drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c

   1 /******************************************************************************
   2  *
   3  * This file is provided under a dual BSD/GPLv2 license.  When using or
   4  * redistributing this file, you may do so under either license.
   5  *
   6  * GPL LICENSE SUMMARY
   7  *
   8  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
   9  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  10  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  11  * Copyright(c) 2018 - 2019 Intel Corporation
  12  *
  13  * This program is free software; you can redistribute it and/or modify
  14  * it under the terms of version 2 of the GNU General Public License as
  15  * published by the Free Software Foundation.
  16  *
  17  * This program is distributed in the hope that it will be useful, but
  18  * WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  20  * General Public License for more details.
  21  *
  22  * The full GNU General Public License is included in this distribution
  23  * in the file called COPYING.
  24  *
  25  * Contact Information:
  26  *  Intel Linux Wireless <linuxwifi@intel.com>
  27  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  28  *
  29  * BSD LICENSE
  30  *
  31  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  32  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  33  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  34  * Copyright(c) 2018 - 2019 Intel Corporation
  35  * All rights reserved.
  36  *
  37  * Redistribution and use in source and binary forms, with or without
  38  * modification, are permitted provided that the following conditions
  39  * are met:
  40  *
  41  *  * Redistributions of source code must retain the above copyright
  42  *    notice, this list of conditions and the following disclaimer.
  43  *  * Redistributions in binary form must reproduce the above copyright
  44  *    notice, this list of conditions and the following disclaimer in
  45  *    the documentation and/or other materials provided with the
  46  *    distribution.
  47  *  * Neither the name Intel Corporation nor the names of its
  48  *    contributors may be used to endorse or promote products derived
  49  *    from this software without specific prior written permission.
  50  *
  51  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  52  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  53  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  54  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  55  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  56  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  57  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  58  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  59  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  60  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  61  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  62  *
  63  *****************************************************************************/
  64 #include <linux/kernel.h>
  65 #include <linux/slab.h>
  66 #include <linux/skbuff.h>
  67 #include <linux/netdevice.h>
  68 #include <linux/etherdevice.h>
  69 #include <linux/ip.h>
  70 #include <linux/if_arp.h>
  71 #include <linux/time.h>
  72 #include <net/mac80211.h>
  73 #include <net/ieee80211_radiotap.h>
  74 #include <net/tcp.h>
  75
  76 #include "iwl-op-mode.h"
  77 #include "iwl-io.h"
  78 #include "mvm.h"
  79 #include "sta.h"
  80 #include "time-event.h"
  81 #include "iwl-eeprom-parse.h"
  82 #include "iwl-phy-db.h"
  83 #include "testmode.h"
  84 #include "fw/error-dump.h"
  85 #include "iwl-prph.h"
  86 #include "iwl-nvm-parse.h"
  87
  88 static const struct ieee80211_iface_limit iwl_mvm_limits[] = {
  89         {
  90                 .max = 1,
  91                 .types = BIT(NL80211_IFTYPE_STATION),
  92         },
  93         {
  94                 .max = 1,
  95                 .types = BIT(NL80211_IFTYPE_AP) |
  96                         BIT(NL80211_IFTYPE_P2P_CLIENT) |
  97                         BIT(NL80211_IFTYPE_P2P_GO),
  98         },
  99         {
 100                 .max = 1,
 101                 .types = BIT(NL80211_IFTYPE_P2P_DEVICE),
 102         },
 103 };
 104
 105 static const struct ieee80211_iface_combination iwl_mvm_iface_combinations[] = {
 106         {
 107                 .num_different_channels = 2,
 108                 .max_interfaces = 3,
 109                 .limits = iwl_mvm_limits,
 110                 .n_limits = ARRAY_SIZE(iwl_mvm_limits),
 111         },
 112 };
 113
 114 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
 115 /*
 116  * Use the reserved field to indicate magic values.
 117  * these values will only be used internally by the driver,
 118  * and won't make it to the fw (reserved will be 0).
 119  * BC_FILTER_MAGIC_IP - configure the val of this attribute to
 120  *      be the vif's ip address. in case there is not a single
 121  *      ip address (0, or more than 1), this attribute will
 122  *      be skipped.
 123  * BC_FILTER_MAGIC_MAC - set the val of this attribute to
 124  *      the LSB bytes of the vif's mac address
 125  */
 126 enum {
 127         BC_FILTER_MAGIC_NONE = 0,
 128         BC_FILTER_MAGIC_IP,
 129         BC_FILTER_MAGIC_MAC,
 130 };
 131
 132 static const struct iwl_fw_bcast_filter iwl_mvm_default_bcast_filters[] = {
 133         {
 134                 /* arp */
 135                 .discard = 0,
 136                 .frame_type = BCAST_FILTER_FRAME_TYPE_ALL,
 137                 .attrs = {
 138                         {
 139                                 /* frame type - arp, hw type - ethernet */
 140                                 .offset_type =
 141                                         BCAST_FILTER_OFFSET_PAYLOAD_START,
 142                                 .offset = sizeof(rfc1042_header),
 143                                 .val = cpu_to_be32(0x08060001),
 144                                 .mask = cpu_to_be32(0xffffffff),
 145                         },
 146                         {
 147                                 /* arp dest ip */
 148                                 .offset_type =
 149                                         BCAST_FILTER_OFFSET_PAYLOAD_START,
 150                                 .offset = sizeof(rfc1042_header) + 2 +
 151                                           sizeof(struct arphdr) +
 152                                           ETH_ALEN + sizeof(__be32) +
 153                                           ETH_ALEN,
 154                                 .mask = cpu_to_be32(0xffffffff),
 155                                 /* mark it as special field */
 156                                 .reserved1 = cpu_to_le16(BC_FILTER_MAGIC_IP),
 157                         },
 158                 },
 159         },
 160         {
 161                 /* dhcp offer bcast */
 162                 .discard = 0,
 163                 .frame_type = BCAST_FILTER_FRAME_TYPE_IPV4,
 164                 .attrs = {
 165                         {
 166                                 /* udp dest port - 68 (bootp client)*/
 167                                 .offset_type = BCAST_FILTER_OFFSET_IP_END,
 168                                 .offset = offsetof(struct udphdr, dest),
 169                                 .val = cpu_to_be32(0x00440000),
 170                                 .mask = cpu_to_be32(0xffff0000),
 171                         },
 172                         {
 173                                 /* dhcp - lsb bytes of client hw address */
 174                                 .offset_type = BCAST_FILTER_OFFSET_IP_END,
 175                                 .offset = 38,
 176                                 .mask = cpu_to_be32(0xffffffff),
 177                                 /* mark it as special field */
 178                                 .reserved1 = cpu_to_le16(BC_FILTER_MAGIC_MAC),
 179                         },
 180                 },
 181         },
 182         /* last filter must be empty */
 183         {},
 184 };
 185 #endif
 186
 187 static const struct cfg80211_pmsr_capabilities iwl_mvm_pmsr_capa = {
 188         .max_peers = IWL_MVM_TOF_MAX_APS,
 189         .report_ap_tsf = 1,
 190         .randomize_mac_addr = 1,
 191
 192         .ftm = {
 193                 .supported = 1,
 194                 .asap = 1,
 195                 .non_asap = 1,
 196                 .request_lci = 1,
 197                 .request_civicloc = 1,
 198                 .max_bursts_exponent = -1, /* all supported */
 199                 .max_ftms_per_burst = 0, /* no limits */
 200                 .bandwidths = BIT(NL80211_CHAN_WIDTH_20_NOHT) |
 201                               BIT(NL80211_CHAN_WIDTH_20) |
 202                               BIT(NL80211_CHAN_WIDTH_40) |
 203                               BIT(NL80211_CHAN_WIDTH_80),
 204                 .preambles = BIT(NL80211_PREAMBLE_LEGACY) |
 205                              BIT(NL80211_PREAMBLE_HT) |
 206                              BIT(NL80211_PREAMBLE_VHT),
 207         },
 208 };
 209
 210 static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
 211                                  enum set_key_cmd cmd,
 212                                  struct ieee80211_vif *vif,
 213                                  struct ieee80211_sta *sta,
 214                                  struct ieee80211_key_conf *key);
 215
 216 static void iwl_mvm_reset_phy_ctxts(struct iwl_mvm *mvm)
 217 {
 218         int i;
 219
 220         memset(mvm->phy_ctxts, 0, sizeof(mvm->phy_ctxts));
 221         for (i = 0; i < NUM_PHY_CTX; i++) {
 222                 mvm->phy_ctxts[i].id = i;
 223                 mvm->phy_ctxts[i].ref = 0;
 224         }
 225 }
 226
 227 struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
 228                                                   const char *alpha2,
 229                                                   enum iwl_mcc_source src_id,
 230                                                   bool *changed)
 231 {
 232         struct ieee80211_regdomain *regd = NULL;
 233         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
 234         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 235         struct iwl_mcc_update_resp *resp;
 236
 237         IWL_DEBUG_LAR(mvm, "Getting regdomain data for %s from FW\n", alpha2);
 238
 239         lockdep_assert_held(&mvm->mutex);
 240
 241         resp = iwl_mvm_update_mcc(mvm, alpha2, src_id);
 242         if (IS_ERR_OR_NULL(resp)) {
 243                 IWL_DEBUG_LAR(mvm, "Could not get update from FW %d\n",
 244                               PTR_ERR_OR_ZERO(resp));
 245                 goto out;
 246         }
 247
 248         if (changed) {
 249                 u32 status = le32_to_cpu(resp->status);
 250
 251                 *changed = (status == MCC_RESP_NEW_CHAN_PROFILE ||
 252                             status == MCC_RESP_ILLEGAL);
 253         }
 254
 255         regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg,
 256                                       __le32_to_cpu(resp->n_channels),
 257                                       resp->channels,
 258                                       __le16_to_cpu(resp->mcc),
 259                                       __le16_to_cpu(resp->geo_info));
 260         /* Store the return source id */
 261         src_id = resp->source_id;
 262         kfree(resp);
 263         if (IS_ERR_OR_NULL(regd)) {
 264                 IWL_DEBUG_LAR(mvm, "Could not get parse update from FW %d\n",
 265                               PTR_ERR_OR_ZERO(regd));
 266                 goto out;
 267         }
 268
 269         IWL_DEBUG_LAR(mvm, "setting alpha2 from FW to %s (0x%x, 0x%x) src=%d\n",
 270                       regd->alpha2, regd->alpha2[0], regd->alpha2[1], src_id);
 271         mvm->lar_regdom_set = true;
 272         mvm->mcc_src = src_id;
 273
 274 out:
 275         return regd;
 276 }
 277
 278 void iwl_mvm_update_changed_regdom(struct iwl_mvm *mvm)
 279 {
 280         bool changed;
 281         struct ieee80211_regdomain *regd;
 282
 283         if (!iwl_mvm_is_lar_supported(mvm))
 284                 return;
 285
 286         regd = iwl_mvm_get_current_regdomain(mvm, &changed);
 287         if (!IS_ERR_OR_NULL(regd)) {
 288                 /* only update the regulatory core if changed */
 289                 if (changed)
 290                         regulatory_set_wiphy_regd(mvm->hw->wiphy, regd);
 291
 292                 kfree(regd);
 293         }
 294 }
 295
 296 struct ieee80211_regdomain *iwl_mvm_get_current_regdomain(struct iwl_mvm *mvm,
 297                                                           bool *changed)
 298 {
 299         return iwl_mvm_get_regdomain(mvm->hw->wiphy, "ZZ",
 300                                      iwl_mvm_is_wifi_mcc_supported(mvm) ?
 301                                      MCC_SOURCE_GET_CURRENT :
 302                                      MCC_SOURCE_OLD_FW, changed);
 303 }
 304
 305 int iwl_mvm_init_fw_regd(struct iwl_mvm *mvm)
 306 {
 307         enum iwl_mcc_source used_src;
 308         struct ieee80211_regdomain *regd;
 309         int ret;
 310         bool changed;
 311         const struct ieee80211_regdomain *r =
 312                         rtnl_dereference(mvm->hw->wiphy->regd);
 313
 314         if (!r)
 315                 return -ENOENT;
 316
 317         /* save the last source in case we overwrite it below */
 318         used_src = mvm->mcc_src;
 319         if (iwl_mvm_is_wifi_mcc_supported(mvm)) {
 320                 /* Notify the firmware we support wifi location updates */
 321                 regd = iwl_mvm_get_current_regdomain(mvm, NULL);
 322                 if (!IS_ERR_OR_NULL(regd))
 323                         kfree(regd);
 324         }
 325
 326         /* Now set our last stored MCC and source */
 327         regd = iwl_mvm_get_regdomain(mvm->hw->wiphy, r->alpha2, used_src,
 328                                      &changed);
 329         if (IS_ERR_OR_NULL(regd))
 330                 return -EIO;
 331
 332         /* update cfg80211 if the regdomain was changed */
 333         if (changed)
 334                 ret = regulatory_set_wiphy_regd_sync_rtnl(mvm->hw->wiphy, regd);
 335         else
 336                 ret = 0;
 337
 338         kfree(regd);
 339         return ret;
 340 }
 341
 342 const static u8 he_if_types_ext_capa_sta[] = {
 343          [0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
 344          [2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
 345          [7] = WLAN_EXT_CAPA8_OPMODE_NOTIF,
 346          [9] = WLAN_EXT_CAPA10_TWT_REQUESTER_SUPPORT,
 347 };
 348
 349 const static struct wiphy_iftype_ext_capab he_iftypes_ext_capa[] = {
 350         {
 351                 .iftype = NL80211_IFTYPE_STATION,
 352                 .extended_capabilities = he_if_types_ext_capa_sta,
 353                 .extended_capabilities_mask = he_if_types_ext_capa_sta,
 354                 .extended_capabilities_len = sizeof(he_if_types_ext_capa_sta),
 355         },
 356 };
 357
 358 int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
 359 {
 360         struct ieee80211_hw *hw = mvm->hw;
 361         int num_mac, ret, i;
 362         static const u32 mvm_ciphers[] = {
 363                 WLAN_CIPHER_SUITE_WEP40,
 364                 WLAN_CIPHER_SUITE_WEP104,
 365                 WLAN_CIPHER_SUITE_TKIP,
 366                 WLAN_CIPHER_SUITE_CCMP,
 367         };
 368 #ifdef CONFIG_PM_SLEEP
 369         bool unified = fw_has_capa(&mvm->fw->ucode_capa,
 370                                    IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
 371 #endif
 372
 373         /* Tell mac80211 our characteristics */
 374         ieee80211_hw_set(hw, SIGNAL_DBM);
 375         ieee80211_hw_set(hw, SPECTRUM_MGMT);
 376         ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
 377         ieee80211_hw_set(hw, WANT_MONITOR_VIF);
 378         ieee80211_hw_set(hw, SUPPORTS_PS);
 379         ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
 380         ieee80211_hw_set(hw, AMPDU_AGGREGATION);
 381         ieee80211_hw_set(hw, TIMING_BEACON_ONLY);
 382         ieee80211_hw_set(hw, CONNECTION_MONITOR);
 383         ieee80211_hw_set(hw, CHANCTX_STA_CSA);
 384         ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
 385         ieee80211_hw_set(hw, SUPPORTS_CLONED_SKBS);
 386         ieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);
 387         ieee80211_hw_set(hw, NEEDS_UNIQUE_STA_ADDR);
 388         ieee80211_hw_set(hw, DEAUTH_NEED_MGD_TX_PREP);
 389         ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);
 390         ieee80211_hw_set(hw, BUFF_MMPDU_TXQ);
 391         ieee80211_hw_set(hw, STA_MMPDU_TXQ);
 392         /*
 393          * On older devices, enabling TX A-MSDU occasionally leads to
 394          * something getting messed up, the command read from the FIFO
 395          * gets out of sync and isn't a TX command, so that we have an
 396          * assert EDC.
 397          *
 398          * It's not clear where the bug is, but since we didn't used to
 399          * support A-MSDU until moving the mac80211 iTXQs, just leave it
 400          * for older devices. We also don't see this issue on any newer
 401          * devices.
 402          */
 403         if (mvm->trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_9000)
 404                 ieee80211_hw_set(hw, TX_AMSDU);
 405         ieee80211_hw_set(hw, TX_FRAG_LIST);
 406
 407         if (iwl_mvm_has_tlc_offload(mvm)) {
 408                 ieee80211_hw_set(hw, TX_AMPDU_SETUP_IN_HW);
 409                 ieee80211_hw_set(hw, HAS_RATE_CONTROL);
 410         }
 411
 412         if (iwl_mvm_has_new_rx_api(mvm))
 413                 ieee80211_hw_set(hw, SUPPORTS_REORDERING_BUFFER);
 414
 415         if (fw_has_capa(&mvm->fw->ucode_capa,
 416                         IWL_UCODE_TLV_CAPA_STA_PM_NOTIF)) {
 417                 ieee80211_hw_set(hw, AP_LINK_PS);
 418         } else if (WARN_ON(iwl_mvm_has_new_tx_api(mvm))) {
 419                 /*
 420                  * we absolutely need this for the new TX API since that comes
 421                  * with many more queues than the current code can deal with
 422                  * for station powersave
 423                  */
 424                 return -EINVAL;
 425         }
 426
 427         if (mvm->trans->num_rx_queues > 1)
 428                 ieee80211_hw_set(hw, USES_RSS);
 429
 430         if (mvm->trans->max_skb_frags)
 431                 hw->netdev_features = NETIF_F_HIGHDMA | NETIF_F_SG;
 432
 433         hw->queues = IEEE80211_MAX_QUEUES;
 434         hw->offchannel_tx_hw_queue = IWL_MVM_OFFCHANNEL_QUEUE;
 435         hw->radiotap_mcs_details |= IEEE80211_RADIOTAP_MCS_HAVE_FEC |
 436                                     IEEE80211_RADIOTAP_MCS_HAVE_STBC;
 437         hw->radiotap_vht_details |= IEEE80211_RADIOTAP_VHT_KNOWN_STBC |
 438                 IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED;
 439
 440         hw->radiotap_timestamp.units_pos =
 441                 IEEE80211_RADIOTAP_TIMESTAMP_UNIT_US |
 442                 IEEE80211_RADIOTAP_TIMESTAMP_SPOS_PLCP_SIG_ACQ;
 443         /* this is the case for CCK frames, it's better (only 8) for OFDM */
 444         hw->radiotap_timestamp.accuracy = 22;
 445
 446         if (!iwl_mvm_has_tlc_offload(mvm))
 447                 hw->rate_control_algorithm = RS_NAME;
 448
 449         hw->uapsd_queues = IWL_MVM_UAPSD_QUEUES;
 450         hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
 451         hw->max_tx_fragments = mvm->trans->max_skb_frags;
 452
 453         BUILD_BUG_ON(ARRAY_SIZE(mvm->ciphers) < ARRAY_SIZE(mvm_ciphers) + 6);
 454         memcpy(mvm->ciphers, mvm_ciphers, sizeof(mvm_ciphers));
 455         hw->wiphy->n_cipher_suites = ARRAY_SIZE(mvm_ciphers);
 456         hw->wiphy->cipher_suites = mvm->ciphers;
 457
 458         if (iwl_mvm_has_new_rx_api(mvm)) {
 459                 mvm->ciphers[hw->wiphy->n_cipher_suites] =
 460                         WLAN_CIPHER_SUITE_GCMP;
 461                 hw->wiphy->n_cipher_suites++;
 462                 mvm->ciphers[hw->wiphy->n_cipher_suites] =
 463                         WLAN_CIPHER_SUITE_GCMP_256;
 464                 hw->wiphy->n_cipher_suites++;
 465         }
 466
 467         /* Enable 11w if software crypto is not enabled (as the
 468          * firmware will interpret some mgmt packets, so enabling it
 469          * with software crypto isn't safe).
 470          */
 471         if (!iwlwifi_mod_params.swcrypto) {
 472                 ieee80211_hw_set(hw, MFP_CAPABLE);
 473                 mvm->ciphers[hw->wiphy->n_cipher_suites] =
 474                         WLAN_CIPHER_SUITE_AES_CMAC;
 475                 hw->wiphy->n_cipher_suites++;
 476                 if (iwl_mvm_has_new_rx_api(mvm)) {
 477                         mvm->ciphers[hw->wiphy->n_cipher_suites] =
 478                                 WLAN_CIPHER_SUITE_BIP_GMAC_128;
 479                         hw->wiphy->n_cipher_suites++;
 480                         mvm->ciphers[hw->wiphy->n_cipher_suites] =
 481                                 WLAN_CIPHER_SUITE_BIP_GMAC_256;
 482                         hw->wiphy->n_cipher_suites++;
 483                 }
 484         }
 485
 486         /* currently FW API supports only one optional cipher scheme */
 487         if (mvm->fw->cs[0].cipher) {
 488                 const struct iwl_fw_cipher_scheme *fwcs = &mvm->fw->cs[0];
 489                 struct ieee80211_cipher_scheme *cs = &mvm->cs[0];
 490
 491                 mvm->hw->n_cipher_schemes = 1;
 492
 493                 cs->cipher = le32_to_cpu(fwcs->cipher);
 494                 cs->iftype = BIT(NL80211_IFTYPE_STATION);
 495                 cs->hdr_len = fwcs->hdr_len;
 496                 cs->pn_len = fwcs->pn_len;
 497                 cs->pn_off = fwcs->pn_off;
 498                 cs->key_idx_off = fwcs->key_idx_off;
 499                 cs->key_idx_mask = fwcs->key_idx_mask;
 500                 cs->key_idx_shift = fwcs->key_idx_shift;
 501                 cs->mic_len = fwcs->mic_len;
 502
 503                 mvm->hw->cipher_schemes = mvm->cs;
 504                 mvm->ciphers[hw->wiphy->n_cipher_suites] = cs->cipher;
 505                 hw->wiphy->n_cipher_suites++;
 506         }
 507
 508         if (fw_has_capa(&mvm->fw->ucode_capa,
 509                         IWL_UCODE_TLV_CAPA_FTM_CALIBRATED)) {
 510                 wiphy_ext_feature_set(hw->wiphy,
 511                                       NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
 512                 hw->wiphy->pmsr_capa = &iwl_mvm_pmsr_capa;
 513         }
 514
 515         ieee80211_hw_set(hw, SINGLE_SCAN_ON_ALL_BANDS);
 516         hw->wiphy->features |=
 517                 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR |
 518                 NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR |
 519                 NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
 520
 521         hw->sta_data_size = sizeof(struct iwl_mvm_sta);
 522         hw->vif_data_size = sizeof(struct iwl_mvm_vif);
 523         hw->chanctx_data_size = sizeof(u16);
 524         hw->txq_data_size = sizeof(struct iwl_mvm_txq);
 525
 526         hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
 527                 BIT(NL80211_IFTYPE_P2P_CLIENT) |
 528                 BIT(NL80211_IFTYPE_AP) |
 529                 BIT(NL80211_IFTYPE_P2P_GO) |
 530                 BIT(NL80211_IFTYPE_P2P_DEVICE) |
 531                 BIT(NL80211_IFTYPE_ADHOC);
 532
 533         hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
 534         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
 535         hw->wiphy->features |= NL80211_FEATURE_HT_IBSS;
 536
 537         hw->wiphy->regulatory_flags |= REGULATORY_ENABLE_RELAX_NO_IR;
 538         if (iwl_mvm_is_lar_supported(mvm))
 539                 hw->wiphy->regulatory_flags |= REGULATORY_WIPHY_SELF_MANAGED;
 540         else
 541                 hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG |
 542                                                REGULATORY_DISABLE_BEACON_HINTS;
 543
 544         hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
 545         hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
 546
 547         hw->wiphy->iface_combinations = iwl_mvm_iface_combinations;
 548         hw->wiphy->n_iface_combinations =
 549                 ARRAY_SIZE(iwl_mvm_iface_combinations);
 550
 551         hw->wiphy->max_remain_on_channel_duration = 10000;
 552         hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
 553
 554         /* Extract MAC address */
 555         memcpy(mvm->addresses[0].addr, mvm->nvm_data->hw_addr, ETH_ALEN);
 556         hw->wiphy->addresses = mvm->addresses;
 557         hw->wiphy->n_addresses = 1;
 558
 559         /* Extract additional MAC addresses if available */
 560         num_mac = (mvm->nvm_data->n_hw_addrs > 1) ?
