xref: /linux/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c (revision cc622420798c4bcf093785d872525087a7798db9)
1 /******************************************************************************
2  *
3  * This file is provided under a dual BSD/GPLv2 license.  When using or
4  * redistributing this file, you may do so under either license.
5  *
6  * GPL LICENSE SUMMARY
7  *
8  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
9  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
10  * Copyright(c) 2016 Intel Deutschland GmbH
11  *
12  * This program is free software; you can redistribute it and/or modify
13  * it under the terms of version 2 of the GNU General Public License as
14  * published by the Free Software Foundation.
15  *
16  * This program is distributed in the hope that it will be useful, but
17  * WITHOUT ANY WARRANTY; without even the implied warranty of
18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
19  * General Public License for more details.
20  *
21  * You should have received a copy of the GNU General Public License
22  * along with this program; if not, write to the Free Software
23  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
24  * USA
25  *
26  * The full GNU General Public License is included in this distribution
27  * in the file called COPYING.
28  *
29  * Contact Information:
30  *  Intel Linux Wireless <linuxwifi@intel.com>
31  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
32  *
33  * BSD LICENSE
34  *
35  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
36  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
37  * All rights reserved.
38  *
39  * Redistribution and use in source and binary forms, with or without
40  * modification, are permitted provided that the following conditions
41  * are met:
42  *
43  *  * Redistributions of source code must retain the above copyright
44  *    notice, this list of conditions and the following disclaimer.
45  *  * Redistributions in binary form must reproduce the above copyright
46  *    notice, this list of conditions and the following disclaimer in
47  *    the documentation and/or other materials provided with the
48  *    distribution.
49  *  * Neither the name Intel Corporation nor the names of its
50  *    contributors may be used to endorse or promote products derived
51  *    from this software without specific prior written permission.
52  *
53  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
54  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
55  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
56  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
57  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
58  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
59  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
60  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
61  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
62  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
63  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
64  *
65  *****************************************************************************/
66 #include <linux/kernel.h>
67 #include <linux/slab.h>
68 #include <linux/skbuff.h>
69 #include <linux/netdevice.h>
70 #include <linux/etherdevice.h>
71 #include <linux/ip.h>
72 #include <linux/if_arp.h>
73 #include <linux/time.h>
74 #include <net/mac80211.h>
75 #include <net/ieee80211_radiotap.h>
76 #include <net/tcp.h>
77 
78 #include "iwl-op-mode.h"
79 #include "iwl-io.h"
80 #include "mvm.h"
81 #include "sta.h"
82 #include "time-event.h"
83 #include "iwl-eeprom-parse.h"
84 #include "iwl-phy-db.h"
85 #include "testmode.h"
86 #include "iwl-fw-error-dump.h"
87 #include "iwl-prph.h"
88 #include "iwl-nvm-parse.h"
89 #include "fw-dbg.h"
90 
91 static const struct ieee80211_iface_limit iwl_mvm_limits[] = {
92 	{
93 		.max = 1,
94 		.types = BIT(NL80211_IFTYPE_STATION),
95 	},
96 	{
97 		.max = 1,
98 		.types = BIT(NL80211_IFTYPE_AP) |
99 			BIT(NL80211_IFTYPE_P2P_CLIENT) |
100 			BIT(NL80211_IFTYPE_P2P_GO),
101 	},
102 	{
103 		.max = 1,
104 		.types = BIT(NL80211_IFTYPE_P2P_DEVICE),
105 	},
106 };
107 
108 static const struct ieee80211_iface_combination iwl_mvm_iface_combinations[] = {
109 	{
110 		.num_different_channels = 2,
111 		.max_interfaces = 3,
112 		.limits = iwl_mvm_limits,
113 		.n_limits = ARRAY_SIZE(iwl_mvm_limits),
114 	},
115 };
116 
117 #ifdef CONFIG_PM_SLEEP
118 static const struct nl80211_wowlan_tcp_data_token_feature
119 iwl_mvm_wowlan_tcp_token_feature = {
120 	.min_len = 0,
121 	.max_len = 255,
122 	.bufsize = IWL_WOWLAN_REMOTE_WAKE_MAX_TOKENS,
123 };
124 
125 static const struct wiphy_wowlan_tcp_support iwl_mvm_wowlan_tcp_support = {
126 	.tok = &iwl_mvm_wowlan_tcp_token_feature,
127 	.data_payload_max = IWL_WOWLAN_TCP_MAX_PACKET_LEN -
128 			    sizeof(struct ethhdr) -
129 			    sizeof(struct iphdr) -
130 			    sizeof(struct tcphdr),
131 	.data_interval_max = 65535, /* __le16 in API */
132 	.wake_payload_max = IWL_WOWLAN_REMOTE_WAKE_MAX_PACKET_LEN -
133 			    sizeof(struct ethhdr) -
134 			    sizeof(struct iphdr) -
135 			    sizeof(struct tcphdr),
136 	.seq = true,
137 };
138 #endif
139 
140 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
141 /*
142  * Use the reserved field to indicate magic values.
143  * these values will only be used internally by the driver,
144  * and won't make it to the fw (reserved will be 0).
145  * BC_FILTER_MAGIC_IP - configure the val of this attribute to
146  *	be the vif's ip address. in case there is not a single
147  *	ip address (0, or more than 1), this attribute will
148  *	be skipped.
149  * BC_FILTER_MAGIC_MAC - set the val of this attribute to
150  *	the LSB bytes of the vif's mac address
151  */
152 enum {
153 	BC_FILTER_MAGIC_NONE = 0,
154 	BC_FILTER_MAGIC_IP,
155 	BC_FILTER_MAGIC_MAC,
156 };
157 
158 static const struct iwl_fw_bcast_filter iwl_mvm_default_bcast_filters[] = {
159 	{
160 		/* arp */
161 		.discard = 0,
162 		.frame_type = BCAST_FILTER_FRAME_TYPE_ALL,
163 		.attrs = {
164 			{
165 				/* frame type - arp, hw type - ethernet */
166 				.offset_type =
167 					BCAST_FILTER_OFFSET_PAYLOAD_START,
168 				.offset = sizeof(rfc1042_header),
169 				.val = cpu_to_be32(0x08060001),
170 				.mask = cpu_to_be32(0xffffffff),
171 			},
172 			{
173 				/* arp dest ip */
174 				.offset_type =
175 					BCAST_FILTER_OFFSET_PAYLOAD_START,
176 				.offset = sizeof(rfc1042_header) + 2 +
177 					  sizeof(struct arphdr) +
178 					  ETH_ALEN + sizeof(__be32) +
179 					  ETH_ALEN,
180 				.mask = cpu_to_be32(0xffffffff),
181 				/* mark it as special field */
182 				.reserved1 = cpu_to_le16(BC_FILTER_MAGIC_IP),
183 			},
184 		},
185 	},
186 	{
187 		/* dhcp offer bcast */
188 		.discard = 0,
189 		.frame_type = BCAST_FILTER_FRAME_TYPE_IPV4,
190 		.attrs = {
191 			{
192 				/* udp dest port - 68 (bootp client)*/
193 				.offset_type = BCAST_FILTER_OFFSET_IP_END,
194 				.offset = offsetof(struct udphdr, dest),
195 				.val = cpu_to_be32(0x00440000),
196 				.mask = cpu_to_be32(0xffff0000),
197 			},
198 			{
199 				/* dhcp - lsb bytes of client hw address */
200 				.offset_type = BCAST_FILTER_OFFSET_IP_END,
201 				.offset = 38,
202 				.mask = cpu_to_be32(0xffffffff),
203 				/* mark it as special field */
204 				.reserved1 = cpu_to_le16(BC_FILTER_MAGIC_MAC),
205 			},
206 		},
207 	},
208 	/* last filter must be empty */
209 	{},
210 };
211 #endif
212 
213 void iwl_mvm_ref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
214 {
215 	if (!iwl_mvm_is_d0i3_supported(mvm))
216 		return;
217 
218 	IWL_DEBUG_RPM(mvm, "Take mvm reference - type %d\n", ref_type);
219 	spin_lock_bh(&mvm->refs_lock);
220 	mvm->refs[ref_type]++;
221 	spin_unlock_bh(&mvm->refs_lock);
222 	iwl_trans_ref(mvm->trans);
223 }
224 
225 void iwl_mvm_unref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
226 {
227 	if (!iwl_mvm_is_d0i3_supported(mvm))
228 		return;
229 
230 	IWL_DEBUG_RPM(mvm, "Leave mvm reference - type %d\n", ref_type);
231 	spin_lock_bh(&mvm->refs_lock);
232 	WARN_ON(!mvm->refs[ref_type]--);
233 	spin_unlock_bh(&mvm->refs_lock);
234 	iwl_trans_unref(mvm->trans);
235 }
236 
237 static void iwl_mvm_unref_all_except(struct iwl_mvm *mvm,
238 				     enum iwl_mvm_ref_type except_ref)
239 {
240 	int i, j;
241 
242 	if (!iwl_mvm_is_d0i3_supported(mvm))
243 		return;
244 
245 	spin_lock_bh(&mvm->refs_lock);
246 	for (i = 0; i < IWL_MVM_REF_COUNT; i++) {
247 		if (except_ref == i || !mvm->refs[i])
248 			continue;
249 
250 		IWL_DEBUG_RPM(mvm, "Cleanup: remove mvm ref type %d (%d)\n",
251 			      i, mvm->refs[i]);
252 		for (j = 0; j < mvm->refs[i]; j++)
253 			iwl_trans_unref(mvm->trans);
254 		mvm->refs[i] = 0;
255 	}
256 	spin_unlock_bh(&mvm->refs_lock);
257 }
258 
259 bool iwl_mvm_ref_taken(struct iwl_mvm *mvm)
260 {
261 	int i;
262 	bool taken = false;
263 
264 	if (!iwl_mvm_is_d0i3_supported(mvm))
265 		return true;
266 
267 	spin_lock_bh(&mvm->refs_lock);
268 	for (i = 0; i < IWL_MVM_REF_COUNT; i++) {
269 		if (mvm->refs[i]) {
270 			taken = true;
271 			break;
272 		}
273 	}
274 	spin_unlock_bh(&mvm->refs_lock);
275 
276 	return taken;
277 }
278 
279 int iwl_mvm_ref_sync(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
280 {
281 	iwl_mvm_ref(mvm, ref_type);
282 
283 	if (!wait_event_timeout(mvm->d0i3_exit_waitq,
284 				!test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status),
285 				HZ)) {
286 		WARN_ON_ONCE(1);
287 		iwl_mvm_unref(mvm, ref_type);
288 		return -EIO;
289 	}
290 
291 	return 0;
292 }
293 
294 static void iwl_mvm_reset_phy_ctxts(struct iwl_mvm *mvm)
295 {
296 	int i;
297 
298 	memset(mvm->phy_ctxts, 0, sizeof(mvm->phy_ctxts));
299 	for (i = 0; i < NUM_PHY_CTX; i++) {
300 		mvm->phy_ctxts[i].id = i;
301 		mvm->phy_ctxts[i].ref = 0;
302 	}
303 }
304 
305 struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
306 						  const char *alpha2,
307 						  enum iwl_mcc_source src_id,
308 						  bool *changed)
309 {
310 	struct ieee80211_regdomain *regd = NULL;
311 	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
312 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
313 	struct iwl_mcc_update_resp *resp;
314 
315 	IWL_DEBUG_LAR(mvm, "Getting regdomain data for %s from FW\n", alpha2);
316 
317 	lockdep_assert_held(&mvm->mutex);
318 
319 	resp = iwl_mvm_update_mcc(mvm, alpha2, src_id);
320 	if (IS_ERR_OR_NULL(resp)) {
321 		IWL_DEBUG_LAR(mvm, "Could not get update from FW %d\n",
322 			      PTR_ERR_OR_ZERO(resp));
323 		goto out;
324 	}
325 
326 	if (changed)
327 		*changed = (resp->status == MCC_RESP_NEW_CHAN_PROFILE);
328 
329 	regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg,
330 				      __le32_to_cpu(resp->n_channels),
331 				      resp->channels,
332 				      __le16_to_cpu(resp->mcc));
333 	/* Store the return source id */
334 	src_id = resp->source_id;
335 	kfree(resp);
336 	if (IS_ERR_OR_NULL(regd)) {
337 		IWL_DEBUG_LAR(mvm, "Could not get parse update from FW %d\n",
338 			      PTR_ERR_OR_ZERO(regd));
339 		goto out;
340 	}
341 
342 	IWL_DEBUG_LAR(mvm, "setting alpha2 from FW to %s (0x%x, 0x%x) src=%d\n",
343 		      regd->alpha2, regd->alpha2[0], regd->alpha2[1], src_id);
344 	mvm->lar_regdom_set = true;
345 	mvm->mcc_src = src_id;
346 
347 out:
348 	return regd;
349 }
350 
351 void iwl_mvm_update_changed_regdom(struct iwl_mvm *mvm)
352 {
353 	bool changed;
354 	struct ieee80211_regdomain *regd;
355 
356 	if (!iwl_mvm_is_lar_supported(mvm))
357 		return;
358 
359 	regd = iwl_mvm_get_current_regdomain(mvm, &changed);
360 	if (!IS_ERR_OR_NULL(regd)) {
361 		/* only update the regulatory core if changed */
362 		if (changed)
363 			regulatory_set_wiphy_regd(mvm->hw->wiphy, regd);
364 
365 		kfree(regd);
366 	}
367 }
368 
369 struct ieee80211_regdomain *iwl_mvm_get_current_regdomain(struct iwl_mvm *mvm,
370 							  bool *changed)
371 {
372 	return iwl_mvm_get_regdomain(mvm->hw->wiphy, "ZZ",
373 				     iwl_mvm_is_wifi_mcc_supported(mvm) ?
374 				     MCC_SOURCE_GET_CURRENT :
375 				     MCC_SOURCE_OLD_FW, changed);
376 }
377 
378 int iwl_mvm_init_fw_regd(struct iwl_mvm *mvm)
379 {
380 	enum iwl_mcc_source used_src;
381 	struct ieee80211_regdomain *regd;
382 	int ret;
383 	bool changed;
384 	const struct ieee80211_regdomain *r =
385 			rtnl_dereference(mvm->hw->wiphy->regd);
386 
387 	if (!r)
388 		return -ENOENT;
389 
390 	/* save the last source in case we overwrite it below */
391 	used_src = mvm->mcc_src;
392 	if (iwl_mvm_is_wifi_mcc_supported(mvm)) {
393 		/* Notify the firmware we support wifi location updates */
394 		regd = iwl_mvm_get_current_regdomain(mvm, NULL);
395 		if (!IS_ERR_OR_NULL(regd))
396 			kfree(regd);
397 	}
398 
399 	/* Now set our last stored MCC and source */
400 	regd = iwl_mvm_get_regdomain(mvm->hw->wiphy, r->alpha2, used_src,
401 				     &changed);
402 	if (IS_ERR_OR_NULL(regd))
403 		return -EIO;
404 
405 	/* update cfg80211 if the regdomain was changed */
406 	if (changed)
407 		ret = regulatory_set_wiphy_regd_sync_rtnl(mvm->hw->wiphy, regd);
408 	else
409 		ret = 0;
410 
411 	kfree(regd);
412 	return ret;
413 }
414 
415 int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
416 {
417 	struct ieee80211_hw *hw = mvm->hw;
418 	int num_mac, ret, i;
419 	static const u32 mvm_ciphers[] = {
420 		WLAN_CIPHER_SUITE_WEP40,
421 		WLAN_CIPHER_SUITE_WEP104,
422 		WLAN_CIPHER_SUITE_TKIP,
423 		WLAN_CIPHER_SUITE_CCMP,
424 	};
425 
426 	/* Tell mac80211 our characteristics */
427 	ieee80211_hw_set(hw, SIGNAL_DBM);
428 	ieee80211_hw_set(hw, SPECTRUM_MGMT);
429 	ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
430 	ieee80211_hw_set(hw, QUEUE_CONTROL);
431 	ieee80211_hw_set(hw, WANT_MONITOR_VIF);
432 	ieee80211_hw_set(hw, SUPPORTS_PS);
433 	ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
434 	ieee80211_hw_set(hw, AMPDU_AGGREGATION);
435 	ieee80211_hw_set(hw, TIMING_BEACON_ONLY);
436 	ieee80211_hw_set(hw, CONNECTION_MONITOR);
437 	ieee80211_hw_set(hw, CHANCTX_STA_CSA);
438 	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
439 	ieee80211_hw_set(hw, SUPPORTS_CLONED_SKBS);
440 	ieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);
441 	ieee80211_hw_set(hw, NEEDS_UNIQUE_STA_ADDR);
442 
443 	if (mvm->trans->max_skb_frags)
444 		hw->netdev_features = NETIF_F_HIGHDMA | NETIF_F_SG;
445 
446 	hw->queues = mvm->first_agg_queue;
447 	hw->offchannel_tx_hw_queue = IWL_MVM_OFFCHANNEL_QUEUE;
448 	hw->radiotap_mcs_details |= IEEE80211_RADIOTAP_MCS_HAVE_FEC |
449 				    IEEE80211_RADIOTAP_MCS_HAVE_STBC;
450 	hw->radiotap_vht_details |= IEEE80211_RADIOTAP_VHT_KNOWN_STBC |
451 		IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED;
452 	hw->rate_control_algorithm = "iwl-mvm-rs";
453 	hw->uapsd_queues = IWL_MVM_UAPSD_QUEUES;
454 	hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
455 
456 	BUILD_BUG_ON(ARRAY_SIZE(mvm->ciphers) < ARRAY_SIZE(mvm_ciphers) + 2);
457 	memcpy(mvm->ciphers, mvm_ciphers, sizeof(mvm_ciphers));
458 	hw->wiphy->n_cipher_suites = ARRAY_SIZE(mvm_ciphers);
459 	hw->wiphy->cipher_suites = mvm->ciphers;
460 
461 	/*
462 	 * Enable 11w if advertised by firmware and software crypto
463 	 * is not enabled (as the firmware will interpret some mgmt
464 	 * packets, so enabling it with software crypto isn't safe)
465 	 */
466 	if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_MFP &&
467 	    !iwlwifi_mod_params.sw_crypto) {
468 		ieee80211_hw_set(hw, MFP_CAPABLE);
469 		mvm->ciphers[hw->wiphy->n_cipher_suites] =
470 			WLAN_CIPHER_SUITE_AES_CMAC;
471 		hw->wiphy->n_cipher_suites++;
472 	}
473 
474 	/* currently FW API supports only one optional cipher scheme */
475 	if (mvm->fw->cs[0].cipher) {
476 		mvm->hw->n_cipher_schemes = 1;
477 		mvm->hw->cipher_schemes = &mvm->fw->cs[0];
478 		mvm->ciphers[hw->wiphy->n_cipher_suites] =
479 			mvm->fw->cs[0].cipher;
480 		hw->wiphy->n_cipher_suites++;
481 	}
482 
483 	ieee80211_hw_set(hw, SINGLE_SCAN_ON_ALL_BANDS);
484 	hw->wiphy->features |=
485 		NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR |
486 		NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR |
487 		NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
488 
489 	hw->sta_data_size = sizeof(struct iwl_mvm_sta);
490 	hw->vif_data_size = sizeof(struct iwl_mvm_vif);
491 	hw->chanctx_data_size = sizeof(u16);
492 
493 	hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
494 		BIT(NL80211_IFTYPE_P2P_CLIENT) |
495 		BIT(NL80211_IFTYPE_AP) |
496 		BIT(NL80211_IFTYPE_P2P_GO) |
497 		BIT(NL80211_IFTYPE_P2P_DEVICE) |
498 		BIT(NL80211_IFTYPE_ADHOC);
499 
500 	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
501 	hw->wiphy->regulatory_flags |= REGULATORY_ENABLE_RELAX_NO_IR;
502 	if (iwl_mvm_is_lar_supported(mvm))
503 		hw->wiphy->regulatory_flags |= REGULATORY_WIPHY_SELF_MANAGED;
504 	else
505 		hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG |
506 					       REGULATORY_DISABLE_BEACON_HINTS;
507 
508 	if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_GO_UAPSD)
509 		hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
510 
511 	hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
512 
513 	hw->wiphy->iface_combinations = iwl_mvm_iface_combinations;
514 	hw->wiphy->n_iface_combinations =
515 		ARRAY_SIZE(iwl_mvm_iface_combinations);
516 
517 	hw->wiphy->max_remain_on_channel_duration = 10000;
518 	hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
519 	/* we can compensate an offset of up to 3 channels = 15 MHz */
520 	hw->wiphy->max_adj_channel_rssi_comp = 3 * 5;
521 
522 	/* Extract MAC address */
523 	memcpy(mvm->addresses[0].addr, mvm->nvm_data->hw_addr, ETH_ALEN);
524 	hw->wiphy->addresses = mvm->addresses;
525 	hw->wiphy->n_addresses = 1;
526 
527 	/* Extract additional MAC addresses if available */
528 	num_mac = (mvm->nvm_data->n_hw_addrs > 1) ?
