mvm->mutex);
2710 
2711 	return ret;
2712 }
2713 
2714 static void iwl_mvm_mac_cancel_hw_scan(struct ieee80211_hw *hw,
2715 				       struct ieee80211_vif *vif)
2716 {
2717 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2718 
2719 	mutex_lock(&mvm->mutex);
2720 
2721 	/* Due to a race condition, it's possible that mac80211 asks
2722 	 * us to stop a hw_scan when it's already stopped.  This can
2723 	 * happen, for instance, if we stopped the scan ourselves,
2724 	 * called ieee80211_scan_completed() and the userspace called
2725 	 * cancel scan scan before ieee80211_scan_work() could run.
2726 	 * To handle that, simply return if the scan is not running.
2727 	*/
2728 	if (mvm->scan_status & IWL_MVM_SCAN_REGULAR)
2729 		iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true);
2730 
2731 	mutex_unlock(&mvm->mutex);
2732 }
2733 
2734 static void
2735 iwl_mvm_mac_allow_buffered_frames(struct ieee80211_hw *hw,
2736 				  struct ieee80211_sta *sta, u16 tids,
2737 				  int num_frames,
2738 				  enum ieee80211_frame_release_type reason,
2739 				  bool more_data)
2740 {
2741 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2742 
2743 	/* Called when we need to transmit (a) frame(s) from mac80211 */
2744 
2745 	iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2746 					  tids, more_data, false);
2747 }
2748 
2749 static void
2750 iwl_mvm_mac_release_buffered_frames(struct ieee80211_hw *hw,
2751 				    struct ieee80211_sta *sta, u16 tids,
2752 				    int num_frames,
2753 				    enum ieee80211_frame_release_type reason,
2754 				    bool more_data)
2755 {
2756 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2757 
2758 	/* Called when we need to transmit (a) frame(s) from agg or dqa queue */
2759 
2760 	iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2761 					  tids, more_data, true);
2762 }
2763 
2764 static void __iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
2765 				     enum sta_notify_cmd cmd,
2766 				     struct ieee80211_sta *sta)
2767 {
2768 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2769 	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
2770 	unsigned long txqs = 0, tids = 0;
2771 	int tid;
2772 
2773 	/*
2774 	 * If we have TVQM then we get too high queue numbers - luckily
2775 	 * we really shouldn't get here with that because such hardware
2776 	 * should have firmware supporting buffer station offload.
2777 	 */
2778 	if (WARN_ON(iwl_mvm_has_new_tx_api(mvm)))
2779 		return;
2780 
2781 	spin_lock_bh(&mvmsta->lock);
2782 	for (tid = 0; tid < ARRAY_SIZE(mvmsta->tid_data); tid++) {
2783 		struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
2784 
2785 		if (tid_data->txq_id == IWL_MVM_INVALID_QUEUE)
2786 			continue;
2787 
2788 		__set_bit(tid_data->txq_id, &txqs);
2789 
2790 		if (iwl_mvm_tid_queued(mvm, tid_data) == 0)
2791 			continue;
2792 
2793 		__set_bit(tid, &tids);
2794 	}
2795 
2796 	switch (cmd) {
2797 	case STA_NOTIFY_SLEEP:
2798 		for_each_set_bit(tid, &tids, IWL_MAX_TID_COUNT)
2799 			ieee80211_sta_set_buffered(sta, tid, true);
2800 
2801 		if (txqs)
2802 			iwl_trans_freeze_txq_timer(mvm->trans, txqs, true);
2803 		/*
2804 		 * The fw updates the STA to be asleep. Tx packets on the Tx
2805 		 * queues to this station will not be transmitted. The fw will
2806 		 * send a Tx response with TX_STATUS_FAIL_DEST_PS.
2807 		 */
2808 		break;
2809 	case STA_NOTIFY_AWAKE:
2810 		if (WARN_ON(mvmsta->sta_id == IWL_MVM_INVALID_STA))
2811 			break;
2812 
2813 		if (txqs)
2814 			iwl_trans_freeze_txq_timer(mvm->trans, txqs, false);
2815 		iwl_mvm_sta_modify_ps_wake(mvm, sta);
2816 		break;
2817 	default:
2818 		break;
2819 	}
2820 	spin_unlock_bh(&mvmsta->lock);
2821 }
2822 
2823 static void iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
2824 				   struct ieee80211_vif *vif,
2825 				   enum sta_notify_cmd cmd,
2826 				   struct ieee80211_sta *sta)
2827 {
2828 	__iwl_mvm_mac_sta_notify(hw, cmd, sta);
2829 }
2830 
2831 void iwl_mvm_sta_pm_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
2832 {
2833 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
2834 	struct iwl_mvm_pm_state_notification *notif = (void *)pkt->data;
2835 	struct ieee80211_sta *sta;
2836 	struct iwl_mvm_sta *mvmsta;
2837 	bool sleeping = (notif->type != IWL_MVM_PM_EVENT_AWAKE);
2838 
2839 	if (WARN_ON(notif->sta_id >= ARRAY_SIZE(mvm->fw_id_to_mac_id)))
2840 		return;
2841 
2842 	rcu_read_lock();
2843 	sta = rcu_dereference(mvm->fw_id_to_mac_id[notif->sta_id]);
2844 	if (WARN_ON(IS_ERR_OR_NULL(sta))) {
2845 		rcu_read_unlock();
2846 		return;
2847 	}
2848 
2849 	mvmsta = iwl_mvm_sta_from_mac80211(sta);
2850 
2851 	if (!mvmsta->vif ||
2852 	    mvmsta->vif->type != NL80211_IFTYPE_AP) {
2853 		rcu_read_unlock();
2854 		return;
2855 	}
2856 
2857 	if (mvmsta->sleeping != sleeping) {
2858 		mvmsta->sleeping = sleeping;
2859 		__iwl_mvm_mac_sta_notify(mvm->hw,
2860 			sleeping ? STA_NOTIFY_SLEEP : STA_NOTIFY_AWAKE,
2861 			sta);
2862 		ieee80211_sta_ps_transition(sta, sleeping);
2863 	}
2864 
2865 	if (sleeping) {
2866 		switch (notif->type) {
2867 		case IWL_MVM_PM_EVENT_AWAKE:
2868 		case IWL_MVM_PM_EVENT_ASLEEP:
2869 			break;
2870 		case IWL_MVM_PM_EVENT_UAPSD:
2871 			ieee80211_sta_uapsd_trigger(sta, IEEE80211_NUM_TIDS);
2872 			break;
2873 		case IWL_MVM_PM_EVENT_PS_POLL:
2874 			ieee80211_sta_pspoll(sta);
2875 			break;
2876 		default:
2877 			break;
2878 		}
2879 	}
2880 
2881 	rcu_read_unlock();
2882 }
2883 
2884 static void iwl_mvm_sta_pre_rcu_remove(struct ieee80211_hw *hw,
2885 				       struct ieee80211_vif *vif,
2886 				       struct ieee80211_sta *sta)
2887 {
2888 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2889 	struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
2890 
2891 	/*
2892 	 * This is called before mac80211 does RCU synchronisation,
2893 	 * so here we already invalidate our internal RCU-protected
2894 	 * station pointer. The rest of the code will thus no longer
2895 	 * be able to find the station this way, and we don't rely
2896 	 * on further RCU synchronisation after the sta_state()
2897 	 * callback deleted the station.
2898 	 */
2899 	mutex_lock(&mvm->mutex);
2900 	if (sta == rcu_access_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id]))
2901 		rcu_assign_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id],
2902 				   ERR_PTR(-ENOENT));
2903 
2904 	mutex_unlock(&mvm->mutex);
2905 }
2906 
2907 static void iwl_mvm_check_uapsd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
2908 				const u8 *bssid)
2909 {
2910 	int i;
2911 
2912 	if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
2913 		struct iwl_mvm_tcm_mac *mdata;
2914 
2915 		mdata = &mvm->tcm.data[iwl_mvm_vif_from_mac80211(vif)->id];
2916 		ewma_rate_init(&mdata->uapsd_nonagg_detect.rate);
2917 		mdata->opened_rx_ba_sessions = false;
2918 	}
2919 
2920 	if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT))
2921 		return;
2922 
2923 	if (vif->p2p && !iwl_mvm_is_p2p_scm_uapsd_supported(mvm)) {
2924 		vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2925 		return;
2926 	}
2927 
2928 	if (!vif->p2p &&
2929 	    (iwlwifi_mod_params.uapsd_disable & IWL_DISABLE_UAPSD_BSS)) {
2930 		vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2931 		return;
2932 	}
2933 
2934 	for (i = 0; i < IWL_MVM_UAPSD_NOAGG_LIST_LEN; i++) {
2935 		if (ether_addr_equal(mvm->uapsd_noagg_bssids[i].addr, bssid)) {
2936 			vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2937 			return;
2938 		}
2939 	}
2940 
2941 	vif->driver_flags |= IEEE80211_VIF_SUPPORTS_UAPSD;
2942 }
2943 
2944 static void
2945 iwl_mvm_tdls_check_trigger(struct iwl_mvm *mvm,
2946 			   struct ieee80211_vif *vif, u8 *peer_addr,
2947 			   enum nl80211_tdls_operation action)
2948 {
2949 	struct iwl_fw_dbg_trigger_tlv *trig;
2950 	struct iwl_fw_dbg_trigger_tdls *tdls_trig;
2951 
2952 	trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
2953 				     FW_DBG_TRIGGER_TDLS);
2954 	if (!trig)
2955 		return;
2956 
2957 	tdls_trig = (void *)trig->data;
2958 
2959 	if (!(tdls_trig->action_bitmap & BIT(action)))
2960 		return;
2961 
2962 	if (tdls_trig->peer_mode &&
2963 	    memcmp(tdls_trig->peer, peer_addr, ETH_ALEN) != 0)
2964 		return;
2965 
2966 	iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
2967 				"TDLS event occurred, peer %pM, action %d",
2968 				peer_addr, action);
2969 }
2970 
2971 struct iwl_mvm_he_obss_narrow_bw_ru_data {
2972 	bool tolerated;
2973 };
2974 
2975 static void iwl_mvm_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
2976 						    struct cfg80211_bss *bss,
2977 						    void *_data)
2978 {
2979 	struct iwl_mvm_he_obss_narrow_bw_ru_data *data = _data;
2980 	const struct element *elem;
2981 
2982 	elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY, bss->ies->data,
2983 				  bss->ies->len);
2984 
2985 	if (!elem || elem->datalen < 10 ||
2986 	    !(elem->data[10] &
2987 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT)) {
2988 		data->tolerated = false;
2989 	}
2990 }
2991 
2992 static void iwl_mvm_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
2993 					       struct ieee80211_vif *vif)
2994 {
2995 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2996 	struct iwl_mvm_he_obss_narrow_bw_ru_data iter_data = {
2997 		.tolerated = true,
2998 	};
2999 
3000 	if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR)) {
3001 		mvmvif->he_ru_2mhz_block = false;
3002 		return;
3003 	}
3004 
3005 	cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
3006 			  iwl_mvm_check_he_obss_narrow_bw_ru_iter,
3007 			  &iter_data);
3008 
3009 	/*
3010 	 * If there is at least one AP on radar channel that cannot
3011 	 * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
3012 	 */
3013 	mvmvif->he_ru_2mhz_block = !iter_data.tolerated;
3014 }
3015 
3016 static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
3017 				 struct ieee80211_vif *vif,
3018 				 struct ieee80211_sta *sta,
3019 				 enum ieee80211_sta_state old_state,
3020 				 enum ieee80211_sta_state new_state)
3021 {
3022 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3023 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3024 	struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
3025 	int ret;
3026 
3027 	IWL_DEBUG_MAC80211(mvm, "station %pM state change %d->%d\n",
3028 			   sta->addr, old_state, new_state);
3029 
3030 	/* this would be a mac80211 bug ... but don't crash */
3031 	if (WARN_ON_ONCE(!mvmvif->phy_ctxt))
3032 		return -EINVAL;
3033 
3034 	/*
3035 	 * If we are in a STA removal flow and in DQA mode:
3036 	 *
3037 	 * This is after the sync_rcu part, so the queues have already been
3038 	 * flushed. No more TXs on their way in mac80211's path, and no more in
3039 	 * the queues.
3040 	 * Also, we won't be getting any new TX frames for this station.