 561                 min(IWL_MVM_MAX_ADDRESSES, mvm->nvm_data->n_hw_addrs) : 1;
 562
 563         for (i = 1; i < num_mac; i++) {
 564                 memcpy(mvm->addresses[i].addr, mvm->addresses[i-1].addr,
 565                        ETH_ALEN);
 566                 mvm->addresses[i].addr[5]++;
 567                 hw->wiphy->n_addresses++;
 568         }
 569
 570         iwl_mvm_reset_phy_ctxts(mvm);
 571
 572         hw->wiphy->max_scan_ie_len = iwl_mvm_max_scan_ie_len(mvm);
 573
 574         hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
 575
 576         BUILD_BUG_ON(IWL_MVM_SCAN_STOPPING_MASK & IWL_MVM_SCAN_MASK);
 577         BUILD_BUG_ON(IWL_MVM_MAX_UMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK) ||
 578                      IWL_MVM_MAX_LMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK));
 579
 580         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
 581                 mvm->max_scans = IWL_MVM_MAX_UMAC_SCANS;
 582         else
 583                 mvm->max_scans = IWL_MVM_MAX_LMAC_SCANS;
 584
 585         if (mvm->nvm_data->bands[NL80211_BAND_2GHZ].n_channels)
 586                 hw->wiphy->bands[NL80211_BAND_2GHZ] =
 587                         &mvm->nvm_data->bands[NL80211_BAND_2GHZ];
 588         if (mvm->nvm_data->bands[NL80211_BAND_5GHZ].n_channels) {
 589                 hw->wiphy->bands[NL80211_BAND_5GHZ] =
 590                         &mvm->nvm_data->bands[NL80211_BAND_5GHZ];
 591
 592                 if (fw_has_capa(&mvm->fw->ucode_capa,
 593                                 IWL_UCODE_TLV_CAPA_BEAMFORMER) &&
 594                     fw_has_api(&mvm->fw->ucode_capa,
 595                                IWL_UCODE_TLV_API_LQ_SS_PARAMS))
 596                         hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.cap |=
 597                                 IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
 598         }
 599
 600         hw->wiphy->hw_version = mvm->trans->hw_id;
 601
 602         if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM)
 603                 hw->wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
 604         else
 605                 hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 606
 607         hw->wiphy->max_sched_scan_reqs = 1;
 608         hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
 609         hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
 610         /* we create the 802.11 header and zero length SSID IE. */
 611         hw->wiphy->max_sched_scan_ie_len =
 612                 SCAN_OFFLOAD_PROBE_REQ_SIZE - 24 - 2;
 613         hw->wiphy->max_sched_scan_plans = IWL_MAX_SCHED_SCAN_PLANS;
 614         hw->wiphy->max_sched_scan_plan_interval = U16_MAX;
 615
 616         /*
 617          * the firmware uses u8 for num of iterations, but 0xff is saved for
 618          * infinite loop, so the maximum number of iterations is actually 254.
 619          */
 620         hw->wiphy->max_sched_scan_plan_iterations = 254;
 621
 622         hw->wiphy->features |= NL80211_FEATURE_P2P_GO_CTWIN |
 623                                NL80211_FEATURE_LOW_PRIORITY_SCAN |
 624                                NL80211_FEATURE_P2P_GO_OPPPS |
 625                                NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
 626                                NL80211_FEATURE_DYNAMIC_SMPS |
 627                                NL80211_FEATURE_STATIC_SMPS |
 628                                NL80211_FEATURE_SUPPORTS_WMM_ADMISSION;
 629
 630         if (fw_has_capa(&mvm->fw->ucode_capa,
 631                         IWL_UCODE_TLV_CAPA_TXPOWER_INSERTION_SUPPORT))
 632                 hw->wiphy->features |= NL80211_FEATURE_TX_POWER_INSERTION;
 633         if (fw_has_capa(&mvm->fw->ucode_capa,
 634                         IWL_UCODE_TLV_CAPA_QUIET_PERIOD_SUPPORT))
 635                 hw->wiphy->features |= NL80211_FEATURE_QUIET;
 636
 637         if (fw_has_capa(&mvm->fw->ucode_capa,
 638                         IWL_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT))
 639                 hw->wiphy->features |=
 640                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES;
 641
 642         if (fw_has_capa(&mvm->fw->ucode_capa,
 643                         IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT))
 644                 hw->wiphy->features |= NL80211_FEATURE_WFA_TPC_IE_IN_PROBES;
 645
 646         if (fw_has_api(&mvm->fw->ucode_capa,
 647                        IWL_UCODE_TLV_API_SCAN_TSF_REPORT)) {
 648                 wiphy_ext_feature_set(hw->wiphy,
 649                                       NL80211_EXT_FEATURE_SCAN_START_TIME);
 650                 wiphy_ext_feature_set(hw->wiphy,
 651                                       NL80211_EXT_FEATURE_BSS_PARENT_TSF);
 652                 wiphy_ext_feature_set(hw->wiphy,
 653                                       NL80211_EXT_FEATURE_SET_SCAN_DWELL);
 654         }
 655
 656         if (iwl_mvm_is_oce_supported(mvm)) {
 657                 wiphy_ext_feature_set(hw->wiphy,
 658                         NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP);
 659                 wiphy_ext_feature_set(hw->wiphy,
 660                         NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME);
 661                 wiphy_ext_feature_set(hw->wiphy,
 662                         NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION);
 663                 wiphy_ext_feature_set(hw->wiphy,
 664                         NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE);
 665         }
 666
 667         if (mvm->nvm_data->sku_cap_11ax_enable &&
 668             !iwlwifi_mod_params.disable_11ax) {
 669                 hw->wiphy->iftype_ext_capab = he_iftypes_ext_capa;
 670                 hw->wiphy->num_iftype_ext_capab =
 671                         ARRAY_SIZE(he_iftypes_ext_capa);
 672
 673                 ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
 674                 ieee80211_hw_set(hw, SUPPORTS_ONLY_HE_MULTI_BSSID);
 675         }
 676
 677         mvm->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
 678
 679 #ifdef CONFIG_PM_SLEEP
 680         if ((unified || mvm->fw->img[IWL_UCODE_WOWLAN].num_sec) &&
 681             mvm->trans->ops->d3_suspend &&
 682             mvm->trans->ops->d3_resume &&
 683             device_can_wakeup(mvm->trans->dev)) {
 684                 mvm->wowlan.flags |= WIPHY_WOWLAN_MAGIC_PKT |
 685                                      WIPHY_WOWLAN_DISCONNECT |
 686                                      WIPHY_WOWLAN_EAP_IDENTITY_REQ |
 687                                      WIPHY_WOWLAN_RFKILL_RELEASE |
 688                                      WIPHY_WOWLAN_NET_DETECT;
 689                 if (!iwlwifi_mod_params.swcrypto)
 690                         mvm->wowlan.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY |
 691                                              WIPHY_WOWLAN_GTK_REKEY_FAILURE |
 692                                              WIPHY_WOWLAN_4WAY_HANDSHAKE;
 693
 694                 mvm->wowlan.n_patterns = IWL_WOWLAN_MAX_PATTERNS;
 695                 mvm->wowlan.pattern_min_len = IWL_WOWLAN_MIN_PATTERN_LEN;
 696                 mvm->wowlan.pattern_max_len = IWL_WOWLAN_MAX_PATTERN_LEN;
 697                 mvm->wowlan.max_nd_match_sets = IWL_SCAN_MAX_PROFILES;
 698                 hw->wiphy->wowlan = &mvm->wowlan;
 699         }
 700 #endif
 701
 702 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
 703         /* assign default bcast filtering configuration */
 704         mvm->bcast_filters = iwl_mvm_default_bcast_filters;
 705 #endif
 706
 707         ret = iwl_mvm_leds_init(mvm);
 708         if (ret)
 709                 return ret;
 710
 711         if (fw_has_capa(&mvm->fw->ucode_capa,
 712                         IWL_UCODE_TLV_CAPA_TDLS_SUPPORT)) {
 713                 IWL_DEBUG_TDLS(mvm, "TDLS supported\n");
 714                 hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
 715                 ieee80211_hw_set(hw, TDLS_WIDER_BW);
 716         }
 717
 718         if (fw_has_capa(&mvm->fw->ucode_capa,
 719                         IWL_UCODE_TLV_CAPA_TDLS_CHANNEL_SWITCH)) {
 720                 IWL_DEBUG_TDLS(mvm, "TDLS channel switch supported\n");
 721                 hw->wiphy->features |= NL80211_FEATURE_TDLS_CHANNEL_SWITCH;
 722         }
 723
 724         hw->netdev_features |= mvm->cfg->features;
 725         if (!iwl_mvm_is_csum_supported(mvm)) {
 726                 hw->netdev_features &= ~(IWL_TX_CSUM_NETIF_FLAGS |
 727                                          NETIF_F_RXCSUM);
 728                 /* We may support SW TX CSUM */
 729                 if (IWL_MVM_SW_TX_CSUM_OFFLOAD)
 730                         hw->netdev_features |= IWL_TX_CSUM_NETIF_FLAGS;
 731         }
 732
 733         if (mvm->cfg->vht_mu_mimo_supported)
 734                 wiphy_ext_feature_set(hw->wiphy,
 735                                       NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER);
 736
 737         ret = ieee80211_register_hw(mvm->hw);
 738         if (ret) {
 739                 iwl_mvm_leds_exit(mvm);
 740         }
 741
 742         return ret;
 743 }
 744
 745 static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
 746                            struct ieee80211_tx_control *control,
 747                            struct sk_buff *skb)
 748 {
 749         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 750         struct ieee80211_sta *sta = control->sta;
 751         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 752         struct ieee80211_hdr *hdr = (void *)skb->data;
 753         bool offchannel = IEEE80211_SKB_CB(skb)->flags &
 754                 IEEE80211_TX_CTL_TX_OFFCHAN;
 755
 756         if (iwl_mvm_is_radio_killed(mvm)) {
 757                 IWL_DEBUG_DROP(mvm, "Dropping - RF/CT KILL\n");
 758                 goto drop;
 759         }
 760
 761         if (offchannel &&
 762             !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status) &&
 763             !test_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status))
 764                 goto drop;
 765
 766         /* treat non-bufferable MMPDUs on AP interfaces as broadcast */
 767         if ((info->control.vif->type == NL80211_IFTYPE_AP ||
 768              info->control.vif->type == NL80211_IFTYPE_ADHOC) &&
 769             ieee80211_is_mgmt(hdr->frame_control) &&
 770             !ieee80211_is_bufferable_mmpdu(hdr->frame_control))
 771                 sta = NULL;
 772
 773         /* If there is no sta, and it's not offchannel - send through AP */
 774         if (!sta && info->control.vif->type == NL80211_IFTYPE_STATION &&
 775             !offchannel) {
 776                 struct iwl_mvm_vif *mvmvif =
 777                         iwl_mvm_vif_from_mac80211(info->control.vif);
 778                 u8 ap_sta_id = READ_ONCE(mvmvif->ap_sta_id);
 779
 780                 if (ap_sta_id < IWL_MVM_STATION_COUNT) {
 781                         /* mac80211 holds rcu read lock */
 782                         sta = rcu_dereference(mvm->fw_id_to_mac_id[ap_sta_id]);
 783                         if (IS_ERR_OR_NULL(sta))
 784                                 goto drop;
 785                 }
 786         }
 787
 788         if (sta) {
 789                 if (iwl_mvm_tx_skb(mvm, skb, sta))
 790                         goto drop;
 791                 return;
 792         }
 793
 794         if (iwl_mvm_tx_skb_non_sta(mvm, skb))
 795                 goto drop;
 796         return;
 797  drop:
 798         ieee80211_free_txskb(hw, skb);
 799 }
 800
 801 void iwl_mvm_mac_itxq_xmit(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
 802 {
 803         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 804         struct iwl_mvm_txq *mvmtxq = iwl_mvm_txq_from_mac80211(txq);
 805         struct sk_buff *skb = NULL;
 806
 807         /*
 808          * No need for threads to be pending here, they can leave the first
 809          * taker all the work.
 810          *
 811          * mvmtxq->tx_request logic:
 812          *
 813          * If 0, no one is currently TXing, set to 1 to indicate current thread
 814          * will now start TX and other threads should quit.
 815          *
 816          * If 1, another thread is currently TXing, set to 2 to indicate to
 817          * that thread that there was another request. Since that request may
 818          * have raced with the check whether the queue is empty, the TXing
 819          * thread should check the queue's status one more time before leaving.
 820          * This check is done in order to not leave any TX hanging in the queue
 821          * until the next TX invocation (which may not even happen).
 822          *
 823          * If 2, another thread is currently TXing, and it will already double
 824          * check the queue, so do nothing.
 825          */
 826         if (atomic_fetch_add_unless(&mvmtxq->tx_request, 1, 2))
 827                 return;
 828
 829         rcu_read_lock();
 830         do {
 831                 while (likely(!mvmtxq->stopped &&
 832                               (mvm->trans->system_pm_mode ==
 833                                IWL_PLAT_PM_MODE_DISABLED))) {
 834                         skb = ieee80211_tx_dequeue(hw, txq);
 835
 836                         if (!skb) {
 837                                 if (txq->sta)
 838                                         IWL_DEBUG_TX(mvm,
 839                                                      "TXQ of sta %pM tid %d is now empty\n",
 840                                                      txq->sta->addr,
 841                                                      txq->tid);
 842                                 break;
 843                         }
 844
 845                         if (!txq->sta)
 846                                 iwl_mvm_tx_skb_non_sta(mvm, skb);
 847                         else
 848                                 iwl_mvm_tx_skb(mvm, skb, txq->sta);
 849                 }
 850         } while (atomic_dec_return(&mvmtxq->tx_request));
 851         rcu_read_unlock();
 852 }
 853
 854 static void iwl_mvm_mac_wake_tx_queue(struct ieee80211_hw *hw,
 855                                       struct ieee80211_txq *txq)
 856 {
 857         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 858         struct iwl_mvm_txq *mvmtxq = iwl_mvm_txq_from_mac80211(txq);
 859
 860         /*
 861          * Please note that racing is handled very carefully here:
 862          * mvmtxq->txq_id is updated during allocation, and mvmtxq->list is
 863          * deleted afterwards.
 864          * This means that if:
 865          * mvmtxq->txq_id != INVALID_QUEUE && list_empty(&mvmtxq->list):
 866          *      queue is allocated and we can TX.
 867          * mvmtxq->txq_id != INVALID_QUEUE && !list_empty(&mvmtxq->list):
 868          *      a race, should defer the frame.
 869          * mvmtxq->txq_id == INVALID_QUEUE && list_empty(&mvmtxq->list):
 870          *      need to allocate the queue and defer the frame.
 871          * mvmtxq->txq_id == INVALID_QUEUE && !list_empty(&mvmtxq->list):
 872          *      queue is already scheduled for allocation, no need to allocate,
 873          *      should defer the frame.
 874          */
 875
 876         /* If the queue is allocated TX and return. */
 877         if (!txq->sta || mvmtxq->txq_id != IWL_MVM_INVALID_QUEUE) {
 878                 /*
 879                  * Check that list is empty to avoid a race where txq_id is
 880                  * already updated, but the queue allocation work wasn't
 881                  * finished
 882                  */
 883                 if (unlikely(txq->sta && !list_empty(&mvmtxq->list)))
 884                         return;
 885
 886                 iwl_mvm_mac_itxq_xmit(hw, txq);
 887                 return;
 888         }
 889
 890         /* The list is being deleted only after the queue is fully allocated. */
 891         if (!list_empty(&mvmtxq->list))
 892                 return;
 893
 894         list_add_tail(&mvmtxq->list, &mvm->add_stream_txqs);
 895         schedule_work(&mvm->add_stream_wk);
 896 }
 897
 898 #define CHECK_BA_TRIGGER(_mvm, _trig, _tid_bm, _tid, _fmt...)           \
 899         do {                                                            \
 900                 if (!(le16_to_cpu(_tid_bm) & BIT(_tid)))                \
 901                         break;                                          \
 902                 iwl_fw_dbg_collect_trig(&(_mvm)->fwrt, _trig, _fmt);    \
 903         } while (0)
 904
 905 static void
 906 iwl_mvm_ampdu_check_trigger(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 907                             struct ieee80211_sta *sta, u16 tid, u16 rx_ba_ssn,
 908                             enum ieee80211_ampdu_mlme_action action)
 909 {
 910         struct iwl_fw_dbg_trigger_tlv *trig;
 911         struct iwl_fw_dbg_trigger_ba *ba_trig;
 912
 913         trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
 914                                      FW_DBG_TRIGGER_BA);
 915         if (!trig)
 916                 return;
 917
 918         ba_trig = (void *)trig->data;
 919
 920         switch (action) {
 921         case IEEE80211_AMPDU_TX_OPERATIONAL: {
 922                 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 923                 struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
 924
 925                 CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_start, tid,
 926                                  "TX AGG START: MAC %pM tid %d ssn %d\n",
 927                                  sta->addr, tid, tid_data->ssn);
 928                 break;
 929                 }
 930         case IEEE80211_AMPDU_TX_STOP_CONT:
 931                 CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_stop, tid,
 932                                  "TX AGG STOP: MAC %pM tid %d\n",
 933                                  sta->addr, tid);
 934                 break;
 935         case IEEE80211_AMPDU_RX_START:
 936                 CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_start, tid,
 937                                  "RX AGG START: MAC %pM tid %d ssn %d\n",
 938                                  sta->addr, tid, rx_ba_ssn);
 939                 break;
 940         case IEEE80211_AMPDU_RX_STOP:
 941                 CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_stop, tid,
 942                                  "RX AGG STOP: MAC %pM tid %d\n",
 943                                  sta->addr, tid);
 944                 break;
 945         default:
 946                 break;
 947         }
 948 }
 949
 950 static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
 951                                     struct ieee80211_vif *vif,
 952                                     struct ieee80211_ampdu_params *params)
 953 {
 954         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 955         int ret;
 956         struct ieee80211_sta *sta = params->sta;
 957         enum ieee80211_ampdu_mlme_action action = params->action;
 958         u16 tid = params->tid;
 959         u16 *ssn = &params->ssn;
 960         u16 buf_size = params->buf_size;
 961         bool amsdu = params->amsdu;
 962         u16 timeout = params->timeout;
 963
 964         IWL_DEBUG_HT(mvm, "A-MPDU action on addr %pM tid %d: action %d\n",
 965                      sta->addr, tid, action);
 966
 967         if (!(mvm->nvm_data->sku_cap_11n_enable))
 968                 return -EACCES;
 969
 970         mutex_lock(&mvm->mutex);
 971
 972         switch (action) {
 973         case IEEE80211_AMPDU_RX_START:
 974                 if (iwl_mvm_vif_from_mac80211(vif)->ap_sta_id ==
 975                                 iwl_mvm_sta_from_mac80211(sta)->sta_id) {
 976                         struct iwl_mvm_vif *mvmvif;
 977                         u16 macid = iwl_mvm_vif_from_mac80211(vif)->id;
 978                         struct iwl_mvm_tcm_mac *mdata = &mvm->tcm.data[macid];
 979
 980                         mdata->opened_rx_ba_sessions = true;
 981                         mvmvif = iwl_mvm_vif_from_mac80211(vif);
 982                         cancel_delayed_work(&mvmvif->uapsd_nonagg_detected_wk);
 983                 }
 984                 if (!iwl_enable_rx_ampdu()) {
 985                         ret = -EINVAL;
 986                         break;
 987                 }
 988                 ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, *ssn, true, buf_size,
 989                                          timeout);
 990                 break;
 991         case IEEE80211_AMPDU_RX_STOP:
 992                 ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, 0, false, buf_size,
 993                                          timeout);
 994                 break;
 995         case IEEE80211_AMPDU_TX_START:
 996                 if (!iwl_enable_tx_ampdu()) {
 997                         ret = -EINVAL;
 998                         break;
 999                 }
1000                 ret = iwl_mvm_sta_tx_agg_start(mvm, vif, sta, tid, ssn);
1001                 break;
1002         case IEEE80211_AMPDU_TX_STOP_CONT:
1003                 ret = iwl_mvm_sta_tx_agg_stop(mvm, vif, sta, tid);
1004                 break;
1005         case IEEE80211_AMPDU_TX_STOP_FLUSH:
1006         case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
1007                 ret = iwl_mvm_sta_tx_agg_flush(mvm, vif, sta, tid);
1008                 break;
1009         case IEEE80211_AMPDU_TX_OPERATIONAL:
1010                 ret = iwl_mvm_sta_tx_agg_oper(mvm, vif, sta, tid,
1011                                               buf_size, amsdu);
1012                 break;
1013         default:
1014                 WARN_ON_ONCE(1);
1015                 ret = -EINVAL;
1016                 break;
1017         }
1018
1019         if (!ret) {
1020                 u16 rx_ba_ssn = 0;
1021
1022                 if (action == IEEE80211_AMPDU_RX_START)
1023                         rx_ba_ssn = *ssn;
1024
1025                 iwl_mvm_ampdu_check_trigger(mvm, vif, sta, tid,
1026                                             rx_ba_ssn, action);
1027         }
1028         mutex_unlock(&mvm->mutex);
1029
1030         return ret;
1031 }
1032
1033 static void iwl_mvm_cleanup_iterator(void *data, u8 *mac,
1034                                      struct ieee80211_vif *vif)
1035 {
1036         struct iwl_mvm *mvm = data;
1037         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1038
1039         mvmvif->uploaded = false;
1040         mvmvif->ap_sta_id = IWL_MVM_INVALID_STA;
1041
1042         spin_lock_bh(&mvm->time_event_lock);
1043         iwl_mvm_te_clear_data(mvm, &mvmvif->time_event_data);
1044         spin_unlock_bh(&mvm->time_event_lock);
1045
1046         mvmvif->phy_ctxt = NULL;
1047         memset(&mvmvif->bf_data, 0, sizeof(mvmvif->bf_data));
1048         memset(&mvmvif->probe_resp_data, 0, sizeof(mvmvif->probe_resp_data));
1049 }
1050
1051 static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
1052 {
1053         iwl_mvm_stop_device(mvm);
1054
1055         mvm->cur_aid = 0;
1056
1057         mvm->scan_status = 0;
1058         mvm->ps_disabled = false;
1059         mvm->rfkill_safe_init_done = false;
1060
1061         /* just in case one was running */
1062         iwl_mvm_cleanup_roc_te(mvm);
1063         ieee80211_remain_on_channel_expired(mvm->hw);
1064
1065         iwl_mvm_ftm_restart(mvm);
1066
1067         /*
1068          * cleanup all interfaces, even inactive ones, as some might have
1069          * gone down during the HW restart
1070          */
1071         ieee80211_iterate_interfaces(mvm->hw, 0, iwl_mvm_cleanup_iterator, mvm);
1072
1073         mvm->p2p_device_vif = NULL;
1074
1075         iwl_mvm_reset_phy_ctxts(mvm);
1076         memset(mvm->fw_key_table, 0, sizeof(mvm->fw_key_table));
1077         memset(&mvm->last_bt_notif, 0, sizeof(mvm->last_bt_notif));
1078         memset(&mvm->last_bt_ci_cmd, 0, sizeof(mvm->last_bt_ci_cmd));
1079
1080         ieee80211_wake_queues(mvm->hw);
1081
1082         mvm->vif_count = 0;
1083         mvm->rx_ba_sessions = 0;
1084         mvm->fwrt.dump.conf = FW_DBG_INVALID;
1085         mvm->monitor_on = false;
1086
1087         /* keep statistics ticking */
1088         iwl_mvm_accu_radio_stats(mvm);
1089 }
1090
1091 int __iwl_mvm_mac_start(struct iwl_mvm *mvm)
1092 {
1093         int ret;
1094
1095         lockdep_assert_held(&mvm->mutex);
1096
1097         if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status)) {
1098                 /*
1099                  * Now convert the HW_RESTART_REQUESTED flag to IN_HW_RESTART
1100                  * so later code will - from now on - see that we're doing it.
1101                  */
1102                 set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1103                 clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status);
1104                 /* Clean up some internal and mac80211 state on restart */
1105                 iwl_mvm_restart_cleanup(mvm);
1106         }
1107         ret = iwl_mvm_up(mvm);
1108
1109         iwl_dbg_tlv_time_point(&mvm->fwrt, IWL_FW_INI_TIME_POINT_POST_INIT,
1110                                NULL);
1111         iwl_dbg_tlv_time_point(&mvm->fwrt, IWL_FW_INI_TIME_POINT_PERIODIC,
1112                                NULL);
1113
1114         if (ret && test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
1115                 /* Something went wrong - we need to finish some cleanup
1116                  * that normally iwl_mvm_mac_restart_complete() below
1117                  * would do.
1118                  */
1119                 clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1120         }
1121
1122         return ret;
1123 }
1124
1125 static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
1126 {
1127         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1128         int ret;
1129
1130         mutex_lock(&mvm->mutex);
1131         ret = __iwl_mvm_mac_start(mvm);
1132         mutex_unlock(&mvm->mutex);
1133
1134         return ret;
1135 }
1136
1137 static void iwl_mvm_restart_complete(struct iwl_mvm *mvm)
1138 {
1139         int ret;
1140
1141         mutex_lock(&mvm->mutex);
1142
1143         clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1144
1145         ret = iwl_mvm_update_quotas(mvm, true, NULL);
1146         if (ret)
1147                 IWL_ERR(mvm, "Failed to update quotas after restart (%d)\n",
1148                         ret);
1149
1150         iwl_mvm_send_recovery_cmd(mvm, ERROR_RECOVERY_END_OF_RECOVERY);
1151
1152         /*
1153          * If we have TDLS peers, remove them. We don't know the last seqno/PN
1154          * of packets the FW sent out, so we must reconnect.
1155          */
1156         iwl_mvm_teardown_tdls_peers(mvm);
1157
1158         mutex_unlock(&mvm->mutex);
1159 }
1160
1161 static void
1162 iwl_mvm_mac_reconfig_complete(struct ieee80211_hw *hw,
1163                               enum ieee80211_reconfig_type reconfig_type)
1164 {
1165         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1166
1167         switch (reconfig_type) {
1168         case IEEE80211_RECONFIG_TYPE_RESTART:
1169                 iwl_mvm_restart_complete(mvm);
1170                 break;
1171         case IEEE80211_RECONFIG_TYPE_SUSPEND:
1172                 break;
1173         }
1174 }
1175
1176 void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
1177 {
1178         lockdep_assert_held(&mvm->mutex);
1179
1180         /* firmware counters are obviously reset now, but we shouldn't
1181          * partially track so also clear the fw_reset_accu counters.
1182          */
1183         memset(&mvm->accu_radio_stats, 0, sizeof(mvm->accu_radio_stats));
1184
1185         /* async_handlers_wk is now blocked */
1186
1187         /*
1188          * The work item could be running or queued if the
1189          * ROC time event stops just as we get here.