529 		min(IWL_MVM_MAX_ADDRESSES, mvm->nvm_data->n_hw_addrs) : 1;
530 
531 	for (i = 1; i < num_mac; i++) {
532 		memcpy(mvm->addresses[i].addr, mvm->addresses[i-1].addr,
533 		       ETH_ALEN);
534 		mvm->addresses[i].addr[5]++;
535 		hw->wiphy->n_addresses++;
536 	}
537 
538 	iwl_mvm_reset_phy_ctxts(mvm);
539 
540 	hw->wiphy->max_scan_ie_len = iwl_mvm_max_scan_ie_len(mvm);
541 
542 	hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
543 
544 	BUILD_BUG_ON(IWL_MVM_SCAN_STOPPING_MASK & IWL_MVM_SCAN_MASK);
545 	BUILD_BUG_ON(IWL_MVM_MAX_UMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK) ||
546 		     IWL_MVM_MAX_LMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK));
547 
548 	if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
549 		mvm->max_scans = IWL_MVM_MAX_UMAC_SCANS;
550 	else
551 		mvm->max_scans = IWL_MVM_MAX_LMAC_SCANS;
552 
553 	if (mvm->nvm_data->bands[IEEE80211_BAND_2GHZ].n_channels)
554 		hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
555 			&mvm->nvm_data->bands[IEEE80211_BAND_2GHZ];
556 	if (mvm->nvm_data->bands[IEEE80211_BAND_5GHZ].n_channels) {
557 		hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
558 			&mvm->nvm_data->bands[IEEE80211_BAND_5GHZ];
559 
560 		if (fw_has_capa(&mvm->fw->ucode_capa,
561 				IWL_UCODE_TLV_CAPA_BEAMFORMER) &&
562 		    fw_has_api(&mvm->fw->ucode_capa,
563 			       IWL_UCODE_TLV_API_LQ_SS_PARAMS))
564 			hw->wiphy->bands[IEEE80211_BAND_5GHZ]->vht_cap.cap |=
565 				IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
566 	}
567 
568 	hw->wiphy->hw_version = mvm->trans->hw_id;
569 
570 	if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM)
571 		hw->wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
572 	else
573 		hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
574 
575 	hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
576 	hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
577 	hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
578 	/* we create the 802.11 header and zero length SSID IE. */
579 	hw->wiphy->max_sched_scan_ie_len =
580 		SCAN_OFFLOAD_PROBE_REQ_SIZE - 24 - 2;
581 	hw->wiphy->max_sched_scan_plans = IWL_MAX_SCHED_SCAN_PLANS;
582 	hw->wiphy->max_sched_scan_plan_interval = U16_MAX;
583 
584 	/*
585 	 * the firmware uses u8 for num of iterations, but 0xff is saved for
586 	 * infinite loop, so the maximum number of iterations is actually 254.
587 	 */
588 	hw->wiphy->max_sched_scan_plan_iterations = 254;
589 
590 	hw->wiphy->features |= NL80211_FEATURE_P2P_GO_CTWIN |
591 			       NL80211_FEATURE_LOW_PRIORITY_SCAN |
592 			       NL80211_FEATURE_P2P_GO_OPPPS |
593 			       NL80211_FEATURE_DYNAMIC_SMPS |
594 			       NL80211_FEATURE_STATIC_SMPS |
595 			       NL80211_FEATURE_SUPPORTS_WMM_ADMISSION;
596 
597 	if (fw_has_capa(&mvm->fw->ucode_capa,
598 			IWL_UCODE_TLV_CAPA_TXPOWER_INSERTION_SUPPORT))
599 		hw->wiphy->features |= NL80211_FEATURE_TX_POWER_INSERTION;
600 	if (fw_has_capa(&mvm->fw->ucode_capa,
601 			IWL_UCODE_TLV_CAPA_QUIET_PERIOD_SUPPORT))
602 		hw->wiphy->features |= NL80211_FEATURE_QUIET;
603 
604 	if (fw_has_capa(&mvm->fw->ucode_capa,
605 			IWL_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT))
606 		hw->wiphy->features |=
607 			NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES;
608 
609 	if (fw_has_capa(&mvm->fw->ucode_capa,
610 			IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT))
611 		hw->wiphy->features |= NL80211_FEATURE_WFA_TPC_IE_IN_PROBES;
612 
613 	mvm->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
614 
615 #ifdef CONFIG_PM_SLEEP
616 	if (iwl_mvm_is_d0i3_supported(mvm) &&
617 	    device_can_wakeup(mvm->trans->dev)) {
618 		mvm->wowlan.flags = WIPHY_WOWLAN_ANY;
619 		hw->wiphy->wowlan = &mvm->wowlan;
620 	}
621 
622 	if (mvm->fw->img[IWL_UCODE_WOWLAN].sec[0].len &&
623 	    mvm->trans->ops->d3_suspend &&
624 	    mvm->trans->ops->d3_resume &&
625 	    device_can_wakeup(mvm->trans->dev)) {
626 		mvm->wowlan.flags |= WIPHY_WOWLAN_MAGIC_PKT |
627 				     WIPHY_WOWLAN_DISCONNECT |
628 				     WIPHY_WOWLAN_EAP_IDENTITY_REQ |
629 				     WIPHY_WOWLAN_RFKILL_RELEASE |
630 				     WIPHY_WOWLAN_NET_DETECT;
631 		if (!iwlwifi_mod_params.sw_crypto)
632 			mvm->wowlan.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY |
633 					     WIPHY_WOWLAN_GTK_REKEY_FAILURE |
634 					     WIPHY_WOWLAN_4WAY_HANDSHAKE;
635 
636 		mvm->wowlan.n_patterns = IWL_WOWLAN_MAX_PATTERNS;
637 		mvm->wowlan.pattern_min_len = IWL_WOWLAN_MIN_PATTERN_LEN;
638 		mvm->wowlan.pattern_max_len = IWL_WOWLAN_MAX_PATTERN_LEN;
639 		mvm->wowlan.max_nd_match_sets = IWL_SCAN_MAX_PROFILES;
640 		mvm->wowlan.tcp = &iwl_mvm_wowlan_tcp_support;
641 		hw->wiphy->wowlan = &mvm->wowlan;
642 	}
643 #endif
644 
645 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
646 	/* assign default bcast filtering configuration */
647 	mvm->bcast_filters = iwl_mvm_default_bcast_filters;
648 #endif
649 
650 	ret = iwl_mvm_leds_init(mvm);
651 	if (ret)
652 		return ret;
653 
654 	if (fw_has_capa(&mvm->fw->ucode_capa,
655 			IWL_UCODE_TLV_CAPA_TDLS_SUPPORT)) {
656 		IWL_DEBUG_TDLS(mvm, "TDLS supported\n");
657 		hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
658 		ieee80211_hw_set(hw, TDLS_WIDER_BW);
659 	}
660 
661 	if (fw_has_capa(&mvm->fw->ucode_capa,
662 			IWL_UCODE_TLV_CAPA_TDLS_CHANNEL_SWITCH)) {
663 		IWL_DEBUG_TDLS(mvm, "TDLS channel switch supported\n");
664 		hw->wiphy->features |= NL80211_FEATURE_TDLS_CHANNEL_SWITCH;
665 	}
666 
667 	hw->netdev_features |= mvm->cfg->features;
668 	if (!iwl_mvm_is_csum_supported(mvm))
669 		hw->netdev_features &= ~NETIF_F_RXCSUM;
670 
671 	if (IWL_MVM_SW_TX_CSUM_OFFLOAD)
672 		hw->netdev_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
673 			NETIF_F_TSO | NETIF_F_TSO6;
674 
675 	ret = ieee80211_register_hw(mvm->hw);
676 	if (ret)
677 		iwl_mvm_leds_exit(mvm);
678 
679 	return ret;
680 }
681 
682 static bool iwl_mvm_defer_tx(struct iwl_mvm *mvm,
683 			     struct ieee80211_sta *sta,
684 			     struct sk_buff *skb)
685 {
686 	struct iwl_mvm_sta *mvmsta;
687 	bool defer = false;
688 
689 	/*
690 	 * double check the IN_D0I3 flag both before and after
691 	 * taking the spinlock, in order to prevent taking
692 	 * the spinlock when not needed.
693 	 */
694 	if (likely(!test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status)))
695 		return false;
696 
697 	spin_lock(&mvm->d0i3_tx_lock);
698 	/*
699 	 * testing the flag again ensures the skb dequeue
700 	 * loop (on d0i3 exit) hasn't run yet.
701 	 */
702 	if (!test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status))
703 		goto out;
704 
705 	mvmsta = iwl_mvm_sta_from_mac80211(sta);
706 	if (mvmsta->sta_id == IWL_MVM_STATION_COUNT ||
707 	    mvmsta->sta_id != mvm->d0i3_ap_sta_id)
708 		goto out;
709 
710 	__skb_queue_tail(&mvm->d0i3_tx, skb);
711 	ieee80211_stop_queues(mvm->hw);
712 
713 	/* trigger wakeup */
714 	iwl_mvm_ref(mvm, IWL_MVM_REF_TX);
715 	iwl_mvm_unref(mvm, IWL_MVM_REF_TX);
716 
717 	defer = true;
718 out:
719 	spin_unlock(&mvm->d0i3_tx_lock);
720 	return defer;
721 }
722 
723 static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
724 			   struct ieee80211_tx_control *control,
725 			   struct sk_buff *skb)
726 {
727 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
728 	struct ieee80211_sta *sta = control->sta;
729 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
730 	struct ieee80211_hdr *hdr = (void *)skb->data;
731 
732 	if (iwl_mvm_is_radio_killed(mvm)) {
733 		IWL_DEBUG_DROP(mvm, "Dropping - RF/CT KILL\n");
734 		goto drop;
735 	}
736 
737 	if (IEEE80211_SKB_CB(skb)->hw_queue == IWL_MVM_OFFCHANNEL_QUEUE &&
738 	    !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status) &&
739 	    !test_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status))
740 		goto drop;
741 
742 	/* treat non-bufferable MMPDUs as broadcast if sta is sleeping */
743 	if (unlikely(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER &&
744 		     ieee80211_is_mgmt(hdr->frame_control) &&
745 		     !ieee80211_is_deauth(hdr->frame_control) &&
746 		     !ieee80211_is_disassoc(hdr->frame_control) &&
747 		     !ieee80211_is_action(hdr->frame_control)))
748 		sta = NULL;
749 
750 	if (sta) {
751 		if (iwl_mvm_defer_tx(mvm, sta, skb))
752 			return;
753 		if (iwl_mvm_tx_skb(mvm, skb, sta))
754 			goto drop;
755 		return;
756 	}
757 
758 	if (iwl_mvm_tx_skb_non_sta(mvm, skb))
759 		goto drop;
760 	return;
761  drop:
762 	ieee80211_free_txskb(hw, skb);
763 }
764 
765 static inline bool iwl_enable_rx_ampdu(const struct iwl_cfg *cfg)
766 {
767 	if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG)
768 		return false;
769 	return true;
770 }
771 
772 static inline bool iwl_enable_tx_ampdu(const struct iwl_cfg *cfg)
773 {
774 	if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG)
775 		return false;
776 	if (iwlwifi_mod_params.disable_11n & IWL_ENABLE_HT_TXAGG)
777 		return true;
778 
779 	/* enabled by default */
780 	return true;
781 }
782 
783 #define CHECK_BA_TRIGGER(_mvm, _trig, _tid_bm, _tid, _fmt...)	\
784 	do {							\
785 		if (!(le16_to_cpu(_tid_bm) & BIT(_tid)))	\
786 			break;					\
787 		iwl_mvm_fw_dbg_collect_trig(_mvm, _trig, _fmt);	\
788 	} while (0)
789 
790 static void
791 iwl_mvm_ampdu_check_trigger(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
792 			    struct ieee80211_sta *sta, u16 tid, u16 rx_ba_ssn,
793 			    enum ieee80211_ampdu_mlme_action action)
794 {
795 	struct iwl_fw_dbg_trigger_tlv *trig;
796 	struct iwl_fw_dbg_trigger_ba *ba_trig;
797 
798 	if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_BA))
799 		return;
800 
801 	trig = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_BA);
802 	ba_trig = (void *)trig->data;
803 
804 	if (!iwl_fw_dbg_trigger_check_stop(mvm, vif, trig))
805 		return;
806 
807 	switch (action) {
808 	case IEEE80211_AMPDU_TX_OPERATIONAL: {
809 		struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
810 		struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
811 
812 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_start, tid,
813 				 "TX AGG START: MAC %pM tid %d ssn %d\n",
814 				 sta->addr, tid, tid_data->ssn);
815 		break;
816 		}
817 	case IEEE80211_AMPDU_TX_STOP_CONT:
818 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_stop, tid,
819 				 "TX AGG STOP: MAC %pM tid %d\n",
820 				 sta->addr, tid);
821 		break;
822 	case IEEE80211_AMPDU_RX_START:
823 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_start, tid,
824 				 "RX AGG START: MAC %pM tid %d ssn %d\n",
825 				 sta->addr, tid, rx_ba_ssn);
826 		break;
827 	case IEEE80211_AMPDU_RX_STOP:
828 		CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_stop, tid,
829 				 "RX AGG STOP: MAC %pM tid %d\n",
830 				 sta->addr, tid);
831 		break;
832 	default:
833 		break;
834 	}
835 }
836 
837 static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
838 				    struct ieee80211_vif *vif,
839 				    struct ieee80211_ampdu_params *params)
840 {
841 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
842 	int ret;
843 	bool tx_agg_ref = false;
844 	struct ieee80211_sta *sta = params->sta;
845 	enum ieee80211_ampdu_mlme_action action = params->action;
846 	u16 tid = params->tid;
847 	u16 *ssn = &params->ssn;
848 	u8 buf_size = params->buf_size;
849 	bool amsdu = params->amsdu;
850 
851 	IWL_DEBUG_HT(mvm, "A-MPDU action on addr %pM tid %d: action %d\n",
852 		     sta->addr, tid, action);
853 
854 	if (!(mvm->nvm_data->sku_cap_11n_enable))
855 		return -EACCES;
856 
857 	/* return from D0i3 before starting a new Tx aggregation */
858 	switch (action) {
859 	case IEEE80211_AMPDU_TX_START:
860 	case IEEE80211_AMPDU_TX_STOP_CONT:
861 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
862 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
863 	case IEEE80211_AMPDU_TX_OPERATIONAL:
864 		/*
865 		 * for tx start, wait synchronously until D0i3 exit to
866 		 * get the correct sequence number for the tid.
867 		 * additionally, some other ampdu actions use direct
868 		 * target access, which is not handled automatically
869 		 * by the trans layer (unlike commands), so wait for
870 		 * d0i3 exit in these cases as well.
871 		 */
872 		ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_TX_AGG);
873 		if (ret)
874 			return ret;
875 
876 		tx_agg_ref = true;
877 		break;
878 	default:
879 		break;
880 	}
881 
882 	mutex_lock(&mvm->mutex);
883 
884 	switch (action) {
885 	case IEEE80211_AMPDU_RX_START:
886 		if (!iwl_enable_rx_ampdu(mvm->cfg)) {
887 			ret = -EINVAL;
888 			break;
889 		}
890 		ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, *ssn, true, buf_size);
891 		break;
892 	case IEEE80211_AMPDU_RX_STOP:
893 		ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, 0, false, buf_size);
894 		break;
895 	case IEEE80211_AMPDU_TX_START:
896 		if (!iwl_enable_tx_ampdu(mvm->cfg)) {
897 			ret = -EINVAL;
898 			break;
899 		}
900 		ret = iwl_mvm_sta_tx_agg_start(mvm, vif, sta, tid, ssn);
901 		break;
902 	case IEEE80211_AMPDU_TX_STOP_CONT:
903 		ret = iwl_mvm_sta_tx_agg_stop(mvm, vif, sta, tid);
904 		break;
905 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
906 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
907 		ret = iwl_mvm_sta_tx_agg_flush(mvm, vif, sta, tid);
908 		break;
909 	case IEEE80211_AMPDU_TX_OPERATIONAL:
910 		ret = iwl_mvm_sta_tx_agg_oper(mvm, vif, sta, tid,
911 					      buf_size, amsdu);
912 		break;
913 	default:
914 		WARN_ON_ONCE(1);
915 		ret = -EINVAL;
916 		break;
917 	}
918 
919 	if (!ret) {
920 		u16 rx_ba_ssn = 0;
921 
922 		if (action == IEEE80211_AMPDU_RX_START)
923 			rx_ba_ssn = *ssn;
924 
925 		iwl_mvm_ampdu_check_trigger(mvm, vif, sta, tid,
926 					    rx_ba_ssn, action);
927 	}
928 	mutex_unlock(&mvm->mutex);
929 
930 	/*
931 	 * If the tid is marked as started, we won't use it for offloaded
932 	 * traffic on the next D0i3 entry. It's safe to unref.
933 	 */
934 	if (tx_agg_ref)
935 		iwl_mvm_unref(mvm, IWL_MVM_REF_TX_AGG);
936 
937 	return ret;
938 }
939 
940 static void iwl_mvm_cleanup_iterator(void *data, u8 *mac,
941 				     struct ieee80211_vif *vif)
942 {
943 	struct iwl_mvm *mvm = data;
944 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
945 
946 	mvmvif->uploaded = false;
947 	mvmvif->ap_sta_id = IWL_MVM_STATION_COUNT;
948 
949 	spin_lock_bh(&mvm->time_event_lock);
950 	iwl_mvm_te_clear_data(mvm, &mvmvif->time_event_data);
951 	spin_unlock_bh(&mvm->time_event_lock);
952 
953 	mvmvif->phy_ctxt = NULL;
954 	memset(&mvmvif->bf_data, 0, sizeof(mvmvif->bf_data));
955 }
956 
957 static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
958 {
959 	/* clear the D3 reconfig, we only need it to avoid dumping a
960 	 * firmware coredump on reconfiguration, we shouldn't do that
961 	 * on D3->D0 transition
962 	 */
963 	if (!test_and_clear_bit(IWL_MVM_STATUS_D3_RECONFIG, &mvm->status)) {
964 		mvm->fw_dump_desc = &iwl_mvm_dump_desc_assert;
965 		iwl_mvm_fw_error_dump(mvm);
966 	}
967 
968 	/* cleanup all stale references (scan, roc), but keep the
969 	 * ucode_down ref until reconfig is complete
970 	 */
971 	iwl_mvm_unref_all_except(mvm, IWL_MVM_REF_UCODE_DOWN);
972 
973 	iwl_mvm_stop_device(mvm);
974 
975 	mvm->scan_status = 0;
976 	mvm->ps_disabled = false;
977 	mvm->calibrating = false;
978 
979 	/* just in case one was running */
980 	iwl_mvm_cleanup_roc_te(mvm);
981 	ieee80211_remain_on_channel_expired(mvm->hw);
982 
983 	/*
984 	 * cleanup all interfaces, even inactive ones, as some might have
985 	 * gone down during the HW restart
986 	 */
987 	ieee80211_iterate_interfaces(mvm->hw, 0, iwl_mvm_cleanup_iterator, mvm);
988 
989 	mvm->p2p_device_vif = NULL;
990 	mvm->d0i3_ap_sta_id = IWL_MVM_STATION_COUNT;
991 
992 	iwl_mvm_reset_phy_ctxts(mvm);
993 	memset(mvm->fw_key_table, 0, sizeof(mvm->fw_key_table));
994 	memset(mvm->sta_drained, 0, sizeof(mvm->sta_drained));
995 	memset(mvm->tfd_drained, 0, sizeof(mvm->tfd_drained));
996 	memset(&mvm->last_bt_notif, 0, sizeof(mvm->last_bt_notif));
997 	memset(&mvm->last_bt_notif_old, 0, sizeof(mvm->last_bt_notif_old));
998 	memset(&mvm->last_bt_ci_cmd, 0, sizeof(mvm->last_bt_ci_cmd));
999 	memset(&mvm->last_bt_ci_cmd_old, 0, sizeof(mvm->last_bt_ci_cmd_old));
1000 	memset(&mvm->bt_ack_kill_msk, 0, sizeof(mvm->bt_ack_kill_msk));
1001 	memset(&mvm->bt_cts_kill_msk, 0, sizeof(mvm->bt_cts_kill_msk));
1002 
1003 	ieee80211_wake_queues(mvm->hw);
1004 
1005 	/* clear any stale d0i3 state */
1006 	clear_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status);
1007 
1008 	mvm->vif_count = 0;
1009 	mvm->rx_ba_sessions = 0;
1010 	mvm->fw_dbg_conf = FW_DBG_INVALID;
1011 
1012 	/* keep statistics ticking */
1013 	iwl_mvm_accu_radio_stats(mvm);
1014 }
1015 
1016 int __iwl_mvm_mac_start(struct iwl_mvm *mvm)
1017 {
1018 	int ret;
1019 
1020 	lockdep_assert_held(&mvm->mutex);
1021 
1022 	if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
1023 		/* Clean up some internal and mac80211 state on restart */
1024 		iwl_mvm_restart_cleanup(mvm);
1025 	} else {
1026 		/* Hold the reference to prevent runtime suspend while
1027 		 * the start procedure runs.  It's a bit confusing
1028 		 * that the UCODE_DOWN reference is taken, but it just
1029 		 * means "UCODE is not UP yet". ( TODO: rename this
1030 		 * reference).
