drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c

   1 /******************************************************************************
   2  *
   3  * This file is provided under a dual BSD/GPLv2 license.  When using or
   4  * redistributing this file, you may do so under either license.
   5  *
   6  * GPL LICENSE SUMMARY
   7  *
   8  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
   9  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  10  * Copyright(c) 2012 - 2014, 2018 - 2020 Intel Corporation
  11  *
  12  * This program is free software; you can redistribute it and/or modify
  13  * it under the terms of version 2 of the GNU General Public License as
  14  * published by the Free Software Foundation.
  15  *
  16  * This program is distributed in the hope that it will be useful, but
  17  * WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  19  * General Public License for more details.
  20  *
  21  * The full GNU General Public License is included in this distribution
  22  * in the file called COPYING.
  23  *
  24  * Contact Information:
  25  *  Intel Linux Wireless <linuxwifi@intel.com>
  26  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  27  *
  28  * BSD LICENSE
  29  *
  30  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  31  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  32  * Copyright(c) 2012 - 2014, 2018 - 2020 Intel Corporation
  33  * All rights reserved.
  34  *
  35  * Redistribution and use in source and binary forms, with or without
  36  * modification, are permitted provided that the following conditions
  37  * are met:
  38  *
  39  *  * Redistributions of source code must retain the above copyright
  40  *    notice, this list of conditions and the following disclaimer.
  41  *  * Redistributions in binary form must reproduce the above copyright
  42  *    notice, this list of conditions and the following disclaimer in
  43  *    the documentation and/or other materials provided with the
  44  *    distribution.
  45  *  * Neither the name Intel Corporation nor the names of its
  46  *    contributors may be used to endorse or promote products derived
  47  *    from this software without specific prior written permission.
  48  *
  49  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  50  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  51  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  52  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  53  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  54  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  55  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  56  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  57  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  58  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  59  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  60  *
  61  *****************************************************************************/
  62 #include <linux/kernel.h>
  63 #include <linux/slab.h>
  64 #include <linux/skbuff.h>
  65 #include <linux/netdevice.h>
  66 #include <linux/etherdevice.h>
  67 #include <linux/ip.h>
  68 #include <linux/if_arp.h>
  69 #include <linux/time.h>
  70 #include <net/mac80211.h>
  71 #include <net/ieee80211_radiotap.h>
  72 #include <net/tcp.h>
  73
  74 #include "iwl-op-mode.h"
  75 #include "iwl-io.h"
  76 #include "mvm.h"
  77 #include "sta.h"
  78 #include "time-event.h"
  79 #include "iwl-eeprom-parse.h"
  80 #include "iwl-phy-db.h"
  81 #include "testmode.h"
  82 #include "fw/error-dump.h"
  83 #include "iwl-prph.h"
  84 #include "iwl-nvm-parse.h"
  85
  86 static const struct ieee80211_iface_limit iwl_mvm_limits[] = {
  87         {
  88                 .max = 1,
  89                 .types = BIT(NL80211_IFTYPE_STATION),
  90         },
  91         {
  92                 .max = 1,
  93                 .types = BIT(NL80211_IFTYPE_AP) |
  94                         BIT(NL80211_IFTYPE_P2P_CLIENT) |
  95                         BIT(NL80211_IFTYPE_P2P_GO),
  96         },
  97         {
  98                 .max = 1,
  99                 .types = BIT(NL80211_IFTYPE_P2P_DEVICE),
 100         },
 101 };
 102
 103 static const struct ieee80211_iface_combination iwl_mvm_iface_combinations[] = {
 104         {
 105                 .num_different_channels = 2,
 106                 .max_interfaces = 3,
 107                 .limits = iwl_mvm_limits,
 108                 .n_limits = ARRAY_SIZE(iwl_mvm_limits),
 109         },
 110 };
 111
 112 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
 113 /*
 114  * Use the reserved field to indicate magic values.
 115  * these values will only be used internally by the driver,
 116  * and won't make it to the fw (reserved will be 0).
 117  * BC_FILTER_MAGIC_IP - configure the val of this attribute to
 118  *      be the vif's ip address. in case there is not a single
 119  *      ip address (0, or more than 1), this attribute will
 120  *      be skipped.
 121  * BC_FILTER_MAGIC_MAC - set the val of this attribute to
 122  *      the LSB bytes of the vif's mac address
 123  */
 124 enum {
 125         BC_FILTER_MAGIC_NONE = 0,
 126         BC_FILTER_MAGIC_IP,
 127         BC_FILTER_MAGIC_MAC,
 128 };
 129
 130 static const struct iwl_fw_bcast_filter iwl_mvm_default_bcast_filters[] = {
 131         {
 132                 /* arp */
 133                 .discard = 0,
 134                 .frame_type = BCAST_FILTER_FRAME_TYPE_ALL,
 135                 .attrs = {
 136                         {
 137                                 /* frame type - arp, hw type - ethernet */
 138                                 .offset_type =
 139                                         BCAST_FILTER_OFFSET_PAYLOAD_START,
 140                                 .offset = sizeof(rfc1042_header),
 141                                 .val = cpu_to_be32(0x08060001),
 142                                 .mask = cpu_to_be32(0xffffffff),
 143                         },
 144                         {
 145                                 /* arp dest ip */
 146                                 .offset_type =
 147                                         BCAST_FILTER_OFFSET_PAYLOAD_START,
 148                                 .offset = sizeof(rfc1042_header) + 2 +
 149                                           sizeof(struct arphdr) +
 150                                           ETH_ALEN + sizeof(__be32) +
 151                                           ETH_ALEN,
 152                                 .mask = cpu_to_be32(0xffffffff),
 153                                 /* mark it as special field */
 154                                 .reserved1 = cpu_to_le16(BC_FILTER_MAGIC_IP),
 155                         },
 156                 },
 157         },
 158         {
 159                 /* dhcp offer bcast */
 160                 .discard = 0,
 161                 .frame_type = BCAST_FILTER_FRAME_TYPE_IPV4,
 162                 .attrs = {
 163                         {
 164                                 /* udp dest port - 68 (bootp client)*/
 165                                 .offset_type = BCAST_FILTER_OFFSET_IP_END,
 166                                 .offset = offsetof(struct udphdr, dest),
 167                                 .val = cpu_to_be32(0x00440000),
 168                                 .mask = cpu_to_be32(0xffff0000),
 169                         },
 170                         {
 171                                 /* dhcp - lsb bytes of client hw address */
 172                                 .offset_type = BCAST_FILTER_OFFSET_IP_END,
 173                                 .offset = 38,
 174                                 .mask = cpu_to_be32(0xffffffff),
 175                                 /* mark it as special field */
 176                                 .reserved1 = cpu_to_le16(BC_FILTER_MAGIC_MAC),
 177                         },
 178                 },
 179         },
 180         /* last filter must be empty */
 181         {},
 182 };
 183 #endif
 184
 185 static const struct cfg80211_pmsr_capabilities iwl_mvm_pmsr_capa = {
 186         .max_peers = IWL_MVM_TOF_MAX_APS,
 187         .report_ap_tsf = 1,
 188         .randomize_mac_addr = 1,
 189
 190         .ftm = {
 191                 .supported = 1,
 192                 .asap = 1,
 193                 .non_asap = 1,
 194                 .request_lci = 1,
 195                 .request_civicloc = 1,
 196                 .max_bursts_exponent = -1, /* all supported */
 197                 .max_ftms_per_burst = 0, /* no limits */
 198                 .bandwidths = BIT(NL80211_CHAN_WIDTH_20_NOHT) |
 199                               BIT(NL80211_CHAN_WIDTH_20) |
 200                               BIT(NL80211_CHAN_WIDTH_40) |
 201                               BIT(NL80211_CHAN_WIDTH_80),