1190          */
1191         flush_work(&mvm->roc_done_wk);
1192
1193         iwl_mvm_stop_device(mvm);
1194
1195         iwl_mvm_async_handlers_purge(mvm);
1196         /* async_handlers_list is empty and will stay empty: HW is stopped */
1197
1198         /* the fw is stopped, the aux sta is dead: clean up driver state */
1199         iwl_mvm_del_aux_sta(mvm);
1200
1201         /*
1202          * Clear IN_HW_RESTART and HW_RESTART_REQUESTED flag when stopping the
1203          * hw (as restart_complete() won't be called in this case) and mac80211
1204          * won't execute the restart.
1205          * But make sure to cleanup interfaces that have gone down before/during
1206          * HW restart was requested.
1207          */
1208         if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) ||
1209             test_and_clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
1210                                &mvm->status))
1211                 ieee80211_iterate_interfaces(mvm->hw, 0,
1212                                              iwl_mvm_cleanup_iterator, mvm);
1213
1214         /* We shouldn't have any UIDs still set.  Loop over all the UIDs to
1215          * make sure there's nothing left there and warn if any is found.
1216          */
1217         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1218                 int i;
1219
1220                 for (i = 0; i < mvm->max_scans; i++) {
1221                         if (WARN_ONCE(mvm->scan_uid_status[i],
1222                                       "UMAC scan UID %d status was not cleaned\n",
1223                                       i))
1224                                 mvm->scan_uid_status[i] = 0;
1225                 }
1226         }
1227 }
1228
1229 static void iwl_mvm_mac_stop(struct ieee80211_hw *hw)
1230 {
1231         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1232
1233         flush_work(&mvm->async_handlers_wk);
1234         flush_work(&mvm->add_stream_wk);
1235
1236         /*
1237          * Lock and clear the firmware running bit here already, so that
1238          * new commands coming in elsewhere, e.g. from debugfs, will not
1239          * be able to proceed. This is important here because one of those
1240          * debugfs files causes the firmware dump to be triggered, and if we
1241          * don't stop debugfs accesses before canceling that it could be
1242          * retriggered after we flush it but before we've cleared the bit.
1243          */
1244         clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status);
1245
1246         cancel_delayed_work_sync(&mvm->cs_tx_unblock_dwork);
1247         cancel_delayed_work_sync(&mvm->scan_timeout_dwork);
1248         iwl_fw_free_dump_desc(&mvm->fwrt);
1249
1250         mutex_lock(&mvm->mutex);
1251         __iwl_mvm_mac_stop(mvm);
1252         mutex_unlock(&mvm->mutex);
1253
1254         /*
1255          * The worker might have been waiting for the mutex, let it run and
1256          * discover that its list is now empty.
1257          */
1258         cancel_work_sync(&mvm->async_handlers_wk);
1259 }
1260
1261 static struct iwl_mvm_phy_ctxt *iwl_mvm_get_free_phy_ctxt(struct iwl_mvm *mvm)
1262 {
1263         u16 i;
1264
1265         lockdep_assert_held(&mvm->mutex);
1266
1267         for (i = 0; i < NUM_PHY_CTX; i++)
1268                 if (!mvm->phy_ctxts[i].ref)
1269                         return &mvm->phy_ctxts[i];
1270
1271         IWL_ERR(mvm, "No available PHY context\n");
1272         return NULL;
1273 }
1274
1275 static int iwl_mvm_set_tx_power(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1276                                 s16 tx_power)
1277 {
1278         int len;
1279         union {
1280                 struct iwl_dev_tx_power_cmd v5;
1281                 struct iwl_dev_tx_power_cmd_v4 v4;
1282         } cmd = {
1283                 .v5.v3.set_mode = cpu_to_le32(IWL_TX_POWER_MODE_SET_MAC),
1284                 .v5.v3.mac_context_id =
1285                         cpu_to_le32(iwl_mvm_vif_from_mac80211(vif)->id),
1286                 .v5.v3.pwr_restriction = cpu_to_le16(8 * tx_power),
1287         };
1288
1289         if (tx_power == IWL_DEFAULT_MAX_TX_POWER)
1290                 cmd.v5.v3.pwr_restriction = cpu_to_le16(IWL_DEV_MAX_TX_POWER);
1291
1292         if (fw_has_api(&mvm->fw->ucode_capa,
1293                        IWL_UCODE_TLV_API_REDUCE_TX_POWER))
1294                 len = sizeof(cmd.v5);
1295         else if (fw_has_capa(&mvm->fw->ucode_capa,
1296                              IWL_UCODE_TLV_CAPA_TX_POWER_ACK))
1297                 len = sizeof(cmd.v4);
1298         else
1299                 len = sizeof(cmd.v4.v3);
1300
1301         return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, 0, len, &cmd);
1302 }
1303
1304 static int iwl_mvm_post_channel_switch(struct ieee80211_hw *hw,
1305                                        struct ieee80211_vif *vif)
1306 {
1307         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1308         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1309         int ret;
1310
1311         mutex_lock(&mvm->mutex);
1312
1313         if (mvmvif->csa_failed) {
1314                 mvmvif->csa_failed = false;
1315                 ret = -EIO;
1316                 goto out_unlock;
1317         }
1318
1319         if (vif->type == NL80211_IFTYPE_STATION) {
1320                 struct iwl_mvm_sta *mvmsta;
1321
1322                 mvmvif->csa_bcn_pending = false;
1323                 mvmsta = iwl_mvm_sta_from_staid_protected(mvm,
1324                                                           mvmvif->ap_sta_id);
1325
1326                 if (WARN_ON(!mvmsta)) {
1327                         ret = -EIO;
1328                         goto out_unlock;
1329                 }
1330
1331                 if (!fw_has_capa(&mvm->fw->ucode_capa,
1332                                  IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD))
1333                         iwl_mvm_sta_modify_disable_tx(mvm, mvmsta, false);
1334
1335                 iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
1336
1337                 if (!fw_has_capa(&mvm->fw->ucode_capa,
1338                                  IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
1339                         ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
1340                         if (ret)
1341                                 goto out_unlock;
1342
1343                         iwl_mvm_stop_session_protection(mvm, vif);
1344                 }
1345         }
1346
1347         mvmvif->ps_disabled = false;
1348
1349         ret = iwl_mvm_power_update_ps(mvm);
1350
1351 out_unlock:
1352         mutex_unlock(&mvm->mutex);
1353
1354         return ret;
1355 }
1356
1357 static void iwl_mvm_abort_channel_switch(struct ieee80211_hw *hw,
1358                                          struct ieee80211_vif *vif)
1359 {
1360         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1361         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1362         struct iwl_chan_switch_te_cmd cmd = {
1363                 .mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
1364                                                           mvmvif->color)),
1365                 .action = cpu_to_le32(FW_CTXT_ACTION_REMOVE),
1366         };
1367
1368         IWL_DEBUG_MAC80211(mvm, "Abort CSA on mac %d\n", mvmvif->id);
1369
1370         mutex_lock(&mvm->mutex);
1371         WARN_ON(iwl_mvm_send_cmd_pdu(mvm,
1372                                      WIDE_ID(MAC_CONF_GROUP,
1373                                              CHANNEL_SWITCH_TIME_EVENT_CMD),
1374                                      0, sizeof(cmd), &cmd));
1375         mutex_unlock(&mvm->mutex);
1376
1377         WARN_ON(iwl_mvm_post_channel_switch(hw, vif));
1378 }
1379
1380 static void iwl_mvm_channel_switch_disconnect_wk(struct work_struct *wk)
1381 {
1382         struct iwl_mvm *mvm;
1383         struct iwl_mvm_vif *mvmvif;
1384         struct ieee80211_vif *vif;
1385
1386         mvmvif = container_of(wk, struct iwl_mvm_vif, csa_work.work);
1387         vif = container_of((void *)mvmvif, struct ieee80211_vif, drv_priv);
1388         mvm = mvmvif->mvm;
1389
1390         iwl_mvm_abort_channel_switch(mvm->hw, vif);
1391         ieee80211_chswitch_done(vif, false);
1392 }
1393
1394 static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
1395                                      struct ieee80211_vif *vif)
1396 {
1397         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1398         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1399         int ret;
1400
1401         mvmvif->mvm = mvm;
1402         RCU_INIT_POINTER(mvmvif->probe_resp_data, NULL);
1403
1404         /*
1405          * Not much to do here. The stack will not allow interface
1406          * types or combinations that we didn't advertise, so we
1407          * don't really have to check the types.
1408          */
1409
1410         mutex_lock(&mvm->mutex);
1411
1412         /* make sure that beacon statistics don't go backwards with FW reset */
1413         if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
1414                 mvmvif->beacon_stats.accu_num_beacons +=
1415                         mvmvif->beacon_stats.num_beacons;
1416
1417         /* Allocate resources for the MAC context, and add it to the fw  */
1418         ret = iwl_mvm_mac_ctxt_init(mvm, vif);
1419         if (ret)
1420                 goto out_unlock;
1421
1422         rcu_assign_pointer(mvm->vif_id_to_mac[mvmvif->id], vif);
1423
1424         /* Counting number of interfaces is needed for legacy PM */
1425         if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1426                 mvm->vif_count++;
1427
1428         /*
1429          * The AP binding flow can be done only after the beacon
1430          * template is configured (which happens only in the mac80211
1431          * start_ap() flow), and adding the broadcast station can happen
1432          * only after the binding.
1433          * In addition, since modifying the MAC before adding a bcast
1434          * station is not allowed by the FW, delay the adding of MAC context to
1435          * the point where we can also add the bcast station.
1436          * In short: there's not much we can do at this point, other than
1437          * allocating resources :)
1438          */
1439         if (vif->type == NL80211_IFTYPE_AP ||
1440             vif->type == NL80211_IFTYPE_ADHOC) {
1441                 ret = iwl_mvm_alloc_bcast_sta(mvm, vif);
1442                 if (ret) {
1443                         IWL_ERR(mvm, "Failed to allocate bcast sta\n");
1444                         goto out_release;
1445                 }
1446
1447                 /*
1448                  * Only queue for this station is the mcast queue,
1449                  * which shouldn't be in TFD mask anyway
1450                  */
1451                 ret = iwl_mvm_allocate_int_sta(mvm, &mvmvif->mcast_sta,
1452                                                0, vif->type,
1453                                                IWL_STA_MULTICAST);
1454                 if (ret)
1455                         goto out_release;
1456
1457                 iwl_mvm_vif_dbgfs_register(mvm, vif);
1458                 goto out_unlock;
1459         }
1460
1461         mvmvif->features |= hw->netdev_features;
1462
1463         ret = iwl_mvm_mac_ctxt_add(mvm, vif);
1464         if (ret)
1465                 goto out_release;
1466
1467         ret = iwl_mvm_power_update_mac(mvm);
1468         if (ret)
1469                 goto out_remove_mac;
1470
1471         /* beacon filtering */
1472         ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
1473         if (ret)
1474                 goto out_remove_mac;
1475
1476         if (!mvm->bf_allowed_vif &&
1477             vif->type == NL80211_IFTYPE_STATION && !vif->p2p) {
1478                 mvm->bf_allowed_vif = mvmvif;
1479                 vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
1480                                      IEEE80211_VIF_SUPPORTS_CQM_RSSI;
1481         }
1482
1483         /*
1484          * P2P_DEVICE interface does not have a channel context assigned to it,
1485          * so a dedicated PHY context is allocated to it and the corresponding
1486          * MAC context is bound to it at this stage.
1487          */
1488         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1489
1490                 mvmvif->phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
1491                 if (!mvmvif->phy_ctxt) {
1492                         ret = -ENOSPC;
1493                         goto out_free_bf;
1494                 }
1495
1496                 iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
1497                 ret = iwl_mvm_binding_add_vif(mvm, vif);
1498                 if (ret)
1499                         goto out_unref_phy;
1500
1501                 ret = iwl_mvm_add_p2p_bcast_sta(mvm, vif);
1502                 if (ret)
1503                         goto out_unbind;
1504
1505                 /* Save a pointer to p2p device vif, so it can later be used to
1506                  * update the p2p device MAC when a GO is started/stopped */
1507                 mvm->p2p_device_vif = vif;
1508         }
1509
1510         iwl_mvm_tcm_add_vif(mvm, vif);
1511         INIT_DELAYED_WORK(&mvmvif->csa_work,
1512                           iwl_mvm_channel_switch_disconnect_wk);
1513
1514         if (vif->type == NL80211_IFTYPE_MONITOR)
1515                 mvm->monitor_on = true;
1516
1517         iwl_mvm_vif_dbgfs_register(mvm, vif);
1518         goto out_unlock;
1519
1520  out_unbind:
1521         iwl_mvm_binding_remove_vif(mvm, vif);
1522  out_unref_phy:
1523         iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1524  out_free_bf:
1525         if (mvm->bf_allowed_vif == mvmvif) {
1526                 mvm->bf_allowed_vif = NULL;
1527                 vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1528                                        IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1529         }
1530  out_remove_mac:
1531         mvmvif->phy_ctxt = NULL;
1532         iwl_mvm_mac_ctxt_remove(mvm, vif);
1533  out_release:
1534         if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1535                 mvm->vif_count--;
1536  out_unlock:
1537         mutex_unlock(&mvm->mutex);
1538
1539         return ret;
1540 }
1541
1542 static void iwl_mvm_prepare_mac_removal(struct iwl_mvm *mvm,
1543                                         struct ieee80211_vif *vif)
1544 {
1545         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1546                 /*
1547                  * Flush the ROC worker which will flush the OFFCHANNEL queue.
1548                  * We assume here that all the packets sent to the OFFCHANNEL
1549                  * queue are sent in ROC session.
1550                  */
1551                 flush_work(&mvm->roc_done_wk);
1552         }
1553 }
1554
1555 static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
1556                                          struct ieee80211_vif *vif)
1557 {
1558         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1559         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1560         struct iwl_probe_resp_data *probe_data;
1561
1562         iwl_mvm_prepare_mac_removal(mvm, vif);
1563
1564         if (!(vif->type == NL80211_IFTYPE_AP ||
1565               vif->type == NL80211_IFTYPE_ADHOC))
1566                 iwl_mvm_tcm_rm_vif(mvm, vif);
1567
1568         mutex_lock(&mvm->mutex);
1569
1570         probe_data = rcu_dereference_protected(mvmvif->probe_resp_data,
1571                                                lockdep_is_held(&mvm->mutex));
1572         RCU_INIT_POINTER(mvmvif->probe_resp_data, NULL);
1573         if (probe_data)
1574                 kfree_rcu(probe_data, rcu_head);
1575
1576         if (mvm->bf_allowed_vif == mvmvif) {
1577                 mvm->bf_allowed_vif = NULL;
1578                 vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1579                                        IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1580         }
1581
1582         if (vif->bss_conf.ftm_responder)
1583                 memset(&mvm->ftm_resp_stats, 0, sizeof(mvm->ftm_resp_stats));
1584
1585         iwl_mvm_vif_dbgfs_clean(mvm, vif);
1586
1587         /*
1588          * For AP/GO interface, the tear down of the resources allocated to the
1589          * interface is be handled as part of the stop_ap flow.
1590          */
1591         if (vif->type == NL80211_IFTYPE_AP ||
1592             vif->type == NL80211_IFTYPE_ADHOC) {
1593 #ifdef CONFIG_NL80211_TESTMODE
1594                 if (vif == mvm->noa_vif) {
1595                         mvm->noa_vif = NULL;
1596                         mvm->noa_duration = 0;
1597                 }
1598 #endif
1599                 iwl_mvm_dealloc_int_sta(mvm, &mvmvif->mcast_sta);
1600                 iwl_mvm_dealloc_bcast_sta(mvm, vif);
1601                 goto out_release;
1602         }
1603
1604         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1605                 mvm->p2p_device_vif = NULL;
1606                 iwl_mvm_rm_p2p_bcast_sta(mvm, vif);
1607                 iwl_mvm_binding_remove_vif(mvm, vif);
1608                 iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1609                 mvmvif->phy_ctxt = NULL;
1610         }
1611
1612         if (mvm->vif_count && vif->type != NL80211_IFTYPE_P2P_DEVICE)
1613                 mvm->vif_count--;
1614
1615         iwl_mvm_power_update_mac(mvm);
1616         iwl_mvm_mac_ctxt_remove(mvm, vif);
1617
1618         RCU_INIT_POINTER(mvm->vif_id_to_mac[mvmvif->id], NULL);
1619
1620         if (vif->type == NL80211_IFTYPE_MONITOR)
1621                 mvm->monitor_on = false;
1622
1623 out_release:
1624         mutex_unlock(&mvm->mutex);
1625 }
1626
1627 static int iwl_mvm_mac_config(struct ieee80211_hw *hw, u32 changed)
1628 {
1629         return 0;
1630 }
1631
1632 struct iwl_mvm_mc_iter_data {
1633         struct iwl_mvm *mvm;
1634         int port_id;
1635 };
1636
1637 static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
1638                                       struct ieee80211_vif *vif)
1639 {
1640         struct iwl_mvm_mc_iter_data *data = _data;
1641         struct iwl_mvm *mvm = data->mvm;
1642         struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd;
1643         struct iwl_host_cmd hcmd = {
1644                 .id = MCAST_FILTER_CMD,
1645                 .flags = CMD_ASYNC,
1646                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
1647         };
1648         int ret, len;
1649
1650         /* if we don't have free ports, mcast frames will be dropped */
1651         if (WARN_ON_ONCE(data->port_id >= MAX_PORT_ID_NUM))
1652                 return;
1653
1654         if (vif->type != NL80211_IFTYPE_STATION ||
1655             !vif->bss_conf.assoc)
1656                 return;
1657
1658         cmd->port_id = data->port_id++;
1659         memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
1660         len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4);
1661
1662         hcmd.len[0] = len;
1663         hcmd.data[0] = cmd;
1664
1665         ret = iwl_mvm_send_cmd(mvm, &hcmd);
1666         if (ret)
1667                 IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret);
1668 }
1669
1670 static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm)
1671 {
1672         struct iwl_mvm_mc_iter_data iter_data = {
1673                 .mvm = mvm,
1674         };
1675
1676         lockdep_assert_held(&mvm->mutex);
1677
1678         if (WARN_ON_ONCE(!mvm->mcast_filter_cmd))
1679                 return;
1680
1681         ieee80211_iterate_active_interfaces_atomic(
1682                 mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1683                 iwl_mvm_mc_iface_iterator, &iter_data);
1684 }
1685
1686 static u64 iwl_mvm_prepare_multicast(struct ieee80211_hw *hw,
1687                                      struct netdev_hw_addr_list *mc_list)
1688 {
1689         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1690         struct iwl_mcast_filter_cmd *cmd;
1691         struct netdev_hw_addr *addr;
1692         int addr_count;
1693         bool pass_all;
1694         int len;
1695
1696         addr_count = netdev_hw_addr_list_count(mc_list);
1697         pass_all = addr_count > MAX_MCAST_FILTERING_ADDRESSES ||
1698                    IWL_MVM_FW_MCAST_FILTER_PASS_ALL;
1699         if (pass_all)
1700                 addr_count = 0;
1701
1702         len = roundup(sizeof(*cmd) + addr_count * ETH_ALEN, 4);
1703         cmd = kzalloc(len, GFP_ATOMIC);
1704         if (!cmd)
1705                 return 0;
1706
1707         if (pass_all) {
1708                 cmd->pass_all = 1;
1709                 return (u64)(unsigned long)cmd;
1710         }
1711
1712         netdev_hw_addr_list_for_each(addr, mc_list) {
1713                 IWL_DEBUG_MAC80211(mvm, "mcast addr (%d): %pM\n",
1714                                    cmd->count, addr->addr);
1715                 memcpy(&cmd->addr_list[cmd->count * ETH_ALEN],
1716                        addr->addr, ETH_ALEN);
1717                 cmd->count++;
1718         }
1719
1720         return (u64)(unsigned long)cmd;
1721 }
1722
1723 static void iwl_mvm_configure_filter(struct ieee80211_hw *hw,
1724                                      unsigned int changed_flags,
1725                                      unsigned int *total_flags,
1726                                      u64 multicast)
1727 {
1728         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1729         struct iwl_mcast_filter_cmd *cmd = (void *)(unsigned long)multicast;
1730
1731         mutex_lock(&mvm->mutex);
1732
1733         /* replace previous configuration */
1734         kfree(mvm->mcast_filter_cmd);
1735         mvm->mcast_filter_cmd = cmd;
1736
1737         if (!cmd)
1738                 goto out;
1739
1740         if (changed_flags & FIF_ALLMULTI)
1741                 cmd->pass_all = !!(*total_flags & FIF_ALLMULTI);
1742
1743         if (cmd->pass_all)
1744                 cmd->count = 0;
1745
1746         iwl_mvm_recalc_multicast(mvm);
1747 out:
1748         mutex_unlock(&mvm->mutex);
1749         *total_flags = 0;
1750 }
1751
1752 static void iwl_mvm_config_iface_filter(struct ieee80211_hw *hw,
1753                                         struct ieee80211_vif *vif,
1754                                         unsigned int filter_flags,
1755                                         unsigned int changed_flags)
1756 {
1757         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1758
1759         /* We support only filter for probe requests */
1760         if (!(changed_flags & FIF_PROBE_REQ))
1761                 return;
1762
1763         /* Supported only for p2p client interfaces */
1764         if (vif->type != NL80211_IFTYPE_STATION || !vif->bss_conf.assoc ||
1765             !vif->p2p)
1766                 return;
1767
1768         mutex_lock(&mvm->mutex);
1769         iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
1770         mutex_unlock(&mvm->mutex);
1771 }
1772
1773 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
1774 struct iwl_bcast_iter_data {
1775         struct iwl_mvm *mvm;
1776         struct iwl_bcast_filter_cmd *cmd;
1777         u8 current_filter;
1778 };
1779
1780 static void
1781 iwl_mvm_set_bcast_filter(struct ieee80211_vif *vif,
1782                          const struct iwl_fw_bcast_filter *in_filter,
1783                          struct iwl_fw_bcast_filter *out_filter)
1784 {
1785         struct iwl_fw_bcast_filter_attr *attr;
1786         int i;
1787
1788         memcpy(out_filter, in_filter, sizeof(*out_filter));
1789
1790         for (i = 0; i < ARRAY_SIZE(out_filter->attrs); i++) {
1791                 attr = &out_filter->attrs[i];
1792
1793                 if (!attr->mask)
1794                         break;
1795
1796                 switch (attr->reserved1) {
1797                 case cpu_to_le16(BC_FILTER_MAGIC_IP):
1798                         if (vif->bss_conf.arp_addr_cnt != 1) {
1799                                 attr->mask = 0;
1800                                 continue;
1801                         }
1802
1803                         attr->val = vif->bss_conf.arp_addr_list[0];
1804                         break;
1805                 case cpu_to_le16(BC_FILTER_MAGIC_MAC):
1806                         attr->val = *(__be32 *)&vif->addr[2];
1807                         break;
1808                 default:
1809                         break;
1810                 }
1811                 attr->reserved1 = 0;
1812                 out_filter->num_attrs++;
1813         }
1814 }
1815
1816 static void iwl_mvm_bcast_filter_iterator(void *_data, u8 *mac,
1817                                           struct ieee80211_vif *vif)
1818 {
1819         struct iwl_bcast_iter_data *data = _data;
1820         struct iwl_mvm *mvm = data->mvm;
1821         struct iwl_bcast_filter_cmd *cmd = data->cmd;
1822         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1823         struct iwl_fw_bcast_mac *bcast_mac;
1824         int i;
1825
1826         if (WARN_ON(mvmvif->id >= ARRAY_SIZE(cmd->macs)))
1827                 return;
1828
1829         bcast_mac = &cmd->macs[mvmvif->id];
1830
1831         /*
1832          * enable filtering only for associated stations, but not for P2P
1833          * Clients
1834          */
1835         if (vif->type != NL80211_IFTYPE_STATION || vif->p2p ||
1836             !vif->bss_conf.assoc)
1837                 return;
1838
1839         bcast_mac->default_discard = 1;
1840
1841         /* copy all configured filters */
1842         for (i = 0; mvm->bcast_filters[i].attrs[0].mask; i++) {
1843                 /*
1844                  * Make sure we don't exceed our filters limit.
1845                  * if there is still a valid filter to be configured,
1846                  * be on the safe side and just allow bcast for this mac.