1031 		 */
1032 		iwl_mvm_ref(mvm, IWL_MVM_REF_UCODE_DOWN);
1033 	}
1034 	ret = iwl_mvm_up(mvm);
1035 
1036 	if (ret && test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
1037 		/* Something went wrong - we need to finish some cleanup
1038 		 * that normally iwl_mvm_mac_restart_complete() below
1039 		 * would do.
1040 		 */
1041 		clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1042 		iwl_mvm_d0i3_enable_tx(mvm, NULL);
1043 	}
1044 
1045 	return ret;
1046 }
1047 
1048 static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
1049 {
1050 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1051 	int ret;
1052 
1053 	/* Some hw restart cleanups must not hold the mutex */
1054 	if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
1055 		/*
1056 		 * Make sure we are out of d0i3. This is needed
1057 		 * to make sure the reference accounting is correct
1058 		 * (and there is no stale d0i3_exit_work).
1059 		 */
1060 		wait_event_timeout(mvm->d0i3_exit_waitq,
1061 				   !test_bit(IWL_MVM_STATUS_IN_D0I3,
1062 					     &mvm->status),
1063 				   HZ);
1064 	}
1065 
1066 	mutex_lock(&mvm->mutex);
1067 	ret = __iwl_mvm_mac_start(mvm);
1068 	mutex_unlock(&mvm->mutex);
1069 
1070 	return ret;
1071 }
1072 
1073 static void iwl_mvm_restart_complete(struct iwl_mvm *mvm)
1074 {
1075 	int ret;
1076 
1077 	mutex_lock(&mvm->mutex);
1078 
1079 	clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1080 	iwl_mvm_d0i3_enable_tx(mvm, NULL);
1081 	ret = iwl_mvm_update_quotas(mvm, true, NULL);
1082 	if (ret)
1083 		IWL_ERR(mvm, "Failed to update quotas after restart (%d)\n",
1084 			ret);
1085 
1086 	/* allow transport/FW low power modes */
1087 	iwl_mvm_unref(mvm, IWL_MVM_REF_UCODE_DOWN);
1088 
1089 	/*
1090 	 * If we have TDLS peers, remove them. We don't know the last seqno/PN
1091 	 * of packets the FW sent out, so we must reconnect.
1092 	 */
1093 	iwl_mvm_teardown_tdls_peers(mvm);
1094 
1095 	mutex_unlock(&mvm->mutex);
1096 }
1097 
1098 static void iwl_mvm_resume_complete(struct iwl_mvm *mvm)
1099 {
1100 	if (iwl_mvm_is_d0i3_supported(mvm) &&
1101 	    iwl_mvm_enter_d0i3_on_suspend(mvm))
1102 		WARN_ONCE(!wait_event_timeout(mvm->d0i3_exit_waitq,
1103 					      !test_bit(IWL_MVM_STATUS_IN_D0I3,
1104 							&mvm->status),
1105 					      HZ),
1106 			  "D0i3 exit on resume timed out\n");
1107 }
1108 
1109 static void
1110 iwl_mvm_mac_reconfig_complete(struct ieee80211_hw *hw,
1111 			      enum ieee80211_reconfig_type reconfig_type)
1112 {
1113 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1114 
1115 	switch (reconfig_type) {
1116 	case IEEE80211_RECONFIG_TYPE_RESTART:
1117 		iwl_mvm_restart_complete(mvm);
1118 		break;
1119 	case IEEE80211_RECONFIG_TYPE_SUSPEND:
1120 		iwl_mvm_resume_complete(mvm);
1121 		break;
1122 	}
1123 }
1124 
1125 void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
1126 {
1127 	lockdep_assert_held(&mvm->mutex);
1128 
1129 	/* firmware counters are obviously reset now, but we shouldn't
1130 	 * partially track so also clear the fw_reset_accu counters.
1131 	 */
1132 	memset(&mvm->accu_radio_stats, 0, sizeof(mvm->accu_radio_stats));
1133 
1134 	/* async_handlers_wk is now blocked */
1135 
1136 	/*
1137 	 * The work item could be running or queued if the
1138 	 * ROC time event stops just as we get here.
1139 	 */
1140 	flush_work(&mvm->roc_done_wk);
1141 
1142 	iwl_mvm_stop_device(mvm);
1143 
1144 	iwl_mvm_async_handlers_purge(mvm);
1145 	/* async_handlers_list is empty and will stay empty: HW is stopped */
1146 
1147 	/* the fw is stopped, the aux sta is dead: clean up driver state */
1148 	iwl_mvm_del_aux_sta(mvm);
1149 
1150 	/*
1151 	 * Clear IN_HW_RESTART flag when stopping the hw (as restart_complete()
1152 	 * won't be called in this case).
1153 	 * But make sure to cleanup interfaces that have gone down before/during
1154 	 * HW restart was requested.
1155 	 */
1156 	if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
1157 		ieee80211_iterate_interfaces(mvm->hw, 0,
1158 					     iwl_mvm_cleanup_iterator, mvm);
1159 
1160 	/* We shouldn't have any UIDs still set.  Loop over all the UIDs to
1161 	 * make sure there's nothing left there and warn if any is found.
1162 	 */
1163 	if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1164 		int i;
1165 
1166 		for (i = 0; i < mvm->max_scans; i++) {
1167 			if (WARN_ONCE(mvm->scan_uid_status[i],
1168 				      "UMAC scan UID %d status was not cleaned\n",
1169 				      i))
1170 				mvm->scan_uid_status[i] = 0;
1171 		}
1172 	}
1173 }
1174 
1175 static void iwl_mvm_mac_stop(struct ieee80211_hw *hw)
1176 {
1177 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1178 
1179 	flush_work(&mvm->d0i3_exit_work);
1180 	flush_work(&mvm->async_handlers_wk);
1181 	cancel_delayed_work_sync(&mvm->fw_dump_wk);
1182 	iwl_mvm_free_fw_dump_desc(mvm);
1183 
1184 	mutex_lock(&mvm->mutex);
1185 	__iwl_mvm_mac_stop(mvm);
1186 	mutex_unlock(&mvm->mutex);
1187 
1188 	/*
1189 	 * The worker might have been waiting for the mutex, let it run and
1190 	 * discover that its list is now empty.
1191 	 */
1192 	cancel_work_sync(&mvm->async_handlers_wk);
1193 }
1194 
1195 static struct iwl_mvm_phy_ctxt *iwl_mvm_get_free_phy_ctxt(struct iwl_mvm *mvm)
1196 {
1197 	u16 i;
1198 
1199 	lockdep_assert_held(&mvm->mutex);
1200 
1201 	for (i = 0; i < NUM_PHY_CTX; i++)
1202 		if (!mvm->phy_ctxts[i].ref)
1203 			return &mvm->phy_ctxts[i];
1204 
1205 	IWL_ERR(mvm, "No available PHY context\n");
1206 	return NULL;
1207 }
1208 
1209 static int iwl_mvm_set_tx_power(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1210 				s16 tx_power)
1211 {
1212 	struct iwl_dev_tx_power_cmd cmd = {
1213 		.v2.set_mode = cpu_to_le32(IWL_TX_POWER_MODE_SET_MAC),
1214 		.v2.mac_context_id =
1215 			cpu_to_le32(iwl_mvm_vif_from_mac80211(vif)->id),
1216 		.v2.pwr_restriction = cpu_to_le16(8 * tx_power),
1217 	};
1218 	int len = sizeof(cmd);
1219 
1220 	if (tx_power == IWL_DEFAULT_MAX_TX_POWER)
1221 		cmd.v2.pwr_restriction = cpu_to_le16(IWL_DEV_MAX_TX_POWER);
1222 
1223 	if (!fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_TX_POWER_CHAIN))
1224 		len = sizeof(cmd.v2);
1225 
1226 	return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, 0, len, &cmd);
1227 }
1228 
1229 static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
1230 				     struct ieee80211_vif *vif)
1231 {
1232 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1233 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1234 	int ret;
1235 
1236 	mvmvif->mvm = mvm;
1237 
1238 	/*
1239 	 * make sure D0i3 exit is completed, otherwise a target access
1240 	 * during tx queue configuration could be done when still in
1241 	 * D0i3 state.
1242 	 */
1243 	ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_ADD_IF);
1244 	if (ret)
1245 		return ret;
1246 
1247 	/*
1248 	 * Not much to do here. The stack will not allow interface
1249 	 * types or combinations that we didn't advertise, so we
1250 	 * don't really have to check the types.
1251 	 */
1252 
1253 	mutex_lock(&mvm->mutex);
1254 
1255 	/* make sure that beacon statistics don't go backwards with FW reset */
1256 	if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
1257 		mvmvif->beacon_stats.accu_num_beacons +=
1258 			mvmvif->beacon_stats.num_beacons;
1259 
1260 	/* Allocate resources for the MAC context, and add it to the fw  */
1261 	ret = iwl_mvm_mac_ctxt_init(mvm, vif);
1262 	if (ret)
1263 		goto out_unlock;
1264 
1265 	/* Counting number of interfaces is needed for legacy PM */
1266 	if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1267 		mvm->vif_count++;
1268 
1269 	/*
1270 	 * The AP binding flow can be done only after the beacon
1271 	 * template is configured (which happens only in the mac80211
1272 	 * start_ap() flow), and adding the broadcast station can happen
1273 	 * only after the binding.
1274 	 * In addition, since modifying the MAC before adding a bcast
1275 	 * station is not allowed by the FW, delay the adding of MAC context to
1276 	 * the point where we can also add the bcast station.
1277 	 * In short: there's not much we can do at this point, other than
1278 	 * allocating resources :)
1279 	 */
1280 	if (vif->type == NL80211_IFTYPE_AP ||
1281 	    vif->type == NL80211_IFTYPE_ADHOC) {
1282 		ret = iwl_mvm_alloc_bcast_sta(mvm, vif);
1283 		if (ret) {
1284 			IWL_ERR(mvm, "Failed to allocate bcast sta\n");
1285 			goto out_release;
1286 		}
1287 
1288 		iwl_mvm_vif_dbgfs_register(mvm, vif);
1289 		goto out_unlock;
1290 	}
1291 
1292 	mvmvif->features |= hw->netdev_features;
1293 
1294 	ret = iwl_mvm_mac_ctxt_add(mvm, vif);
1295 	if (ret)
1296 		goto out_release;
1297 
1298 	ret = iwl_mvm_power_update_mac(mvm);
1299 	if (ret)
1300 		goto out_remove_mac;
1301 
1302 	/* beacon filtering */
1303 	ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
1304 	if (ret)
1305 		goto out_remove_mac;
1306 
1307 	if (!mvm->bf_allowed_vif &&
1308 	    vif->type == NL80211_IFTYPE_STATION && !vif->p2p) {
1309 		mvm->bf_allowed_vif = mvmvif;
1310 		vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
1311 				     IEEE80211_VIF_SUPPORTS_CQM_RSSI;
1312 	}
1313 
1314 	/*
1315 	 * P2P_DEVICE interface does not have a channel context assigned to it,
1316 	 * so a dedicated PHY context is allocated to it and the corresponding
1317 	 * MAC context is bound to it at this stage.
1318 	 */
1319 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1320 
1321 		mvmvif->phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
1322 		if (!mvmvif->phy_ctxt) {
1323 			ret = -ENOSPC;
1324 			goto out_free_bf;
1325 		}
1326 
1327 		iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
1328 		ret = iwl_mvm_binding_add_vif(mvm, vif);
1329 		if (ret)
1330 			goto out_unref_phy;
1331 
1332 		ret = iwl_mvm_add_bcast_sta(mvm, vif);
1333 		if (ret)
1334 			goto out_unbind;
1335 
1336 		/* Save a pointer to p2p device vif, so it can later be used to
1337 		 * update the p2p device MAC when a GO is started/stopped */
1338 		mvm->p2p_device_vif = vif;
1339 	}
1340 
1341 	iwl_mvm_vif_dbgfs_register(mvm, vif);
1342 	goto out_unlock;
1343 
1344  out_unbind:
1345 	iwl_mvm_binding_remove_vif(mvm, vif);
1346  out_unref_phy:
1347 	iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1348  out_free_bf:
1349 	if (mvm->bf_allowed_vif == mvmvif) {
1350 		mvm->bf_allowed_vif = NULL;
1351 		vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1352 				       IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1353 	}
1354  out_remove_mac:
1355 	mvmvif->phy_ctxt = NULL;
1356 	iwl_mvm_mac_ctxt_remove(mvm, vif);
1357  out_release:
1358 	if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1359 		mvm->vif_count--;
1360 
1361 	iwl_mvm_mac_ctxt_release(mvm, vif);
1362  out_unlock:
1363 	mutex_unlock(&mvm->mutex);
1364 
1365 	iwl_mvm_unref(mvm, IWL_MVM_REF_ADD_IF);
1366 
1367 	return ret;
1368 }
1369 
1370 static void iwl_mvm_prepare_mac_removal(struct iwl_mvm *mvm,
1371 					struct ieee80211_vif *vif)
1372 {
1373 	u32 tfd_msk = iwl_mvm_mac_get_queues_mask(vif);
1374 
1375 	if (tfd_msk) {
1376 		/*
1377 		 * mac80211 first removes all the stations of the vif and
1378 		 * then removes the vif. When it removes a station it also
1379 		 * flushes the AMPDU session. So by now, all the AMPDU sessions
1380 		 * of all the stations of this vif are closed, and the queues
1381 		 * of these AMPDU sessions are properly closed.
1382 		 * We still need to take care of the shared queues of the vif.
1383 		 * Flush them here.
1384 		 */
1385 		mutex_lock(&mvm->mutex);
1386 		iwl_mvm_flush_tx_path(mvm, tfd_msk, 0);
1387 		mutex_unlock(&mvm->mutex);
1388 
1389 		/*
1390 		 * There are transports that buffer a few frames in the host.
1391 		 * For these, the flush above isn't enough since while we were
1392 		 * flushing, the transport might have sent more frames to the
1393 		 * device. To solve this, wait here until the transport is
1394 		 * empty. Technically, this could have replaced the flush
1395 		 * above, but flush is much faster than draining. So flush
1396 		 * first, and drain to make sure we have no frames in the
1397 		 * transport anymore.
1398 		 * If a station still had frames on the shared queues, it is
1399 		 * already marked as draining, so to complete the draining, we
1400 		 * just need to wait until the transport is empty.
1401 		 */
1402 		iwl_trans_wait_tx_queue_empty(mvm->trans, tfd_msk);
1403 	}
1404 
1405 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1406 		/*
1407 		 * Flush the ROC worker which will flush the OFFCHANNEL queue.
1408 		 * We assume here that all the packets sent to the OFFCHANNEL
1409 		 * queue are sent in ROC session.
1410 		 */
1411 		flush_work(&mvm->roc_done_wk);
1412 	} else {
1413 		/*
1414 		 * By now, all the AC queues are empty. The AGG queues are
1415 		 * empty too. We already got all the Tx responses for all the
1416 		 * packets in the queues. The drain work can have been
1417 		 * triggered. Flush it.
1418 		 */
1419 		flush_work(&mvm->sta_drained_wk);
1420 	}
1421 }
1422 
1423 static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
1424 					 struct ieee80211_vif *vif)
1425 {
1426 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1427 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1428 
1429 	iwl_mvm_prepare_mac_removal(mvm, vif);
1430 
1431 	mutex_lock(&mvm->mutex);
1432 
1433 	if (mvm->bf_allowed_vif == mvmvif) {
1434 		mvm->bf_allowed_vif = NULL;
1435 		vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1436 				       IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1437 	}
1438 
1439 	iwl_mvm_vif_dbgfs_clean(mvm, vif);
1440 
1441 	/*
1442 	 * For AP/GO interface, the tear down of the resources allocated to the
1443 	 * interface is be handled as part of the stop_ap flow.