3041 	 * What we might have are deferred TX frames that need to be taken care
3042 	 * of.
3043 	 *
3044 	 * Drop any still-queued deferred-frame before removing the STA, and
3045 	 * make sure the worker is no longer handling frames for this STA.
3046 	 */
3047 	if (old_state == IEEE80211_STA_NONE &&
3048 	    new_state == IEEE80211_STA_NOTEXIST) {
3049 		flush_work(&mvm->add_stream_wk);
3050 
3051 		/*
3052 		 * No need to make sure deferred TX indication is off since the
3053 		 * worker will already remove it if it was on
3054 		 */
3055 	}
3056 
3057 	mutex_lock(&mvm->mutex);
3058 	/* track whether or not the station is associated */
3059 	mvm_sta->sta_state = new_state;
3060 
3061 	if (old_state == IEEE80211_STA_NOTEXIST &&
3062 	    new_state == IEEE80211_STA_NONE) {
3063 		/*
3064 		 * Firmware bug - it'll crash if the beacon interval is less
3065 		 * than 16. We can't avoid connecting at all, so refuse the
3066 		 * station state change, this will cause mac80211 to abandon
3067 		 * attempts to connect to this AP, and eventually wpa_s will
3068 		 * blacklist the AP...
3069 		 */
3070 		if (vif->type == NL80211_IFTYPE_STATION &&
3071 		    vif->bss_conf.beacon_int < 16) {
3072 			IWL_ERR(mvm,
3073 				"AP %pM beacon interval is %d, refusing due to firmware bug!\n",
3074 				sta->addr, vif->bss_conf.beacon_int);
3075 			ret = -EINVAL;
3076 			goto out_unlock;
3077 		}
3078 
3079 		if (sta->tdls &&
3080 		    (vif->p2p ||
3081 		     iwl_mvm_tdls_sta_count(mvm, NULL) ==
3082 						IWL_MVM_TDLS_STA_COUNT ||
3083 		     iwl_mvm_phy_ctx_count(mvm) > 1)) {
3084 			IWL_DEBUG_MAC80211(mvm, "refusing TDLS sta\n");
3085 			ret = -EBUSY;
3086 			goto out_unlock;
3087 		}
3088 
3089 		ret = iwl_mvm_add_sta(mvm, vif, sta);
3090 		if (sta->tdls && ret == 0) {
3091 			iwl_mvm_recalc_tdls_state(mvm, vif, true);
3092 			iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3093 						   NL80211_TDLS_SETUP);
3094 		}
3095 
3096 		sta->max_rc_amsdu_len = 1;
3097 	} else if (old_state == IEEE80211_STA_NONE &&
3098 		   new_state == IEEE80211_STA_AUTH) {
3099 		/*
3100 		 * EBS may be disabled due to previous failures reported by FW.
3101 		 * Reset EBS status here assuming environment has been changed.
3102 		 */
3103 		mvm->last_ebs_successful = true;
3104 		iwl_mvm_check_uapsd(mvm, vif, sta->addr);
3105 		ret = 0;
3106 	} else if (old_state == IEEE80211_STA_AUTH &&
3107 		   new_state == IEEE80211_STA_ASSOC) {
3108 		if (vif->type == NL80211_IFTYPE_AP) {
3109 			vif->bss_conf.he_support = sta->he_cap.has_he;
3110 			mvmvif->ap_assoc_sta_count++;
3111 			iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3112 			if (vif->bss_conf.he_support &&
3113 			    !iwlwifi_mod_params.disable_11ax)
3114 				iwl_mvm_cfg_he_sta(mvm, vif, mvm_sta->sta_id);
3115 		} else if (vif->type == NL80211_IFTYPE_STATION) {
3116 			vif->bss_conf.he_support = sta->he_cap.has_he;
3117 
3118 			mvmvif->he_ru_2mhz_block = false;
3119 			if (sta->he_cap.has_he)
3120 				iwl_mvm_check_he_obss_narrow_bw_ru(hw, vif);
3121 
3122 			iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3123 		}
3124 
3125 		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3126 				     false);
3127 		ret = iwl_mvm_update_sta(mvm, vif, sta);
3128 	} else if (old_state == IEEE80211_STA_ASSOC &&
3129 		   new_state == IEEE80211_STA_AUTHORIZED) {
3130 		ret = 0;
3131 
3132 		/* we don't support TDLS during DCM */
3133 		if (iwl_mvm_phy_ctx_count(mvm) > 1)
3134 			iwl_mvm_teardown_tdls_peers(mvm);
3135 
3136 		if (sta->tdls)
3137 			iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3138 						   NL80211_TDLS_ENABLE_LINK);
3139 
3140 		/* enable beacon filtering */
3141 		WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
3142 
3143 		/*
3144 		 * Now that the station is authorized, i.e., keys were already
3145 		 * installed, need to indicate to the FW that
3146 		 * multicast data frames can be forwarded to the driver
3147 		 */
3148 		iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3149 
3150 		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3151 				     true);
3152 	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
3153 		   new_state == IEEE80211_STA_ASSOC) {
3154 		/* Multicast data frames are no longer allowed */
3155 		iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3156 
3157 		/* disable beacon filtering */
3158 		ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
3159 		WARN_ON(ret &&
3160 			!test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
3161 				  &mvm->status));
3162 		ret = 0;
3163 	} else if (old_state == IEEE80211_STA_ASSOC &&
3164 		   new_state == IEEE80211_STA_AUTH) {
3165 		if (vif->type == NL80211_IFTYPE_AP) {
3166 			mvmvif->ap_assoc_sta_count--;
3167 			iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3168 		}
3169 		ret = 0;
3170 	} else if (old_state == IEEE80211_STA_AUTH &&
3171 		   new_state == IEEE80211_STA_NONE) {
3172 		ret = 0;
3173 	} else if (old_state == IEEE80211_STA_NONE &&
3174 		   new_state == IEEE80211_STA_NOTEXIST) {
3175 		ret = iwl_mvm_rm_sta(mvm, vif, sta);
3176 		if (sta->tdls) {
3177 			iwl_mvm_recalc_tdls_state(mvm, vif, false);
3178 			iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3179 						   NL80211_TDLS_DISABLE_LINK);
3180 		}
3181 
3182 		if (unlikely(ret &&
3183 			     test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
3184 				      &mvm->status)))
3185 			ret = 0;
3186 	} else {
3187 		ret = -EIO;
3188 	}
3189  out_unlock:
3190 	mutex_unlock(&mvm->mutex);
3191 
3192 	if (sta->tdls && ret == 0) {
3193 		if (old_state == IEEE80211_STA_NOTEXIST &&
3194 		    new_state == IEEE80211_STA_NONE)
3195 			ieee80211_reserve_tid(sta, IWL_MVM_TDLS_FW_TID);
3196 		else if (old_state == IEEE80211_STA_NONE &&
3197 			 new_state == IEEE80211_STA_NOTEXIST)
3198 			ieee80211_unreserve_tid(sta, IWL_MVM_TDLS_FW_TID);
3199 	}
3200 
3201 	return ret;
3202 }
3203 
3204 static int iwl_mvm_mac_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
3205 {
3206 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3207 
3208 	mvm->rts_threshold = value;
3209 
3210 	return 0;
3211 }
3212 
3213 static void iwl_mvm_sta_rc_update(struct ieee80211_hw *hw,
3214 				  struct ieee80211_vif *vif,
3215 				  struct ieee80211_sta *sta, u32 changed)
3216 {
3217 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3218 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3219 
3220 	if (changed & (IEEE80211_RC_BW_CHANGED |
3221 		       IEEE80211_RC_SUPP_RATES_CHANGED |
3222 		       IEEE80211_RC_NSS_CHANGED))
3223 		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3224 				     true);
3225 
3226 	if (vif->type == NL80211_IFTYPE_STATION &&
3227 	    changed & IEEE80211_RC_NSS_CHANGED)
3228 		iwl_mvm_sf_update(mvm, vif, false);
3229 }
3230 
3231 static int iwl_mvm_mac_conf_tx(struct ieee80211_hw *hw,
3232 			       struct ieee80211_vif *vif, u16 ac,
3233 			       const struct ieee80211_tx_queue_params *params)
3234 {
3235 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3236 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3237 
3238 	mvmvif->queue_params[ac] = *params;
3239 
3240 	/*
3241 	 * No need to update right away, we'll get BSS_CHANGED_QOS
3242 	 * The exception is P2P_DEVICE interface which needs immediate update.
3243 	 */
3244 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
3245 		int ret;
3246 
3247 		mutex_lock(&mvm->mutex);
3248 		ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3249 		mutex_unlock(&mvm->mutex);
3250 		return ret;
3251 	}
3252 	return 0;
3253 }
3254 
3255 static void iwl_mvm_mac_mgd_prepare_tx(struct ieee80211_hw *hw,
3256 				       struct ieee80211_vif *vif,
3257 				       u16 req_duration)
3258 {
3259 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3260 	u32 duration = IWL_MVM_TE_SESSION_PROTECTION_MAX_TIME_MS;
3261 	u32 min_duration = IWL_MVM_TE_SESSION_PROTECTION_MIN_TIME_MS;
3262 
3263 	if (req_duration > duration)
3264 		duration = req_duration;
3265 
3266 	mutex_lock(&mvm->mutex);
3267 	/* Try really hard to protect the session and hear a beacon
3268 	 * The new session protection command allows us to protect the
3269 	 * session for a much longer time since the firmware will internally
3270 	 * create two events: a 300TU one with a very high priority that
3271 	 * won't be fragmented which should be enough for 99% of the cases,
3272 	 * and another one (which we configure here to be 900TU long) which
3273 	 * will have a slightly lower priority, but more importantly, can be
3274 	 * fragmented so that it'll allow other activities to run.
3275 	 */
3276 	if (fw_has_capa(&mvm->fw->ucode_capa,
3277 			IWL_UCODE_TLV_CAPA_SESSION_PROT_CMD))
3278 		iwl_mvm_schedule_session_protection(mvm, vif, 900,
3279 						    min_duration);
3280 	else
3281 		iwl_mvm_protect_session(mvm, vif, duration,
3282 					min_duration, 500, false);
3283 	mutex_unlock(&mvm->mutex);
3284 }
3285 
3286 static int iwl_mvm_mac_sched_scan_start(struct ieee80211_hw *hw,
3287 					struct ieee80211_vif *vif,
3288 					struct cfg80211_sched_scan_request *req,
3289 					struct ieee80211_scan_ies *ies)
3290 {
3291 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3292 
3293 	int ret;
3294 
3295 	mutex_lock(&mvm->mutex);
3296 
3297 	if (!vif->bss_conf.idle) {
3298 		ret = -EBUSY;
3299 		goto out;
3300 	}
3301 
3302 	ret = iwl_mvm_sched_scan_start(mvm, vif, req, ies, IWL_MVM_SCAN_SCHED);
3303 
3304 out:
3305 	mutex_unlock(&mvm->mutex);
3306 	return ret;
3307 }
3308 
3309 static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
3310 				       struct ieee80211_vif *vif)
3311 {
3312 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3313 	int ret;
3314 
3315 	mutex_lock(&mvm->mutex);
3316 
3317 	/* Due to a race condition, it's possible that mac80211 asks
3318 	 * us to stop a sched_scan when it's already stopped.  This
3319 	 * can happen, for instance, if we stopped the scan ourselves,
3320 	 * called ieee80211_sched_scan_stopped() and the userspace called
3321 	 * stop sched scan scan before ieee80211_sched_scan_stopped_work()
3322 	 * could run.  To handle this, simply return if the scan is
3323 	 * not running.