 202                 .preambles = BIT(NL80211_PREAMBLE_LEGACY) |
 203                              BIT(NL80211_PREAMBLE_HT) |
 204                              BIT(NL80211_PREAMBLE_VHT),
 205         },
 206 };
 207
 208 static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
 209                                  enum set_key_cmd cmd,
 210                                  struct ieee80211_vif *vif,
 211                                  struct ieee80211_sta *sta,
 212                                  struct ieee80211_key_conf *key);
 213
 214 static void iwl_mvm_reset_phy_ctxts(struct iwl_mvm *mvm)
 215 {
 216         int i;
 217
 218         memset(mvm->phy_ctxts, 0, sizeof(mvm->phy_ctxts));
 219         for (i = 0; i < NUM_PHY_CTX; i++) {
 220                 mvm->phy_ctxts[i].id = i;
 221                 mvm->phy_ctxts[i].ref = 0;
 222         }
 223 }
 224
 225 struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
 226                                                   const char *alpha2,
 227                                                   enum iwl_mcc_source src_id,
 228                                                   bool *changed)
 229 {
 230         struct ieee80211_regdomain *regd = NULL;
 231         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
 232         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 233         struct iwl_mcc_update_resp *resp;
 234
 235         IWL_DEBUG_LAR(mvm, "Getting regdomain data for %s from FW\n", alpha2);
 236
 237         lockdep_assert_held(&mvm->mutex);
 238
 239         resp = iwl_mvm_update_mcc(mvm, alpha2, src_id);
 240         if (IS_ERR_OR_NULL(resp)) {
 241                 IWL_DEBUG_LAR(mvm, "Could not get update from FW %d\n",
 242                               PTR_ERR_OR_ZERO(resp));
 243                 goto out;
 244         }
 245
 246         if (changed) {
 247                 u32 status = le32_to_cpu(resp->status);
 248
 249                 *changed = (status == MCC_RESP_NEW_CHAN_PROFILE ||
 250                             status == MCC_RESP_ILLEGAL);
 251         }
 252
 253         regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg,
 254                                       __le32_to_cpu(resp->n_channels),
 255                                       resp->channels,
 256                                       __le16_to_cpu(resp->mcc),
 257                                       __le16_to_cpu(resp->geo_info),
 258                                       __le16_to_cpu(resp->cap));
 259         /* Store the return source id */
 260         src_id = resp->source_id;
 261         kfree(resp);
 262         if (IS_ERR_OR_NULL(regd)) {
 263                 IWL_DEBUG_LAR(mvm, "Could not get parse update from FW %d\n",
 264                               PTR_ERR_OR_ZERO(regd));
 265                 goto out;
 266         }
 267
 268         IWL_DEBUG_LAR(mvm, "setting alpha2 from FW to %s (0x%x, 0x%x) src=%d\n",
 269                       regd->alpha2, regd->alpha2[0], regd->alpha2[1], src_id);
 270         mvm->lar_regdom_set = true;
 271         mvm->mcc_src = src_id;
 272
 273 out:
 274         return regd;
 275 }
 276
 277 void iwl_mvm_update_changed_regdom(struct iwl_mvm *mvm)
 278 {
 279         bool changed;
 280         struct ieee80211_regdomain *regd;
 281
 282         if (!iwl_mvm_is_lar_supported(mvm))
 283                 return;
 284
 285         regd = iwl_mvm_get_current_regdomain(mvm, &changed);
 286         if (!IS_ERR_OR_NULL(regd)) {
 287                 /* only update the regulatory core if changed */
 288                 if (changed)
 289                         regulatory_set_wiphy_regd(mvm->hw->wiphy, regd);
 290
 291                 kfree(regd);
 292         }
 293 }
 294
 295 struct ieee80211_regdomain *iwl_mvm_get_current_regdomain(struct iwl_mvm *mvm,
 296                                                           bool *changed)
 297 {
 298         return iwl_mvm_get_regdomain(mvm->hw->wiphy, "ZZ",
 299                                      iwl_mvm_is_wifi_mcc_supported(mvm) ?
 300                                      MCC_SOURCE_GET_CURRENT :
 301                                      MCC_SOURCE_OLD_FW, changed);
 302 }
 303
 304 int iwl_mvm_init_fw_regd(struct iwl_mvm *mvm)
 305 {
 306         enum iwl_mcc_source used_src;
 307         struct ieee80211_regdomain *regd;
 308         int ret;
 309         bool changed;
 310         const struct ieee80211_regdomain *r =
 311                         rtnl_dereference(mvm->hw->wiphy->regd);
 312
 313         if (!r)
 314                 return -ENOENT;
 315
 316         /* save the last source in case we overwrite it below */
 317         used_src = mvm->mcc_src;
 318         if (iwl_mvm_is_wifi_mcc_supported(mvm)) {
 319                 /* Notify the firmware we support wifi location updates */
 320                 regd = iwl_mvm_get_current_regdomain(mvm, NULL);
 321                 if (!IS_ERR_OR_NULL(regd))
 322                         kfree(regd);
 323         }
 324
 325         /* Now set our last stored MCC and source */
 326         regd = iwl_mvm_get_regdomain(mvm->hw->wiphy, r->alpha2, used_src,
 327                                      &changed);
 328         if (IS_ERR_OR_NULL(regd))
 329                 return -EIO;
 330
 331         /* update cfg80211 if the regdomain was changed */
 332         if (changed)
 333                 ret = regulatory_set_wiphy_regd_sync_rtnl(mvm->hw->wiphy, regd);
 334         else
 335                 ret = 0;
 336
 337         kfree(regd);
 338         return ret;
 339 }
 340
 341 static const u8 he_if_types_ext_capa_sta[] = {
 342          [0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
 343          [2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
 344          [7] = WLAN_EXT_CAPA8_OPMODE_NOTIF,
 345          [9] = WLAN_EXT_CAPA10_TWT_REQUESTER_SUPPORT,
 346 };
 347
 348 static const struct wiphy_iftype_ext_capab he_iftypes_ext_capa[] = {
 349         {
 350                 .iftype = NL80211_IFTYPE_STATION,
 351                 .extended_capabilities = he_if_types_ext_capa_sta,
 352                 .extended_capabilities_mask = he_if_types_ext_capa_sta,
 353                 .extended_capabilities_len = sizeof(he_if_types_ext_capa_sta),
 354         },
 355 };
 356
 357 static int
 358 iwl_mvm_op_get_antenna(struct ieee80211_hw *hw, u32 *tx_ant, u32 *rx_ant)
 359 {
 360         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 361         *tx_ant = iwl_mvm_get_valid_tx_ant(mvm);
 362         *rx_ant = iwl_mvm_get_valid_rx_ant(mvm);
 363         return 0;
 364 }
 365
 366 int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
 367 {
 368         struct ieee80211_hw *hw = mvm->hw;
 369         int num_mac, ret, i;
 370         static const u32 mvm_ciphers[] = {
 371                 WLAN_CIPHER_SUITE_WEP40,
 372                 WLAN_CIPHER_SUITE_WEP104,
 373                 WLAN_CIPHER_SUITE_TKIP,
 374                 WLAN_CIPHER_SUITE_CCMP,
 375         };
 376 #ifdef CONFIG_PM_SLEEP
 377         bool unified = fw_has_capa(&mvm->fw->ucode_capa,
 378                                    IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
 379 #endif
 380
 381         /* Tell mac80211 our characteristics */
 382         ieee80211_hw_set(hw, SIGNAL_DBM);
 383         ieee80211_hw_set(hw, SPECTRUM_MGMT);
 384         ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
 385         ieee80211_hw_set(hw, WANT_MONITOR_VIF);
 386         ieee80211_hw_set(hw, SUPPORTS_PS);
 387         ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
 388         ieee80211_hw_set(hw, AMPDU_AGGREGATION);
 389         ieee80211_hw_set(hw, TIMING_BEACON_ONLY);
 390         ieee80211_hw_set(hw, CONNECTION_MONITOR);
 391         ieee80211_hw_set(hw, CHANCTX_STA_CSA);
 392         ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
 393         ieee80211_hw_set(hw, SUPPORTS_CLONED_SKBS);
 394         ieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);
 395         ieee80211_hw_set(hw, NEEDS_UNIQUE_STA_ADDR);
 396         ieee80211_hw_set(hw, DEAUTH_NEED_MGD_TX_PREP);
 397         ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);
 398         ieee80211_hw_set(hw, BUFF_MMPDU_TXQ);
 399         ieee80211_hw_set(hw, STA_MMPDU_TXQ);
 400         /*
 401          * On older devices, enabling TX A-MSDU occasionally leads to
 402          * something getting messed up, the command read from the FIFO
 403          * gets out of sync and isn't a TX command, so that we have an
 404          * assert EDC.
 405          *
 406          * It's not clear where the bug is, but since we didn't used to
 407          * support A-MSDU until moving the mac80211 iTXQs, just leave it
 408          * for older devices. We also don't see this issue on any newer
 409          * devices.