1444 	 */
1445 	if (vif->type == NL80211_IFTYPE_AP ||
1446 	    vif->type == NL80211_IFTYPE_ADHOC) {
1447 #ifdef CONFIG_NL80211_TESTMODE
1448 		if (vif == mvm->noa_vif) {
1449 			mvm->noa_vif = NULL;
1450 			mvm->noa_duration = 0;
1451 		}
1452 #endif
1453 		iwl_mvm_dealloc_bcast_sta(mvm, vif);
1454 		goto out_release;
1455 	}
1456 
1457 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1458 		mvm->p2p_device_vif = NULL;
1459 		iwl_mvm_rm_bcast_sta(mvm, vif);
1460 		iwl_mvm_binding_remove_vif(mvm, vif);
1461 		iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1462 		mvmvif->phy_ctxt = NULL;
1463 	}
1464 
1465 	if (mvm->vif_count && vif->type != NL80211_IFTYPE_P2P_DEVICE)
1466 		mvm->vif_count--;
1467 
1468 	iwl_mvm_power_update_mac(mvm);
1469 	iwl_mvm_mac_ctxt_remove(mvm, vif);
1470 
1471 out_release:
1472 	iwl_mvm_mac_ctxt_release(mvm, vif);
1473 	mutex_unlock(&mvm->mutex);
1474 }
1475 
1476 static int iwl_mvm_mac_config(struct ieee80211_hw *hw, u32 changed)
1477 {
1478 	return 0;
1479 }
1480 
1481 struct iwl_mvm_mc_iter_data {
1482 	struct iwl_mvm *mvm;
1483 	int port_id;
1484 };
1485 
1486 static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
1487 				      struct ieee80211_vif *vif)
1488 {
1489 	struct iwl_mvm_mc_iter_data *data = _data;
1490 	struct iwl_mvm *mvm = data->mvm;
1491 	struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd;
1492 	int ret, len;
1493 
1494 	/* if we don't have free ports, mcast frames will be dropped */
1495 	if (WARN_ON_ONCE(data->port_id >= MAX_PORT_ID_NUM))
1496 		return;
1497 
1498 	if (vif->type != NL80211_IFTYPE_STATION ||
1499 	    !vif->bss_conf.assoc)
1500 		return;
1501 
1502 	cmd->port_id = data->port_id++;
1503 	memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
1504 	len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4);
1505 
1506 	ret = iwl_mvm_send_cmd_pdu(mvm, MCAST_FILTER_CMD, CMD_ASYNC, len, cmd);
1507 	if (ret)
1508 		IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret);
1509 }
1510 
1511 static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm)
1512 {
1513 	struct iwl_mvm_mc_iter_data iter_data = {
1514 		.mvm = mvm,
1515 	};
1516 
1517 	lockdep_assert_held(&mvm->mutex);
1518 
1519 	if (WARN_ON_ONCE(!mvm->mcast_filter_cmd))
1520 		return;
1521 
1522 	ieee80211_iterate_active_interfaces_atomic(
1523 		mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1524 		iwl_mvm_mc_iface_iterator, &iter_data);
1525 }
1526 
1527 static u64 iwl_mvm_prepare_multicast(struct ieee80211_hw *hw,
1528 				     struct netdev_hw_addr_list *mc_list)
1529 {
1530 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1531 	struct iwl_mcast_filter_cmd *cmd;
1532 	struct netdev_hw_addr *addr;
1533 	int addr_count;
1534 	bool pass_all;
1535 	int len;
1536 
1537 	addr_count = netdev_hw_addr_list_count(mc_list);
1538 	pass_all = addr_count > MAX_MCAST_FILTERING_ADDRESSES ||
1539 		   IWL_MVM_FW_MCAST_FILTER_PASS_ALL;
1540 	if (pass_all)
1541 		addr_count = 0;
1542 
1543 	len = roundup(sizeof(*cmd) + addr_count * ETH_ALEN, 4);
1544 	cmd = kzalloc(len, GFP_ATOMIC);
1545 	if (!cmd)
1546 		return 0;
1547 
1548 	if (pass_all) {
1549 		cmd->pass_all = 1;
1550 		return (u64)(unsigned long)cmd;
1551 	}
1552 
1553 	netdev_hw_addr_list_for_each(addr, mc_list) {
1554 		IWL_DEBUG_MAC80211(mvm, "mcast addr (%d): %pM\n",
1555 				   cmd->count, addr->addr);
1556 		memcpy(&cmd->addr_list[cmd->count * ETH_ALEN],
1557 		       addr->addr, ETH_ALEN);
1558 		cmd->count++;
1559 	}
1560 
1561 	return (u64)(unsigned long)cmd;
1562 }
1563 
1564 static void iwl_mvm_configure_filter(struct ieee80211_hw *hw,
1565 				     unsigned int changed_flags,
1566 				     unsigned int *total_flags,
1567 				     u64 multicast)
1568 {
1569 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1570 	struct iwl_mcast_filter_cmd *cmd = (void *)(unsigned long)multicast;
1571 
1572 	mutex_lock(&mvm->mutex);
1573 
1574 	/* replace previous configuration */
1575 	kfree(mvm->mcast_filter_cmd);
1576 	mvm->mcast_filter_cmd = cmd;
1577 
1578 	if (!cmd)
1579 		goto out;
1580 
1581 	iwl_mvm_recalc_multicast(mvm);
1582 out:
1583 	mutex_unlock(&mvm->mutex);
1584 	*total_flags = 0;
1585 }
1586 
1587 static void iwl_mvm_config_iface_filter(struct ieee80211_hw *hw,
1588 					struct ieee80211_vif *vif,
1589 					unsigned int filter_flags,
1590 					unsigned int changed_flags)
1591 {
1592 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1593 
1594 	/* We support only filter for probe requests */
1595 	if (!(changed_flags & FIF_PROBE_REQ))
1596 		return;
1597 
1598 	/* Supported only for p2p client interfaces */
1599 	if (vif->type != NL80211_IFTYPE_STATION || !vif->bss_conf.assoc ||
1600 	    !vif->p2p)
1601 		return;
1602 
1603 	mutex_lock(&mvm->mutex);
1604 	iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
1605 	mutex_unlock(&mvm->mutex);
1606 }
1607 
1608 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
1609 struct iwl_bcast_iter_data {
1610 	struct iwl_mvm *mvm;
1611 	struct iwl_bcast_filter_cmd *cmd;
1612 	u8 current_filter;
1613 };
1614 
1615 static void
1616 iwl_mvm_set_bcast_filter(struct ieee80211_vif *vif,
1617 			 const struct iwl_fw_bcast_filter *in_filter,
1618 			 struct iwl_fw_bcast_filter *out_filter)
1619 {
1620 	struct iwl_fw_bcast_filter_attr *attr;
1621 	int i;
1622 
1623 	memcpy(out_filter, in_filter, sizeof(*out_filter));
1624 
1625 	for (i = 0; i < ARRAY_SIZE(out_filter->attrs); i++) {
1626 		attr = &out_filter->attrs[i];
1627 
1628 		if (!attr->mask)
1629 			break;
1630 
1631 		switch (attr->reserved1) {
1632 		case cpu_to_le16(BC_FILTER_MAGIC_IP):
1633 			if (vif->bss_conf.arp_addr_cnt != 1) {
1634 				attr->mask = 0;
1635 				continue;
1636 			}
1637 
1638 			attr->val = vif->bss_conf.arp_addr_list[0];
1639 			break;
1640 		case cpu_to_le16(BC_FILTER_MAGIC_MAC):
1641 			attr->val = *(__be32 *)&vif->addr[2];
1642 			break;
1643 		default:
1644 			break;
1645 		}
1646 		attr->reserved1 = 0;
1647 		out_filter->num_attrs++;
1648 	}
1649 }
1650 
1651 static void iwl_mvm_bcast_filter_iterator(void *_data, u8 *mac,
1652 					  struct ieee80211_vif *vif)
1653 {
1654 	struct iwl_bcast_iter_data *data = _data;
1655 	struct iwl_mvm *mvm = data->mvm;
1656 	struct iwl_bcast_filter_cmd *cmd = data->cmd;
1657 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1658 	struct iwl_fw_bcast_mac *bcast_mac;
1659 	int i;
1660 
1661 	if (WARN_ON(mvmvif->id >= ARRAY_SIZE(cmd->macs)))
1662 		return;
1663 
1664 	bcast_mac = &cmd->macs[mvmvif->id];
1665 
1666 	/*
1667 	 * enable filtering only for associated stations, but not for P2P
1668 	 * Clients
1669 	 */
1670 	if (vif->type != NL80211_IFTYPE_STATION || vif->p2p ||
1671 	    !vif->bss_conf.assoc)
1672 		return;
1673 
1674 	bcast_mac->default_discard = 1;
1675 
1676 	/* copy all configured filters */
1677 	for (i = 0; mvm->bcast_filters[i].attrs[0].mask; i++) {
1678 		/*
1679 		 * Make sure we don't exceed our filters limit.
1680 		 * if there is still a valid filter to be configured,
1681 		 * be on the safe side and just allow bcast for this mac.
1682 		 */
1683 		if (WARN_ON_ONCE(data->current_filter >=
1684 				 ARRAY_SIZE(cmd->filters))) {
1685 			bcast_mac->default_discard = 0;
1686 			bcast_mac->attached_filters = 0;
1687 			break;
1688 		}
1689 
1690 		iwl_mvm_set_bcast_filter(vif,
1691 					 &mvm->bcast_filters[i],
1692 					 &cmd->filters[data->current_filter]);
1693 
1694 		/* skip current filter if it contains no attributes */
1695 		if (!cmd->filters[data->current_filter].num_attrs)
1696 			continue;
1697 
1698 		/* attach the filter to current mac */
1699 		bcast_mac->attached_filters |=
1700 				cpu_to_le16(BIT(data->current_filter));
1701 
1702 		data->current_filter++;
1703 	}
1704 }
1705 
1706 bool iwl_mvm_bcast_filter_build_cmd(struct iwl_mvm *mvm,
1707 				    struct iwl_bcast_filter_cmd *cmd)
1708 {
1709 	struct iwl_bcast_iter_data iter_data = {
1710 		.mvm = mvm,
1711 		.cmd = cmd,
1712 	};
1713 
1714 	if (IWL_MVM_FW_BCAST_FILTER_PASS_ALL)
1715 		return false;
1716 
1717 	memset(cmd, 0, sizeof(*cmd));
1718 	cmd->max_bcast_filters = ARRAY_SIZE(cmd->filters);
1719 	cmd->max_macs = ARRAY_SIZE(cmd->macs);
1720 
1721 #ifdef CONFIG_IWLWIFI_DEBUGFS
1722 	/* use debugfs filters/macs if override is configured */
1723 	if (mvm->dbgfs_bcast_filtering.override) {
1724 		memcpy(cmd->filters, &mvm->dbgfs_bcast_filtering.cmd.filters,
1725 		       sizeof(cmd->filters));
1726 		memcpy(cmd->macs, &mvm->dbgfs_bcast_filtering.cmd.macs,
1727 		       sizeof(cmd->macs));
1728 		return true;
1729 	}
1730 #endif
1731 
1732 	/* if no filters are configured, do nothing */
1733 	if (!mvm->bcast_filters)
1734 		return false;
1735 
1736 	/* configure and attach these filters for each associated sta vif */
1737 	ieee80211_iterate_active_interfaces(
1738 		mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1739 		iwl_mvm_bcast_filter_iterator, &iter_data);
1740 
1741 	return true;
1742 }
1743 
1744 static int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
1745 {
1746 	struct iwl_bcast_filter_cmd cmd;
1747 
1748 	if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BCAST_FILTERING))
1749 		return 0;
1750 
1751 	if (!iwl_mvm_bcast_filter_build_cmd(mvm, &cmd))
1752 		return 0;
1753 
1754 	return iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, 0,
1755 				    sizeof(cmd), &cmd);
1756 }
1757 #else
1758 static inline int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
1759 {
1760 	return 0;
1761 }
1762 #endif
1763 
1764 static int iwl_mvm_update_mu_groups(struct iwl_mvm *mvm,
1765 				    struct ieee80211_vif *vif)
1766 {
1767 	struct iwl_mu_group_mgmt_cmd cmd = {};
1768 
1769 	memcpy(cmd.membership_status, vif->bss_conf.mu_group.membership,
1770 	       WLAN_MEMBERSHIP_LEN);
1771 	memcpy(cmd.user_position, vif->bss_conf.mu_group.position,
1772 	       WLAN_USER_POSITION_LEN);
1773 
1774 	return iwl_mvm_send_cmd_pdu(mvm,
1775 				    WIDE_ID(DATA_PATH_GROUP,
1776 					    UPDATE_MU_GROUPS_CMD),
1777 				    0, sizeof(cmd), &cmd);
1778 }
1779 
1780 static void iwl_mvm_mu_mimo_iface_iterator(void *_data, u8 *mac,
1781 					   struct ieee80211_vif *vif)
1782 {
1783 	if (vif->mu_mimo_owner) {
1784 		struct iwl_mu_group_mgmt_notif *notif = _data;
1785 
1786 		/*
1787 		 * MU-MIMO Group Id action frame is little endian. We treat
1788 		 * the data received from firmware as if it came from the
1789 		 * action frame, so no conversion is needed.
1790 		 */
1791 		ieee80211_update_mu_groups(vif,
1792 					   (u8 *)&notif->membership_status,
1793 					   (u8 *)&notif->user_position);
1794 	}
1795 }
1796 
1797 void iwl_mvm_mu_mimo_grp_notif(struct iwl_mvm *mvm,
1798 			       struct iwl_rx_cmd_buffer *rxb)
1799 {
1800 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
1801 	struct iwl_mu_group_mgmt_notif *notif = (void *)pkt->data;
1802 
1803 	ieee80211_iterate_active_interfaces_atomic(
1804 			mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1805 			iwl_mvm_mu_mimo_iface_iterator, notif);
1806 }
1807 
1808 static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
1809 					     struct ieee80211_vif *vif,
1810 					     struct ieee80211_bss_conf *bss_conf,
1811 					     u32 changes)
1812 {
1813 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1814 	int ret;
1815 
1816 	/*
1817 	 * Re-calculate the tsf id, as the master-slave relations depend on the
1818 	 * beacon interval, which was not known when the station interface was
1819 	 * added.
1820 	 */
1821 	if (changes & BSS_CHANGED_ASSOC && bss_conf->assoc)
1822 		iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
1823 
1824 	/*
1825 	 * If we're not associated yet, take the (new) BSSID before associating
1826 	 * so the firmware knows. If we're already associated, then use the old
1827 	 * BSSID here, and we'll send a cleared one later in the CHANGED_ASSOC
1828 	 * branch for disassociation below.
1829 	 */
1830 	if (changes & BSS_CHANGED_BSSID && !mvmvif->associated)
1831 		memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
1832 
1833 	ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, mvmvif->bssid);
1834 	if (ret)
1835 		IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
1836 
1837 	/* after sending it once, adopt mac80211 data */
1838 	memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
1839 	mvmvif->associated = bss_conf->assoc;
1840 
1841 	if (changes & BSS_CHANGED_ASSOC) {
1842 		if (bss_conf->assoc) {
1843 			/* clear statistics to get clean beacon counter */
1844 			iwl_mvm_request_statistics(mvm, true);
1845 			memset(&mvmvif->beacon_stats, 0,
1846 			       sizeof(mvmvif->beacon_stats));
1847 
1848 			/* add quota for this interface */
1849 			ret = iwl_mvm_update_quotas(mvm, true, NULL);
1850 			if (ret) {
1851 				IWL_ERR(mvm, "failed to update quotas\n");
1852 				return;
1853 			}
1854 
1855 			if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
1856 				     &mvm->status)) {
1857 				/*
1858 				 * If we're restarting then the firmware will
1859 				 * obviously have lost synchronisation with
1860 				 * the AP. It will attempt to synchronise by
1861 				 * itself, but we can make it more reliable by
1862 				 * scheduling a session protection time event.
1863 				 *
1864 				 * The firmware needs to receive a beacon to
1865 				 * catch up with synchronisation, use 110% of
1866 				 * the beacon interval.
1867 				 *
1868 				 * Set a large maximum delay to allow for more
1869 				 * than a single interface.
1870 				 */
1871 				u32 dur = (11 * vif->bss_conf.beacon_int) / 10;
1872 				iwl_mvm_protect_session(mvm, vif, dur, dur,
1873 							5 * dur, false);
1874 			}
1875 
1876 			iwl_mvm_sf_update(mvm, vif, false);
1877 			iwl_mvm_power_vif_assoc(mvm, vif);
1878 			if (vif->p2p) {
1879 				iwl_mvm_ref(mvm, IWL_MVM_REF_P2P_CLIENT);
1880 				iwl_mvm_update_smps(mvm, vif,
1881 						    IWL_MVM_SMPS_REQ_PROT,
1882 						    IEEE80211_SMPS_DYNAMIC);
1883 			}
1884 		} else if (mvmvif->ap_sta_id != IWL_MVM_STATION_COUNT) {
1885 			/*
1886 			 * If update fails - SF might be running in associated
1887 			 * mode while disassociated - which is forbidden.
1888 			 */
1889 			WARN_ONCE(iwl_mvm_sf_update(mvm, vif, false),
1890 				  "Failed to update SF upon disassociation\n");
1891 
1892 			/* remove AP station now that the MAC is unassoc */
1893 			ret = iwl_mvm_rm_sta_id(mvm, vif, mvmvif->ap_sta_id);
1894 			if (ret)
1895 				IWL_ERR(mvm, "failed to remove AP station\n");
1896 
1897 			if (mvm->d0i3_ap_sta_id == mvmvif->ap_sta_id)
1898 				mvm->d0i3_ap_sta_id = IWL_MVM_STATION_COUNT;
1899 			mvmvif->ap_sta_id = IWL_MVM_STATION_COUNT;
1900 			/* remove quota for this interface */
1901 			ret = iwl_mvm_update_quotas(mvm, false, NULL);
1902 			if (ret)
1903 				IWL_ERR(mvm, "failed to update quotas\n");
1904 
1905 			if (vif->p2p)
1906 				iwl_mvm_unref(mvm, IWL_MVM_REF_P2P_CLIENT);
1907 
1908 			/* this will take the cleared BSSID from bss_conf */
1909 			ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
1910 			if (ret)
1911 				IWL_ERR(mvm,
1912 					"failed to update MAC %pM (clear after unassoc)\n",
1913 					vif->addr);
1914 		}
1915 
1916 		/*
1917 		 * The firmware tracks the MU-MIMO group on its own.
1918 		 * However, on HW restart we should restore this data.
1919 		 */
1920 		if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
1921 		    (changes & BSS_CHANGED_MU_GROUPS) && vif->mu_mimo_owner) {
1922 			ret = iwl_mvm_update_mu_groups(mvm, vif);
1923 			if (ret)
1924 				IWL_ERR(mvm,
1925 					"failed to update VHT MU_MIMO groups\n");
1926 		}
1927 
1928 		iwl_mvm_recalc_multicast(mvm);
1929 		iwl_mvm_configure_bcast_filter(mvm);
1930 
1931 		/* reset rssi values */
1932 		mvmvif->bf_data.ave_beacon_signal = 0;
1933 
1934 		iwl_mvm_bt_coex_vif_change(mvm);
1935 		iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_TT,
1936 				    IEEE80211_SMPS_AUTOMATIC);
1937 		if (fw_has_capa(&mvm->fw->ucode_capa,
1938 				IWL_UCODE_TLV_CAPA_UMAC_SCAN))
1939 			iwl_mvm_config_scan(mvm);
1940 	} else if (changes & BSS_CHANGED_BEACON_INFO) {
1941 		/*
1942 		 * We received a beacon _after_ association so
1943 		 * remove the session protection.
1944 		 */
1945 		iwl_mvm_remove_time_event(mvm, mvmvif,
1946 					  &mvmvif->time_event_data);
1947 	}
1948 
1949 	if (changes & BSS_CHANGED_BEACON_INFO) {
1950 		iwl_mvm_sf_update(mvm, vif, false);
1951 		WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
1952 	}
1953 
1954 	if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS | BSS_CHANGED_QOS |
1955 		       /*
1956 			* Send power command on every beacon change,
1957 			* because we may have not enabled beacon abort yet.
1958 			*/
1959 		       BSS_CHANGED_BEACON_INFO)) {
1960 		ret = iwl_mvm_power_update_mac(mvm);
1961 		if (ret)
1962 			IWL_ERR(mvm, "failed to update power mode\n");
1963 	}
1964 
1965 	if (changes & BSS_CHANGED_TXPOWER) {
1966 		IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
1967 				bss_conf->txpower);
1968 		iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
1969 	}
1970 
1971 	if (changes & BSS_CHANGED_CQM) {
1972 		IWL_DEBUG_MAC80211(mvm, "cqm info_changed\n");
1973 		/* reset cqm events tracking */
1974 		mvmvif->bf_data.last_cqm_event = 0;
1975 		if (mvmvif->bf_data.bf_enabled) {
1976 			ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
1977 			if (ret)
1978 				IWL_ERR(mvm,
1979 					"failed to update CQM thresholds\n");
1980 		}
1981 	}
1982 
1983 	if (changes & BSS_CHANGED_ARP_FILTER) {
1984 		IWL_DEBUG_MAC80211(mvm, "arp filter changed\n");
1985 		iwl_mvm_configure_bcast_filter(mvm);
1986 	}
1987 }
1988 
1989 static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
1990 				 struct ieee80211_vif *vif)
1991 {
1992 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1993 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1994 	int ret;
1995 
1996 	/*
1997 	 * iwl_mvm_mac_ctxt_add() might read directly from the device
1998 	 * (the system time), so make sure it is available.
1999 	 */
2000 	ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_START_AP);
2001 	if (ret)
2002 		return ret;
2003 
2004 	mutex_lock(&mvm->mutex);
2005 
2006 	/* Send the beacon template */
2007 	ret = iwl_mvm_mac_ctxt_beacon_changed(mvm, vif);
2008 	if (ret)
2009 		goto out_unlock;
2010 
2011 	/*
2012 	 * Re-calculate the tsf id, as the master-slave relations depend on the
2013 	 * beacon interval, which was not known when the AP interface was added.