3324 	*/
3325 	if (!(mvm->scan_status & IWL_MVM_SCAN_SCHED)) {
3326 		mutex_unlock(&mvm->mutex);
3327 		return 0;
3328 	}
3329 
3330 	ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, false);
3331 	mutex_unlock(&mvm->mutex);
3332 	iwl_mvm_wait_for_async_handlers(mvm);
3333 
3334 	return ret;
3335 }
3336 
3337 static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
3338 				 enum set_key_cmd cmd,
3339 				 struct ieee80211_vif *vif,
3340 				 struct ieee80211_sta *sta,
3341 				 struct ieee80211_key_conf *key)
3342 {
3343 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3344 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3345 	struct iwl_mvm_sta *mvmsta;
3346 	struct iwl_mvm_key_pn *ptk_pn;
3347 	int keyidx = key->keyidx;
3348 	int ret, i;
3349 	u8 key_offset;
3350 
3351 	if (iwlwifi_mod_params.swcrypto) {
3352 		IWL_DEBUG_MAC80211(mvm, "leave - hwcrypto disabled\n");
3353 		return -EOPNOTSUPP;
3354 	}
3355 
3356 	switch (key->cipher) {
3357 	case WLAN_CIPHER_SUITE_TKIP:
3358 		if (!mvm->trans->trans_cfg->gen2) {
3359 			key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3360 			key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3361 		} else if (vif->type == NL80211_IFTYPE_STATION) {
3362 			key->flags |= IEEE80211_KEY_FLAG_PUT_MIC_SPACE;
3363 		} else {
3364 			IWL_DEBUG_MAC80211(mvm, "Use SW encryption for TKIP\n");
3365 			return -EOPNOTSUPP;
3366 		}
3367 		break;
3368 	case WLAN_CIPHER_SUITE_CCMP:
3369 	case WLAN_CIPHER_SUITE_GCMP:
3370 	case WLAN_CIPHER_SUITE_GCMP_256:
3371 		if (!iwl_mvm_has_new_tx_api(mvm))
3372 			key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3373 		break;
3374 	case WLAN_CIPHER_SUITE_AES_CMAC:
3375 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
3376 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
3377 		WARN_ON_ONCE(!ieee80211_hw_check(hw, MFP_CAPABLE));
3378 		break;
3379 	case WLAN_CIPHER_SUITE_WEP40:
3380 	case WLAN_CIPHER_SUITE_WEP104:
3381 		if (vif->type == NL80211_IFTYPE_STATION)
3382 			break;
3383 		if (iwl_mvm_has_new_tx_api(mvm))
3384 			return -EOPNOTSUPP;
3385 		/* support HW crypto on TX */
3386 		return 0;
3387 	default:
3388 		/* currently FW supports only one optional cipher scheme */
3389 		if (hw->n_cipher_schemes &&
3390 		    hw->cipher_schemes->cipher == key->cipher)
3391 			key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3392 		else
3393 			return -EOPNOTSUPP;
3394 	}
3395 
3396 	switch (cmd) {
3397 	case SET_KEY:
3398 		if ((vif->type == NL80211_IFTYPE_ADHOC ||
3399 		     vif->type == NL80211_IFTYPE_AP) && !sta) {
3400 			/*
3401 			 * GTK on AP interface is a TX-only key, return 0;
3402 			 * on IBSS they're per-station and because we're lazy
3403 			 * we don't support them for RX, so do the same.
3404 			 * CMAC/GMAC in AP/IBSS modes must be done in software.
3405 			 */
3406 			if (key->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
3407 			    key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
3408 			    key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256)
3409 				ret = -EOPNOTSUPP;
3410 			else
3411 				ret = 0;
3412 
3413 			if (key->cipher != WLAN_CIPHER_SUITE_GCMP &&
3414 			    key->cipher != WLAN_CIPHER_SUITE_GCMP_256 &&
3415 			    !iwl_mvm_has_new_tx_api(mvm)) {
3416 				key->hw_key_idx = STA_KEY_IDX_INVALID;
3417 				break;
3418 			}
3419 
3420 			if (!mvmvif->ap_ibss_active) {
3421 				for (i = 0;
3422 				     i < ARRAY_SIZE(mvmvif->ap_early_keys);
3423 				     i++) {
3424 					if (!mvmvif->ap_early_keys[i]) {
3425 						mvmvif->ap_early_keys[i] = key;
3426 						break;
3427 					}
3428 				}
3429 
3430 				if (i >= ARRAY_SIZE(mvmvif->ap_early_keys))
3431 					ret = -ENOSPC;
3432 
3433 				break;
3434 			}
3435 		}
3436 
3437 		/* During FW restart, in order to restore the state as it was,
3438 		 * don't try to reprogram keys we previously failed for.
3439 		 */
3440 		if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
3441 		    key->hw_key_idx == STA_KEY_IDX_INVALID) {
3442 			IWL_DEBUG_MAC80211(mvm,
3443 					   "skip invalid idx key programming during restart\n");
3444 			ret = 0;
3445 			break;
3446 		}
3447 
3448 		if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
3449 		    sta && iwl_mvm_has_new_rx_api(mvm) &&
3450 		    key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
3451 		    (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
3452 		     key->cipher == WLAN_CIPHER_SUITE_GCMP ||
3453 		     key->cipher == WLAN_CIPHER_SUITE_GCMP_256)) {
3454 			struct ieee80211_key_seq seq;
3455 			int tid, q;
3456 
3457 			mvmsta = iwl_mvm_sta_from_mac80211(sta);
3458 			WARN_ON(rcu_access_pointer(mvmsta->ptk_pn[keyidx]));
3459 			ptk_pn = kzalloc(struct_size(ptk_pn, q,
3460 						     mvm->trans->num_rx_queues),
3461 					 GFP_KERNEL);
3462 			if (!ptk_pn) {
3463 				ret = -ENOMEM;
3464 				break;
3465 			}
3466 
3467 			for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++) {
3468 				ieee80211_get_key_rx_seq(key, tid, &seq);
3469 				for (q = 0; q < mvm->trans->num_rx_queues; q++)
3470 					memcpy(ptk_pn->q[q].pn[tid],
3471 					       seq.ccmp.pn,
3472 					       IEEE80211_CCMP_PN_LEN);
3473 			}
3474 
3475 			rcu_assign_pointer(mvmsta->ptk_pn[keyidx], ptk_pn);
3476 		}
3477 
3478 		/* in HW restart reuse the index, otherwise request a new one */
3479 		if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
3480 			key_offset = key->hw_key_idx;
3481 		else
3482 			key_offset = STA_KEY_IDX_INVALID;
3483 
3484 		IWL_DEBUG_MAC80211(mvm, "set hwcrypto key\n");
3485 		ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, key_offset);
3486 		if (ret) {
3487 			IWL_WARN(mvm, "set key failed\n");
3488 			key->hw_key_idx = STA_KEY_IDX_INVALID;
3489 			/*
3490 			 * can't add key for RX, but we don't need it
3491 			 * in the device for TX so still return 0,
3492 			 * unless we have new TX API where we cannot
3493 			 * put key material into the TX_CMD
3494 			 */
3495 			if (iwl_mvm_has_new_tx_api(mvm))
3496 				ret = -EOPNOTSUPP;
3497 			else
3498 				ret = 0;
3499 		}
3500 
3501 		break;
3502 	case DISABLE_KEY:
3503 		ret = -ENOENT;
3504 		for (i = 0; i < ARRAY_SIZE(mvmvif->ap_early_keys); i++) {
3505 			if (mvmvif->ap_early_keys[i] == key) {
3506 				mvmvif->ap_early_keys[i] = NULL;
3507 				ret = 0;
3508 			}
3509 		}
3510 
3511 		/* found in pending list - don't do anything else */
3512 		if (ret == 0)
3513 			break;
3514 
3515 		if (key->hw_key_idx == STA_KEY_IDX_INVALID) {
3516 			ret = 0;
3517 			break;
3518 		}
3519 
3520 		if (sta && iwl_mvm_has_new_rx_api(mvm) &&
3521 		    key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
3522 		    (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
3523 		     key->cipher == WLAN_CIPHER_SUITE_GCMP ||
3524 		     key->cipher == WLAN_CIPHER_SUITE_GCMP_256)) {
3525 			mvmsta = iwl_mvm_sta_from_mac80211(sta);
3526 			ptk_pn = rcu_dereference_protected(
3527 						mvmsta->ptk_pn[keyidx],
3528 						lockdep_is_held(&mvm->mutex));
3529 			RCU_INIT_POINTER(mvmsta->ptk_pn[keyidx], NULL);
3530 			if (ptk_pn)
3531 				kfree_rcu(ptk_pn, rcu_head);
3532 		}
3533 
3534 		IWL_DEBUG_MAC80211(mvm, "disable hwcrypto key\n");
3535 		ret = iwl_mvm_remove_sta_key(mvm, vif, sta, key);
3536 		break;
3537 	default:
3538 		ret = -EINVAL;
3539 	}
3540 
3541 	return ret;
3542 }
3543 
3544 static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
3545 			       enum set_key_cmd cmd,
3546 			       struct ieee80211_vif *vif,
3547 			       struct ieee80211_sta *sta,
3548 			       struct ieee80211_key_conf *key)
3549 {
3550 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3551 	int ret;
3552 
3553 	mutex_lock(&mvm->mutex);
3554 	ret = __iwl_mvm_mac_set_key(hw, cmd, vif, sta, key);
3555 	mutex_unlock(&mvm->mutex);
3556 
3557 	return ret;
3558 }
3559 
3560 static void iwl_mvm_mac_update_tkip_key(struct ieee80211_hw *hw,
3561 					struct ieee80211_vif *vif,
3562 					struct ieee80211_key_conf *keyconf,
3563 					struct ieee80211_sta *sta,
3564 					u32 iv32, u16 *phase1key)
3565 {
3566 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3567 
3568 	if (keyconf->hw_key_idx == STA_KEY_IDX_INVALID)
3569 		return;
3570 
3571 	iwl_mvm_update_tkip_key(mvm, vif, keyconf, sta, iv32, phase1key);
3572 }
3573 
3574 
3575 static bool iwl_mvm_rx_aux_roc(struct iwl_notif_wait_data *notif_wait,
3576 			       struct iwl_rx_packet *pkt, void *data)
3577 {
3578 	struct iwl_mvm *mvm =
3579 		container_of(notif_wait, struct iwl_mvm, notif_wait);
3580 	struct iwl_hs20_roc_res *resp;
3581 	int resp_len = iwl_rx_packet_payload_len(pkt);
3582 	struct iwl_mvm_time_event_data *te_data = data;
3583 
3584 	if (WARN_ON(pkt->hdr.cmd != HOT_SPOT_CMD))
3585 		return true;
3586 
3587 	if (WARN_ON_ONCE(resp_len != sizeof(*resp))) {
3588 		IWL_ERR(mvm, "Invalid HOT_SPOT_CMD response\n");
3589 		return true;
3590 	}
3591 
3592 	resp = (void *)pkt->data;
3593 
3594 	IWL_DEBUG_TE(mvm,
3595 		     "Aux ROC: Received response from ucode: status=%d uid=%d\n",
3596 		     resp->status, resp->event_unique_id);
3597 
3598 	te_data->uid = le32_to_cpu(resp->event_unique_id);
3599 	IWL_DEBUG_TE(mvm, "TIME_EVENT_CMD response - UID = 0x%x\n",
3600 		     te_data->uid);
3601 
3602 	spin_lock_bh(&mvm->time_event_lock);
3603 	list_add_tail(&te_data->list, &mvm->aux_roc_te_list);
3604 	spin_unlock_bh(&mvm->time_event_lock);
3605 
3606 	return true;
3607 }
3608 
3609 #define AUX_ROC_MIN_DURATION MSEC_TO_TU(100)
3610 #define AUX_ROC_MIN_DELAY MSEC_TO_TU(200)
3611 #define AUX_ROC_MAX_DELAY MSEC_TO_TU(600)
3612 #define AUX_ROC_SAFETY_BUFFER MSEC_TO_TU(20)
3613 #define AUX_ROC_MIN_SAFETY_BUFFER MSEC_TO_TU(10)
3614 static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm,
3615 				    struct ieee80211_channel *channel,
3616 				    struct ieee80211_vif *vif,
3617 				    int duration)
3618 {
3619 	int res;
3620 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3621 	struct iwl_mvm_time_event_data *te_data = &mvmvif->hs_time_event_data;
3622 	static const u16 time_event_response[] = { HOT_SPOT_CMD };
3623 	struct iwl_notification_wait wait_time_event;
3624 	u32 dtim_interval = vif->bss_conf.dtim_period *
3625 		vif->bss_conf.beacon_int;
3626 	u32 req_dur, delay;
3627 	struct iwl_hs20_roc_req aux_roc_req = {
3628 		.action = cpu_to_le32(FW_CTXT_ACTION_ADD),
3629 		.id_and_color =
3630 			cpu_to_le32(FW_CMD_ID_AND_COLOR(MAC_INDEX_AUX, 0)),
3631 		.sta_id_and_color = cpu_to_le32(mvm->aux_sta.sta_id),
3632 	};
3633 	struct iwl_hs20_roc_req_tail *tail = iwl_mvm_chan_info_cmd_tail(mvm,
3634 		&aux_roc_req.channel_info);
3635 	u16 len = sizeof(aux_roc_req) - iwl_mvm_chan_info_padding(mvm);
3636 
3637 	/* Set the channel info data */
3638 	iwl_mvm_set_chan_info(mvm, &aux_roc_req.channel_info, channel->hw_value,
3639 			      iwl_mvm_phy_band_from_nl80211(channel->band),
3640 			      PHY_VHT_CHANNEL_MODE20,
3641 			      0);
3642 
3643 	/* Set the time and duration */
3644 	tail->apply_time = cpu_to_le32(iwl_mvm_get_systime(mvm));
3645 
3646 	delay = AUX_ROC_MIN_DELAY;
3647 	req_dur = MSEC_TO_TU(duration);
3648 
3649 	/*
3650 	 * If we are associated we want the delay time to be at least one
3651 	 * dtim interval so that the FW can wait until after the DTIM and
3652 	 * then start the time event, this will potentially allow us to
3653 	 * remain off-channel for the max duration.