 410          */
 411         if (mvm->trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_9000)
 412                 ieee80211_hw_set(hw, TX_AMSDU);
 413         ieee80211_hw_set(hw, TX_FRAG_LIST);
 414
 415         if (iwl_mvm_has_tlc_offload(mvm)) {
 416                 ieee80211_hw_set(hw, TX_AMPDU_SETUP_IN_HW);
 417                 ieee80211_hw_set(hw, HAS_RATE_CONTROL);
 418         }
 419
 420         if (iwl_mvm_has_new_rx_api(mvm))
 421                 ieee80211_hw_set(hw, SUPPORTS_REORDERING_BUFFER);
 422
 423         if (fw_has_capa(&mvm->fw->ucode_capa,
 424                         IWL_UCODE_TLV_CAPA_STA_PM_NOTIF)) {
 425                 ieee80211_hw_set(hw, AP_LINK_PS);
 426         } else if (WARN_ON(iwl_mvm_has_new_tx_api(mvm))) {
 427                 /*
 428                  * we absolutely need this for the new TX API since that comes
 429                  * with many more queues than the current code can deal with
 430                  * for station powersave
 431                  */
 432                 return -EINVAL;
 433         }
 434
 435         if (mvm->trans->num_rx_queues > 1)
 436                 ieee80211_hw_set(hw, USES_RSS);
 437
 438         if (mvm->trans->max_skb_frags)
 439                 hw->netdev_features = NETIF_F_HIGHDMA | NETIF_F_SG;
 440
 441         hw->queues = IEEE80211_MAX_QUEUES;
 442         hw->offchannel_tx_hw_queue = IWL_MVM_OFFCHANNEL_QUEUE;
 443         hw->radiotap_mcs_details |= IEEE80211_RADIOTAP_MCS_HAVE_FEC |
 444                                     IEEE80211_RADIOTAP_MCS_HAVE_STBC;
 445         hw->radiotap_vht_details |= IEEE80211_RADIOTAP_VHT_KNOWN_STBC |
 446                 IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED;
 447
 448         hw->radiotap_timestamp.units_pos =
 449                 IEEE80211_RADIOTAP_TIMESTAMP_UNIT_US |
 450                 IEEE80211_RADIOTAP_TIMESTAMP_SPOS_PLCP_SIG_ACQ;
 451         /* this is the case for CCK frames, it's better (only 8) for OFDM */
 452         hw->radiotap_timestamp.accuracy = 22;
 453
 454         if (!iwl_mvm_has_tlc_offload(mvm))
 455                 hw->rate_control_algorithm = RS_NAME;
 456
 457         hw->uapsd_queues = IWL_MVM_UAPSD_QUEUES;
 458         hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
 459         hw->max_tx_fragments = mvm->trans->max_skb_frags;
 460
 461         BUILD_BUG_ON(ARRAY_SIZE(mvm->ciphers) < ARRAY_SIZE(mvm_ciphers) + 6);
 462         memcpy(mvm->ciphers, mvm_ciphers, sizeof(mvm_ciphers));
 463         hw->wiphy->n_cipher_suites = ARRAY_SIZE(mvm_ciphers);
 464         hw->wiphy->cipher_suites = mvm->ciphers;
 465
 466         if (iwl_mvm_has_new_rx_api(mvm)) {
 467                 mvm->ciphers[hw->wiphy->n_cipher_suites] =
 468                         WLAN_CIPHER_SUITE_GCMP;
 469                 hw->wiphy->n_cipher_suites++;
 470                 mvm->ciphers[hw->wiphy->n_cipher_suites] =
 471                         WLAN_CIPHER_SUITE_GCMP_256;
 472                 hw->wiphy->n_cipher_suites++;
 473         }
 474
 475         /* Enable 11w if software crypto is not enabled (as the
 476          * firmware will interpret some mgmt packets, so enabling it
 477          * with software crypto isn't safe).
 478          */
 479         if (!iwlwifi_mod_params.swcrypto) {
 480                 ieee80211_hw_set(hw, MFP_CAPABLE);
 481                 mvm->ciphers[hw->wiphy->n_cipher_suites] =
 482                         WLAN_CIPHER_SUITE_AES_CMAC;
 483                 hw->wiphy->n_cipher_suites++;
 484                 if (iwl_mvm_has_new_rx_api(mvm)) {
 485                         mvm->ciphers[hw->wiphy->n_cipher_suites] =
 486                                 WLAN_CIPHER_SUITE_BIP_GMAC_128;
 487                         hw->wiphy->n_cipher_suites++;
 488                         mvm->ciphers[hw->wiphy->n_cipher_suites] =
 489                                 WLAN_CIPHER_SUITE_BIP_GMAC_256;
 490                         hw->wiphy->n_cipher_suites++;
 491                 }
 492         }
 493
 494         /* currently FW API supports only one optional cipher scheme */
 495         if (mvm->fw->cs[0].cipher) {
 496                 const struct iwl_fw_cipher_scheme *fwcs = &mvm->fw->cs[0];
 497                 struct ieee80211_cipher_scheme *cs = &mvm->cs[0];
 498
 499                 mvm->hw->n_cipher_schemes = 1;
 500
 501                 cs->cipher = le32_to_cpu(fwcs->cipher);
 502                 cs->iftype = BIT(NL80211_IFTYPE_STATION);
 503                 cs->hdr_len = fwcs->hdr_len;
 504                 cs->pn_len = fwcs->pn_len;
 505                 cs->pn_off = fwcs->pn_off;
 506                 cs->key_idx_off = fwcs->key_idx_off;
 507                 cs->key_idx_mask = fwcs->key_idx_mask;
 508                 cs->key_idx_shift = fwcs->key_idx_shift;
 509                 cs->mic_len = fwcs->mic_len;
 510
 511                 mvm->hw->cipher_schemes = mvm->cs;
 512                 mvm->ciphers[hw->wiphy->n_cipher_suites] = cs->cipher;
 513                 hw->wiphy->n_cipher_suites++;
 514         }
 515
 516         if (fw_has_capa(&mvm->fw->ucode_capa,
 517                         IWL_UCODE_TLV_CAPA_FTM_CALIBRATED)) {
 518                 wiphy_ext_feature_set(hw->wiphy,
 519                                       NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
 520                 hw->wiphy->pmsr_capa = &iwl_mvm_pmsr_capa;
 521         }
 522
 523         ieee80211_hw_set(hw, SINGLE_SCAN_ON_ALL_BANDS);
 524         hw->wiphy->features |=
 525                 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR |
 526                 NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR |
 527                 NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
 528
 529         hw->sta_data_size = sizeof(struct iwl_mvm_sta);
 530         hw->vif_data_size = sizeof(struct iwl_mvm_vif);
 531         hw->chanctx_data_size = sizeof(u16);
 532         hw->txq_data_size = sizeof(struct iwl_mvm_txq);
 533
 534         hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
 535                 BIT(NL80211_IFTYPE_P2P_CLIENT) |
 536                 BIT(NL80211_IFTYPE_AP) |
 537                 BIT(NL80211_IFTYPE_P2P_GO) |
 538                 BIT(NL80211_IFTYPE_P2P_DEVICE) |
 539                 BIT(NL80211_IFTYPE_ADHOC);
 540
 541         hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
 542         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
 543         hw->wiphy->features |= NL80211_FEATURE_HT_IBSS;
 544
 545         hw->wiphy->regulatory_flags |= REGULATORY_ENABLE_RELAX_NO_IR;
 546         if (iwl_mvm_is_lar_supported(mvm))
 547                 hw->wiphy->regulatory_flags |= REGULATORY_WIPHY_SELF_MANAGED;
 548         else
 549                 hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG |
 550                                                REGULATORY_DISABLE_BEACON_HINTS;
 551
 552         hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
 553         hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
 554
 555         hw->wiphy->iface_combinations = iwl_mvm_iface_combinations;
 556         hw->wiphy->n_iface_combinations =
 557                 ARRAY_SIZE(iwl_mvm_iface_combinations);
 558
 559         hw->wiphy->max_remain_on_channel_duration = 10000;
 560         hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
 561
 562         /* Extract MAC address */
 563         memcpy(mvm->addresses[0].addr, mvm->nvm_data->hw_addr, ETH_ALEN);
 564         hw->wiphy->addresses = mvm->addresses;
 565         hw->wiphy->n_addresses = 1;
 566
 567         /* Extract additional MAC addresses if available */
 568         num_mac = (mvm->nvm_data->n_hw_addrs > 1) ?