1847                  */
1848                 if (WARN_ON_ONCE(data->current_filter >=
1849                                  ARRAY_SIZE(cmd->filters))) {
1850                         bcast_mac->default_discard = 0;
1851                         bcast_mac->attached_filters = 0;
1852                         break;
1853                 }
1854
1855                 iwl_mvm_set_bcast_filter(vif,
1856                                          &mvm->bcast_filters[i],
1857                                          &cmd->filters[data->current_filter]);
1858
1859                 /* skip current filter if it contains no attributes */
1860                 if (!cmd->filters[data->current_filter].num_attrs)
1861                         continue;
1862
1863                 /* attach the filter to current mac */
1864                 bcast_mac->attached_filters |=
1865                                 cpu_to_le16(BIT(data->current_filter));
1866
1867                 data->current_filter++;
1868         }
1869 }
1870
1871 bool iwl_mvm_bcast_filter_build_cmd(struct iwl_mvm *mvm,
1872                                     struct iwl_bcast_filter_cmd *cmd)
1873 {
1874         struct iwl_bcast_iter_data iter_data = {
1875                 .mvm = mvm,
1876                 .cmd = cmd,
1877         };
1878
1879         if (IWL_MVM_FW_BCAST_FILTER_PASS_ALL)
1880                 return false;
1881
1882         memset(cmd, 0, sizeof(*cmd));
1883         cmd->max_bcast_filters = ARRAY_SIZE(cmd->filters);
1884         cmd->max_macs = ARRAY_SIZE(cmd->macs);
1885
1886 #ifdef CONFIG_IWLWIFI_DEBUGFS
1887         /* use debugfs filters/macs if override is configured */
1888         if (mvm->dbgfs_bcast_filtering.override) {
1889                 memcpy(cmd->filters, &mvm->dbgfs_bcast_filtering.cmd.filters,
1890                        sizeof(cmd->filters));
1891                 memcpy(cmd->macs, &mvm->dbgfs_bcast_filtering.cmd.macs,
1892                        sizeof(cmd->macs));
1893                 return true;
1894         }
1895 #endif
1896
1897         /* if no filters are configured, do nothing */
1898         if (!mvm->bcast_filters)
1899                 return false;
1900
1901         /* configure and attach these filters for each associated sta vif */
1902         ieee80211_iterate_active_interfaces(
1903                 mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1904                 iwl_mvm_bcast_filter_iterator, &iter_data);
1905
1906         return true;
1907 }
1908
1909 static int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
1910 {
1911         struct iwl_bcast_filter_cmd cmd;
1912
1913         if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BCAST_FILTERING))
1914                 return 0;
1915
1916         if (!iwl_mvm_bcast_filter_build_cmd(mvm, &cmd))
1917                 return 0;
1918
1919         return iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, 0,
1920                                     sizeof(cmd), &cmd);
1921 }
1922 #else
1923 static inline int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
1924 {
1925         return 0;
1926 }
1927 #endif
1928
1929 static int iwl_mvm_update_mu_groups(struct iwl_mvm *mvm,
1930                                     struct ieee80211_vif *vif)
1931 {
1932         struct iwl_mu_group_mgmt_cmd cmd = {};
1933
1934         memcpy(cmd.membership_status, vif->bss_conf.mu_group.membership,
1935                WLAN_MEMBERSHIP_LEN);
1936         memcpy(cmd.user_position, vif->bss_conf.mu_group.position,
1937                WLAN_USER_POSITION_LEN);
1938
1939         return iwl_mvm_send_cmd_pdu(mvm,
1940                                     WIDE_ID(DATA_PATH_GROUP,
1941                                             UPDATE_MU_GROUPS_CMD),
1942                                     0, sizeof(cmd), &cmd);
1943 }
1944
1945 static void iwl_mvm_mu_mimo_iface_iterator(void *_data, u8 *mac,
1946                                            struct ieee80211_vif *vif)
1947 {
1948         if (vif->mu_mimo_owner) {
1949                 struct iwl_mu_group_mgmt_notif *notif = _data;
1950
1951                 /*
1952                  * MU-MIMO Group Id action frame is little endian. We treat
1953                  * the data received from firmware as if it came from the
1954                  * action frame, so no conversion is needed.
1955                  */
1956                 ieee80211_update_mu_groups(vif,
1957                                            (u8 *)&notif->membership_status,
1958                                            (u8 *)&notif->user_position);
1959         }
1960 }
1961
1962 void iwl_mvm_mu_mimo_grp_notif(struct iwl_mvm *mvm,
1963                                struct iwl_rx_cmd_buffer *rxb)
1964 {
1965         struct iwl_rx_packet *pkt = rxb_addr(rxb);
1966         struct iwl_mu_group_mgmt_notif *notif = (void *)pkt->data;
1967
1968         ieee80211_iterate_active_interfaces_atomic(
1969                         mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1970                         iwl_mvm_mu_mimo_iface_iterator, notif);
1971 }
1972
1973 static u8 iwl_mvm_he_get_ppe_val(u8 *ppe, u8 ppe_pos_bit)
1974 {
1975         u8 byte_num = ppe_pos_bit / 8;
1976         u8 bit_num = ppe_pos_bit % 8;
1977         u8 residue_bits;
1978         u8 res;
1979
1980         if (bit_num <= 5)
1981                 return (ppe[byte_num] >> bit_num) &
1982                        (BIT(IEEE80211_PPE_THRES_INFO_PPET_SIZE) - 1);
1983
1984         /*
1985          * If bit_num > 5, we have to combine bits with next byte.
1986          * Calculate how many bits we need to take from current byte (called
1987          * here "residue_bits"), and add them to bits from next byte.
1988          */
1989
1990         residue_bits = 8 - bit_num;
1991
1992         res = (ppe[byte_num + 1] &
1993                (BIT(IEEE80211_PPE_THRES_INFO_PPET_SIZE - residue_bits) - 1)) <<
1994               residue_bits;
1995         res += (ppe[byte_num] >> bit_num) & (BIT(residue_bits) - 1);
1996
1997         return res;
1998 }
1999
2000 static void iwl_mvm_cfg_he_sta(struct iwl_mvm *mvm,
2001                                struct ieee80211_vif *vif, u8 sta_id)
2002 {
2003         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2004         struct iwl_he_sta_context_cmd sta_ctxt_cmd = {
2005                 .sta_id = sta_id,
2006                 .tid_limit = IWL_MAX_TID_COUNT,
2007                 .bss_color = vif->bss_conf.bss_color,
2008                 .htc_trig_based_pkt_ext = vif->bss_conf.htc_trig_based_pkt_ext,
2009                 .frame_time_rts_th =
2010                         cpu_to_le16(vif->bss_conf.frame_time_rts_th),
2011         };
2012         int size = fw_has_api(&mvm->fw->ucode_capa,
2013                               IWL_UCODE_TLV_API_MBSSID_HE) ?
2014                    sizeof(sta_ctxt_cmd) :
2015                    sizeof(struct iwl_he_sta_context_cmd_v1);
2016         struct ieee80211_sta *sta;
2017         u32 flags;
2018         int i;
2019
2020         rcu_read_lock();
2021
2022         sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_ctxt_cmd.sta_id]);
2023         if (IS_ERR(sta)) {
2024                 rcu_read_unlock();
2025                 WARN(1, "Can't find STA to configure HE\n");
2026                 return;
2027         }
2028
2029         if (!sta->he_cap.has_he) {
2030                 rcu_read_unlock();
2031                 return;
2032         }
2033
2034         flags = 0;
2035
2036         /* Block 26-tone RU OFDMA transmissions */
2037         if (mvmvif->he_ru_2mhz_block)
2038                 flags |= STA_CTXT_HE_RU_2MHZ_BLOCK;
2039
2040         /* HTC flags */
2041         if (sta->he_cap.he_cap_elem.mac_cap_info[0] &
2042             IEEE80211_HE_MAC_CAP0_HTC_HE)
2043                 sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_SUPPORT);
2044         if ((sta->he_cap.he_cap_elem.mac_cap_info[1] &
2045               IEEE80211_HE_MAC_CAP1_LINK_ADAPTATION) ||
2046             (sta->he_cap.he_cap_elem.mac_cap_info[2] &
2047               IEEE80211_HE_MAC_CAP2_LINK_ADAPTATION)) {
2048                 u8 link_adap =
2049                         ((sta->he_cap.he_cap_elem.mac_cap_info[2] &
2050                           IEEE80211_HE_MAC_CAP2_LINK_ADAPTATION) << 1) +
2051                          (sta->he_cap.he_cap_elem.mac_cap_info[1] &
2052                           IEEE80211_HE_MAC_CAP1_LINK_ADAPTATION);
2053
2054                 if (link_adap == 2)
2055                         sta_ctxt_cmd.htc_flags |=
2056                                 cpu_to_le32(IWL_HE_HTC_LINK_ADAP_UNSOLICITED);
2057                 else if (link_adap == 3)
2058                         sta_ctxt_cmd.htc_flags |=
2059                                 cpu_to_le32(IWL_HE_HTC_LINK_ADAP_BOTH);
2060         }
2061         if (sta->he_cap.he_cap_elem.mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
2062                 sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_BSR_SUPP);
2063         if (sta->he_cap.he_cap_elem.mac_cap_info[3] &
2064             IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
2065                 sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_OMI_SUPP);
2066         if (sta->he_cap.he_cap_elem.mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
2067                 sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_BQR_SUPP);
2068
2069         /*
2070          * Initialize the PPE thresholds to "None" (7), as described in Table
2071          * 9-262ac of 80211.ax/D3.0.
2072          */
2073         memset(&sta_ctxt_cmd.pkt_ext, 7, sizeof(sta_ctxt_cmd.pkt_ext));
2074
2075         /* If PPE Thresholds exist, parse them into a FW-familiar format. */
2076         if (sta->he_cap.he_cap_elem.phy_cap_info[6] &
2077             IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT) {
2078                 u8 nss = (sta->he_cap.ppe_thres[0] &
2079                           IEEE80211_PPE_THRES_NSS_MASK) + 1;
2080                 u8 ru_index_bitmap =
2081                         (sta->he_cap.ppe_thres[0] &
2082                          IEEE80211_PPE_THRES_RU_INDEX_BITMASK_MASK) >>
2083                         IEEE80211_PPE_THRES_RU_INDEX_BITMASK_POS;
2084                 u8 *ppe = &sta->he_cap.ppe_thres[0];
2085                 u8 ppe_pos_bit = 7; /* Starting after PPE header */
2086
2087                 /*
2088                  * FW currently supports only nss == MAX_HE_SUPP_NSS
2089                  *
2090                  * If nss > MAX: we can ignore values we don't support
2091                  * If nss < MAX: we can set zeros in other streams
2092                  */
2093                 if (nss > MAX_HE_SUPP_NSS) {
2094                         IWL_INFO(mvm, "Got NSS = %d - trimming to %d\n", nss,
2095                                  MAX_HE_SUPP_NSS);
2096                         nss = MAX_HE_SUPP_NSS;
2097                 }
2098
2099                 for (i = 0; i < nss; i++) {
2100                         u8 ru_index_tmp = ru_index_bitmap << 1;
2101                         u8 bw;
2102
2103                         for (bw = 0; bw < MAX_HE_CHANNEL_BW_INDX; bw++) {
2104                                 ru_index_tmp >>= 1;
2105                                 if (!(ru_index_tmp & 1))
2106                                         continue;
2107
2108                                 sta_ctxt_cmd.pkt_ext.pkt_ext_qam_th[i][bw][1] =
2109                                         iwl_mvm_he_get_ppe_val(ppe,
2110                                                                ppe_pos_bit);
2111                                 ppe_pos_bit +=
2112                                         IEEE80211_PPE_THRES_INFO_PPET_SIZE;
2113                                 sta_ctxt_cmd.pkt_ext.pkt_ext_qam_th[i][bw][0] =
2114                                         iwl_mvm_he_get_ppe_val(ppe,
2115                                                                ppe_pos_bit);
2116                                 ppe_pos_bit +=
2117                                         IEEE80211_PPE_THRES_INFO_PPET_SIZE;
2118                         }
2119                 }
2120
2121                 flags |= STA_CTXT_HE_PACKET_EXT;
2122         } else if ((sta->he_cap.he_cap_elem.phy_cap_info[9] &
2123                     IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_MASK) !=
2124                   IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_RESERVED) {
2125                 int low_th = -1;
2126                 int high_th = -1;
2127
2128                 /* Take the PPE thresholds from the nominal padding info */
2129                 switch (sta->he_cap.he_cap_elem.phy_cap_info[9] &
2130                         IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_MASK) {
2131                 case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_0US:
2132                         low_th = IWL_HE_PKT_EXT_NONE;
2133                         high_th = IWL_HE_PKT_EXT_NONE;
2134                         break;
2135                 case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_8US:
2136                         low_th = IWL_HE_PKT_EXT_BPSK;
2137                         high_th = IWL_HE_PKT_EXT_NONE;
2138                         break;
2139                 case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_16US:
2140                         low_th = IWL_HE_PKT_EXT_NONE;
2141                         high_th = IWL_HE_PKT_EXT_BPSK;
2142                         break;
2143                 }
2144
2145                 /* Set the PPE thresholds accordingly */
2146                 if (low_th >= 0 && high_th >= 0) {
2147                         struct iwl_he_pkt_ext *pkt_ext =
2148                                 (struct iwl_he_pkt_ext *)&sta_ctxt_cmd.pkt_ext;
2149
2150                         for (i = 0; i < MAX_HE_SUPP_NSS; i++) {
2151                                 u8 bw;
2152
2153                                 for (bw = 0; bw < MAX_HE_CHANNEL_BW_INDX;
2154                                      bw++) {
2155                                         pkt_ext->pkt_ext_qam_th[i][bw][0] =
2156                                                 low_th;
2157                                         pkt_ext->pkt_ext_qam_th[i][bw][1] =
2158                                                 high_th;
2159                                 }
2160                         }
2161
2162                         flags |= STA_CTXT_HE_PACKET_EXT;
2163                 }
2164         }
2165         rcu_read_unlock();
2166
2167         /* Mark MU EDCA as enabled, unless none detected on some AC */
2168         flags |= STA_CTXT_HE_MU_EDCA_CW;
2169         for (i = 0; i < IEEE80211_NUM_ACS; i++) {
2170                 struct ieee80211_he_mu_edca_param_ac_rec *mu_edca =
2171                         &mvmvif->queue_params[i].mu_edca_param_rec;
2172                 u8 ac = iwl_mvm_mac80211_ac_to_ucode_ac(i);
2173
2174                 if (!mvmvif->queue_params[i].mu_edca) {
2175                         flags &= ~STA_CTXT_HE_MU_EDCA_CW;
2176                         break;
2177                 }
2178
2179                 sta_ctxt_cmd.trig_based_txf[ac].cwmin =
2180                         cpu_to_le16(mu_edca->ecw_min_max & 0xf);
2181                 sta_ctxt_cmd.trig_based_txf[ac].cwmax =
2182                         cpu_to_le16((mu_edca->ecw_min_max & 0xf0) >> 4);
2183                 sta_ctxt_cmd.trig_based_txf[ac].aifsn =
2184                         cpu_to_le16(mu_edca->aifsn);
2185                 sta_ctxt_cmd.trig_based_txf[ac].mu_time =
2186                         cpu_to_le16(mu_edca->mu_edca_timer);
2187         }
2188
2189         if (vif->bss_conf.multi_sta_back_32bit)
2190                 flags |= STA_CTXT_HE_32BIT_BA_BITMAP;
2191
2192         if (vif->bss_conf.ack_enabled)
2193                 flags |= STA_CTXT_HE_ACK_ENABLED;
2194
2195         if (vif->bss_conf.uora_exists) {
2196                 flags |= STA_CTXT_HE_TRIG_RND_ALLOC;
2197
2198                 sta_ctxt_cmd.rand_alloc_ecwmin =
2199                         vif->bss_conf.uora_ocw_range & 0x7;
2200                 sta_ctxt_cmd.rand_alloc_ecwmax =
2201                         (vif->bss_conf.uora_ocw_range >> 3) & 0x7;
2202         }
2203
2204         if (vif->bss_conf.nontransmitted) {
2205                 flags |= STA_CTXT_HE_REF_BSSID_VALID;
2206                 ether_addr_copy(sta_ctxt_cmd.ref_bssid_addr,
2207                                 vif->bss_conf.transmitter_bssid);
2208                 sta_ctxt_cmd.max_bssid_indicator =
2209                         vif->bss_conf.bssid_indicator;
2210                 sta_ctxt_cmd.bssid_index = vif->bss_conf.bssid_index;
2211                 sta_ctxt_cmd.ema_ap = vif->bss_conf.ema_ap;
2212                 sta_ctxt_cmd.profile_periodicity =
2213                         vif->bss_conf.profile_periodicity;
2214         }
2215
2216         sta_ctxt_cmd.flags = cpu_to_le32(flags);
2217
2218         if (iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(STA_HE_CTXT_CMD,
2219                                                  DATA_PATH_GROUP, 0),
2220                                  0, size, &sta_ctxt_cmd))
2221                 IWL_ERR(mvm, "Failed to config FW to work HE!\n");
2222 }
2223
2224 static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
2225                                              struct ieee80211_vif *vif,
2226                                              struct ieee80211_bss_conf *bss_conf,
2227                                              u32 changes)
2228 {
2229         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2230         int ret;
2231
2232         /*
2233          * Re-calculate the tsf id, as the master-slave relations depend on the
2234          * beacon interval, which was not known when the station interface was
2235          * added.
2236          */
2237         if (changes & BSS_CHANGED_ASSOC && bss_conf->assoc) {
2238                 if (vif->bss_conf.he_support &&
2239                     !iwlwifi_mod_params.disable_11ax)
2240                         iwl_mvm_cfg_he_sta(mvm, vif, mvmvif->ap_sta_id);
2241
2242                 iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
2243         }
2244
2245         /* Update MU EDCA params */
2246         if (changes & BSS_CHANGED_QOS && mvmvif->associated &&
2247             bss_conf->assoc && vif->bss_conf.he_support &&
2248             !iwlwifi_mod_params.disable_11ax)
2249                 iwl_mvm_cfg_he_sta(mvm, vif, mvmvif->ap_sta_id);
2250
2251         /*
2252          * If we're not associated yet, take the (new) BSSID before associating
2253          * so the firmware knows. If we're already associated, then use the old
2254          * BSSID here, and we'll send a cleared one later in the CHANGED_ASSOC
2255          * branch for disassociation below.
2256          */
2257         if (changes & BSS_CHANGED_BSSID && !mvmvif->associated)
2258                 memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
2259
2260         ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, mvmvif->bssid);
2261         if (ret)
2262                 IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
2263
2264         /* after sending it once, adopt mac80211 data */
2265         memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
2266         mvmvif->associated = bss_conf->assoc;
2267
2268         if (changes & BSS_CHANGED_ASSOC) {
2269                 if (bss_conf->assoc) {
2270                         /* clear statistics to get clean beacon counter */
2271                         iwl_mvm_request_statistics(mvm, true);
2272                         memset(&mvmvif->beacon_stats, 0,
2273                                sizeof(mvmvif->beacon_stats));
2274
2275                         /* add quota for this interface */
2276                         ret = iwl_mvm_update_quotas(mvm, true, NULL);
2277                         if (ret) {
2278                                 IWL_ERR(mvm, "failed to update quotas\n");
2279                                 return;
2280                         }
2281
2282                         if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
2283                                      &mvm->status)) {
2284                                 /*
2285                                  * If we're restarting then the firmware will
2286                                  * obviously have lost synchronisation with
2287                                  * the AP. It will attempt to synchronise by
2288                                  * itself, but we can make it more reliable by
2289                                  * scheduling a session protection time event.
2290                                  *
2291                                  * The firmware needs to receive a beacon to
2292                                  * catch up with synchronisation, use 110% of
2293                                  * the beacon interval.
2294                                  *
2295                                  * Set a large maximum delay to allow for more
2296                                  * than a single interface.
2297                                  */
2298                                 u32 dur = (11 * vif->bss_conf.beacon_int) / 10;
2299                                 iwl_mvm_protect_session(mvm, vif, dur, dur,
2300                                                         5 * dur, false);
2301                         }
2302
2303                         iwl_mvm_sf_update(mvm, vif, false);
2304                         iwl_mvm_power_vif_assoc(mvm, vif);
2305                         if (vif->p2p) {
2306                                 iwl_mvm_update_smps(mvm, vif,
2307                                                     IWL_MVM_SMPS_REQ_PROT,
2308                                                     IEEE80211_SMPS_DYNAMIC);
2309                         }
2310                 } else if (mvmvif->ap_sta_id != IWL_MVM_INVALID_STA) {
2311                         /*
2312                          * If update fails - SF might be running in associated
2313                          * mode while disassociated - which is forbidden.
2314                          */
2315                         ret = iwl_mvm_sf_update(mvm, vif, false);
2316                         WARN_ONCE(ret &&
2317                                   !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
2318                                             &mvm->status),
2319                                   "Failed to update SF upon disassociation\n");
2320
2321                         /*
2322                          * If we get an assert during the connection (after the
2323                          * station has been added, but before the vif is set
2324                          * to associated), mac80211 will re-add the station and
2325                          * then configure the vif. Since the vif is not
2326                          * associated, we would remove the station here and
2327                          * this would fail the recovery.
2328                          */
2329                         if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
2330                                       &mvm->status)) {
2331                                 /*
2332                                  * Remove AP station now that
2333                                  * the MAC is unassoc
2334                                  */
2335                                 ret = iwl_mvm_rm_sta_id(mvm, vif,
2336                                                         mvmvif->ap_sta_id);
2337                                 if (ret)
2338                                         IWL_ERR(mvm,
2339                                                 "failed to remove AP station\n");
2340
2341                                 mvmvif->ap_sta_id = IWL_MVM_INVALID_STA;
2342                         }
2343
2344                         /* remove quota for this interface */
2345                         ret = iwl_mvm_update_quotas(mvm, false, NULL);
2346                         if (ret)
2347                                 IWL_ERR(mvm, "failed to update quotas\n");
2348
2349                         /* this will take the cleared BSSID from bss_conf */
2350                         ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
2351                         if (ret)
2352                                 IWL_ERR(mvm,
2353                                         "failed to update MAC %pM (clear after unassoc)\n",
2354                                         vif->addr);
2355                 }
2356
2357                 /*
2358                  * The firmware tracks the MU-MIMO group on its own.
2359                  * However, on HW restart we should restore this data.
2360                  */
2361                 if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
2362                     (changes & BSS_CHANGED_MU_GROUPS) && vif->mu_mimo_owner) {
2363                         ret = iwl_mvm_update_mu_groups(mvm, vif);
2364                         if (ret)
2365                                 IWL_ERR(mvm,
2366                                         "failed to update VHT MU_MIMO groups\n");
2367                 }
2368
2369                 iwl_mvm_recalc_multicast(mvm);
2370                 iwl_mvm_configure_bcast_filter(mvm);
2371
2372                 /* reset rssi values */
2373                 mvmvif->bf_data.ave_beacon_signal = 0;
2374
2375                 iwl_mvm_bt_coex_vif_change(mvm);
2376                 iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_TT,
2377                                     IEEE80211_SMPS_AUTOMATIC);
2378                 if (fw_has_capa(&mvm->fw->ucode_capa,
2379                                 IWL_UCODE_TLV_CAPA_UMAC_SCAN))
2380                         iwl_mvm_config_scan(mvm);
2381         }
2382
2383         if (changes & BSS_CHANGED_BEACON_INFO) {
2384                 /*
2385                  * We received a beacon from the associated AP so
2386                  * remove the session protection.
2387                  */
2388                 iwl_mvm_stop_session_protection(mvm, vif);
2389
2390                 iwl_mvm_sf_update(mvm, vif, false);
2391                 WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
2392         }
2393
2394         if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS | BSS_CHANGED_QOS |
2395                        /*
2396                         * Send power command on every beacon change,
2397                         * because we may have not enabled beacon abort yet.
2398                         */
2399                        BSS_CHANGED_BEACON_INFO)) {
2400                 ret = iwl_mvm_power_update_mac(mvm);
2401                 if (ret)
2402                         IWL_ERR(mvm, "failed to update power mode\n");
2403         }
2404
2405         if (changes & BSS_CHANGED_TXPOWER) {
2406                 IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2407                                 bss_conf->txpower);
2408                 iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2409         }
2410
2411         if (changes & BSS_CHANGED_CQM) {
2412                 IWL_DEBUG_MAC80211(mvm, "cqm info_changed\n");
2413                 /* reset cqm events tracking */
2414                 mvmvif->bf_data.last_cqm_event = 0;
2415                 if (mvmvif->bf_data.bf_enabled) {
2416                         ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
2417                         if (ret)
2418                                 IWL_ERR(mvm,
2419                                         "failed to update CQM thresholds\n");
2420                 }
2421         }
2422
2423         if (changes & BSS_CHANGED_ARP_FILTER) {
2424                 IWL_DEBUG_MAC80211(mvm, "arp filter changed\n");
2425                 iwl_mvm_configure_bcast_filter(mvm);
2426         }
2427 }
2428
2429 static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
2430                                  struct ieee80211_vif *vif)
2431 {
2432         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2433         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2434         int ret, i;
2435
2436         mutex_lock(&mvm->mutex);
2437
2438         /* Send the beacon template */
2439         ret = iwl_mvm_mac_ctxt_beacon_changed(mvm, vif);
2440         if (ret)
2441                 goto out_unlock;
2442
2443         /*
2444          * Re-calculate the tsf id, as the master-slave relations depend on the
2445          * beacon interval, which was not known when the AP interface was added.
2446          */
2447         if (vif->type == NL80211_IFTYPE_AP)
2448                 iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
2449
2450         mvmvif->ap_assoc_sta_count = 0;
2451
2452         /* Add the mac context */
2453         ret = iwl_mvm_mac_ctxt_add(mvm, vif);
2454         if (ret)
2455                 goto out_unlock;
2456
2457         /* Perform the binding */
2458         ret = iwl_mvm_binding_add_vif(mvm, vif);
2459         if (ret)
2460                 goto out_remove;
2461
2462         /*
2463          * This is not very nice, but the simplest:
2464          * For older FWs adding the mcast sta before the bcast station may
2465          * cause assert 0x2b00.
