drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c

   1 /******************************************************************************
   2  *
   3  * This file is provided under a dual BSD/GPLv2 license.  When using or
   4  * redistributing this file, you may do so under either license.
   5  *
   6  * GPL LICENSE SUMMARY
   7  *
   8  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
   9  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  10  * Copyright(c) 2012 - 2014, 2018 - 2020 Intel Corporation
  11  *
  12  * This program is free software; you can redistribute it and/or modify
  13  * it under the terms of version 2 of the GNU General Public License as
  14  * published by the Free Software Foundation.
  15  *
  16  * This program is distributed in the hope that it will be useful, but
  17  * WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  19  * General Public License for more details.
  20  *
  21  * The full GNU General Public License is included in this distribution
  22  * in the file called COPYING.
  23  *
  24  * Contact Information:
  25  *  Intel Linux Wireless <linuxwifi@intel.com>
  26  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  27  *
  28  * BSD LICENSE
  29  *
  30  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  31  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  32  * Copyright(c) 2012 - 2014, 2018 - 2020 Intel Corporation
  33  * All rights reserved.
  34  *
  35  * Redistribution and use in source and binary forms, with or without
  36  * modification, are permitted provided that the following conditions
  37  * are met:
  38  *
  39  *  * Redistributions of source code must retain the above copyright
  40  *    notice, this list of conditions and the following disclaimer.
  41  *  * Redistributions in binary form must reproduce the above copyright
  42  *    notice, this list of conditions and the following disclaimer in
  43  *    the documentation and/or other materials provided with the
  44  *    distribution.
  45  *  * Neither the name Intel Corporation nor the names of its
  46  *    contributors may be used to endorse or promote products derived
  47  *    from this software without specific prior written permission.
  48  *
  49  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  50  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  51  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  52  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  53  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  54  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  55  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  56  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  57  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  58  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  59  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  60  *
  61  *****************************************************************************/
  62 #include <linux/kernel.h>
  63 #include <linux/slab.h>
  64 #include <linux/skbuff.h>
  65 #include <linux/netdevice.h>
  66 #include <linux/etherdevice.h>
  67 #include <linux/ip.h>
  68 #include <linux/if_arp.h>
  69 #include <linux/time.h>
  70 #include <net/mac80211.h>
  71 #include <net/ieee80211_radiotap.h>
  72 #include <net/tcp.h>
  73
  74 #include "iwl-op-mode.h"
  75 #include "iwl-io.h"
  76 #include "mvm.h"
  77 #include "sta.h"
  78 #include "time-event.h"
  79 #include "iwl-eeprom-parse.h"
  80 #include "iwl-phy-db.h"
  81 #include "testmode.h"
  82 #include "fw/error-dump.h"
  83 #include "iwl-prph.h"
  84 #include "iwl-nvm-parse.h"
  85
  86 static const struct ieee80211_iface_limit iwl_mvm_limits[] = {
  87         {
  88                 .max = 1,
  89                 .types = BIT(NL80211_IFTYPE_STATION),
  90         },
  91         {
  92                 .max = 1,
  93                 .types = BIT(NL80211_IFTYPE_AP) |
  94                         BIT(NL80211_IFTYPE_P2P_CLIENT) |
  95                         BIT(NL80211_IFTYPE_P2P_GO),
  96         },
  97         {
  98                 .max = 1,
  99                 .types = BIT(NL80211_IFTYPE_P2P_DEVICE),
 100         },
 101 };
 102
 103 static const struct ieee80211_iface_combination iwl_mvm_iface_combinations[] = {
 104         {
 105                 .num_different_channels = 2,
 106                 .max_interfaces = 3,
 107                 .limits = iwl_mvm_limits,
 108                 .n_limits = ARRAY_SIZE(iwl_mvm_limits),
 109         },
 110 };
 111
 112 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
 113 /*
 114  * Use the reserved field to indicate magic values.
 115  * these values will only be used internally by the driver,
 116  * and won't make it to the fw (reserved will be 0).
 117  * BC_FILTER_MAGIC_IP - configure the val of this attribute to
 118  *      be the vif's ip address. in case there is not a single
 119  *      ip address (0, or more than 1), this attribute will
 120  *      be skipped.
 121  * BC_FILTER_MAGIC_MAC - set the val of this attribute to
 122  *      the LSB bytes of the vif's mac address
 123  */
 124 enum {
 125         BC_FILTER_MAGIC_NONE = 0,
 126         BC_FILTER_MAGIC_IP,
 127         BC_FILTER_MAGIC_MAC,
 128 };
 129
 130 static const struct iwl_fw_bcast_filter iwl_mvm_default_bcast_filters[] = {
 131         {
 132                 /* arp */
 133                 .discard = 0,
 134                 .frame_type = BCAST_FILTER_FRAME_TYPE_ALL,
 135                 .attrs = {
 136                         {
 137                                 /* frame type - arp, hw type - ethernet */
 138                                 .offset_type =
 139                                         BCAST_FILTER_OFFSET_PAYLOAD_START,
 140                                 .offset = sizeof(rfc1042_header),
 141                                 .val = cpu_to_be32(0x08060001),
 142                                 .mask = cpu_to_be32(0xffffffff),
 143                         },
 144                         {
 145                                 /* arp dest ip */
 146                                 .offset_type =
 147                                         BCAST_FILTER_OFFSET_PAYLOAD_START,
 148                                 .offset = sizeof(rfc1042_header) + 2 +
 149                                           sizeof(struct arphdr) +
 150                                           ETH_ALEN + sizeof(__be32) +
 151                                           ETH_ALEN,
 152                                 .mask = cpu_to_be32(0xffffffff),
 153                                 /* mark it as special field */
 154                                 .reserved1 = cpu_to_le16(BC_FILTER_MAGIC_IP),
 155                         },
 156                 },
 157         },
 158         {
 159                 /* dhcp offer bcast */
 160                 .discard = 0,
 161                 .frame_type = BCAST_FILTER_FRAME_TYPE_IPV4,
 162                 .attrs = {
 163                         {
 164                                 /* udp dest port - 68 (bootp client)*/
 165                                 .offset_type = BCAST_FILTER_OFFSET_IP_END,
 166                                 .offset = offsetof(struct udphdr, dest),
 167                                 .val = cpu_to_be32(0x00440000),
 168                                 .mask = cpu_to_be32(0xffff0000),
 169                         },
 170                         {
 171                                 /* dhcp - lsb bytes of client hw address */
 172                                 .offset_type = BCAST_FILTER_OFFSET_IP_END,
 173                                 .offset = 38,
 174                                 .mask = cpu_to_be32(0xffffffff),
 175                                 /* mark it as special field */
 176                                 .reserved1 = cpu_to_le16(BC_FILTER_MAGIC_MAC),
 177                         },
 178                 },
 179         },
 180         /* last filter must be empty */
 181         {},
 182 };
 183 #endif
 184
 185 static const struct cfg80211_pmsr_capabilities iwl_mvm_pmsr_capa = {
 186         .max_peers = IWL_MVM_TOF_MAX_APS,
 187         .report_ap_tsf = 1,
 188         .randomize_mac_addr = 1,
 189
 190         .ftm = {
 191                 .supported = 1,
 192                 .asap = 1,
 193                 .non_asap = 1,
 194                 .request_lci = 1,
 195                 .request_civicloc = 1,
 196                 .max_bursts_exponent = -1, /* all supported */
 197                 .max_ftms_per_burst = 0, /* no limits */
 198                 .bandwidths = BIT(NL80211_CHAN_WIDTH_20_NOHT) |
 199                               BIT(NL80211_CHAN_WIDTH_20) |
 200                               BIT(NL80211_CHAN_WIDTH_40) |
 201                               BIT(NL80211_CHAN_WIDTH_80),
 202                 .preambles = BIT(NL80211_PREAMBLE_LEGACY) |
 203                              BIT(NL80211_PREAMBLE_HT) |
 204                              BIT(NL80211_PREAMBLE_VHT),
 205         },
 206 };
 207
 208 static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
 209                                  enum set_key_cmd cmd,
 210                                  struct ieee80211_vif *vif,
 211                                  struct ieee80211_sta *sta,
 212                                  struct ieee80211_key_conf *key);
 213
 214 static void iwl_mvm_reset_phy_ctxts(struct iwl_mvm *mvm)
 215 {
 216         int i;
 217
 218         memset(mvm->phy_ctxts, 0, sizeof(mvm->phy_ctxts));
 219         for (i = 0; i < NUM_PHY_CTX; i++) {
 220                 mvm->phy_ctxts[i].id = i;
 221                 mvm->phy_ctxts[i].ref = 0;
 222         }
 223 }
 224
 225 struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
 226                                                   const char *alpha2,
 227                                                   enum iwl_mcc_source src_id,
 228                                                   bool *changed)
 229 {
 230         struct ieee80211_regdomain *regd = NULL;
 231         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
 232         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 233         struct iwl_mcc_update_resp *resp;
 234
 235         IWL_DEBUG_LAR(mvm, "Getting regdomain data for %s from FW\n", alpha2);
 236
 237         lockdep_assert_held(&mvm->mutex);
 238
 239         resp = iwl_mvm_update_mcc(mvm, alpha2, src_id);
 240         if (IS_ERR_OR_NULL(resp)) {
 241                 IWL_DEBUG_LAR(mvm, "Could not get update from FW %d\n",
 242                               PTR_ERR_OR_ZERO(resp));
 243                 goto out;
 244         }
 245
 246         if (changed) {
 247                 u32 status = le32_to_cpu(resp->status);
 248
 249                 *changed = (status == MCC_RESP_NEW_CHAN_PROFILE ||
 250                             status == MCC_RESP_ILLEGAL);
 251         }
 252
 253         regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg,
 254                                       __le32_to_cpu(resp->n_channels),
 255                                       resp->channels,
 256                                       __le16_to_cpu(resp->mcc),
 257                                       __le16_to_cpu(resp->geo_info),
 258                                       __le16_to_cpu(resp->cap));
 259         /* Store the return source id */
 260         src_id = resp->source_id;
 261         kfree(resp);
 262         if (IS_ERR_OR_NULL(regd)) {
 263                 IWL_DEBUG_LAR(mvm, "Could not get parse update from FW %d\n",
 264                               PTR_ERR_OR_ZERO(regd));
 265                 goto out;
 266         }
 267
 268         IWL_DEBUG_LAR(mvm, "setting alpha2 from FW to %s (0x%x, 0x%x) src=%d\n",
 269                       regd->alpha2, regd->alpha2[0], regd->alpha2[1], src_id);
 270         mvm->lar_regdom_set = true;
 271         mvm->mcc_src = src_id;
 272
 273 out:
 274         return regd;
 275 }
 276
 277 void iwl_mvm_update_changed_regdom(struct iwl_mvm *mvm)
 278 {
 279         bool changed;
 280         struct ieee80211_regdomain *regd;
 281
 282         if (!iwl_mvm_is_lar_supported(mvm))
 283                 return;
 284
 285         regd = iwl_mvm_get_current_regdomain(mvm, &changed);
 286         if (!IS_ERR_OR_NULL(regd)) {
 287                 /* only update the regulatory core if changed */
 288                 if (changed)
 289                         regulatory_set_wiphy_regd(mvm->hw->wiphy, regd);
 290
 291                 kfree(regd);
 292         }
 293 }
 294
 295 struct ieee80211_regdomain *iwl_mvm_get_current_regdomain(struct iwl_mvm *mvm,
 296                                                           bool *changed)
 297 {
 298         return iwl_mvm_get_regdomain(mvm->hw->wiphy, "ZZ",
 299                                      iwl_mvm_is_wifi_mcc_supported(mvm) ?
 300                                      MCC_SOURCE_GET_CURRENT :
 301                                      MCC_SOURCE_OLD_FW, changed);
 302 }
 303
 304 int iwl_mvm_init_fw_regd(struct iwl_mvm *mvm)
 305 {
 306         enum iwl_mcc_source used_src;
 307         struct ieee80211_regdomain *regd;
 308         int ret;
 309         bool changed;
 310         const struct ieee80211_regdomain *r =
 311                         rtnl_dereference(mvm->hw->wiphy->regd);
 312
 313         if (!r)
 314                 return -ENOENT;
 315
 316         /* save the last source in case we overwrite it below */
 317         used_src = mvm->mcc_src;
 318         if (iwl_mvm_is_wifi_mcc_supported(mvm)) {
 319                 /* Notify the firmware we support wifi location updates */
 320                 regd = iwl_mvm_get_current_regdomain(mvm, NULL);
 321                 if (!IS_ERR_OR_NULL(regd))
 322                         kfree(regd);
 323         }
 324
 325         /* Now set our last stored MCC and source */
 326         regd = iwl_mvm_get_regdomain(mvm->hw->wiphy, r->alpha2, used_src,
 327                                      &changed);
 328         if (IS_ERR_OR_NULL(regd))
 329                 return -EIO;
 330
 331         /* update cfg80211 if the regdomain was changed */
 332         if (changed)
 333                 ret = regulatory_set_wiphy_regd_sync_rtnl(mvm->hw->wiphy, regd);
 334         else
 335                 ret = 0;
 336
 337         kfree(regd);
 338         return ret;
 339 }
 340
 341 const static u8 he_if_types_ext_capa_sta[] = {
 342          [0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
 343          [2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
 344          [7] = WLAN_EXT_CAPA8_OPMODE_NOTIF,
 345          [9] = WLAN_EXT_CAPA10_TWT_REQUESTER_SUPPORT,
 346 };
 347
 348 const static struct wiphy_iftype_ext_capab he_iftypes_ext_capa[] = {
 349         {
 350                 .iftype = NL80211_IFTYPE_STATION,
 351                 .extended_capabilities = he_if_types_ext_capa_sta,
 352                 .extended_capabilities_mask = he_if_types_ext_capa_sta,
 353                 .extended_capabilities_len = sizeof(he_if_types_ext_capa_sta),
 354         },
 355 };
 356
 357 int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
 358 {
 359         struct ieee80211_hw *hw = mvm->hw;
 360         int num_mac, ret, i;
 361         static const u32 mvm_ciphers[] = {
 362                 WLAN_CIPHER_SUITE_WEP40,
 363                 WLAN_CIPHER_SUITE_WEP104,
 364                 WLAN_CIPHER_SUITE_TKIP,
 365                 WLAN_CIPHER_SUITE_CCMP,
 366         };
 367 #ifdef CONFIG_PM_SLEEP
 368         bool unified = fw_has_capa(&mvm->fw->ucode_capa,
 369                                    IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
 370 #endif
 371
 372         /* Tell mac80211 our characteristics */
 373         ieee80211_hw_set(hw, SIGNAL_DBM);
 374         ieee80211_hw_set(hw, SPECTRUM_MGMT);
 375         ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
 376         ieee80211_hw_set(hw, WANT_MONITOR_VIF);
 377         ieee80211_hw_set(hw, SUPPORTS_PS);
 378         ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
 379         ieee80211_hw_set(hw, AMPDU_AGGREGATION);
 380         ieee80211_hw_set(hw, TIMING_BEACON_ONLY);
 381         ieee80211_hw_set(hw, CONNECTION_MONITOR);
 382         ieee80211_hw_set(hw, CHANCTX_STA_CSA);
 383         ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
 384         ieee80211_hw_set(hw, SUPPORTS_CLONED_SKBS);
 385         ieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);
 386         ieee80211_hw_set(hw, NEEDS_UNIQUE_STA_ADDR);
 387         ieee80211_hw_set(hw, DEAUTH_NEED_MGD_TX_PREP);
 388         ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);
 389         ieee80211_hw_set(hw, BUFF_MMPDU_TXQ);
 390         ieee80211_hw_set(hw, STA_MMPDU_TXQ);
 391         /*
 392          * On older devices, enabling TX A-MSDU occasionally leads to
 393          * something getting messed up, the command read from the FIFO
 394          * gets out of sync and isn't a TX command, so that we have an
 395          * assert EDC.
 396          *
 397          * It's not clear where the bug is, but since we didn't used to
 398          * support A-MSDU until moving the mac80211 iTXQs, just leave it
 399          * for older devices. We also don't see this issue on any newer
 400          * devices.
 401          */
 402         if (mvm->trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_9000)
 403                 ieee80211_hw_set(hw, TX_AMSDU);
 404         ieee80211_hw_set(hw, TX_FRAG_LIST);
 405
 406         if (iwl_mvm_has_tlc_offload(mvm)) {
 407                 ieee80211_hw_set(hw, TX_AMPDU_SETUP_IN_HW);
 408                 ieee80211_hw_set(hw, HAS_RATE_CONTROL);
 409         }
 410
 411         if (iwl_mvm_has_new_rx_api(mvm))
 412                 ieee80211_hw_set(hw, SUPPORTS_REORDERING_BUFFER);
 413
 414         if (fw_has_capa(&mvm->fw->ucode_capa,
 415                         IWL_UCODE_TLV_CAPA_STA_PM_NOTIF)) {
 416                 ieee80211_hw_set(hw, AP_LINK_PS);
 417         } else if (WARN_ON(iwl_mvm_has_new_tx_api(mvm))) {
 418                 /*
 419                  * we absolutely need this for the new TX API since that comes
 420                  * with many more queues than the current code can deal with
 421                  * for station powersave
 422                  */
 423                 return -EINVAL;
 424         }
 425
 426         if (mvm->trans->num_rx_queues > 1)
 427                 ieee80211_hw_set(hw, USES_RSS);
 428
 429         if (mvm->trans->max_skb_frags)
 430                 hw->netdev_features = NETIF_F_HIGHDMA | NETIF_F_SG;
 431
 432         hw->queues = IEEE80211_MAX_QUEUES;
 433         hw->offchannel_tx_hw_queue = IWL_MVM_OFFCHANNEL_QUEUE;
 434         hw->radiotap_mcs_details |= IEEE80211_RADIOTAP_MCS_HAVE_FEC |
 435                                     IEEE80211_RADIOTAP_MCS_HAVE_STBC;
 436         hw->radiotap_vht_details |= IEEE80211_RADIOTAP_VHT_KNOWN_STBC |
 437                 IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED;
 438
 439         hw->radiotap_timestamp.units_pos =
 440                 IEEE80211_RADIOTAP_TIMESTAMP_UNIT_US |
 441                 IEEE80211_RADIOTAP_TIMESTAMP_SPOS_PLCP_SIG_ACQ;
 442         /* this is the case for CCK frames, it's better (only 8) for OFDM */
 443         hw->radiotap_timestamp.accuracy = 22;
 444
 445         if (!iwl_mvm_has_tlc_offload(mvm))
 446                 hw->rate_control_algorithm = RS_NAME;
 447
 448         hw->uapsd_queues = IWL_MVM_UAPSD_QUEUES;
 449         hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
 450         hw->max_tx_fragments = mvm->trans->max_skb_frags;
 451
 452         BUILD_BUG_ON(ARRAY_SIZE(mvm->ciphers) < ARRAY_SIZE(mvm_ciphers) + 6);
 453         memcpy(mvm->ciphers, mvm_ciphers, sizeof(mvm_ciphers));
 454         hw->wiphy->n_cipher_suites = ARRAY_SIZE(mvm_ciphers);
 455         hw->wiphy->cipher_suites = mvm->ciphers;
 456
 457         if (iwl_mvm_has_new_rx_api(mvm)) {
 458                 mvm->ciphers[hw->wiphy->n_cipher_suites] =
 459                         WLAN_CIPHER_SUITE_GCMP;
 460                 hw->wiphy->n_cipher_suites++;
 461                 mvm->ciphers[hw->wiphy->n_cipher_suites] =
 462                         WLAN_CIPHER_SUITE_GCMP_256;
 463                 hw->wiphy->n_cipher_suites++;
 464         }
 465
 466         /* Enable 11w if software crypto is not enabled (as the
 467          * firmware will interpret some mgmt packets, so enabling it
 468          * with software crypto isn't safe).
 469          */
 470         if (!iwlwifi_mod_params.swcrypto) {
 471                 ieee80211_hw_set(hw, MFP_CAPABLE);
 472                 mvm->ciphers[hw->wiphy->n_cipher_suites] =
 473                         WLAN_CIPHER_SUITE_AES_CMAC;
 474                 hw->wiphy->n_cipher_suites++;
 475                 if (iwl_mvm_has_new_rx_api(mvm)) {
 476                         mvm->ciphers[hw->wiphy->n_cipher_suites] =
 477                                 WLAN_CIPHER_SUITE_BIP_GMAC_128;
 478                         hw->wiphy->n_cipher_suites++;
 479                         mvm->ciphers[hw->wiphy->n_cipher_suites] =
 480                                 WLAN_CIPHER_SUITE_BIP_GMAC_256;
 481                         hw->wiphy->n_cipher_suites++;
 482                 }
 483         }
 484
 485         /* currently FW API supports only one optional cipher scheme */
 486         if (mvm->fw->cs[0].cipher) {
 487                 const struct iwl_fw_cipher_scheme *fwcs = &mvm->fw->cs[0];
 488                 struct ieee80211_cipher_scheme *cs = &mvm->cs[0];
 489
 490                 mvm->hw->n_cipher_schemes = 1;
 491
 492                 cs->cipher = le32_to_cpu(fwcs->cipher);
 493                 cs->iftype = BIT(NL80211_IFTYPE_STATION);
 494                 cs->hdr_len = fwcs->hdr_len;
 495                 cs->pn_len = fwcs->pn_len;
 496                 cs->pn_off = fwcs->pn_off;
 497                 cs->key_idx_off = fwcs->key_idx_off;
 498                 cs->key_idx_mask = fwcs->key_idx_mask;
 499                 cs->key_idx_shift = fwcs->key_idx_shift;
 500                 cs->mic_len = fwcs->mic_len;
 501
 502                 mvm->hw->cipher_schemes = mvm->cs;
 503                 mvm->ciphers[hw->wiphy->n_cipher_suites] = cs->cipher;
 504                 hw->wiphy->n_cipher_suites++;
 505         }
 506
 507         if (fw_has_capa(&mvm->fw->ucode_capa,
 508                         IWL_UCODE_TLV_CAPA_FTM_CALIBRATED)) {
 509                 wiphy_ext_feature_set(hw->wiphy,
 510                                       NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
 511                 hw->wiphy->pmsr_capa = &iwl_mvm_pmsr_capa;
 512         }
 513
 514         ieee80211_hw_set(hw, SINGLE_SCAN_ON_ALL_BANDS);
 515         hw->wiphy->features |=
 516                 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR |
 517                 NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR |
 518                 NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
 519
 520         hw->sta_data_size = sizeof(struct iwl_mvm_sta);
 521         hw->vif_data_size = sizeof(struct iwl_mvm_vif);
 522         hw->chanctx_data_size = sizeof(u16);
 523         hw->txq_data_size = sizeof(struct iwl_mvm_txq);
 524
 525         hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
 526                 BIT(NL80211_IFTYPE_P2P_CLIENT) |
 527                 BIT(NL80211_IFTYPE_AP) |
 528                 BIT(NL80211_IFTYPE_P2P_GO) |
 529                 BIT(NL80211_IFTYPE_P2P_DEVICE) |
 530                 BIT(NL80211_IFTYPE_ADHOC);
 531
 532         hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
 533         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
 534         hw->wiphy->features |= NL80211_FEATURE_HT_IBSS;
 535
 536         hw->wiphy->regulatory_flags |= REGULATORY_ENABLE_RELAX_NO_IR;
 537         if (iwl_mvm_is_lar_supported(mvm))
 538                 hw->wiphy->regulatory_flags |= REGULATORY_WIPHY_SELF_MANAGED;
 539         else
 540                 hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG |
 541                                                REGULATORY_DISABLE_BEACON_HINTS;
 542
 543         hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
 544         hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
 545
 546         hw->wiphy->iface_combinations = iwl_mvm_iface_combinations;
 547         hw->wiphy->n_iface_combinations =
 548                 ARRAY_SIZE(iwl_mvm_iface_combinations);
 549
 550         hw->wiphy->max_remain_on_channel_duration = 10000;
 551         hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
 552
 553         /* Extract MAC address */
 554         memcpy(mvm->addresses[0].addr, mvm->nvm_data->hw_addr, ETH_ALEN);
 555         hw->wiphy->addresses = mvm->addresses;
 556         hw->wiphy->n_addresses = 1;
 557
 558         /* Extract additional MAC addresses if available */
 559         num_mac = (mvm->nvm_data->n_hw_addrs > 1) ?