 569                 min(IWL_MVM_MAX_ADDRESSES, mvm->nvm_data->n_hw_addrs) : 1;
 570
 571         for (i = 1; i < num_mac; i++) {
 572                 memcpy(mvm->addresses[i].addr, mvm->addresses[i-1].addr,
 573                        ETH_ALEN);
 574                 mvm->addresses[i].addr[5]++;
 575                 hw->wiphy->n_addresses++;
 576         }
 577
 578         iwl_mvm_reset_phy_ctxts(mvm);
 579
 580         hw->wiphy->max_scan_ie_len = iwl_mvm_max_scan_ie_len(mvm);
 581
 582         hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
 583
 584         BUILD_BUG_ON(IWL_MVM_SCAN_STOPPING_MASK & IWL_MVM_SCAN_MASK);
 585         BUILD_BUG_ON(IWL_MVM_MAX_UMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK) ||
 586                      IWL_MVM_MAX_LMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK));
 587
 588         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
 589                 mvm->max_scans = IWL_MVM_MAX_UMAC_SCANS;
 590         else
 591                 mvm->max_scans = IWL_MVM_MAX_LMAC_SCANS;
 592
 593         if (mvm->nvm_data->bands[NL80211_BAND_2GHZ].n_channels)
 594                 hw->wiphy->bands[NL80211_BAND_2GHZ] =
 595                         &mvm->nvm_data->bands[NL80211_BAND_2GHZ];
 596         if (mvm->nvm_data->bands[NL80211_BAND_5GHZ].n_channels) {
 597                 hw->wiphy->bands[NL80211_BAND_5GHZ] =
 598                         &mvm->nvm_data->bands[NL80211_BAND_5GHZ];
 599
 600                 if (fw_has_capa(&mvm->fw->ucode_capa,
 601                                 IWL_UCODE_TLV_CAPA_BEAMFORMER) &&
 602                     fw_has_api(&mvm->fw->ucode_capa,
 603                                IWL_UCODE_TLV_API_LQ_SS_PARAMS))
 604                         hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.cap |=
 605                                 IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
 606         }
 607
 608         hw->wiphy->hw_version = mvm->trans->hw_id;
 609
 610         if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM)
 611                 hw->wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
 612         else
 613                 hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 614
 615         hw->wiphy->max_sched_scan_reqs = 1;
 616         hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
 617         hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
 618         /* we create the 802.11 header and zero length SSID IE. */
 619         hw->wiphy->max_sched_scan_ie_len =
 620                 SCAN_OFFLOAD_PROBE_REQ_SIZE - 24 - 2;
 621         hw->wiphy->max_sched_scan_plans = IWL_MAX_SCHED_SCAN_PLANS;
 622         hw->wiphy->max_sched_scan_plan_interval = U16_MAX;
 623
 624         /*
 625          * the firmware uses u8 for num of iterations, but 0xff is saved for
 626          * infinite loop, so the maximum number of iterations is actually 254.
 627          */
 628         hw->wiphy->max_sched_scan_plan_iterations = 254;
 629
 630         hw->wiphy->features |= NL80211_FEATURE_P2P_GO_CTWIN |
 631                                NL80211_FEATURE_LOW_PRIORITY_SCAN |
 632                                NL80211_FEATURE_P2P_GO_OPPPS |
 633                                NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
 634                                NL80211_FEATURE_DYNAMIC_SMPS |
 635                                NL80211_FEATURE_STATIC_SMPS |
 636                                NL80211_FEATURE_SUPPORTS_WMM_ADMISSION;
 637
 638         if (fw_has_capa(&mvm->fw->ucode_capa,
 639                         IWL_UCODE_TLV_CAPA_TXPOWER_INSERTION_SUPPORT))
 640                 hw->wiphy->features |= NL80211_FEATURE_TX_POWER_INSERTION;
 641         if (fw_has_capa(&mvm->fw->ucode_capa,
 642                         IWL_UCODE_TLV_CAPA_QUIET_PERIOD_SUPPORT))
 643                 hw->wiphy->features |= NL80211_FEATURE_QUIET;
 644
 645         if (fw_has_capa(&mvm->fw->ucode_capa,
 646                         IWL_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT))
 647                 hw->wiphy->features |=
 648                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES;
 649
 650         if (fw_has_capa(&mvm->fw->ucode_capa,
 651                         IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT))
 652                 hw->wiphy->features |= NL80211_FEATURE_WFA_TPC_IE_IN_PROBES;
 653
 654         if (fw_has_api(&mvm->fw->ucode_capa,
 655                        IWL_UCODE_TLV_API_SCAN_TSF_REPORT)) {
 656                 wiphy_ext_feature_set(hw->wiphy,
 657                                       NL80211_EXT_FEATURE_SCAN_START_TIME);
 658                 wiphy_ext_feature_set(hw->wiphy,
 659                                       NL80211_EXT_FEATURE_BSS_PARENT_TSF);
 660                 wiphy_ext_feature_set(hw->wiphy,
 661                                       NL80211_EXT_FEATURE_SET_SCAN_DWELL);
 662         }
 663
 664         if (iwl_mvm_is_oce_supported(mvm)) {
 665                 wiphy_ext_feature_set(hw->wiphy,
 666                         NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP);
 667                 wiphy_ext_feature_set(hw->wiphy,
 668                         NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME);
 669                 wiphy_ext_feature_set(hw->wiphy,
 670                         NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION);
 671                 wiphy_ext_feature_set(hw->wiphy,
 672                         NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE);
 673         }
 674
 675         if (mvm->nvm_data->sku_cap_11ax_enable &&
 676             !iwlwifi_mod_params.disable_11ax) {
 677                 hw->wiphy->iftype_ext_capab = he_iftypes_ext_capa;
 678                 hw->wiphy->num_iftype_ext_capab =
 679                         ARRAY_SIZE(he_iftypes_ext_capa);
 680
 681                 ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
 682                 ieee80211_hw_set(hw, SUPPORTS_ONLY_HE_MULTI_BSSID);
 683         }
 684
 685         mvm->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
 686
 687 #ifdef CONFIG_PM_SLEEP
 688         if ((unified || mvm->fw->img[IWL_UCODE_WOWLAN].num_sec) &&
 689             mvm->trans->ops->d3_suspend &&
 690             mvm->trans->ops->d3_resume &&
 691             device_can_wakeup(mvm->trans->dev)) {
 692                 mvm->wowlan.flags |= WIPHY_WOWLAN_MAGIC_PKT |
 693                                      WIPHY_WOWLAN_DISCONNECT |
 694                                      WIPHY_WOWLAN_EAP_IDENTITY_REQ |
 695                                      WIPHY_WOWLAN_RFKILL_RELEASE |
 696                                      WIPHY_WOWLAN_NET_DETECT;
 697                 if (!iwlwifi_mod_params.swcrypto)
 698                         mvm->wowlan.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY |
 699                                              WIPHY_WOWLAN_GTK_REKEY_FAILURE |
 700                                              WIPHY_WOWLAN_4WAY_HANDSHAKE;
 701
 702                 mvm->wowlan.n_patterns = IWL_WOWLAN_MAX_PATTERNS;
 703                 mvm->wowlan.pattern_min_len = IWL_WOWLAN_MIN_PATTERN_LEN;
 704                 mvm->wowlan.pattern_max_len = IWL_WOWLAN_MAX_PATTERN_LEN;
 705                 mvm->wowlan.max_nd_match_sets = IWL_SCAN_MAX_PROFILES;
 706                 hw->wiphy->wowlan = &mvm->wowlan;
 707         }
 708 #endif
 709
 710 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
 711         /* assign default bcast filtering configuration */
 712         mvm->bcast_filters = iwl_mvm_default_bcast_filters;
 713 #endif
 714
 715         ret = iwl_mvm_leds_init(mvm);
 716         if (ret)
 717                 return ret;
 718
 719         if (fw_has_capa(&mvm->fw->ucode_capa,