2466          * This is fixed in later FW so make the order of removal depend on
2467          * the TLV
2468          */
2469         if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE)) {
2470                 ret = iwl_mvm_add_mcast_sta(mvm, vif);
2471                 if (ret)
2472                         goto out_unbind;
2473                 /*
2474                  * Send the bcast station. At this stage the TBTT and DTIM time
2475                  * events are added and applied to the scheduler
2476                  */
2477                 ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
2478                 if (ret) {
2479                         iwl_mvm_rm_mcast_sta(mvm, vif);
2480                         goto out_unbind;
2481                 }
2482         } else {
2483                 /*
2484                  * Send the bcast station. At this stage the TBTT and DTIM time
2485                  * events are added and applied to the scheduler
2486                  */
2487                 ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
2488                 if (ret)
2489                         goto out_unbind;
2490                 ret = iwl_mvm_add_mcast_sta(mvm, vif);
2491                 if (ret) {
2492                         iwl_mvm_send_rm_bcast_sta(mvm, vif);
2493                         goto out_unbind;
2494                 }
2495         }
2496
2497         /* must be set before quota calculations */
2498         mvmvif->ap_ibss_active = true;
2499
2500         /* send all the early keys to the device now */
2501         for (i = 0; i < ARRAY_SIZE(mvmvif->ap_early_keys); i++) {
2502                 struct ieee80211_key_conf *key = mvmvif->ap_early_keys[i];
2503
2504                 if (!key)
2505                         continue;
2506
2507                 mvmvif->ap_early_keys[i] = NULL;
2508
2509                 ret = __iwl_mvm_mac_set_key(hw, SET_KEY, vif, NULL, key);
2510                 if (ret)
2511                         goto out_quota_failed;
2512         }
2513
2514         if (vif->type == NL80211_IFTYPE_AP && !vif->p2p) {
2515                 iwl_mvm_vif_set_low_latency(mvmvif, true,
2516                                             LOW_LATENCY_VIF_TYPE);
2517                 iwl_mvm_send_low_latency_cmd(mvm, true, mvmvif->id);
2518         }
2519
2520         /* power updated needs to be done before quotas */
2521         iwl_mvm_power_update_mac(mvm);
2522
2523         ret = iwl_mvm_update_quotas(mvm, false, NULL);
2524         if (ret)
2525                 goto out_quota_failed;
2526
2527         /* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2528         if (vif->p2p && mvm->p2p_device_vif)
2529                 iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2530
2531         iwl_mvm_bt_coex_vif_change(mvm);
2532
2533         /* we don't support TDLS during DCM */
2534         if (iwl_mvm_phy_ctx_count(mvm) > 1)
2535                 iwl_mvm_teardown_tdls_peers(mvm);
2536
2537         iwl_mvm_ftm_restart_responder(mvm, vif);
2538
2539         goto out_unlock;
2540
2541 out_quota_failed:
2542         iwl_mvm_power_update_mac(mvm);
2543         mvmvif->ap_ibss_active = false;
2544         iwl_mvm_send_rm_bcast_sta(mvm, vif);
2545         iwl_mvm_rm_mcast_sta(mvm, vif);
2546 out_unbind:
2547         iwl_mvm_binding_remove_vif(mvm, vif);
2548 out_remove:
2549         iwl_mvm_mac_ctxt_remove(mvm, vif);
2550 out_unlock:
2551         mutex_unlock(&mvm->mutex);
2552         return ret;
2553 }
2554
2555 static void iwl_mvm_stop_ap_ibss(struct ieee80211_hw *hw,
2556                                  struct ieee80211_vif *vif)
2557 {
2558         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2559         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2560
2561         iwl_mvm_prepare_mac_removal(mvm, vif);
2562
2563         mutex_lock(&mvm->mutex);
2564
2565         /* Handle AP stop while in CSA */
2566         if (rcu_access_pointer(mvm->csa_vif) == vif) {
2567                 iwl_mvm_remove_time_event(mvm, mvmvif,
2568                                           &mvmvif->time_event_data);
2569                 RCU_INIT_POINTER(mvm->csa_vif, NULL);
2570                 mvmvif->csa_countdown = false;
2571         }
2572
2573         if (rcu_access_pointer(mvm->csa_tx_blocked_vif) == vif) {
2574                 RCU_INIT_POINTER(mvm->csa_tx_blocked_vif, NULL);
2575                 mvm->csa_tx_block_bcn_timeout = 0;
2576         }
2577
2578         mvmvif->ap_ibss_active = false;
2579         mvm->ap_last_beacon_gp2 = 0;
2580
2581         if (vif->type == NL80211_IFTYPE_AP && !vif->p2p) {
2582                 iwl_mvm_vif_set_low_latency(mvmvif, false,
2583                                             LOW_LATENCY_VIF_TYPE);
2584                 iwl_mvm_send_low_latency_cmd(mvm, false,  mvmvif->id);
2585         }
2586
2587         iwl_mvm_bt_coex_vif_change(mvm);
2588
2589         /* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2590         if (vif->p2p && mvm->p2p_device_vif)
2591                 iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2592
2593         iwl_mvm_update_quotas(mvm, false, NULL);
2594
2595         /*
2596          * This is not very nice, but the simplest:
2597          * For older FWs removing the mcast sta before the bcast station may
2598          * cause assert 0x2b00.
2599          * This is fixed in later FW (which will stop beaconing when removing
2600          * bcast station).
2601          * So make the order of removal depend on the TLV
2602          */
2603         if (!fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE))
2604                 iwl_mvm_rm_mcast_sta(mvm, vif);
2605         iwl_mvm_send_rm_bcast_sta(mvm, vif);
2606         if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE))
2607                 iwl_mvm_rm_mcast_sta(mvm, vif);
2608         iwl_mvm_binding_remove_vif(mvm, vif);
2609
2610         iwl_mvm_power_update_mac(mvm);
2611
2612         iwl_mvm_mac_ctxt_remove(mvm, vif);
2613
2614         mutex_unlock(&mvm->mutex);
2615 }
2616
2617 static void
2618 iwl_mvm_bss_info_changed_ap_ibss(struct iwl_mvm *mvm,
2619                                  struct ieee80211_vif *vif,
2620                                  struct ieee80211_bss_conf *bss_conf,
2621                                  u32 changes)
2622 {
2623         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2624
2625         /* Changes will be applied when the AP/IBSS is started */
2626         if (!mvmvif->ap_ibss_active)
2627                 return;
2628
2629         if (changes & (BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_HT |
2630                        BSS_CHANGED_BANDWIDTH | BSS_CHANGED_QOS) &&
2631             iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL))
2632                 IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
2633
2634         /* Need to send a new beacon template to the FW */
2635         if (changes & BSS_CHANGED_BEACON &&
2636             iwl_mvm_mac_ctxt_beacon_changed(mvm, vif))
2637                 IWL_WARN(mvm, "Failed updating beacon data\n");
2638
2639         if (changes & BSS_CHANGED_TXPOWER) {
2640                 IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2641                                 bss_conf->txpower);
2642                 iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2643         }
2644
2645         if (changes & BSS_CHANGED_FTM_RESPONDER) {
2646                 int ret = iwl_mvm_ftm_start_responder(mvm, vif);
2647
2648                 if (ret)
2649                         IWL_WARN(mvm, "Failed to enable FTM responder (%d)\n",
2650                                  ret);
2651         }
2652
2653 }
2654
2655 static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw,
2656                                      struct ieee80211_vif *vif,
2657                                      struct ieee80211_bss_conf *bss_conf,
2658                                      u32 changes)
2659 {
2660         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2661
2662         mutex_lock(&mvm->mutex);
2663
2664         if (changes & BSS_CHANGED_IDLE && !bss_conf->idle)
2665                 iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true);
2666
2667         switch (vif->type) {
2668         case NL80211_IFTYPE_STATION:
2669                 iwl_mvm_bss_info_changed_station(mvm, vif, bss_conf, changes);
2670                 break;
2671         case NL80211_IFTYPE_AP:
2672         case NL80211_IFTYPE_ADHOC:
2673                 iwl_mvm_bss_info_changed_ap_ibss(mvm, vif, bss_conf, changes);
2674                 break;
2675         case NL80211_IFTYPE_MONITOR:
2676                 if (changes & BSS_CHANGED_MU_GROUPS)
2677                         iwl_mvm_update_mu_groups(mvm, vif);
2678                 break;
2679         default:
2680                 /* shouldn't happen */
2681                 WARN_ON_ONCE(1);
2682         }
2683
2684         mutex_unlock(&mvm->mutex);
2685 }
2686
2687 static int iwl_mvm_mac_hw_scan(struct ieee80211_hw *hw,
2688                                struct ieee80211_vif *vif,
2689                                struct ieee80211_scan_request *hw_req)
2690 {
2691         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2692         int ret;
2693
2694         if (hw_req->req.n_channels == 0 ||
2695             hw_req->req.n_channels > mvm->fw->ucode_capa.n_scan_channels)
2696                 return -EINVAL;
2697
2698         mutex_lock(&mvm->mutex);
2699         ret = iwl_mvm_reg_scan_start(mvm, vif, &hw_req->req, &hw_req->ies);
2700         mutex_unlock(&mvm->mutex);
2701
2702         return ret;
2703 }
2704
2705 static void iwl_mvm_mac_cancel_hw_scan(struct ieee80211_hw *hw,
2706                                        struct ieee80211_vif *vif)
2707 {
2708         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2709
2710         mutex_lock(&mvm->mutex);
2711
2712         /* Due to a race condition, it's possible that mac80211 asks
2713          * us to stop a hw_scan when it's already stopped.  This can
2714          * happen, for instance, if we stopped the scan ourselves,
2715          * called ieee80211_scan_completed() and the userspace called
2716          * cancel scan scan before ieee80211_scan_work() could run.
2717          * To handle that, simply return if the scan is not running.
2718         */
2719         if (mvm->scan_status & IWL_MVM_SCAN_REGULAR)
2720                 iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true);
2721
2722         mutex_unlock(&mvm->mutex);
2723 }
2724
2725 static void
2726 iwl_mvm_mac_allow_buffered_frames(struct ieee80211_hw *hw,
2727                                   struct ieee80211_sta *sta, u16 tids,
2728                                   int num_frames,
2729                                   enum ieee80211_frame_release_type reason,
2730                                   bool more_data)
2731 {
2732         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2733
2734         /* Called when we need to transmit (a) frame(s) from mac80211 */
2735
2736         iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2737                                           tids, more_data, false);
2738 }
2739
2740 static void
2741 iwl_mvm_mac_release_buffered_frames(struct ieee80211_hw *hw,
2742                                     struct ieee80211_sta *sta, u16 tids,
2743                                     int num_frames,
2744                                     enum ieee80211_frame_release_type reason,
2745                                     bool more_data)
2746 {
2747         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2748
2749         /* Called when we need to transmit (a) frame(s) from agg or dqa queue */
2750
2751         iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2752                                           tids, more_data, true);
2753 }
2754
2755 static void __iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
2756                                      enum sta_notify_cmd cmd,
2757                                      struct ieee80211_sta *sta)
2758 {
2759         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2760         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
2761         unsigned long txqs = 0, tids = 0;
2762         int tid;
2763
2764         /*
2765          * If we have TVQM then we get too high queue numbers - luckily
2766          * we really shouldn't get here with that because such hardware
2767          * should have firmware supporting buffer station offload.
2768          */
2769         if (WARN_ON(iwl_mvm_has_new_tx_api(mvm)))
2770                 return;
2771
2772         spin_lock_bh(&mvmsta->lock);
2773         for (tid = 0; tid < ARRAY_SIZE(mvmsta->tid_data); tid++) {
2774                 struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
2775
2776                 if (tid_data->txq_id == IWL_MVM_INVALID_QUEUE)
2777                         continue;
2778
2779                 __set_bit(tid_data->txq_id, &txqs);
2780
2781                 if (iwl_mvm_tid_queued(mvm, tid_data) == 0)
2782                         continue;
2783
2784                 __set_bit(tid, &tids);
2785         }
2786
2787         switch (cmd) {
2788         case STA_NOTIFY_SLEEP:
2789                 for_each_set_bit(tid, &tids, IWL_MAX_TID_COUNT)
2790                         ieee80211_sta_set_buffered(sta, tid, true);
2791
2792                 if (txqs)
2793                         iwl_trans_freeze_txq_timer(mvm->trans, txqs, true);
2794                 /*
2795                  * The fw updates the STA to be asleep. Tx packets on the Tx
2796                  * queues to this station will not be transmitted. The fw will
2797                  * send a Tx response with TX_STATUS_FAIL_DEST_PS.
2798                  */
2799                 break;
2800         case STA_NOTIFY_AWAKE:
2801                 if (WARN_ON(mvmsta->sta_id == IWL_MVM_INVALID_STA))
2802                         break;
2803
2804                 if (txqs)
2805                         iwl_trans_freeze_txq_timer(mvm->trans, txqs, false);
2806                 iwl_mvm_sta_modify_ps_wake(mvm, sta);
2807                 break;
2808         default:
2809                 break;
2810         }
2811         spin_unlock_bh(&mvmsta->lock);
2812 }
2813
2814 static void iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
2815                                    struct ieee80211_vif *vif,
2816                                    enum sta_notify_cmd cmd,
2817                                    struct ieee80211_sta *sta)
2818 {
2819         __iwl_mvm_mac_sta_notify(hw, cmd, sta);
2820 }
2821
2822 void iwl_mvm_sta_pm_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
2823 {
2824         struct iwl_rx_packet *pkt = rxb_addr(rxb);
2825         struct iwl_mvm_pm_state_notification *notif = (void *)pkt->data;
2826         struct ieee80211_sta *sta;
2827         struct iwl_mvm_sta *mvmsta;
2828         bool sleeping = (notif->type != IWL_MVM_PM_EVENT_AWAKE);
2829
2830         if (WARN_ON(notif->sta_id >= ARRAY_SIZE(mvm->fw_id_to_mac_id)))
2831                 return;
2832
2833         rcu_read_lock();
2834         sta = rcu_dereference(mvm->fw_id_to_mac_id[notif->sta_id]);
2835         if (WARN_ON(IS_ERR_OR_NULL(sta))) {
2836                 rcu_read_unlock();
2837                 return;
2838         }
2839
2840         mvmsta = iwl_mvm_sta_from_mac80211(sta);
2841
2842         if (!mvmsta->vif ||
2843             mvmsta->vif->type != NL80211_IFTYPE_AP) {
2844                 rcu_read_unlock();
2845                 return;
2846         }
2847
2848         if (mvmsta->sleeping != sleeping) {
2849                 mvmsta->sleeping = sleeping;
2850                 __iwl_mvm_mac_sta_notify(mvm->hw,
2851                         sleeping ? STA_NOTIFY_SLEEP : STA_NOTIFY_AWAKE,
2852                         sta);
2853                 ieee80211_sta_ps_transition(sta, sleeping);
2854         }
2855
2856         if (sleeping) {
2857                 switch (notif->type) {
2858                 case IWL_MVM_PM_EVENT_AWAKE:
2859                 case IWL_MVM_PM_EVENT_ASLEEP:
2860                         break;
2861                 case IWL_MVM_PM_EVENT_UAPSD:
2862                         ieee80211_sta_uapsd_trigger(sta, IEEE80211_NUM_TIDS);
2863                         break;
2864                 case IWL_MVM_PM_EVENT_PS_POLL:
2865                         ieee80211_sta_pspoll(sta);
2866                         break;
2867                 default:
2868                         break;
2869                 }
2870         }
2871
2872         rcu_read_unlock();
2873 }
2874
2875 static void iwl_mvm_sta_pre_rcu_remove(struct ieee80211_hw *hw,
2876                                        struct ieee80211_vif *vif,
2877                                        struct ieee80211_sta *sta)
2878 {
2879         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2880         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
2881
2882         /*
2883          * This is called before mac80211 does RCU synchronisation,
2884          * so here we already invalidate our internal RCU-protected
2885          * station pointer. The rest of the code will thus no longer
2886          * be able to find the station this way, and we don't rely
2887          * on further RCU synchronisation after the sta_state()
2888          * callback deleted the station.
2889          */
2890         mutex_lock(&mvm->mutex);
2891         if (sta == rcu_access_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id]))
2892                 rcu_assign_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id],
2893                                    ERR_PTR(-ENOENT));
2894
2895         mutex_unlock(&mvm->mutex);
2896 }
2897
2898 static void iwl_mvm_check_uapsd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
2899                                 const u8 *bssid)
2900 {
2901         int i;
2902
2903         if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
2904                 struct iwl_mvm_tcm_mac *mdata;
2905
2906                 mdata = &mvm->tcm.data[iwl_mvm_vif_from_mac80211(vif)->id];
2907                 ewma_rate_init(&mdata->uapsd_nonagg_detect.rate);
2908                 mdata->opened_rx_ba_sessions = false;
2909         }
2910
2911         if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT))
2912                 return;
2913
2914         if (vif->p2p && !iwl_mvm_is_p2p_scm_uapsd_supported(mvm)) {
2915                 vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2916                 return;
2917         }
2918
2919         if (!vif->p2p &&
2920             (iwlwifi_mod_params.uapsd_disable & IWL_DISABLE_UAPSD_BSS)) {
2921                 vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2922                 return;
2923         }
2924
2925         for (i = 0; i < IWL_MVM_UAPSD_NOAGG_LIST_LEN; i++) {
2926                 if (ether_addr_equal(mvm->uapsd_noagg_bssids[i].addr, bssid)) {
2927                         vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2928                         return;
2929                 }
2930         }
2931
2932         vif->driver_flags |= IEEE80211_VIF_SUPPORTS_UAPSD;
2933 }
2934
2935 static void
2936 iwl_mvm_tdls_check_trigger(struct iwl_mvm *mvm,
2937                            struct ieee80211_vif *vif, u8 *peer_addr,
2938                            enum nl80211_tdls_operation action)
2939 {
2940         struct iwl_fw_dbg_trigger_tlv *trig;
2941         struct iwl_fw_dbg_trigger_tdls *tdls_trig;
2942
2943         trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
2944                                      FW_DBG_TRIGGER_TDLS);
2945         if (!trig)
2946                 return;
2947
2948         tdls_trig = (void *)trig->data;
2949
2950         if (!(tdls_trig->action_bitmap & BIT(action)))
2951                 return;
2952
2953         if (tdls_trig->peer_mode &&
2954             memcmp(tdls_trig->peer, peer_addr, ETH_ALEN) != 0)
2955                 return;
2956
2957         iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
2958                                 "TDLS event occurred, peer %pM, action %d",
2959                                 peer_addr, action);
2960 }
2961
2962 struct iwl_mvm_he_obss_narrow_bw_ru_data {
2963         bool tolerated;
2964 };
2965
2966 static void iwl_mvm_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
2967                                                     struct cfg80211_bss *bss,
2968                                                     void *_data)
2969 {
2970         struct iwl_mvm_he_obss_narrow_bw_ru_data *data = _data;
2971         const struct element *elem;
2972
2973         elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY, bss->ies->data,
2974                                   bss->ies->len);
2975
2976         if (!elem || elem->datalen < 10 ||
2977             !(elem->data[10] &
2978               WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT)) {
2979                 data->tolerated = false;
2980         }
2981 }
2982
2983 static void iwl_mvm_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
2984                                                struct ieee80211_vif *vif)
2985 {
2986         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2987         struct iwl_mvm_he_obss_narrow_bw_ru_data iter_data = {
2988                 .tolerated = true,
2989         };
2990
2991         if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR)) {
2992                 mvmvif->he_ru_2mhz_block = false;
2993                 return;
2994         }
2995
2996         cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
2997                           iwl_mvm_check_he_obss_narrow_bw_ru_iter,
2998                           &iter_data);
2999
3000         /*
3001          * If there is at least one AP on radar channel that cannot
3002          * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
3003          */
3004         mvmvif->he_ru_2mhz_block = !iter_data.tolerated;
3005 }
3006
3007 static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
3008                                  struct ieee80211_vif *vif,
3009                                  struct ieee80211_sta *sta,
3010                                  enum ieee80211_sta_state old_state,
3011                                  enum ieee80211_sta_state new_state)
3012 {
3013         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3014         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3015         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
3016         int ret;
3017
3018         IWL_DEBUG_MAC80211(mvm, "station %pM state change %d->%d\n",
3019                            sta->addr, old_state, new_state);
3020
3021         /* this would be a mac80211 bug ... but don't crash */
3022         if (WARN_ON_ONCE(!mvmvif->phy_ctxt))
3023                 return -EINVAL;
3024
3025         /*
3026          * If we are in a STA removal flow and in DQA mode:
3027          *
3028          * This is after the sync_rcu part, so the queues have already been
3029          * flushed. No more TXs on their way in mac80211's path, and no more in
3030          * the queues.
3031          * Also, we won't be getting any new TX frames for this station.
3032          * What we might have are deferred TX frames that need to be taken care
3033          * of.
3034          *
3035          * Drop any still-queued deferred-frame before removing the STA, and
3036          * make sure the worker is no longer handling frames for this STA.
3037          */
3038         if (old_state == IEEE80211_STA_NONE &&
3039             new_state == IEEE80211_STA_NOTEXIST) {
3040                 flush_work(&mvm->add_stream_wk);
3041
3042                 /*
3043                  * No need to make sure deferred TX indication is off since the
3044                  * worker will already remove it if it was on
3045                  */
3046         }
3047
3048         mutex_lock(&mvm->mutex);
3049         /* track whether or not the station is associated */
3050         mvm_sta->sta_state = new_state;
3051
3052         if (old_state == IEEE80211_STA_NOTEXIST &&
3053             new_state == IEEE80211_STA_NONE) {
3054                 /*
3055                  * Firmware bug - it'll crash if the beacon interval is less
3056                  * than 16. We can't avoid connecting at all, so refuse the
3057                  * station state change, this will cause mac80211 to abandon
3058                  * attempts to connect to this AP, and eventually wpa_s will
3059                  * blacklist the AP...
3060                  */
3061                 if (vif->type == NL80211_IFTYPE_STATION &&
3062                     vif->bss_conf.beacon_int < 16) {
3063                         IWL_ERR(mvm,
3064                                 "AP %pM beacon interval is %d, refusing due to firmware bug!\n",
3065                                 sta->addr, vif->bss_conf.beacon_int);
3066                         ret = -EINVAL;
3067                         goto out_unlock;
3068                 }
3069
3070                 if (sta->tdls &&
3071                     (vif->p2p ||
3072                      iwl_mvm_tdls_sta_count(mvm, NULL) ==
3073                                                 IWL_MVM_TDLS_STA_COUNT ||
3074                      iwl_mvm_phy_ctx_count(mvm) > 1)) {
3075                         IWL_DEBUG_MAC80211(mvm, "refusing TDLS sta\n");
3076                         ret = -EBUSY;
3077                         goto out_unlock;
3078                 }
3079
3080                 ret = iwl_mvm_add_sta(mvm, vif, sta);
3081                 if (sta->tdls && ret == 0) {
3082                         iwl_mvm_recalc_tdls_state(mvm, vif, true);
3083                         iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3084                                                    NL80211_TDLS_SETUP);
3085                 }
3086
3087                 sta->max_rc_amsdu_len = 1;
3088         } else if (old_state == IEEE80211_STA_NONE &&
3089                    new_state == IEEE80211_STA_AUTH) {
3090                 /*
3091                  * EBS may be disabled due to previous failures reported by FW.
3092                  * Reset EBS status here assuming environment has been changed.
3093                  */
3094                 mvm->last_ebs_successful = true;
3095                 iwl_mvm_check_uapsd(mvm, vif, sta->addr);
3096                 ret = 0;
3097         } else if (old_state == IEEE80211_STA_AUTH &&
3098                    new_state == IEEE80211_STA_ASSOC) {
3099                 if (vif->type == NL80211_IFTYPE_AP) {
3100                         vif->bss_conf.he_support = sta->he_cap.has_he;
3101                         mvmvif->ap_assoc_sta_count++;
3102                         iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3103                         if (vif->bss_conf.he_support &&
3104                             !iwlwifi_mod_params.disable_11ax)
3105                                 iwl_mvm_cfg_he_sta(mvm, vif, mvm_sta->sta_id);
3106                 } else if (vif->type == NL80211_IFTYPE_STATION) {
3107                         vif->bss_conf.he_support = sta->he_cap.has_he;
3108
3109                         mvmvif->he_ru_2mhz_block = false;
3110                         if (sta->he_cap.has_he)
3111                                 iwl_mvm_check_he_obss_narrow_bw_ru(hw, vif);
3112
3113                         iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3114                 }
3115
3116                 iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3117                                      false);
3118                 ret = iwl_mvm_update_sta(mvm, vif, sta);
3119         } else if (old_state == IEEE80211_STA_ASSOC &&
3120                    new_state == IEEE80211_STA_AUTHORIZED) {
3121                 ret = 0;
3122
3123                 /* we don't support TDLS during DCM */
3124                 if (iwl_mvm_phy_ctx_count(mvm) > 1)
3125                         iwl_mvm_teardown_tdls_peers(mvm);
3126
3127                 if (sta->tdls)
3128                         iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3129                                                    NL80211_TDLS_ENABLE_LINK);
3130
3131                 /* enable beacon filtering */
3132                 WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
3133
3134                 /*
3135                  * Now that the station is authorized, i.e., keys were already
3136                  * installed, need to indicate to the FW that
3137                  * multicast data frames can be forwarded to the driver
3138                  */
3139                 iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3140
3141                 iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3142                                      true);
3143         } else if (old_state == IEEE80211_STA_AUTHORIZED &&
3144                    new_state == IEEE80211_STA_ASSOC) {
3145                 /* Multicast data frames are no longer allowed */
3146                 iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3147
3148                 /* disable beacon filtering */
3149                 ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
3150                 WARN_ON(ret &&
3151                         !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
3152                                   &mvm->status));
3153                 ret = 0;
3154         } else if (old_state == IEEE80211_STA_ASSOC &&
3155                    new_state == IEEE80211_STA_AUTH) {
3156                 if (vif->type == NL80211_IFTYPE_AP) {
3157                         mvmvif->ap_assoc_sta_count--;
3158                         iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3159                 }
3160                 ret = 0;
3161         } else if (old_state == IEEE80211_STA_AUTH &&
3162                    new_state == IEEE80211_STA_NONE) {
3163                 ret = 0;
3164         } else if (old_state == IEEE80211_STA_NONE &&
3165                    new_state == IEEE80211_STA_NOTEXIST) {
3166                 ret = iwl_mvm_rm_sta(mvm, vif, sta);
3167                 if (sta->tdls) {
3168                         iwl_mvm_recalc_tdls_state(mvm, vif, false);
3169                         iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3170                                                    NL80211_TDLS_DISABLE_LINK);
3171                 }
3172
3173                 if (unlikely(ret &&
3174                              test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
3175                                       &mvm->status)))
3176                         ret = 0;
3177         } else {
3178                 ret = -EIO;
3179         }
3180  out_unlock:
3181         mutex_unlock(&mvm->mutex);
3182
3183         if (sta->tdls && ret == 0) {
3184                 if (old_state == IEEE80211_STA_NOTEXIST &&
3185                     new_state == IEEE80211_STA_NONE)
3186                         ieee80211_reserve_tid(sta, IWL_MVM_TDLS_FW_TID);
3187                 else if (old_state == IEEE80211_STA_NONE &&
3188                          new_state == IEEE80211_STA_NOTEXIST)
3189                         ieee80211_unreserve_tid(sta, IWL_MVM_TDLS_FW_TID);
3190         }
3191
3192         return ret;
3193 }
3194
3195 static int iwl_mvm_mac_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
3196 {
3197         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3198
3199         mvm->rts_threshold = value;
3200
3201         return 0;
3202 }
3203
3204 static void iwl_mvm_sta_rc_update(struct ieee80211_hw *hw,
3205                                   struct ieee80211_vif *vif,
3206                                   struct ieee80211_sta *sta, u32 changed)
3207 {
3208         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3209         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3210
3211         if (changed & (IEEE80211_RC_BW_CHANGED |
3212                        IEEE80211_RC_SUPP_RATES_CHANGED |
3213                        IEEE80211_RC_NSS_CHANGED))
3214                 iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3215                                      true);
3216
3217         if (vif->type == NL80211_IFTYPE_STATION &&
3218             changed & IEEE80211_RC_NSS_CHANGED)
3219                 iwl_mvm_sf_update(mvm, vif, false);
3220 }
3221
3222 static int iwl_mvm_mac_conf_tx(struct ieee80211_hw *hw,
3223                                struct ieee80211_vif *vif, u16 ac,
3224                                const struct ieee80211_tx_queue_params *params)
3225 {
3226         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3227         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3228
3229         mvmvif->queue_params[ac] = *params;
3230
3231         /*
3232          * No need to update right away, we'll get BSS_CHANGED_QOS
3233          * The exception is P2P_DEVICE interface which needs immediate update.