 560                 min(IWL_MVM_MAX_ADDRESSES, mvm->nvm_data->n_hw_addrs) : 1;
 561
 562         for (i = 1; i < num_mac; i++) {
 563                 memcpy(mvm->addresses[i].addr, mvm->addresses[i-1].addr,
 564                        ETH_ALEN);
 565                 mvm->addresses[i].addr[5]++;
 566                 hw->wiphy->n_addresses++;
 567         }
 568
 569         iwl_mvm_reset_phy_ctxts(mvm);
 570
 571         hw->wiphy->max_scan_ie_len = iwl_mvm_max_scan_ie_len(mvm);
 572
 573         hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
 574
 575         BUILD_BUG_ON(IWL_MVM_SCAN_STOPPING_MASK & IWL_MVM_SCAN_MASK);
 576         BUILD_BUG_ON(IWL_MVM_MAX_UMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK) ||
 577                      IWL_MVM_MAX_LMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK));
 578
 579         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
 580                 mvm->max_scans = IWL_MVM_MAX_UMAC_SCANS;
 581         else
 582                 mvm->max_scans = IWL_MVM_MAX_LMAC_SCANS;
 583
 584         if (mvm->nvm_data->bands[NL80211_BAND_2GHZ].n_channels)
 585                 hw->wiphy->bands[NL80211_BAND_2GHZ] =
 586                         &mvm->nvm_data->bands[NL80211_BAND_2GHZ];
 587         if (mvm->nvm_data->bands[NL80211_BAND_5GHZ].n_channels) {
 588                 hw->wiphy->bands[NL80211_BAND_5GHZ] =
 589                         &mvm->nvm_data->bands[NL80211_BAND_5GHZ];
 590
 591                 if (fw_has_capa(&mvm->fw->ucode_capa,
 592                                 IWL_UCODE_TLV_CAPA_BEAMFORMER) &&
 593                     fw_has_api(&mvm->fw->ucode_capa,
 594                                IWL_UCODE_TLV_API_LQ_SS_PARAMS))
 595                         hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.cap |=
 596                                 IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
 597         }
 598
 599         hw->wiphy->hw_version = mvm->trans->hw_id;
 600
 601         if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM)
 602                 hw->wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
 603         else
 604                 hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 605
 606         hw->wiphy->max_sched_scan_reqs = 1;
 607         hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
 608         hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
 609         /* we create the 802.11 header and zero length SSID IE. */
 610         hw->wiphy->max_sched_scan_ie_len =
 611                 SCAN_OFFLOAD_PROBE_REQ_SIZE - 24 - 2;
 612         hw->wiphy->max_sched_scan_plans = IWL_MAX_SCHED_SCAN_PLANS;
 613         hw->wiphy->max_sched_scan_plan_interval = U16_MAX;
 614
 615         /*
 616          * the firmware uses u8 for num of iterations, but 0xff is saved for
 617          * infinite loop, so the maximum number of iterations is actually 254.
 618          */
 619         hw->wiphy->max_sched_scan_plan_iterations = 254;
 620
 621         hw->wiphy->features |= NL80211_FEATURE_P2P_GO_CTWIN |
 622                                NL80211_FEATURE_LOW_PRIORITY_SCAN |
 623                                NL80211_FEATURE_P2P_GO_OPPPS |
 624                                NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
 625                                NL80211_FEATURE_DYNAMIC_SMPS |
 626                                NL80211_FEATURE_STATIC_SMPS |
 627                                NL80211_FEATURE_SUPPORTS_WMM_ADMISSION;
 628
 629         if (fw_has_capa(&mvm->fw->ucode_capa,
 630                         IWL_UCODE_TLV_CAPA_TXPOWER_INSERTION_SUPPORT))
 631                 hw->wiphy->features |= NL80211_FEATURE_TX_POWER_INSERTION;
 632         if (fw_has_capa(&mvm->fw->ucode_capa,
 633                         IWL_UCODE_TLV_CAPA_QUIET_PERIOD_SUPPORT))
 634                 hw->wiphy->features |= NL80211_FEATURE_QUIET;
 635
 636         if (fw_has_capa(&mvm->fw->ucode_capa,
 637                         IWL_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT))
 638                 hw->wiphy->features |=
 639                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES;
 640
 641         if (fw_has_capa(&mvm->fw->ucode_capa,
 642                         IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT))
 643                 hw->wiphy->features |= NL80211_FEATURE_WFA_TPC_IE_IN_PROBES;
 644
 645         if (fw_has_api(&mvm->fw->ucode_capa,
 646                        IWL_UCODE_TLV_API_SCAN_TSF_REPORT)) {
 647                 wiphy_ext_feature_set(hw->wiphy,
 648                                       NL80211_EXT_FEATURE_SCAN_START_TIME);
 649                 wiphy_ext_feature_set(hw->wiphy,
 650                                       NL80211_EXT_FEATURE_BSS_PARENT_TSF);
 651                 wiphy_ext_feature_set(hw->wiphy,
 652                                       NL80211_EXT_FEATURE_SET_SCAN_DWELL);
 653         }
 654
 655         if (iwl_mvm_is_oce_supported(mvm)) {
 656                 wiphy_ext_feature_set(hw->wiphy,
 657                         NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP);
 658                 wiphy_ext_feature_set(hw->wiphy,
 659                         NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME);
 660                 wiphy_ext_feature_set(hw->wiphy,
 661                         NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION);
 662                 wiphy_ext_feature_set(hw->wiphy,
 663                         NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE);
 664         }
 665
 666         if (mvm->nvm_data->sku_cap_11ax_enable &&
 667             !iwlwifi_mod_params.disable_11ax) {
 668                 hw->wiphy->iftype_ext_capab = he_iftypes_ext_capa;
 669                 hw->wiphy->num_iftype_ext_capab =
 670                         ARRAY_SIZE(he_iftypes_ext_capa);
 671
 672                 ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
 673                 ieee80211_hw_set(hw, SUPPORTS_ONLY_HE_MULTI_BSSID);
 674         }
 675
 676         mvm->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
 677
 678 #ifdef CONFIG_PM_SLEEP
 679         if ((unified || mvm->fw->img[IWL_UCODE_WOWLAN].num_sec) &&
 680             mvm->trans->ops->d3_suspend &&
 681             mvm->trans->ops->d3_resume &&
 682             device_can_wakeup(mvm->trans->dev)) {
 683                 mvm->wowlan.flags |= WIPHY_WOWLAN_MAGIC_PKT |
 684                                      WIPHY_WOWLAN_DISCONNECT |
 685                                      WIPHY_WOWLAN_EAP_IDENTITY_REQ |
 686                                      WIPHY_WOWLAN_RFKILL_RELEASE |
 687                                      WIPHY_WOWLAN_NET_DETECT;
 688                 if (!iwlwifi_mod_params.swcrypto)
 689                         mvm->wowlan.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY |
 690                                              WIPHY_WOWLAN_GTK_REKEY_FAILURE |
 691                                              WIPHY_WOWLAN_4WAY_HANDSHAKE;
 692
 693                 mvm->wowlan.n_patterns = IWL_WOWLAN_MAX_PATTERNS;
 694                 mvm->wowlan.pattern_min_len = IWL_WOWLAN_MIN_PATTERN_LEN;
 695                 mvm->wowlan.pattern_max_len = IWL_WOWLAN_MAX_PATTERN_LEN;
 696                 mvm->wowlan.max_nd_match_sets = IWL_SCAN_MAX_PROFILES;
 697                 hw->wiphy->wowlan = &mvm->wowlan;
 698         }
 699 #endif
 700
 701 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
 702         /* assign default bcast filtering configuration */
 703         mvm->bcast_filters = iwl_mvm_default_bcast_filters;
 704 #endif
 705
 706         ret = iwl_mvm_leds_init(mvm);
 707         if (ret)
 708                 return ret;
 709
 710         if (fw_has_capa(&mvm->fw->ucode_capa,
 711                         IWL_UCODE_TLV_CAPA_TDLS_SUPPORT)) {
 712                 IWL_DEBUG_TDLS(mvm, "TDLS supported\n");
 713                 hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
 714                 ieee80211_hw_set(hw, TDLS_WIDER_BW);
 715         }
 716
 717         if (fw_has_capa(&mvm->fw->ucode_capa,
 718                         IWL_UCODE_TLV_CAPA_TDLS_CHANNEL_SWITCH)) {
 719                 IWL_DEBUG_TDLS(mvm, "TDLS channel switch supported\n");
 720                 hw->wiphy->features |= NL80211_FEATURE_TDLS_CHANNEL_SWITCH;
 721         }
 722
 723         hw->netdev_features |= mvm->cfg->features;
 724         if (!iwl_mvm_is_csum_supported(mvm)) {
 725                 hw->netdev_features &= ~(IWL_TX_CSUM_NETIF_FLAGS |
 726                                          NETIF_F_RXCSUM);
 727                 /* We may support SW TX CSUM */
 728                 if (IWL_MVM_SW_TX_CSUM_OFFLOAD)
 729                         hw->netdev_features |= IWL_TX_CSUM_NETIF_FLAGS;
 730         }
 731
 732         if (mvm->cfg->vht_mu_mimo_supported)
 733                 wiphy_ext_feature_set(hw->wiphy,
 734                                       NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER);
 735
 736         ret = ieee80211_register_hw(mvm->hw);
 737         if (ret) {
 738                 iwl_mvm_leds_exit(mvm);
 739         }
 740
 741         return ret;
 742 }
 743
 744 static void iwl_mvm_tx_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
 745                            struct ieee80211_sta *sta)
 746 {
 747         if (likely(sta)) {
 748                 if (likely(iwl_mvm_tx_skb_sta(mvm, skb, sta) == 0))
 749                         return;
 750         } else {
 751                 if (likely(iwl_mvm_tx_skb_non_sta(mvm, skb) == 0))
 752                         return;
 753         }
 754
 755         ieee80211_free_txskb(mvm->hw, skb);
 756 }
 757
 758 static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
 759                            struct ieee80211_tx_control *control,
 760                            struct sk_buff *skb)
 761 {
 762         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 763         struct ieee80211_sta *sta = control->sta;
 764         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 765         struct ieee80211_hdr *hdr = (void *)skb->data;
 766         bool offchannel = IEEE80211_SKB_CB(skb)->flags &
 767                 IEEE80211_TX_CTL_TX_OFFCHAN;
 768
 769         if (iwl_mvm_is_radio_killed(mvm)) {
 770                 IWL_DEBUG_DROP(mvm, "Dropping - RF/CT KILL\n");
 771                 goto drop;
 772         }
 773
 774         if (offchannel &&
 775             !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status) &&
 776             !test_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status))
 777                 goto drop;
 778
 779         /* treat non-bufferable MMPDUs on AP interfaces as broadcast */
 780         if ((info->control.vif->type == NL80211_IFTYPE_AP ||
 781              info->control.vif->type == NL80211_IFTYPE_ADHOC) &&
 782             ieee80211_is_mgmt(hdr->frame_control) &&
 783             !ieee80211_is_bufferable_mmpdu(hdr->frame_control))
 784                 sta = NULL;
 785
 786         /* If there is no sta, and it's not offchannel - send through AP */
 787         if (!sta && info->control.vif->type == NL80211_IFTYPE_STATION &&
 788             !offchannel) {
 789                 struct iwl_mvm_vif *mvmvif =
 790                         iwl_mvm_vif_from_mac80211(info->control.vif);
 791                 u8 ap_sta_id = READ_ONCE(mvmvif->ap_sta_id);
 792
 793                 if (ap_sta_id < IWL_MVM_STATION_COUNT) {
 794                         /* mac80211 holds rcu read lock */
 795                         sta = rcu_dereference(mvm->fw_id_to_mac_id[ap_sta_id]);
 796                         if (IS_ERR_OR_NULL(sta))
 797                                 goto drop;
 798                 }
 799         }
 800
 801         iwl_mvm_tx_skb(mvm, skb, sta);
 802         return;
 803  drop:
 804         ieee80211_free_txskb(hw, skb);
 805 }
 806
 807 void iwl_mvm_mac_itxq_xmit(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
 808 {
 809         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 810         struct iwl_mvm_txq *mvmtxq = iwl_mvm_txq_from_mac80211(txq);
 811         struct sk_buff *skb = NULL;
 812
 813         /*
 814          * No need for threads to be pending here, they can leave the first
 815          * taker all the work.
 816          *
 817          * mvmtxq->tx_request logic:
 818          *
 819          * If 0, no one is currently TXing, set to 1 to indicate current thread
 820          * will now start TX and other threads should quit.
 821          *
 822          * If 1, another thread is currently TXing, set to 2 to indicate to
 823          * that thread that there was another request. Since that request may
 824          * have raced with the check whether the queue is empty, the TXing
 825          * thread should check the queue's status one more time before leaving.
 826          * This check is done in order to not leave any TX hanging in the queue
 827          * until the next TX invocation (which may not even happen).
 828          *
 829          * If 2, another thread is currently TXing, and it will already double
 830          * check the queue, so do nothing.
 831          */
 832         if (atomic_fetch_add_unless(&mvmtxq->tx_request, 1, 2))
 833                 return;
 834
 835         rcu_read_lock();
 836         do {
 837                 while (likely(!mvmtxq->stopped &&
 838                               (mvm->trans->system_pm_mode ==
 839                                IWL_PLAT_PM_MODE_DISABLED))) {
 840                         skb = ieee80211_tx_dequeue(hw, txq);
 841
 842                         if (!skb) {
 843                                 if (txq->sta)
 844                                         IWL_DEBUG_TX(mvm,
 845                                                      "TXQ of sta %pM tid %d is now empty\n",
 846                                                      txq->sta->addr,
 847                                                      txq->tid);
 848                                 break;
 849                         }
 850
 851                         iwl_mvm_tx_skb(mvm, skb, txq->sta);
 852                 }
 853         } while (atomic_dec_return(&mvmtxq->tx_request));
 854         rcu_read_unlock();
 855 }
 856
 857 static void iwl_mvm_mac_wake_tx_queue(struct ieee80211_hw *hw,
 858                                       struct ieee80211_txq *txq)
 859 {
 860         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 861         struct iwl_mvm_txq *mvmtxq = iwl_mvm_txq_from_mac80211(txq);
 862
 863         /*
 864          * Please note that racing is handled very carefully here:
 865          * mvmtxq->txq_id is updated during allocation, and mvmtxq->list is
 866          * deleted afterwards.
 867          * This means that if:
 868          * mvmtxq->txq_id != INVALID_QUEUE && list_empty(&mvmtxq->list):
 869          *      queue is allocated and we can TX.
 870          * mvmtxq->txq_id != INVALID_QUEUE && !list_empty(&mvmtxq->list):
 871          *      a race, should defer the frame.
 872          * mvmtxq->txq_id == INVALID_QUEUE && list_empty(&mvmtxq->list):
 873          *      need to allocate the queue and defer the frame.
 874          * mvmtxq->txq_id == INVALID_QUEUE && !list_empty(&mvmtxq->list):
 875          *      queue is already scheduled for allocation, no need to allocate,
 876          *      should defer the frame.
 877          */
 878
 879         /* If the queue is allocated TX and return. */
 880         if (!txq->sta || mvmtxq->txq_id != IWL_MVM_INVALID_QUEUE) {
 881                 /*
 882                  * Check that list is empty to avoid a race where txq_id is
 883                  * already updated, but the queue allocation work wasn't
 884                  * finished
 885                  */
 886                 if (unlikely(txq->sta && !list_empty(&mvmtxq->list)))
 887                         return;
 888
 889                 iwl_mvm_mac_itxq_xmit(hw, txq);
 890                 return;
 891         }
 892
 893         /* The list is being deleted only after the queue is fully allocated. */
 894         if (!list_empty(&mvmtxq->list))
 895                 return;
 896
 897         list_add_tail(&mvmtxq->list, &mvm->add_stream_txqs);
 898         schedule_work(&mvm->add_stream_wk);
 899 }
 900
 901 #define CHECK_BA_TRIGGER(_mvm, _trig, _tid_bm, _tid, _fmt...)           \
 902         do {                                                            \
 903                 if (!(le16_to_cpu(_tid_bm) & BIT(_tid)))                \
 904                         break;                                          \
 905                 iwl_fw_dbg_collect_trig(&(_mvm)->fwrt, _trig, _fmt);    \
 906         } while (0)
 907
 908 static void
 909 iwl_mvm_ampdu_check_trigger(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 910                             struct ieee80211_sta *sta, u16 tid, u16 rx_ba_ssn,
 911                             enum ieee80211_ampdu_mlme_action action)
 912 {
 913         struct iwl_fw_dbg_trigger_tlv *trig;
 914         struct iwl_fw_dbg_trigger_ba *ba_trig;
 915
 916         trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
 917                                      FW_DBG_TRIGGER_BA);
 918         if (!trig)
 919                 return;
 920
 921         ba_trig = (void *)trig->data;
 922
 923         switch (action) {
 924         case IEEE80211_AMPDU_TX_OPERATIONAL: {
 925                 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 926                 struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
 927
 928                 CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_start, tid,
 929                                  "TX AGG START: MAC %pM tid %d ssn %d\n",
 930                                  sta->addr, tid, tid_data->ssn);
 931                 break;
 932                 }
 933         case IEEE80211_AMPDU_TX_STOP_CONT:
 934                 CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_stop, tid,
 935                                  "TX AGG STOP: MAC %pM tid %d\n",
 936                                  sta->addr, tid);
 937                 break;
 938         case IEEE80211_AMPDU_RX_START:
 939                 CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_start, tid,
 940                                  "RX AGG START: MAC %pM tid %d ssn %d\n",
 941                                  sta->addr, tid, rx_ba_ssn);
 942                 break;
 943         case IEEE80211_AMPDU_RX_STOP:
 944                 CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_stop, tid,
 945                                  "RX AGG STOP: MAC %pM tid %d\n",
 946                                  sta->addr, tid);
 947                 break;
 948         default:
 949                 break;
 950         }
 951 }
 952
 953 static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
 954                                     struct ieee80211_vif *vif,
 955                                     struct ieee80211_ampdu_params *params)
 956 {
 957         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 958         int ret;
 959         struct ieee80211_sta *sta = params->sta;
 960         enum ieee80211_ampdu_mlme_action action = params->action;
 961         u16 tid = params->tid;
 962         u16 *ssn = &params->ssn;
 963         u16 buf_size = params->buf_size;
 964         bool amsdu = params->amsdu;
 965         u16 timeout = params->timeout;
 966
 967         IWL_DEBUG_HT(mvm, "A-MPDU action on addr %pM tid %d: action %d\n",
 968                      sta->addr, tid, action);
 969
 970         if (!(mvm->nvm_data->sku_cap_11n_enable))
 971                 return -EACCES;
 972
 973         mutex_lock(&mvm->mutex);
 974
 975         switch (action) {
 976         case IEEE80211_AMPDU_RX_START:
 977                 if (iwl_mvm_vif_from_mac80211(vif)->ap_sta_id ==
 978                                 iwl_mvm_sta_from_mac80211(sta)->sta_id) {
 979                         struct iwl_mvm_vif *mvmvif;
 980                         u16 macid = iwl_mvm_vif_from_mac80211(vif)->id;
 981                         struct iwl_mvm_tcm_mac *mdata = &mvm->tcm.data[macid];
 982
 983                         mdata->opened_rx_ba_sessions = true;
 984                         mvmvif = iwl_mvm_vif_from_mac80211(vif);
 985                         cancel_delayed_work(&mvmvif->uapsd_nonagg_detected_wk);
 986                 }
 987                 if (!iwl_enable_rx_ampdu()) {
 988                         ret = -EINVAL;
 989                         break;
 990                 }
 991                 ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, *ssn, true, buf_size,
 992                                          timeout);
 993                 break;
 994         case IEEE80211_AMPDU_RX_STOP:
 995                 ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, 0, false, buf_size,
 996                                          timeout);
 997                 break;
 998         case IEEE80211_AMPDU_TX_START:
 999                 if (!iwl_enable_tx_ampdu()) {
1000                         ret = -EINVAL;
1001                         break;
1002                 }
1003                 ret = iwl_mvm_sta_tx_agg_start(mvm, vif, sta, tid, ssn);
1004                 break;
1005         case IEEE80211_AMPDU_TX_STOP_CONT:
1006                 ret = iwl_mvm_sta_tx_agg_stop(mvm, vif, sta, tid);
1007                 break;
1008         case IEEE80211_AMPDU_TX_STOP_FLUSH:
1009         case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
1010                 ret = iwl_mvm_sta_tx_agg_flush(mvm, vif, sta, tid);
1011                 break;
1012         case IEEE80211_AMPDU_TX_OPERATIONAL:
1013                 ret = iwl_mvm_sta_tx_agg_oper(mvm, vif, sta, tid,
1014                                               buf_size, amsdu);
1015                 break;
1016         default:
1017                 WARN_ON_ONCE(1);
1018                 ret = -EINVAL;
1019                 break;
1020         }
1021
1022         if (!ret) {
1023                 u16 rx_ba_ssn = 0;
1024
1025                 if (action == IEEE80211_AMPDU_RX_START)
1026                         rx_ba_ssn = *ssn;
1027
1028                 iwl_mvm_ampdu_check_trigger(mvm, vif, sta, tid,
1029                                             rx_ba_ssn, action);
1030         }
1031         mutex_unlock(&mvm->mutex);
1032
1033         return ret;
1034 }
1035
1036 static void iwl_mvm_cleanup_iterator(void *data, u8 *mac,
1037                                      struct ieee80211_vif *vif)
1038 {
1039         struct iwl_mvm *mvm = data;
1040         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1041
1042         mvmvif->uploaded = false;
1043         mvmvif->ap_sta_id = IWL_MVM_INVALID_STA;
1044
1045         spin_lock_bh(&mvm->time_event_lock);
1046         iwl_mvm_te_clear_data(mvm, &mvmvif->time_event_data);
1047         spin_unlock_bh(&mvm->time_event_lock);
1048
1049         mvmvif->phy_ctxt = NULL;
1050         memset(&mvmvif->bf_data, 0, sizeof(mvmvif->bf_data));
1051         memset(&mvmvif->probe_resp_data, 0, sizeof(mvmvif->probe_resp_data));
1052 }
1053
1054 static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
1055 {
1056         iwl_mvm_stop_device(mvm);
1057
1058         mvm->cur_aid = 0;
1059
1060         mvm->scan_status = 0;
1061         mvm->ps_disabled = false;
1062         mvm->rfkill_safe_init_done = false;
1063
1064         /* just in case one was running */
1065         iwl_mvm_cleanup_roc_te(mvm);
1066         ieee80211_remain_on_channel_expired(mvm->hw);
1067
1068         iwl_mvm_ftm_restart(mvm);
1069
1070         /*
1071          * cleanup all interfaces, even inactive ones, as some might have
1072          * gone down during the HW restart
1073          */
1074         ieee80211_iterate_interfaces(mvm->hw, 0, iwl_mvm_cleanup_iterator, mvm);
1075
1076         mvm->p2p_device_vif = NULL;
1077
1078         iwl_mvm_reset_phy_ctxts(mvm);
1079         memset(mvm->fw_key_table, 0, sizeof(mvm->fw_key_table));
1080         memset(&mvm->last_bt_notif, 0, sizeof(mvm->last_bt_notif));
1081         memset(&mvm->last_bt_ci_cmd, 0, sizeof(mvm->last_bt_ci_cmd));
1082
1083         ieee80211_wake_queues(mvm->hw);
1084
1085         mvm->vif_count = 0;
1086         mvm->rx_ba_sessions = 0;
1087         mvm->fwrt.dump.conf = FW_DBG_INVALID;
1088         mvm->monitor_on = false;
1089
1090         /* keep statistics ticking */
1091         iwl_mvm_accu_radio_stats(mvm);
1092 }
1093
1094 int __iwl_mvm_mac_start(struct iwl_mvm *mvm)
1095 {
1096         int ret;
1097
1098         lockdep_assert_held(&mvm->mutex);
1099
1100         if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status)) {
1101                 /*
1102                  * Now convert the HW_RESTART_REQUESTED flag to IN_HW_RESTART
1103                  * so later code will - from now on - see that we're doing it.
1104                  */
1105                 set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1106                 clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status);
1107                 /* Clean up some internal and mac80211 state on restart */
1108                 iwl_mvm_restart_cleanup(mvm);
1109         }
1110         ret = iwl_mvm_up(mvm);
1111
1112         iwl_dbg_tlv_time_point(&mvm->fwrt, IWL_FW_INI_TIME_POINT_POST_INIT,
1113                                NULL);
1114         iwl_dbg_tlv_time_point(&mvm->fwrt, IWL_FW_INI_TIME_POINT_PERIODIC,
1115                                NULL);
1116
1117         if (ret && test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
1118                 /* Something went wrong - we need to finish some cleanup
1119                  * that normally iwl_mvm_mac_restart_complete() below
1120                  * would do.
1121                  */
1122                 clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1123         }
1124
1125         return ret;
1126 }
1127
1128 static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
1129 {
1130         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1131         int ret;
1132
1133         mutex_lock(&mvm->mutex);
1134         ret = __iwl_mvm_mac_start(mvm);
1135         mutex_unlock(&mvm->mutex);
1136
1137         return ret;
1138 }
1139
1140 static void iwl_mvm_restart_complete(struct iwl_mvm *mvm)
1141 {
1142         int ret;
1143
1144         mutex_lock(&mvm->mutex);
1145
1146         clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1147
1148         ret = iwl_mvm_update_quotas(mvm, true, NULL);
1149         if (ret)
1150                 IWL_ERR(mvm, "Failed to update quotas after restart (%d)\n",
1151                         ret);
1152
1153         iwl_mvm_send_recovery_cmd(mvm, ERROR_RECOVERY_END_OF_RECOVERY);
1154
1155         /*
1156          * If we have TDLS peers, remove them. We don't know the last seqno/PN
1157          * of packets the FW sent out, so we must reconnect.
1158          */
1159         iwl_mvm_teardown_tdls_peers(mvm);
1160
1161         mutex_unlock(&mvm->mutex);
1162 }
1163
1164 static void
1165 iwl_mvm_mac_reconfig_complete(struct ieee80211_hw *hw,
1166                               enum ieee80211_reconfig_type reconfig_type)
1167 {
1168         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1169
1170         switch (reconfig_type) {
1171         case IEEE80211_RECONFIG_TYPE_RESTART:
1172                 iwl_mvm_restart_complete(mvm);
1173                 break;
1174         case IEEE80211_RECONFIG_TYPE_SUSPEND:
1175                 break;
1176         }
1177 }
1178
1179 void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
1180 {
1181         lockdep_assert_held(&mvm->mutex);
1182
1183         /* firmware counters are obviously reset now, but we shouldn't
1184          * partially track so also clear the fw_reset_accu counters.