 720                         IWL_UCODE_TLV_CAPA_TDLS_SUPPORT)) {
 721                 IWL_DEBUG_TDLS(mvm, "TDLS supported\n");
 722                 hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
 723                 ieee80211_hw_set(hw, TDLS_WIDER_BW);
 724         }
 725
 726         if (fw_has_capa(&mvm->fw->ucode_capa,
 727                         IWL_UCODE_TLV_CAPA_TDLS_CHANNEL_SWITCH)) {
 728                 IWL_DEBUG_TDLS(mvm, "TDLS channel switch supported\n");
 729                 hw->wiphy->features |= NL80211_FEATURE_TDLS_CHANNEL_SWITCH;
 730         }
 731
 732         hw->netdev_features |= mvm->cfg->features;
 733         if (!iwl_mvm_is_csum_supported(mvm)) {
 734                 hw->netdev_features &= ~(IWL_TX_CSUM_NETIF_FLAGS |
 735                                          NETIF_F_RXCSUM);
 736                 /* We may support SW TX CSUM */
 737                 if (IWL_MVM_SW_TX_CSUM_OFFLOAD)
 738                         hw->netdev_features |= IWL_TX_CSUM_NETIF_FLAGS;
 739         }
 740
 741         if (mvm->cfg->vht_mu_mimo_supported)
 742                 wiphy_ext_feature_set(hw->wiphy,
 743                                       NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER);
 744
 745         hw->wiphy->available_antennas_tx = iwl_mvm_get_valid_tx_ant(mvm);
 746         hw->wiphy->available_antennas_rx = iwl_mvm_get_valid_rx_ant(mvm);
 747
 748         ret = ieee80211_register_hw(mvm->hw);
 749         if (ret) {
 750                 iwl_mvm_leds_exit(mvm);
 751         }
 752
 753         return ret;
 754 }
 755
 756 static void iwl_mvm_tx_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
 757                            struct ieee80211_sta *sta)
 758 {
 759         if (likely(sta)) {
 760                 if (likely(iwl_mvm_tx_skb_sta(mvm, skb, sta) == 0))
 761                         return;
 762         } else {
 763                 if (likely(iwl_mvm_tx_skb_non_sta(mvm, skb) == 0))
 764                         return;
 765         }
 766
 767         ieee80211_free_txskb(mvm->hw, skb);
 768 }
 769
 770 static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
 771                            struct ieee80211_tx_control *control,
 772                            struct sk_buff *skb)
 773 {
 774         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 775         struct ieee80211_sta *sta = control->sta;
 776         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 777         struct ieee80211_hdr *hdr = (void *)skb->data;
 778         bool offchannel = IEEE80211_SKB_CB(skb)->flags &
 779                 IEEE80211_TX_CTL_TX_OFFCHAN;
 780
 781         if (iwl_mvm_is_radio_killed(mvm)) {
 782                 IWL_DEBUG_DROP(mvm, "Dropping - RF/CT KILL\n");
 783                 goto drop;
 784         }
 785
 786         if (offchannel &&
 787             !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status) &&
 788             !test_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status))
 789                 goto drop;
 790
 791         /* treat non-bufferable MMPDUs on AP interfaces as broadcast */
 792         if ((info->control.vif->type == NL80211_IFTYPE_AP ||
 793              info->control.vif->type == NL80211_IFTYPE_ADHOC) &&
 794             ieee80211_is_mgmt(hdr->frame_control) &&
 795             !ieee80211_is_bufferable_mmpdu(hdr->frame_control))
 796                 sta = NULL;
 797
 798         /* If there is no sta, and it's not offchannel - send through AP */
 799         if (!sta && info->control.vif->type == NL80211_IFTYPE_STATION &&
 800             !offchannel) {
 801                 struct iwl_mvm_vif *mvmvif =
 802                         iwl_mvm_vif_from_mac80211(info->control.vif);
 803                 u8 ap_sta_id = READ_ONCE(mvmvif->ap_sta_id);
 804
 805                 if (ap_sta_id < IWL_MVM_STATION_COUNT) {
 806                         /* mac80211 holds rcu read lock */
 807                         sta = rcu_dereference(mvm->fw_id_to_mac_id[ap_sta_id]);
 808                         if (IS_ERR_OR_NULL(sta))
 809                                 goto drop;
 810                 }
 811         }
 812
 813         iwl_mvm_tx_skb(mvm, skb, sta);
 814         return;
 815  drop:
 816         ieee80211_free_txskb(hw, skb);
 817 }
 818
 819 void iwl_mvm_mac_itxq_xmit(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
 820 {
 821         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 822         struct iwl_mvm_txq *mvmtxq = iwl_mvm_txq_from_mac80211(txq);
 823         struct sk_buff *skb = NULL;
 824
 825         /*
 826          * No need for threads to be pending here, they can leave the first
 827          * taker all the work.
 828          *
 829          * mvmtxq->tx_request logic:
 830          *
 831          * If 0, no one is currently TXing, set to 1 to indicate current thread
 832          * will now start TX and other threads should quit.
 833          *
 834          * If 1, another thread is currently TXing, set to 2 to indicate to
 835          * that thread that there was another request. Since that request may
 836          * have raced with the check whether the queue is empty, the TXing
 837          * thread should check the queue's status one more time before leaving.
 838          * This check is done in order to not leave any TX hanging in the queue
 839          * until the next TX invocation (which may not even happen).
 840          *
 841          * If 2, another thread is currently TXing, and it will already double
 842          * check the queue, so do nothing.
 843          */
 844         if (atomic_fetch_add_unless(&mvmtxq->tx_request, 1, 2))
 845                 return;
 846
 847         rcu_read_lock();
 848         do {
 849                 while (likely(!mvmtxq->stopped &&
 850                               (mvm->trans->system_pm_mode ==
 851                                IWL_PLAT_PM_MODE_DISABLED))) {
 852                         skb = ieee80211_tx_dequeue(hw, txq);
 853
 854                         if (!skb) {
 855                                 if (txq->sta)
 856                                         IWL_DEBUG_TX(mvm,
 857                                                      "TXQ of sta %pM tid %d is now empty\n",
 858                                                      txq->sta->addr,
 859                                                      txq->tid);
 860                                 break;
 861                         }
 862
 863                         iwl_mvm_tx_skb(mvm, skb, txq->sta);
 864                 }
 865         } while (atomic_dec_return(&mvmtxq->tx_request));
 866         rcu_read_unlock();
 867 }
 868
 869 static void iwl_mvm_mac_wake_tx_queue(struct ieee80211_hw *hw,
 870                                       struct ieee80211_txq *txq)
 871 {
 872         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 873         struct iwl_mvm_txq *mvmtxq = iwl_mvm_txq_from_mac80211(txq);
 874
 875         /*
 876          * Please note that racing is handled very carefully here:
 877          * mvmtxq->txq_id is updated during allocation, and mvmtxq->list is
 878          * deleted afterwards.
 879          * This means that if:
 880          * mvmtxq->txq_id != INVALID_QUEUE && list_empty(&mvmtxq->list):
 881          *      queue is allocated and we can TX.
 882          * mvmtxq->txq_id != INVALID_QUEUE && !list_empty(&mvmtxq->list):
 883          *      a race, should defer the frame.
 884          * mvmtxq->txq_id == INVALID_QUEUE && list_empty(&mvmtxq->list):
 885          *      need to allocate the queue and defer the frame.
 886          * mvmtxq->txq_id == INVALID_QUEUE && !list_empty(&mvmtxq->list):
 887          *      queue is already scheduled for allocation, no need to allocate,
 888          *      should defer the frame.