3234          */
3235         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
3236                 int ret;
3237
3238                 mutex_lock(&mvm->mutex);
3239                 ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3240                 mutex_unlock(&mvm->mutex);
3241                 return ret;
3242         }
3243         return 0;
3244 }
3245
3246 static void iwl_mvm_mac_mgd_prepare_tx(struct ieee80211_hw *hw,
3247                                        struct ieee80211_vif *vif,
3248                                        u16 req_duration)
3249 {
3250         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3251         u32 duration = IWL_MVM_TE_SESSION_PROTECTION_MAX_TIME_MS;
3252         u32 min_duration = IWL_MVM_TE_SESSION_PROTECTION_MIN_TIME_MS;
3253
3254         if (req_duration > duration)
3255                 duration = req_duration;
3256
3257         mutex_lock(&mvm->mutex);
3258         /* Try really hard to protect the session and hear a beacon */
3259         iwl_mvm_protect_session(mvm, vif, duration, min_duration, 500, false);
3260         mutex_unlock(&mvm->mutex);
3261 }
3262
3263 static int iwl_mvm_mac_sched_scan_start(struct ieee80211_hw *hw,
3264                                         struct ieee80211_vif *vif,
3265                                         struct cfg80211_sched_scan_request *req,
3266                                         struct ieee80211_scan_ies *ies)
3267 {
3268         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3269
3270         int ret;
3271
3272         mutex_lock(&mvm->mutex);
3273
3274         if (!vif->bss_conf.idle) {
3275                 ret = -EBUSY;
3276                 goto out;
3277         }
3278
3279         ret = iwl_mvm_sched_scan_start(mvm, vif, req, ies, IWL_MVM_SCAN_SCHED);
3280
3281 out:
3282         mutex_unlock(&mvm->mutex);
3283         return ret;
3284 }
3285
3286 static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
3287                                        struct ieee80211_vif *vif)
3288 {
3289         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3290         int ret;
3291
3292         mutex_lock(&mvm->mutex);
3293
3294         /* Due to a race condition, it's possible that mac80211 asks
3295          * us to stop a sched_scan when it's already stopped.  This
3296          * can happen, for instance, if we stopped the scan ourselves,
3297          * called ieee80211_sched_scan_stopped() and the userspace called
3298          * stop sched scan scan before ieee80211_sched_scan_stopped_work()
3299          * could run.  To handle this, simply return if the scan is
3300          * not running.
3301         */
3302         if (!(mvm->scan_status & IWL_MVM_SCAN_SCHED)) {
3303                 mutex_unlock(&mvm->mutex);
3304                 return 0;
3305         }
3306
3307         ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, false);
3308         mutex_unlock(&mvm->mutex);
3309         iwl_mvm_wait_for_async_handlers(mvm);
3310
3311         return ret;
3312 }
3313
3314 static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
3315                                  enum set_key_cmd cmd,
3316                                  struct ieee80211_vif *vif,
3317                                  struct ieee80211_sta *sta,
3318                                  struct ieee80211_key_conf *key)
3319 {
3320         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3321         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3322         struct iwl_mvm_sta *mvmsta;
3323         struct iwl_mvm_key_pn *ptk_pn;
3324         int keyidx = key->keyidx;
3325         int ret, i;
3326         u8 key_offset;
3327
3328         if (iwlwifi_mod_params.swcrypto) {
3329                 IWL_DEBUG_MAC80211(mvm, "leave - hwcrypto disabled\n");
3330                 return -EOPNOTSUPP;
3331         }
3332
3333         switch (key->cipher) {
3334         case WLAN_CIPHER_SUITE_TKIP:
3335                 if (!mvm->trans->trans_cfg->gen2) {
3336                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3337                         key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3338                 } else if (vif->type == NL80211_IFTYPE_STATION) {
3339                         key->flags |= IEEE80211_KEY_FLAG_PUT_MIC_SPACE;
3340                 } else {
3341                         IWL_DEBUG_MAC80211(mvm, "Use SW encryption for TKIP\n");
3342                         return -EOPNOTSUPP;
3343                 }
3344                 break;
3345         case WLAN_CIPHER_SUITE_CCMP:
3346         case WLAN_CIPHER_SUITE_GCMP:
3347         case WLAN_CIPHER_SUITE_GCMP_256:
3348                 if (!iwl_mvm_has_new_tx_api(mvm))
3349                         key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3350                 break;
3351         case WLAN_CIPHER_SUITE_AES_CMAC:
3352         case WLAN_CIPHER_SUITE_BIP_GMAC_128:
3353         case WLAN_CIPHER_SUITE_BIP_GMAC_256:
3354                 WARN_ON_ONCE(!ieee80211_hw_check(hw, MFP_CAPABLE));
3355                 break;
3356         case WLAN_CIPHER_SUITE_WEP40:
3357         case WLAN_CIPHER_SUITE_WEP104:
3358                 if (vif->type == NL80211_IFTYPE_STATION)
3359                         break;
3360                 if (iwl_mvm_has_new_tx_api(mvm))
3361                         return -EOPNOTSUPP;
3362                 /* support HW crypto on TX */
3363                 return 0;
3364         default:
3365                 /* currently FW supports only one optional cipher scheme */
3366                 if (hw->n_cipher_schemes &&
3367                     hw->cipher_schemes->cipher == key->cipher)
3368                         key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3369                 else
3370                         return -EOPNOTSUPP;
3371         }
3372
3373         switch (cmd) {
3374         case SET_KEY:
3375                 if ((vif->type == NL80211_IFTYPE_ADHOC ||
3376                      vif->type == NL80211_IFTYPE_AP) && !sta) {
3377                         /*
3378                          * GTK on AP interface is a TX-only key, return 0;
3379                          * on IBSS they're per-station and because we're lazy
3380                          * we don't support them for RX, so do the same.
3381                          * CMAC/GMAC in AP/IBSS modes must be done in software.
3382                          */
3383                         if (key->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
3384                             key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
3385                             key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256)
3386                                 ret = -EOPNOTSUPP;
3387                         else
3388                                 ret = 0;
3389
3390                         if (key->cipher != WLAN_CIPHER_SUITE_GCMP &&
3391                             key->cipher != WLAN_CIPHER_SUITE_GCMP_256 &&
3392                             !iwl_mvm_has_new_tx_api(mvm)) {
3393                                 key->hw_key_idx = STA_KEY_IDX_INVALID;
3394                                 break;
3395                         }
3396
3397                         if (!mvmvif->ap_ibss_active) {
3398                                 for (i = 0;
3399                                      i < ARRAY_SIZE(mvmvif->ap_early_keys);
3400                                      i++) {
3401                                         if (!mvmvif->ap_early_keys[i]) {
3402                                                 mvmvif->ap_early_keys[i] = key;
3403                                                 break;
3404                                         }
3405                                 }
3406
3407                                 if (i >= ARRAY_SIZE(mvmvif->ap_early_keys))
3408                                         ret = -ENOSPC;
3409
3410                                 break;
3411                         }
3412                 }
3413
3414                 /* During FW restart, in order to restore the state as it was,
3415                  * don't try to reprogram keys we previously failed for.
3416                  */
3417                 if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
3418                     key->hw_key_idx == STA_KEY_IDX_INVALID) {
3419                         IWL_DEBUG_MAC80211(mvm,
3420                                            "skip invalid idx key programming during restart\n");
3421                         ret = 0;
3422                         break;
3423                 }
3424
3425                 if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
3426                     sta && iwl_mvm_has_new_rx_api(mvm) &&
3427                     key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
3428                     (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
3429                      key->cipher == WLAN_CIPHER_SUITE_GCMP ||
3430                      key->cipher == WLAN_CIPHER_SUITE_GCMP_256)) {
3431                         struct ieee80211_key_seq seq;
3432                         int tid, q;
3433
3434                         mvmsta = iwl_mvm_sta_from_mac80211(sta);
3435                         WARN_ON(rcu_access_pointer(mvmsta->ptk_pn[keyidx]));
3436                         ptk_pn = kzalloc(struct_size(ptk_pn, q,
3437                                                      mvm->trans->num_rx_queues),
3438                                          GFP_KERNEL);
3439                         if (!ptk_pn) {
3440                                 ret = -ENOMEM;
3441                                 break;
3442                         }
3443
3444                         for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++) {
3445                                 ieee80211_get_key_rx_seq(key, tid, &seq);
3446                                 for (q = 0; q < mvm->trans->num_rx_queues; q++)
3447                                         memcpy(ptk_pn->q[q].pn[tid],
3448                                                seq.ccmp.pn,
3449                                                IEEE80211_CCMP_PN_LEN);
3450                         }
3451
3452                         rcu_assign_pointer(mvmsta->ptk_pn[keyidx], ptk_pn);
3453                 }
3454
3455                 /* in HW restart reuse the index, otherwise request a new one */
3456                 if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
3457                         key_offset = key->hw_key_idx;
3458                 else
3459                         key_offset = STA_KEY_IDX_INVALID;
3460
3461                 IWL_DEBUG_MAC80211(mvm, "set hwcrypto key\n");
3462                 ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, key_offset);
3463                 if (ret) {
3464                         IWL_WARN(mvm, "set key failed\n");
3465                         key->hw_key_idx = STA_KEY_IDX_INVALID;
3466                         /*
3467                          * can't add key for RX, but we don't need it
3468                          * in the device for TX so still return 0,
3469                          * unless we have new TX API where we cannot
3470                          * put key material into the TX_CMD
3471                          */
3472                         if (iwl_mvm_has_new_tx_api(mvm))
3473                                 ret = -EOPNOTSUPP;
3474                         else
3475                                 ret = 0;
3476                 }
3477
3478                 break;
3479         case DISABLE_KEY:
3480                 ret = -ENOENT;
3481                 for (i = 0; i < ARRAY_SIZE(mvmvif->ap_early_keys); i++) {
3482                         if (mvmvif->ap_early_keys[i] == key) {
3483                                 mvmvif->ap_early_keys[i] = NULL;
3484                                 ret = 0;
3485                         }
3486                 }
3487
3488                 /* found in pending list - don't do anything else */
3489                 if (ret == 0)
3490                         break;
3491
3492                 if (key->hw_key_idx == STA_KEY_IDX_INVALID) {
3493                         ret = 0;
3494                         break;
3495                 }
3496
3497                 if (sta && iwl_mvm_has_new_rx_api(mvm) &&
3498                     key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
3499                     (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
3500                      key->cipher == WLAN_CIPHER_SUITE_GCMP ||
3501                      key->cipher == WLAN_CIPHER_SUITE_GCMP_256)) {
3502                         mvmsta = iwl_mvm_sta_from_mac80211(sta);
3503                         ptk_pn = rcu_dereference_protected(
3504                                                 mvmsta->ptk_pn[keyidx],
3505                                                 lockdep_is_held(&mvm->mutex));
3506                         RCU_INIT_POINTER(mvmsta->ptk_pn[keyidx], NULL);
3507                         if (ptk_pn)
3508                                 kfree_rcu(ptk_pn, rcu_head);
3509                 }
3510
3511                 IWL_DEBUG_MAC80211(mvm, "disable hwcrypto key\n");
3512                 ret = iwl_mvm_remove_sta_key(mvm, vif, sta, key);
3513                 break;
3514         default:
3515                 ret = -EINVAL;
3516         }
3517
3518         return ret;
3519 }
3520
3521 static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
3522                                enum set_key_cmd cmd,
3523                                struct ieee80211_vif *vif,
3524                                struct ieee80211_sta *sta,
3525                                struct ieee80211_key_conf *key)
3526 {
3527         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3528         int ret;
3529
3530         mutex_lock(&mvm->mutex);
3531         ret = __iwl_mvm_mac_set_key(hw, cmd, vif, sta, key);
3532         mutex_unlock(&mvm->mutex);
3533
3534         return ret;
3535 }
3536
3537 static void iwl_mvm_mac_update_tkip_key(struct ieee80211_hw *hw,
3538                                         struct ieee80211_vif *vif,
3539                                         struct ieee80211_key_conf *keyconf,
3540                                         struct ieee80211_sta *sta,
3541                                         u32 iv32, u16 *phase1key)
3542 {
3543         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3544
3545         if (keyconf->hw_key_idx == STA_KEY_IDX_INVALID)
3546                 return;
3547
3548         iwl_mvm_update_tkip_key(mvm, vif, keyconf, sta, iv32, phase1key);
3549 }
3550
3551
3552 static bool iwl_mvm_rx_aux_roc(struct iwl_notif_wait_data *notif_wait,
3553                                struct iwl_rx_packet *pkt, void *data)
3554 {
3555         struct iwl_mvm *mvm =
3556                 container_of(notif_wait, struct iwl_mvm, notif_wait);
3557         struct iwl_hs20_roc_res *resp;
3558         int resp_len = iwl_rx_packet_payload_len(pkt);
3559         struct iwl_mvm_time_event_data *te_data = data;
3560
3561         if (WARN_ON(pkt->hdr.cmd != HOT_SPOT_CMD))
3562                 return true;
3563
3564         if (WARN_ON_ONCE(resp_len != sizeof(*resp))) {
3565                 IWL_ERR(mvm, "Invalid HOT_SPOT_CMD response\n");
3566                 return true;
3567         }
3568
3569         resp = (void *)pkt->data;
3570
3571         IWL_DEBUG_TE(mvm,
3572                      "Aux ROC: Received response from ucode: status=%d uid=%d\n",
3573                      resp->status, resp->event_unique_id);
3574
3575         te_data->uid = le32_to_cpu(resp->event_unique_id);
3576         IWL_DEBUG_TE(mvm, "TIME_EVENT_CMD response - UID = 0x%x\n",
3577                      te_data->uid);
3578
3579         spin_lock_bh(&mvm->time_event_lock);
3580         list_add_tail(&te_data->list, &mvm->aux_roc_te_list);
3581         spin_unlock_bh(&mvm->time_event_lock);
3582
3583         return true;
3584 }
3585
3586 #define AUX_ROC_MIN_DURATION MSEC_TO_TU(100)
3587 #define AUX_ROC_MIN_DELAY MSEC_TO_TU(200)
3588 #define AUX_ROC_MAX_DELAY MSEC_TO_TU(600)
3589 #define AUX_ROC_SAFETY_BUFFER MSEC_TO_TU(20)
3590 #define AUX_ROC_MIN_SAFETY_BUFFER MSEC_TO_TU(10)
3591 static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm,
3592                                     struct ieee80211_channel *channel,
3593                                     struct ieee80211_vif *vif,
3594                                     int duration)
3595 {
3596         int res;
3597         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3598         struct iwl_mvm_time_event_data *te_data = &mvmvif->hs_time_event_data;
3599         static const u16 time_event_response[] = { HOT_SPOT_CMD };
3600         struct iwl_notification_wait wait_time_event;
3601         u32 dtim_interval = vif->bss_conf.dtim_period *
3602                 vif->bss_conf.beacon_int;
3603         u32 req_dur, delay;
3604         struct iwl_hs20_roc_req aux_roc_req = {
3605                 .action = cpu_to_le32(FW_CTXT_ACTION_ADD),
3606                 .id_and_color =
3607                         cpu_to_le32(FW_CMD_ID_AND_COLOR(MAC_INDEX_AUX, 0)),
3608                 .sta_id_and_color = cpu_to_le32(mvm->aux_sta.sta_id),
3609         };
3610         struct iwl_hs20_roc_req_tail *tail = iwl_mvm_chan_info_cmd_tail(mvm,
3611                 &aux_roc_req.channel_info);
3612         u16 len = sizeof(aux_roc_req) - iwl_mvm_chan_info_padding(mvm);
3613
3614         /* Set the channel info data */
3615         iwl_mvm_set_chan_info(mvm, &aux_roc_req.channel_info, channel->hw_value,
3616                               (channel->band == NL80211_BAND_2GHZ) ?
3617                                PHY_BAND_24 : PHY_BAND_5,
3618                               PHY_VHT_CHANNEL_MODE20,
3619                               0);
3620
3621         /* Set the time and duration */
3622         tail->apply_time = cpu_to_le32(iwl_mvm_get_systime(mvm));
3623
3624         delay = AUX_ROC_MIN_DELAY;
3625         req_dur = MSEC_TO_TU(duration);
3626
3627         /*
3628          * If we are associated we want the delay time to be at least one
3629          * dtim interval so that the FW can wait until after the DTIM and
3630          * then start the time event, this will potentially allow us to
3631          * remain off-channel for the max duration.
3632          * Since we want to use almost a whole dtim interval we would also
3633          * like the delay to be for 2-3 dtim intervals, in case there are
3634          * other time events with higher priority.
3635          */
3636         if (vif->bss_conf.assoc) {
3637                 delay = min_t(u32, dtim_interval * 3, AUX_ROC_MAX_DELAY);
3638                 /* We cannot remain off-channel longer than the DTIM interval */
3639                 if (dtim_interval <= req_dur) {
3640                         req_dur = dtim_interval - AUX_ROC_SAFETY_BUFFER;
3641                         if (req_dur <= AUX_ROC_MIN_DURATION)
3642                                 req_dur = dtim_interval -
3643                                         AUX_ROC_MIN_SAFETY_BUFFER;
3644                 }
3645         }
3646
3647         tail->duration = cpu_to_le32(req_dur);
3648         tail->apply_time_max_delay = cpu_to_le32(delay);
3649
3650         IWL_DEBUG_TE(mvm,
3651                      "ROC: Requesting to remain on channel %u for %ums (requested = %ums, max_delay = %ums, dtim_interval = %ums)\n",
3652                      channel->hw_value, req_dur, duration, delay,
3653                      dtim_interval);
3654         /* Set the node address */
3655         memcpy(tail->node_addr, vif->addr, ETH_ALEN);
3656
3657         lockdep_assert_held(&mvm->mutex);
3658
3659         spin_lock_bh(&mvm->time_event_lock);
3660
3661         if (WARN_ON(te_data->id == HOT_SPOT_CMD)) {
3662                 spin_unlock_bh(&mvm->time_event_lock);
3663                 return -EIO;
3664         }
3665
3666         te_data->vif = vif;
3667         te_data->duration = duration;
3668         te_data->id = HOT_SPOT_CMD;
3669
3670         spin_unlock_bh(&mvm->time_event_lock);
3671
3672         /*
3673          * Use a notification wait, which really just processes the
3674          * command response and doesn't wait for anything, in order
3675          * to be able to process the response and get the UID inside
3676          * the RX path. Using CMD_WANT_SKB doesn't work because it
3677          * stores the buffer and then wakes up this thread, by which
3678          * time another notification (that the time event started)
3679          * might already be processed unsuccessfully.
3680          */
3681         iwl_init_notification_wait(&mvm->notif_wait, &wait_time_event,
3682                                    time_event_response,
3683                                    ARRAY_SIZE(time_event_response),
3684                                    iwl_mvm_rx_aux_roc, te_data);
3685
3686         res = iwl_mvm_send_cmd_pdu(mvm, HOT_SPOT_CMD, 0, len,
3687                                    &aux_roc_req);
3688
3689         if (res) {
3690                 IWL_ERR(mvm, "Couldn't send HOT_SPOT_CMD: %d\n", res);
3691                 iwl_remove_notification(&mvm->notif_wait, &wait_time_event);
3692                 goto out_clear_te;
3693         }
3694
3695         /* No need to wait for anything, so just pass 1 (0 isn't valid) */
3696         res = iwl_wait_notification(&mvm->notif_wait, &wait_time_event, 1);
3697         /* should never fail */
3698         WARN_ON_ONCE(res);
3699
3700         if (res) {
3701  out_clear_te:
3702                 spin_lock_bh(&mvm->time_event_lock);
3703                 iwl_mvm_te_clear_data(mvm, te_data);
3704                 spin_unlock_bh(&mvm->time_event_lock);
3705         }
3706
3707         return res;
3708 }
3709
3710 static int iwl_mvm_roc(struct ieee80211_hw *hw,
3711                        struct ieee80211_vif *vif,
3712                        struct ieee80211_channel *channel,
3713                        int duration,
3714                        enum ieee80211_roc_type type)
3715 {
3716         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3717         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3718         struct cfg80211_chan_def chandef;
3719         struct iwl_mvm_phy_ctxt *phy_ctxt;
3720         int ret, i;
3721
3722         IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value,
3723                            duration, type);
3724
3725         /*
3726          * Flush the done work, just in case it's still pending, so that
3727          * the work it does can complete and we can accept new frames.
3728          */
3729         flush_work(&mvm->roc_done_wk);
3730
3731         mutex_lock(&mvm->mutex);
3732
3733         switch (vif->type) {
3734         case NL80211_IFTYPE_STATION:
3735                 if (fw_has_capa(&mvm->fw->ucode_capa,
3736                                 IWL_UCODE_TLV_CAPA_HOTSPOT_SUPPORT)) {
3737                         /* Use aux roc framework (HS20) */
3738                         ret = iwl_mvm_send_aux_roc_cmd(mvm, channel,
3739                                                        vif, duration);
3740                         goto out_unlock;
3741                 }
3742                 IWL_ERR(mvm, "hotspot not supported\n");
3743                 ret = -EINVAL;
3744                 goto out_unlock;
3745         case NL80211_IFTYPE_P2P_DEVICE:
3746                 /* handle below */
3747                 break;
3748         default:
3749                 IWL_ERR(mvm, "vif isn't P2P_DEVICE: %d\n", vif->type);
3750                 ret = -EINVAL;
3751                 goto out_unlock;
3752         }
3753
3754         for (i = 0; i < NUM_PHY_CTX; i++) {
3755                 phy_ctxt = &mvm->phy_ctxts[i];
3756                 if (phy_ctxt->ref == 0 || mvmvif->phy_ctxt == phy_ctxt)
3757                         continue;
3758
3759                 if (phy_ctxt->ref && channel == phy_ctxt->channel) {
3760                         /*
3761                          * Unbind the P2P_DEVICE from the current PHY context,
3762                          * and if the PHY context is not used remove it.