1185          */
1186         memset(&mvm->accu_radio_stats, 0, sizeof(mvm->accu_radio_stats));
1187
1188         /* async_handlers_wk is now blocked */
1189
1190         /*
1191          * The work item could be running or queued if the
1192          * ROC time event stops just as we get here.
1193          */
1194         flush_work(&mvm->roc_done_wk);
1195
1196         iwl_mvm_rm_aux_sta(mvm);
1197
1198         iwl_mvm_stop_device(mvm);
1199
1200         iwl_mvm_async_handlers_purge(mvm);
1201         /* async_handlers_list is empty and will stay empty: HW is stopped */
1202
1203         /*
1204          * Clear IN_HW_RESTART and HW_RESTART_REQUESTED flag when stopping the
1205          * hw (as restart_complete() won't be called in this case) and mac80211
1206          * won't execute the restart.
1207          * But make sure to cleanup interfaces that have gone down before/during
1208          * HW restart was requested.
1209          */
1210         if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) ||
1211             test_and_clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
1212                                &mvm->status))
1213                 ieee80211_iterate_interfaces(mvm->hw, 0,
1214                                              iwl_mvm_cleanup_iterator, mvm);
1215
1216         /* We shouldn't have any UIDs still set.  Loop over all the UIDs to
1217          * make sure there's nothing left there and warn if any is found.
1218          */
1219         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1220                 int i;
1221
1222                 for (i = 0; i < mvm->max_scans; i++) {
1223                         if (WARN_ONCE(mvm->scan_uid_status[i],
1224                                       "UMAC scan UID %d status was not cleaned\n",
1225                                       i))
1226                                 mvm->scan_uid_status[i] = 0;
1227                 }
1228         }
1229 }
1230
1231 static void iwl_mvm_mac_stop(struct ieee80211_hw *hw)
1232 {
1233         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1234
1235         flush_work(&mvm->async_handlers_wk);
1236         flush_work(&mvm->add_stream_wk);
1237
1238         /*
1239          * Lock and clear the firmware running bit here already, so that
1240          * new commands coming in elsewhere, e.g. from debugfs, will not
1241          * be able to proceed. This is important here because one of those
1242          * debugfs files causes the firmware dump to be triggered, and if we
1243          * don't stop debugfs accesses before canceling that it could be
1244          * retriggered after we flush it but before we've cleared the bit.
1245          */
1246         clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status);
1247
1248         cancel_delayed_work_sync(&mvm->cs_tx_unblock_dwork);
1249         cancel_delayed_work_sync(&mvm->scan_timeout_dwork);
1250         iwl_fw_free_dump_desc(&mvm->fwrt);
1251
1252         mutex_lock(&mvm->mutex);
1253         __iwl_mvm_mac_stop(mvm);
1254         mutex_unlock(&mvm->mutex);
1255
1256         /*
1257          * The worker might have been waiting for the mutex, let it run and
1258          * discover that its list is now empty.
1259          */
1260         cancel_work_sync(&mvm->async_handlers_wk);
1261 }
1262
1263 static struct iwl_mvm_phy_ctxt *iwl_mvm_get_free_phy_ctxt(struct iwl_mvm *mvm)
1264 {
1265         u16 i;
1266
1267         lockdep_assert_held(&mvm->mutex);
1268
1269         for (i = 0; i < NUM_PHY_CTX; i++)
1270                 if (!mvm->phy_ctxts[i].ref)
1271                         return &mvm->phy_ctxts[i];
1272
1273         IWL_ERR(mvm, "No available PHY context\n");
1274         return NULL;
1275 }
1276
1277 static int iwl_mvm_set_tx_power(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1278                                 s16 tx_power)
1279 {
1280         int len;
1281         union {
1282                 struct iwl_dev_tx_power_cmd v5;
1283                 struct iwl_dev_tx_power_cmd_v4 v4;
1284         } cmd = {
1285                 .v5.v3.set_mode = cpu_to_le32(IWL_TX_POWER_MODE_SET_MAC),
1286                 .v5.v3.mac_context_id =
1287                         cpu_to_le32(iwl_mvm_vif_from_mac80211(vif)->id),
1288                 .v5.v3.pwr_restriction = cpu_to_le16(8 * tx_power),
1289         };
1290
1291         if (tx_power == IWL_DEFAULT_MAX_TX_POWER)
1292                 cmd.v5.v3.pwr_restriction = cpu_to_le16(IWL_DEV_MAX_TX_POWER);
1293
1294         if (fw_has_api(&mvm->fw->ucode_capa,
1295                        IWL_UCODE_TLV_API_REDUCE_TX_POWER))
1296                 len = sizeof(cmd.v5);
1297         else if (fw_has_capa(&mvm->fw->ucode_capa,
1298                              IWL_UCODE_TLV_CAPA_TX_POWER_ACK))
1299                 len = sizeof(cmd.v4);
1300         else
1301                 len = sizeof(cmd.v4.v3);
1302
1303         return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, 0, len, &cmd);
1304 }
1305
1306 static int iwl_mvm_post_channel_switch(struct ieee80211_hw *hw,
1307                                        struct ieee80211_vif *vif)
1308 {
1309         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1310         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1311         int ret;
1312
1313         mutex_lock(&mvm->mutex);
1314
1315         if (mvmvif->csa_failed) {
1316                 mvmvif->csa_failed = false;
1317                 ret = -EIO;
1318                 goto out_unlock;
1319         }
1320
1321         if (vif->type == NL80211_IFTYPE_STATION) {
1322                 struct iwl_mvm_sta *mvmsta;
1323
1324                 mvmvif->csa_bcn_pending = false;
1325                 mvmsta = iwl_mvm_sta_from_staid_protected(mvm,
1326                                                           mvmvif->ap_sta_id);
1327
1328                 if (WARN_ON(!mvmsta)) {
1329                         ret = -EIO;
1330                         goto out_unlock;
1331                 }
1332
1333                 if (!fw_has_capa(&mvm->fw->ucode_capa,
1334                                  IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD))
1335                         iwl_mvm_sta_modify_disable_tx(mvm, mvmsta, false);
1336
1337                 iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
1338
1339                 if (!fw_has_capa(&mvm->fw->ucode_capa,
1340                                  IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
1341                         ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
1342                         if (ret)
1343                                 goto out_unlock;
1344
1345                         iwl_mvm_stop_session_protection(mvm, vif);
1346                 }
1347         }
1348
1349         mvmvif->ps_disabled = false;
1350
1351         ret = iwl_mvm_power_update_ps(mvm);
1352
1353 out_unlock:
1354         mutex_unlock(&mvm->mutex);
1355
1356         return ret;
1357 }
1358
1359 static void iwl_mvm_abort_channel_switch(struct ieee80211_hw *hw,
1360                                          struct ieee80211_vif *vif)
1361 {
1362         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1363         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1364         struct iwl_chan_switch_te_cmd cmd = {
1365                 .mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
1366                                                           mvmvif->color)),
1367                 .action = cpu_to_le32(FW_CTXT_ACTION_REMOVE),
1368         };
1369
1370         IWL_DEBUG_MAC80211(mvm, "Abort CSA on mac %d\n", mvmvif->id);
1371
1372         mutex_lock(&mvm->mutex);
1373         WARN_ON(iwl_mvm_send_cmd_pdu(mvm,
1374                                      WIDE_ID(MAC_CONF_GROUP,
1375                                              CHANNEL_SWITCH_TIME_EVENT_CMD),
1376                                      0, sizeof(cmd), &cmd));
1377         mutex_unlock(&mvm->mutex);
1378
1379         WARN_ON(iwl_mvm_post_channel_switch(hw, vif));
1380 }
1381
1382 static void iwl_mvm_channel_switch_disconnect_wk(struct work_struct *wk)
1383 {
1384         struct iwl_mvm *mvm;
1385         struct iwl_mvm_vif *mvmvif;
1386         struct ieee80211_vif *vif;
1387
1388         mvmvif = container_of(wk, struct iwl_mvm_vif, csa_work.work);
1389         vif = container_of((void *)mvmvif, struct ieee80211_vif, drv_priv);
1390         mvm = mvmvif->mvm;
1391
1392         iwl_mvm_abort_channel_switch(mvm->hw, vif);
1393         ieee80211_chswitch_done(vif, false);
1394 }
1395
1396 static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
1397                                      struct ieee80211_vif *vif)
1398 {
1399         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1400         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1401         int ret;
1402
1403         mvmvif->mvm = mvm;
1404         RCU_INIT_POINTER(mvmvif->probe_resp_data, NULL);
1405
1406         /*
1407          * Not much to do here. The stack will not allow interface
1408          * types or combinations that we didn't advertise, so we
1409          * don't really have to check the types.
1410          */
1411
1412         mutex_lock(&mvm->mutex);
1413
1414         /* make sure that beacon statistics don't go backwards with FW reset */
1415         if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
1416                 mvmvif->beacon_stats.accu_num_beacons +=
1417                         mvmvif->beacon_stats.num_beacons;
1418
1419         /* Allocate resources for the MAC context, and add it to the fw  */
1420         ret = iwl_mvm_mac_ctxt_init(mvm, vif);
1421         if (ret)
1422                 goto out_unlock;
1423
1424         rcu_assign_pointer(mvm->vif_id_to_mac[mvmvif->id], vif);
1425
1426         /* Counting number of interfaces is needed for legacy PM */
1427         if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1428                 mvm->vif_count++;
1429
1430         /*
1431          * The AP binding flow can be done only after the beacon
1432          * template is configured (which happens only in the mac80211
1433          * start_ap() flow), and adding the broadcast station can happen
1434          * only after the binding.
1435          * In addition, since modifying the MAC before adding a bcast
1436          * station is not allowed by the FW, delay the adding of MAC context to
1437          * the point where we can also add the bcast station.
1438          * In short: there's not much we can do at this point, other than
1439          * allocating resources :)
1440          */
1441         if (vif->type == NL80211_IFTYPE_AP ||
1442             vif->type == NL80211_IFTYPE_ADHOC) {
1443                 ret = iwl_mvm_alloc_bcast_sta(mvm, vif);
1444                 if (ret) {
1445                         IWL_ERR(mvm, "Failed to allocate bcast sta\n");
1446                         goto out_release;
1447                 }
1448
1449                 /*
1450                  * Only queue for this station is the mcast queue,
1451                  * which shouldn't be in TFD mask anyway
1452                  */
1453                 ret = iwl_mvm_allocate_int_sta(mvm, &mvmvif->mcast_sta,
1454                                                0, vif->type,
1455                                                IWL_STA_MULTICAST);
1456                 if (ret)
1457                         goto out_release;
1458
1459                 iwl_mvm_vif_dbgfs_register(mvm, vif);
1460                 goto out_unlock;
1461         }
1462
1463         mvmvif->features |= hw->netdev_features;
1464
1465         ret = iwl_mvm_mac_ctxt_add(mvm, vif);
1466         if (ret)
1467                 goto out_release;
1468
1469         ret = iwl_mvm_power_update_mac(mvm);
1470         if (ret)
1471                 goto out_remove_mac;
1472
1473         /* beacon filtering */
1474         ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
1475         if (ret)
1476                 goto out_remove_mac;
1477
1478         if (!mvm->bf_allowed_vif &&
1479             vif->type == NL80211_IFTYPE_STATION && !vif->p2p) {
1480                 mvm->bf_allowed_vif = mvmvif;
1481                 vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
1482                                      IEEE80211_VIF_SUPPORTS_CQM_RSSI;
1483         }
1484
1485         /*
1486          * P2P_DEVICE interface does not have a channel context assigned to it,
1487          * so a dedicated PHY context is allocated to it and the corresponding
1488          * MAC context is bound to it at this stage.
1489          */
1490         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1491
1492                 mvmvif->phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
1493                 if (!mvmvif->phy_ctxt) {
1494                         ret = -ENOSPC;
1495                         goto out_free_bf;
1496                 }
1497
1498                 iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
1499                 ret = iwl_mvm_binding_add_vif(mvm, vif);
1500                 if (ret)
1501                         goto out_unref_phy;
1502
1503                 ret = iwl_mvm_add_p2p_bcast_sta(mvm, vif);
1504                 if (ret)
1505                         goto out_unbind;
1506
1507                 /* Save a pointer to p2p device vif, so it can later be used to
1508                  * update the p2p device MAC when a GO is started/stopped */
1509                 mvm->p2p_device_vif = vif;
1510         }
1511
1512         iwl_mvm_tcm_add_vif(mvm, vif);
1513         INIT_DELAYED_WORK(&mvmvif->csa_work,
1514                           iwl_mvm_channel_switch_disconnect_wk);
1515
1516         if (vif->type == NL80211_IFTYPE_MONITOR)
1517                 mvm->monitor_on = true;
1518
1519         iwl_mvm_vif_dbgfs_register(mvm, vif);
1520         goto out_unlock;
1521
1522  out_unbind:
1523         iwl_mvm_binding_remove_vif(mvm, vif);
1524  out_unref_phy:
1525         iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1526  out_free_bf:
1527         if (mvm->bf_allowed_vif == mvmvif) {
1528                 mvm->bf_allowed_vif = NULL;
1529                 vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1530                                        IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1531         }
1532  out_remove_mac:
1533         mvmvif->phy_ctxt = NULL;
1534         iwl_mvm_mac_ctxt_remove(mvm, vif);
1535  out_release:
1536         if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1537                 mvm->vif_count--;
1538  out_unlock:
1539         mutex_unlock(&mvm->mutex);
1540
1541         return ret;
1542 }
1543
1544 static void iwl_mvm_prepare_mac_removal(struct iwl_mvm *mvm,
1545                                         struct ieee80211_vif *vif)
1546 {
1547         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1548                 /*
1549                  * Flush the ROC worker which will flush the OFFCHANNEL queue.
1550                  * We assume here that all the packets sent to the OFFCHANNEL
1551                  * queue are sent in ROC session.
1552                  */
1553                 flush_work(&mvm->roc_done_wk);
1554         }
1555 }
1556
1557 static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
1558                                          struct ieee80211_vif *vif)
1559 {
1560         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1561         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1562         struct iwl_probe_resp_data *probe_data;
1563
1564         iwl_mvm_prepare_mac_removal(mvm, vif);
1565
1566         if (!(vif->type == NL80211_IFTYPE_AP ||
1567               vif->type == NL80211_IFTYPE_ADHOC))
1568                 iwl_mvm_tcm_rm_vif(mvm, vif);
1569
1570         mutex_lock(&mvm->mutex);
1571
1572         probe_data = rcu_dereference_protected(mvmvif->probe_resp_data,
1573                                                lockdep_is_held(&mvm->mutex));
1574         RCU_INIT_POINTER(mvmvif->probe_resp_data, NULL);
1575         if (probe_data)
1576                 kfree_rcu(probe_data, rcu_head);
1577
1578         if (mvm->bf_allowed_vif == mvmvif) {
1579                 mvm->bf_allowed_vif = NULL;
1580                 vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1581                                        IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1582         }
1583
1584         if (vif->bss_conf.ftm_responder)
1585                 memset(&mvm->ftm_resp_stats, 0, sizeof(mvm->ftm_resp_stats));
1586
1587         iwl_mvm_vif_dbgfs_clean(mvm, vif);
1588
1589         /*
1590          * For AP/GO interface, the tear down of the resources allocated to the
1591          * interface is be handled as part of the stop_ap flow.
1592          */
1593         if (vif->type == NL80211_IFTYPE_AP ||
1594             vif->type == NL80211_IFTYPE_ADHOC) {
1595 #ifdef CONFIG_NL80211_TESTMODE
1596                 if (vif == mvm->noa_vif) {
1597                         mvm->noa_vif = NULL;
1598                         mvm->noa_duration = 0;
1599                 }
1600 #endif
1601                 iwl_mvm_dealloc_int_sta(mvm, &mvmvif->mcast_sta);
1602                 iwl_mvm_dealloc_bcast_sta(mvm, vif);
1603                 goto out_release;
1604         }
1605
1606         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1607                 mvm->p2p_device_vif = NULL;
1608                 iwl_mvm_rm_p2p_bcast_sta(mvm, vif);
1609                 iwl_mvm_binding_remove_vif(mvm, vif);
1610                 iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1611                 mvmvif->phy_ctxt = NULL;
1612         }
1613
1614         if (mvm->vif_count && vif->type != NL80211_IFTYPE_P2P_DEVICE)
1615                 mvm->vif_count--;
1616
1617         iwl_mvm_power_update_mac(mvm);
1618         iwl_mvm_mac_ctxt_remove(mvm, vif);
1619
1620         RCU_INIT_POINTER(mvm->vif_id_to_mac[mvmvif->id], NULL);
1621
1622         if (vif->type == NL80211_IFTYPE_MONITOR)
1623                 mvm->monitor_on = false;
1624
1625 out_release:
1626         mutex_unlock(&mvm->mutex);
1627 }
1628
1629 static int iwl_mvm_mac_config(struct ieee80211_hw *hw, u32 changed)
1630 {
1631         return 0;
1632 }
1633
1634 struct iwl_mvm_mc_iter_data {
1635         struct iwl_mvm *mvm;
1636         int port_id;
1637 };
1638
1639 static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
1640                                       struct ieee80211_vif *vif)
1641 {
1642         struct iwl_mvm_mc_iter_data *data = _data;
1643         struct iwl_mvm *mvm = data->mvm;
1644         struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd;
1645         struct iwl_host_cmd hcmd = {
1646                 .id = MCAST_FILTER_CMD,
1647                 .flags = CMD_ASYNC,
1648                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
1649         };
1650         int ret, len;
1651
1652         /* if we don't have free ports, mcast frames will be dropped */
1653         if (WARN_ON_ONCE(data->port_id >= MAX_PORT_ID_NUM))
1654                 return;
1655
1656         if (vif->type != NL80211_IFTYPE_STATION ||
1657             !vif->bss_conf.assoc)
1658                 return;
1659
1660         cmd->port_id = data->port_id++;
1661         memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
1662         len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4);
1663
1664         hcmd.len[0] = len;
1665         hcmd.data[0] = cmd;
1666
1667         ret = iwl_mvm_send_cmd(mvm, &hcmd);
1668         if (ret)
1669                 IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret);
1670 }
1671
1672 static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm)
1673 {
1674         struct iwl_mvm_mc_iter_data iter_data = {
1675                 .mvm = mvm,
1676         };
1677
1678         lockdep_assert_held(&mvm->mutex);
1679
1680         if (WARN_ON_ONCE(!mvm->mcast_filter_cmd))
1681                 return;
1682
1683         ieee80211_iterate_active_interfaces_atomic(
1684                 mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1685                 iwl_mvm_mc_iface_iterator, &iter_data);
1686 }
1687
1688 static u64 iwl_mvm_prepare_multicast(struct ieee80211_hw *hw,
1689                                      struct netdev_hw_addr_list *mc_list)
1690 {
1691         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1692         struct iwl_mcast_filter_cmd *cmd;
1693         struct netdev_hw_addr *addr;
1694         int addr_count;
1695         bool pass_all;
1696         int len;
1697
1698         addr_count = netdev_hw_addr_list_count(mc_list);
1699         pass_all = addr_count > MAX_MCAST_FILTERING_ADDRESSES ||
1700                    IWL_MVM_FW_MCAST_FILTER_PASS_ALL;
1701         if (pass_all)
1702                 addr_count = 0;
1703
1704         len = roundup(sizeof(*cmd) + addr_count * ETH_ALEN, 4);
1705         cmd = kzalloc(len, GFP_ATOMIC);
1706         if (!cmd)
1707                 return 0;
1708
1709         if (pass_all) {
1710                 cmd->pass_all = 1;
1711                 return (u64)(unsigned long)cmd;
1712         }
1713
1714         netdev_hw_addr_list_for_each(addr, mc_list) {
1715                 IWL_DEBUG_MAC80211(mvm, "mcast addr (%d): %pM\n",
1716                                    cmd->count, addr->addr);
1717                 memcpy(&cmd->addr_list[cmd->count * ETH_ALEN],
1718                        addr->addr, ETH_ALEN);
1719                 cmd->count++;
1720         }
1721
1722         return (u64)(unsigned long)cmd;
1723 }
1724
1725 static void iwl_mvm_configure_filter(struct ieee80211_hw *hw,
1726                                      unsigned int changed_flags,
1727                                      unsigned int *total_flags,
1728                                      u64 multicast)
1729 {
1730         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1731         struct iwl_mcast_filter_cmd *cmd = (void *)(unsigned long)multicast;
1732
1733         mutex_lock(&mvm->mutex);
1734
1735         /* replace previous configuration */
1736         kfree(mvm->mcast_filter_cmd);
1737         mvm->mcast_filter_cmd = cmd;
1738
1739         if (!cmd)
1740                 goto out;
1741
1742         if (changed_flags & FIF_ALLMULTI)
1743                 cmd->pass_all = !!(*total_flags & FIF_ALLMULTI);
1744
1745         if (cmd->pass_all)
1746                 cmd->count = 0;
1747
1748         iwl_mvm_recalc_multicast(mvm);
1749 out:
1750         mutex_unlock(&mvm->mutex);
1751         *total_flags = 0;
1752 }
1753
1754 static void iwl_mvm_config_iface_filter(struct ieee80211_hw *hw,
1755                                         struct ieee80211_vif *vif,
1756                                         unsigned int filter_flags,
1757                                         unsigned int changed_flags)
1758 {
1759         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1760
1761         /* We support only filter for probe requests */
1762         if (!(changed_flags & FIF_PROBE_REQ))
1763                 return;
1764
1765         /* Supported only for p2p client interfaces */
1766         if (vif->type != NL80211_IFTYPE_STATION || !vif->bss_conf.assoc ||
1767             !vif->p2p)
1768                 return;
1769
1770         mutex_lock(&mvm->mutex);
1771         iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
1772         mutex_unlock(&mvm->mutex);
1773 }
1774
1775 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
1776 struct iwl_bcast_iter_data {
1777         struct iwl_mvm *mvm;
1778         struct iwl_bcast_filter_cmd *cmd;
1779         u8 current_filter;
1780 };
1781
1782 static void
1783 iwl_mvm_set_bcast_filter(struct ieee80211_vif *vif,
1784                          const struct iwl_fw_bcast_filter *in_filter,
1785                          struct iwl_fw_bcast_filter *out_filter)
1786 {
1787         struct iwl_fw_bcast_filter_attr *attr;
1788         int i;
1789
1790         memcpy(out_filter, in_filter, sizeof(*out_filter));
1791
1792         for (i = 0; i < ARRAY_SIZE(out_filter->attrs); i++) {
1793                 attr = &out_filter->attrs[i];
1794
1795                 if (!attr->mask)
1796                         break;
1797
1798                 switch (attr->reserved1) {
1799                 case cpu_to_le16(BC_FILTER_MAGIC_IP):
1800                         if (vif->bss_conf.arp_addr_cnt != 1) {
1801                                 attr->mask = 0;
1802                                 continue;
1803                         }
1804
1805                         attr->val = vif->bss_conf.arp_addr_list[0];
1806                         break;
1807                 case cpu_to_le16(BC_FILTER_MAGIC_MAC):
1808                         attr->val = *(__be32 *)&vif->addr[2];
1809                         break;
1810                 default:
1811                         break;
1812                 }
1813                 attr->reserved1 = 0;
1814                 out_filter->num_attrs++;
1815         }
1816 }
1817
1818 static void iwl_mvm_bcast_filter_iterator(void *_data, u8 *mac,
1819                                           struct ieee80211_vif *vif)
1820 {
1821         struct iwl_bcast_iter_data *data = _data;
1822         struct iwl_mvm *mvm = data->mvm;
1823         struct iwl_bcast_filter_cmd *cmd = data->cmd;
1824         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1825         struct iwl_fw_bcast_mac *bcast_mac;
1826         int i;
1827
1828         if (WARN_ON(mvmvif->id >= ARRAY_SIZE(cmd->macs)))
1829                 return;
1830
1831         bcast_mac = &cmd->macs[mvmvif->id];
1832
1833         /*
1834          * enable filtering only for associated stations, but not for P2P
1835          * Clients
1836          */
1837         if (vif->type != NL80211_IFTYPE_STATION || vif->p2p ||
1838             !vif->bss_conf.assoc)
1839                 return;
1840
1841         bcast_mac->default_discard = 1;
1842
1843         /* copy all configured filters */
1844         for (i = 0; mvm->bcast_filters[i].attrs[0].mask; i++) {
1845                 /*
1846                  * Make sure we don't exceed our filters limit.
1847                  * if there is still a valid filter to be configured,
1848                  * be on the safe side and just allow bcast for this mac.