2014 	 */
2015 	if (vif->type == NL80211_IFTYPE_AP)
2016 		iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
2017 
2018 	mvmvif->ap_assoc_sta_count = 0;
2019 
2020 	/* Add the mac context */
2021 	ret = iwl_mvm_mac_ctxt_add(mvm, vif);
2022 	if (ret)
2023 		goto out_unlock;
2024 
2025 	/* Perform the binding */
2026 	ret = iwl_mvm_binding_add_vif(mvm, vif);
2027 	if (ret)
2028 		goto out_remove;
2029 
2030 	/* Send the bcast station. At this stage the TBTT and DTIM time events
2031 	 * are added and applied to the scheduler */
2032 	ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
2033 	if (ret)
2034 		goto out_unbind;
2035 
2036 	/* must be set before quota calculations */
2037 	mvmvif->ap_ibss_active = true;
2038 
2039 	/* power updated needs to be done before quotas */
2040 	iwl_mvm_power_update_mac(mvm);
2041 
2042 	ret = iwl_mvm_update_quotas(mvm, false, NULL);
2043 	if (ret)
2044 		goto out_quota_failed;
2045 
2046 	/* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2047 	if (vif->p2p && mvm->p2p_device_vif)
2048 		iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2049 
2050 	iwl_mvm_ref(mvm, IWL_MVM_REF_AP_IBSS);
2051 
2052 	iwl_mvm_bt_coex_vif_change(mvm);
2053 
2054 	/* we don't support TDLS during DCM */
2055 	if (iwl_mvm_phy_ctx_count(mvm) > 1)
2056 		iwl_mvm_teardown_tdls_peers(mvm);
2057 
2058 	goto out_unlock;
2059 
2060 out_quota_failed:
2061 	iwl_mvm_power_update_mac(mvm);
2062 	mvmvif->ap_ibss_active = false;
2063 	iwl_mvm_send_rm_bcast_sta(mvm, vif);
2064 out_unbind:
2065 	iwl_mvm_binding_remove_vif(mvm, vif);
2066 out_remove:
2067 	iwl_mvm_mac_ctxt_remove(mvm, vif);
2068 out_unlock:
2069 	mutex_unlock(&mvm->mutex);
2070 	iwl_mvm_unref(mvm, IWL_MVM_REF_START_AP);
2071 	return ret;
2072 }
2073 
2074 static void iwl_mvm_stop_ap_ibss(struct ieee80211_hw *hw,
2075 				 struct ieee80211_vif *vif)
2076 {
2077 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2078 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2079 
2080 	iwl_mvm_prepare_mac_removal(mvm, vif);
2081 
2082 	mutex_lock(&mvm->mutex);
2083 
2084 	/* Handle AP stop while in CSA */
2085 	if (rcu_access_pointer(mvm->csa_vif) == vif) {
2086 		iwl_mvm_remove_time_event(mvm, mvmvif,
2087 					  &mvmvif->time_event_data);
2088 		RCU_INIT_POINTER(mvm->csa_vif, NULL);
2089 		mvmvif->csa_countdown = false;
2090 	}
2091 
2092 	if (rcu_access_pointer(mvm->csa_tx_blocked_vif) == vif) {
2093 		RCU_INIT_POINTER(mvm->csa_tx_blocked_vif, NULL);
2094 		mvm->csa_tx_block_bcn_timeout = 0;
2095 	}
2096 
2097 	mvmvif->ap_ibss_active = false;
2098 	mvm->ap_last_beacon_gp2 = 0;
2099 
2100 	iwl_mvm_bt_coex_vif_change(mvm);
2101 
2102 	iwl_mvm_unref(mvm, IWL_MVM_REF_AP_IBSS);
2103 
2104 	/* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2105 	if (vif->p2p && mvm->p2p_device_vif)
2106 		iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2107 
2108 	iwl_mvm_update_quotas(mvm, false, NULL);
2109 	iwl_mvm_send_rm_bcast_sta(mvm, vif);
2110 	iwl_mvm_binding_remove_vif(mvm, vif);
2111 
2112 	iwl_mvm_power_update_mac(mvm);
2113 
2114 	iwl_mvm_mac_ctxt_remove(mvm, vif);
2115 
2116 	mutex_unlock(&mvm->mutex);
2117 }
2118 
2119 static void
2120 iwl_mvm_bss_info_changed_ap_ibss(struct iwl_mvm *mvm,
2121 				 struct ieee80211_vif *vif,
2122 				 struct ieee80211_bss_conf *bss_conf,
2123 				 u32 changes)
2124 {
2125 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2126 
2127 	/* Changes will be applied when the AP/IBSS is started */
2128 	if (!mvmvif->ap_ibss_active)
2129 		return;
2130 
2131 	if (changes & (BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_HT |
2132 		       BSS_CHANGED_BANDWIDTH | BSS_CHANGED_QOS) &&
2133 	    iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL))
2134 		IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
2135 
2136 	/* Need to send a new beacon template to the FW */
2137 	if (changes & BSS_CHANGED_BEACON &&
2138 	    iwl_mvm_mac_ctxt_beacon_changed(mvm, vif))
2139 		IWL_WARN(mvm, "Failed updating beacon data\n");
2140 
2141 	if (changes & BSS_CHANGED_TXPOWER) {
2142 		IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2143 				bss_conf->txpower);
2144 		iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2145 	}
2146 }
2147 
2148 static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw,
2149 				     struct ieee80211_vif *vif,
2150 				     struct ieee80211_bss_conf *bss_conf,
2151 				     u32 changes)
2152 {
2153 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2154 
2155 	/*
2156 	 * iwl_mvm_bss_info_changed_station() might call
2157 	 * iwl_mvm_protect_session(), which reads directly from
2158 	 * the device (the system time), so make sure it is available.
2159 	 */
2160 	if (iwl_mvm_ref_sync(mvm, IWL_MVM_REF_BSS_CHANGED))
2161 		return;
2162 
2163 	mutex_lock(&mvm->mutex);
2164 
2165 	if (changes & BSS_CHANGED_IDLE && !bss_conf->idle)
2166 		iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true);
2167 
2168 	switch (vif->type) {
2169 	case NL80211_IFTYPE_STATION:
2170 		iwl_mvm_bss_info_changed_station(mvm, vif, bss_conf, changes);
2171 		break;
2172 	case NL80211_IFTYPE_AP:
2173 	case NL80211_IFTYPE_ADHOC:
2174 		iwl_mvm_bss_info_changed_ap_ibss(mvm, vif, bss_conf, changes);
2175 		break;
2176 	default:
2177 		/* shouldn't happen */
2178 		WARN_ON_ONCE(1);
2179 	}
2180 
2181 	mutex_unlock(&mvm->mutex);
2182 	iwl_mvm_unref(mvm, IWL_MVM_REF_BSS_CHANGED);
2183 }
2184 
2185 static int iwl_mvm_mac_hw_scan(struct ieee80211_hw *hw,
2186 			       struct ieee80211_vif *vif,
2187 			       struct ieee80211_scan_request *hw_req)
2188 {
2189 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2190 	int ret;
2191 
2192 	if (hw_req->req.n_channels == 0 ||
2193 	    hw_req->req.n_channels > mvm->fw->ucode_capa.n_scan_channels)
2194 		return -EINVAL;
2195 
2196 	mutex_lock(&mvm->mutex);
2197 	ret = iwl_mvm_reg_scan_start(mvm, vif, &hw_req->req, &hw_req->ies);
2198 	mutex_unlock(&mvm->mutex);
2199 
2200 	return ret;
2201 }
2202 
2203 static void iwl_mvm_mac_cancel_hw_scan(struct ieee80211_hw *hw,
2204 				       struct ieee80211_vif *vif)
2205 {
2206 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2207 
2208 	mutex_lock(&mvm->mutex);
2209 
2210 	/* Due to a race condition, it's possible that mac80211 asks
2211 	 * us to stop a hw_scan when it's already stopped.  This can
2212 	 * happen, for instance, if we stopped the scan ourselves,
2213 	 * called ieee80211_scan_completed() and the userspace called
2214 	 * cancel scan scan before ieee80211_scan_work() could run.
2215 	 * To handle that, simply return if the scan is not running.
2216 	*/
2217 	if (mvm->scan_status & IWL_MVM_SCAN_REGULAR)
2218 		iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true);
2219 
2220 	mutex_unlock(&mvm->mutex);
2221 }
2222 
2223 static void
2224 iwl_mvm_mac_allow_buffered_frames(struct ieee80211_hw *hw,
2225 				  struct ieee80211_sta *sta, u16 tids,
2226 				  int num_frames,
2227 				  enum ieee80211_frame_release_type reason,
2228 				  bool more_data)
2229 {
2230 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2231 
2232 	/* Called when we need to transmit (a) frame(s) from mac80211 */
2233 
2234 	iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2235 					  tids, more_data, false);
2236 }
2237 
2238 static void
2239 iwl_mvm_mac_release_buffered_frames(struct ieee80211_hw *hw,
2240 				    struct ieee80211_sta *sta, u16 tids,
2241 				    int num_frames,
2242 				    enum ieee80211_frame_release_type reason,
2243 				    bool more_data)
2244 {
2245 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2246 
2247 	/* Called when we need to transmit (a) frame(s) from agg queue */
2248 
2249 	iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2250 					  tids, more_data, true);
2251 }
2252 
2253 static void iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
2254 				   struct ieee80211_vif *vif,
2255 				   enum sta_notify_cmd cmd,
2256 				   struct ieee80211_sta *sta)
2257 {
2258 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2259 	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
2260 	unsigned long txqs = 0, tids = 0;
2261 	int tid;
2262 
2263 	spin_lock_bh(&mvmsta->lock);
2264 	for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++) {
2265 		struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
2266 
2267 		if (tid_data->state != IWL_AGG_ON &&
2268 		    tid_data->state != IWL_EMPTYING_HW_QUEUE_DELBA)
2269 			continue;
2270 
2271 		__set_bit(tid_data->txq_id, &txqs);
2272 
2273 		if (iwl_mvm_tid_queued(tid_data) == 0)
2274 			continue;
2275 
2276 		__set_bit(tid, &tids);
2277 	}
2278 
2279 	switch (cmd) {
2280 	case STA_NOTIFY_SLEEP:
2281 		if (atomic_read(&mvm->pending_frames[mvmsta->sta_id]) > 0)
2282 			ieee80211_sta_block_awake(hw, sta, true);
2283 
2284 		for_each_set_bit(tid, &tids, IWL_MAX_TID_COUNT)
2285 			ieee80211_sta_set_buffered(sta, tid, true);
2286 
2287 		if (txqs)
2288 			iwl_trans_freeze_txq_timer(mvm->trans, txqs, true);
2289 		/*
2290 		 * The fw updates the STA to be asleep. Tx packets on the Tx
2291 		 * queues to this station will not be transmitted. The fw will
2292 		 * send a Tx response with TX_STATUS_FAIL_DEST_PS.
2293 		 */
2294 		break;
2295 	case STA_NOTIFY_AWAKE:
2296 		if (WARN_ON(mvmsta->sta_id == IWL_MVM_STATION_COUNT))
2297 			break;
2298 
2299 		if (txqs)
2300 			iwl_trans_freeze_txq_timer(mvm->trans, txqs, false);
2301 		iwl_mvm_sta_modify_ps_wake(mvm, sta);
2302 		break;
2303 	default:
2304 		break;
2305 	}
2306 	spin_unlock_bh(&mvmsta->lock);
2307 }
2308 
2309 static void iwl_mvm_sta_pre_rcu_remove(struct ieee80211_hw *hw,
2310 				       struct ieee80211_vif *vif,
2311 				       struct ieee80211_sta *sta)
2312 {
2313 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2314 	struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
2315 
2316 	/*
2317 	 * This is called before mac80211 does RCU synchronisation,
2318 	 * so here we already invalidate our internal RCU-protected
2319 	 * station pointer. The rest of the code will thus no longer
2320 	 * be able to find the station this way, and we don't rely
2321 	 * on further RCU synchronisation after the sta_state()
2322 	 * callback deleted the station.
2323 	 */
2324 	mutex_lock(&mvm->mutex);
2325 	if (sta == rcu_access_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id]))
2326 		rcu_assign_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id],
2327 				   ERR_PTR(-ENOENT));
2328 
2329 	mutex_unlock(&mvm->mutex);
2330 }
2331 
2332 static void iwl_mvm_check_uapsd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
2333 				const u8 *bssid)
2334 {
2335 	if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT))
2336 		return;
2337 
2338 	if (vif->p2p && !iwl_mvm_is_p2p_standalone_uapsd_supported(mvm)) {
2339 		vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2340 		return;
2341 	}
2342 
2343 	if (iwlwifi_mod_params.uapsd_disable) {
2344 		vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2345 		return;
2346 	}
2347 
2348 	vif->driver_flags |= IEEE80211_VIF_SUPPORTS_UAPSD;
2349 }
2350 
2351 static void
2352 iwl_mvm_tdls_check_trigger(struct iwl_mvm *mvm,
2353 			   struct ieee80211_vif *vif, u8 *peer_addr,
2354 			   enum nl80211_tdls_operation action)
2355 {
2356 	struct iwl_fw_dbg_trigger_tlv *trig;
2357 	struct iwl_fw_dbg_trigger_tdls *tdls_trig;
2358 
2359 	if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_TDLS))
2360 		return;
2361 
2362 	trig = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_TDLS);
2363 	tdls_trig = (void *)trig->data;
2364 	if (!iwl_fw_dbg_trigger_check_stop(mvm, vif, trig))
2365 		return;
2366 
2367 	if (!(tdls_trig->action_bitmap & BIT(action)))
2368 		return;
2369 
2370 	if (tdls_trig->peer_mode &&
2371 	    memcmp(tdls_trig->peer, peer_addr, ETH_ALEN) != 0)
2372 		return;
2373 
2374 	iwl_mvm_fw_dbg_collect_trig(mvm, trig,
2375 				    "TDLS event occurred, peer %pM, action %d",
2376 				    peer_addr, action);
2377 }
2378 
2379 static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
2380 				 struct ieee80211_vif *vif,
2381 				 struct ieee80211_sta *sta,
2382 				 enum ieee80211_sta_state old_state,
2383 				 enum ieee80211_sta_state new_state)
2384 {
2385 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2386 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2387 	int ret;
2388 
2389 	IWL_DEBUG_MAC80211(mvm, "station %pM state change %d->%d\n",
2390 			   sta->addr, old_state, new_state);
2391 
2392 	/* this would be a mac80211 bug ... but don't crash */
2393 	if (WARN_ON_ONCE(!mvmvif->phy_ctxt))
2394 		return -EINVAL;
2395 
2396 	/* if a STA is being removed, reuse its ID */
2397 	flush_work(&mvm->sta_drained_wk);
2398 
2399 	mutex_lock(&mvm->mutex);
2400 	if (old_state == IEEE80211_STA_NOTEXIST &&
2401 	    new_state == IEEE80211_STA_NONE) {
2402 		/*
2403 		 * Firmware bug - it'll crash if the beacon interval is less
2404 		 * than 16. We can't avoid connecting at all, so refuse the
2405 		 * station state change, this will cause mac80211 to abandon
2406 		 * attempts to connect to this AP, and eventually wpa_s will
2407 		 * blacklist the AP...
2408 		 */
2409 		if (vif->type == NL80211_IFTYPE_STATION &&
2410 		    vif->bss_conf.beacon_int < 16) {
2411 			IWL_ERR(mvm,
2412 				"AP %pM beacon interval is %d, refusing due to firmware bug!\n",
2413 				sta->addr, vif->bss_conf.beacon_int);
2414 			ret = -EINVAL;
2415 			goto out_unlock;
2416 		}
2417 
2418 		if (sta->tdls &&
2419 		    (vif->p2p ||
2420 		     iwl_mvm_tdls_sta_count(mvm, NULL) ==
2421 						IWL_MVM_TDLS_STA_COUNT ||
2422 		     iwl_mvm_phy_ctx_count(mvm) > 1)) {
2423 			IWL_DEBUG_MAC80211(mvm, "refusing TDLS sta\n");
2424 			ret = -EBUSY;
2425 			goto out_unlock;
2426 		}
2427 
2428 		ret = iwl_mvm_add_sta(mvm, vif, sta);
2429 		if (sta->tdls && ret == 0) {
2430 			iwl_mvm_recalc_tdls_state(mvm, vif, true);
2431 			iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
2432 						   NL80211_TDLS_SETUP);
2433 		}
2434 	} else if (old_state == IEEE80211_STA_NONE &&
2435 		   new_state == IEEE80211_STA_AUTH) {
2436 		/*
2437 		 * EBS may be disabled due to previous failures reported by FW.
2438 		 * Reset EBS status here assuming environment has been changed.
2439 		 */
2440 		mvm->last_ebs_successful = true;
2441 		iwl_mvm_check_uapsd(mvm, vif, sta->addr);
2442 		ret = 0;
2443 	} else if (old_state == IEEE80211_STA_AUTH &&
2444 		   new_state == IEEE80211_STA_ASSOC) {
2445 		if (vif->type == NL80211_IFTYPE_AP) {
2446 			mvmvif->ap_assoc_sta_count++;
2447 			iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
2448 		}
2449 		ret = iwl_mvm_update_sta(mvm, vif, sta);
2450 		if (ret == 0)
2451 			iwl_mvm_rs_rate_init(mvm, sta,
2452 					     mvmvif->phy_ctxt->channel->band,
2453 					     true);
2454 	} else if (old_state == IEEE80211_STA_ASSOC &&
2455 		   new_state == IEEE80211_STA_AUTHORIZED) {
2456 
2457 		/* we don't support TDLS during DCM */
2458 		if (iwl_mvm_phy_ctx_count(mvm) > 1)
2459 			iwl_mvm_teardown_tdls_peers(mvm);
2460 
2461 		if (sta->tdls)
2462 			iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
2463 						   NL80211_TDLS_ENABLE_LINK);
2464 
2465 		/* enable beacon filtering */
2466 		WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
2467 		ret = 0;
2468 	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
2469 		   new_state == IEEE80211_STA_ASSOC) {
2470 		/* disable beacon filtering */
2471 		WARN_ON(iwl_mvm_disable_beacon_filter(mvm, vif, 0));
2472 		ret = 0;
2473 	} else if (old_state == IEEE80211_STA_ASSOC &&
2474 		   new_state == IEEE80211_STA_AUTH) {
2475 		if (vif->type == NL80211_IFTYPE_AP) {
2476 			mvmvif->ap_assoc_sta_count--;
2477 			iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
2478 		}
2479 		ret = 0;
2480 	} else if (old_state == IEEE80211_STA_AUTH &&
2481 		   new_state == IEEE80211_STA_NONE) {
2482 		ret = 0;
2483 	} else if (old_state == IEEE80211_STA_NONE &&
2484 		   new_state == IEEE80211_STA_NOTEXIST) {
2485 		ret = iwl_mvm_rm_sta(mvm, vif, sta);
2486 		if (sta->tdls) {
2487 			iwl_mvm_recalc_tdls_state(mvm, vif, false);
2488 			iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
2489 						   NL80211_TDLS_DISABLE_LINK);
2490 		}
2491 	} else {
2492 		ret = -EIO;
2493 	}
2494  out_unlock:
2495 	mutex_unlock(&mvm->mutex);
2496 
2497 	if (sta->tdls && ret == 0) {
2498 		if (old_state == IEEE80211_STA_NOTEXIST &&
2499 		    new_state == IEEE80211_STA_NONE)
2500 			ieee80211_reserve_tid(sta, IWL_MVM_TDLS_FW_TID);
2501 		else if (old_state == IEEE80211_STA_NONE &&
2502 			 new_state == IEEE80211_STA_NOTEXIST)
2503 			ieee80211_unreserve_tid(sta, IWL_MVM_TDLS_FW_TID);
2504 	}
2505 
2506 	return ret;
2507 }
2508 
2509 static int iwl_mvm_mac_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
2510 {
2511 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2512 
2513 	mvm->rts_threshold = value;
2514 
2515 	return 0;
2516 }
2517 
2518 static void iwl_mvm_sta_rc_update(struct ieee80211_hw *hw,
2519 				  struct ieee80211_vif *vif,
2520 				  struct ieee80211_sta *sta, u32 changed)
2521 {
2522 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2523 
2524 	if (vif->type == NL80211_IFTYPE_STATION &&
2525 	    changed & IEEE80211_RC_NSS_CHANGED)
2526 		iwl_mvm_sf_update(mvm, vif, false);
2527 }
2528 
2529 static int iwl_mvm_mac_conf_tx(struct ieee80211_hw *hw,
2530 			       struct ieee80211_vif *vif, u16 ac,
2531 			       const struct ieee80211_tx_queue_params *params)
2532 {
2533 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2534 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2535 
2536 	mvmvif->queue_params[ac] = *params;
2537 
2538 	/*
2539 	 * No need to update right away, we'll get BSS_CHANGED_QOS
2540 	 * The exception is P2P_DEVICE interface which needs immediate update.
2541 	 */
2542 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
2543 		int ret;
2544 
2545 		mutex_lock(&mvm->mutex);
2546 		ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
2547 		mutex_unlock(&mvm->mutex);
2548 		return ret;
2549 	}
2550 	return 0;
2551 }
2552 
2553 static void iwl_mvm_mac_mgd_prepare_tx(struct ieee80211_hw *hw,
2554 				      struct ieee80211_vif *vif)
2555 {
2556 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2557 	u32 duration = IWL_MVM_TE_SESSION_PROTECTION_MAX_TIME_MS;
2558 	u32 min_duration = IWL_MVM_TE_SESSION_PROTECTION_MIN_TIME_MS;
2559 
2560 	if (WARN_ON_ONCE(vif->bss_conf.assoc))
2561 		return;
2562 
2563 	/*
2564 	 * iwl_mvm_protect_session() reads directly from the device
2565 	 * (the system time), so make sure it is available.