3763                          */
3764                         ret = iwl_mvm_binding_remove_vif(mvm, vif);
3765                         if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3766                                 goto out_unlock;
3767
3768                         iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3769
3770                         /* Bind the P2P_DEVICE to the current PHY Context */
3771                         mvmvif->phy_ctxt = phy_ctxt;
3772
3773                         ret = iwl_mvm_binding_add_vif(mvm, vif);
3774                         if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3775                                 goto out_unlock;
3776
3777                         iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3778                         goto schedule_time_event;
3779                 }
3780         }
3781
3782         /* Need to update the PHY context only if the ROC channel changed */
3783         if (channel == mvmvif->phy_ctxt->channel)
3784                 goto schedule_time_event;
3785
3786         cfg80211_chandef_create(&chandef, channel, NL80211_CHAN_NO_HT);
3787
3788         /*
3789          * Change the PHY context configuration as it is currently referenced
3790          * only by the P2P Device MAC
3791          */
3792         if (mvmvif->phy_ctxt->ref == 1) {
3793                 ret = iwl_mvm_phy_ctxt_changed(mvm, mvmvif->phy_ctxt,
3794                                                &chandef, 1, 1);
3795                 if (ret)
3796                         goto out_unlock;
3797         } else {
3798                 /*
3799                  * The PHY context is shared with other MACs. Need to remove the
3800                  * P2P Device from the binding, allocate an new PHY context and
3801                  * create a new binding
3802                  */
3803                 phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3804                 if (!phy_ctxt) {
3805                         ret = -ENOSPC;
3806                         goto out_unlock;
3807                 }
3808
3809                 ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &chandef,
3810                                                1, 1);
3811                 if (ret) {
3812                         IWL_ERR(mvm, "Failed to change PHY context\n");
3813                         goto out_unlock;
3814                 }
3815
3816                 /* Unbind the P2P_DEVICE from the current PHY context */
3817                 ret = iwl_mvm_binding_remove_vif(mvm, vif);
3818                 if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3819                         goto out_unlock;
3820
3821                 iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3822
3823                 /* Bind the P2P_DEVICE to the new allocated PHY context */
3824                 mvmvif->phy_ctxt = phy_ctxt;
3825
3826                 ret = iwl_mvm_binding_add_vif(mvm, vif);
3827                 if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3828                         goto out_unlock;
3829
3830                 iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3831         }
3832
3833 schedule_time_event:
3834         /* Schedule the time events */
3835         ret = iwl_mvm_start_p2p_roc(mvm, vif, duration, type);
3836
3837 out_unlock:
3838         mutex_unlock(&mvm->mutex);
3839         IWL_DEBUG_MAC80211(mvm, "leave\n");
3840         return ret;
3841 }
3842
3843 static int iwl_mvm_cancel_roc(struct ieee80211_hw *hw,
3844                               struct ieee80211_vif *vif)
3845 {
3846         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3847
3848         IWL_DEBUG_MAC80211(mvm, "enter\n");
3849
3850         mutex_lock(&mvm->mutex);
3851         iwl_mvm_stop_roc(mvm);
3852         mutex_unlock(&mvm->mutex);
3853
3854         IWL_DEBUG_MAC80211(mvm, "leave\n");
3855         return 0;
3856 }
3857
3858 struct iwl_mvm_ftm_responder_iter_data {
3859         bool responder;
3860         struct ieee80211_chanctx_conf *ctx;
3861 };
3862
3863 static void iwl_mvm_ftm_responder_chanctx_iter(void *_data, u8 *mac,
3864                                                struct ieee80211_vif *vif)
3865 {
3866         struct iwl_mvm_ftm_responder_iter_data *data = _data;
3867
3868         if (rcu_access_pointer(vif->chanctx_conf) == data->ctx &&
3869             vif->type == NL80211_IFTYPE_AP && vif->bss_conf.ftmr_params)
3870                 data->responder = true;
3871 }
3872
3873 static bool iwl_mvm_is_ftm_responder_chanctx(struct iwl_mvm *mvm,
3874                                              struct ieee80211_chanctx_conf *ctx)
3875 {
3876         struct iwl_mvm_ftm_responder_iter_data data = {
3877                 .responder = false,
3878                 .ctx = ctx,
3879         };
3880
3881         ieee80211_iterate_active_interfaces_atomic(mvm->hw,
3882                                         IEEE80211_IFACE_ITER_NORMAL,
3883                                         iwl_mvm_ftm_responder_chanctx_iter,
3884                                         &data);
3885         return data.responder;
3886 }
3887
3888 static int __iwl_mvm_add_chanctx(struct iwl_mvm *mvm,
3889                                  struct ieee80211_chanctx_conf *ctx)
3890 {
3891         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3892         struct iwl_mvm_phy_ctxt *phy_ctxt;
3893         bool responder = iwl_mvm_is_ftm_responder_chanctx(mvm, ctx);
3894         struct cfg80211_chan_def *def = responder ? &ctx->def : &ctx->min_def;
3895         int ret;
3896
3897         lockdep_assert_held(&mvm->mutex);
3898
3899         IWL_DEBUG_MAC80211(mvm, "Add channel context\n");
3900
3901         phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3902         if (!phy_ctxt) {
3903                 ret = -ENOSPC;
3904                 goto out;
3905         }
3906
3907         ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, def,
3908                                        ctx->rx_chains_static,
3909                                        ctx->rx_chains_dynamic);
3910         if (ret) {
3911                 IWL_ERR(mvm, "Failed to add PHY context\n");
3912                 goto out;
3913         }
3914
3915         iwl_mvm_phy_ctxt_ref(mvm, phy_ctxt);
3916         *phy_ctxt_id = phy_ctxt->id;
3917 out:
3918         return ret;
3919 }
3920
3921 static int iwl_mvm_add_chanctx(struct ieee80211_hw *hw,
3922                                struct ieee80211_chanctx_conf *ctx)
3923 {
3924         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3925         int ret;
3926
3927         mutex_lock(&mvm->mutex);
3928         ret = __iwl_mvm_add_chanctx(mvm, ctx);
3929         mutex_unlock(&mvm->mutex);
3930
3931         return ret;
3932 }
3933
3934 static void __iwl_mvm_remove_chanctx(struct iwl_mvm *mvm,
3935                                      struct ieee80211_chanctx_conf *ctx)
3936 {
3937         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3938         struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3939
3940         lockdep_assert_held(&mvm->mutex);
3941
3942         iwl_mvm_phy_ctxt_unref(mvm, phy_ctxt);
3943 }
3944
3945 static void iwl_mvm_remove_chanctx(struct ieee80211_hw *hw,
3946                                    struct ieee80211_chanctx_conf *ctx)
3947 {
3948         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3949
3950         mutex_lock(&mvm->mutex);
3951         __iwl_mvm_remove_chanctx(mvm, ctx);
3952         mutex_unlock(&mvm->mutex);
3953 }
3954
3955 static void iwl_mvm_change_chanctx(struct ieee80211_hw *hw,
3956                                    struct ieee80211_chanctx_conf *ctx,
3957                                    u32 changed)
3958 {
3959         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3960         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3961         struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3962         bool responder = iwl_mvm_is_ftm_responder_chanctx(mvm, ctx);
3963         struct cfg80211_chan_def *def = responder ? &ctx->def : &ctx->min_def;
3964
3965         if (WARN_ONCE((phy_ctxt->ref > 1) &&
3966                       (changed & ~(IEEE80211_CHANCTX_CHANGE_WIDTH |
3967                                    IEEE80211_CHANCTX_CHANGE_RX_CHAINS |
3968                                    IEEE80211_CHANCTX_CHANGE_RADAR |
3969                                    IEEE80211_CHANCTX_CHANGE_MIN_WIDTH)),
3970                       "Cannot change PHY. Ref=%d, changed=0x%X\n",
3971                       phy_ctxt->ref, changed))
3972                 return;
3973
3974         mutex_lock(&mvm->mutex);
3975
3976         /* we are only changing the min_width, may be a noop */
3977         if (changed == IEEE80211_CHANCTX_CHANGE_MIN_WIDTH) {
3978                 if (phy_ctxt->width == def->width)
3979                         goto out_unlock;
3980
3981                 /* we are just toggling between 20_NOHT and 20 */
3982                 if (phy_ctxt->width <= NL80211_CHAN_WIDTH_20 &&
3983                     def->width <= NL80211_CHAN_WIDTH_20)
3984                         goto out_unlock;
3985         }
3986
3987         iwl_mvm_bt_coex_vif_change(mvm);
3988         iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, def,
3989                                  ctx->rx_chains_static,
3990                                  ctx->rx_chains_dynamic);
3991
3992 out_unlock:
3993         mutex_unlock(&mvm->mutex);
3994 }
3995
3996 static int __iwl_mvm_assign_vif_chanctx(struct iwl_mvm *mvm,
3997                                         struct ieee80211_vif *vif,
3998                                         struct ieee80211_chanctx_conf *ctx,
3999                                         bool switching_chanctx)
4000 {
4001         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
4002         struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
4003         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4004         int ret;
4005
4006         lockdep_assert_held(&mvm->mutex);
4007
4008         mvmvif->phy_ctxt = phy_ctxt;
4009
4010         switch (vif->type) {
4011         case NL80211_IFTYPE_AP:
4012                 /* only needed if we're switching chanctx (i.e. during CSA) */
4013                 if (switching_chanctx) {
4014                         mvmvif->ap_ibss_active = true;
4015                         break;
4016                 }
4017                 /* fall through */
4018         case NL80211_IFTYPE_ADHOC:
4019                 /*
4020                  * The AP binding flow is handled as part of the start_ap flow
4021                  * (in bss_info_changed), similarly for IBSS.
4022                  */
4023                 ret = 0;
4024                 goto out;
4025         case NL80211_IFTYPE_STATION:
4026                 mvmvif->csa_bcn_pending = false;
4027                 break;
4028         case NL80211_IFTYPE_MONITOR:
4029                 /* always disable PS when a monitor interface is active */
4030                 mvmvif->ps_disabled = true;
4031                 break;
4032         default:
4033                 ret = -EINVAL;
4034                 goto out;
4035         }
4036
4037         ret = iwl_mvm_binding_add_vif(mvm, vif);
4038         if (ret)
4039                 goto out;
4040
4041         /*
4042          * Power state must be updated before quotas,
4043          * otherwise fw will complain.
4044          */
4045         iwl_mvm_power_update_mac(mvm);
4046
4047         /* Setting the quota at this stage is only required for monitor
4048          * interfaces. For the other types, the bss_info changed flow
4049          * will handle quota settings.
4050          */
4051         if (vif->type == NL80211_IFTYPE_MONITOR) {
4052                 mvmvif->monitor_active = true;
4053                 ret = iwl_mvm_update_quotas(mvm, false, NULL);
4054                 if (ret)
4055                         goto out_remove_binding;
4056
4057                 ret = iwl_mvm_add_snif_sta(mvm, vif);
4058                 if (ret)
4059                         goto out_remove_binding;
4060
4061         }
4062
4063         /* Handle binding during CSA */
4064         if (vif->type == NL80211_IFTYPE_AP) {
4065                 iwl_mvm_update_quotas(mvm, false, NULL);
4066                 iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
4067         }
4068
4069         if (switching_chanctx && vif->type == NL80211_IFTYPE_STATION) {
4070                 mvmvif->csa_bcn_pending = true;
4071
4072                 if (!fw_has_capa(&mvm->fw->ucode_capa,
4073                                  IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
4074                         u32 duration = 3 * vif->bss_conf.beacon_int;
4075
4076                         /* Protect the session to make sure we hear the first
4077                          * beacon on the new channel.
4078                          */
4079                         iwl_mvm_protect_session(mvm, vif, duration, duration,
4080                                                 vif->bss_conf.beacon_int / 2,
4081                                                 true);
4082                 }
4083
4084                 iwl_mvm_update_quotas(mvm, false, NULL);
4085         }
4086
4087         goto out;
4088
4089 out_remove_binding:
4090         iwl_mvm_binding_remove_vif(mvm, vif);
4091         iwl_mvm_power_update_mac(mvm);
4092 out:
4093         if (ret)
4094                 mvmvif->phy_ctxt = NULL;
4095         return ret;
4096 }
4097 static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
4098                                       struct ieee80211_vif *vif,
4099                                       struct ieee80211_chanctx_conf *ctx)
4100 {
4101         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4102         int ret;
4103
4104         mutex_lock(&mvm->mutex);
4105         ret = __iwl_mvm_assign_vif_chanctx(mvm, vif, ctx, false);
4106         mutex_unlock(&mvm->mutex);
4107
4108         return ret;
4109 }
4110
4111 static void __iwl_mvm_unassign_vif_chanctx(struct iwl_mvm *mvm,
4112                                            struct ieee80211_vif *vif,
4113                                            struct ieee80211_chanctx_conf *ctx,
4114                                            bool switching_chanctx)
4115 {
4116         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4117         struct ieee80211_vif *disabled_vif = NULL;
4118
4119         lockdep_assert_held(&mvm->mutex);
4120
4121         iwl_mvm_remove_time_event(mvm, mvmvif, &mvmvif->time_event_data);
4122
4123         switch (vif->type) {
4124         case NL80211_IFTYPE_ADHOC:
4125                 goto out;
4126         case NL80211_IFTYPE_MONITOR:
4127                 mvmvif->monitor_active = false;
4128                 mvmvif->ps_disabled = false;
4129                 iwl_mvm_rm_snif_sta(mvm, vif);
4130                 break;
4131         case NL80211_IFTYPE_AP:
4132                 /* This part is triggered only during CSA */
4133                 if (!switching_chanctx || !mvmvif->ap_ibss_active)
4134                         goto out;
4135
4136                 mvmvif->csa_countdown = false;
4137
4138                 /* Set CS bit on all the stations */
4139                 iwl_mvm_modify_all_sta_disable_tx(mvm, mvmvif, true);
4140
4141                 /* Save blocked iface, the timeout is set on the next beacon */
4142                 rcu_assign_pointer(mvm->csa_tx_blocked_vif, vif);
4143
4144                 mvmvif->ap_ibss_active = false;
4145                 break;
4146         case NL80211_IFTYPE_STATION:
4147                 if (!switching_chanctx)
4148                         break;
4149
4150                 disabled_vif = vif;
4151
4152                 if (!fw_has_capa(&mvm->fw->ucode_capa,
4153                                  IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD))
4154                         iwl_mvm_mac_ctxt_changed(mvm, vif, true, NULL);
4155                 break;
4156         default:
4157                 break;
4158         }
4159
4160         iwl_mvm_update_quotas(mvm, false, disabled_vif);
4161         iwl_mvm_binding_remove_vif(mvm, vif);
4162
4163 out:
4164         mvmvif->phy_ctxt = NULL;
4165         iwl_mvm_power_update_mac(mvm);
4166 }
4167
4168 static void iwl_mvm_unassign_vif_chanctx(struct ieee80211_hw *hw,
4169                                          struct ieee80211_vif *vif,
4170                                          struct ieee80211_chanctx_conf *ctx)
4171 {
4172         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4173
4174         mutex_lock(&mvm->mutex);
4175         __iwl_mvm_unassign_vif_chanctx(mvm, vif, ctx, false);
4176         mutex_unlock(&mvm->mutex);
4177 }
4178
4179 static int
4180 iwl_mvm_switch_vif_chanctx_swap(struct iwl_mvm *mvm,
4181                                 struct ieee80211_vif_chanctx_switch *vifs)
4182 {
4183         int ret;
4184
4185         mutex_lock(&mvm->mutex);
4186         __iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
4187         __iwl_mvm_remove_chanctx(mvm, vifs[0].old_ctx);
4188
4189         ret = __iwl_mvm_add_chanctx(mvm, vifs[0].new_ctx);
4190         if (ret) {
4191                 IWL_ERR(mvm, "failed to add new_ctx during channel switch\n");
4192                 goto out_reassign;
4193         }
4194
4195         ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
4196                                            true);
4197         if (ret) {
4198                 IWL_ERR(mvm,
4199                         "failed to assign new_ctx during channel switch\n");
4200                 goto out_remove;
4201         }
4202
4203         /* we don't support TDLS during DCM - can be caused by channel switch */
4204         if (iwl_mvm_phy_ctx_count(mvm) > 1)
4205                 iwl_mvm_teardown_tdls_peers(mvm);
4206
4207         goto out;
4208
4209 out_remove:
4210         __iwl_mvm_remove_chanctx(mvm, vifs[0].new_ctx);
4211
4212 out_reassign:
4213         if (__iwl_mvm_add_chanctx(mvm, vifs[0].old_ctx)) {
4214                 IWL_ERR(mvm, "failed to add old_ctx back after failure.\n");
4215                 goto out_restart;
4216         }
4217
4218         if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
4219                                          true)) {
4220                 IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
4221                 goto out_restart;
4222         }
4223
4224         goto out;
4225
4226 out_restart:
4227         /* things keep failing, better restart the hw */
4228         iwl_mvm_nic_restart(mvm, false);
4229
4230 out:
4231         mutex_unlock(&mvm->mutex);
4232
4233         return ret;
4234 }
4235
4236 static int
4237 iwl_mvm_switch_vif_chanctx_reassign(struct iwl_mvm *mvm,
4238                                     struct ieee80211_vif_chanctx_switch *vifs)
4239 {
4240         int ret;
4241
4242         mutex_lock(&mvm->mutex);
4243         __iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
4244
4245         ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
4246                                            true);
4247         if (ret) {
4248                 IWL_ERR(mvm,
4249                         "failed to assign new_ctx during channel switch\n");
4250                 goto out_reassign;
4251         }
4252
4253         goto out;
4254
4255 out_reassign:
4256         if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
4257                                          true)) {
4258                 IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
4259                 goto out_restart;
4260         }
4261
4262         goto out;
4263
4264 out_restart:
4265         /* things keep failing, better restart the hw */
4266         iwl_mvm_nic_restart(mvm, false);
4267
4268 out:
4269         mutex_unlock(&mvm->mutex);
4270
4271         return ret;
4272 }
4273
4274 static int iwl_mvm_switch_vif_chanctx(struct ieee80211_hw *hw,
4275                                       struct ieee80211_vif_chanctx_switch *vifs,
4276                                       int n_vifs,
4277                                       enum ieee80211_chanctx_switch_mode mode)
4278 {
4279         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4280         int ret;
4281
4282         /* we only support a single-vif right now */
4283         if (n_vifs > 1)
4284                 return -EOPNOTSUPP;
4285
4286         switch (mode) {
4287         case CHANCTX_SWMODE_SWAP_CONTEXTS:
4288                 ret = iwl_mvm_switch_vif_chanctx_swap(mvm, vifs);
4289                 break;
4290         case CHANCTX_SWMODE_REASSIGN_VIF:
4291                 ret = iwl_mvm_switch_vif_chanctx_reassign(mvm, vifs);
4292                 break;
4293         default:
4294                 ret = -EOPNOTSUPP;
4295                 break;
4296         }
4297
4298         return ret;
4299 }
4300
4301 static int iwl_mvm_tx_last_beacon(struct ieee80211_hw *hw)
4302 {
4303         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4304
4305         return mvm->ibss_manager;
4306 }
4307
4308 static int iwl_mvm_set_tim(struct ieee80211_hw *hw,
4309                            struct ieee80211_sta *sta,
4310                            bool set)
4311 {
4312         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4313         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
4314
4315         if (!mvm_sta || !mvm_sta->vif) {
4316                 IWL_ERR(mvm, "Station is not associated to a vif\n");
4317                 return -EINVAL;
4318         }
4319
4320         return iwl_mvm_mac_ctxt_beacon_changed(mvm, mvm_sta->vif);
4321 }
4322
4323 #ifdef CONFIG_NL80211_TESTMODE
4324 static const struct nla_policy iwl_mvm_tm_policy[IWL_MVM_TM_ATTR_MAX + 1] = {
4325         [IWL_MVM_TM_ATTR_CMD] = { .type = NLA_U32 },
4326         [IWL_MVM_TM_ATTR_NOA_DURATION] = { .type = NLA_U32 },
4327         [IWL_MVM_TM_ATTR_BEACON_FILTER_STATE] = { .type = NLA_U32 },
4328 };
4329
4330 static int __iwl_mvm_mac_testmode_cmd(struct iwl_mvm *mvm,
4331                                       struct ieee80211_vif *vif,
4332                                       void *data, int len)
4333 {
4334         struct nlattr *tb[IWL_MVM_TM_ATTR_MAX + 1];
4335         int err;
4336         u32 noa_duration;
4337
4338         err = nla_parse_deprecated(tb, IWL_MVM_TM_ATTR_MAX, data, len,
4339                                    iwl_mvm_tm_policy, NULL);
4340         if (err)
4341                 return err;
4342
4343         if (!tb[IWL_MVM_TM_ATTR_CMD])
4344                 return -EINVAL;
4345
4346         switch (nla_get_u32(tb[IWL_MVM_TM_ATTR_CMD])) {
4347         case IWL_MVM_TM_CMD_SET_NOA:
4348                 if (!vif || vif->type != NL80211_IFTYPE_AP || !vif->p2p ||
4349                     !vif->bss_conf.enable_beacon ||
4350                     !tb[IWL_MVM_TM_ATTR_NOA_DURATION])
4351                         return -EINVAL;
4352
4353                 noa_duration = nla_get_u32(tb[IWL_MVM_TM_ATTR_NOA_DURATION]);
4354                 if (noa_duration >= vif->bss_conf.beacon_int)
4355                         return -EINVAL;
4356
4357                 mvm->noa_duration = noa_duration;
4358                 mvm->noa_vif = vif;
4359
4360                 return iwl_mvm_update_quotas(mvm, true, NULL);
4361         case IWL_MVM_TM_CMD_SET_BEACON_FILTER:
4362                 /* must be associated client vif - ignore authorized */
4363                 if (!vif || vif->type != NL80211_IFTYPE_STATION ||
4364                     !vif->bss_conf.assoc || !vif->bss_conf.dtim_period ||
4365                     !tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE])
4366                         return -EINVAL;
4367
4368                 if (nla_get_u32(tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE]))
4369                         return iwl_mvm_enable_beacon_filter(mvm, vif, 0);
4370                 return iwl_mvm_disable_beacon_filter(mvm, vif, 0);
4371         }
4372
4373         return -EOPNOTSUPP;
4374 }
4375
4376 static int iwl_mvm_mac_testmode_cmd(struct ieee80211_hw *hw,
4377                                     struct ieee80211_vif *vif,
4378                                     void *data, int len)
4379 {
4380         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4381         int err;
4382
4383         mutex_lock(&mvm->mutex);
4384         err = __iwl_mvm_mac_testmode_cmd(mvm, vif, data, len);
4385         mutex_unlock(&mvm->mutex);
4386
4387         return err;
4388 }
4389 #endif
4390
4391 static void iwl_mvm_channel_switch(struct ieee80211_hw *hw,
4392                                    struct ieee80211_vif *vif,
4393                                    struct ieee80211_channel_switch *chsw)
4394 {
4395         /* By implementing this operation, we prevent mac80211 from
4396          * starting its own channel switch timer, so that we can call
4397          * ieee80211_chswitch_done() ourselves at the right time
4398          * (which is when the absence time event starts).
4399          */
4400
4401         IWL_DEBUG_MAC80211(IWL_MAC80211_GET_MVM(hw),
4402                            "dummy channel switch op\n");
4403 }
4404
4405 static int iwl_mvm_schedule_client_csa(struct iwl_mvm *mvm,
4406                                        struct ieee80211_vif *vif,
4407                                        struct ieee80211_channel_switch *chsw)
4408 {
4409         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4410         struct iwl_chan_switch_te_cmd cmd = {
4411                 .mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
4412                                                           mvmvif->color)),
4413                 .action = cpu_to_le32(FW_CTXT_ACTION_ADD),
4414                 .tsf = cpu_to_le32(chsw->timestamp),
4415                 .cs_count = chsw->count,
4416                 .cs_mode = chsw->block_tx,
4417         };
4418
4419         lockdep_assert_held(&mvm->mutex);
4420
4421         if (chsw->delay)
4422                 cmd.cs_delayed_bcn_count =
4423                         DIV_ROUND_UP(chsw->delay, vif->bss_conf.beacon_int);
4424
4425         return iwl_mvm_send_cmd_pdu(mvm,
4426                                     WIDE_ID(MAC_CONF_GROUP,
4427                                             CHANNEL_SWITCH_TIME_EVENT_CMD),
4428                                     0, sizeof(cmd), &cmd);
4429 }
4430
4431 static int iwl_mvm_old_pre_chan_sw_sta(struct iwl_mvm *mvm,
4432                                        struct ieee80211_vif *vif,
4433                                        struct ieee80211_channel_switch *chsw)
4434 {
4435         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4436         u32 apply_time;
4437
4438         /* Schedule the time event to a bit before beacon 1,
4439          * to make sure we're in the new channel when the
4440          * GO/AP arrives. In case count <= 1 immediately schedule the
4441          * TE (this might result with some packet loss or connection
4442          * loss).