1849                  */
1850                 if (WARN_ON_ONCE(data->current_filter >=
1851                                  ARRAY_SIZE(cmd->filters))) {
1852                         bcast_mac->default_discard = 0;
1853                         bcast_mac->attached_filters = 0;
1854                         break;
1855                 }
1856
1857                 iwl_mvm_set_bcast_filter(vif,
1858                                          &mvm->bcast_filters[i],
1859                                          &cmd->filters[data->current_filter]);
1860
1861                 /* skip current filter if it contains no attributes */
1862                 if (!cmd->filters[data->current_filter].num_attrs)
1863                         continue;
1864
1865                 /* attach the filter to current mac */
1866                 bcast_mac->attached_filters |=
1867                                 cpu_to_le16(BIT(data->current_filter));
1868
1869                 data->current_filter++;
1870         }
1871 }
1872
1873 bool iwl_mvm_bcast_filter_build_cmd(struct iwl_mvm *mvm,
1874                                     struct iwl_bcast_filter_cmd *cmd)
1875 {
1876         struct iwl_bcast_iter_data iter_data = {
1877                 .mvm = mvm,
1878                 .cmd = cmd,
1879         };
1880
1881         if (IWL_MVM_FW_BCAST_FILTER_PASS_ALL)
1882                 return false;
1883
1884         memset(cmd, 0, sizeof(*cmd));
1885         cmd->max_bcast_filters = ARRAY_SIZE(cmd->filters);
1886         cmd->max_macs = ARRAY_SIZE(cmd->macs);
1887
1888 #ifdef CONFIG_IWLWIFI_DEBUGFS
1889         /* use debugfs filters/macs if override is configured */
1890         if (mvm->dbgfs_bcast_filtering.override) {
1891                 memcpy(cmd->filters, &mvm->dbgfs_bcast_filtering.cmd.filters,
1892                        sizeof(cmd->filters));
1893                 memcpy(cmd->macs, &mvm->dbgfs_bcast_filtering.cmd.macs,
1894                        sizeof(cmd->macs));
1895                 return true;
1896         }
1897 #endif
1898
1899         /* if no filters are configured, do nothing */
1900         if (!mvm->bcast_filters)
1901                 return false;
1902
1903         /* configure and attach these filters for each associated sta vif */
1904         ieee80211_iterate_active_interfaces(
1905                 mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1906                 iwl_mvm_bcast_filter_iterator, &iter_data);
1907
1908         return true;
1909 }
1910
1911 static int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
1912 {
1913         struct iwl_bcast_filter_cmd cmd;
1914
1915         if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BCAST_FILTERING))
1916                 return 0;
1917
1918         if (!iwl_mvm_bcast_filter_build_cmd(mvm, &cmd))
1919                 return 0;
1920
1921         return iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, 0,
1922                                     sizeof(cmd), &cmd);
1923 }
1924 #else
1925 static inline int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
1926 {
1927         return 0;
1928 }
1929 #endif
1930
1931 static int iwl_mvm_update_mu_groups(struct iwl_mvm *mvm,
1932                                     struct ieee80211_vif *vif)
1933 {
1934         struct iwl_mu_group_mgmt_cmd cmd = {};
1935
1936         memcpy(cmd.membership_status, vif->bss_conf.mu_group.membership,
1937                WLAN_MEMBERSHIP_LEN);
1938         memcpy(cmd.user_position, vif->bss_conf.mu_group.position,
1939                WLAN_USER_POSITION_LEN);
1940
1941         return iwl_mvm_send_cmd_pdu(mvm,
1942                                     WIDE_ID(DATA_PATH_GROUP,
1943                                             UPDATE_MU_GROUPS_CMD),
1944                                     0, sizeof(cmd), &cmd);
1945 }
1946
1947 static void iwl_mvm_mu_mimo_iface_iterator(void *_data, u8 *mac,
1948                                            struct ieee80211_vif *vif)
1949 {
1950         if (vif->mu_mimo_owner) {
1951                 struct iwl_mu_group_mgmt_notif *notif = _data;
1952
1953                 /*
1954                  * MU-MIMO Group Id action frame is little endian. We treat
1955                  * the data received from firmware as if it came from the
1956                  * action frame, so no conversion is needed.
1957                  */
1958                 ieee80211_update_mu_groups(vif,
1959                                            (u8 *)&notif->membership_status,
1960                                            (u8 *)&notif->user_position);
1961         }
1962 }
1963
1964 void iwl_mvm_mu_mimo_grp_notif(struct iwl_mvm *mvm,
1965                                struct iwl_rx_cmd_buffer *rxb)
1966 {
1967         struct iwl_rx_packet *pkt = rxb_addr(rxb);
1968         struct iwl_mu_group_mgmt_notif *notif = (void *)pkt->data;
1969
1970         ieee80211_iterate_active_interfaces_atomic(
1971                         mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1972                         iwl_mvm_mu_mimo_iface_iterator, notif);
1973 }
1974
1975 static u8 iwl_mvm_he_get_ppe_val(u8 *ppe, u8 ppe_pos_bit)
1976 {
1977         u8 byte_num = ppe_pos_bit / 8;
1978         u8 bit_num = ppe_pos_bit % 8;
1979         u8 residue_bits;
1980         u8 res;
1981
1982         if (bit_num <= 5)
1983                 return (ppe[byte_num] >> bit_num) &
1984                        (BIT(IEEE80211_PPE_THRES_INFO_PPET_SIZE) - 1);
1985
1986         /*
1987          * If bit_num > 5, we have to combine bits with next byte.
1988          * Calculate how many bits we need to take from current byte (called
1989          * here "residue_bits"), and add them to bits from next byte.
1990          */
1991
1992         residue_bits = 8 - bit_num;
1993
1994         res = (ppe[byte_num + 1] &
1995                (BIT(IEEE80211_PPE_THRES_INFO_PPET_SIZE - residue_bits) - 1)) <<
1996               residue_bits;
1997         res += (ppe[byte_num] >> bit_num) & (BIT(residue_bits) - 1);
1998
1999         return res;
2000 }
2001
2002 static void iwl_mvm_cfg_he_sta(struct iwl_mvm *mvm,
2003                                struct ieee80211_vif *vif, u8 sta_id)
2004 {
2005         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2006         struct iwl_he_sta_context_cmd sta_ctxt_cmd = {
2007                 .sta_id = sta_id,
2008                 .tid_limit = IWL_MAX_TID_COUNT,
2009                 .bss_color = vif->bss_conf.bss_color,
2010                 .htc_trig_based_pkt_ext = vif->bss_conf.htc_trig_based_pkt_ext,
2011                 .frame_time_rts_th =
2012                         cpu_to_le16(vif->bss_conf.frame_time_rts_th),
2013         };
2014         int size = fw_has_api(&mvm->fw->ucode_capa,
2015                               IWL_UCODE_TLV_API_MBSSID_HE) ?
2016                    sizeof(sta_ctxt_cmd) :
2017                    sizeof(struct iwl_he_sta_context_cmd_v1);
2018         struct ieee80211_sta *sta;
2019         u32 flags;
2020         int i;
2021
2022         rcu_read_lock();
2023
2024         sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_ctxt_cmd.sta_id]);
2025         if (IS_ERR_OR_NULL(sta)) {
2026                 rcu_read_unlock();
2027                 WARN(1, "Can't find STA to configure HE\n");
2028                 return;
2029         }
2030
2031         if (!sta->he_cap.has_he) {
2032                 rcu_read_unlock();
2033                 return;
2034         }
2035
2036         flags = 0;
2037
2038         /* Block 26-tone RU OFDMA transmissions */
2039         if (mvmvif->he_ru_2mhz_block)
2040                 flags |= STA_CTXT_HE_RU_2MHZ_BLOCK;
2041
2042         /* HTC flags */
2043         if (sta->he_cap.he_cap_elem.mac_cap_info[0] &
2044             IEEE80211_HE_MAC_CAP0_HTC_HE)
2045                 sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_SUPPORT);
2046         if ((sta->he_cap.he_cap_elem.mac_cap_info[1] &
2047               IEEE80211_HE_MAC_CAP1_LINK_ADAPTATION) ||
2048             (sta->he_cap.he_cap_elem.mac_cap_info[2] &
2049               IEEE80211_HE_MAC_CAP2_LINK_ADAPTATION)) {
2050                 u8 link_adap =
2051                         ((sta->he_cap.he_cap_elem.mac_cap_info[2] &
2052                           IEEE80211_HE_MAC_CAP2_LINK_ADAPTATION) << 1) +
2053                          (sta->he_cap.he_cap_elem.mac_cap_info[1] &
2054                           IEEE80211_HE_MAC_CAP1_LINK_ADAPTATION);
2055
2056                 if (link_adap == 2)
2057                         sta_ctxt_cmd.htc_flags |=
2058                                 cpu_to_le32(IWL_HE_HTC_LINK_ADAP_UNSOLICITED);
2059                 else if (link_adap == 3)
2060                         sta_ctxt_cmd.htc_flags |=
2061                                 cpu_to_le32(IWL_HE_HTC_LINK_ADAP_BOTH);
2062         }
2063         if (sta->he_cap.he_cap_elem.mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
2064                 sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_BSR_SUPP);
2065         if (sta->he_cap.he_cap_elem.mac_cap_info[3] &
2066             IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
2067                 sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_OMI_SUPP);
2068         if (sta->he_cap.he_cap_elem.mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
2069                 sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_BQR_SUPP);
2070
2071         /*
2072          * Initialize the PPE thresholds to "None" (7), as described in Table
2073          * 9-262ac of 80211.ax/D3.0.
2074          */
2075         memset(&sta_ctxt_cmd.pkt_ext, 7, sizeof(sta_ctxt_cmd.pkt_ext));
2076
2077         /* If PPE Thresholds exist, parse them into a FW-familiar format. */
2078         if (sta->he_cap.he_cap_elem.phy_cap_info[6] &
2079             IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT) {
2080                 u8 nss = (sta->he_cap.ppe_thres[0] &
2081                           IEEE80211_PPE_THRES_NSS_MASK) + 1;
2082                 u8 ru_index_bitmap =
2083                         (sta->he_cap.ppe_thres[0] &
2084                          IEEE80211_PPE_THRES_RU_INDEX_BITMASK_MASK) >>
2085                         IEEE80211_PPE_THRES_RU_INDEX_BITMASK_POS;
2086                 u8 *ppe = &sta->he_cap.ppe_thres[0];
2087                 u8 ppe_pos_bit = 7; /* Starting after PPE header */
2088
2089                 /*
2090                  * FW currently supports only nss == MAX_HE_SUPP_NSS
2091                  *
2092                  * If nss > MAX: we can ignore values we don't support
2093                  * If nss < MAX: we can set zeros in other streams
2094                  */
2095                 if (nss > MAX_HE_SUPP_NSS) {
2096                         IWL_INFO(mvm, "Got NSS = %d - trimming to %d\n", nss,
2097                                  MAX_HE_SUPP_NSS);
2098                         nss = MAX_HE_SUPP_NSS;
2099                 }
2100
2101                 for (i = 0; i < nss; i++) {
2102                         u8 ru_index_tmp = ru_index_bitmap << 1;
2103                         u8 bw;
2104
2105                         for (bw = 0; bw < MAX_HE_CHANNEL_BW_INDX; bw++) {
2106                                 ru_index_tmp >>= 1;
2107                                 if (!(ru_index_tmp & 1))
2108                                         continue;
2109
2110                                 sta_ctxt_cmd.pkt_ext.pkt_ext_qam_th[i][bw][1] =
2111                                         iwl_mvm_he_get_ppe_val(ppe,
2112                                                                ppe_pos_bit);
2113                                 ppe_pos_bit +=
2114                                         IEEE80211_PPE_THRES_INFO_PPET_SIZE;
2115                                 sta_ctxt_cmd.pkt_ext.pkt_ext_qam_th[i][bw][0] =
2116                                         iwl_mvm_he_get_ppe_val(ppe,
2117                                                                ppe_pos_bit);
2118                                 ppe_pos_bit +=
2119                                         IEEE80211_PPE_THRES_INFO_PPET_SIZE;
2120                         }
2121                 }
2122
2123                 flags |= STA_CTXT_HE_PACKET_EXT;
2124         } else if ((sta->he_cap.he_cap_elem.phy_cap_info[9] &
2125                     IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_MASK) !=
2126                   IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_RESERVED) {
2127                 int low_th = -1;
2128                 int high_th = -1;
2129
2130                 /* Take the PPE thresholds from the nominal padding info */
2131                 switch (sta->he_cap.he_cap_elem.phy_cap_info[9] &
2132                         IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_MASK) {
2133                 case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_0US:
2134                         low_th = IWL_HE_PKT_EXT_NONE;
2135                         high_th = IWL_HE_PKT_EXT_NONE;
2136                         break;
2137                 case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_8US:
2138                         low_th = IWL_HE_PKT_EXT_BPSK;
2139                         high_th = IWL_HE_PKT_EXT_NONE;
2140                         break;
2141                 case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_16US:
2142                         low_th = IWL_HE_PKT_EXT_NONE;
2143                         high_th = IWL_HE_PKT_EXT_BPSK;
2144                         break;
2145                 }
2146
2147                 /* Set the PPE thresholds accordingly */
2148                 if (low_th >= 0 && high_th >= 0) {
2149                         struct iwl_he_pkt_ext *pkt_ext =
2150                                 (struct iwl_he_pkt_ext *)&sta_ctxt_cmd.pkt_ext;
2151
2152                         for (i = 0; i < MAX_HE_SUPP_NSS; i++) {
2153                                 u8 bw;
2154
2155                                 for (bw = 0; bw < MAX_HE_CHANNEL_BW_INDX;
2156                                      bw++) {
2157                                         pkt_ext->pkt_ext_qam_th[i][bw][0] =
2158                                                 low_th;
2159                                         pkt_ext->pkt_ext_qam_th[i][bw][1] =
2160                                                 high_th;
2161                                 }
2162                         }
2163
2164                         flags |= STA_CTXT_HE_PACKET_EXT;
2165                 }
2166         }
2167         rcu_read_unlock();
2168
2169         /* Mark MU EDCA as enabled, unless none detected on some AC */
2170         flags |= STA_CTXT_HE_MU_EDCA_CW;
2171         for (i = 0; i < IEEE80211_NUM_ACS; i++) {
2172                 struct ieee80211_he_mu_edca_param_ac_rec *mu_edca =
2173                         &mvmvif->queue_params[i].mu_edca_param_rec;
2174                 u8 ac = iwl_mvm_mac80211_ac_to_ucode_ac(i);
2175
2176                 if (!mvmvif->queue_params[i].mu_edca) {
2177                         flags &= ~STA_CTXT_HE_MU_EDCA_CW;
2178                         break;
2179                 }
2180
2181                 sta_ctxt_cmd.trig_based_txf[ac].cwmin =
2182                         cpu_to_le16(mu_edca->ecw_min_max & 0xf);
2183                 sta_ctxt_cmd.trig_based_txf[ac].cwmax =
2184                         cpu_to_le16((mu_edca->ecw_min_max & 0xf0) >> 4);
2185                 sta_ctxt_cmd.trig_based_txf[ac].aifsn =
2186                         cpu_to_le16(mu_edca->aifsn);
2187                 sta_ctxt_cmd.trig_based_txf[ac].mu_time =
2188                         cpu_to_le16(mu_edca->mu_edca_timer);
2189         }
2190
2191         if (vif->bss_conf.multi_sta_back_32bit)
2192                 flags |= STA_CTXT_HE_32BIT_BA_BITMAP;
2193
2194         if (vif->bss_conf.ack_enabled)
2195                 flags |= STA_CTXT_HE_ACK_ENABLED;
2196
2197         if (vif->bss_conf.uora_exists) {
2198                 flags |= STA_CTXT_HE_TRIG_RND_ALLOC;
2199
2200                 sta_ctxt_cmd.rand_alloc_ecwmin =
2201                         vif->bss_conf.uora_ocw_range & 0x7;
2202                 sta_ctxt_cmd.rand_alloc_ecwmax =
2203                         (vif->bss_conf.uora_ocw_range >> 3) & 0x7;
2204         }
2205
2206         if (vif->bss_conf.nontransmitted) {
2207                 flags |= STA_CTXT_HE_REF_BSSID_VALID;
2208                 ether_addr_copy(sta_ctxt_cmd.ref_bssid_addr,
2209                                 vif->bss_conf.transmitter_bssid);
2210                 sta_ctxt_cmd.max_bssid_indicator =
2211                         vif->bss_conf.bssid_indicator;
2212                 sta_ctxt_cmd.bssid_index = vif->bss_conf.bssid_index;
2213                 sta_ctxt_cmd.ema_ap = vif->bss_conf.ema_ap;
2214                 sta_ctxt_cmd.profile_periodicity =
2215                         vif->bss_conf.profile_periodicity;
2216         }
2217
2218         sta_ctxt_cmd.flags = cpu_to_le32(flags);
2219
2220         if (iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(STA_HE_CTXT_CMD,
2221                                                  DATA_PATH_GROUP, 0),
2222                                  0, size, &sta_ctxt_cmd))
2223                 IWL_ERR(mvm, "Failed to config FW to work HE!\n");
2224 }
2225
2226 static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
2227                                              struct ieee80211_vif *vif,
2228                                              struct ieee80211_bss_conf *bss_conf,
2229                                              u32 changes)
2230 {
2231         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2232         int ret;
2233
2234         /*
2235          * Re-calculate the tsf id, as the master-slave relations depend on the
2236          * beacon interval, which was not known when the station interface was
2237          * added.
2238          */
2239         if (changes & BSS_CHANGED_ASSOC && bss_conf->assoc) {
2240                 if (vif->bss_conf.he_support &&
2241                     !iwlwifi_mod_params.disable_11ax)
2242                         iwl_mvm_cfg_he_sta(mvm, vif, mvmvif->ap_sta_id);
2243
2244                 iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
2245         }
2246
2247         /* Update MU EDCA params */
2248         if (changes & BSS_CHANGED_QOS && mvmvif->associated &&
2249             bss_conf->assoc && vif->bss_conf.he_support &&
2250             !iwlwifi_mod_params.disable_11ax)
2251                 iwl_mvm_cfg_he_sta(mvm, vif, mvmvif->ap_sta_id);
2252
2253         /*
2254          * If we're not associated yet, take the (new) BSSID before associating
2255          * so the firmware knows. If we're already associated, then use the old
2256          * BSSID here, and we'll send a cleared one later in the CHANGED_ASSOC
2257          * branch for disassociation below.
2258          */
2259         if (changes & BSS_CHANGED_BSSID && !mvmvif->associated)
2260                 memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
2261
2262         ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, mvmvif->bssid);
2263         if (ret)
2264                 IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
2265
2266         /* after sending it once, adopt mac80211 data */
2267         memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
2268         mvmvif->associated = bss_conf->assoc;
2269
2270         if (changes & BSS_CHANGED_ASSOC) {
2271                 if (bss_conf->assoc) {
2272                         /* clear statistics to get clean beacon counter */
2273                         iwl_mvm_request_statistics(mvm, true);
2274                         memset(&mvmvif->beacon_stats, 0,
2275                                sizeof(mvmvif->beacon_stats));
2276
2277                         /* add quota for this interface */
2278                         ret = iwl_mvm_update_quotas(mvm, true, NULL);
2279                         if (ret) {
2280                                 IWL_ERR(mvm, "failed to update quotas\n");
2281                                 return;
2282                         }
2283
2284                         if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
2285                                      &mvm->status)) {
2286                                 /*
2287                                  * If we're restarting then the firmware will
2288                                  * obviously have lost synchronisation with
2289                                  * the AP. It will attempt to synchronise by
2290                                  * itself, but we can make it more reliable by
2291                                  * scheduling a session protection time event.
2292                                  *
2293                                  * The firmware needs to receive a beacon to
2294                                  * catch up with synchronisation, use 110% of
2295                                  * the beacon interval.
2296                                  *
2297                                  * Set a large maximum delay to allow for more
2298                                  * than a single interface.
2299                                  */
2300                                 u32 dur = (11 * vif->bss_conf.beacon_int) / 10;
2301                                 iwl_mvm_protect_session(mvm, vif, dur, dur,
2302                                                         5 * dur, false);
2303                         }
2304
2305                         iwl_mvm_sf_update(mvm, vif, false);
2306                         iwl_mvm_power_vif_assoc(mvm, vif);
2307                         if (vif->p2p) {
2308                                 iwl_mvm_update_smps(mvm, vif,
2309                                                     IWL_MVM_SMPS_REQ_PROT,
2310                                                     IEEE80211_SMPS_DYNAMIC);
2311                         }
2312                 } else if (mvmvif->ap_sta_id != IWL_MVM_INVALID_STA) {
2313                         /*
2314                          * If update fails - SF might be running in associated
2315                          * mode while disassociated - which is forbidden.
2316                          */
2317                         ret = iwl_mvm_sf_update(mvm, vif, false);
2318                         WARN_ONCE(ret &&
2319                                   !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
2320                                             &mvm->status),
2321                                   "Failed to update SF upon disassociation\n");
2322
2323                         /*
2324                          * If we get an assert during the connection (after the
2325                          * station has been added, but before the vif is set
2326                          * to associated), mac80211 will re-add the station and
2327                          * then configure the vif. Since the vif is not
2328                          * associated, we would remove the station here and
2329                          * this would fail the recovery.
2330                          */
2331                         if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
2332                                       &mvm->status)) {
2333                                 /*
2334                                  * Remove AP station now that
2335                                  * the MAC is unassoc
2336                                  */
2337                                 ret = iwl_mvm_rm_sta_id(mvm, vif,
2338                                                         mvmvif->ap_sta_id);
2339                                 if (ret)
2340                                         IWL_ERR(mvm,
2341                                                 "failed to remove AP station\n");
2342
2343                                 mvmvif->ap_sta_id = IWL_MVM_INVALID_STA;
2344                         }
2345
2346                         /* remove quota for this interface */
2347                         ret = iwl_mvm_update_quotas(mvm, false, NULL);
2348                         if (ret)
2349                                 IWL_ERR(mvm, "failed to update quotas\n");
2350
2351                         /* this will take the cleared BSSID from bss_conf */
2352                         ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
2353                         if (ret)
2354                                 IWL_ERR(mvm,
2355                                         "failed to update MAC %pM (clear after unassoc)\n",
2356                                         vif->addr);
2357                 }
2358
2359                 /*
2360                  * The firmware tracks the MU-MIMO group on its own.
2361                  * However, on HW restart we should restore this data.
2362                  */
2363                 if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
2364                     (changes & BSS_CHANGED_MU_GROUPS) && vif->mu_mimo_owner) {
2365                         ret = iwl_mvm_update_mu_groups(mvm, vif);
2366                         if (ret)
2367                                 IWL_ERR(mvm,
2368                                         "failed to update VHT MU_MIMO groups\n");
2369                 }
2370
2371                 iwl_mvm_recalc_multicast(mvm);
2372                 iwl_mvm_configure_bcast_filter(mvm);
2373
2374                 /* reset rssi values */
2375                 mvmvif->bf_data.ave_beacon_signal = 0;
2376
2377                 iwl_mvm_bt_coex_vif_change(mvm);
2378                 iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_TT,
2379                                     IEEE80211_SMPS_AUTOMATIC);
2380                 if (fw_has_capa(&mvm->fw->ucode_capa,
2381                                 IWL_UCODE_TLV_CAPA_UMAC_SCAN))
2382                         iwl_mvm_config_scan(mvm);
2383         }
2384
2385         if (changes & BSS_CHANGED_BEACON_INFO) {
2386                 /*
2387                  * We received a beacon from the associated AP so
2388                  * remove the session protection.
2389                  */
2390                 iwl_mvm_stop_session_protection(mvm, vif);
2391
2392                 iwl_mvm_sf_update(mvm, vif, false);
2393                 WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
2394         }
2395
2396         if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS | BSS_CHANGED_QOS |
2397                        /*
2398                         * Send power command on every beacon change,
2399                         * because we may have not enabled beacon abort yet.
2400                         */
2401                        BSS_CHANGED_BEACON_INFO)) {
2402                 ret = iwl_mvm_power_update_mac(mvm);
2403                 if (ret)
2404                         IWL_ERR(mvm, "failed to update power mode\n");
2405         }
2406
2407         if (changes & BSS_CHANGED_TXPOWER) {
2408                 IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2409                                 bss_conf->txpower);
2410                 iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2411         }
2412
2413         if (changes & BSS_CHANGED_CQM) {
2414                 IWL_DEBUG_MAC80211(mvm, "cqm info_changed\n");
2415                 /* reset cqm events tracking */
2416                 mvmvif->bf_data.last_cqm_event = 0;
2417                 if (mvmvif->bf_data.bf_enabled) {
2418                         ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
2419                         if (ret)
2420                                 IWL_ERR(mvm,
2421                                         "failed to update CQM thresholds\n");
2422                 }
2423         }
2424
2425         if (changes & BSS_CHANGED_ARP_FILTER) {
2426                 IWL_DEBUG_MAC80211(mvm, "arp filter changed\n");
2427                 iwl_mvm_configure_bcast_filter(mvm);
2428         }
2429 }
2430
2431 static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
2432                                  struct ieee80211_vif *vif)
2433 {
2434         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2435         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2436         int ret, i;
2437
2438         mutex_lock(&mvm->mutex);
2439
2440         /* Send the beacon template */
2441         ret = iwl_mvm_mac_ctxt_beacon_changed(mvm, vif);
2442         if (ret)
2443                 goto out_unlock;
2444
2445         /*
2446          * Re-calculate the tsf id, as the master-slave relations depend on the
2447          * beacon interval, which was not known when the AP interface was added.
2448          */
2449         if (vif->type == NL80211_IFTYPE_AP)
2450                 iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
2451
2452         mvmvif->ap_assoc_sta_count = 0;
2453
2454         /* Add the mac context */
2455         ret = iwl_mvm_mac_ctxt_add(mvm, vif);
2456         if (ret)
2457                 goto out_unlock;
2458
2459         /* Perform the binding */
2460         ret = iwl_mvm_binding_add_vif(mvm, vif);
2461         if (ret)
2462                 goto out_remove;
2463
2464         /*
2465          * This is not very nice, but the simplest:
2466          * For older FWs adding the mcast sta before the bcast station may
2467          * cause assert 0x2b00.