 889          */
 890
 891         /* If the queue is allocated TX and return. */
 892         if (!txq->sta || mvmtxq->txq_id != IWL_MVM_INVALID_QUEUE) {
 893                 /*
 894                  * Check that list is empty to avoid a race where txq_id is
 895                  * already updated, but the queue allocation work wasn't
 896                  * finished
 897                  */
 898                 if (unlikely(txq->sta && !list_empty(&mvmtxq->list)))
 899                         return;
 900
 901                 iwl_mvm_mac_itxq_xmit(hw, txq);
 902                 return;
 903         }
 904
 905         /* The list is being deleted only after the queue is fully allocated. */
 906         if (!list_empty(&mvmtxq->list))
 907                 return;
 908
 909         list_add_tail(&mvmtxq->list, &mvm->add_stream_txqs);
 910         schedule_work(&mvm->add_stream_wk);
 911 }
 912
 913 #define CHECK_BA_TRIGGER(_mvm, _trig, _tid_bm, _tid, _fmt...)           \
 914         do {                                                            \
 915                 if (!(le16_to_cpu(_tid_bm) & BIT(_tid)))                \
 916                         break;                                          \
 917                 iwl_fw_dbg_collect_trig(&(_mvm)->fwrt, _trig, _fmt);    \
 918         } while (0)
 919
 920 static void
 921 iwl_mvm_ampdu_check_trigger(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 922                             struct ieee80211_sta *sta, u16 tid, u16 rx_ba_ssn,
 923                             enum ieee80211_ampdu_mlme_action action)
 924 {
 925         struct iwl_fw_dbg_trigger_tlv *trig;
 926         struct iwl_fw_dbg_trigger_ba *ba_trig;
 927
 928         trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
 929                                      FW_DBG_TRIGGER_BA);
 930         if (!trig)
 931                 return;
 932
 933         ba_trig = (void *)trig->data;
 934
 935         switch (action) {
 936         case IEEE80211_AMPDU_TX_OPERATIONAL: {
 937                 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 938                 struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
 939
 940                 CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_start, tid,
 941                                  "TX AGG START: MAC %pM tid %d ssn %d\n",
 942                                  sta->addr, tid, tid_data->ssn);
 943                 break;
 944                 }
 945         case IEEE80211_AMPDU_TX_STOP_CONT:
 946                 CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_stop, tid,
 947                                  "TX AGG STOP: MAC %pM tid %d\n",
 948                                  sta->addr, tid);
 949                 break;
 950         case IEEE80211_AMPDU_RX_START:
 951                 CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_start, tid,
 952                                  "RX AGG START: MAC %pM tid %d ssn %d\n",
 953                                  sta->addr, tid, rx_ba_ssn);
 954                 break;
 955         case IEEE80211_AMPDU_RX_STOP:
 956                 CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_stop, tid,
 957                                  "RX AGG STOP: MAC %pM tid %d\n",
 958                                  sta->addr, tid);
 959                 break;
 960         default:
 961                 break;
 962         }
 963 }
 964
 965 static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
 966                                     struct ieee80211_vif *vif,
 967                                     struct ieee80211_ampdu_params *params)
 968 {
 969         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 970         int ret;
 971         struct ieee80211_sta *sta = params->sta;
 972         enum ieee80211_ampdu_mlme_action action = params->action;
 973         u16 tid = params->tid;
 974         u16 *ssn = &params->ssn;
 975         u16 buf_size = params->buf_size;
 976         bool amsdu = params->amsdu;
 977         u16 timeout = params->timeout;
 978
 979         IWL_DEBUG_HT(mvm, "A-MPDU action on addr %pM tid %d: action %d\n",
 980                      sta->addr, tid, action);
 981
 982         if (!(mvm->nvm_data->sku_cap_11n_enable))
 983                 return -EACCES;
 984
 985         mutex_lock(&mvm->mutex);
 986
 987         switch (action) {
 988         case IEEE80211_AMPDU_RX_START:
 989                 if (iwl_mvm_vif_from_mac80211(vif)->ap_sta_id ==
 990                                 iwl_mvm_sta_from_mac80211(sta)->sta_id) {
 991                         struct iwl_mvm_vif *mvmvif;
 992                         u16 macid = iwl_mvm_vif_from_mac80211(vif)->id;
 993                         struct iwl_mvm_tcm_mac *mdata = &mvm->tcm.data[macid];
 994
 995                         mdata->opened_rx_ba_sessions = true;
 996                         mvmvif = iwl_mvm_vif_from_mac80211(vif);
 997                         cancel_delayed_work(&mvmvif->uapsd_nonagg_detected_wk);
 998                 }
 999                 if (!iwl_enable_rx_ampdu()) {
1000                         ret = -EINVAL;
1001                         break;
1002                 }
1003                 ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, *ssn, true, buf_size,
1004                                          timeout);
1005                 break;
1006         case IEEE80211_AMPDU_RX_STOP:
1007                 ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, 0, false, buf_size,
1008                                          timeout);
1009                 break;
1010         case IEEE80211_AMPDU_TX_START:
1011                 if (!iwl_enable_tx_ampdu()) {
1012                         ret = -EINVAL;
1013                         break;
1014                 }
1015                 ret = iwl_mvm_sta_tx_agg_start(mvm, vif, sta, tid, ssn);
1016                 break;
1017         case IEEE80211_AMPDU_TX_STOP_CONT:
1018                 ret = iwl_mvm_sta_tx_agg_stop(mvm, vif, sta, tid);
1019                 break;
1020         case IEEE80211_AMPDU_TX_STOP_FLUSH:
1021         case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
1022                 ret = iwl_mvm_sta_tx_agg_flush(mvm, vif, sta, tid);
1023                 break;
1024         case IEEE80211_AMPDU_TX_OPERATIONAL:
1025                 ret = iwl_mvm_sta_tx_agg_oper(mvm, vif, sta, tid,
1026                                               buf_size, amsdu);
1027                 break;
1028         default:
1029                 WARN_ON_ONCE(1);
1030                 ret = -EINVAL;
1031                 break;
1032         }
1033
1034         if (!ret) {
1035                 u16 rx_ba_ssn = 0;
1036
1037                 if (action == IEEE80211_AMPDU_RX_START)
1038                         rx_ba_ssn = *ssn;
1039
1040                 iwl_mvm_ampdu_check_trigger(mvm, vif, sta, tid,
1041                                             rx_ba_ssn, action);
1042         }
1043         mutex_unlock(&mvm->mutex);
1044
1045         return ret;
1046 }
1047
1048 static void iwl_mvm_cleanup_iterator(void *data, u8 *mac,
1049                                      struct ieee80211_vif *vif)
1050 {
1051         struct iwl_mvm *mvm = data;
1052         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1053
1054         mvmvif->uploaded = false;
1055         mvmvif->ap_sta_id = IWL_MVM_INVALID_STA;
1056
1057         spin_lock_bh(&mvm->time_event_lock);
1058         iwl_mvm_te_clear_data(mvm, &mvmvif->time_event_data);
1059         spin_unlock_bh(&mvm->time_event_lock);
1060
1061         mvmvif->phy_ctxt = NULL;
1062         memset(&mvmvif->bf_data, 0, sizeof(mvmvif->bf_data));
1063         memset(&mvmvif->probe_resp_data, 0, sizeof(mvmvif->probe_resp_data));
1064 }
1065
1066 static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
1067 {
1068         iwl_mvm_stop_device(mvm);
1069
1070         mvm->cur_aid = 0;
1071
1072         mvm->scan_status = 0;
1073         mvm->ps_disabled = false;
1074         mvm->rfkill_safe_init_done = false;
1075
1076         /* just in case one was running */
1077         iwl_mvm_cleanup_roc_te(mvm);
1078         ieee80211_remain_on_channel_expired(mvm->hw);
1079
1080         iwl_mvm_ftm_restart(mvm);
1081
1082         /*
1083          * cleanup all interfaces, even inactive ones, as some might have
1084          * gone down during the HW restart
1085          */
1086         ieee80211_iterate_interfaces(mvm->hw, 0, iwl_mvm_cleanup_iterator, mvm);
1087
1088         mvm->p2p_device_vif = NULL;
1089
1090         iwl_mvm_reset_phy_ctxts(mvm);
1091         memset(mvm->fw_key_table, 0, sizeof(mvm->fw_key_table));
1092         memset(&mvm->last_bt_notif, 0, sizeof(mvm->last_bt_notif));
1093         memset(&mvm->last_bt_ci_cmd, 0, sizeof(mvm->last_bt_ci_cmd));
1094
1095         ieee80211_wake_queues(mvm->hw);
1096
1097         mvm->vif_count = 0;
1098         mvm->rx_ba_sessions = 0;
1099         mvm->fwrt.dump.conf = FW_DBG_INVALID;
1100         mvm->monitor_on = false;
1101
1102         /* keep statistics ticking */
1103         iwl_mvm_accu_radio_stats(mvm);
1104 }
1105
1106 int __iwl_mvm_mac_start(struct iwl_mvm *mvm)
1107 {
1108         int ret;
1109
1110         lockdep_assert_held(&mvm->mutex);
1111
1112         if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status)) {
1113                 /*
1114                  * Now convert the HW_RESTART_REQUESTED flag to IN_HW_RESTART
1115                  * so later code will - from now on - see that we're doing it.