3654 	 * Since we want to use almost a whole dtim interval we would also
3655 	 * like the delay to be for 2-3 dtim intervals, in case there are
3656 	 * other time events with higher priority.
3657 	 */
3658 	if (vif->bss_conf.assoc) {
3659 		delay = min_t(u32, dtim_interval * 3, AUX_ROC_MAX_DELAY);
3660 		/* We cannot remain off-channel longer than the DTIM interval */
3661 		if (dtim_interval <= req_dur) {
3662 			req_dur = dtim_interval - AUX_ROC_SAFETY_BUFFER;
3663 			if (req_dur <= AUX_ROC_MIN_DURATION)
3664 				req_dur = dtim_interval -
3665 					AUX_ROC_MIN_SAFETY_BUFFER;
3666 		}
3667 	}
3668 
3669 	tail->duration = cpu_to_le32(req_dur);
3670 	tail->apply_time_max_delay = cpu_to_le32(delay);
3671 
3672 	IWL_DEBUG_TE(mvm,
3673 		     "ROC: Requesting to remain on channel %u for %ums (requested = %ums, max_delay = %ums, dtim_interval = %ums)\n",
3674 		     channel->hw_value, req_dur, duration, delay,
3675 		     dtim_interval);
3676 	/* Set the node address */
3677 	memcpy(tail->node_addr, vif->addr, ETH_ALEN);
3678 
3679 	lockdep_assert_held(&mvm->mutex);
3680 
3681 	spin_lock_bh(&mvm->time_event_lock);
3682 
3683 	if (WARN_ON(te_data->id == HOT_SPOT_CMD)) {
3684 		spin_unlock_bh(&mvm->time_event_lock);
3685 		return -EIO;
3686 	}
3687 
3688 	te_data->vif = vif;
3689 	te_data->duration = duration;
3690 	te_data->id = HOT_SPOT_CMD;
3691 
3692 	spin_unlock_bh(&mvm->time_event_lock);
3693 
3694 	/*
3695 	 * Use a notification wait, which really just processes the
3696 	 * command response and doesn't wait for anything, in order
3697 	 * to be able to process the response and get the UID inside
3698 	 * the RX path. Using CMD_WANT_SKB doesn't work because it
3699 	 * stores the buffer and then wakes up this thread, by which
3700 	 * time another notification (that the time event started)
3701 	 * might already be processed unsuccessfully.
3702 	 */
3703 	iwl_init_notification_wait(&mvm->notif_wait, &wait_time_event,
3704 				   time_event_response,
3705 				   ARRAY_SIZE(time_event_response),
3706 				   iwl_mvm_rx_aux_roc, te_data);
3707 
3708 	res = iwl_mvm_send_cmd_pdu(mvm, HOT_SPOT_CMD, 0, len,
3709 				   &aux_roc_req);
3710 
3711 	if (res) {
3712 		IWL_ERR(mvm, "Couldn't send HOT_SPOT_CMD: %d\n", res);
3713 		iwl_remove_notification(&mvm->notif_wait, &wait_time_event);
3714 		goto out_clear_te;
3715 	}
3716 
3717 	/* No need to wait for anything, so just pass 1 (0 isn't valid) */
3718 	res = iwl_wait_notification(&mvm->notif_wait, &wait_time_event, 1);
3719 	/* should never fail */
3720 	WARN_ON_ONCE(res);
3721 
3722 	if (res) {
3723  out_clear_te:
3724 		spin_lock_bh(&mvm->time_event_lock);
3725 		iwl_mvm_te_clear_data(mvm, te_data);
3726 		spin_unlock_bh(&mvm->time_event_lock);
3727 	}
3728 
3729 	return res;
3730 }
3731 
3732 static int iwl_mvm_roc(struct ieee80211_hw *hw,
3733 		       struct ieee80211_vif *vif,
3734 		       struct ieee80211_channel *channel,
3735 		       int duration,
3736 		       enum ieee80211_roc_type type)
3737 {
3738 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3739 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3740 	struct cfg80211_chan_def chandef;
3741 	struct iwl_mvm_phy_ctxt *phy_ctxt;
3742 	int ret, i;
3743 
3744 	IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value,
3745 			   duration, type);
3746 
3747 	/*
3748 	 * Flush the done work, just in case it's still pending, so that
3749 	 * the work it does can complete and we can accept new frames.
3750 	 */
3751 	flush_work(&mvm->roc_done_wk);
3752 
3753 	mutex_lock(&mvm->mutex);
3754 
3755 	switch (vif->type) {
3756 	case NL80211_IFTYPE_STATION:
3757 		if (fw_has_capa(&mvm->fw->ucode_capa,
3758 				IWL_UCODE_TLV_CAPA_HOTSPOT_SUPPORT)) {
3759 			/* Use aux roc framework (HS20) */
3760 			ret = iwl_mvm_send_aux_roc_cmd(mvm, channel,
3761 						       vif, duration);
3762 			goto out_unlock;
3763 		}
3764 		IWL_ERR(mvm, "hotspot not supported\n");
3765 		ret = -EINVAL;
3766 		goto out_unlock;
3767 	case NL80211_IFTYPE_P2P_DEVICE:
3768 		/* handle below */
3769 		break;
3770 	default:
3771 		IWL_ERR(mvm, "vif isn't P2P_DEVICE: %d\n", vif->type);
3772 		ret = -EINVAL;
3773 		goto out_unlock;
3774 	}
3775 
3776 	for (i = 0; i < NUM_PHY_CTX; i++) {
3777 		phy_ctxt = &mvm->phy_ctxts[i];
3778 		if (phy_ctxt->ref == 0 || mvmvif->phy_ctxt == phy_ctxt)
3779 			continue;
3780 
3781 		if (phy_ctxt->ref && channel == phy_ctxt->channel) {
3782 			/*
3783 			 * Unbind the P2P_DEVICE from the current PHY context,
3784 			 * and if the PHY context is not used remove it.
3785 			 */
3786 			ret = iwl_mvm_binding_remove_vif(mvm, vif);
3787 			if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3788 				goto out_unlock;
3789 
3790 			iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3791 
3792 			/* Bind the P2P_DEVICE to the current PHY Context */
3793 			mvmvif->phy_ctxt = phy_ctxt;
3794 
3795 			ret = iwl_mvm_binding_add_vif(mvm, vif);
3796 			if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3797 				goto out_unlock;
3798 
3799 			iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3800 			goto schedule_time_event;
3801 		}
3802 	}
3803 
3804 	/* Need to update the PHY context only if the ROC channel changed */
3805 	if (channel == mvmvif->phy_ctxt->channel)
3806 		goto schedule_time_event;
3807 
3808 	cfg80211_chandef_create(&chandef, channel, NL80211_CHAN_NO_HT);
3809 
3810 	/*
3811 	 * Change the PHY context configuration as it is currently referenced
3812 	 * only by the P2P Device MAC
3813 	 */
3814 	if (mvmvif->phy_ctxt->ref == 1) {
3815 		ret = iwl_mvm_phy_ctxt_changed(mvm, mvmvif->phy_ctxt,
3816 					       &chandef, 1, 1);
3817 		if (ret)
3818 			goto out_unlock;
3819 	} else {
3820 		/*
3821 		 * The PHY context is shared with other MACs. Need to remove the
3822 		 * P2P Device from the binding, allocate an new PHY context and
3823 		 * create a new binding
3824 		 */
3825 		phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3826 		if (!phy_ctxt) {
3827 			ret = -ENOSPC;
3828 			goto out_unlock;
3829 		}
3830 
3831 		ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &chandef,
3832 					       1, 1);
3833 		if (ret) {
3834 			IWL_ERR(mvm, "Failed to change PHY context\n");
3835 			goto out_unlock;
3836 		}
3837 
3838 		/* Unbind the P2P_DEVICE from the current PHY context */
3839 		ret = iwl_mvm_binding_remove_vif(mvm, vif);
3840 		if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3841 			goto out_unlock;
3842 
3843 		iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3844 
3845 		/* Bind the P2P_DEVICE to the new allocated PHY context */
3846 		mvmvif->phy_ctxt = phy_ctxt;
3847 
3848 		ret = iwl_mvm_binding_add_vif(mvm, vif);
3849 		if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3850 			goto out_unlock;
3851 
3852 		iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3853 	}
3854 
3855 schedule_time_event:
3856 	/* Schedule the time events */
3857 	ret = iwl_mvm_start_p2p_roc(mvm, vif, duration, type);
3858 
3859 out_unlock:
3860 	mutex_unlock(&mvm->mutex);
3861 	IWL_DEBUG_MAC80211(mvm, "leave\n");
3862 	return ret;
3863 }
3864 
3865 static int iwl_mvm_cancel_roc(struct ieee80211_hw *hw,
3866 			      struct ieee80211_vif *vif)
3867 {
3868 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3869 
3870 	IWL_DEBUG_MAC80211(mvm, "enter\n");
3871 
3872 	mutex_lock(&mvm->mutex);
3873 	iwl_mvm_stop_roc(mvm, vif);
3874 	mutex_unlock(&mvm->mutex);
3875 
3876 	IWL_DEBUG_MAC80211(mvm, "leave\n");
3877 	return 0;
3878 }
3879 
3880 struct iwl_mvm_ftm_responder_iter_data {
3881 	bool responder;
3882 	struct ieee80211_chanctx_conf *ctx;
3883 };
3884 
3885 static void iwl_mvm_ftm_responder_chanctx_iter(void *_data, u8 *mac,
3886 					       struct ieee80211_vif *vif)
3887 {
3888 	struct iwl_mvm_ftm_responder_iter_data *data = _data;
3889 
3890 	if (rcu_access_pointer(vif->chanctx_conf) == data->ctx &&
3891 	    vif->type == NL80211_IFTYPE_AP && vif->bss_conf.ftmr_params)
3892 		data->responder = true;
3893 }
3894 
3895 static bool iwl_mvm_is_ftm_responder_chanctx(struct iwl_mvm *mvm,
3896 					     struct ieee80211_chanctx_conf *ctx)
3897 {
3898 	struct iwl_mvm_ftm_responder_iter_data data = {
3899 		.responder = false,
3900 		.ctx = ctx,
3901 	};
3902 
3903 	ieee80211_iterate_active_interfaces_atomic(mvm->hw,
3904 					IEEE80211_IFACE_ITER_NORMAL,
3905 					iwl_mvm_ftm_responder_chanctx_iter,
3906 					&data);
3907 	return data.responder;
3908 }
3909 
3910 static int __iwl_mvm_add_chanctx(struct iwl_mvm *mvm,
3911 				 struct ieee80211_chanctx_conf *ctx)
3912 {
3913 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3914 	struct iwl_mvm_phy_ctxt *phy_ctxt;
3915 	bool responder = iwl_mvm_is_ftm_responder_chanctx(mvm, ctx);
3916 	struct cfg80211_chan_def *def = responder ? &ctx->def : &ctx->min_def;
3917 	int ret;
3918 
3919 	lockdep_assert_held(&mvm->mutex);
3920 
3921 	IWL_DEBUG_MAC80211(mvm, "Add channel context\n");
3922 
3923 	phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3924 	if (!phy_ctxt) {
3925 		ret = -ENOSPC;
3926 		goto out;
3927 	}
3928 
3929 	ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, def,
3930 				       ctx->rx_chains_static,
3931 				       ctx->rx_chains_dynamic);
3932 	if (ret) {
3933 		IWL_ERR(mvm, "Failed to add PHY context\n");
3934 		goto out;
3935 	}
3936 
3937 	iwl_mvm_phy_ctxt_ref(mvm, phy_ctxt);