2468          * This is fixed in later FW so make the order of removal depend on
2469          * the TLV
2470          */
2471         if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE)) {
2472                 ret = iwl_mvm_add_mcast_sta(mvm, vif);
2473                 if (ret)
2474                         goto out_unbind;
2475                 /*
2476                  * Send the bcast station. At this stage the TBTT and DTIM time
2477                  * events are added and applied to the scheduler
2478                  */
2479                 ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
2480                 if (ret) {
2481                         iwl_mvm_rm_mcast_sta(mvm, vif);
2482                         goto out_unbind;
2483                 }
2484         } else {
2485                 /*
2486                  * Send the bcast station. At this stage the TBTT and DTIM time
2487                  * events are added and applied to the scheduler
2488                  */
2489                 ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
2490                 if (ret)
2491                         goto out_unbind;
2492                 ret = iwl_mvm_add_mcast_sta(mvm, vif);
2493                 if (ret) {
2494                         iwl_mvm_send_rm_bcast_sta(mvm, vif);
2495                         goto out_unbind;
2496                 }
2497         }
2498
2499         /* must be set before quota calculations */
2500         mvmvif->ap_ibss_active = true;
2501
2502         /* send all the early keys to the device now */
2503         for (i = 0; i < ARRAY_SIZE(mvmvif->ap_early_keys); i++) {
2504                 struct ieee80211_key_conf *key = mvmvif->ap_early_keys[i];
2505
2506                 if (!key)
2507                         continue;
2508
2509                 mvmvif->ap_early_keys[i] = NULL;
2510
2511                 ret = __iwl_mvm_mac_set_key(hw, SET_KEY, vif, NULL, key);
2512                 if (ret)
2513                         goto out_quota_failed;
2514         }
2515
2516         if (vif->type == NL80211_IFTYPE_AP && !vif->p2p) {
2517                 iwl_mvm_vif_set_low_latency(mvmvif, true,
2518                                             LOW_LATENCY_VIF_TYPE);
2519                 iwl_mvm_send_low_latency_cmd(mvm, true, mvmvif->id);
2520         }
2521
2522         /* power updated needs to be done before quotas */
2523         iwl_mvm_power_update_mac(mvm);
2524
2525         ret = iwl_mvm_update_quotas(mvm, false, NULL);
2526         if (ret)
2527                 goto out_quota_failed;
2528
2529         /* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2530         if (vif->p2p && mvm->p2p_device_vif)
2531                 iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2532
2533         iwl_mvm_bt_coex_vif_change(mvm);
2534
2535         /* we don't support TDLS during DCM */
2536         if (iwl_mvm_phy_ctx_count(mvm) > 1)
2537                 iwl_mvm_teardown_tdls_peers(mvm);
2538
2539         iwl_mvm_ftm_restart_responder(mvm, vif);
2540
2541         goto out_unlock;
2542
2543 out_quota_failed:
2544         iwl_mvm_power_update_mac(mvm);
2545         mvmvif->ap_ibss_active = false;
2546         iwl_mvm_send_rm_bcast_sta(mvm, vif);
2547         iwl_mvm_rm_mcast_sta(mvm, vif);
2548 out_unbind:
2549         iwl_mvm_binding_remove_vif(mvm, vif);
2550 out_remove:
2551         iwl_mvm_mac_ctxt_remove(mvm, vif);
2552 out_unlock:
2553         mutex_unlock(&mvm->mutex);
2554         return ret;
2555 }
2556
2557 static void iwl_mvm_stop_ap_ibss(struct ieee80211_hw *hw,
2558                                  struct ieee80211_vif *vif)
2559 {
2560         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2561         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2562
2563         iwl_mvm_prepare_mac_removal(mvm, vif);
2564
2565         mutex_lock(&mvm->mutex);
2566
2567         /* Handle AP stop while in CSA */
2568         if (rcu_access_pointer(mvm->csa_vif) == vif) {
2569                 iwl_mvm_remove_time_event(mvm, mvmvif,
2570                                           &mvmvif->time_event_data);
2571                 RCU_INIT_POINTER(mvm->csa_vif, NULL);
2572                 mvmvif->csa_countdown = false;
2573         }
2574
2575         if (rcu_access_pointer(mvm->csa_tx_blocked_vif) == vif) {
2576                 RCU_INIT_POINTER(mvm->csa_tx_blocked_vif, NULL);
2577                 mvm->csa_tx_block_bcn_timeout = 0;
2578         }
2579
2580         mvmvif->ap_ibss_active = false;
2581         mvm->ap_last_beacon_gp2 = 0;
2582
2583         if (vif->type == NL80211_IFTYPE_AP && !vif->p2p) {
2584                 iwl_mvm_vif_set_low_latency(mvmvif, false,
2585                                             LOW_LATENCY_VIF_TYPE);
2586                 iwl_mvm_send_low_latency_cmd(mvm, false,  mvmvif->id);
2587         }
2588
2589         iwl_mvm_bt_coex_vif_change(mvm);
2590
2591         /* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2592         if (vif->p2p && mvm->p2p_device_vif)
2593                 iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2594
2595         iwl_mvm_update_quotas(mvm, false, NULL);
2596
2597         /*
2598          * This is not very nice, but the simplest:
2599          * For older FWs removing the mcast sta before the bcast station may
2600          * cause assert 0x2b00.
2601          * This is fixed in later FW (which will stop beaconing when removing
2602          * bcast station).
2603          * So make the order of removal depend on the TLV
2604          */
2605         if (!fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE))
2606                 iwl_mvm_rm_mcast_sta(mvm, vif);
2607         iwl_mvm_send_rm_bcast_sta(mvm, vif);
2608         if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE))
2609                 iwl_mvm_rm_mcast_sta(mvm, vif);
2610         iwl_mvm_binding_remove_vif(mvm, vif);
2611
2612         iwl_mvm_power_update_mac(mvm);
2613
2614         iwl_mvm_mac_ctxt_remove(mvm, vif);
2615
2616         mutex_unlock(&mvm->mutex);
2617 }
2618
2619 static void
2620 iwl_mvm_bss_info_changed_ap_ibss(struct iwl_mvm *mvm,
2621                                  struct ieee80211_vif *vif,
2622                                  struct ieee80211_bss_conf *bss_conf,
2623                                  u32 changes)
2624 {
2625         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2626
2627         /* Changes will be applied when the AP/IBSS is started */
2628         if (!mvmvif->ap_ibss_active)
2629                 return;
2630
2631         if (changes & (BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_HT |
2632                        BSS_CHANGED_BANDWIDTH | BSS_CHANGED_QOS) &&
2633             iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL))
2634                 IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
2635
2636         /* Need to send a new beacon template to the FW */
2637         if (changes & BSS_CHANGED_BEACON &&
2638             iwl_mvm_mac_ctxt_beacon_changed(mvm, vif))
2639                 IWL_WARN(mvm, "Failed updating beacon data\n");
2640
2641         if (changes & BSS_CHANGED_TXPOWER) {
2642                 IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2643                                 bss_conf->txpower);
2644                 iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2645         }
2646
2647         if (changes & BSS_CHANGED_FTM_RESPONDER) {
2648                 int ret = iwl_mvm_ftm_start_responder(mvm, vif);
2649
2650                 if (ret)
2651                         IWL_WARN(mvm, "Failed to enable FTM responder (%d)\n",
2652                                  ret);
2653         }
2654
2655 }
2656
2657 static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw,
2658                                      struct ieee80211_vif *vif,
2659                                      struct ieee80211_bss_conf *bss_conf,
2660                                      u32 changes)
2661 {
2662         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2663
2664         mutex_lock(&mvm->mutex);
2665
2666         if (changes & BSS_CHANGED_IDLE && !bss_conf->idle)
2667                 iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true);
2668
2669         switch (vif->type) {
2670         case NL80211_IFTYPE_STATION:
2671                 iwl_mvm_bss_info_changed_station(mvm, vif, bss_conf, changes);
2672                 break;
2673         case NL80211_IFTYPE_AP:
2674         case NL80211_IFTYPE_ADHOC:
2675                 iwl_mvm_bss_info_changed_ap_ibss(mvm, vif, bss_conf, changes);
2676                 break;
2677         case NL80211_IFTYPE_MONITOR:
2678                 if (changes & BSS_CHANGED_MU_GROUPS)
2679                         iwl_mvm_update_mu_groups(mvm, vif);
2680                 break;
2681         default:
2682                 /* shouldn't happen */
2683                 WARN_ON_ONCE(1);
2684         }
2685
2686         mutex_unlock(&mvm->mutex);
2687 }
2688
2689 static int iwl_mvm_mac_hw_scan(struct ieee80211_hw *hw,
2690                                struct ieee80211_vif *vif,
2691                                struct ieee80211_scan_request *hw_req)
2692 {
2693         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2694         int ret;
2695
2696         if (hw_req->req.n_channels == 0 ||
2697             hw_req->req.n_channels > mvm->fw->ucode_capa.n_scan_channels)
2698                 return -EINVAL;
2699
2700         mutex_lock(&mvm->mutex);
2701         ret = iwl_mvm_reg_scan_start(mvm, vif, &hw_req->req, &hw_req->ies);
2702         mutex_unlock(&mvm->mutex);
2703
2704         return ret;
2705 }
2706
2707 static void iwl_mvm_mac_cancel_hw_scan(struct ieee80211_hw *hw,
2708                                        struct ieee80211_vif *vif)
2709 {
2710         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2711
2712         mutex_lock(&mvm->mutex);
2713
2714         /* Due to a race condition, it's possible that mac80211 asks
2715          * us to stop a hw_scan when it's already stopped.  This can
2716          * happen, for instance, if we stopped the scan ourselves,
2717          * called ieee80211_scan_completed() and the userspace called
2718          * cancel scan scan before ieee80211_scan_work() could run.
2719          * To handle that, simply return if the scan is not running.
2720         */
2721         if (mvm->scan_status & IWL_MVM_SCAN_REGULAR)
2722                 iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true);
2723
2724         mutex_unlock(&mvm->mutex);
2725 }
2726
2727 static void
2728 iwl_mvm_mac_allow_buffered_frames(struct ieee80211_hw *hw,
2729                                   struct ieee80211_sta *sta, u16 tids,
2730                                   int num_frames,
2731                                   enum ieee80211_frame_release_type reason,
2732                                   bool more_data)
2733 {
2734         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2735
2736         /* Called when we need to transmit (a) frame(s) from mac80211 */
2737
2738         iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2739                                           tids, more_data, false);
2740 }
2741
2742 static void
2743 iwl_mvm_mac_release_buffered_frames(struct ieee80211_hw *hw,
2744                                     struct ieee80211_sta *sta, u16 tids,
2745                                     int num_frames,
2746                                     enum ieee80211_frame_release_type reason,
2747                                     bool more_data)
2748 {
2749         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2750
2751         /* Called when we need to transmit (a) frame(s) from agg or dqa queue */
2752
2753         iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2754                                           tids, more_data, true);
2755 }
2756
2757 static void __iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
2758                                      enum sta_notify_cmd cmd,
2759                                      struct ieee80211_sta *sta)
2760 {
2761         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2762         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
2763         unsigned long txqs = 0, tids = 0;
2764         int tid;
2765
2766         /*
2767          * If we have TVQM then we get too high queue numbers - luckily
2768          * we really shouldn't get here with that because such hardware
2769          * should have firmware supporting buffer station offload.
2770          */
2771         if (WARN_ON(iwl_mvm_has_new_tx_api(mvm)))
2772                 return;
2773
2774         spin_lock_bh(&mvmsta->lock);
2775         for (tid = 0; tid < ARRAY_SIZE(mvmsta->tid_data); tid++) {
2776                 struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
2777
2778                 if (tid_data->txq_id == IWL_MVM_INVALID_QUEUE)
2779                         continue;
2780
2781                 __set_bit(tid_data->txq_id, &txqs);
2782
2783                 if (iwl_mvm_tid_queued(mvm, tid_data) == 0)
2784                         continue;
2785
2786                 __set_bit(tid, &tids);
2787         }
2788
2789         switch (cmd) {
2790         case STA_NOTIFY_SLEEP:
2791                 for_each_set_bit(tid, &tids, IWL_MAX_TID_COUNT)
2792                         ieee80211_sta_set_buffered(sta, tid, true);
2793
2794                 if (txqs)
2795                         iwl_trans_freeze_txq_timer(mvm->trans, txqs, true);
2796                 /*
2797                  * The fw updates the STA to be asleep. Tx packets on the Tx
2798                  * queues to this station will not be transmitted. The fw will
2799                  * send a Tx response with TX_STATUS_FAIL_DEST_PS.
2800                  */
2801                 break;
2802         case STA_NOTIFY_AWAKE:
2803                 if (WARN_ON(mvmsta->sta_id == IWL_MVM_INVALID_STA))
2804                         break;
2805
2806                 if (txqs)
2807                         iwl_trans_freeze_txq_timer(mvm->trans, txqs, false);
2808                 iwl_mvm_sta_modify_ps_wake(mvm, sta);
2809                 break;
2810         default:
2811                 break;
2812         }
2813         spin_unlock_bh(&mvmsta->lock);
2814 }
2815
2816 static void iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
2817                                    struct ieee80211_vif *vif,
2818                                    enum sta_notify_cmd cmd,
2819                                    struct ieee80211_sta *sta)
2820 {
2821         __iwl_mvm_mac_sta_notify(hw, cmd, sta);
2822 }
2823
2824 void iwl_mvm_sta_pm_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
2825 {
2826         struct iwl_rx_packet *pkt = rxb_addr(rxb);
2827         struct iwl_mvm_pm_state_notification *notif = (void *)pkt->data;
2828         struct ieee80211_sta *sta;
2829         struct iwl_mvm_sta *mvmsta;
2830         bool sleeping = (notif->type != IWL_MVM_PM_EVENT_AWAKE);
2831
2832         if (WARN_ON(notif->sta_id >= ARRAY_SIZE(mvm->fw_id_to_mac_id)))
2833                 return;
2834
2835         rcu_read_lock();
2836         sta = rcu_dereference(mvm->fw_id_to_mac_id[notif->sta_id]);
2837         if (WARN_ON(IS_ERR_OR_NULL(sta))) {
2838                 rcu_read_unlock();
2839                 return;
2840         }
2841
2842         mvmsta = iwl_mvm_sta_from_mac80211(sta);
2843
2844         if (!mvmsta->vif ||
2845             mvmsta->vif->type != NL80211_IFTYPE_AP) {
2846                 rcu_read_unlock();
2847                 return;
2848         }
2849
2850         if (mvmsta->sleeping != sleeping) {
2851                 mvmsta->sleeping = sleeping;
2852                 __iwl_mvm_mac_sta_notify(mvm->hw,
2853                         sleeping ? STA_NOTIFY_SLEEP : STA_NOTIFY_AWAKE,
2854                         sta);
2855                 ieee80211_sta_ps_transition(sta, sleeping);
2856         }
2857
2858         if (sleeping) {
2859                 switch (notif->type) {
2860                 case IWL_MVM_PM_EVENT_AWAKE:
2861                 case IWL_MVM_PM_EVENT_ASLEEP:
2862                         break;
2863                 case IWL_MVM_PM_EVENT_UAPSD:
2864                         ieee80211_sta_uapsd_trigger(sta, IEEE80211_NUM_TIDS);
2865                         break;
2866                 case IWL_MVM_PM_EVENT_PS_POLL:
2867                         ieee80211_sta_pspoll(sta);
2868                         break;
2869                 default:
2870                         break;
2871                 }
2872         }
2873
2874         rcu_read_unlock();
2875 }
2876
2877 static void iwl_mvm_sta_pre_rcu_remove(struct ieee80211_hw *hw,
2878                                        struct ieee80211_vif *vif,
2879                                        struct ieee80211_sta *sta)
2880 {
2881         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2882         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
2883
2884         /*
2885          * This is called before mac80211 does RCU synchronisation,
2886          * so here we already invalidate our internal RCU-protected
2887          * station pointer. The rest of the code will thus no longer
2888          * be able to find the station this way, and we don't rely
2889          * on further RCU synchronisation after the sta_state()
2890          * callback deleted the station.
2891          */
2892         mutex_lock(&mvm->mutex);
2893         if (sta == rcu_access_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id]))
2894                 rcu_assign_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id],
2895                                    ERR_PTR(-ENOENT));
2896
2897         mutex_unlock(&mvm->mutex);
2898 }
2899
2900 static void iwl_mvm_check_uapsd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
2901                                 const u8 *bssid)
2902 {
2903         int i;
2904
2905         if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
2906                 struct iwl_mvm_tcm_mac *mdata;
2907
2908                 mdata = &mvm->tcm.data[iwl_mvm_vif_from_mac80211(vif)->id];
2909                 ewma_rate_init(&mdata->uapsd_nonagg_detect.rate);
2910                 mdata->opened_rx_ba_sessions = false;
2911         }
2912
2913         if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT))
2914                 return;
2915
2916         if (vif->p2p && !iwl_mvm_is_p2p_scm_uapsd_supported(mvm)) {
2917                 vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2918                 return;
2919         }
2920
2921         if (!vif->p2p &&
2922             (iwlwifi_mod_params.uapsd_disable & IWL_DISABLE_UAPSD_BSS)) {
2923                 vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2924                 return;
2925         }
2926
2927         for (i = 0; i < IWL_MVM_UAPSD_NOAGG_LIST_LEN; i++) {
2928                 if (ether_addr_equal(mvm->uapsd_noagg_bssids[i].addr, bssid)) {
2929                         vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2930                         return;
2931                 }
2932         }
2933
2934         vif->driver_flags |= IEEE80211_VIF_SUPPORTS_UAPSD;
2935 }
2936
2937 static void
2938 iwl_mvm_tdls_check_trigger(struct iwl_mvm *mvm,
2939                            struct ieee80211_vif *vif, u8 *peer_addr,
2940                            enum nl80211_tdls_operation action)
2941 {
2942         struct iwl_fw_dbg_trigger_tlv *trig;
2943         struct iwl_fw_dbg_trigger_tdls *tdls_trig;
2944
2945         trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
2946                                      FW_DBG_TRIGGER_TDLS);
2947         if (!trig)
2948                 return;
2949
2950         tdls_trig = (void *)trig->data;
2951
2952         if (!(tdls_trig->action_bitmap & BIT(action)))
2953                 return;
2954
2955         if (tdls_trig->peer_mode &&
2956             memcmp(tdls_trig->peer, peer_addr, ETH_ALEN) != 0)
2957                 return;
2958
2959         iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
2960                                 "TDLS event occurred, peer %pM, action %d",
2961                                 peer_addr, action);
2962 }
2963
2964 struct iwl_mvm_he_obss_narrow_bw_ru_data {
2965         bool tolerated;
2966 };
2967
2968 static void iwl_mvm_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
2969                                                     struct cfg80211_bss *bss,
2970                                                     void *_data)
2971 {
2972         struct iwl_mvm_he_obss_narrow_bw_ru_data *data = _data;
2973         const struct element *elem;
2974
2975         elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY, bss->ies->data,
2976                                   bss->ies->len);
2977
2978         if (!elem || elem->datalen < 10 ||
2979             !(elem->data[10] &
2980               WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT)) {
2981                 data->tolerated = false;
2982         }
2983 }
2984
2985 static void iwl_mvm_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
2986                                                struct ieee80211_vif *vif)
2987 {
2988         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2989         struct iwl_mvm_he_obss_narrow_bw_ru_data iter_data = {
2990                 .tolerated = true,
2991         };
2992
2993         if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR)) {
2994                 mvmvif->he_ru_2mhz_block = false;
2995                 return;
2996         }
2997
2998         cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
2999                           iwl_mvm_check_he_obss_narrow_bw_ru_iter,
3000                           &iter_data);
3001
3002         /*
3003          * If there is at least one AP on radar channel that cannot
3004          * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
3005          */
3006         mvmvif->he_ru_2mhz_block = !iter_data.tolerated;
3007 }
3008
3009 static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
3010                                  struct ieee80211_vif *vif,
3011                                  struct ieee80211_sta *sta,
3012                                  enum ieee80211_sta_state old_state,
3013                                  enum ieee80211_sta_state new_state)
3014 {
3015         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3016         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3017         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
3018         int ret;
3019
3020         IWL_DEBUG_MAC80211(mvm, "station %pM state change %d->%d\n",
3021                            sta->addr, old_state, new_state);
3022
3023         /* this would be a mac80211 bug ... but don't crash */
3024         if (WARN_ON_ONCE(!mvmvif->phy_ctxt))
3025                 return -EINVAL;
3026
3027         /*
3028          * If we are in a STA removal flow and in DQA mode:
3029          *
3030          * This is after the sync_rcu part, so the queues have already been
3031          * flushed. No more TXs on their way in mac80211's path, and no more in
3032          * the queues.
3033          * Also, we won't be getting any new TX frames for this station.
3034          * What we might have are deferred TX frames that need to be taken care
3035          * of.
3036          *
3037          * Drop any still-queued deferred-frame before removing the STA, and
3038          * make sure the worker is no longer handling frames for this STA.
3039          */
3040         if (old_state == IEEE80211_STA_NONE &&
3041             new_state == IEEE80211_STA_NOTEXIST) {
3042                 flush_work(&mvm->add_stream_wk);
3043
3044                 /*
3045                  * No need to make sure deferred TX indication is off since the
3046                  * worker will already remove it if it was on
3047                  */
3048         }
3049
3050         mutex_lock(&mvm->mutex);
3051         /* track whether or not the station is associated */
3052         mvm_sta->sta_state = new_state;
3053
3054         if (old_state == IEEE80211_STA_NOTEXIST &&
3055             new_state == IEEE80211_STA_NONE) {
3056                 /*
3057                  * Firmware bug - it'll crash if the beacon interval is less
3058                  * than 16. We can't avoid connecting at all, so refuse the
3059                  * station state change, this will cause mac80211 to abandon
3060                  * attempts to connect to this AP, and eventually wpa_s will
3061                  * blacklist the AP...
3062                  */
3063                 if (vif->type == NL80211_IFTYPE_STATION &&
3064                     vif->bss_conf.beacon_int < 16) {
3065                         IWL_ERR(mvm,
3066                                 "AP %pM beacon interval is %d, refusing due to firmware bug!\n",
3067                                 sta->addr, vif->bss_conf.beacon_int);
3068                         ret = -EINVAL;
3069                         goto out_unlock;
3070                 }
3071
3072                 if (sta->tdls &&
3073                     (vif->p2p ||
3074                      iwl_mvm_tdls_sta_count(mvm, NULL) ==
3075                                                 IWL_MVM_TDLS_STA_COUNT ||
3076                      iwl_mvm_phy_ctx_count(mvm) > 1)) {
3077                         IWL_DEBUG_MAC80211(mvm, "refusing TDLS sta\n");
3078                         ret = -EBUSY;
3079                         goto out_unlock;
3080                 }
3081
3082                 ret = iwl_mvm_add_sta(mvm, vif, sta);
3083                 if (sta->tdls && ret == 0) {
3084                         iwl_mvm_recalc_tdls_state(mvm, vif, true);
3085                         iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3086                                                    NL80211_TDLS_SETUP);
3087                 }
3088
3089                 sta->max_rc_amsdu_len = 1;
3090         } else if (old_state == IEEE80211_STA_NONE &&
3091                    new_state == IEEE80211_STA_AUTH) {
3092                 /*
3093                  * EBS may be disabled due to previous failures reported by FW.
3094                  * Reset EBS status here assuming environment has been changed.