1116                  */
1117                 set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1118                 clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status);
1119                 /* Clean up some internal and mac80211 state on restart */
1120                 iwl_mvm_restart_cleanup(mvm);
1121         }
1122         ret = iwl_mvm_up(mvm);
1123
1124         iwl_dbg_tlv_time_point(&mvm->fwrt, IWL_FW_INI_TIME_POINT_POST_INIT,
1125                                NULL);
1126         iwl_dbg_tlv_time_point(&mvm->fwrt, IWL_FW_INI_TIME_POINT_PERIODIC,
1127                                NULL);
1128
1129         if (ret && test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
1130                 /* Something went wrong - we need to finish some cleanup
1131                  * that normally iwl_mvm_mac_restart_complete() below
1132                  * would do.
1133                  */
1134                 clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1135         }
1136
1137         return ret;
1138 }
1139
1140 static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
1141 {
1142         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1143         int ret;
1144
1145         mutex_lock(&mvm->mutex);
1146         ret = __iwl_mvm_mac_start(mvm);
1147         mutex_unlock(&mvm->mutex);
1148
1149         return ret;
1150 }
1151
1152 static void iwl_mvm_restart_complete(struct iwl_mvm *mvm)
1153 {
1154         int ret;
1155
1156         mutex_lock(&mvm->mutex);
1157
1158         clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1159
1160         ret = iwl_mvm_update_quotas(mvm, true, NULL);
1161         if (ret)
1162                 IWL_ERR(mvm, "Failed to update quotas after restart (%d)\n",
1163                         ret);
1164
1165         iwl_mvm_send_recovery_cmd(mvm, ERROR_RECOVERY_END_OF_RECOVERY);
1166
1167         /*
1168          * If we have TDLS peers, remove them. We don't know the last seqno/PN
1169          * of packets the FW sent out, so we must reconnect.
1170          */
1171         iwl_mvm_teardown_tdls_peers(mvm);
1172
1173         mutex_unlock(&mvm->mutex);
1174 }
1175
1176 static void
1177 iwl_mvm_mac_reconfig_complete(struct ieee80211_hw *hw,
1178                               enum ieee80211_reconfig_type reconfig_type)
1179 {
1180         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1181
1182         switch (reconfig_type) {
1183         case IEEE80211_RECONFIG_TYPE_RESTART:
1184                 iwl_mvm_restart_complete(mvm);
1185                 break;
1186         case IEEE80211_RECONFIG_TYPE_SUSPEND:
1187                 break;
1188         }
1189 }
1190
1191 void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
1192 {
1193         lockdep_assert_held(&mvm->mutex);
1194
1195         /* firmware counters are obviously reset now, but we shouldn't
1196          * partially track so also clear the fw_reset_accu counters.
1197          */
1198         memset(&mvm->accu_radio_stats, 0, sizeof(mvm->accu_radio_stats));
1199
1200         /* async_handlers_wk is now blocked */
1201
1202         /*
1203          * The work item could be running or queued if the
1204          * ROC time event stops just as we get here.
1205          */
1206         flush_work(&mvm->roc_done_wk);
1207
1208         iwl_mvm_stop_device(mvm);
1209
1210         iwl_mvm_async_handlers_purge(mvm);
1211         /* async_handlers_list is empty and will stay empty: HW is stopped */
1212
1213         /* the fw is stopped, the aux sta is dead: clean up driver state */
1214         iwl_mvm_del_aux_sta(mvm);
1215
1216         /*
1217          * Clear IN_HW_RESTART and HW_RESTART_REQUESTED flag when stopping the
1218          * hw (as restart_complete() won't be called in this case) and mac80211
1219          * won't execute the restart.
1220          * But make sure to cleanup interfaces that have gone down before/during
1221          * HW restart was requested.
1222          */
1223         if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) ||
1224             test_and_clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
1225                                &mvm->status))
1226                 ieee80211_iterate_interfaces(mvm->hw, 0,
1227                                              iwl_mvm_cleanup_iterator, mvm);
1228
1229         /* We shouldn't have any UIDs still set.  Loop over all the UIDs to
1230          * make sure there's nothing left there and warn if any is found.
1231          */
1232         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1233                 int i;
1234
1235                 for (i = 0; i < mvm->max_scans; i++) {
1236                         if (WARN_ONCE(mvm->scan_uid_status[i],
1237                                       "UMAC scan UID %d status was not cleaned\n",
1238                                       i))
1239                                 mvm->scan_uid_status[i] = 0;
1240                 }
1241         }
1242 }
1243
1244 static void iwl_mvm_mac_stop(struct ieee80211_hw *hw)
1245 {
1246         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1247
1248         flush_work(&mvm->async_handlers_wk);
1249         flush_work(&mvm->add_stream_wk);
1250
1251         /*
1252          * Lock and clear the firmware running bit here already, so that
1253          * new commands coming in elsewhere, e.g. from debugfs, will not
1254          * be able to proceed. This is important here because one of those
1255          * debugfs files causes the firmware dump to be triggered, and if we
1256          * don't stop debugfs accesses before canceling that it could be
1257          * retriggered after we flush it but before we've cleared the bit.
1258          */
1259         clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status);
1260
1261         cancel_delayed_work_sync(&mvm->cs_tx_unblock_dwork);
1262         cancel_delayed_work_sync(&mvm->scan_timeout_dwork);
1263         iwl_fw_free_dump_desc(&mvm->fwrt);
1264
1265         mutex_lock(&mvm->mutex);
1266         __iwl_mvm_mac_stop(mvm);
1267         mutex_unlock(&mvm->mutex);
1268
1269         /*
1270          * The worker might have been waiting for the mutex, let it run and
1271          * discover that its list is now empty.
1272          */
1273         cancel_work_sync(&mvm->async_handlers_wk);
1274 }
1275
1276 static struct iwl_mvm_phy_ctxt *iwl_mvm_get_free_phy_ctxt(struct iwl_mvm *mvm)
1277 {
1278         u16 i;
1279
1280         lockdep_assert_held(&mvm->mutex);
1281
1282         for (i = 0; i < NUM_PHY_CTX; i++)
1283                 if (!mvm->phy_ctxts[i].ref)
1284                         return &mvm->phy_ctxts[i];
1285
1286         IWL_ERR(mvm, "No available PHY context\n");
1287         return NULL;
1288 }
1289
1290 static int iwl_mvm_set_tx_power(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1291                                 s16 tx_power)
1292 {
1293         int len;
1294         union {
1295                 struct iwl_dev_tx_power_cmd v5;
1296                 struct iwl_dev_tx_power_cmd_v4 v4;
1297         } cmd = {
1298                 .v5.v3.set_mode = cpu_to_le32(IWL_TX_POWER_MODE_SET_MAC),
1299                 .v5.v3.mac_context_id =
1300                         cpu_to_le32(iwl_mvm_vif_from_mac80211(vif)->id),
1301                 .v5.v3.pwr_restriction = cpu_to_le16(8 * tx_power),
1302         };
1303
1304         if (tx_power == IWL_DEFAULT_MAX_TX_POWER)
1305                 cmd.v5.v3.pwr_restriction = cpu_to_le16(IWL_DEV_MAX_TX_POWER);
1306
1307         if (fw_has_api(&mvm->fw->ucode_capa,
1308                        IWL_UCODE_TLV_API_REDUCE_TX_POWER))
1309                 len = sizeof(cmd.v5);
1310         else if (fw_has_capa(&mvm->fw->ucode_capa,
1311                              IWL_UCODE_TLV_CAPA_TX_POWER_ACK))
1312                 len = sizeof(cmd.v4);
1313         else
1314                 len = sizeof(cmd.v4.v3);
1315
1316         return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, 0, len, &cmd);
1317 }
1318
1319 static int iwl_mvm_post_channel_switch(struct ieee80211_hw *hw,
1320                                        struct ieee80211_vif *vif)
1321 {
1322         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1323         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1324         int ret;
1325
1326         mutex_lock(&mvm->mutex);
1327
1328         if (mvmvif->csa_failed) {
1329                 mvmvif->csa_failed = false;
1330                 ret = -EIO;
1331                 goto out_unlock;
1332         }
1333
1334         if (vif->type == NL80211_IFTYPE_STATION) {
1335                 struct iwl_mvm_sta *mvmsta;
1336
1337                 mvmvif->csa_bcn_pending = false;
1338                 mvmsta = iwl_mvm_sta_from_staid_protected(mvm,
1339                                                           mvmvif->ap_sta_id);
1340
1341                 if (WARN_ON(!mvmsta)) {
1342                         ret = -EIO;
1343                         goto out_unlock;
1344                 }
1345
1346                 if (!fw_has_capa(&mvm->fw->ucode_capa,
1347                                  IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD))
1348                         iwl_mvm_sta_modify_disable_tx(mvm, mvmsta, false);
1349