3938 	*phy_ctxt_id = phy_ctxt->id;
3939 out:
3940 	return ret;
3941 }
3942 
3943 static int iwl_mvm_add_chanctx(struct ieee80211_hw *hw,
3944 			       struct ieee80211_chanctx_conf *ctx)
3945 {
3946 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3947 	int ret;
3948 
3949 	mutex_lock(&mvm->mutex);
3950 	ret = __iwl_mvm_add_chanctx(mvm, ctx);
3951 	mutex_unlock(&mvm->mutex);
3952 
3953 	return ret;
3954 }
3955 
3956 static void __iwl_mvm_remove_chanctx(struct iwl_mvm *mvm,
3957 				     struct ieee80211_chanctx_conf *ctx)
3958 {
3959 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3960 	struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3961 
3962 	lockdep_assert_held(&mvm->mutex);
3963 
3964 	iwl_mvm_phy_ctxt_unref(mvm, phy_ctxt);
3965 }
3966 
3967 static void iwl_mvm_remove_chanctx(struct ieee80211_hw *hw,
3968 				   struct ieee80211_chanctx_conf *ctx)
3969 {
3970 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3971 
3972 	mutex_lock(&mvm->mutex);
3973 	__iwl_mvm_remove_chanctx(mvm, ctx);
3974 	mutex_unlock(&mvm->mutex);
3975 }
3976 
3977 static void iwl_mvm_change_chanctx(struct ieee80211_hw *hw,
3978 				   struct ieee80211_chanctx_conf *ctx,
3979 				   u32 changed)
3980 {
3981 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3982 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3983 	struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3984 	bool responder = iwl_mvm_is_ftm_responder_chanctx(mvm, ctx);
3985 	struct cfg80211_chan_def *def = responder ? &ctx->def : &ctx->min_def;
3986 
3987 	if (WARN_ONCE((phy_ctxt->ref > 1) &&
3988 		      (changed & ~(IEEE80211_CHANCTX_CHANGE_WIDTH |
3989 				   IEEE80211_CHANCTX_CHANGE_RX_CHAINS |
3990 				   IEEE80211_CHANCTX_CHANGE_RADAR |
3991 				   IEEE80211_CHANCTX_CHANGE_MIN_WIDTH)),
3992 		      "Cannot change PHY. Ref=%d, changed=0x%X\n",
3993 		      phy_ctxt->ref, changed))
3994 		return;
3995 
3996 	mutex_lock(&mvm->mutex);
3997 
3998 	/* we are only changing the min_width, may be a noop */
3999 	if (changed == IEEE80211_CHANCTX_CHANGE_MIN_WIDTH) {
4000 		if (phy_ctxt->width == def->width)
4001 			goto out_unlock;
4002 
4003 		/* we are just toggling between 20_NOHT and 20 */
4004 		if (phy_ctxt->width <= NL80211_CHAN_WIDTH_20 &&
4005 		    def->width <= NL80211_CHAN_WIDTH_20)
4006 			goto out_unlock;
4007 	}
4008 
4009 	iwl_mvm_bt_coex_vif_change(mvm);
4010 	iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, def,
4011 				 ctx->rx_chains_static,
4012 				 ctx->rx_chains_dynamic);
4013 
4014 out_unlock:
4015 	mutex_unlock(&mvm->mutex);
4016 }
4017 
4018 static int __iwl_mvm_assign_vif_chanctx(struct iwl_mvm *mvm,
4019 					struct ieee80211_vif *vif,
4020 					struct ieee80211_chanctx_conf *ctx,
4021 					bool switching_chanctx)
4022 {
4023 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
4024 	struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
4025 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4026 	int ret;
4027 
4028 	lockdep_assert_held(&mvm->mutex);
4029 
4030 	mvmvif->phy_ctxt = phy_ctxt;
4031 
4032 	switch (vif->type) {
4033 	case NL80211_IFTYPE_AP:
4034 		/* only needed if we're switching chanctx (i.e. during CSA) */
4035 		if (switching_chanctx) {
4036 			mvmvif->ap_ibss_active = true;
4037 			break;
4038 		}
4039 		/* fall through */
4040 	case NL80211_IFTYPE_ADHOC:
4041 		/*
4042 		 * The AP binding flow is handled as part of the start_ap flow
4043 		 * (in bss_info_changed), similarly for IBSS.
4044 		 */
4045 		ret = 0;
4046 		goto out;
4047 	case NL80211_IFTYPE_STATION:
4048 		mvmvif->csa_bcn_pending = false;
4049 		break;
4050 	case NL80211_IFTYPE_MONITOR:
4051 		/* always disable PS when a monitor interface is active */
4052 		mvmvif->ps_disabled = true;
4053 		break;
4054 	default:
4055 		ret = -EINVAL;
4056 		goto out;
4057 	}
4058 
4059 	ret = iwl_mvm_binding_add_vif(mvm, vif);
4060 	if (ret)
4061 		goto out;
4062 
4063 	/*
4064 	 * Power state must be updated before quotas,
4065 	 * otherwise fw will complain.
4066 	 */
4067 	iwl_mvm_power_update_mac(mvm);
4068 
4069 	/* Setting the quota at this stage is only required for monitor
4070 	 * interfaces. For the other types, the bss_info changed flow
4071 	 * will handle quota settings.
4072 	 */
4073 	if (vif->type == NL80211_IFTYPE_MONITOR) {
4074 		mvmvif->monitor_active = true;
4075 		ret = iwl_mvm_update_quotas(mvm, false, NULL);
4076 		if (ret)
4077 			goto out_remove_binding;
4078 
4079 		ret = iwl_mvm_add_snif_sta(mvm, vif);
4080 		if (ret)
4081 			goto out_remove_binding;
4082 
4083 	}
4084 
4085 	/* Handle binding during CSA */
4086 	if (vif->type == NL80211_IFTYPE_AP) {
4087 		iwl_mvm_update_quotas(mvm, false, NULL);
4088 		iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
4089 	}
4090 
4091 	if (switching_chanctx && vif->type == NL80211_IFTYPE_STATION) {
4092 		mvmvif->csa_bcn_pending = true;
4093 
4094 		if (!fw_has_capa(&mvm->fw->ucode_capa,
4095 				 IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
4096 			u32 duration = 3 * vif->bss_conf.beacon_int;
4097 
4098 			/* Protect the session to make sure we hear the first
4099 			 * beacon on the new channel.
4100 			 */
4101 			iwl_mvm_protect_session(mvm, vif, duration, duration,
4102 						vif->bss_conf.beacon_int / 2,
4103 						true);
4104 		}
4105 
4106 		iwl_mvm_update_quotas(mvm, false, NULL);
4107 	}
4108 
4109 	goto out;
4110 
4111 out_remove_binding:
4112 	iwl_mvm_binding_remove_vif(mvm, vif);
4113 	iwl_mvm_power_update_mac(mvm);
4114 out:
4115 	if (ret)
4116 		mvmvif->phy_ctxt = NULL;
4117 	return ret;
4118 }
4119 static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
4120 				      struct ieee80211_vif *vif,
4121 				      struct ieee80211_chanctx_conf *ctx)
4122 {
4123 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4124 	int ret;
4125 
4126 	mutex_lock(&mvm->mutex);
4127 	ret = __iwl_mvm_assign_vif_chanctx(mvm, vif, ctx, false);
4128 	mutex_unlock(&mvm->mutex);
4129 
4130 	return ret;
4131 }
4132 
4133 static void __iwl_mvm_unassign_vif_chanctx(struct iwl_mvm *mvm,
4134 					   struct ieee80211_vif *vif,
4135 					   struct ieee80211_chanctx_conf *ctx,
4136 					   bool switching_chanctx)
4137 {
4138 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4139 	struct ieee80211_vif *disabled_vif = NULL;
4140 
4141 	lockdep_assert_held(&mvm->mutex);
4142 
4143 	iwl_mvm_remove_time_event(mvm, mvmvif, &mvmvif->time_event_data);
4144 
4145 	switch (vif->type) {
4146 	case NL80211_IFTYPE_ADHOC:
4147 		goto out;
4148 	case NL80211_IFTYPE_MONITOR:
4149 		mvmvif->monitor_active = false;
4150 		mvmvif->ps_disabled = false;
4151 		iwl_mvm_rm_snif_sta(mvm, vif);
4152 		break;
4153 	case NL80211_IFTYPE_AP:
4154 		/* This part is triggered only during CSA */
4155 		if (!switching_chanctx || !mvmvif->ap_ibss_active)
4156 			goto out;
4157 
4158 		mvmvif->csa_countdown = false;
4159 
4160 		/* Set CS bit on all the stations */
4161 		iwl_mvm_modify_all_sta_disable_tx(mvm, mvmvif, true);
4162 
4163 		/* Save blocked iface, the timeout is set on the next beacon */
4164 		rcu_assign_pointer(mvm->csa_tx_blocked_vif, vif);
4165 
4166 		mvmvif->ap_ibss_active = false;
4167 		break;
4168 	case NL80211_IFTYPE_STATION:
4169 		if (!switching_chanctx)
4170 			break;
4171 
4172 		disabled_vif = vif;
4173 
4174 		if (!fw_has_capa(&mvm->fw->ucode_capa,
4175 				 IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD))
4176 			iwl_mvm_mac_ctxt_changed(mvm, vif, true, NULL);
4177 		break;
4178 	default:
4179 		break;
4180 	}
4181 
4182 	iwl_mvm_update_quotas(mvm, false, disabled_vif);
4183 	iwl_mvm_binding_remove_vif(mvm, vif);
4184 
4185 out:
4186 	mvmvif->phy_ctxt = NULL;
4187 	iwl_mvm_power_update_mac(mvm);
4188 }
4189 
4190 static void iwl_mvm_unassign_vif_chanctx(struct ieee80211_hw *hw,
4191 					 struct ieee80211_vif *vif,
4192 					 struct ieee80211_chanctx_conf *ctx)
4193 {
4194 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4195 
4196 	mutex_lock(&mvm->mutex);
4197 	__iwl_mvm_unassign_vif_chanctx(mvm, vif, ctx, false);
4198 	mutex_unlock(&mvm->mutex);
4199 }
4200 
4201 static int
4202 iwl_mvm_switch_vif_chanctx_swap(struct iwl_mvm *mvm,
4203 				struct ieee80211_vif_chanctx_switch *vifs)
4204 {
4205 	int ret;
4206 
4207 	mutex_lock(&mvm->mutex);
4208 	__iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
4209 	__iwl_mvm_remove_chanctx(mvm, vifs[0].old_ctx);
4210 
4211 	ret = __iwl_mvm_add_chanctx(mvm, vifs[0].new_ctx);
4212 	if (ret) {
4213 		IWL_ERR(mvm, "failed to add new_ctx during channel switch\n");
4214 		goto out_reassign;
4215 	}
4216 
4217 	ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
4218 					   true);
4219 	if (ret) {
4220 		IWL_ERR(mvm,
4221 			"failed to assign new_ctx during channel switch\n");
4222 		goto out_remove;
4223 	}
4224 
4225 	/* we don't support TDLS during DCM - can be caused by channel switch */
4226 	if (iwl_mvm_phy_ctx_count(mvm) > 1)
4227 		iwl_mvm_teardown_tdls_peers(mvm);
4228 
4229 	goto out;
4230 
4231 out_remove:
4232 	__iwl_mvm_remove_chanctx(mvm, vifs[0].new_ctx);
4233 
4234 out_reassign:
4235 	if (__iwl_mvm_add_chanctx(mvm, vifs[0].old_ctx)) {
4236 		IWL_ERR(mvm, "failed to add old_ctx back after failure.\n");
4237 		goto out_restart;
4238 	}
4239 
4240 	if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
4241 					 true)) {