3095                  */
3096                 mvm->last_ebs_successful = true;
3097                 iwl_mvm_check_uapsd(mvm, vif, sta->addr);
3098                 ret = 0;
3099         } else if (old_state == IEEE80211_STA_AUTH &&
3100                    new_state == IEEE80211_STA_ASSOC) {
3101                 if (vif->type == NL80211_IFTYPE_AP) {
3102                         vif->bss_conf.he_support = sta->he_cap.has_he;
3103                         mvmvif->ap_assoc_sta_count++;
3104                         iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3105                         if (vif->bss_conf.he_support &&
3106                             !iwlwifi_mod_params.disable_11ax)
3107                                 iwl_mvm_cfg_he_sta(mvm, vif, mvm_sta->sta_id);
3108                 } else if (vif->type == NL80211_IFTYPE_STATION) {
3109                         vif->bss_conf.he_support = sta->he_cap.has_he;
3110
3111                         mvmvif->he_ru_2mhz_block = false;
3112                         if (sta->he_cap.has_he)
3113                                 iwl_mvm_check_he_obss_narrow_bw_ru(hw, vif);
3114
3115                         iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3116                 }
3117
3118                 iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3119                                      false);
3120                 ret = iwl_mvm_update_sta(mvm, vif, sta);
3121         } else if (old_state == IEEE80211_STA_ASSOC &&
3122                    new_state == IEEE80211_STA_AUTHORIZED) {
3123                 ret = 0;
3124
3125                 /* we don't support TDLS during DCM */
3126                 if (iwl_mvm_phy_ctx_count(mvm) > 1)
3127                         iwl_mvm_teardown_tdls_peers(mvm);
3128
3129                 if (sta->tdls)
3130                         iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3131                                                    NL80211_TDLS_ENABLE_LINK);
3132
3133                 /* enable beacon filtering */
3134                 WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
3135
3136                 /*
3137                  * Now that the station is authorized, i.e., keys were already
3138                  * installed, need to indicate to the FW that
3139                  * multicast data frames can be forwarded to the driver
3140                  */
3141                 iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3142
3143                 iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3144                                      true);
3145         } else if (old_state == IEEE80211_STA_AUTHORIZED &&
3146                    new_state == IEEE80211_STA_ASSOC) {
3147                 /* Multicast data frames are no longer allowed */
3148                 iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3149
3150                 /* disable beacon filtering */
3151                 ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
3152                 WARN_ON(ret &&
3153                         !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
3154                                   &mvm->status));
3155                 ret = 0;
3156         } else if (old_state == IEEE80211_STA_ASSOC &&
3157                    new_state == IEEE80211_STA_AUTH) {
3158                 if (vif->type == NL80211_IFTYPE_AP) {
3159                         mvmvif->ap_assoc_sta_count--;
3160                         iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3161                 }
3162                 ret = 0;
3163         } else if (old_state == IEEE80211_STA_AUTH &&
3164                    new_state == IEEE80211_STA_NONE) {
3165                 ret = 0;
3166         } else if (old_state == IEEE80211_STA_NONE &&
3167                    new_state == IEEE80211_STA_NOTEXIST) {
3168                 ret = iwl_mvm_rm_sta(mvm, vif, sta);
3169                 if (sta->tdls) {
3170                         iwl_mvm_recalc_tdls_state(mvm, vif, false);
3171                         iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3172                                                    NL80211_TDLS_DISABLE_LINK);
3173                 }
3174
3175                 if (unlikely(ret &&
3176                              test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
3177                                       &mvm->status)))
3178                         ret = 0;
3179         } else {
3180                 ret = -EIO;
3181         }
3182  out_unlock:
3183         mutex_unlock(&mvm->mutex);
3184
3185         if (sta->tdls && ret == 0) {
3186                 if (old_state == IEEE80211_STA_NOTEXIST &&
3187                     new_state == IEEE80211_STA_NONE)
3188                         ieee80211_reserve_tid(sta, IWL_MVM_TDLS_FW_TID);
3189                 else if (old_state == IEEE80211_STA_NONE &&
3190                          new_state == IEEE80211_STA_NOTEXIST)
3191                         ieee80211_unreserve_tid(sta, IWL_MVM_TDLS_FW_TID);
3192         }
3193
3194         return ret;
3195 }
3196
3197 static int iwl_mvm_mac_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
3198 {
3199         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3200
3201         mvm->rts_threshold = value;
3202
3203         return 0;
3204 }
3205
3206 static void iwl_mvm_sta_rc_update(struct ieee80211_hw *hw,
3207                                   struct ieee80211_vif *vif,
3208                                   struct ieee80211_sta *sta, u32 changed)
3209 {
3210         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3211         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3212
3213         if (changed & (IEEE80211_RC_BW_CHANGED |
3214                        IEEE80211_RC_SUPP_RATES_CHANGED |
3215                        IEEE80211_RC_NSS_CHANGED))
3216                 iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3217                                      true);
3218
3219         if (vif->type == NL80211_IFTYPE_STATION &&
3220             changed & IEEE80211_RC_NSS_CHANGED)
3221                 iwl_mvm_sf_update(mvm, vif, false);
3222 }
3223
3224 static int iwl_mvm_mac_conf_tx(struct ieee80211_hw *hw,
3225                                struct ieee80211_vif *vif, u16 ac,
3226                                const struct ieee80211_tx_queue_params *params)
3227 {
3228         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3229         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3230
3231         mvmvif->queue_params[ac] = *params;
3232
3233         /*
3234          * No need to update right away, we'll get BSS_CHANGED_QOS
3235          * The exception is P2P_DEVICE interface which needs immediate update.
3236          */
3237         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
3238                 int ret;
3239
3240                 mutex_lock(&mvm->mutex);
3241                 ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3242                 mutex_unlock(&mvm->mutex);
3243                 return ret;
3244         }
3245         return 0;
3246 }
3247
3248 static void iwl_mvm_mac_mgd_prepare_tx(struct ieee80211_hw *hw,
3249                                        struct ieee80211_vif *vif,
3250                                        u16 req_duration)
3251 {
3252         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3253         u32 duration = IWL_MVM_TE_SESSION_PROTECTION_MAX_TIME_MS;
3254         u32 min_duration = IWL_MVM_TE_SESSION_PROTECTION_MIN_TIME_MS;
3255
3256         if (req_duration > duration)
3257                 duration = req_duration;
3258
3259         mutex_lock(&mvm->mutex);
3260         /* Try really hard to protect the session and hear a beacon */
3261         iwl_mvm_protect_session(mvm, vif, duration, min_duration, 500, false);
3262         mutex_unlock(&mvm->mutex);
3263 }
3264
3265 static int iwl_mvm_mac_sched_scan_start(struct ieee80211_hw *hw,
3266                                         struct ieee80211_vif *vif,
3267                                         struct cfg80211_sched_scan_request *req,
3268                                         struct ieee80211_scan_ies *ies)
3269 {
3270         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3271
3272         int ret;
3273
3274         mutex_lock(&mvm->mutex);
3275
3276         if (!vif->bss_conf.idle) {
3277                 ret = -EBUSY;
3278                 goto out;
3279         }
3280
3281         ret = iwl_mvm_sched_scan_start(mvm, vif, req, ies, IWL_MVM_SCAN_SCHED);
3282
3283 out:
3284         mutex_unlock(&mvm->mutex);
3285         return ret;
3286 }
3287
3288 static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
3289                                        struct ieee80211_vif *vif)
3290 {
3291         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3292         int ret;
3293
3294         mutex_lock(&mvm->mutex);
3295
3296         /* Due to a race condition, it's possible that mac80211 asks
3297          * us to stop a sched_scan when it's already stopped.  This
3298          * can happen, for instance, if we stopped the scan ourselves,
3299          * called ieee80211_sched_scan_stopped() and the userspace called
3300          * stop sched scan scan before ieee80211_sched_scan_stopped_work()
3301          * could run.  To handle this, simply return if the scan is
3302          * not running.
3303         */
3304         if (!(mvm->scan_status & IWL_MVM_SCAN_SCHED)) {
3305                 mutex_unlock(&mvm->mutex);
3306                 return 0;
3307         }
3308
3309         ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, false);
3310         mutex_unlock(&mvm->mutex);
3311         iwl_mvm_wait_for_async_handlers(mvm);
3312
3313         return ret;
3314 }
3315
3316 static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
3317                                  enum set_key_cmd cmd,
3318                                  struct ieee80211_vif *vif,
3319                                  struct ieee80211_sta *sta,
3320                                  struct ieee80211_key_conf *key)
3321 {
3322         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3323         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3324         struct iwl_mvm_sta *mvmsta;
3325         struct iwl_mvm_key_pn *ptk_pn;
3326         int keyidx = key->keyidx;
3327         int ret, i;
3328         u8 key_offset;
3329
3330         if (iwlwifi_mod_params.swcrypto) {
3331                 IWL_DEBUG_MAC80211(mvm, "leave - hwcrypto disabled\n");
3332                 return -EOPNOTSUPP;
3333         }
3334
3335         switch (key->cipher) {
3336         case WLAN_CIPHER_SUITE_TKIP:
3337                 if (!mvm->trans->trans_cfg->gen2) {
3338                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3339                         key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3340                 } else if (vif->type == NL80211_IFTYPE_STATION) {
3341                         key->flags |= IEEE80211_KEY_FLAG_PUT_MIC_SPACE;
3342                 } else {
3343                         IWL_DEBUG_MAC80211(mvm, "Use SW encryption for TKIP\n");
3344                         return -EOPNOTSUPP;
3345                 }
3346                 break;
3347         case WLAN_CIPHER_SUITE_CCMP:
3348         case WLAN_CIPHER_SUITE_GCMP:
3349         case WLAN_CIPHER_SUITE_GCMP_256:
3350                 if (!iwl_mvm_has_new_tx_api(mvm))
3351                         key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3352                 break;
3353         case WLAN_CIPHER_SUITE_AES_CMAC:
3354         case WLAN_CIPHER_SUITE_BIP_GMAC_128:
3355         case WLAN_CIPHER_SUITE_BIP_GMAC_256:
3356                 WARN_ON_ONCE(!ieee80211_hw_check(hw, MFP_CAPABLE));
3357                 break;
3358         case WLAN_CIPHER_SUITE_WEP40:
3359         case WLAN_CIPHER_SUITE_WEP104:
3360                 if (vif->type == NL80211_IFTYPE_STATION)
3361                         break;
3362                 if (iwl_mvm_has_new_tx_api(mvm))
3363                         return -EOPNOTSUPP;
3364                 /* support HW crypto on TX */
3365                 return 0;
3366         default:
3367                 /* currently FW supports only one optional cipher scheme */
3368                 if (hw->n_cipher_schemes &&
3369                     hw->cipher_schemes->cipher == key->cipher)
3370                         key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3371                 else
3372                         return -EOPNOTSUPP;
3373         }
3374
3375         switch (cmd) {
3376         case SET_KEY:
3377                 if ((vif->type == NL80211_IFTYPE_ADHOC ||
3378                      vif->type == NL80211_IFTYPE_AP) && !sta) {
3379                         /*
3380                          * GTK on AP interface is a TX-only key, return 0;
3381                          * on IBSS they're per-station and because we're lazy
3382                          * we don't support them for RX, so do the same.
3383                          * CMAC/GMAC in AP/IBSS modes must be done in software.
3384                          */
3385                         if (key->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
3386                             key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
3387                             key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256)
3388                                 ret = -EOPNOTSUPP;
3389                         else
3390                                 ret = 0;
3391
3392                         if (key->cipher != WLAN_CIPHER_SUITE_GCMP &&
3393                             key->cipher != WLAN_CIPHER_SUITE_GCMP_256 &&
3394                             !iwl_mvm_has_new_tx_api(mvm)) {
3395                                 key->hw_key_idx = STA_KEY_IDX_INVALID;
3396                                 break;
3397                         }
3398
3399                         if (!mvmvif->ap_ibss_active) {
3400                                 for (i = 0;
3401                                      i < ARRAY_SIZE(mvmvif->ap_early_keys);
3402                                      i++) {
3403                                         if (!mvmvif->ap_early_keys[i]) {
3404                                                 mvmvif->ap_early_keys[i] = key;
3405                                                 break;
3406                                         }
3407                                 }
3408
3409                                 if (i >= ARRAY_SIZE(mvmvif->ap_early_keys))
3410                                         ret = -ENOSPC;
3411
3412                                 break;
3413                         }
3414                 }
3415
3416                 /* During FW restart, in order to restore the state as it was,
3417                  * don't try to reprogram keys we previously failed for.
3418                  */
3419                 if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
3420                     key->hw_key_idx == STA_KEY_IDX_INVALID) {
3421                         IWL_DEBUG_MAC80211(mvm,
3422                                            "skip invalid idx key programming during restart\n");
3423                         ret = 0;
3424                         break;
3425                 }
3426
3427                 if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
3428                     sta && iwl_mvm_has_new_rx_api(mvm) &&
3429                     key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
3430                     (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
3431                      key->cipher == WLAN_CIPHER_SUITE_GCMP ||
3432                      key->cipher == WLAN_CIPHER_SUITE_GCMP_256)) {
3433                         struct ieee80211_key_seq seq;
3434                         int tid, q;
3435
3436                         mvmsta = iwl_mvm_sta_from_mac80211(sta);
3437                         WARN_ON(rcu_access_pointer(mvmsta->ptk_pn[keyidx]));
3438                         ptk_pn = kzalloc(struct_size(ptk_pn, q,
3439                                                      mvm->trans->num_rx_queues),
3440                                          GFP_KERNEL);
3441                         if (!ptk_pn) {
3442                                 ret = -ENOMEM;
3443                                 break;
3444                         }
3445
3446                         for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++) {
3447                                 ieee80211_get_key_rx_seq(key, tid, &seq);
3448                                 for (q = 0; q < mvm->trans->num_rx_queues; q++)
3449                                         memcpy(ptk_pn->q[q].pn[tid],
3450                                                seq.ccmp.pn,
3451                                                IEEE80211_CCMP_PN_LEN);
3452                         }
3453
3454                         rcu_assign_pointer(mvmsta->ptk_pn[keyidx], ptk_pn);
3455                 }
3456
3457                 /* in HW restart reuse the index, otherwise request a new one */
3458                 if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
3459                         key_offset = key->hw_key_idx;
3460                 else
3461                         key_offset = STA_KEY_IDX_INVALID;
3462
3463                 IWL_DEBUG_MAC80211(mvm, "set hwcrypto key\n");
3464                 ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, key_offset);
3465                 if (ret) {
3466                         IWL_WARN(mvm, "set key failed\n");
3467                         key->hw_key_idx = STA_KEY_IDX_INVALID;
3468                         /*
3469                          * can't add key for RX, but we don't need it
3470                          * in the device for TX so still return 0,
3471                          * unless we have new TX API where we cannot
3472                          * put key material into the TX_CMD
3473                          */
3474                         if (iwl_mvm_has_new_tx_api(mvm))
3475                                 ret = -EOPNOTSUPP;
3476                         else
3477                                 ret = 0;
3478                 }
3479
3480                 break;
3481         case DISABLE_KEY:
3482                 ret = -ENOENT;
3483                 for (i = 0; i < ARRAY_SIZE(mvmvif->ap_early_keys); i++) {
3484                         if (mvmvif->ap_early_keys[i] == key) {
3485                                 mvmvif->ap_early_keys[i] = NULL;
3486                                 ret = 0;
3487                         }
3488                 }
3489
3490                 /* found in pending list - don't do anything else */
3491                 if (ret == 0)
3492                         break;
3493
3494                 if (key->hw_key_idx == STA_KEY_IDX_INVALID) {
3495                         ret = 0;
3496                         break;
3497                 }
3498
3499                 if (sta && iwl_mvm_has_new_rx_api(mvm) &&
3500                     key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
3501                     (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
3502                      key->cipher == WLAN_CIPHER_SUITE_GCMP ||
3503                      key->cipher == WLAN_CIPHER_SUITE_GCMP_256)) {
3504                         mvmsta = iwl_mvm_sta_from_mac80211(sta);
3505                         ptk_pn = rcu_dereference_protected(
3506                                                 mvmsta->ptk_pn[keyidx],
3507                                                 lockdep_is_held(&mvm->mutex));
3508                         RCU_INIT_POINTER(mvmsta->ptk_pn[keyidx], NULL);
3509                         if (ptk_pn)
3510                                 kfree_rcu(ptk_pn, rcu_head);
3511                 }
3512
3513                 IWL_DEBUG_MAC80211(mvm, "disable hwcrypto key\n");
3514                 ret = iwl_mvm_remove_sta_key(mvm, vif, sta, key);
3515                 break;
3516         default:
3517                 ret = -EINVAL;
3518         }
3519
3520         return ret;
3521 }
3522
3523 static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
3524                                enum set_key_cmd cmd,
3525                                struct ieee80211_vif *vif,
3526                                struct ieee80211_sta *sta,
3527                                struct ieee80211_key_conf *key)
3528 {
3529         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3530         int ret;
3531
3532         mutex_lock(&mvm->mutex);
3533         ret = __iwl_mvm_mac_set_key(hw, cmd, vif, sta, key);
3534         mutex_unlock(&mvm->mutex);
3535
3536         return ret;
3537 }
3538
3539 static void iwl_mvm_mac_update_tkip_key(struct ieee80211_hw *hw,
3540                                         struct ieee80211_vif *vif,
3541                                         struct ieee80211_key_conf *keyconf,
3542                                         struct ieee80211_sta *sta,
3543                                         u32 iv32, u16 *phase1key)
3544 {
3545         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3546
3547         if (keyconf->hw_key_idx == STA_KEY_IDX_INVALID)
3548                 return;
3549
3550         iwl_mvm_update_tkip_key(mvm, vif, keyconf, sta, iv32, phase1key);
3551 }
3552
3553
3554 static bool iwl_mvm_rx_aux_roc(struct iwl_notif_wait_data *notif_wait,
3555                                struct iwl_rx_packet *pkt, void *data)
3556 {
3557         struct iwl_mvm *mvm =
3558                 container_of(notif_wait, struct iwl_mvm, notif_wait);
3559         struct iwl_hs20_roc_res *resp;
3560         int resp_len = iwl_rx_packet_payload_len(pkt);
3561         struct iwl_mvm_time_event_data *te_data = data;
3562
3563         if (WARN_ON(pkt->hdr.cmd != HOT_SPOT_CMD))
3564                 return true;
3565
3566         if (WARN_ON_ONCE(resp_len != sizeof(*resp))) {
3567                 IWL_ERR(mvm, "Invalid HOT_SPOT_CMD response\n");
3568                 return true;
3569         }
3570
3571         resp = (void *)pkt->data;
3572
3573         IWL_DEBUG_TE(mvm,
3574                      "Aux ROC: Received response from ucode: status=%d uid=%d\n",
3575                      resp->status, resp->event_unique_id);
3576
3577         te_data->uid = le32_to_cpu(resp->event_unique_id);
3578         IWL_DEBUG_TE(mvm, "TIME_EVENT_CMD response - UID = 0x%x\n",
3579                      te_data->uid);
3580
3581         spin_lock_bh(&mvm->time_event_lock);
3582         list_add_tail(&te_data->list, &mvm->aux_roc_te_list);
3583         spin_unlock_bh(&mvm->time_event_lock);
3584
3585         return true;
3586 }
3587
3588 #define AUX_ROC_MIN_DURATION MSEC_TO_TU(100)
3589 #define AUX_ROC_MIN_DELAY MSEC_TO_TU(200)
3590 #define AUX_ROC_MAX_DELAY MSEC_TO_TU(600)
3591 #define AUX_ROC_SAFETY_BUFFER MSEC_TO_TU(20)
3592 #define AUX_ROC_MIN_SAFETY_BUFFER MSEC_TO_TU(10)
3593 static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm,
3594                                     struct ieee80211_channel *channel,
3595                                     struct ieee80211_vif *vif,
3596                                     int duration)
3597 {
3598         int res;
3599         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3600         struct iwl_mvm_time_event_data *te_data = &mvmvif->hs_time_event_data;
3601         static const u16 time_event_response[] = { HOT_SPOT_CMD };
3602         struct iwl_notification_wait wait_time_event;
3603         u32 dtim_interval = vif->bss_conf.dtim_period *
3604                 vif->bss_conf.beacon_int;
3605         u32 req_dur, delay;
3606         struct iwl_hs20_roc_req aux_roc_req = {
3607                 .action = cpu_to_le32(FW_CTXT_ACTION_ADD),
3608                 .id_and_color =
3609                         cpu_to_le32(FW_CMD_ID_AND_COLOR(MAC_INDEX_AUX, 0)),
3610                 .sta_id_and_color = cpu_to_le32(mvm->aux_sta.sta_id),
3611         };
3612         struct iwl_hs20_roc_req_tail *tail = iwl_mvm_chan_info_cmd_tail(mvm,
3613                 &aux_roc_req.channel_info);
3614         u16 len = sizeof(aux_roc_req) - iwl_mvm_chan_info_padding(mvm);
3615
3616         /* Set the channel info data */
3617         iwl_mvm_set_chan_info(mvm, &aux_roc_req.channel_info, channel->hw_value,
3618                               (channel->band == NL80211_BAND_2GHZ) ?
3619                                PHY_BAND_24 : PHY_BAND_5,
3620                               PHY_VHT_CHANNEL_MODE20,
3621                               0);
3622
3623         /* Set the time and duration */
3624         tail->apply_time = cpu_to_le32(iwl_mvm_get_systime(mvm));
3625
3626         delay = AUX_ROC_MIN_DELAY;
3627         req_dur = MSEC_TO_TU(duration);
3628
3629         /*
3630          * If we are associated we want the delay time to be at least one
3631          * dtim interval so that the FW can wait until after the DTIM and
3632          * then start the time event, this will potentially allow us to
3633          * remain off-channel for the max duration.
3634          * Since we want to use almost a whole dtim interval we would also
3635          * like the delay to be for 2-3 dtim intervals, in case there are
3636          * other time events with higher priority.
3637          */
3638         if (vif->bss_conf.assoc) {
3639                 delay = min_t(u32, dtim_interval * 3, AUX_ROC_MAX_DELAY);
3640                 /* We cannot remain off-channel longer than the DTIM interval */
3641                 if (dtim_interval <= req_dur) {
3642                         req_dur = dtim_interval - AUX_ROC_SAFETY_BUFFER;
3643                         if (req_dur <= AUX_ROC_MIN_DURATION)
3644                                 req_dur = dtim_interval -
3645                                         AUX_ROC_MIN_SAFETY_BUFFER;
3646                 }
3647         }
3648
3649         tail->duration = cpu_to_le32(req_dur);
3650         tail->apply_time_max_delay = cpu_to_le32(delay);
3651
3652         IWL_DEBUG_TE(mvm,
3653                      "ROC: Requesting to remain on channel %u for %ums (requested = %ums, max_delay = %ums, dtim_interval = %ums)\n",
3654                      channel->hw_value, req_dur, duration, delay,
3655                      dtim_interval);
3656         /* Set the node address */
3657         memcpy(tail->node_addr, vif->addr, ETH_ALEN);
3658
3659         lockdep_assert_held(&mvm->mutex);
3660
3661         spin_lock_bh(&mvm->time_event_lock);
3662
3663         if (WARN_ON(te_data->id == HOT_SPOT_CMD)) {
3664                 spin_unlock_bh(&mvm->time_event_lock);
3665                 return -EIO;
3666         }
3667
3668         te_data->vif = vif;
3669         te_data->duration = duration;
3670         te_data->id = HOT_SPOT_CMD;
3671
3672         spin_unlock_bh(&mvm->time_event_lock);
3673
3674         /*
3675          * Use a notification wait, which really just processes the
3676          * command response and doesn't wait for anything, in order
3677          * to be able to process the response and get the UID inside
3678          * the RX path. Using CMD_WANT_SKB doesn't work because it
3679          * stores the buffer and then wakes up this thread, by which
3680          * time another notification (that the time event started)
3681          * might already be processed unsuccessfully.
3682          */
3683         iwl_init_notification_wait(&mvm->notif_wait, &wait_time_event,
3684                                    time_event_response,
3685                                    ARRAY_SIZE(time_event_response),
3686                                    iwl_mvm_rx_aux_roc, te_data);
3687
3688         res = iwl_mvm_send_cmd_pdu(mvm, HOT_SPOT_CMD, 0, len,
3689                                    &aux_roc_req);
3690
3691         if (res) {
3692                 IWL_ERR(mvm, "Couldn't send HOT_SPOT_CMD: %d\n", res);
3693                 iwl_remove_notification(&mvm->notif_wait, &wait_time_event);
3694                 goto out_clear_te;
3695         }
3696
3697         /* No need to wait for anything, so just pass 1 (0 isn't valid) */
3698         res = iwl_wait_notification(&mvm->notif_wait, &wait_time_event, 1);
3699         /* should never fail */
3700         WARN_ON_ONCE(res);
3701
3702         if (res) {
3703  out_clear_te:
3704                 spin_lock_bh(&mvm->time_event_lock);
3705                 iwl_mvm_te_clear_data(mvm, te_data);
3706                 spin_unlock_bh(&mvm->time_event_lock);
3707         }
3708
3709         return res;
3710 }
3711
3712 static int iwl_mvm_roc(struct ieee80211_hw *hw,
3713                        struct ieee80211_vif *vif,
3714                        struct ieee80211_channel *channel,
3715                        int duration,
3716                        enum ieee80211_roc_type type)
3717 {
3718         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3719         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3720         struct cfg80211_chan_def chandef;
3721         struct iwl_mvm_phy_ctxt *phy_ctxt;
3722         int ret, i;
3723
3724         IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value,
3725                            duration, type);
3726
3727         /*
3728          * Flush the done work, just in case it's still pending, so that
3729          * the work it does can complete and we can accept new frames.
3730          */
3731         flush_work(&mvm->roc_done_wk);
3732
3733         mutex_lock(&mvm->mutex);
3734
3735         switch (vif->type) {
3736         case NL80211_IFTYPE_STATION:
3737                 if (fw_has_capa(&mvm->fw->ucode_capa,
3738                                 IWL_UCODE_TLV_CAPA_HOTSPOT_SUPPORT)) {
3739                         /* Use aux roc framework (HS20) */
3740                         ret = iwl_mvm_send_aux_roc_cmd(mvm, channel,
3741                                                        vif, duration);
3742                         goto out_unlock;
3743                 }
3744                 IWL_ERR(mvm, "hotspot not supported\n");
3745                 ret = -EINVAL;
3746                 goto out_unlock;
3747         case NL80211_IFTYPE_P2P_DEVICE:
3748                 /* handle below */
3749                 break;
3750         default:
3751                 IWL_ERR(mvm, "vif isn't P2P_DEVICE: %d\n", vif->type);
3752                 ret = -EINVAL;
3753                 goto out_unlock;
3754         }
3755
3756         for (i = 0; i < NUM_PHY_CTX; i++) {
3757                 phy_ctxt = &mvm->phy_ctxts[i];
3758                 if (phy_ctxt->ref == 0 || mvmvif->phy_ctxt == phy_ctxt)
3759                         continue;
3760
3761                 if (phy_ctxt->ref && channel == phy_ctxt->channel) {
3762                         /*
3763                          * Unbind the P2P_DEVICE from the current PHY context,
3764                          * and if the PHY context is not used remove it.