4443          */
4444         if (chsw->count <= 1)
4445                 apply_time = 0;
4446         else
4447                 apply_time = chsw->device_timestamp +
4448                         ((vif->bss_conf.beacon_int * (chsw->count - 1) -
4449                           IWL_MVM_CHANNEL_SWITCH_TIME_CLIENT) * 1024);
4450
4451         if (chsw->block_tx)
4452                 iwl_mvm_csa_client_absent(mvm, vif);
4453
4454         if (mvmvif->bf_data.bf_enabled) {
4455                 int ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
4456
4457                 if (ret)
4458                         return ret;
4459         }
4460
4461         iwl_mvm_schedule_csa_period(mvm, vif, vif->bss_conf.beacon_int,
4462                                     apply_time);
4463
4464         return 0;
4465 }
4466
4467 #define IWL_MAX_CSA_BLOCK_TX 1500
4468 static int iwl_mvm_pre_channel_switch(struct ieee80211_hw *hw,
4469                                       struct ieee80211_vif *vif,
4470                                       struct ieee80211_channel_switch *chsw)
4471 {
4472         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4473         struct ieee80211_vif *csa_vif;
4474         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4475         int ret;
4476
4477         mutex_lock(&mvm->mutex);
4478
4479         mvmvif->csa_failed = false;
4480
4481         IWL_DEBUG_MAC80211(mvm, "pre CSA to freq %d\n",
4482                            chsw->chandef.center_freq1);
4483
4484         iwl_fw_dbg_trigger_simple_stop(&mvm->fwrt,
4485                                        ieee80211_vif_to_wdev(vif),
4486                                        FW_DBG_TRIGGER_CHANNEL_SWITCH);
4487
4488         switch (vif->type) {
4489         case NL80211_IFTYPE_AP:
4490                 csa_vif =
4491                         rcu_dereference_protected(mvm->csa_vif,
4492                                                   lockdep_is_held(&mvm->mutex));
4493                 if (WARN_ONCE(csa_vif && csa_vif->csa_active,
4494                               "Another CSA is already in progress")) {
4495                         ret = -EBUSY;
4496                         goto out_unlock;
4497                 }
4498
4499                 /* we still didn't unblock tx. prevent new CS meanwhile */
4500                 if (rcu_dereference_protected(mvm->csa_tx_blocked_vif,
4501                                               lockdep_is_held(&mvm->mutex))) {
4502                         ret = -EBUSY;
4503                         goto out_unlock;
4504                 }
4505
4506                 rcu_assign_pointer(mvm->csa_vif, vif);
4507
4508                 if (WARN_ONCE(mvmvif->csa_countdown,
4509                               "Previous CSA countdown didn't complete")) {
4510                         ret = -EBUSY;
4511                         goto out_unlock;
4512                 }
4513
4514                 mvmvif->csa_target_freq = chsw->chandef.chan->center_freq;
4515
4516                 break;
4517         case NL80211_IFTYPE_STATION:
4518                 if (chsw->block_tx) {
4519                         /*
4520                          * In case of undetermined / long time with immediate
4521                          * quiet monitor status to gracefully disconnect
4522                          */
4523                         if (!chsw->count ||
4524                             chsw->count * vif->bss_conf.beacon_int >
4525                             IWL_MAX_CSA_BLOCK_TX)
4526                                 schedule_delayed_work(&mvmvif->csa_work,
4527                                                       msecs_to_jiffies(IWL_MAX_CSA_BLOCK_TX));
4528                 }
4529
4530                 if (!fw_has_capa(&mvm->fw->ucode_capa,
4531                                  IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
4532                         ret = iwl_mvm_old_pre_chan_sw_sta(mvm, vif, chsw);
4533                         if (ret)
4534                                 goto out_unlock;
4535                 } else {
4536                         iwl_mvm_schedule_client_csa(mvm, vif, chsw);
4537                 }
4538
4539                 mvmvif->csa_count = chsw->count;
4540                 mvmvif->csa_misbehave = false;
4541                 break;
4542         default:
4543                 break;
4544         }
4545
4546         mvmvif->ps_disabled = true;
4547
4548         ret = iwl_mvm_power_update_ps(mvm);
4549         if (ret)
4550                 goto out_unlock;
4551
4552         /* we won't be on this channel any longer */
4553         iwl_mvm_teardown_tdls_peers(mvm);
4554
4555 out_unlock:
4556         mutex_unlock(&mvm->mutex);
4557
4558         return ret;
4559 }
4560
4561 static void iwl_mvm_channel_switch_rx_beacon(struct ieee80211_hw *hw,
4562                                              struct ieee80211_vif *vif,
4563                                              struct ieee80211_channel_switch *chsw)
4564 {
4565         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4566         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4567         struct iwl_chan_switch_te_cmd cmd = {
4568                 .mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
4569                                                           mvmvif->color)),
4570                 .action = cpu_to_le32(FW_CTXT_ACTION_MODIFY),
4571                 .tsf = cpu_to_le32(chsw->timestamp),
4572                 .cs_count = chsw->count,
4573                 .cs_mode = chsw->block_tx,
4574         };
4575
4576         if (!fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_CS_MODIFY))
4577                 return;
4578
4579         if (chsw->count >= mvmvif->csa_count && chsw->block_tx) {
4580                 if (mvmvif->csa_misbehave) {
4581                         /* Second time, give up on this AP*/
4582                         iwl_mvm_abort_channel_switch(hw, vif);
4583                         ieee80211_chswitch_done(vif, false);
4584                         mvmvif->csa_misbehave = false;
4585                         return;
4586                 }
4587                 mvmvif->csa_misbehave = true;
4588         }
4589         mvmvif->csa_count = chsw->count;
4590
4591         IWL_DEBUG_MAC80211(mvm, "Modify CSA on mac %d\n", mvmvif->id);
4592
4593         WARN_ON(iwl_mvm_send_cmd_pdu(mvm,
4594                                      WIDE_ID(MAC_CONF_GROUP,
4595                                              CHANNEL_SWITCH_TIME_EVENT_CMD),
4596                                      CMD_ASYNC, sizeof(cmd), &cmd));
4597 }
4598
4599 static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop)
4600 {
4601         int i;
4602
4603         if (!iwl_mvm_has_new_tx_api(mvm)) {
4604                 if (drop) {
4605                         mutex_lock(&mvm->mutex);
4606                         iwl_mvm_flush_tx_path(mvm,
4607                                 iwl_mvm_flushable_queues(mvm) & queues, 0);
4608                         mutex_unlock(&mvm->mutex);
4609                 } else {
4610                         iwl_trans_wait_tx_queues_empty(mvm->trans, queues);
4611                 }
4612                 return;
4613         }
4614
4615         mutex_lock(&mvm->mutex);
4616         for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
4617                 struct ieee80211_sta *sta;
4618
4619                 sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
4620                                                 lockdep_is_held(&mvm->mutex));
4621                 if (IS_ERR_OR_NULL(sta))
4622                         continue;
4623
4624                 if (drop)
4625                         iwl_mvm_flush_sta_tids(mvm, i, 0xFF, 0);
4626                 else
4627                         iwl_mvm_wait_sta_queues_empty(mvm,
4628                                         iwl_mvm_sta_from_mac80211(sta));
4629         }
4630         mutex_unlock(&mvm->mutex);
4631 }
4632
4633 static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
4634                               struct ieee80211_vif *vif, u32 queues, bool drop)
4635 {
4636         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4637         struct iwl_mvm_vif *mvmvif;
4638         struct iwl_mvm_sta *mvmsta;
4639         struct ieee80211_sta *sta;
4640         int i;
4641         u32 msk = 0;
4642
4643         if (!vif) {
4644                 iwl_mvm_flush_no_vif(mvm, queues, drop);
4645                 return;
4646         }
4647
4648         if (vif->type != NL80211_IFTYPE_STATION)
4649                 return;
4650
4651         /* Make sure we're done with the deferred traffic before flushing */
4652         flush_work(&mvm->add_stream_wk);
4653
4654         mutex_lock(&mvm->mutex);
4655         mvmvif = iwl_mvm_vif_from_mac80211(vif);
4656
4657         /* flush the AP-station and all TDLS peers */
4658         for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
4659                 sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
4660                                                 lockdep_is_held(&mvm->mutex));
4661                 if (IS_ERR_OR_NULL(sta))
4662                         continue;
4663
4664                 mvmsta = iwl_mvm_sta_from_mac80211(sta);
4665                 if (mvmsta->vif != vif)
4666                         continue;
4667
4668                 /* make sure only TDLS peers or the AP are flushed */
4669                 WARN_ON(i != mvmvif->ap_sta_id && !sta->tdls);
4670
4671                 if (drop) {
4672                         if (iwl_mvm_flush_sta(mvm, mvmsta, false, 0))
4673                                 IWL_ERR(mvm, "flush request fail\n");
4674                 } else {
4675                         msk |= mvmsta->tfd_queue_msk;
4676                         if (iwl_mvm_has_new_tx_api(mvm))
4677                                 iwl_mvm_wait_sta_queues_empty(mvm, mvmsta);
4678                 }
4679         }
4680
4681         mutex_unlock(&mvm->mutex);
4682
4683         /* this can take a while, and we may need/want other operations
4684          * to succeed while doing this, so do it without the mutex held
4685          */
4686         if (!drop && !iwl_mvm_has_new_tx_api(mvm))
4687                 iwl_trans_wait_tx_queues_empty(mvm->trans, msk);
4688 }
4689
4690 static int iwl_mvm_mac_get_survey(struct ieee80211_hw *hw, int idx,
4691                                   struct survey_info *survey)
4692 {
4693         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4694         int ret;
4695
4696         memset(survey, 0, sizeof(*survey));
4697
4698         /* only support global statistics right now */
4699         if (idx != 0)
4700                 return -ENOENT;
4701
4702         if (!fw_has_capa(&mvm->fw->ucode_capa,
4703                          IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
4704                 return -ENOENT;
4705
4706         mutex_lock(&mvm->mutex);
4707
4708         if (iwl_mvm_firmware_running(mvm)) {
4709                 ret = iwl_mvm_request_statistics(mvm, false);
4710                 if (ret)
4711                         goto out;
4712         }
4713
4714         survey->filled = SURVEY_INFO_TIME |
4715                          SURVEY_INFO_TIME_RX |
4716                          SURVEY_INFO_TIME_TX |
4717                          SURVEY_INFO_TIME_SCAN;
4718         survey->time = mvm->accu_radio_stats.on_time_rf +
4719                        mvm->radio_stats.on_time_rf;
4720         do_div(survey->time, USEC_PER_MSEC);
4721
4722         survey->time_rx = mvm->accu_radio_stats.rx_time +
4723                           mvm->radio_stats.rx_time;
4724         do_div(survey->time_rx, USEC_PER_MSEC);
4725
4726         survey->time_tx = mvm->accu_radio_stats.tx_time +
4727                           mvm->radio_stats.tx_time;
4728         do_div(survey->time_tx, USEC_PER_MSEC);
4729
4730         survey->time_scan = mvm->accu_radio_stats.on_time_scan +
4731                             mvm->radio_stats.on_time_scan;
4732         do_div(survey->time_scan, USEC_PER_MSEC);
4733
4734         ret = 0;
4735  out:
4736         mutex_unlock(&mvm->mutex);
4737         return ret;
4738 }
4739
4740 static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,
4741                                        struct ieee80211_vif *vif,
4742                                        struct ieee80211_sta *sta,
4743                                        struct station_info *sinfo)
4744 {
4745         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4746         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4747         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
4748
4749         if (mvmsta->avg_energy) {
4750                 sinfo->signal_avg = mvmsta->avg_energy;
4751                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
4752         }
4753
4754         /* if beacon filtering isn't on mac80211 does it anyway */
4755         if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
4756                 return;
4757
4758         if (!vif->bss_conf.assoc)
4759                 return;
4760
4761         mutex_lock(&mvm->mutex);
4762
4763         if (mvmvif->ap_sta_id != mvmsta->sta_id)
4764                 goto unlock;
4765
4766         if (iwl_mvm_request_statistics(mvm, false))
4767                 goto unlock;
4768
4769         sinfo->rx_beacon = mvmvif->beacon_stats.num_beacons +
4770                            mvmvif->beacon_stats.accu_num_beacons;
4771         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_RX);
4772         if (mvmvif->beacon_stats.avg_signal) {
4773                 /* firmware only reports a value after RXing a few beacons */
4774                 sinfo->rx_beacon_signal_avg = mvmvif->beacon_stats.avg_signal;
4775                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG);
4776         }
4777  unlock:
4778         mutex_unlock(&mvm->mutex);
4779 }
4780
4781 static void iwl_mvm_event_mlme_callback(struct iwl_mvm *mvm,
4782                                         struct ieee80211_vif *vif,
4783                                         const struct ieee80211_event *event)
4784 {
4785 #define CHECK_MLME_TRIGGER(_cnt, _fmt...)                               \
4786         do {                                                            \
4787                 if ((trig_mlme->_cnt) && --(trig_mlme->_cnt))           \
4788                         break;                                          \
4789                 iwl_fw_dbg_collect_trig(&(mvm)->fwrt, trig, _fmt);      \
4790         } while (0)
4791
4792         struct iwl_fw_dbg_trigger_tlv *trig;
4793         struct iwl_fw_dbg_trigger_mlme *trig_mlme;
4794
4795         trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
4796                                      FW_DBG_TRIGGER_MLME);
4797         if (!trig)
4798                 return;
4799
4800         trig_mlme = (void *)trig->data;
4801
4802         if (event->u.mlme.data == ASSOC_EVENT) {
4803                 if (event->u.mlme.status == MLME_DENIED)
4804                         CHECK_MLME_TRIGGER(stop_assoc_denied,
4805                                            "DENIED ASSOC: reason %d",
4806                                             event->u.mlme.reason);
4807                 else if (event->u.mlme.status == MLME_TIMEOUT)
4808                         CHECK_MLME_TRIGGER(stop_assoc_timeout,
4809                                            "ASSOC TIMEOUT");
4810         } else if (event->u.mlme.data == AUTH_EVENT) {
4811                 if (event->u.mlme.status == MLME_DENIED)
4812                         CHECK_MLME_TRIGGER(stop_auth_denied,
4813                                            "DENIED AUTH: reason %d",
4814                                            event->u.mlme.reason);
4815                 else if (event->u.mlme.status == MLME_TIMEOUT)
4816                         CHECK_MLME_TRIGGER(stop_auth_timeout,
4817                                            "AUTH TIMEOUT");
4818         } else if (event->u.mlme.data == DEAUTH_RX_EVENT) {
4819                 CHECK_MLME_TRIGGER(stop_rx_deauth,
4820                                    "DEAUTH RX %d", event->u.mlme.reason);
4821         } else if (event->u.mlme.data == DEAUTH_TX_EVENT) {
4822                 CHECK_MLME_TRIGGER(stop_tx_deauth,
4823                                    "DEAUTH TX %d", event->u.mlme.reason);
4824         }
4825 #undef CHECK_MLME_TRIGGER
4826 }
4827
4828 static void iwl_mvm_event_bar_rx_callback(struct iwl_mvm *mvm,
4829                                           struct ieee80211_vif *vif,
4830                                           const struct ieee80211_event *event)
4831 {
4832         struct iwl_fw_dbg_trigger_tlv *trig;
4833         struct iwl_fw_dbg_trigger_ba *ba_trig;
4834
4835         trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
4836                                      FW_DBG_TRIGGER_BA);
4837         if (!trig)
4838                 return;
4839
4840         ba_trig = (void *)trig->data;
4841
4842         if (!(le16_to_cpu(ba_trig->rx_bar) & BIT(event->u.ba.tid)))
4843                 return;
4844
4845         iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
4846                                 "BAR received from %pM, tid %d, ssn %d",
4847                                 event->u.ba.sta->addr, event->u.ba.tid,
4848                                 event->u.ba.ssn);
4849 }
4850
4851 static void iwl_mvm_mac_event_callback(struct ieee80211_hw *hw,
4852                                        struct ieee80211_vif *vif,
4853                                        const struct ieee80211_event *event)
4854 {
4855         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4856
4857         switch (event->type) {
4858         case MLME_EVENT:
4859                 iwl_mvm_event_mlme_callback(mvm, vif, event);
4860                 break;
4861         case BAR_RX_EVENT:
4862                 iwl_mvm_event_bar_rx_callback(mvm, vif, event);
4863                 break;
4864         case BA_FRAME_TIMEOUT:
4865                 iwl_mvm_event_frame_timeout_callback(mvm, vif, event->u.ba.sta,
4866                                                      event->u.ba.tid);
4867                 break;
4868         default:
4869                 break;
4870         }
4871 }
4872
4873 void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm,
4874                                      struct iwl_mvm_internal_rxq_notif *notif,
4875                                      u32 size)
4876 {
4877         u32 qmask = BIT(mvm->trans->num_rx_queues) - 1;
4878         int ret;
4879
4880
4881         if (!iwl_mvm_has_new_rx_api(mvm))
4882                 return;
4883
4884         notif->cookie = mvm->queue_sync_cookie;
4885
4886         if (notif->sync)
4887                 atomic_set(&mvm->queue_sync_counter,
4888                            mvm->trans->num_rx_queues);
4889
4890         ret = iwl_mvm_notify_rx_queue(mvm, qmask, (u8 *)notif,
4891                                       size, !notif->sync);
4892         if (ret) {
4893                 IWL_ERR(mvm, "Failed to trigger RX queues sync (%d)\n", ret);
4894                 goto out;
4895         }
4896
4897         if (notif->sync) {
4898                 lockdep_assert_held(&mvm->mutex);
4899                 ret = wait_event_timeout(mvm->rx_sync_waitq,
4900                                          atomic_read(&mvm->queue_sync_counter) == 0 ||
4901                                          iwl_mvm_is_radio_killed(mvm),
4902                                          HZ);
4903                 WARN_ON_ONCE(!ret && !iwl_mvm_is_radio_killed(mvm));
4904         }
4905
4906 out:
4907         atomic_set(&mvm->queue_sync_counter, 0);
4908         mvm->queue_sync_cookie++;
4909 }
4910
4911 static void iwl_mvm_sync_rx_queues(struct ieee80211_hw *hw)
4912 {
4913         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4914         struct iwl_mvm_internal_rxq_notif data = {
4915                 .type = IWL_MVM_RXQ_EMPTY,
4916                 .sync = 1,
4917         };
4918
4919         mutex_lock(&mvm->mutex);
4920         iwl_mvm_sync_rx_queues_internal(mvm, &data, sizeof(data));
4921         mutex_unlock(&mvm->mutex);
4922 }
4923
4924 static int
4925 iwl_mvm_mac_get_ftm_responder_stats(struct ieee80211_hw *hw,
4926                                     struct ieee80211_vif *vif,
4927                                     struct cfg80211_ftm_responder_stats *stats)
4928 {
4929         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4930         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4931
4932         if (vif->p2p || vif->type != NL80211_IFTYPE_AP ||
4933             !mvmvif->ap_ibss_active || !vif->bss_conf.ftm_responder)
4934                 return -EINVAL;
4935
4936         mutex_lock(&mvm->mutex);
4937         *stats = mvm->ftm_resp_stats;
4938         mutex_unlock(&mvm->mutex);
4939
4940         stats->filled = BIT(NL80211_FTM_STATS_SUCCESS_NUM) |
4941                         BIT(NL80211_FTM_STATS_PARTIAL_NUM) |
4942                         BIT(NL80211_FTM_STATS_FAILED_NUM) |
4943                         BIT(NL80211_FTM_STATS_ASAP_NUM) |
4944                         BIT(NL80211_FTM_STATS_NON_ASAP_NUM) |
4945                         BIT(NL80211_FTM_STATS_TOTAL_DURATION_MSEC) |
4946                         BIT(NL80211_FTM_STATS_UNKNOWN_TRIGGERS_NUM) |
4947                         BIT(NL80211_FTM_STATS_RESCHEDULE_REQUESTS_NUM) |
4948                         BIT(NL80211_FTM_STATS_OUT_OF_WINDOW_TRIGGERS_NUM);
4949
4950         return 0;
4951 }
4952
4953 static int iwl_mvm_start_pmsr(struct ieee80211_hw *hw,
4954                               struct ieee80211_vif *vif,
4955                               struct cfg80211_pmsr_request *request)
4956 {
4957         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4958         int ret;
4959
4960         mutex_lock(&mvm->mutex);
4961         ret = iwl_mvm_ftm_start(mvm, vif, request);
4962         mutex_unlock(&mvm->mutex);
4963
4964         return ret;
4965 }
4966
4967 static void iwl_mvm_abort_pmsr(struct ieee80211_hw *hw,
4968                                struct ieee80211_vif *vif,
4969                                struct cfg80211_pmsr_request *request)
4970 {
4971         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4972
4973         mutex_lock(&mvm->mutex);
4974         iwl_mvm_ftm_abort(mvm, request);
4975         mutex_unlock(&mvm->mutex);
4976 }
4977
4978 static bool iwl_mvm_can_hw_csum(struct sk_buff *skb)
4979 {
4980         u8 protocol = ip_hdr(skb)->protocol;
4981
4982         if (!IS_ENABLED(CONFIG_INET))
4983                 return false;
4984
4985         return protocol == IPPROTO_TCP || protocol == IPPROTO_UDP;
4986 }
4987
4988 static bool iwl_mvm_mac_can_aggregate(struct ieee80211_hw *hw,
4989                                       struct sk_buff *head,
4990                                       struct sk_buff *skb)
4991 {
4992         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4993
4994         /* For now don't aggregate IPv6 in AMSDU */
4995         if (skb->protocol != htons(ETH_P_IP))
4996                 return false;
4997
4998         if (!iwl_mvm_is_csum_supported(mvm))
4999                 return true;
5000
5001         return iwl_mvm_can_hw_csum(skb) == iwl_mvm_can_hw_csum(head);
5002 }
5003
5004 const struct ieee80211_ops iwl_mvm_hw_ops = {
5005         .tx = iwl_mvm_mac_tx,
5006         .wake_tx_queue = iwl_mvm_mac_wake_tx_queue,
5007         .ampdu_action = iwl_mvm_mac_ampdu_action,
5008         .start = iwl_mvm_mac_start,
5009         .reconfig_complete = iwl_mvm_mac_reconfig_complete,
5010         .stop = iwl_mvm_mac_stop,
5011         .add_interface = iwl_mvm_mac_add_interface,
5012         .remove_interface = iwl_mvm_mac_remove_interface,
5013         .config = iwl_mvm_mac_config,
5014         .prepare_multicast = iwl_mvm_prepare_multicast,
5015         .configure_filter = iwl_mvm_configure_filter,
5016         .config_iface_filter = iwl_mvm_config_iface_filter,
5017         .bss_info_changed = iwl_mvm_bss_info_changed,
5018         .hw_scan = iwl_mvm_mac_hw_scan,
5019         .cancel_hw_scan = iwl_mvm_mac_cancel_hw_scan,
5020         .sta_pre_rcu_remove = iwl_mvm_sta_pre_rcu_remove,
5021         .sta_state = iwl_mvm_mac_sta_state,
5022         .sta_notify = iwl_mvm_mac_sta_notify,
5023         .allow_buffered_frames = iwl_mvm_mac_allow_buffered_frames,
5024         .release_buffered_frames = iwl_mvm_mac_release_buffered_frames,
5025         .set_rts_threshold = iwl_mvm_mac_set_rts_threshold,
5026         .sta_rc_update = iwl_mvm_sta_rc_update,
5027         .conf_tx = iwl_mvm_mac_conf_tx,
5028         .mgd_prepare_tx = iwl_mvm_mac_mgd_prepare_tx,
5029         .mgd_protect_tdls_discover = iwl_mvm_mac_mgd_protect_tdls_discover,
5030         .flush = iwl_mvm_mac_flush,
5031         .sched_scan_start = iwl_mvm_mac_sched_scan_start,
5032         .sched_scan_stop = iwl_mvm_mac_sched_scan_stop,
5033         .set_key = iwl_mvm_mac_set_key,
5034         .update_tkip_key = iwl_mvm_mac_update_tkip_key,
5035         .remain_on_channel = iwl_mvm_roc,
5036         .cancel_remain_on_channel = iwl_mvm_cancel_roc,
5037         .add_chanctx = iwl_mvm_add_chanctx,
5038         .remove_chanctx = iwl_mvm_remove_chanctx,
5039         .change_chanctx = iwl_mvm_change_chanctx,
5040         .assign_vif_chanctx = iwl_mvm_assign_vif_chanctx,
5041         .unassign_vif_chanctx = iwl_mvm_unassign_vif_chanctx,
5042         .switch_vif_chanctx = iwl_mvm_switch_vif_chanctx,
5043
5044         .start_ap = iwl_mvm_start_ap_ibss,
5045         .stop_ap = iwl_mvm_stop_ap_ibss,
5046         .join_ibss = iwl_mvm_start_ap_ibss,
5047         .leave_ibss = iwl_mvm_stop_ap_ibss,
5048
5049         .tx_last_beacon = iwl_mvm_tx_last_beacon,
5050
5051         .set_tim = iwl_mvm_set_tim,
5052
5053         .channel_switch = iwl_mvm_channel_switch,
5054         .pre_channel_switch = iwl_mvm_pre_channel_switch,
5055         .post_channel_switch = iwl_mvm_post_channel_switch,
5056         .abort_channel_switch = iwl_mvm_abort_channel_switch,
5057         .channel_switch_rx_beacon = iwl_mvm_channel_switch_rx_beacon,
5058
5059         .tdls_channel_switch = iwl_mvm_tdls_channel_switch,
5060         .tdls_cancel_channel_switch = iwl_mvm_tdls_cancel_channel_switch,
5061         .tdls_recv_channel_switch = iwl_mvm_tdls_recv_channel_switch,
5062
5063         .event_callback = iwl_mvm_mac_event_callback,
5064
5065         .sync_rx_queues = iwl_mvm_sync_rx_queues,
5066
5067         CFG80211_TESTMODE_CMD(iwl_mvm_mac_testmode_cmd)
5068
5069 #ifdef CONFIG_PM_SLEEP
5070         /* look at d3.c */
5071         .suspend = iwl_mvm_suspend,
5072         .resume = iwl_mvm_resume,
5073         .set_wakeup = iwl_mvm_set_wakeup,
5074         .set_rekey_data = iwl_mvm_set_rekey_data,
5075 #if IS_ENABLED(CONFIG_IPV6)
5076         .ipv6_addr_change = iwl_mvm_ipv6_addr_change,
5077 #endif
5078         .set_default_unicast_key = iwl_mvm_set_default_unicast_key,
5079 #endif
5080         .get_survey = iwl_mvm_mac_get_survey,
5081         .sta_statistics = iwl_mvm_mac_sta_statistics,
5082         .get_ftm_responder_stats = iwl_mvm_mac_get_ftm_responder_stats,
5083         .start_pmsr = iwl_mvm_start_pmsr,
5084         .abort_pmsr = iwl_mvm_abort_pmsr,
5085
5086         .can_aggregate_in_amsdu = iwl_mvm_mac_can_aggregate,
5087 #ifdef CONFIG_IWLWIFI_DEBUGFS
5088         .sta_add_debugfs = iwl_mvm_sta_add_debugfs,
5089 #endif
5090 };