4242 		IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
4243 		goto out_restart;
4244 	}
4245 
4246 	goto out;
4247 
4248 out_restart:
4249 	/* things keep failing, better restart the hw */
4250 	iwl_mvm_nic_restart(mvm, false);
4251 
4252 out:
4253 	mutex_unlock(&mvm->mutex);
4254 
4255 	return ret;
4256 }
4257 
4258 static int
4259 iwl_mvm_switch_vif_chanctx_reassign(struct iwl_mvm *mvm,
4260 				    struct ieee80211_vif_chanctx_switch *vifs)
4261 {
4262 	int ret;
4263 
4264 	mutex_lock(&mvm->mutex);
4265 	__iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
4266 
4267 	ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
4268 					   true);
4269 	if (ret) {
4270 		IWL_ERR(mvm,
4271 			"failed to assign new_ctx during channel switch\n");
4272 		goto out_reassign;
4273 	}
4274 
4275 	goto out;
4276 
4277 out_reassign:
4278 	if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
4279 					 true)) {
4280 		IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
4281 		goto out_restart;
4282 	}
4283 
4284 	goto out;
4285 
4286 out_restart:
4287 	/* things keep failing, better restart the hw */
4288 	iwl_mvm_nic_restart(mvm, false);
4289 
4290 out:
4291 	mutex_unlock(&mvm->mutex);
4292 
4293 	return ret;
4294 }
4295 
4296 static int iwl_mvm_switch_vif_chanctx(struct ieee80211_hw *hw,
4297 				      struct ieee80211_vif_chanctx_switch *vifs,
4298 				      int n_vifs,
4299 				      enum ieee80211_chanctx_switch_mode mode)
4300 {
4301 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4302 	int ret;
4303 
4304 	/* we only support a single-vif right now */
4305 	if (n_vifs > 1)
4306 		return -EOPNOTSUPP;
4307 
4308 	switch (mode) {
4309 	case CHANCTX_SWMODE_SWAP_CONTEXTS:
4310 		ret = iwl_mvm_switch_vif_chanctx_swap(mvm, vifs);
4311 		break;
4312 	case CHANCTX_SWMODE_REASSIGN_VIF:
4313 		ret = iwl_mvm_switch_vif_chanctx_reassign(mvm, vifs);
4314 		break;
4315 	default:
4316 		ret = -EOPNOTSUPP;
4317 		break;
4318 	}
4319 
4320 	return ret;
4321 }
4322 
4323 static int iwl_mvm_tx_last_beacon(struct ieee80211_hw *hw)
4324 {
4325 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4326 
4327 	return mvm->ibss_manager;
4328 }
4329 
4330 static int iwl_mvm_set_tim(struct ieee80211_hw *hw,
4331 			   struct ieee80211_sta *sta,
4332 			   bool set)
4333 {
4334 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4335 	struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
4336 
4337 	if (!mvm_sta || !mvm_sta->vif) {
4338 		IWL_ERR(mvm, "Station is not associated to a vif\n");
4339 		return -EINVAL;
4340 	}
4341 
4342 	return iwl_mvm_mac_ctxt_beacon_changed(mvm, mvm_sta->vif);
4343 }
4344 
4345 #ifdef CONFIG_NL80211_TESTMODE
4346 static const struct nla_policy iwl_mvm_tm_policy[IWL_MVM_TM_ATTR_MAX + 1] = {
4347 	[IWL_MVM_TM_ATTR_CMD] = { .type = NLA_U32 },
4348 	[IWL_MVM_TM_ATTR_NOA_DURATION] = { .type = NLA_U32 },
4349 	[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE] = { .type = NLA_U32 },
4350 };
4351 
4352 static int __iwl_mvm_mac_testmode_cmd(struct iwl_mvm *mvm,
4353 				      struct ieee80211_vif *vif,
4354 				      void *data, int len)
4355 {
4356 	struct nlattr *tb[IWL_MVM_TM_ATTR_MAX + 1];
4357 	int err;
4358 	u32 noa_duration;
4359 
4360 	err = nla_parse_deprecated(tb, IWL_MVM_TM_ATTR_MAX, data, len,
4361 				   iwl_mvm_tm_policy, NULL);
4362 	if (err)
4363 		return err;
4364 
4365 	if (!tb[IWL_MVM_TM_ATTR_CMD])
4366 		return -EINVAL;
4367 
4368 	switch (nla_get_u32(tb[IWL_MVM_TM_ATTR_CMD])) {
4369 	case IWL_MVM_TM_CMD_SET_NOA:
4370 		if (!vif || vif->type != NL80211_IFTYPE_AP || !vif->p2p ||
4371 		    !vif->bss_conf.enable_beacon ||
4372 		    !tb[IWL_MVM_TM_ATTR_NOA_DURATION])
4373 			return -EINVAL;
4374 
4375 		noa_duration = nla_get_u32(tb[IWL_MVM_TM_ATTR_NOA_DURATION]);
4376 		if (noa_duration >= vif->bss_conf.beacon_int)
4377 			return -EINVAL;
4378 
4379 		mvm->noa_duration = noa_duration;
4380 		mvm->noa_vif = vif;
4381 
4382 		return iwl_mvm_update_quotas(mvm, true, NULL);
4383 	case IWL_MVM_TM_CMD_SET_BEACON_FILTER:
4384 		/* must be associated client vif - ignore authorized */
4385 		if (!vif || vif->type != NL80211_IFTYPE_STATION ||
4386 		    !vif->bss_conf.assoc || !vif->bss_conf.dtim_period ||
4387 		    !tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE])
4388 			return -EINVAL;
4389 
4390 		if (nla_get_u32(tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE]))
4391 			return iwl_mvm_enable_beacon_filter(mvm, vif, 0);
4392 		return iwl_mvm_disable_beacon_filter(mvm, vif, 0);
4393 	}
4394 
4395 	return -EOPNOTSUPP;
4396 }
4397 
4398 static int iwl_mvm_mac_testmode_cmd(struct ieee80211_hw *hw,
4399 				    struct ieee80211_vif *vif,
4400 				    void *data, int len)
4401 {
4402 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4403 	int err;
4404 
4405 	mutex_lock(&mvm->mutex);
4406 	err = __iwl_mvm_mac_testmode_cmd(mvm, vif, data, len);
4407 	mutex_unlock(&mvm->mutex);
4408 
4409 	return err;
4410 }
4411 #endif
4412 
4413 static void iwl_mvm_channel_switch(struct ieee80211_hw *hw,
4414 				   struct ieee80211_vif *vif,
4415 				   struct ieee80211_channel_switch *chsw)
4416 {
4417 	/* By implementing this operation, we prevent mac80211 from
4418 	 * starting its own channel switch timer, so that we can call
4419 	 * ieee80211_chswitch_done() ourselves at the right time
4420 	 * (which is when the absence time event starts).
4421 	 */
4422 
4423 	IWL_DEBUG_MAC80211(IWL_MAC80211_GET_MVM(hw),
4424 			   "dummy channel switch op\n");
4425 }
4426 
4427 static int iwl_mvm_schedule_client_csa(struct iwl_mvm *mvm,
4428 				       struct ieee80211_vif *vif,
4429 				       struct ieee80211_channel_switch *chsw)
4430 {
4431 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4432 	struct iwl_chan_switch_te_cmd cmd = {
4433 		.mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
4434 							  mvmvif->color)),
4435 		.action = cpu_to_le32(FW_CTXT_ACTION_ADD),
4436 		.tsf = cpu_to_le32(chsw->timestamp),
4437 		.cs_count = chsw->count,
4438 		.cs_mode = chsw->block_tx,
4439 	};
4440 
4441 	lockdep_assert_held(&mvm->mutex);
4442 
4443 	if (chsw->delay)
4444 		cmd.cs_delayed_bcn_count =
4445 			DIV_ROUND_UP(chsw->delay, vif->bss_conf.beacon_int);
4446 
4447 	return iwl_mvm_send_cmd_pdu(mvm,
4448 				    WIDE_ID(MAC_CONF_GROUP,
4449 					    CHANNEL_SWITCH_TIME_EVENT_CMD),
4450 				    0, sizeof(cmd), &cmd);
4451 }
4452 
4453 static int iwl_mvm_old_pre_chan_sw_sta(struct iwl_mvm *mvm,
4454 				       struct ieee80211_vif *vif,
4455 				       struct ieee80211_channel_switch *chsw)
4456 {
4457 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4458 	u32 apply_time;
4459 
4460 	/* Schedule the time event to a bit before beacon 1,
4461 	 * to make sure we're in the new channel when the
4462 	 * GO/AP arrives. In case count <= 1 immediately schedule the
4463 	 * TE (this might result with some packet loss or connection
4464 	 * loss).
4465 	 */
4466 	if (chsw->count <= 1)
4467 		apply_time = 0;
4468 	else
4469 		apply_time = chsw->device_timestamp +
4470 			((vif->bss_conf.beacon_int * (chsw->count - 1) -
4471 			  IWL_MVM_CHANNEL_SWITCH_TIME_CLIENT) * 1024);
4472 
4473 	if (chsw->block_tx)
4474 		iwl_mvm_csa_client_absent(mvm, vif);
4475 
4476 	if (mvmvif->bf_data.bf_enabled) {
4477 		int ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
4478 
4479 		if (ret)
4480 			return ret;
4481 	}
4482 
4483 	iwl_mvm_schedule_csa_period(mvm, vif, vif->bss_conf.beacon_int,
4484 				    apply_time);
4485 
4486 	return 0;
4487 }
4488 
4489 #define IWL_MAX_CSA_BLOCK_TX 1500
4490 static int iwl_mvm_pre_channel_switch(struct ieee80211_hw *hw,
4491 				      struct ieee80211_vif *vif,
4492 				      struct ieee80211_channel_switch *chsw)
4493 {
4494 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4495 	struct ieee80211_vif *csa_vif;
4496 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4497 	int ret;
4498 
4499 	mutex_lock(&mvm->mutex);
4500 
4501 	mvmvif->csa_failed = false;
4502 
4503 	IWL_DEBUG_MAC80211(mvm, "pre CSA to freq %d\n",
4504 			   chsw->chandef.center_freq1);
4505 
4506 	iwl_fw_dbg_trigger_simple_stop(&mvm->fwrt,
4507 				       ieee80211_vif_to_wdev(vif),
4508 				       FW_DBG_TRIGGER_CHANNEL_SWITCH);
4509 
4510 	switch (vif->type) {
4511 	case NL80211_IFTYPE_AP:
4512 		csa_vif =
4513 			rcu_dereference_protected(mvm->csa_vif,
4514 						  lockdep_is_held(&mvm->mutex));
4515 		if (WARN_ONCE(csa_vif && csa_vif->csa_active,
4516 			      "Another CSA is already in progress")) {
4517 			ret = -EBUSY;
4518 			goto out_unlock;
4519 		}
4520 
4521 		/* we still didn't unblock tx. prevent new CS meanwhile */
4522 		if (rcu_dereference_protected(mvm->csa_tx_blocked_vif,
4523 					      lockdep_is_held(&mvm->mutex))) {
4524 			ret = -EBUSY;
4525 			goto out_unlock;
4526 		}
4527 
4528 		rcu_assign_pointer(mvm->csa_vif, vif);
4529 
4530 		if (WARN_ONCE(mvmvif->csa_countdown,
4531 			      "Previous CSA countdown didn't complete")) {
4532 			ret = -EBUSY;
4533 			goto out_unlock;
4534 		}
4535 
4536 		mvmvif->csa_target_freq = chsw->chandef.chan->center_freq;
4537 
4538 		break;
4539 	case NL80211_IFTYPE_STATION:
4540 		if (chsw->block_tx) {
4541 			/*
4542 			 * In case of undetermined / long time with immediate
4543 			 * quiet monitor status to gracefully disconnect
4544 			 */
4545 			if (!chsw->count ||
4546 			    chsw->count * vif->bss_conf.beacon_int >