3765                          */
3766                         ret = iwl_mvm_binding_remove_vif(mvm, vif);
3767                         if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3768                                 goto out_unlock;
3769
3770                         iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3771
3772                         /* Bind the P2P_DEVICE to the current PHY Context */
3773                         mvmvif->phy_ctxt = phy_ctxt;
3774
3775                         ret = iwl_mvm_binding_add_vif(mvm, vif);
3776                         if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3777                                 goto out_unlock;
3778
3779                         iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3780                         goto schedule_time_event;
3781                 }
3782         }
3783
3784         /* Need to update the PHY context only if the ROC channel changed */
3785         if (channel == mvmvif->phy_ctxt->channel)
3786                 goto schedule_time_event;
3787
3788         cfg80211_chandef_create(&chandef, channel, NL80211_CHAN_NO_HT);
3789
3790         /*
3791          * Change the PHY context configuration as it is currently referenced
3792          * only by the P2P Device MAC
3793          */
3794         if (mvmvif->phy_ctxt->ref == 1) {
3795                 ret = iwl_mvm_phy_ctxt_changed(mvm, mvmvif->phy_ctxt,
3796                                                &chandef, 1, 1);
3797                 if (ret)
3798                         goto out_unlock;
3799         } else {
3800                 /*
3801                  * The PHY context is shared with other MACs. Need to remove the
3802                  * P2P Device from the binding, allocate an new PHY context and
3803                  * create a new binding
3804                  */
3805                 phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3806                 if (!phy_ctxt) {
3807                         ret = -ENOSPC;
3808                         goto out_unlock;
3809                 }
3810
3811                 ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &chandef,
3812                                                1, 1);
3813                 if (ret) {
3814                         IWL_ERR(mvm, "Failed to change PHY context\n");
3815                         goto out_unlock;
3816                 }
3817
3818                 /* Unbind the P2P_DEVICE from the current PHY context */
3819                 ret = iwl_mvm_binding_remove_vif(mvm, vif);
3820                 if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3821                         goto out_unlock;
3822
3823                 iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3824
3825                 /* Bind the P2P_DEVICE to the new allocated PHY context */
3826                 mvmvif->phy_ctxt = phy_ctxt;
3827
3828                 ret = iwl_mvm_binding_add_vif(mvm, vif);
3829                 if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3830                         goto out_unlock;
3831
3832                 iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3833         }
3834
3835 schedule_time_event:
3836         /* Schedule the time events */
3837         ret = iwl_mvm_start_p2p_roc(mvm, vif, duration, type);
3838
3839 out_unlock:
3840         mutex_unlock(&mvm->mutex);
3841         IWL_DEBUG_MAC80211(mvm, "leave\n");
3842         return ret;
3843 }
3844
3845 static int iwl_mvm_cancel_roc(struct ieee80211_hw *hw,
3846                               struct ieee80211_vif *vif)
3847 {
3848         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3849
3850         IWL_DEBUG_MAC80211(mvm, "enter\n");
3851
3852         mutex_lock(&mvm->mutex);
3853         iwl_mvm_stop_roc(mvm);
3854         mutex_unlock(&mvm->mutex);
3855
3856         IWL_DEBUG_MAC80211(mvm, "leave\n");
3857         return 0;
3858 }
3859
3860 struct iwl_mvm_ftm_responder_iter_data {
3861         bool responder;
3862         struct ieee80211_chanctx_conf *ctx;
3863 };
3864
3865 static void iwl_mvm_ftm_responder_chanctx_iter(void *_data, u8 *mac,
3866                                                struct ieee80211_vif *vif)
3867 {
3868         struct iwl_mvm_ftm_responder_iter_data *data = _data;
3869
3870         if (rcu_access_pointer(vif->chanctx_conf) == data->ctx &&
3871             vif->type == NL80211_IFTYPE_AP && vif->bss_conf.ftmr_params)
3872                 data->responder = true;
3873 }
3874
3875 static bool iwl_mvm_is_ftm_responder_chanctx(struct iwl_mvm *mvm,
3876                                              struct ieee80211_chanctx_conf *ctx)
3877 {
3878         struct iwl_mvm_ftm_responder_iter_data data = {
3879                 .responder = false,
3880                 .ctx = ctx,
3881         };
3882
3883         ieee80211_iterate_active_interfaces_atomic(mvm->hw,
3884                                         IEEE80211_IFACE_ITER_NORMAL,
3885                                         iwl_mvm_ftm_responder_chanctx_iter,
3886                                         &data);
3887         return data.responder;
3888 }
3889
3890 static int __iwl_mvm_add_chanctx(struct iwl_mvm *mvm,
3891                                  struct ieee80211_chanctx_conf *ctx)
3892 {
3893         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3894         struct iwl_mvm_phy_ctxt *phy_ctxt;
3895         bool responder = iwl_mvm_is_ftm_responder_chanctx(mvm, ctx);
3896         struct cfg80211_chan_def *def = responder ? &ctx->def : &ctx->min_def;
3897         int ret;
3898
3899         lockdep_assert_held(&mvm->mutex);
3900
3901         IWL_DEBUG_MAC80211(mvm, "Add channel context\n");
3902
3903         phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3904         if (!phy_ctxt) {
3905                 ret = -ENOSPC;
3906                 goto out;
3907         }
3908
3909         ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, def,
3910                                        ctx->rx_chains_static,
3911                                        ctx->rx_chains_dynamic);
3912         if (ret) {
3913                 IWL_ERR(mvm, "Failed to add PHY context\n");
3914                 goto out;
3915         }
3916
3917         iwl_mvm_phy_ctxt_ref(mvm, phy_ctxt);
3918         *phy_ctxt_id = phy_ctxt->id;
3919 out:
3920         return ret;
3921 }
3922
3923 static int iwl_mvm_add_chanctx(struct ieee80211_hw *hw,
3924                                struct ieee80211_chanctx_conf *ctx)
3925 {
3926         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3927         int ret;
3928
3929         mutex_lock(&mvm->mutex);
3930         ret = __iwl_mvm_add_chanctx(mvm, ctx);
3931         mutex_unlock(&mvm->mutex);
3932
3933         return ret;
3934 }
3935
3936 static void __iwl_mvm_remove_chanctx(struct iwl_mvm *mvm,
3937                                      struct ieee80211_chanctx_conf *ctx)
3938 {
3939         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3940         struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3941
3942         lockdep_assert_held(&mvm->mutex);
3943
3944         iwl_mvm_phy_ctxt_unref(mvm, phy_ctxt);
3945 }
3946
3947 static void iwl_mvm_remove_chanctx(struct ieee80211_hw *hw,
3948                                    struct ieee80211_chanctx_conf *ctx)
3949 {
3950         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3951
3952         mutex_lock(&mvm->mutex);
3953         __iwl_mvm_remove_chanctx(mvm, ctx);
3954         mutex_unlock(&mvm->mutex);
3955 }
3956
3957 static void iwl_mvm_change_chanctx(struct ieee80211_hw *hw,
3958                                    struct ieee80211_chanctx_conf *ctx,
3959                                    u32 changed)
3960 {
3961         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3962         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3963         struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3964         bool responder = iwl_mvm_is_ftm_responder_chanctx(mvm, ctx);
3965         struct cfg80211_chan_def *def = responder ? &ctx->def : &ctx->min_def;
3966
3967         if (WARN_ONCE((phy_ctxt->ref > 1) &&
3968                       (changed & ~(IEEE80211_CHANCTX_CHANGE_WIDTH |
3969                                    IEEE80211_CHANCTX_CHANGE_RX_CHAINS |
3970                                    IEEE80211_CHANCTX_CHANGE_RADAR |
3971                                    IEEE80211_CHANCTX_CHANGE_MIN_WIDTH)),
3972                       "Cannot change PHY. Ref=%d, changed=0x%X\n",
3973                       phy_ctxt->ref, changed))
3974                 return;
3975
3976         mutex_lock(&mvm->mutex);
3977
3978         /* we are only changing the min_width, may be a noop */
3979         if (changed == IEEE80211_CHANCTX_CHANGE_MIN_WIDTH) {
3980                 if (phy_ctxt->width == def->width)
3981                         goto out_unlock;
3982
3983                 /* we are just toggling between 20_NOHT and 20 */
3984                 if (phy_ctxt->width <= NL80211_CHAN_WIDTH_20 &&
3985                     def->width <= NL80211_CHAN_WIDTH_20)
3986                         goto out_unlock;
3987         }
3988
3989         iwl_mvm_bt_coex_vif_change(mvm);
3990         iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, def,
3991                                  ctx->rx_chains_static,
3992                                  ctx->rx_chains_dynamic);
3993
3994 out_unlock:
3995         mutex_unlock(&mvm->mutex);
3996 }
3997
3998 static int __iwl_mvm_assign_vif_chanctx(struct iwl_mvm *mvm,
3999                                         struct ieee80211_vif *vif,
4000                                         struct ieee80211_chanctx_conf *ctx,
4001                                         bool switching_chanctx)
4002 {
4003         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
4004         struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
4005         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4006         int ret;
4007
4008         lockdep_assert_held(&mvm->mutex);
4009
4010         mvmvif->phy_ctxt = phy_ctxt;
4011
4012         switch (vif->type) {
4013         case NL80211_IFTYPE_AP:
4014                 /* only needed if we're switching chanctx (i.e. during CSA) */
4015                 if (switching_chanctx) {
4016                         mvmvif->ap_ibss_active = true;
4017                         break;
4018                 }
4019                 /* fall through */
4020         case NL80211_IFTYPE_ADHOC:
4021                 /*
4022                  * The AP binding flow is handled as part of the start_ap flow
4023                  * (in bss_info_changed), similarly for IBSS.
4024                  */
4025                 ret = 0;
4026                 goto out;
4027         case NL80211_IFTYPE_STATION:
4028                 mvmvif->csa_bcn_pending = false;
4029                 break;
4030         case NL80211_IFTYPE_MONITOR:
4031                 /* always disable PS when a monitor interface is active */
4032                 mvmvif->ps_disabled = true;
4033                 break;
4034         default:
4035                 ret = -EINVAL;
4036                 goto out;
4037         }
4038
4039         ret = iwl_mvm_binding_add_vif(mvm, vif);
4040         if (ret)
4041                 goto out;
4042
4043         /*
4044          * Power state must be updated before quotas,
4045          * otherwise fw will complain.
4046          */
4047         iwl_mvm_power_update_mac(mvm);
4048
4049         /* Setting the quota at this stage is only required for monitor
4050          * interfaces. For the other types, the bss_info changed flow
4051          * will handle quota settings.
4052          */
4053         if (vif->type == NL80211_IFTYPE_MONITOR) {
4054                 mvmvif->monitor_active = true;
4055                 ret = iwl_mvm_update_quotas(mvm, false, NULL);
4056                 if (ret)
4057                         goto out_remove_binding;
4058
4059                 ret = iwl_mvm_add_snif_sta(mvm, vif);
4060                 if (ret)
4061                         goto out_remove_binding;
4062
4063         }
4064
4065         /* Handle binding during CSA */
4066         if (vif->type == NL80211_IFTYPE_AP) {
4067                 iwl_mvm_update_quotas(mvm, false, NULL);
4068                 iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
4069         }
4070
4071         if (switching_chanctx && vif->type == NL80211_IFTYPE_STATION) {
4072                 mvmvif->csa_bcn_pending = true;
4073
4074                 if (!fw_has_capa(&mvm->fw->ucode_capa,
4075                                  IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
4076                         u32 duration = 3 * vif->bss_conf.beacon_int;
4077
4078                         /* Protect the session to make sure we hear the first
4079                          * beacon on the new channel.
4080                          */
4081                         iwl_mvm_protect_session(mvm, vif, duration, duration,
4082                                                 vif->bss_conf.beacon_int / 2,
4083                                                 true);
4084                 }
4085
4086                 iwl_mvm_update_quotas(mvm, false, NULL);
4087         }
4088
4089         goto out;
4090
4091 out_remove_binding:
4092         iwl_mvm_binding_remove_vif(mvm, vif);
4093         iwl_mvm_power_update_mac(mvm);
4094 out:
4095         if (ret)
4096                 mvmvif->phy_ctxt = NULL;
4097         return ret;
4098 }
4099 static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
4100                                       struct ieee80211_vif *vif,
4101                                       struct ieee80211_chanctx_conf *ctx)
4102 {
4103         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4104         int ret;
4105
4106         mutex_lock(&mvm->mutex);
4107         ret = __iwl_mvm_assign_vif_chanctx(mvm, vif, ctx, false);
4108         mutex_unlock(&mvm->mutex);
4109
4110         return ret;
4111 }
4112
4113 static void __iwl_mvm_unassign_vif_chanctx(struct iwl_mvm *mvm,
4114                                            struct ieee80211_vif *vif,
4115                                            struct ieee80211_chanctx_conf *ctx,
4116                                            bool switching_chanctx)
4117 {
4118         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4119         struct ieee80211_vif *disabled_vif = NULL;
4120
4121         lockdep_assert_held(&mvm->mutex);
4122
4123         iwl_mvm_remove_time_event(mvm, mvmvif, &mvmvif->time_event_data);
4124
4125         switch (vif->type) {
4126         case NL80211_IFTYPE_ADHOC:
4127                 goto out;
4128         case NL80211_IFTYPE_MONITOR:
4129                 mvmvif->monitor_active = false;
4130                 mvmvif->ps_disabled = false;
4131                 iwl_mvm_rm_snif_sta(mvm, vif);
4132                 break;
4133         case NL80211_IFTYPE_AP:
4134                 /* This part is triggered only during CSA */
4135                 if (!switching_chanctx || !mvmvif->ap_ibss_active)
4136                         goto out;
4137
4138                 mvmvif->csa_countdown = false;
4139
4140                 /* Set CS bit on all the stations */
4141                 iwl_mvm_modify_all_sta_disable_tx(mvm, mvmvif, true);
4142
4143                 /* Save blocked iface, the timeout is set on the next beacon */
4144                 rcu_assign_pointer(mvm->csa_tx_blocked_vif, vif);
4145
4146                 mvmvif->ap_ibss_active = false;
4147                 break;
4148         case NL80211_IFTYPE_STATION:
4149                 if (!switching_chanctx)
4150                         break;
4151
4152                 disabled_vif = vif;
4153
4154                 if (!fw_has_capa(&mvm->fw->ucode_capa,
4155                                  IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD))
4156                         iwl_mvm_mac_ctxt_changed(mvm, vif, true, NULL);
4157                 break;
4158         default:
4159                 break;
4160         }
4161
4162         iwl_mvm_update_quotas(mvm, false, disabled_vif);
4163         iwl_mvm_binding_remove_vif(mvm, vif);
4164
4165 out:
4166         mvmvif->phy_ctxt = NULL;
4167         iwl_mvm_power_update_mac(mvm);
4168 }
4169
4170 static void iwl_mvm_unassign_vif_chanctx(struct ieee80211_hw *hw,
4171                                          struct ieee80211_vif *vif,
4172                                          struct ieee80211_chanctx_conf *ctx)
4173 {
4174         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4175
4176         mutex_lock(&mvm->mutex);
4177         __iwl_mvm_unassign_vif_chanctx(mvm, vif, ctx, false);
4178         mutex_unlock(&mvm->mutex);
4179 }
4180
4181 static int
4182 iwl_mvm_switch_vif_chanctx_swap(struct iwl_mvm *mvm,
4183                                 struct ieee80211_vif_chanctx_switch *vifs)
4184 {
4185         int ret;
4186
4187         mutex_lock(&mvm->mutex);
4188         __iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
4189         __iwl_mvm_remove_chanctx(mvm, vifs[0].old_ctx);
4190
4191         ret = __iwl_mvm_add_chanctx(mvm, vifs[0].new_ctx);
4192         if (ret) {
4193                 IWL_ERR(mvm, "failed to add new_ctx during channel switch\n");
4194                 goto out_reassign;
4195         }
4196
4197         ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
4198                                            true);
4199         if (ret) {
4200                 IWL_ERR(mvm,
4201                         "failed to assign new_ctx during channel switch\n");
4202                 goto out_remove;
4203         }
4204
4205         /* we don't support TDLS during DCM - can be caused by channel switch */
4206         if (iwl_mvm_phy_ctx_count(mvm) > 1)
4207                 iwl_mvm_teardown_tdls_peers(mvm);
4208
4209         goto out;
4210
4211 out_remove:
4212         __iwl_mvm_remove_chanctx(mvm, vifs[0].new_ctx);
4213
4214 out_reassign:
4215         if (__iwl_mvm_add_chanctx(mvm, vifs[0].old_ctx)) {
4216                 IWL_ERR(mvm, "failed to add old_ctx back after failure.\n");
4217                 goto out_restart;
4218         }
4219
4220         if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
4221                                          true)) {
4222                 IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
4223                 goto out_restart;
4224         }
4225
4226         goto out;
4227
4228 out_restart:
4229         /* things keep failing, better restart the hw */
4230         iwl_mvm_nic_restart(mvm, false);
4231
4232 out:
4233         mutex_unlock(&mvm->mutex);
4234
4235         return ret;
4236 }
4237
4238 static int
4239 iwl_mvm_switch_vif_chanctx_reassign(struct iwl_mvm *mvm,
4240                                     struct ieee80211_vif_chanctx_switch *vifs)
4241 {
4242         int ret;
4243
4244         mutex_lock(&mvm->mutex);
4245         __iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
4246
4247         ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
4248                                            true);
4249         if (ret) {
4250                 IWL_ERR(mvm,
4251                         "failed to assign new_ctx during channel switch\n");
4252                 goto out_reassign;
4253         }
4254
4255         goto out;
4256
4257 out_reassign:
4258         if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
4259                                          true)) {
4260                 IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
4261                 goto out_restart;
4262         }
4263
4264         goto out;
4265
4266 out_restart:
4267         /* things keep failing, better restart the hw */
4268         iwl_mvm_nic_restart(mvm, false);
4269
4270 out:
4271         mutex_unlock(&mvm->mutex);
4272
4273         return ret;
4274 }
4275
4276 static int iwl_mvm_switch_vif_chanctx(struct ieee80211_hw *hw,
4277                                       struct ieee80211_vif_chanctx_switch *vifs,
4278                                       int n_vifs,
4279                                       enum ieee80211_chanctx_switch_mode mode)
4280 {
4281         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4282         int ret;
4283
4284         /* we only support a single-vif right now */
4285         if (n_vifs > 1)
4286                 return -EOPNOTSUPP;
4287
4288         switch (mode) {
4289         case CHANCTX_SWMODE_SWAP_CONTEXTS:
4290                 ret = iwl_mvm_switch_vif_chanctx_swap(mvm, vifs);
4291                 break;
4292         case CHANCTX_SWMODE_REASSIGN_VIF:
4293                 ret = iwl_mvm_switch_vif_chanctx_reassign(mvm, vifs);
4294                 break;
4295         default:
4296                 ret = -EOPNOTSUPP;
4297                 break;
4298         }
4299
4300         return ret;
4301 }
4302
4303 static int iwl_mvm_tx_last_beacon(struct ieee80211_hw *hw)
4304 {
4305         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4306
4307         return mvm->ibss_manager;
4308 }
4309
4310 static int iwl_mvm_set_tim(struct ieee80211_hw *hw,
4311                            struct ieee80211_sta *sta,
4312                            bool set)
4313 {
4314         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4315         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
4316
4317         if (!mvm_sta || !mvm_sta->vif) {
4318                 IWL_ERR(mvm, "Station is not associated to a vif\n");
4319                 return -EINVAL;
4320         }
4321
4322         return iwl_mvm_mac_ctxt_beacon_changed(mvm, mvm_sta->vif);
4323 }
4324
4325 #ifdef CONFIG_NL80211_TESTMODE
4326 static const struct nla_policy iwl_mvm_tm_policy[IWL_MVM_TM_ATTR_MAX + 1] = {
4327         [IWL_MVM_TM_ATTR_CMD] = { .type = NLA_U32 },
4328         [IWL_MVM_TM_ATTR_NOA_DURATION] = { .type = NLA_U32 },
4329         [IWL_MVM_TM_ATTR_BEACON_FILTER_STATE] = { .type = NLA_U32 },
4330 };
4331
4332 static int __iwl_mvm_mac_testmode_cmd(struct iwl_mvm *mvm,
4333                                       struct ieee80211_vif *vif,
4334                                       void *data, int len)
4335 {
4336         struct nlattr *tb[IWL_MVM_TM_ATTR_MAX + 1];
4337         int err;
4338         u32 noa_duration;
4339
4340         err = nla_parse_deprecated(tb, IWL_MVM_TM_ATTR_MAX, data, len,
4341                                    iwl_mvm_tm_policy, NULL);
4342         if (err)
4343                 return err;
4344
4345         if (!tb[IWL_MVM_TM_ATTR_CMD])
4346                 return -EINVAL;
4347
4348         switch (nla_get_u32(tb[IWL_MVM_TM_ATTR_CMD])) {
4349         case IWL_MVM_TM_CMD_SET_NOA:
4350                 if (!vif || vif->type != NL80211_IFTYPE_AP || !vif->p2p ||
4351                     !vif->bss_conf.enable_beacon ||
4352                     !tb[IWL_MVM_TM_ATTR_NOA_DURATION])
4353                         return -EINVAL;
4354
4355                 noa_duration = nla_get_u32(tb[IWL_MVM_TM_ATTR_NOA_DURATION]);
4356                 if (noa_duration >= vif->bss_conf.beacon_int)
4357                         return -EINVAL;
4358
4359                 mvm->noa_duration = noa_duration;
4360                 mvm->noa_vif = vif;
4361
4362                 return iwl_mvm_update_quotas(mvm, true, NULL);
4363         case IWL_MVM_TM_CMD_SET_BEACON_FILTER:
4364                 /* must be associated client vif - ignore authorized */
4365                 if (!vif || vif->type != NL80211_IFTYPE_STATION ||
4366                     !vif->bss_conf.assoc || !vif->bss_conf.dtim_period ||
4367                     !tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE])
4368                         return -EINVAL;
4369
4370                 if (nla_get_u32(tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE]))
4371                         return iwl_mvm_enable_beacon_filter(mvm, vif, 0);
4372                 return iwl_mvm_disable_beacon_filter(mvm, vif, 0);
4373         }
4374
4375         return -EOPNOTSUPP;
4376 }
4377
4378 static int iwl_mvm_mac_testmode_cmd(struct ieee80211_hw *hw,
4379                                     struct ieee80211_vif *vif,
4380                                     void *data, int len)
4381 {
4382         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4383         int err;
4384
4385         mutex_lock(&mvm->mutex);
4386         err = __iwl_mvm_mac_testmode_cmd(mvm, vif, data, len);
4387         mutex_unlock(&mvm->mutex);
4388
4389         return err;
4390 }
4391 #endif
4392
4393 static void iwl_mvm_channel_switch(struct ieee80211_hw *hw,
4394                                    struct ieee80211_vif *vif,
4395                                    struct ieee80211_channel_switch *chsw)
4396 {
4397         /* By implementing this operation, we prevent mac80211 from
4398          * starting its own channel switch timer, so that we can call
4399          * ieee80211_chswitch_done() ourselves at the right time
4400          * (which is when the absence time event starts).
4401          */
4402
4403         IWL_DEBUG_MAC80211(IWL_MAC80211_GET_MVM(hw),
4404                            "dummy channel switch op\n");
4405 }
4406
4407 static int iwl_mvm_schedule_client_csa(struct iwl_mvm *mvm,
4408                                        struct ieee80211_vif *vif,
4409                                        struct ieee80211_channel_switch *chsw)
4410 {
4411         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4412         struct iwl_chan_switch_te_cmd cmd = {
4413                 .mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
4414                                                           mvmvif->color)),
4415                 .action = cpu_to_le32(FW_CTXT_ACTION_ADD),
4416                 .tsf = cpu_to_le32(chsw->timestamp),
4417                 .cs_count = chsw->count,
4418                 .cs_mode = chsw->block_tx,
4419         };
4420
4421         lockdep_assert_held(&mvm->mutex);
4422
4423         if (chsw->delay)
4424                 cmd.cs_delayed_bcn_count =
4425                         DIV_ROUND_UP(chsw->delay, vif->bss_conf.beacon_int);
4426
4427         return iwl_mvm_send_cmd_pdu(mvm,
4428                                     WIDE_ID(MAC_CONF_GROUP,
4429                                             CHANNEL_SWITCH_TIME_EVENT_CMD),
4430                                     0, sizeof(cmd), &cmd);
4431 }
4432
4433 static int iwl_mvm_old_pre_chan_sw_sta(struct iwl_mvm *mvm,
4434                                        struct ieee80211_vif *vif,
4435                                        struct ieee80211_channel_switch *chsw)
4436 {
4437         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4438         u32 apply_time;
4439
4440         /* Schedule the time event to a bit before beacon 1,
4441          * to make sure we're in the new channel when the
4442          * GO/AP arrives. In case count <= 1 immediately schedule the
4443          * TE (this might result with some packet loss or connection
4444          * loss).