2566 	 */
2567 	if (iwl_mvm_ref_sync(mvm, IWL_MVM_REF_PREPARE_TX))
2568 		return;
2569 
2570 	mutex_lock(&mvm->mutex);
2571 	/* Try really hard to protect the session and hear a beacon */
2572 	iwl_mvm_protect_session(mvm, vif, duration, min_duration, 500, false);
2573 	mutex_unlock(&mvm->mutex);
2574 
2575 	iwl_mvm_unref(mvm, IWL_MVM_REF_PREPARE_TX);
2576 }
2577 
2578 static int iwl_mvm_mac_sched_scan_start(struct ieee80211_hw *hw,
2579 					struct ieee80211_vif *vif,
2580 					struct cfg80211_sched_scan_request *req,
2581 					struct ieee80211_scan_ies *ies)
2582 {
2583 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2584 
2585 	int ret;
2586 
2587 	mutex_lock(&mvm->mutex);
2588 
2589 	if (!vif->bss_conf.idle) {
2590 		ret = -EBUSY;
2591 		goto out;
2592 	}
2593 
2594 	ret = iwl_mvm_sched_scan_start(mvm, vif, req, ies, IWL_MVM_SCAN_SCHED);
2595 
2596 out:
2597 	mutex_unlock(&mvm->mutex);
2598 	return ret;
2599 }
2600 
2601 static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
2602 				       struct ieee80211_vif *vif)
2603 {
2604 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2605 	int ret;
2606 
2607 	mutex_lock(&mvm->mutex);
2608 
2609 	/* Due to a race condition, it's possible that mac80211 asks
2610 	 * us to stop a sched_scan when it's already stopped.  This
2611 	 * can happen, for instance, if we stopped the scan ourselves,
2612 	 * called ieee80211_sched_scan_stopped() and the userspace called
2613 	 * stop sched scan scan before ieee80211_sched_scan_stopped_work()
2614 	 * could run.  To handle this, simply return if the scan is
2615 	 * not running.
2616 	*/
2617 	if (!(mvm->scan_status & IWL_MVM_SCAN_SCHED)) {
2618 		mutex_unlock(&mvm->mutex);
2619 		return 0;
2620 	}
2621 
2622 	ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, false);
2623 	mutex_unlock(&mvm->mutex);
2624 	iwl_mvm_wait_for_async_handlers(mvm);
2625 
2626 	return ret;
2627 }
2628 
2629 static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
2630 			       enum set_key_cmd cmd,
2631 			       struct ieee80211_vif *vif,
2632 			       struct ieee80211_sta *sta,
2633 			       struct ieee80211_key_conf *key)
2634 {
2635 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2636 	struct iwl_mvm_sta *mvmsta;
2637 	struct iwl_mvm_key_pn *ptk_pn;
2638 	int keyidx = key->keyidx;
2639 	int ret;
2640 	u8 key_offset;
2641 
2642 	if (iwlwifi_mod_params.sw_crypto) {
2643 		IWL_DEBUG_MAC80211(mvm, "leave - hwcrypto disabled\n");
2644 		return -EOPNOTSUPP;
2645 	}
2646 
2647 	switch (key->cipher) {
2648 	case WLAN_CIPHER_SUITE_TKIP:
2649 		key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
2650 		key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
2651 		break;
2652 	case WLAN_CIPHER_SUITE_CCMP:
2653 		key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
2654 		break;
2655 	case WLAN_CIPHER_SUITE_AES_CMAC:
2656 		WARN_ON_ONCE(!ieee80211_hw_check(hw, MFP_CAPABLE));
2657 		break;
2658 	case WLAN_CIPHER_SUITE_WEP40:
2659 	case WLAN_CIPHER_SUITE_WEP104:
2660 		/* For non-client mode, only use WEP keys for TX as we probably
2661 		 * don't have a station yet anyway and would then have to keep
2662 		 * track of the keys, linking them to each of the clients/peers
2663 		 * as they appear. For now, don't do that, for performance WEP
2664 		 * offload doesn't really matter much, but we need it for some
2665 		 * other offload features in client mode.
2666 		 */
2667 		if (vif->type != NL80211_IFTYPE_STATION)
2668 			return 0;
2669 		break;
2670 	default:
2671 		/* currently FW supports only one optional cipher scheme */
2672 		if (hw->n_cipher_schemes &&
2673 		    hw->cipher_schemes->cipher == key->cipher)
2674 			key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
2675 		else
2676 			return -EOPNOTSUPP;
2677 	}
2678 
2679 	mutex_lock(&mvm->mutex);
2680 
2681 	switch (cmd) {
2682 	case SET_KEY:
2683 		if ((vif->type == NL80211_IFTYPE_ADHOC ||
2684 		     vif->type == NL80211_IFTYPE_AP) && !sta) {
2685 			/*
2686 			 * GTK on AP interface is a TX-only key, return 0;
2687 			 * on IBSS they're per-station and because we're lazy
2688 			 * we don't support them for RX, so do the same.
2689 			 * CMAC in AP/IBSS modes must be done in software.
2690 			 */
2691 			if (key->cipher == WLAN_CIPHER_SUITE_AES_CMAC)
2692 				ret = -EOPNOTSUPP;
2693 			else
2694 				ret = 0;
2695 			key->hw_key_idx = STA_KEY_IDX_INVALID;
2696 			break;
2697 		}
2698 
2699 		/* During FW restart, in order to restore the state as it was,
2700 		 * don't try to reprogram keys we previously failed for.
2701 		 */
2702 		if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
2703 		    key->hw_key_idx == STA_KEY_IDX_INVALID) {
2704 			IWL_DEBUG_MAC80211(mvm,
2705 					   "skip invalid idx key programming during restart\n");
2706 			ret = 0;
2707 			break;
2708 		}
2709 
2710 		if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
2711 		    sta && iwl_mvm_has_new_rx_api(mvm) &&
2712 		    key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
2713 		    (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
2714 		     key->cipher == WLAN_CIPHER_SUITE_GCMP)) {
2715 			struct ieee80211_key_seq seq;
2716 			int tid, q;
2717 
2718 			mvmsta = iwl_mvm_sta_from_mac80211(sta);
2719 			WARN_ON(rcu_access_pointer(mvmsta->ptk_pn[keyidx]));
2720 			ptk_pn = kzalloc(sizeof(*ptk_pn) +
2721 					 mvm->trans->num_rx_queues *
2722 						sizeof(ptk_pn->q[0]),
2723 					 GFP_KERNEL);
2724 			if (!ptk_pn) {
2725 				ret = -ENOMEM;
2726 				break;
2727 			}
2728 
2729 			for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++) {
2730 				ieee80211_get_key_rx_seq(key, tid, &seq);
2731 				for (q = 0; q < mvm->trans->num_rx_queues; q++)
2732 					memcpy(ptk_pn->q[q].pn[tid],
2733 					       seq.ccmp.pn,
2734 					       IEEE80211_CCMP_PN_LEN);
2735 			}
2736 
2737 			rcu_assign_pointer(mvmsta->ptk_pn[keyidx], ptk_pn);
2738 		}
2739 
2740 		/* in HW restart reuse the index, otherwise request a new one */
2741 		if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
2742 			key_offset = key->hw_key_idx;
2743 		else
2744 			key_offset = STA_KEY_IDX_INVALID;
2745 
2746 		IWL_DEBUG_MAC80211(mvm, "set hwcrypto key\n");
2747 		ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, key_offset);
2748 		if (ret) {
2749 			IWL_WARN(mvm, "set key failed\n");
2750 			/*
2751 			 * can't add key for RX, but we don't need it
2752 			 * in the device for TX so still return 0
2753 			 */
2754 			key->hw_key_idx = STA_KEY_IDX_INVALID;
2755 			ret = 0;
2756 		}
2757 
2758 		break;
2759 	case DISABLE_KEY:
2760 		if (key->hw_key_idx == STA_KEY_IDX_INVALID) {
2761 			ret = 0;
2762 			break;
2763 		}
2764 
2765 		if (sta && iwl_mvm_has_new_rx_api(mvm) &&
2766 		    key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
2767 		    (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
2768 		     key->cipher == WLAN_CIPHER_SUITE_GCMP)) {
2769 			mvmsta = iwl_mvm_sta_from_mac80211(sta);
2770 			ptk_pn = rcu_dereference_protected(
2771 						mvmsta->ptk_pn[keyidx],
2772 						lockdep_is_held(&mvm->mutex));
2773 			RCU_INIT_POINTER(mvmsta->ptk_pn[keyidx], NULL);
2774 			if (ptk_pn)
2775 				kfree_rcu(ptk_pn, rcu_head);
2776 		}
2777 
2778 		IWL_DEBUG_MAC80211(mvm, "disable hwcrypto key\n");
2779 		ret = iwl_mvm_remove_sta_key(mvm, vif, sta, key);
2780 		break;
2781 	default:
2782 		ret = -EINVAL;
2783 	}
2784 
2785 	mutex_unlock(&mvm->mutex);
2786 	return ret;
2787 }
2788 
2789 static void iwl_mvm_mac_update_tkip_key(struct ieee80211_hw *hw,
2790 					struct ieee80211_vif *vif,
2791 					struct ieee80211_key_conf *keyconf,
2792 					struct ieee80211_sta *sta,
2793 					u32 iv32, u16 *phase1key)
2794 {
2795 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2796 
2797 	if (keyconf->hw_key_idx == STA_KEY_IDX_INVALID)
2798 		return;
2799 
2800 	iwl_mvm_update_tkip_key(mvm, vif, keyconf, sta, iv32, phase1key);
2801 }
2802 
2803 
2804 static bool iwl_mvm_rx_aux_roc(struct iwl_notif_wait_data *notif_wait,
2805 			       struct iwl_rx_packet *pkt, void *data)
2806 {
2807 	struct iwl_mvm *mvm =
2808 		container_of(notif_wait, struct iwl_mvm, notif_wait);
2809 	struct iwl_hs20_roc_res *resp;
2810 	int resp_len = iwl_rx_packet_payload_len(pkt);
2811 	struct iwl_mvm_time_event_data *te_data = data;
2812 
2813 	if (WARN_ON(pkt->hdr.cmd != HOT_SPOT_CMD))
2814 		return true;
2815 
2816 	if (WARN_ON_ONCE(resp_len != sizeof(*resp))) {
2817 		IWL_ERR(mvm, "Invalid HOT_SPOT_CMD response\n");
2818 		return true;
2819 	}
2820 
2821 	resp = (void *)pkt->data;
2822 
2823 	IWL_DEBUG_TE(mvm,
2824 		     "Aux ROC: Recieved response from ucode: status=%d uid=%d\n",
2825 		     resp->status, resp->event_unique_id);
2826 
2827 	te_data->uid = le32_to_cpu(resp->event_unique_id);
2828 	IWL_DEBUG_TE(mvm, "TIME_EVENT_CMD response - UID = 0x%x\n",
2829 		     te_data->uid);
2830 
2831 	spin_lock_bh(&mvm->time_event_lock);
2832 	list_add_tail(&te_data->list, &mvm->aux_roc_te_list);
2833 	spin_unlock_bh(&mvm->time_event_lock);
2834 
2835 	return true;
2836 }
2837 
2838 #define AUX_ROC_MIN_DURATION MSEC_TO_TU(100)
2839 #define AUX_ROC_MIN_DELAY MSEC_TO_TU(200)
2840 #define AUX_ROC_MAX_DELAY MSEC_TO_TU(600)
2841 #define AUX_ROC_SAFETY_BUFFER MSEC_TO_TU(20)
2842 #define AUX_ROC_MIN_SAFETY_BUFFER MSEC_TO_TU(10)
2843 static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm,
2844 				    struct ieee80211_channel *channel,
2845 				    struct ieee80211_vif *vif,
2846 				    int duration)
2847 {
2848 	int res, time_reg = DEVICE_SYSTEM_TIME_REG;
2849 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2850 	struct iwl_mvm_time_event_data *te_data = &mvmvif->hs_time_event_data;
2851 	static const u16 time_event_response[] = { HOT_SPOT_CMD };
2852 	struct iwl_notification_wait wait_time_event;
2853 	u32 dtim_interval = vif->bss_conf.dtim_period *
2854 		vif->bss_conf.beacon_int;
2855 	u32 req_dur, delay;
2856 	struct iwl_hs20_roc_req aux_roc_req = {
2857 		.action = cpu_to_le32(FW_CTXT_ACTION_ADD),
2858 		.id_and_color =
2859 			cpu_to_le32(FW_CMD_ID_AND_COLOR(MAC_INDEX_AUX, 0)),
2860 		.sta_id_and_color = cpu_to_le32(mvm->aux_sta.sta_id),
2861 		/* Set the channel info data */
2862 		.channel_info.band = (channel->band == IEEE80211_BAND_2GHZ) ?
2863 			PHY_BAND_24 : PHY_BAND_5,
2864 		.channel_info.channel = channel->hw_value,
2865 		.channel_info.width = PHY_VHT_CHANNEL_MODE20,
2866 		/* Set the time and duration */
2867 		.apply_time = cpu_to_le32(iwl_read_prph(mvm->trans, time_reg)),
2868 	 };
2869 
2870 	delay = AUX_ROC_MIN_DELAY;
2871 	req_dur = MSEC_TO_TU(duration);
2872 
2873 	/*
2874 	 * If we are associated we want the delay time to be at least one
2875 	 * dtim interval so that the FW can wait until after the DTIM and
2876 	 * then start the time event, this will potentially allow us to
2877 	 * remain off-channel for the max duration.
2878 	 * Since we want to use almost a whole dtim interval we would also
2879 	 * like the delay to be for 2-3 dtim intervals, in case there are
2880 	 * other time events with higher priority.
2881 	 */
2882 	if (vif->bss_conf.assoc) {
2883 		delay = min_t(u32, dtim_interval * 3, AUX_ROC_MAX_DELAY);
2884 		/* We cannot remain off-channel longer than the DTIM interval */
2885 		if (dtim_interval <= req_dur) {
2886 			req_dur = dtim_interval - AUX_ROC_SAFETY_BUFFER;
2887 			if (req_dur <= AUX_ROC_MIN_DURATION)
2888 				req_dur = dtim_interval -
2889 					AUX_ROC_MIN_SAFETY_BUFFER;
2890 		}
2891 	}
2892 
2893 	aux_roc_req.duration = cpu_to_le32(req_dur);
2894 	aux_roc_req.apply_time_max_delay = cpu_to_le32(delay);
2895 
2896 	IWL_DEBUG_TE(mvm,
2897 		     "ROC: Requesting to remain on channel %u for %ums (requested = %ums, max_delay = %ums, dtim_interval = %ums)\n",
2898 		     channel->hw_value, req_dur, duration, delay,
2899 		     dtim_interval);
2900 	/* Set the node address */
2901 	memcpy(aux_roc_req.node_addr, vif->addr, ETH_ALEN);
2902 
2903 	lockdep_assert_held(&mvm->mutex);
2904 
2905 	spin_lock_bh(&mvm->time_event_lock);
2906 
2907 	if (WARN_ON(te_data->id == HOT_SPOT_CMD)) {
2908 		spin_unlock_bh(&mvm->time_event_lock);
2909 		return -EIO;
2910 	}
2911 
2912 	te_data->vif = vif;
2913 	te_data->duration = duration;
2914 	te_data->id = HOT_SPOT_CMD;
2915 
2916 	spin_unlock_bh(&mvm->time_event_lock);
2917 
2918 	/*
2919 	 * Use a notification wait, which really just processes the
2920 	 * command response and doesn't wait for anything, in order
2921 	 * to be able to process the response and get the UID inside
2922 	 * the RX path. Using CMD_WANT_SKB doesn't work because it
2923 	 * stores the buffer and then wakes up this thread, by which
2924 	 * time another notification (that the time event started)
2925 	 * might already be processed unsuccessfully.
2926 	 */
2927 	iwl_init_notification_wait(&mvm->notif_wait, &wait_time_event,
2928 				   time_event_response,
2929 				   ARRAY_SIZE(time_event_response),
2930 				   iwl_mvm_rx_aux_roc, te_data);
2931 
2932 	res = iwl_mvm_send_cmd_pdu(mvm, HOT_SPOT_CMD, 0, sizeof(aux_roc_req),
2933 				   &aux_roc_req);
2934 
2935 	if (res) {
2936 		IWL_ERR(mvm, "Couldn't send HOT_SPOT_CMD: %d\n", res);
2937 		iwl_remove_notification(&mvm->notif_wait, &wait_time_event);
2938 		goto out_clear_te;
2939 	}
2940 
2941 	/* No need to wait for anything, so just pass 1 (0 isn't valid) */
2942 	res = iwl_wait_notification(&mvm->notif_wait, &wait_time_event, 1);
2943 	/* should never fail */
2944 	WARN_ON_ONCE(res);
2945 
2946 	if (res) {
2947  out_clear_te:
2948 		spin_lock_bh(&mvm->time_event_lock);
2949 		iwl_mvm_te_clear_data(mvm, te_data);
2950 		spin_unlock_bh(&mvm->time_event_lock);
2951 	}
2952 
2953 	return res;
2954 }
2955 
2956 static int iwl_mvm_roc(struct ieee80211_hw *hw,
2957 		       struct ieee80211_vif *vif,
2958 		       struct ieee80211_channel *channel,
2959 		       int duration,
2960 		       enum ieee80211_roc_type type)
2961 {
2962 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2963 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2964 	struct cfg80211_chan_def chandef;
2965 	struct iwl_mvm_phy_ctxt *phy_ctxt;
2966 	int ret, i;
2967 
2968 	IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value,
2969 			   duration, type);
2970 
2971 	flush_work(&mvm->roc_done_wk);
2972 
2973 	mutex_lock(&mvm->mutex);
2974 
2975 	switch (vif->type) {
2976 	case NL80211_IFTYPE_STATION:
2977 		if (fw_has_capa(&mvm->fw->ucode_capa,
2978 				IWL_UCODE_TLV_CAPA_HOTSPOT_SUPPORT)) {
2979 			/* Use aux roc framework (HS20) */
2980 			ret = iwl_mvm_send_aux_roc_cmd(mvm, channel,
2981 						       vif, duration);
2982 			goto out_unlock;
2983 		}
2984 		IWL_ERR(mvm, "hotspot not supported\n");
2985 		ret = -EINVAL;
2986 		goto out_unlock;
2987 	case NL80211_IFTYPE_P2P_DEVICE:
2988 		/* handle below */
2989 		break;
2990 	default:
2991 		IWL_ERR(mvm, "vif isn't P2P_DEVICE: %d\n", vif->type);
2992 		ret = -EINVAL;
2993 		goto out_unlock;
2994 	}
2995 
2996 	for (i = 0; i < NUM_PHY_CTX; i++) {
2997 		phy_ctxt = &mvm->phy_ctxts[i];
2998 		if (phy_ctxt->ref == 0 || mvmvif->phy_ctxt == phy_ctxt)
2999 			continue;
3000 
3001 		if (phy_ctxt->ref && channel == phy_ctxt->channel) {
3002 			/*
3003 			 * Unbind the P2P_DEVICE from the current PHY context,
3004 			 * and if the PHY context is not used remove it.