4547 			    IWL_MAX_CSA_BLOCK_TX)
4548 				schedule_delayed_work(&mvmvif->csa_work,
4549 						      msecs_to_jiffies(IWL_MAX_CSA_BLOCK_TX));
4550 		}
4551 
4552 		if (!fw_has_capa(&mvm->fw->ucode_capa,
4553 				 IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
4554 			ret = iwl_mvm_old_pre_chan_sw_sta(mvm, vif, chsw);
4555 			if (ret)
4556 				goto out_unlock;
4557 		} else {
4558 			iwl_mvm_schedule_client_csa(mvm, vif, chsw);
4559 		}
4560 
4561 		mvmvif->csa_count = chsw->count;
4562 		mvmvif->csa_misbehave = false;
4563 		break;
4564 	default:
4565 		break;
4566 	}
4567 
4568 	mvmvif->ps_disabled = true;
4569 
4570 	ret = iwl_mvm_power_update_ps(mvm);
4571 	if (ret)
4572 		goto out_unlock;
4573 
4574 	/* we won't be on this channel any longer */
4575 	iwl_mvm_teardown_tdls_peers(mvm);
4576 
4577 out_unlock:
4578 	mutex_unlock(&mvm->mutex);
4579 
4580 	return ret;
4581 }
4582 
4583 static void iwl_mvm_channel_switch_rx_beacon(struct ieee80211_hw *hw,
4584 					     struct ieee80211_vif *vif,
4585 					     struct ieee80211_channel_switch *chsw)
4586 {
4587 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4588 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4589 	struct iwl_chan_switch_te_cmd cmd = {
4590 		.mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
4591 							  mvmvif->color)),
4592 		.action = cpu_to_le32(FW_CTXT_ACTION_MODIFY),
4593 		.tsf = cpu_to_le32(chsw->timestamp),
4594 		.cs_count = chsw->count,
4595 		.cs_mode = chsw->block_tx,
4596 	};
4597 
4598 	if (!fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_CS_MODIFY))
4599 		return;
4600 
4601 	if (chsw->count >= mvmvif->csa_count && chsw->block_tx) {
4602 		if (mvmvif->csa_misbehave) {
4603 			/* Second time, give up on this AP*/
4604 			iwl_mvm_abort_channel_switch(hw, vif);
4605 			ieee80211_chswitch_done(vif, false);
4606 			mvmvif->csa_misbehave = false;
4607 			return;
4608 		}
4609 		mvmvif->csa_misbehave = true;
4610 	}
4611 	mvmvif->csa_count = chsw->count;
4612 
4613 	IWL_DEBUG_MAC80211(mvm, "Modify CSA on mac %d\n", mvmvif->id);
4614 
4615 	WARN_ON(iwl_mvm_send_cmd_pdu(mvm,
4616 				     WIDE_ID(MAC_CONF_GROUP,
4617 					     CHANNEL_SWITCH_TIME_EVENT_CMD),
4618 				     CMD_ASYNC, sizeof(cmd), &cmd));
4619 }
4620 
4621 static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop)
4622 {
4623 	int i;
4624 
4625 	if (!iwl_mvm_has_new_tx_api(mvm)) {
4626 		if (drop) {
4627 			mutex_lock(&mvm->mutex);
4628 			iwl_mvm_flush_tx_path(mvm,
4629 				iwl_mvm_flushable_queues(mvm) & queues, 0);
4630 			mutex_unlock(&mvm->mutex);
4631 		} else {
4632 			iwl_trans_wait_tx_queues_empty(mvm->trans, queues);
4633 		}
4634 		return;
4635 	}
4636 
4637 	mutex_lock(&mvm->mutex);
4638 	for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
4639 		struct ieee80211_sta *sta;
4640 
4641 		sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
4642 						lockdep_is_held(&mvm->mutex));
4643 		if (IS_ERR_OR_NULL(sta))
4644 			continue;
4645 
4646 		if (drop)
4647 			iwl_mvm_flush_sta_tids(mvm, i, 0xFF, 0);
4648 		else
4649 			iwl_mvm_wait_sta_queues_empty(mvm,
4650 					iwl_mvm_sta_from_mac80211(sta));
4651 	}
4652 	mutex_unlock(&mvm->mutex);
4653 }
4654 
4655 static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
4656 			      struct ieee80211_vif *vif, u32 queues, bool drop)
4657 {
4658 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4659 	struct iwl_mvm_vif *mvmvif;
4660 	struct iwl_mvm_sta *mvmsta;
4661 	struct ieee80211_sta *sta;
4662 	int i;
4663 	u32 msk = 0;
4664 
4665 	if (!vif) {
4666 		iwl_mvm_flush_no_vif(mvm, queues, drop);
4667 		return;
4668 	}
4669 
4670 	if (vif->type != NL80211_IFTYPE_STATION)
4671 		return;
4672 
4673 	/* Make sure we're done with the deferred traffic before flushing */
4674 	flush_work(&mvm->add_stream_wk);
4675 
4676 	mutex_lock(&mvm->mutex);
4677 	mvmvif = iwl_mvm_vif_from_mac80211(vif);
4678 
4679 	/* flush the AP-station and all TDLS peers */
4680 	for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
4681 		sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
4682 						lockdep_is_held(&mvm->mutex));
4683 		if (IS_ERR_OR_NULL(sta))
4684 			continue;
4685 
4686 		mvmsta = iwl_mvm_sta_from_mac80211(sta);
4687 		if (mvmsta->vif != vif)
4688 			continue;
4689 
4690 		/* make sure only TDLS peers or the AP are flushed */
4691 		WARN_ON(i != mvmvif->ap_sta_id && !sta->tdls);
4692 
4693 		if (drop) {
4694 			if (iwl_mvm_flush_sta(mvm, mvmsta, false, 0))
4695 				IWL_ERR(mvm, "flush request fail\n");
4696 		} else {
4697 			msk |= mvmsta->tfd_queue_msk;
4698 			if (iwl_mvm_has_new_tx_api(mvm))
4699 				iwl_mvm_wait_sta_queues_empty(mvm, mvmsta);
4700 		}
4701 	}
4702 
4703 	mutex_unlock(&mvm->mutex);
4704 
4705 	/* this can take a while, and we may need/want other operations
4706 	 * to succeed while doing this, so do it without the mutex held
4707 	 */
4708 	if (!drop && !iwl_mvm_has_new_tx_api(mvm))
4709 		iwl_trans_wait_tx_queues_empty(mvm->trans, msk);
4710 }
4711 
4712 static int iwl_mvm_mac_get_survey(struct ieee80211_hw *hw, int idx,
4713 				  struct survey_info *survey)
4714 {
4715 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4716 	int ret;
4717 
4718 	memset(survey, 0, sizeof(*survey));
4719 
4720 	/* only support global statistics right now */
4721 	if (idx != 0)
4722 		return -ENOENT;
4723 
4724 	if (!fw_has_capa(&mvm->fw->ucode_capa,
4725 			 IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
4726 		return -ENOENT;
4727 
4728 	mutex_lock(&mvm->mutex);
4729 
4730 	if (iwl_mvm_firmware_running(mvm)) {
4731 		ret = iwl_mvm_request_statistics(mvm, false);
4732 		if (ret)
4733 			goto out;
4734 	}
4735 
4736 	survey->filled = SURVEY_INFO_TIME |
4737 			 SURVEY_INFO_TIME_RX |
4738 			 SURVEY_INFO_TIME_TX |
4739 			 SURVEY_INFO_TIME_SCAN;
4740 	survey->time = mvm->accu_radio_stats.on_time_rf +
4741 		       mvm->radio_stats.on_time_rf;
4742 	do_div(survey->time, USEC_PER_MSEC);
4743 
4744 	survey->time_rx = mvm->accu_radio_stats.rx_time +
4745 			  mvm->radio_stats.rx_time;
4746 	do_div(survey->time_rx, USEC_PER_MSEC);
4747 
4748 	survey->time_tx = mvm->accu_radio_stats.tx_time +
4749 			  mvm->radio_stats.tx_time;
4750 	do_div(survey->time_tx, USEC_PER_MSEC);
4751 
4752 	survey->time_scan = mvm->accu_radio_stats.on_time_scan +
4753 			    mvm->radio_stats.on_time_scan;
4754 	do_div(survey->time_scan, USEC_PER_MSEC);
4755 
4756 	ret = 0;
4757  out:
4758 	mutex_unlock(&mvm->mutex);
4759 	return ret;
4760 }
4761 
4762 static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,
4763 				       struct ieee80211_vif *vif,
4764 				       struct ieee80211_sta *sta,
4765 				       struct station_info *sinfo)
4766 {
4767 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4768 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4769 	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
4770 
4771 	if (mvmsta->avg_energy) {
4772 		sinfo->signal_avg = mvmsta->avg_energy;
4773 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
4774 	}
4775 
4776 	/* if beacon filtering isn't on mac80211 does it anyway */
4777 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
4778 		return;
4779 
4780 	if (!vif->bss_conf.assoc)
4781 		return;
4782 
4783 	mutex_lock(&mvm->mutex);
4784 
4785 	if (mvmvif->ap_sta_id != mvmsta->sta_id)
4786 		goto unlock;
4787 
4788 	if (iwl_mvm_request_statistics(mvm, false))
4789 		goto unlock;
4790 
4791 	sinfo->rx_beacon = mvmvif->beacon_stats.num_beacons +
4792 			   mvmvif->beacon_stats.accu_num_beacons;
4793 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_RX);
4794 	if (mvmvif->beacon_stats.avg_signal) {
4795 		/* firmware only reports a value after RXing a few beacons */
4796 		sinfo->rx_beacon_signal_avg = mvmvif->beacon_stats.avg_signal;
4797 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG);
4798 	}
4799  unlock:
4800 	mutex_unlock(&mvm->mutex);
4801 }
4802 
4803 static void iwl_mvm_event_mlme_callback(struct iwl_mvm *mvm,
4804 					struct ieee80211_vif *vif,
4805 					const struct ieee80211_event *event)
4806 {
4807 #define CHECK_MLME_TRIGGER(_cnt, _fmt...)				\
4808 	do {								\
4809 		if ((trig_mlme->_cnt) && --(trig_mlme->_cnt))		\
4810 			break;						\
4811 		iwl_fw_dbg_collect_trig(&(mvm)->fwrt, trig, _fmt);	\
4812 	} while (0)
4813 
4814 	struct iwl_fw_dbg_trigger_tlv *trig;
4815 	struct iwl_fw_dbg_trigger_mlme *trig_mlme;
4816 
4817 	trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
4818 				     FW_DBG_TRIGGER_MLME);
4819 	if (!trig)
4820 		return;
4821 
4822 	trig_mlme = (void *)trig->data;
4823 
4824 	if (event->u.mlme.data == ASSOC_EVENT) {
4825 		if (event->u.mlme.status == MLME_DENIED)
4826 			CHECK_MLME_TRIGGER(stop_assoc_denied,
4827 					   "DENIED ASSOC: reason %d",
4828 					    event->u.mlme.reason);
4829 		else if (event->u.mlme.status == MLME_TIMEOUT)
4830 			CHECK_MLME_TRIGGER(stop_assoc_timeout,
4831 					   "ASSOC TIMEOUT");
4832 	} else if (event->u.mlme.data == AUTH_EVENT) {
4833 		if (event->u.mlme.status == MLME_DENIED)
4834 			CHECK_MLME_TRIGGER(stop_auth_denied,
4835 					   "DENIED AUTH: reason %d",
4836 					   event->u.mlme.reason);
4837 		else if (event->u.mlme.status == MLME_TIMEOUT)
4838 			CHECK_MLME_TRIGGER(stop_auth_timeout,
4839 					   "AUTH TIMEOUT");
4840 	} else if (event->u.mlme.data == DEAUTH_RX_EVENT) {
4841 		CHECK_MLME_TRIGGER(stop_rx_deauth,