4445          */
4446         if (chsw->count <= 1)
4447                 apply_time = 0;
4448         else
4449                 apply_time = chsw->device_timestamp +
4450                         ((vif->bss_conf.beacon_int * (chsw->count - 1) -
4451                           IWL_MVM_CHANNEL_SWITCH_TIME_CLIENT) * 1024);
4452
4453         if (chsw->block_tx)
4454                 iwl_mvm_csa_client_absent(mvm, vif);
4455
4456         if (mvmvif->bf_data.bf_enabled) {
4457                 int ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
4458
4459                 if (ret)
4460                         return ret;
4461         }
4462
4463         iwl_mvm_schedule_csa_period(mvm, vif, vif->bss_conf.beacon_int,
4464                                     apply_time);
4465
4466         return 0;
4467 }
4468
4469 #define IWL_MAX_CSA_BLOCK_TX 1500
4470 static int iwl_mvm_pre_channel_switch(struct ieee80211_hw *hw,
4471                                       struct ieee80211_vif *vif,
4472                                       struct ieee80211_channel_switch *chsw)
4473 {
4474         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4475         struct ieee80211_vif *csa_vif;
4476         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4477         int ret;
4478
4479         mutex_lock(&mvm->mutex);
4480
4481         mvmvif->csa_failed = false;
4482
4483         IWL_DEBUG_MAC80211(mvm, "pre CSA to freq %d\n",
4484                            chsw->chandef.center_freq1);
4485
4486         iwl_fw_dbg_trigger_simple_stop(&mvm->fwrt,
4487                                        ieee80211_vif_to_wdev(vif),
4488                                        FW_DBG_TRIGGER_CHANNEL_SWITCH);
4489
4490         switch (vif->type) {
4491         case NL80211_IFTYPE_AP:
4492                 csa_vif =
4493                         rcu_dereference_protected(mvm->csa_vif,
4494                                                   lockdep_is_held(&mvm->mutex));
4495                 if (WARN_ONCE(csa_vif && csa_vif->csa_active,
4496                               "Another CSA is already in progress")) {
4497                         ret = -EBUSY;
4498                         goto out_unlock;
4499                 }
4500
4501                 /* we still didn't unblock tx. prevent new CS meanwhile */
4502                 if (rcu_dereference_protected(mvm->csa_tx_blocked_vif,
4503                                               lockdep_is_held(&mvm->mutex))) {
4504                         ret = -EBUSY;
4505                         goto out_unlock;
4506                 }
4507
4508                 rcu_assign_pointer(mvm->csa_vif, vif);
4509
4510                 if (WARN_ONCE(mvmvif->csa_countdown,
4511                               "Previous CSA countdown didn't complete")) {
4512                         ret = -EBUSY;
4513                         goto out_unlock;
4514                 }
4515
4516                 mvmvif->csa_target_freq = chsw->chandef.chan->center_freq;
4517
4518                 break;
4519         case NL80211_IFTYPE_STATION:
4520                 if (chsw->block_tx) {
4521                         /*
4522                          * In case of undetermined / long time with immediate
4523                          * quiet monitor status to gracefully disconnect
4524                          */
4525                         if (!chsw->count ||
4526                             chsw->count * vif->bss_conf.beacon_int >
4527                             IWL_MAX_CSA_BLOCK_TX)
4528                                 schedule_delayed_work(&mvmvif->csa_work,
4529                                                       msecs_to_jiffies(IWL_MAX_CSA_BLOCK_TX));
4530                 }
4531
4532                 if (!fw_has_capa(&mvm->fw->ucode_capa,
4533                                  IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
4534                         ret = iwl_mvm_old_pre_chan_sw_sta(mvm, vif, chsw);
4535                         if (ret)
4536                                 goto out_unlock;
4537                 } else {
4538                         iwl_mvm_schedule_client_csa(mvm, vif, chsw);
4539                 }
4540
4541                 mvmvif->csa_count = chsw->count;
4542                 mvmvif->csa_misbehave = false;
4543                 break;
4544         default:
4545                 break;
4546         }
4547
4548         mvmvif->ps_disabled = true;
4549
4550         ret = iwl_mvm_power_update_ps(mvm);
4551         if (ret)
4552                 goto out_unlock;
4553
4554         /* we won't be on this channel any longer */
4555         iwl_mvm_teardown_tdls_peers(mvm);
4556
4557 out_unlock:
4558         mutex_unlock(&mvm->mutex);
4559
4560         return ret;
4561 }
4562
4563 static void iwl_mvm_channel_switch_rx_beacon(struct ieee80211_hw *hw,
4564                                              struct ieee80211_vif *vif,
4565                                              struct ieee80211_channel_switch *chsw)
4566 {
4567         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4568         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4569         struct iwl_chan_switch_te_cmd cmd = {
4570                 .mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
4571                                                           mvmvif->color)),
4572                 .action = cpu_to_le32(FW_CTXT_ACTION_MODIFY),
4573                 .tsf = cpu_to_le32(chsw->timestamp),
4574                 .cs_count = chsw->count,
4575                 .cs_mode = chsw->block_tx,
4576         };
4577
4578         if (!fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_CS_MODIFY))
4579                 return;
4580
4581         if (chsw->count >= mvmvif->csa_count && chsw->block_tx) {
4582                 if (mvmvif->csa_misbehave) {
4583                         /* Second time, give up on this AP*/
4584                         iwl_mvm_abort_channel_switch(hw, vif);
4585                         ieee80211_chswitch_done(vif, false);
4586                         mvmvif->csa_misbehave = false;
4587                         return;
4588                 }
4589                 mvmvif->csa_misbehave = true;
4590         }
4591         mvmvif->csa_count = chsw->count;
4592
4593         IWL_DEBUG_MAC80211(mvm, "Modify CSA on mac %d\n", mvmvif->id);
4594
4595         WARN_ON(iwl_mvm_send_cmd_pdu(mvm,
4596                                      WIDE_ID(MAC_CONF_GROUP,
4597                                              CHANNEL_SWITCH_TIME_EVENT_CMD),
4598                                      CMD_ASYNC, sizeof(cmd), &cmd));
4599 }
4600
4601 static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop)
4602 {
4603         int i;
4604
4605         if (!iwl_mvm_has_new_tx_api(mvm)) {
4606                 if (drop) {
4607                         mutex_lock(&mvm->mutex);
4608                         iwl_mvm_flush_tx_path(mvm,
4609                                 iwl_mvm_flushable_queues(mvm) & queues, 0);
4610                         mutex_unlock(&mvm->mutex);
4611                 } else {
4612                         iwl_trans_wait_tx_queues_empty(mvm->trans, queues);
4613                 }
4614                 return;
4615         }
4616
4617         mutex_lock(&mvm->mutex);
4618         for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
4619                 struct ieee80211_sta *sta;
4620
4621                 sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
4622                                                 lockdep_is_held(&mvm->mutex));
4623                 if (IS_ERR_OR_NULL(sta))
4624                         continue;
4625
4626                 if (drop)
4627                         iwl_mvm_flush_sta_tids(mvm, i, 0xFF, 0);
4628                 else
4629                         iwl_mvm_wait_sta_queues_empty(mvm,
4630                                         iwl_mvm_sta_from_mac80211(sta));
4631         }
4632         mutex_unlock(&mvm->mutex);
4633 }
4634
4635 static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
4636                               struct ieee80211_vif *vif, u32 queues, bool drop)
4637 {
4638         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4639         struct iwl_mvm_vif *mvmvif;
4640         struct iwl_mvm_sta *mvmsta;
4641         struct ieee80211_sta *sta;
4642         int i;
4643         u32 msk = 0;
4644
4645         if (!vif) {
4646                 iwl_mvm_flush_no_vif(mvm, queues, drop);
4647                 return;
4648         }
4649
4650         if (vif->type != NL80211_IFTYPE_STATION)
4651                 return;
4652
4653         /* Make sure we're done with the deferred traffic before flushing */
4654         flush_work(&mvm->add_stream_wk);
4655
4656         mutex_lock(&mvm->mutex);
4657         mvmvif = iwl_mvm_vif_from_mac80211(vif);
4658
4659         /* flush the AP-station and all TDLS peers */
4660         for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
4661                 sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
4662                                                 lockdep_is_held(&mvm->mutex));
4663                 if (IS_ERR_OR_NULL(sta))
4664                         continue;
4665
4666                 mvmsta = iwl_mvm_sta_from_mac80211(sta);
4667                 if (mvmsta->vif != vif)
4668                         continue;
4669
4670                 /* make sure only TDLS peers or the AP are flushed */
4671                 WARN_ON(i != mvmvif->ap_sta_id && !sta->tdls);
4672
4673                 if (drop) {
4674                         if (iwl_mvm_flush_sta(mvm, mvmsta, false, 0))
4675                                 IWL_ERR(mvm, "flush request fail\n");
4676                 } else {
4677                         msk |= mvmsta->tfd_queue_msk;
4678                         if (iwl_mvm_has_new_tx_api(mvm))
4679                                 iwl_mvm_wait_sta_queues_empty(mvm, mvmsta);
4680                 }
4681         }
4682
4683         mutex_unlock(&mvm->mutex);
4684
4685         /* this can take a while, and we may need/want other operations
4686          * to succeed while doing this, so do it without the mutex held
4687          */
4688         if (!drop && !iwl_mvm_has_new_tx_api(mvm))
4689                 iwl_trans_wait_tx_queues_empty(mvm->trans, msk);
4690 }
4691
4692 static int iwl_mvm_mac_get_survey(struct ieee80211_hw *hw, int idx,
4693                                   struct survey_info *survey)
4694 {
4695         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4696         int ret;
4697
4698         memset(survey, 0, sizeof(*survey));
4699
4700         /* only support global statistics right now */
4701         if (idx != 0)
4702                 return -ENOENT;
4703
4704         if (!fw_has_capa(&mvm->fw->ucode_capa,
4705                          IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
4706                 return -ENOENT;
4707
4708         mutex_lock(&mvm->mutex);
4709
4710         if (iwl_mvm_firmware_running(mvm)) {
4711                 ret = iwl_mvm_request_statistics(mvm, false);
4712                 if (ret)
4713                         goto out;
4714         }
4715
4716         survey->filled = SURVEY_INFO_TIME |
4717                          SURVEY_INFO_TIME_RX |
4718                          SURVEY_INFO_TIME_TX |
4719                          SURVEY_INFO_TIME_SCAN;
4720         survey->time = mvm->accu_radio_stats.on_time_rf +
4721                        mvm->radio_stats.on_time_rf;
4722         do_div(survey->time, USEC_PER_MSEC);
4723
4724         survey->time_rx = mvm->accu_radio_stats.rx_time +
4725                           mvm->radio_stats.rx_time;
4726         do_div(survey->time_rx, USEC_PER_MSEC);
4727
4728         survey->time_tx = mvm->accu_radio_stats.tx_time +
4729                           mvm->radio_stats.tx_time;
4730         do_div(survey->time_tx, USEC_PER_MSEC);
4731
4732         survey->time_scan = mvm->accu_radio_stats.on_time_scan +
4733                             mvm->radio_stats.on_time_scan;
4734         do_div(survey->time_scan, USEC_PER_MSEC);
4735
4736         ret = 0;
4737  out:
4738         mutex_unlock(&mvm->mutex);
4739         return ret;
4740 }
4741
4742 static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,
4743                                        struct ieee80211_vif *vif,
4744                                        struct ieee80211_sta *sta,
4745                                        struct station_info *sinfo)
4746 {
4747         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4748         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4749         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
4750
4751         if (mvmsta->avg_energy) {
4752                 sinfo->signal_avg = mvmsta->avg_energy;
4753                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
4754         }
4755
4756         /* if beacon filtering isn't on mac80211 does it anyway */
4757         if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
4758                 return;
4759
4760         if (!vif->bss_conf.assoc)
4761                 return;
4762
4763         mutex_lock(&mvm->mutex);
4764
4765         if (mvmvif->ap_sta_id != mvmsta->sta_id)
4766                 goto unlock;
4767
4768         if (iwl_mvm_request_statistics(mvm, false))
4769                 goto unlock;
4770
4771         sinfo->rx_beacon = mvmvif->beacon_stats.num_beacons +
4772                            mvmvif->beacon_stats.accu_num_beacons;
4773         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_RX);
4774         if (mvmvif->beacon_stats.avg_signal) {
4775                 /* firmware only reports a value after RXing a few beacons */
4776                 sinfo->rx_beacon_signal_avg = mvmvif->beacon_stats.avg_signal;
4777                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG);
4778         }
4779  unlock:
4780         mutex_unlock(&mvm->mutex);
4781 }
4782
4783 static void iwl_mvm_event_mlme_callback(struct iwl_mvm *mvm,
4784                                         struct ieee80211_vif *vif,
4785                                         const struct ieee80211_event *event)
4786 {
4787 #define CHECK_MLME_TRIGGER(_cnt, _fmt...)                               \
4788         do {                                                            \
4789                 if ((trig_mlme->_cnt) && --(trig_mlme->_cnt))           \
4790                         break;                                          \
4791                 iwl_fw_dbg_collect_trig(&(mvm)->fwrt, trig, _fmt);      \
4792         } while (0)
4793
4794         struct iwl_fw_dbg_trigger_tlv *trig;
4795         struct iwl_fw_dbg_trigger_mlme *trig_mlme;
4796
4797         trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
4798                                      FW_DBG_TRIGGER_MLME);
4799         if (!trig)
4800                 return;
4801
4802         trig_mlme = (void *)trig->data;
4803
4804         if (event->u.mlme.data == ASSOC_EVENT) {
4805                 if (event->u.mlme.status == MLME_DENIED)
4806                         CHECK_MLME_TRIGGER(stop_assoc_denied,
4807                                            "DENIED ASSOC: reason %d",
4808                                             event->u.mlme.reason);
4809                 else if (event->u.mlme.status == MLME_TIMEOUT)
4810                         CHECK_MLME_TRIGGER(stop_assoc_timeout,
4811                                            "ASSOC TIMEOUT");
4812         } else if (event->u.mlme.data == AUTH_EVENT) {
4813                 if (event->u.mlme.status == MLME_DENIED)
4814                         CHECK_MLME_TRIGGER(stop_auth_denied,
4815                                            "DENIED AUTH: reason %d",
4816                                            event->u.mlme.reason);
4817                 else if (event->u.mlme.status == MLME_TIMEOUT)
4818                         CHECK_MLME_TRIGGER(stop_auth_timeout,
4819                                            "AUTH TIMEOUT");
4820         } else if (event->u.mlme.data == DEAUTH_RX_EVENT) {
4821                 CHECK_MLME_TRIGGER(stop_rx_deauth,
4822                                    "DEAUTH RX %d", event->u.mlme.reason);
4823         } else if (event->u.mlme.data == DEAUTH_TX_EVENT) {
4824                 CHECK_MLME_TRIGGER(stop_tx_deauth,
4825                                    "DEAUTH TX %d", event->u.mlme.reason);
4826         }
4827 #undef CHECK_MLME_TRIGGER
4828 }
4829
4830 static void iwl_mvm_event_bar_rx_callback(struct iwl_mvm *mvm,
4831                                           struct ieee80211_vif *vif,
4832                                           const struct ieee80211_event *event)
4833 {
4834         struct iwl_fw_dbg_trigger_tlv *trig;
4835         struct iwl_fw_dbg_trigger_ba *ba_trig;
4836
4837         trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
4838                                      FW_DBG_TRIGGER_BA);
4839         if (!trig)
4840                 return;
4841
4842         ba_trig = (void *)trig->data;
4843
4844         if (!(le16_to_cpu(ba_trig->rx_bar) & BIT(event->u.ba.tid)))
4845                 return;
4846
4847         iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
4848                                 "BAR received from %pM, tid %d, ssn %d",
4849                                 event->u.ba.sta->addr, event->u.ba.tid,
4850                                 event->u.ba.ssn);
4851 }
4852
4853 static void iwl_mvm_mac_event_callback(struct ieee80211_hw *hw,
4854                                        struct ieee80211_vif *vif,
4855                                        const struct ieee80211_event *event)
4856 {
4857         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4858
4859         switch (event->type) {
4860         case MLME_EVENT:
4861                 iwl_mvm_event_mlme_callback(mvm, vif, event);
4862                 break;
4863         case BAR_RX_EVENT:
4864                 iwl_mvm_event_bar_rx_callback(mvm, vif, event);
4865                 break;
4866         case BA_FRAME_TIMEOUT:
4867                 iwl_mvm_event_frame_timeout_callback(mvm, vif, event->u.ba.sta,
4868                                                      event->u.ba.tid);
4869                 break;
4870         default:
4871                 break;
4872         }
4873 }
4874
4875 void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm,
4876                                      struct iwl_mvm_internal_rxq_notif *notif,
4877                                      u32 size)
4878 {
4879         u32 qmask = BIT(mvm->trans->num_rx_queues) - 1;
4880         int ret;
4881
4882
4883         if (!iwl_mvm_has_new_rx_api(mvm))
4884                 return;
4885
4886         if (notif->sync) {
4887                 notif->cookie = mvm->queue_sync_cookie;
4888                 atomic_set(&mvm->queue_sync_counter,
4889                            mvm->trans->num_rx_queues);
4890         }
4891
4892         ret = iwl_mvm_notify_rx_queue(mvm, qmask, (u8 *)notif,
4893                                       size, !notif->sync);
4894         if (ret) {
4895                 IWL_ERR(mvm, "Failed to trigger RX queues sync (%d)\n", ret);
4896                 goto out;
4897         }
4898
4899         if (notif->sync) {
4900                 lockdep_assert_held(&mvm->mutex);
4901                 ret = wait_event_timeout(mvm->rx_sync_waitq,
4902                                          atomic_read(&mvm->queue_sync_counter) == 0 ||
4903                                          iwl_mvm_is_radio_killed(mvm),
4904                                          HZ);
4905                 WARN_ON_ONCE(!ret && !iwl_mvm_is_radio_killed(mvm));
4906         }
4907
4908 out:
4909         atomic_set(&mvm->queue_sync_counter, 0);
4910         if (notif->sync)
4911                 mvm->queue_sync_cookie++;
4912 }
4913
4914 static void iwl_mvm_sync_rx_queues(struct ieee80211_hw *hw)
4915 {
4916         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4917         struct iwl_mvm_internal_rxq_notif data = {
4918                 .type = IWL_MVM_RXQ_EMPTY,
4919                 .sync = 1,
4920         };
4921
4922         mutex_lock(&mvm->mutex);
4923         iwl_mvm_sync_rx_queues_internal(mvm, &data, sizeof(data));
4924         mutex_unlock(&mvm->mutex);
4925 }
4926
4927 static int
4928 iwl_mvm_mac_get_ftm_responder_stats(struct ieee80211_hw *hw,
4929                                     struct ieee80211_vif *vif,
4930                                     struct cfg80211_ftm_responder_stats *stats)
4931 {
4932         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4933         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4934
4935         if (vif->p2p || vif->type != NL80211_IFTYPE_AP ||
4936             !mvmvif->ap_ibss_active || !vif->bss_conf.ftm_responder)
4937                 return -EINVAL;
4938
4939         mutex_lock(&mvm->mutex);
4940         *stats = mvm->ftm_resp_stats;
4941         mutex_unlock(&mvm->mutex);
4942
4943         stats->filled = BIT(NL80211_FTM_STATS_SUCCESS_NUM) |
4944                         BIT(NL80211_FTM_STATS_PARTIAL_NUM) |
4945                         BIT(NL80211_FTM_STATS_FAILED_NUM) |
4946                         BIT(NL80211_FTM_STATS_ASAP_NUM) |
4947                         BIT(NL80211_FTM_STATS_NON_ASAP_NUM) |
4948                         BIT(NL80211_FTM_STATS_TOTAL_DURATION_MSEC) |
4949                         BIT(NL80211_FTM_STATS_UNKNOWN_TRIGGERS_NUM) |
4950                         BIT(NL80211_FTM_STATS_RESCHEDULE_REQUESTS_NUM) |
4951                         BIT(NL80211_FTM_STATS_OUT_OF_WINDOW_TRIGGERS_NUM);
4952
4953         return 0;
4954 }
4955
4956 static int iwl_mvm_start_pmsr(struct ieee80211_hw *hw,
4957                               struct ieee80211_vif *vif,
4958                               struct cfg80211_pmsr_request *request)
4959 {
4960         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4961         int ret;
4962
4963         mutex_lock(&mvm->mutex);
4964         ret = iwl_mvm_ftm_start(mvm, vif, request);
4965         mutex_unlock(&mvm->mutex);
4966
4967         return ret;
4968 }
4969
4970 static void iwl_mvm_abort_pmsr(struct ieee80211_hw *hw,
4971                                struct ieee80211_vif *vif,
4972                                struct cfg80211_pmsr_request *request)
4973 {
4974         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4975
4976         mutex_lock(&mvm->mutex);
4977         iwl_mvm_ftm_abort(mvm, request);
4978         mutex_unlock(&mvm->mutex);
4979 }
4980
4981 static bool iwl_mvm_can_hw_csum(struct sk_buff *skb)
4982 {
4983         u8 protocol = ip_hdr(skb)->protocol;
4984
4985         if (!IS_ENABLED(CONFIG_INET))
4986                 return false;
4987
4988         return protocol == IPPROTO_TCP || protocol == IPPROTO_UDP;
4989 }
4990
4991 static bool iwl_mvm_mac_can_aggregate(struct ieee80211_hw *hw,
4992                                       struct sk_buff *head,
4993                                       struct sk_buff *skb)
4994 {
4995         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4996
4997         /* For now don't aggregate IPv6 in AMSDU */
4998         if (skb->protocol != htons(ETH_P_IP))
4999                 return false;
5000
5001         if (!iwl_mvm_is_csum_supported(mvm))
5002                 return true;
5003
5004         return iwl_mvm_can_hw_csum(skb) == iwl_mvm_can_hw_csum(head);
5005 }
5006
5007 const struct ieee80211_ops iwl_mvm_hw_ops = {
5008         .tx = iwl_mvm_mac_tx,
5009         .wake_tx_queue = iwl_mvm_mac_wake_tx_queue,
5010         .ampdu_action = iwl_mvm_mac_ampdu_action,
5011         .start = iwl_mvm_mac_start,
5012         .reconfig_complete = iwl_mvm_mac_reconfig_complete,
5013         .stop = iwl_mvm_mac_stop,
5014         .add_interface = iwl_mvm_mac_add_interface,
5015         .remove_interface = iwl_mvm_mac_remove_interface,
5016         .config = iwl_mvm_mac_config,
5017         .prepare_multicast = iwl_mvm_prepare_multicast,
5018         .configure_filter = iwl_mvm_configure_filter,
5019         .config_iface_filter = iwl_mvm_config_iface_filter,
5020         .bss_info_changed = iwl_mvm_bss_info_changed,
5021         .hw_scan = iwl_mvm_mac_hw_scan,
5022         .cancel_hw_scan = iwl_mvm_mac_cancel_hw_scan,
5023         .sta_pre_rcu_remove = iwl_mvm_sta_pre_rcu_remove,
5024         .sta_state = iwl_mvm_mac_sta_state,
5025         .sta_notify = iwl_mvm_mac_sta_notify,
5026         .allow_buffered_frames = iwl_mvm_mac_allow_buffered_frames,
5027         .release_buffered_frames = iwl_mvm_mac_release_buffered_frames,
5028         .set_rts_threshold = iwl_mvm_mac_set_rts_threshold,
5029         .sta_rc_update = iwl_mvm_sta_rc_update,
5030         .conf_tx = iwl_mvm_mac_conf_tx,
5031         .mgd_prepare_tx = iwl_mvm_mac_mgd_prepare_tx,
5032         .mgd_protect_tdls_discover = iwl_mvm_mac_mgd_protect_tdls_discover,
5033         .flush = iwl_mvm_mac_flush,
5034         .sched_scan_start = iwl_mvm_mac_sched_scan_start,
5035         .sched_scan_stop = iwl_mvm_mac_sched_scan_stop,
5036         .set_key = iwl_mvm_mac_set_key,
5037         .update_tkip_key = iwl_mvm_mac_update_tkip_key,
5038         .remain_on_channel = iwl_mvm_roc,
5039         .cancel_remain_on_channel = iwl_mvm_cancel_roc,
5040         .add_chanctx = iwl_mvm_add_chanctx,
5041         .remove_chanctx = iwl_mvm_remove_chanctx,
5042         .change_chanctx = iwl_mvm_change_chanctx,
5043         .assign_vif_chanctx = iwl_mvm_assign_vif_chanctx,
5044         .unassign_vif_chanctx = iwl_mvm_unassign_vif_chanctx,
5045         .switch_vif_chanctx = iwl_mvm_switch_vif_chanctx,
5046
5047         .start_ap = iwl_mvm_start_ap_ibss,
5048         .stop_ap = iwl_mvm_stop_ap_ibss,
5049         .join_ibss = iwl_mvm_start_ap_ibss,
5050         .leave_ibss = iwl_mvm_stop_ap_ibss,
5051
5052         .tx_last_beacon = iwl_mvm_tx_last_beacon,
5053
5054         .set_tim = iwl_mvm_set_tim,
5055
5056         .channel_switch = iwl_mvm_channel_switch,
5057         .pre_channel_switch = iwl_mvm_pre_channel_switch,
5058         .post_channel_switch = iwl_mvm_post_channel_switch,
5059         .abort_channel_switch = iwl_mvm_abort_channel_switch,
5060         .channel_switch_rx_beacon = iwl_mvm_channel_switch_rx_beacon,
5061
5062         .tdls_channel_switch = iwl_mvm_tdls_channel_switch,
5063         .tdls_cancel_channel_switch = iwl_mvm_tdls_cancel_channel_switch,
5064         .tdls_recv_channel_switch = iwl_mvm_tdls_recv_channel_switch,
5065
5066         .event_callback = iwl_mvm_mac_event_callback,
5067
5068         .sync_rx_queues = iwl_mvm_sync_rx_queues,
5069
5070         CFG80211_TESTMODE_CMD(iwl_mvm_mac_testmode_cmd)
5071
5072 #ifdef CONFIG_PM_SLEEP
5073         /* look at d3.c */
5074         .suspend = iwl_mvm_suspend,
5075         .resume = iwl_mvm_resume,
5076         .set_wakeup = iwl_mvm_set_wakeup,
5077         .set_rekey_data = iwl_mvm_set_rekey_data,
5078 #if IS_ENABLED(CONFIG_IPV6)
5079         .ipv6_addr_change = iwl_mvm_ipv6_addr_change,
5080 #endif
5081         .set_default_unicast_key = iwl_mvm_set_default_unicast_key,
5082 #endif
5083         .get_survey = iwl_mvm_mac_get_survey,
5084         .sta_statistics = iwl_mvm_mac_sta_statistics,
5085         .get_ftm_responder_stats = iwl_mvm_mac_get_ftm_responder_stats,
5086         .start_pmsr = iwl_mvm_start_pmsr,
5087         .abort_pmsr = iwl_mvm_abort_pmsr,
5088
5089         .can_aggregate_in_amsdu = iwl_mvm_mac_can_aggregate,
5090 #ifdef CONFIG_IWLWIFI_DEBUGFS
5091         .sta_add_debugfs = iwl_mvm_sta_add_debugfs,
5092 #endif
5093 };