3005 			 */
3006 			ret = iwl_mvm_binding_remove_vif(mvm, vif);
3007 			if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3008 				goto out_unlock;
3009 
3010 			iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3011 
3012 			/* Bind the P2P_DEVICE to the current PHY Context */
3013 			mvmvif->phy_ctxt = phy_ctxt;
3014 
3015 			ret = iwl_mvm_binding_add_vif(mvm, vif);
3016 			if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3017 				goto out_unlock;
3018 
3019 			iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3020 			goto schedule_time_event;
3021 		}
3022 	}
3023 
3024 	/* Need to update the PHY context only if the ROC channel changed */
3025 	if (channel == mvmvif->phy_ctxt->channel)
3026 		goto schedule_time_event;
3027 
3028 	cfg80211_chandef_create(&chandef, channel, NL80211_CHAN_NO_HT);
3029 
3030 	/*
3031 	 * Change the PHY context configuration as it is currently referenced
3032 	 * only by the P2P Device MAC
3033 	 */
3034 	if (mvmvif->phy_ctxt->ref == 1) {
3035 		ret = iwl_mvm_phy_ctxt_changed(mvm, mvmvif->phy_ctxt,
3036 					       &chandef, 1, 1);
3037 		if (ret)
3038 			goto out_unlock;
3039 	} else {
3040 		/*
3041 		 * The PHY context is shared with other MACs. Need to remove the
3042 		 * P2P Device from the binding, allocate an new PHY context and
3043 		 * create a new binding
3044 		 */
3045 		phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3046 		if (!phy_ctxt) {
3047 			ret = -ENOSPC;
3048 			goto out_unlock;
3049 		}
3050 
3051 		ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &chandef,
3052 					       1, 1);
3053 		if (ret) {
3054 			IWL_ERR(mvm, "Failed to change PHY context\n");
3055 			goto out_unlock;
3056 		}
3057 
3058 		/* Unbind the P2P_DEVICE from the current PHY context */
3059 		ret = iwl_mvm_binding_remove_vif(mvm, vif);
3060 		if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3061 			goto out_unlock;
3062 
3063 		iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3064 
3065 		/* Bind the P2P_DEVICE to the new allocated PHY context */
3066 		mvmvif->phy_ctxt = phy_ctxt;
3067 
3068 		ret = iwl_mvm_binding_add_vif(mvm, vif);
3069 		if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3070 			goto out_unlock;
3071 
3072 		iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3073 	}
3074 
3075 schedule_time_event:
3076 	/* Schedule the time events */
3077 	ret = iwl_mvm_start_p2p_roc(mvm, vif, duration, type);
3078 
3079 out_unlock:
3080 	mutex_unlock(&mvm->mutex);
3081 	IWL_DEBUG_MAC80211(mvm, "leave\n");
3082 	return ret;
3083 }
3084 
3085 static int iwl_mvm_cancel_roc(struct ieee80211_hw *hw)
3086 {
3087 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3088 
3089 	IWL_DEBUG_MAC80211(mvm, "enter\n");
3090 
3091 	mutex_lock(&mvm->mutex);
3092 	iwl_mvm_stop_roc(mvm);
3093 	mutex_unlock(&mvm->mutex);
3094 
3095 	IWL_DEBUG_MAC80211(mvm, "leave\n");
3096 	return 0;
3097 }
3098 
3099 static int __iwl_mvm_add_chanctx(struct iwl_mvm *mvm,
3100 				 struct ieee80211_chanctx_conf *ctx)
3101 {
3102 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3103 	struct iwl_mvm_phy_ctxt *phy_ctxt;
3104 	int ret;
3105 
3106 	lockdep_assert_held(&mvm->mutex);
3107 
3108 	IWL_DEBUG_MAC80211(mvm, "Add channel context\n");
3109 
3110 	phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3111 	if (!phy_ctxt) {
3112 		ret = -ENOSPC;
3113 		goto out;
3114 	}
3115 
3116 	ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx->min_def,
3117 				       ctx->rx_chains_static,
3118 				       ctx->rx_chains_dynamic);
3119 	if (ret) {
3120 		IWL_ERR(mvm, "Failed to add PHY context\n");
3121 		goto out;
3122 	}
3123 
3124 	iwl_mvm_phy_ctxt_ref(mvm, phy_ctxt);
3125 	*phy_ctxt_id = phy_ctxt->id;
3126 out:
3127 	return ret;
3128 }
3129 
3130 static int iwl_mvm_add_chanctx(struct ieee80211_hw *hw,
3131 			       struct ieee80211_chanctx_conf *ctx)
3132 {
3133 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3134 	int ret;
3135 
3136 	mutex_lock(&mvm->mutex);
3137 	ret = __iwl_mvm_add_chanctx(mvm, ctx);
3138 	mutex_unlock(&mvm->mutex);
3139 
3140 	return ret;
3141 }
3142 
3143 static void __iwl_mvm_remove_chanctx(struct iwl_mvm *mvm,
3144 				     struct ieee80211_chanctx_conf *ctx)
3145 {
3146 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3147 	struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3148 
3149 	lockdep_assert_held(&mvm->mutex);
3150 
3151 	iwl_mvm_phy_ctxt_unref(mvm, phy_ctxt);
3152 }
3153 
3154 static void iwl_mvm_remove_chanctx(struct ieee80211_hw *hw,
3155 				   struct ieee80211_chanctx_conf *ctx)
3156 {
3157 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3158 
3159 	mutex_lock(&mvm->mutex);
3160 	__iwl_mvm_remove_chanctx(mvm, ctx);
3161 	mutex_unlock(&mvm->mutex);
3162 }
3163 
3164 static void iwl_mvm_change_chanctx(struct ieee80211_hw *hw,
3165 				   struct ieee80211_chanctx_conf *ctx,
3166 				   u32 changed)
3167 {
3168 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3169 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3170 	struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3171 
3172 	if (WARN_ONCE((phy_ctxt->ref > 1) &&
3173 		      (changed & ~(IEEE80211_CHANCTX_CHANGE_WIDTH |
3174 				   IEEE80211_CHANCTX_CHANGE_RX_CHAINS |
3175 				   IEEE80211_CHANCTX_CHANGE_RADAR |
3176 				   IEEE80211_CHANCTX_CHANGE_MIN_WIDTH)),
3177 		      "Cannot change PHY. Ref=%d, changed=0x%X\n",
3178 		      phy_ctxt->ref, changed))
3179 		return;
3180 
3181 	mutex_lock(&mvm->mutex);
3182 	iwl_mvm_bt_coex_vif_change(mvm);
3183 	iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx->min_def,
3184 				 ctx->rx_chains_static,
3185 				 ctx->rx_chains_dynamic);
3186 	mutex_unlock(&mvm->mutex);
3187 }
3188 
3189 static int __iwl_mvm_assign_vif_chanctx(struct iwl_mvm *mvm,
3190 					struct ieee80211_vif *vif,
3191 					struct ieee80211_chanctx_conf *ctx,
3192 					bool switching_chanctx)
3193 {
3194 	u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3195 	struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3196 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3197 	int ret;
3198 
3199 	lockdep_assert_held(&mvm->mutex);
3200 
3201 	mvmvif->phy_ctxt = phy_ctxt;
3202 
3203 	switch (vif->type) {
3204 	case NL80211_IFTYPE_AP:
3205 		/* only needed if we're switching chanctx (i.e. during CSA) */
3206 		if (switching_chanctx) {
3207 			mvmvif->ap_ibss_active = true;
3208 			break;
3209 		}
3210 	case NL80211_IFTYPE_ADHOC:
3211 		/*
3212 		 * The AP binding flow is handled as part of the start_ap flow
3213 		 * (in bss_info_changed), similarly for IBSS.
3214 		 */
3215 		ret = 0;
3216 		goto out;
3217 	case NL80211_IFTYPE_STATION:
3218 		break;
3219 	case NL80211_IFTYPE_MONITOR:
3220 		/* always disable PS when a monitor interface is active */
3221 		mvmvif->ps_disabled = true;
3222 		break;
3223 	default:
3224 		ret = -EINVAL;
3225 		goto out;
3226 	}
3227 
3228 	ret = iwl_mvm_binding_add_vif(mvm, vif);
3229 	if (ret)
3230 		goto out;
3231 
3232 	/*
3233 	 * Power state must be updated before quotas,
3234 	 * otherwise fw will complain.
3235 	 */
3236 	iwl_mvm_power_update_mac(mvm);
3237 
3238 	/* Setting the quota at this stage is only required for monitor
3239 	 * interfaces. For the other types, the bss_info changed flow
3240 	 * will handle quota settings.
3241 	 */
3242 	if (vif->type == NL80211_IFTYPE_MONITOR) {
3243 		mvmvif->monitor_active = true;
3244 		ret = iwl_mvm_update_quotas(mvm, false, NULL);
3245 		if (ret)
3246 			goto out_remove_binding;
3247 
3248 		ret = iwl_mvm_add_snif_sta(mvm, vif);
3249 		if (ret)
3250 			goto out_remove_binding;
3251 
3252 	}
3253 
3254 	/* Handle binding during CSA */
3255 	if (vif->type == NL80211_IFTYPE_AP) {
3256 		iwl_mvm_update_quotas(mvm, false, NULL);
3257 		iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3258 	}
3259 
3260 	if (switching_chanctx && vif->type == NL80211_IFTYPE_STATION) {
3261 		u32 duration = 2 * vif->bss_conf.beacon_int;
3262 
3263 		/* iwl_mvm_protect_session() reads directly from the
3264 		 * device (the system time), so make sure it is
3265 		 * available.
3266 		 */
3267 		ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_PROTECT_CSA);
3268 		if (ret)
3269 			goto out_remove_binding;
3270 
3271 		/* Protect the session to make sure we hear the first
3272 		 * beacon on the new channel.
3273 		 */
3274 		iwl_mvm_protect_session(mvm, vif, duration, duration,
3275 					vif->bss_conf.beacon_int / 2,
3276 					true);
3277 
3278 		iwl_mvm_unref(mvm, IWL_MVM_REF_PROTECT_CSA);
3279 
3280 		iwl_mvm_update_quotas(mvm, false, NULL);
3281 	}
3282 
3283 	goto out;
3284 
3285 out_remove_binding:
3286 	iwl_mvm_binding_remove_vif(mvm, vif);
3287 	iwl_mvm_power_update_mac(mvm);
3288 out:
3289 	if (ret)
3290 		mvmvif->phy_ctxt = NULL;
3291 	return ret;
3292 }
3293 static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
3294 				      struct ieee80211_vif *vif,
3295 				      struct ieee80211_chanctx_conf *ctx)
3296 {
3297 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3298 	int ret;
3299 
3300 	mutex_lock(&mvm->mutex);
3301 	ret = __iwl_mvm_assign_vif_chanctx(mvm, vif, ctx, false);
3302 	mutex_unlock(&mvm->mutex);
3303 
3304 	return ret;
3305 }
3306 
3307 static void __iwl_mvm_unassign_vif_chanctx(struct iwl_mvm *mvm,
3308 					   struct ieee80211_vif *vif,
3309 					   struct ieee80211_chanctx_conf *ctx,
3310 					   bool switching_chanctx)
3311 {
3312 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3313 	struct ieee80211_vif *disabled_vif = NULL;
3314 
3315 	lockdep_assert_held(&mvm->mutex);
3316 
3317 	iwl_mvm_remove_time_event(mvm, mvmvif, &mvmvif->time_event_data);
3318 
3319 	switch (vif->type) {
3320 	case NL80211_IFTYPE_ADHOC:
3321 		goto out;
3322 	case NL80211_IFTYPE_MONITOR:
3323 		mvmvif->monitor_active = false;
3324 		mvmvif->ps_disabled = false;
3325 		iwl_mvm_rm_snif_sta(mvm, vif);
3326 		break;
3327 	case NL80211_IFTYPE_AP:
3328 		/* This part is triggered only during CSA */
3329 		if (!switching_chanctx || !mvmvif->ap_ibss_active)
3330 			goto out;
3331 
3332 		mvmvif->csa_countdown = false;
3333 
3334 		/* Set CS bit on all the stations */
3335 		iwl_mvm_modify_all_sta_disable_tx(mvm, mvmvif, true);
3336 
3337 		/* Save blocked iface, the timeout is set on the next beacon */
3338 		rcu_assign_pointer(mvm->csa_tx_blocked_vif, vif);
3339 
3340 		mvmvif->ap_ibss_active = false;
3341 		break;
3342 	case NL80211_IFTYPE_STATION:
3343 		if (!switching_chanctx)
3344 			break;
3345 
3346 		disabled_vif = vif;
3347 
3348 		iwl_mvm_mac_ctxt_changed(mvm, vif, true, NULL);
3349 		break;
3350 	default:
3351 		break;
3352 	}
3353 
3354 	iwl_mvm_update_quotas(mvm, false, disabled_vif);
3355 	iwl_mvm_binding_remove_vif(mvm, vif);
3356 
3357 out:
3358 	mvmvif->phy_ctxt = NULL;
3359 	iwl_mvm_power_update_mac(mvm);
3360 }
3361 
3362 static void iwl_mvm_unassign_vif_chanctx(struct ieee80211_hw *hw,
3363 					 struct ieee80211_vif *vif,
3364 					 struct ieee80211_chanctx_conf *ctx)
3365 {
3366 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3367 
3368 	mutex_lock(&mvm->mutex);
3369 	__iwl_mvm_unassign_vif_chanctx(mvm, vif, ctx, false);
3370 	mutex_unlock(&mvm->mutex);
3371 }
3372 
3373 static int
3374 iwl_mvm_switch_vif_chanctx_swap(struct iwl_mvm *mvm,
3375 				struct ieee80211_vif_chanctx_switch *vifs)
3376 {
3377 	int ret;
3378 
3379 	mutex_lock(&mvm->mutex);
3380 	__iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
3381 	__iwl_mvm_remove_chanctx(mvm, vifs[0].old_ctx);
3382 
3383 	ret = __iwl_mvm_add_chanctx(mvm, vifs[0].new_ctx);
3384 	if (ret) {
3385 		IWL_ERR(mvm, "failed to add new_ctx during channel switch\n");
3386 		goto out_reassign;
3387 	}
3388 
3389 	ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
3390 					   true);
3391 	if (ret) {
3392 		IWL_ERR(mvm,
3393 			"failed to assign new_ctx during channel switch\n");
3394 		goto out_remove;
3395 	}
3396 
3397 	/* we don't support TDLS during DCM - can be caused by channel switch */
3398 	if (iwl_mvm_phy_ctx_count(mvm) > 1)
3399 		iwl_mvm_teardown_tdls_peers(mvm);
3400 
3401 	goto out;
3402 
3403 out_remove:
3404 	__iwl_mvm_remove_chanctx(mvm, vifs[0].new_ctx);
3405 
3406 out_reassign:
3407 	if (__iwl_mvm_add_chanctx(mvm, vifs[0].old_ctx)) {
3408 		IWL_ERR(mvm, "failed to add old_ctx back after failure.\n");
3409 		goto out_restart;
3410 	}
3411 
3412 	if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
3413 					 true)) {
3414 		IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
3415 		goto out_restart;
3416 	}
3417 
3418 	goto out;
3419 
3420 out_restart:
3421 	/* things keep failing, better restart the hw */
3422 	iwl_mvm_nic_restart(mvm, false);
3423 
3424 out:
3425 	mutex_unlock(&mvm->mutex);
3426 
3427 	return ret;
3428 }
3429 
3430 static int
3431 iwl_mvm_switch_vif_chanctx_reassign(struct iwl_mvm *mvm,
3432 				    struct ieee80211_vif_chanctx_switch *vifs)
3433 {
3434 	int ret;
3435 
3436 	mutex_lock(&mvm->mutex);
3437 	__iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
3438 
3439 	ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
3440 					   true);
3441 	if (ret) {
3442 		IWL_ERR(mvm,
3443 			"failed to assign new_ctx during channel switch\n");
3444 		goto out_reassign;
3445 	}
3446 
3447 	goto out;
3448 
3449 out_reassign:
3450 	if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
3451 					 true)) {
3452 		IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
3453 		goto out_restart;
3454 	}
3455 
3456 	goto out;
3457 
3458 out_restart:
3459 	/* things keep failing, better restart the hw */
3460 	iwl_mvm_nic_restart(mvm, false);
3461 
3462 out:
3463 	mutex_unlock(&mvm->mutex);
3464 
3465 	return ret;
3466 }
3467 
3468 static int iwl_mvm_switch_vif_chanctx(struct ieee80211_hw *hw,
3469 				      struct ieee80211_vif_chanctx_switch *vifs,
3470 				      int n_vifs,
3471 				      enum ieee80211_chanctx_switch_mode mode)
3472 {
3473 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3474 	int ret;
3475 
3476 	/* we only support a single-vif right now */
3477 	if (n_vifs > 1)
3478 		return -EOPNOTSUPP;
3479 
3480 	switch (mode) {
3481 	case CHANCTX_SWMODE_SWAP_CONTEXTS:
3482 		ret = iwl_mvm_switch_vif_chanctx_swap(mvm, vifs);
3483 		break;
3484 	case CHANCTX_SWMODE_REASSIGN_VIF:
3485 		ret = iwl_mvm_switch_vif_chanctx_reassign(mvm, vifs);
3486 		break;
3487 	default:
3488 		ret = -EOPNOTSUPP;
3489 		break;
3490 	}
3491 
3492 	return ret;
3493 }
3494 
3495 static int iwl_mvm_set_tim(struct ieee80211_hw *hw,
3496 			   struct ieee80211_sta *sta,
3497 			   bool set)
3498 {
3499 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3500 	struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
3501 
3502 	if (!mvm_sta || !mvm_sta->vif) {
3503 		IWL_ERR(mvm, "Station is not associated to a vif\n");
3504 		return -EINVAL;
3505 	}
3506 
3507 	return iwl_mvm_mac_ctxt_beacon_changed(mvm, mvm_sta->vif);
3508 }
3509 
3510 #ifdef CONFIG_NL80211_TESTMODE
3511 static const struct nla_policy iwl_mvm_tm_policy[IWL_MVM_TM_ATTR_MAX + 1] = {
3512 	[IWL_MVM_TM_ATTR_CMD] = { .type = NLA_U32 },
3513 	[IWL_MVM_TM_ATTR_NOA_DURATION] = { .type = NLA_U32 },
3514 	[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE] = { .type = NLA_U32 },
3515 };
3516 
3517 static int __iwl_mvm_mac_testmode_cmd(struct iwl_mvm *mvm,
3518 				      struct ieee80211_vif *vif,
3519 				      void *data, int len)
3520 {
3521 	struct nlattr *tb[IWL_MVM_TM_ATTR_MAX + 1];
3522 	int err;
3523 	u32 noa_duration;
3524 
3525 	err = nla_parse(tb, IWL_MVM_TM_ATTR_MAX, data, len, iwl_mvm_tm_policy);
3526 	if (err)
3527 		return err;
3528 
3529 	if (!tb[IWL_MVM_TM_ATTR_CMD])
3530 		return -EINVAL;
3531 
3532 	switch (nla_get_u32(tb[IWL_MVM_TM_ATTR_CMD])) {
3533 	case IWL_MVM_TM_CMD_SET_NOA:
3534 		if (!vif || vif->type != NL80211_IFTYPE_AP || !vif->p2p ||
3535 		    !vif->bss_conf.enable_beacon ||
3536 		    !tb[IWL_MVM_TM_ATTR_NOA_DURATION])
3537 			return -EINVAL;
3538 
3539 		noa_duration = nla_get_u32(tb[IWL_MVM_TM_ATTR_NOA_DURATION]);
3540 		if (noa_duration >= vif->bss_conf.beacon_int)
3541 			return -EINVAL;
3542 
3543 		mvm->noa_duration = noa_duration;
3544 		mvm->noa_vif = vif;
3545 
3546 		return iwl_mvm_update_quotas(mvm, false, NULL);
3547 	case IWL_MVM_TM_CMD_SET_BEACON_FILTER:
3548 		/* must be associated client vif - ignore authorized */
3549 		if (!vif || vif->type != NL80211_IFTYPE_STATION ||
3550 		    !vif->bss_conf.assoc || !vif->bss_conf.dtim_period ||
3551 		    !tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE])
3552 			return -EINVAL;
3553 
3554 		if (nla_get_u32(tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE]))
3555 			return iwl_mvm_enable_beacon_filter(mvm, vif, 0);
3556 		return iwl_mvm_disable_beacon_filter(mvm, vif, 0);
3557 	}
3558 
3559 	return -EOPNOTSUPP;
3560 }
3561 
3562 static int iwl_mvm_mac_testmode_cmd(struct ieee80211_hw *hw,
3563 				    struct ieee80211_vif *vif,
3564 				    void *data, int len)
3565 {
3566 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3567 	int err;
3568 
3569 	mutex_lock(&mvm->mutex);
3570 	err = __iwl_mvm_mac_testmode_cmd(mvm, vif, data, len);
3571 	mutex_unlock(&mvm->mutex);
3572 
3573 	return err;
3574 }
3575 #endif
3576 
3577 static void iwl_mvm_channel_switch(struct ieee80211_hw *hw,
3578 				   struct ieee80211_vif *vif,
3579 				   struct ieee80211_channel_switch *chsw)
3580 {
3581 	/* By implementing this operation, we prevent mac80211 from
3582 	 * starting its own channel switch timer, so that we can call
3583 	 * ieee80211_chswitch_done() ourselves at the right time
3584 	 * (which is when the absence time event starts).