4842 				   "DEAUTH RX %d", event->u.mlme.reason);
4843 	} else if (event->u.mlme.data == DEAUTH_TX_EVENT) {
4844 		CHECK_MLME_TRIGGER(stop_tx_deauth,
4845 				   "DEAUTH TX %d", event->u.mlme.reason);
4846 	}
4847 #undef CHECK_MLME_TRIGGER
4848 }
4849 
4850 static void iwl_mvm_event_bar_rx_callback(struct iwl_mvm *mvm,
4851 					  struct ieee80211_vif *vif,
4852 					  const struct ieee80211_event *event)
4853 {
4854 	struct iwl_fw_dbg_trigger_tlv *trig;
4855 	struct iwl_fw_dbg_trigger_ba *ba_trig;
4856 
4857 	trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
4858 				     FW_DBG_TRIGGER_BA);
4859 	if (!trig)
4860 		return;
4861 
4862 	ba_trig = (void *)trig->data;
4863 
4864 	if (!(le16_to_cpu(ba_trig->rx_bar) & BIT(event->u.ba.tid)))
4865 		return;
4866 
4867 	iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
4868 				"BAR received from %pM, tid %d, ssn %d",
4869 				event->u.ba.sta->addr, event->u.ba.tid,
4870 				event->u.ba.ssn);
4871 }
4872 
4873 static void iwl_mvm_mac_event_callback(struct ieee80211_hw *hw,
4874 				       struct ieee80211_vif *vif,
4875 				       const struct ieee80211_event *event)
4876 {
4877 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4878 
4879 	switch (event->type) {
4880 	case MLME_EVENT:
4881 		iwl_mvm_event_mlme_callback(mvm, vif, event);
4882 		break;
4883 	case BAR_RX_EVENT:
4884 		iwl_mvm_event_bar_rx_callback(mvm, vif, event);
4885 		break;
4886 	case BA_FRAME_TIMEOUT:
4887 		iwl_mvm_event_frame_timeout_callback(mvm, vif, event->u.ba.sta,
4888 						     event->u.ba.tid);
4889 		break;
4890 	default:
4891 		break;
4892 	}
4893 }
4894 
4895 void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm,
4896 				     struct iwl_mvm_internal_rxq_notif *notif,
4897 				     u32 size)
4898 {
4899 	u32 qmask = BIT(mvm->trans->num_rx_queues) - 1;
4900 	int ret;
4901 
4902 
4903 	if (!iwl_mvm_has_new_rx_api(mvm))
4904 		return;
4905 
4906 	if (notif->sync) {
4907 		notif->cookie = mvm->queue_sync_cookie;
4908 		atomic_set(&mvm->queue_sync_counter,
4909 			   mvm->trans->num_rx_queues);
4910 	}
4911 
4912 	ret = iwl_mvm_notify_rx_queue(mvm, qmask, (u8 *)notif,
4913 				      size, !notif->sync);
4914 	if (ret) {
4915 		IWL_ERR(mvm, "Failed to trigger RX queues sync (%d)\n", ret);
4916 		goto out;
4917 	}
4918 
4919 	if (notif->sync) {
4920 		lockdep_assert_held(&mvm->mutex);
4921 		ret = wait_event_timeout(mvm->rx_sync_waitq,
4922 					 atomic_read(&mvm->queue_sync_counter) == 0 ||
4923 					 iwl_mvm_is_radio_killed(mvm),
4924 					 HZ);
4925 		WARN_ON_ONCE(!ret && !iwl_mvm_is_radio_killed(mvm));
4926 	}
4927 
4928 out:
4929 	atomic_set(&mvm->queue_sync_counter, 0);
4930 	if (notif->sync)
4931 		mvm->queue_sync_cookie++;
4932 }
4933 
4934 static void iwl_mvm_sync_rx_queues(struct ieee80211_hw *hw)
4935 {
4936 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4937 	struct iwl_mvm_internal_rxq_notif data = {
4938 		.type = IWL_MVM_RXQ_EMPTY,
4939 		.sync = 1,
4940 	};
4941 
4942 	mutex_lock(&mvm->mutex);
4943 	iwl_mvm_sync_rx_queues_internal(mvm, &data, sizeof(data));
4944 	mutex_unlock(&mvm->mutex);
4945 }
4946 
4947 static int
4948 iwl_mvm_mac_get_ftm_responder_stats(struct ieee80211_hw *hw,
4949 				    struct ieee80211_vif *vif,
4950 				    struct cfg80211_ftm_responder_stats *stats)
4951 {
4952 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4953 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4954 
4955 	if (vif->p2p || vif->type != NL80211_IFTYPE_AP ||
4956 	    !mvmvif->ap_ibss_active || !vif->bss_conf.ftm_responder)
4957 		return -EINVAL;
4958 
4959 	mutex_lock(&mvm->mutex);
4960 	*stats = mvm->ftm_resp_stats;
4961 	mutex_unlock(&mvm->mutex);
4962 
4963 	stats->filled = BIT(NL80211_FTM_STATS_SUCCESS_NUM) |
4964 			BIT(NL80211_FTM_STATS_PARTIAL_NUM) |
4965 			BIT(NL80211_FTM_STATS_FAILED_NUM) |
4966 			BIT(NL80211_FTM_STATS_ASAP_NUM) |
4967 			BIT(NL80211_FTM_STATS_NON_ASAP_NUM) |
4968 			BIT(NL80211_FTM_STATS_TOTAL_DURATION_MSEC) |
4969 			BIT(NL80211_FTM_STATS_UNKNOWN_TRIGGERS_NUM) |
4970 			BIT(NL80211_FTM_STATS_RESCHEDULE_REQUESTS_NUM) |
4971 			BIT(NL80211_FTM_STATS_OUT_OF_WINDOW_TRIGGERS_NUM);
4972 
4973 	return 0;
4974 }
4975 
4976 static int iwl_mvm_start_pmsr(struct ieee80211_hw *hw,
4977 			      struct ieee80211_vif *vif,
4978 			      struct cfg80211_pmsr_request *request)
4979 {
4980 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4981 	int ret;
4982 
4983 	mutex_lock(&mvm->mutex);
4984 	ret = iwl_mvm_ftm_start(mvm, vif, request);
4985 	mutex_unlock(&mvm->mutex);
4986 
4987 	return ret;
4988 }
4989 
4990 static void iwl_mvm_abort_pmsr(struct ieee80211_hw *hw,
4991 			       struct ieee80211_vif *vif,
4992 			       struct cfg80211_pmsr_request *request)
4993 {
4994 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4995 
4996 	mutex_lock(&mvm->mutex);
4997 	iwl_mvm_ftm_abort(mvm, request);
4998 	mutex_unlock(&mvm->mutex);
4999 }
5000 
5001 static bool iwl_mvm_can_hw_csum(struct sk_buff *skb)
5002 {
5003 	u8 protocol = ip_hdr(skb)->protocol;
5004 
5005 	if (!IS_ENABLED(CONFIG_INET))
5006 		return false;
5007 
5008 	return protocol == IPPROTO_TCP || protocol == IPPROTO_UDP;
5009 }
5010 
5011 static bool iwl_mvm_mac_can_aggregate(struct ieee80211_hw *hw,
5012 				      struct sk_buff *head,
5013 				      struct sk_buff *skb)
5014 {
5015 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
5016 
5017 	/* For now don't aggregate IPv6 in AMSDU */
5018 	if (skb->protocol != htons(ETH_P_IP))
5019 		return false;
5020 
5021 	if (!iwl_mvm_is_csum_supported(mvm))
5022 		return true;
5023 
5024 	return iwl_mvm_can_hw_csum(skb) == iwl_mvm_can_hw_csum(head);
5025 }
5026 
5027 const struct ieee80211_ops iwl_mvm_hw_ops = {
5028 	.tx = iwl_mvm_mac_tx,
5029 	.wake_tx_queue = iwl_mvm_mac_wake_tx_queue,
5030 	.ampdu_action = iwl_mvm_mac_ampdu_action,
5031 	.start = iwl_mvm_mac_start,
5032 	.reconfig_complete = iwl_mvm_mac_reconfig_complete,
5033 	.stop = iwl_mvm_mac_stop,
5034 	.add_interface = iwl_mvm_mac_add_interface,
5035 	.remove_interface = iwl_mvm_mac_remove_interface,
5036 	.config = iwl_mvm_mac_config,
5037 	.prepare_multicast = iwl_mvm_prepare_multicast,
5038 	.configure_filter = iwl_mvm_configure_filter,
5039 	.config_iface_filter = iwl_mvm_config_iface_filter,
5040 	.bss_info_changed = iwl_mvm_bss_info_changed,
5041 	.hw_scan = iwl_mvm_mac_hw_scan,
5042 	.cancel_hw_scan = iwl_mvm_mac_cancel_hw_scan,
5043 	.sta_pre_rcu_remove = iwl_mvm_sta_pre_rcu_remove,
5044 	.sta_state = iwl_mvm_mac_sta_state,
5045 	.sta_notify = iwl_mvm_mac_sta_notify,
5046 	.allow_buffered_frames = iwl_mvm_mac_allow_buffered_frames,
5047 	.release_buffered_frames = iwl_mvm_mac_release_buffered_frames,
5048 	.set_rts_threshold = iwl_mvm_mac_set_rts_threshold,
5049 	.sta_rc_update = iwl_mvm_sta_rc_update,
5050 	.conf_tx = iwl_mvm_mac_conf_tx,
5051 	.mgd_prepare_tx = iwl_mvm_mac_mgd_prepare_tx,
5052 	.mgd_protect_tdls_discover = iwl_mvm_mac_mgd_protect_tdls_discover,
5053 	.flush = iwl_mvm_mac_flush,
5054 	.sched_scan_start = iwl_mvm_mac_sched_scan_start,
5055 	.sched_scan_stop = iwl_mvm_mac_sched_scan_stop,
5056 	.set_key = iwl_mvm_mac_set_key,
5057 	.update_tkip_key = iwl_mvm_mac_update_tkip_key,
5058 	.remain_on_channel = iwl_mvm_roc,
5059 	.cancel_remain_on_channel = iwl_mvm_cancel_roc,
5060 	.add_chanctx = iwl_mvm_add_chanctx,
5061 	.remove_chanctx = iwl_mvm_remove_chanctx,
5062 	.change_chanctx = iwl_mvm_change_chanctx,
5063 	.assign_vif_chanctx = iwl_mvm_assign_vif_chanctx,
5064 	.unassign_vif_chanctx = iwl_mvm_unassign_vif_chanctx,
5065 	.switch_vif_chanctx = iwl_mvm_switch_vif_chanctx,
5066 
5067 	.start_ap = iwl_mvm_start_ap_ibss,
5068 	.stop_ap = iwl_mvm_stop_ap_ibss,
5069 	.join_ibss = iwl_mvm_start_ap_ibss,
5070 	.leave_ibss = iwl_mvm_stop_ap_ibss,
5071 
5072 	.tx_last_beacon = iwl_mvm_tx_last_beacon,
5073 
5074 	.set_tim = iwl_mvm_set_tim,
5075 
5076 	.channel_switch = iwl_mvm_channel_switch,
5077 	.pre_channel_switch = iwl_mvm_pre_channel_switch,
5078 	.post_channel_switch = iwl_mvm_post_channel_switch,
5079 	.abort_channel_switch = iwl_mvm_abort_channel_switch,
5080 	.channel_switch_rx_beacon = iwl_mvm_channel_switch_rx_beacon,
5081 
5082 	.tdls_channel_switch = iwl_mvm_tdls_channel_switch,
5083 	.tdls_cancel_channel_switch = iwl_mvm_tdls_cancel_channel_switch,
5084 	.tdls_recv_channel_switch = iwl_mvm_tdls_recv_channel_switch,
5085 
5086 	.event_callback = iwl_mvm_mac_event_callback,
5087 
5088 	.sync_rx_queues = iwl_mvm_sync_rx_queues,
5089 
5090 	CFG80211_TESTMODE_CMD(iwl_mvm_mac_testmode_cmd)
5091 
5092 #ifdef CONFIG_PM_SLEEP
5093 	/* look at d3.c */
5094 	.suspend = iwl_mvm_suspend,
5095 	.resume = iwl_mvm_resume,
5096 	.set_wakeup = iwl_mvm_set_wakeup,
5097 	.set_rekey_data = iwl_mvm_set_rekey_data,
5098 #if IS_ENABLED(CONFIG_IPV6)
5099 	.ipv6_addr_change = iwl_mvm_ipv6_addr_change,
5100 #endif
5101 	.set_default_unicast_key = iwl_mvm_set_default_unicast_key,
5102 #endif
5103 	.get_survey = iwl_mvm_mac_get_survey,
5104 	.sta_statistics = iwl_mvm_mac_sta_statistics,
5105 	.get_ftm_responder_stats = iwl_mvm_mac_get_ftm_responder_stats,
5106 	.start_pmsr = iwl_mvm_start_pmsr,
5107 	.abort_pmsr = iwl_mvm_abort_pmsr,
5108 
5109 	.can_aggregate_in_amsdu = iwl_mvm_mac_can_aggregate,
5110 #ifdef CONFIG_IWLWIFI_DEBUGFS
5111 	.sta_add_debugfs = iwl_mvm_sta_add_debugfs,
5112 #endif
5113 };
5114