3585 	 */
3586 
3587 	IWL_DEBUG_MAC80211(IWL_MAC80211_GET_MVM(hw),
3588 			   "dummy channel switch op\n");
3589 }
3590 
3591 static int iwl_mvm_pre_channel_switch(struct ieee80211_hw *hw,
3592 				      struct ieee80211_vif *vif,
3593 				      struct ieee80211_channel_switch *chsw)
3594 {
3595 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3596 	struct ieee80211_vif *csa_vif;
3597 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3598 	u32 apply_time;
3599 	int ret;
3600 
3601 	mutex_lock(&mvm->mutex);
3602 
3603 	mvmvif->csa_failed = false;
3604 
3605 	IWL_DEBUG_MAC80211(mvm, "pre CSA to freq %d\n",
3606 			   chsw->chandef.center_freq1);
3607 
3608 	iwl_fw_dbg_trigger_simple_stop(mvm, vif, FW_DBG_TRIGGER_CHANNEL_SWITCH);
3609 
3610 	switch (vif->type) {
3611 	case NL80211_IFTYPE_AP:
3612 		csa_vif =
3613 			rcu_dereference_protected(mvm->csa_vif,
3614 						  lockdep_is_held(&mvm->mutex));
3615 		if (WARN_ONCE(csa_vif && csa_vif->csa_active,
3616 			      "Another CSA is already in progress")) {
3617 			ret = -EBUSY;
3618 			goto out_unlock;
3619 		}
3620 
3621 		rcu_assign_pointer(mvm->csa_vif, vif);
3622 
3623 		if (WARN_ONCE(mvmvif->csa_countdown,
3624 			      "Previous CSA countdown didn't complete")) {
3625 			ret = -EBUSY;
3626 			goto out_unlock;
3627 		}
3628 
3629 		break;
3630 	case NL80211_IFTYPE_STATION:
3631 		/* Schedule the time event to a bit before beacon 1,
3632 		 * to make sure we're in the new channel when the
3633 		 * GO/AP arrives.
3634 		 */
3635 		apply_time = chsw->device_timestamp +
3636 			((vif->bss_conf.beacon_int * (chsw->count - 1) -
3637 			  IWL_MVM_CHANNEL_SWITCH_TIME_CLIENT) * 1024);
3638 
3639 		if (chsw->block_tx)
3640 			iwl_mvm_csa_client_absent(mvm, vif);
3641 
3642 		iwl_mvm_schedule_csa_period(mvm, vif, vif->bss_conf.beacon_int,
3643 					    apply_time);
3644 		if (mvmvif->bf_data.bf_enabled) {
3645 			ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
3646 			if (ret)
3647 				goto out_unlock;
3648 		}
3649 
3650 		break;
3651 	default:
3652 		break;
3653 	}
3654 
3655 	mvmvif->ps_disabled = true;
3656 
3657 	ret = iwl_mvm_power_update_ps(mvm);
3658 	if (ret)
3659 		goto out_unlock;
3660 
3661 	/* we won't be on this channel any longer */
3662 	iwl_mvm_teardown_tdls_peers(mvm);
3663 
3664 out_unlock:
3665 	mutex_unlock(&mvm->mutex);
3666 
3667 	return ret;
3668 }
3669 
3670 static int iwl_mvm_post_channel_switch(struct ieee80211_hw *hw,
3671 				       struct ieee80211_vif *vif)
3672 {
3673 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3674 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3675 	int ret;
3676 
3677 	mutex_lock(&mvm->mutex);
3678 
3679 	if (mvmvif->csa_failed) {
3680 		mvmvif->csa_failed = false;
3681 		ret = -EIO;
3682 		goto out_unlock;
3683 	}
3684 
3685 	if (vif->type == NL80211_IFTYPE_STATION) {
3686 		struct iwl_mvm_sta *mvmsta;
3687 
3688 		mvmsta = iwl_mvm_sta_from_staid_protected(mvm,
3689 							  mvmvif->ap_sta_id);
3690 
3691 		if (WARN_ON(!mvmsta)) {
3692 			ret = -EIO;
3693 			goto out_unlock;
3694 		}
3695 
3696 		iwl_mvm_sta_modify_disable_tx(mvm, mvmsta, false);
3697 
3698 		iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3699 
3700 		ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
3701 		if (ret)
3702 			goto out_unlock;
3703 
3704 		iwl_mvm_stop_session_protection(mvm, vif);
3705 	}
3706 
3707 	mvmvif->ps_disabled = false;
3708 
3709 	ret = iwl_mvm_power_update_ps(mvm);
3710 
3711 out_unlock:
3712 	mutex_unlock(&mvm->mutex);
3713 
3714 	return ret;
3715 }
3716 
3717 static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
3718 			      struct ieee80211_vif *vif, u32 queues, bool drop)
3719 {
3720 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3721 	struct iwl_mvm_vif *mvmvif;
3722 	struct iwl_mvm_sta *mvmsta;
3723 	struct ieee80211_sta *sta;
3724 	int i;
3725 	u32 msk = 0;
3726 
3727 	if (!vif || vif->type != NL80211_IFTYPE_STATION)
3728 		return;
3729 
3730 	mutex_lock(&mvm->mutex);
3731 	mvmvif = iwl_mvm_vif_from_mac80211(vif);
3732 
3733 	/* flush the AP-station and all TDLS peers */
3734 	for (i = 0; i < IWL_MVM_STATION_COUNT; i++) {
3735 		sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
3736 						lockdep_is_held(&mvm->mutex));
3737 		if (IS_ERR_OR_NULL(sta))
3738 			continue;
3739 
3740 		mvmsta = iwl_mvm_sta_from_mac80211(sta);
3741 		if (mvmsta->vif != vif)
3742 			continue;
3743 
3744 		/* make sure only TDLS peers or the AP are flushed */
3745 		WARN_ON(i != mvmvif->ap_sta_id && !sta->tdls);
3746 
3747 		msk |= mvmsta->tfd_queue_msk;
3748 	}
3749 
3750 	if (drop) {
3751 		if (iwl_mvm_flush_tx_path(mvm, msk, 0))
3752 			IWL_ERR(mvm, "flush request fail\n");
3753 		mutex_unlock(&mvm->mutex);
3754 	} else {
3755 		mutex_unlock(&mvm->mutex);
3756 
3757 		/* this can take a while, and we may need/want other operations
3758 		 * to succeed while doing this, so do it without the mutex held
3759 		 */
3760 		iwl_trans_wait_tx_queue_empty(mvm->trans, msk);
3761 	}
3762 }
3763 
3764 static int iwl_mvm_mac_get_survey(struct ieee80211_hw *hw, int idx,
3765 				  struct survey_info *survey)
3766 {
3767 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3768 	int ret;
3769 
3770 	memset(survey, 0, sizeof(*survey));
3771 
3772 	/* only support global statistics right now */
3773 	if (idx != 0)
3774 		return -ENOENT;
3775 
3776 	if (fw_has_capa(&mvm->fw->ucode_capa,
3777 			IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
3778 		return -ENOENT;
3779 
3780 	mutex_lock(&mvm->mutex);
3781 
3782 	if (mvm->ucode_loaded) {
3783 		ret = iwl_mvm_request_statistics(mvm, false);
3784 		if (ret)
3785 			goto out;
3786 	}
3787 
3788 	survey->filled = SURVEY_INFO_TIME |
3789 			 SURVEY_INFO_TIME_RX |
3790 			 SURVEY_INFO_TIME_TX |
3791 			 SURVEY_INFO_TIME_SCAN;
3792 	survey->time = mvm->accu_radio_stats.on_time_rf +
3793 		       mvm->radio_stats.on_time_rf;
3794 	do_div(survey->time, USEC_PER_MSEC);
3795 
3796 	survey->time_rx = mvm->accu_radio_stats.rx_time +
3797 			  mvm->radio_stats.rx_time;
3798 	do_div(survey->time_rx, USEC_PER_MSEC);
3799 
3800 	survey->time_tx = mvm->accu_radio_stats.tx_time +
3801 			  mvm->radio_stats.tx_time;
3802 	do_div(survey->time_tx, USEC_PER_MSEC);
3803 
3804 	survey->time_scan = mvm->accu_radio_stats.on_time_scan +
3805 			    mvm->radio_stats.on_time_scan;
3806 	do_div(survey->time_scan, USEC_PER_MSEC);
3807 
3808 	ret = 0;
3809  out:
3810 	mutex_unlock(&mvm->mutex);
3811 	return ret;
3812 }
3813 
3814 static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,
3815 				       struct ieee80211_vif *vif,
3816 				       struct ieee80211_sta *sta,
3817 				       struct station_info *sinfo)
3818 {
3819 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3820 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3821 	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
3822 
3823 	if (fw_has_capa(&mvm->fw->ucode_capa,
3824 			IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
3825 		return;
3826 
3827 	/* if beacon filtering isn't on mac80211 does it anyway */
3828 	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
3829 		return;
3830 
3831 	if (!vif->bss_conf.assoc)
3832 		return;
3833 
3834 	mutex_lock(&mvm->mutex);
3835 
3836 	if (mvmvif->ap_sta_id != mvmsta->sta_id)
3837 		goto unlock;
3838 
3839 	if (iwl_mvm_request_statistics(mvm, false))
3840 		goto unlock;
3841 
3842 	sinfo->rx_beacon = mvmvif->beacon_stats.num_beacons +
3843 			   mvmvif->beacon_stats.accu_num_beacons;
3844 	sinfo->filled |= BIT(NL80211_STA_INFO_BEACON_RX);
3845 	if (mvmvif->beacon_stats.avg_signal) {
3846 		/* firmware only reports a value after RXing a few beacons */
3847 		sinfo->rx_beacon_signal_avg = mvmvif->beacon_stats.avg_signal;
3848 		sinfo->filled |= BIT(NL80211_STA_INFO_BEACON_SIGNAL_AVG);
3849 	}
3850  unlock:
3851 	mutex_unlock(&mvm->mutex);
3852 }
3853 
3854 static void iwl_mvm_event_mlme_callback(struct iwl_mvm *mvm,
3855 					struct ieee80211_vif *vif,
3856 					const struct ieee80211_event *event)
3857 {
3858 #define CHECK_MLME_TRIGGER(_mvm, _trig, _buf, _cnt, _fmt...)	\
3859 	do {							\
3860 		if ((_cnt) && --(_cnt))				\
3861 			break;					\
3862 		iwl_mvm_fw_dbg_collect_trig(_mvm, _trig, _fmt);\
3863 	} while (0)
3864 
3865 	struct iwl_fw_dbg_trigger_tlv *trig;
3866 	struct iwl_fw_dbg_trigger_mlme *trig_mlme;
3867 
3868 	if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_MLME))
3869 		return;
3870 
3871 	trig = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_MLME);
3872 	trig_mlme = (void *)trig->data;
3873 	if (!iwl_fw_dbg_trigger_check_stop(mvm, vif, trig))
3874 		return;
3875 
3876 	if (event->u.mlme.data == ASSOC_EVENT) {
3877 		if (event->u.mlme.status == MLME_DENIED)
3878 			CHECK_MLME_TRIGGER(mvm, trig, buf,
3879 					   trig_mlme->stop_assoc_denied,
3880 					   "DENIED ASSOC: reason %d",
3881 					    event->u.mlme.reason);
3882 		else if (event->u.mlme.status == MLME_TIMEOUT)
3883 			CHECK_MLME_TRIGGER(mvm, trig, buf,
3884 					   trig_mlme->stop_assoc_timeout,
3885 					   "ASSOC TIMEOUT");
3886 	} else if (event->u.mlme.data == AUTH_EVENT) {
3887 		if (event->u.mlme.status == MLME_DENIED)
3888 			CHECK_MLME_TRIGGER(mvm, trig, buf,
3889 					   trig_mlme->stop_auth_denied,
3890 					   "DENIED AUTH: reason %d",
3891 					   event->u.mlme.reason);
3892 		else if (event->u.mlme.status == MLME_TIMEOUT)
3893 			CHECK_MLME_TRIGGER(mvm, trig, buf,
3894 					   trig_mlme->stop_auth_timeout,
3895 					   "AUTH TIMEOUT");
3896 	} else if (event->u.mlme.data == DEAUTH_RX_EVENT) {
3897 		CHECK_MLME_TRIGGER(mvm, trig, buf,
3898 				   trig_mlme->stop_rx_deauth,
3899 				   "DEAUTH RX %d", event->u.mlme.reason);
3900 	} else if (event->u.mlme.data == DEAUTH_TX_EVENT) {
3901 		CHECK_MLME_TRIGGER(mvm, trig, buf,
3902 				   trig_mlme->stop_tx_deauth,
3903 				   "DEAUTH TX %d", event->u.mlme.reason);
3904 	}
3905 #undef CHECK_MLME_TRIGGER
3906 }
3907 
3908 static void iwl_mvm_event_bar_rx_callback(struct iwl_mvm *mvm,
3909 					  struct ieee80211_vif *vif,
3910 					  const struct ieee80211_event *event)
3911 {
3912 	struct iwl_fw_dbg_trigger_tlv *trig;
3913 	struct iwl_fw_dbg_trigger_ba *ba_trig;
3914 
3915 	if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_BA))
3916 		return;
3917 
3918 	trig = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_BA);
3919 	ba_trig = (void *)trig->data;
3920 	if (!iwl_fw_dbg_trigger_check_stop(mvm, vif, trig))
3921 		return;
3922 
3923 	if (!(le16_to_cpu(ba_trig->rx_bar) & BIT(event->u.ba.tid)))
3924 		return;
3925 
3926 	iwl_mvm_fw_dbg_collect_trig(mvm, trig,
3927 				    "BAR received from %pM, tid %d, ssn %d",
3928 				    event->u.ba.sta->addr, event->u.ba.tid,
3929 				    event->u.ba.ssn);
3930 }
3931 
3932 static void
3933 iwl_mvm_event_frame_timeout_callback(struct iwl_mvm *mvm,
3934 				     struct ieee80211_vif *vif,
3935 				     const struct ieee80211_event *event)
3936 {
3937 	struct iwl_fw_dbg_trigger_tlv *trig;
3938 	struct iwl_fw_dbg_trigger_ba *ba_trig;
3939 
3940 	if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_BA))
3941 		return;
3942 
3943 	trig = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_BA);
3944 	ba_trig = (void *)trig->data;
3945 	if (!iwl_fw_dbg_trigger_check_stop(mvm, vif, trig))
3946 		return;
3947 
3948 	if (!(le16_to_cpu(ba_trig->frame_timeout) & BIT(event->u.ba.tid)))
3949 		return;
3950 
3951 	iwl_mvm_fw_dbg_collect_trig(mvm, trig,
3952 				    "Frame from %pM timed out, tid %d",
3953 				    event->u.ba.sta->addr, event->u.ba.tid);
3954 }
3955 
3956 static void iwl_mvm_mac_event_callback(struct ieee80211_hw *hw,
3957 				       struct ieee80211_vif *vif,
3958 				       const struct ieee80211_event *event)
3959 {
3960 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3961 
3962 	switch (event->type) {
3963 	case MLME_EVENT:
3964 		iwl_mvm_event_mlme_callback(mvm, vif, event);
3965 		break;
3966 	case BAR_RX_EVENT:
3967 		iwl_mvm_event_bar_rx_callback(mvm, vif, event);
3968 		break;
3969 	case BA_FRAME_TIMEOUT:
3970 		iwl_mvm_event_frame_timeout_callback(mvm, vif, event);
3971 		break;
3972 	default:
3973 		break;
3974 	}
3975 }
3976 
3977 const struct ieee80211_ops iwl_mvm_hw_ops = {
3978 	.tx = iwl_mvm_mac_tx,
3979 	.ampdu_action = iwl_mvm_mac_ampdu_action,
3980 	.start = iwl_mvm_mac_start,
3981 	.reconfig_complete = iwl_mvm_mac_reconfig_complete,
3982 	.stop = iwl_mvm_mac_stop,
3983 	.add_interface = iwl_mvm_mac_add_interface,
3984 	.remove_interface = iwl_mvm_mac_remove_interface,
3985 	.config = iwl_mvm_mac_config,
3986 	.prepare_multicast = iwl_mvm_prepare_multicast,
3987 	.configure_filter = iwl_mvm_configure_filter,
3988 	.config_iface_filter = iwl_mvm_config_iface_filter,
3989 	.bss_info_changed = iwl_mvm_bss_info_changed,
3990 	.hw_scan = iwl_mvm_mac_hw_scan,
3991 	.cancel_hw_scan = iwl_mvm_mac_cancel_hw_scan,
3992 	.sta_pre_rcu_remove = iwl_mvm_sta_pre_rcu_remove,
3993 	.sta_state = iwl_mvm_mac_sta_state,
3994 	.sta_notify = iwl_mvm_mac_sta_notify,
3995 	.allow_buffered_frames = iwl_mvm_mac_allow_buffered_frames,
3996 	.release_buffered_frames = iwl_mvm_mac_release_buffered_frames,
3997 	.set_rts_threshold = iwl_mvm_mac_set_rts_threshold,
3998 	.sta_rc_update = iwl_mvm_sta_rc_update,
3999 	.conf_tx = iwl_mvm_mac_conf_tx,
4000 	.mgd_prepare_tx = iwl_mvm_mac_mgd_prepare_tx,
4001 	.mgd_protect_tdls_discover = iwl_mvm_mac_mgd_protect_tdls_discover,
4002 	.flush = iwl_mvm_mac_flush,
4003 	.sched_scan_start = iwl_mvm_mac_sched_scan_start,
4004 	.sched_scan_stop = iwl_mvm_mac_sched_scan_stop,
4005 	.set_key = iwl_mvm_mac_set_key,
4006 	.update_tkip_key = iwl_mvm_mac_update_tkip_key,
4007 	.remain_on_channel = iwl_mvm_roc,
4008 	.cancel_remain_on_channel = iwl_mvm_cancel_roc,
4009 	.add_chanctx = iwl_mvm_add_chanctx,
4010 	.remove_chanctx = iwl_mvm_remove_chanctx,
4011 	.change_chanctx = iwl_mvm_change_chanctx,
4012 	.assign_vif_chanctx = iwl_mvm_assign_vif_chanctx,
4013 	.unassign_vif_chanctx = iwl_mvm_unassign_vif_chanctx,
4014 	.switch_vif_chanctx = iwl_mvm_switch_vif_chanctx,
4015 
4016 	.start_ap = iwl_mvm_start_ap_ibss,
4017 	.stop_ap = iwl_mvm_stop_ap_ibss,
4018 	.join_ibss = iwl_mvm_start_ap_ibss,
4019 	.leave_ibss = iwl_mvm_stop_ap_ibss,
4020 
4021 	.set_tim = iwl_mvm_set_tim,
4022 
4023 	.channel_switch = iwl_mvm_channel_switch,
4024 	.pre_channel_switch = iwl_mvm_pre_channel_switch,
4025 	.post_channel_switch = iwl_mvm_post_channel_switch,
4026 
4027 	.tdls_channel_switch = iwl_mvm_tdls_channel_switch,
4028 	.tdls_cancel_channel_switch = iwl_mvm_tdls_cancel_channel_switch,
4029 	.tdls_recv_channel_switch = iwl_mvm_tdls_recv_channel_switch,
4030 
4031 	.event_callback = iwl_mvm_mac_event_callback,
4032 
4033 	CFG80211_TESTMODE_CMD(iwl_mvm_mac_testmode_cmd)
4034 
4035 #ifdef CONFIG_PM_SLEEP
4036 	/* look at d3.c */
4037 	.suspend = iwl_mvm_suspend,
4038 	.resume = iwl_mvm_resume,
4039 	.set_wakeup = iwl_mvm_set_wakeup,
4040 	.set_rekey_data = iwl_mvm_set_rekey_data,
4041 #if IS_ENABLED(CONFIG_IPV6)
4042 	.ipv6_addr_change = iwl_mvm_ipv6_addr_change,
4043 #endif
4044 	.set_default_unicast_key = iwl_mvm_set_default_unicast_key,
4045 #endif
4046 	.get_survey = iwl_mvm_mac_get_survey,
4047 	.sta_statistics = iwl_mvm_mac_sta_statistics,
4048 };
4049