1350                 iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
1351
1352                 if (!fw_has_capa(&mvm->fw->ucode_capa,
1353                                  IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
1354                         ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
1355                         if (ret)
1356                                 goto out_unlock;
1357
1358                         iwl_mvm_stop_session_protection(mvm, vif);
1359                 }
1360         }
1361
1362         mvmvif->ps_disabled = false;
1363
1364         ret = iwl_mvm_power_update_ps(mvm);
1365
1366 out_unlock:
1367         mutex_unlock(&mvm->mutex);
1368
1369         return ret;
1370 }
1371
1372 static void iwl_mvm_abort_channel_switch(struct ieee80211_hw *hw,
1373                                          struct ieee80211_vif *vif)
1374 {
1375         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1376         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1377         struct iwl_chan_switch_te_cmd cmd = {
1378                 .mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
1379                                                           mvmvif->color)),
1380                 .action = cpu_to_le32(FW_CTXT_ACTION_REMOVE),
1381         };
1382
1383         IWL_DEBUG_MAC80211(mvm, "Abort CSA on mac %d\n", mvmvif->id);
1384
1385         mutex_lock(&mvm->mutex);
1386         WARN_ON(iwl_mvm_send_cmd_pdu(mvm,
1387                                      WIDE_ID(MAC_CONF_GROUP,
1388                                              CHANNEL_SWITCH_TIME_EVENT_CMD),
1389                                      0, sizeof(cmd), &cmd));
1390         mutex_unlock(&mvm->mutex);
1391
1392         WARN_ON(iwl_mvm_post_channel_switch(hw, vif));
1393 }
1394
1395 static void iwl_mvm_channel_switch_disconnect_wk(struct work_struct *wk)
1396 {
1397         struct iwl_mvm *mvm;
1398         struct iwl_mvm_vif *mvmvif;
1399         struct ieee80211_vif *vif;
1400
1401         mvmvif = container_of(wk, struct iwl_mvm_vif, csa_work.work);
1402         vif = container_of((void *)mvmvif, struct ieee80211_vif, drv_priv);
1403         mvm = mvmvif->mvm;
1404
1405         iwl_mvm_abort_channel_switch(mvm->hw, vif);
1406         ieee80211_chswitch_done(vif, false);
1407 }
1408
1409 static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
1410                                      struct ieee80211_vif *vif)
1411 {
1412         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1413         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1414         int ret;
1415
1416         mvmvif->mvm = mvm;
1417         RCU_INIT_POINTER(mvmvif->probe_resp_data, NULL);
1418
1419         /*
1420          * Not much to do here. The stack will not allow interface
1421          * types or combinations that we didn't advertise, so we
1422          * don't really have to check the types.
1423          */
1424
1425         mutex_lock(&mvm->mutex);
1426
1427         /* make sure that beacon statistics don't go backwards with FW reset */
1428         if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
1429                 mvmvif->beacon_stats.accu_num_beacons +=
1430                         mvmvif->beacon_stats.num_beacons;
1431
1432         /* Allocate resources for the MAC context, and add it to the fw  */
1433         ret = iwl_mvm_mac_ctxt_init(mvm, vif);
1434         if (ret)
1435                 goto out_unlock;
1436
1437         rcu_assign_pointer(mvm->vif_id_to_mac[mvmvif->id], vif);
1438
1439         /* Counting number of interfaces is needed for legacy PM */
1440         if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1441                 mvm->vif_count++;
1442
1443         /*
1444          * The AP binding flow can be done only after the beacon
1445          * template is configured (which happens only in the mac80211
1446          * start_ap() flow), and adding the broadcast station can happen
1447          * only after the binding.
1448          * In addition, since modifying the MAC before adding a bcast
1449          * station is not allowed by the FW, delay the adding of MAC context to
1450          * the point where we can also add the bcast station.
1451          * In short: there's not much we can do at this point, other than
1452          * allocating resources :)
1453          */
1454         if (vif->type == NL80211_IFTYPE_AP ||
1455             vif->type == NL80211_IFTYPE_ADHOC) {
1456                 ret = iwl_mvm_alloc_bcast_sta(mvm, vif);
1457                 if (ret) {
1458                         IWL_ERR(mvm, "Failed to allocate bcast sta\n");
1459                         goto out_release;
1460                 }
1461
1462                 /*
1463                  * Only queue for this station is the mcast queue,
1464                  * which shouldn't be in TFD mask anyway
1465                  */
1466                 ret = iwl_mvm_allocate_int_sta(mvm, &mvmvif->mcast_sta,
1467                                                0, vif->type,
1468                                                IWL_STA_MULTICAST);
1469                 if (ret)
1470                         goto out_release;
1471
1472                 iwl_mvm_vif_dbgfs_register(mvm, vif);
1473                 goto out_unlock;
1474         }
1475
1476         mvmvif->features |= hw->netdev_features;
1477
1478         ret = iwl_mvm_mac_ctxt_add(mvm, vif);
1479         if (ret)
1480                 goto out_release;
1481
1482         ret = iwl_mvm_power_update_mac(mvm);
1483         if (ret)
1484                 goto out_remove_mac;
1485
1486         /* beacon filtering */
1487         ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
1488         if (ret)
1489                 goto out_remove_mac;
1490
1491         if (!mvm->bf_allowed_vif &&
1492             vif->type == NL80211_IFTYPE_STATION && !vif->p2p) {
1493                 mvm->bf_allowed_vif = mvmvif;
1494                 vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
1495                                      IEEE80211_VIF_SUPPORTS_CQM_RSSI;
1496         }
1497
1498         /*
1499          * P2P_DEVICE interface does not have a channel context assigned to it,
1500          * so a dedicated PHY context is allocated to it and the corresponding
1501          * MAC context is bound to it at this stage.
1502          */
1503         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1504
1505                 mvmvif->phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
1506                 if (!mvmvif->phy_ctxt) {
1507                         ret = -ENOSPC;
1508                         goto out_free_bf;
1509                 }
1510
1511                 iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
1512                 ret = iwl_mvm_binding_add_vif(mvm, vif);
1513                 if (ret)
1514                         goto out_unref_phy;
1515
1516                 ret = iwl_mvm_add_p2p_bcast_sta(mvm, vif);
1517                 if (ret)
1518                         goto out_unbind;
1519
1520                 /* Save a pointer to p2p device vif, so it can later be used to
1521                  * update the p2p device MAC when a GO is started/stopped */
1522                 mvm->p2p_device_vif = vif;
1523         }
1524
1525         iwl_mvm_tcm_add_vif(mvm, vif);
1526         INIT_DELAYED_WORK(&mvmvif->csa_work,
1527                           iwl_mvm_channel_switch_disconnect_wk);
1528
1529         if (vif->type == NL80211_IFTYPE_MONITOR)
1530                 mvm->monitor_on = true;
1531
1532         iwl_mvm_vif_dbgfs_register(mvm, vif);
1533         goto out_unlock;
1534
1535  out_unbind:
1536         iwl_mvm_binding_remove_vif(mvm, vif);
1537  out_unref_phy:
1538         iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1539  out_free_bf:
1540         if (mvm->bf_allowed_vif == mvmvif) {
1541                 mvm->bf_allowed_vif = NULL;
1542                 vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1543                                        IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1544         }
1545  out_remove_mac:
1546         mvmvif->phy_ctxt = NULL;
1547         iwl_mvm_mac_ctxt_remove(mvm, vif);
1548  out_release:
1549         if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1550                 mvm->vif_count--;
1551  out_unlock:
1552         mutex_unlock(&mvm->mutex);
1553
1554         return ret;
1555 }
1556
1557 static void iwl_mvm_prepare_mac_removal(struct iwl_mvm *mvm,
1558                                         struct ieee80211_vif *vif)
1559 {
1560         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1561                 /*
1562                  * Flush the ROC worker which will flush the OFFCHANNEL queue.
1563                  * We assume here that all the packets sent to the OFFCHANNEL
1564                  * queue are sent in ROC session.
1565                  */
1566                 flush_work(&mvm->roc_done_wk);
1567         }
1568 }
1569
1570 static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
1571                                          struct ieee80211_vif *vif)
1572 {
1573         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1574         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1575         struct iwl_probe_resp_data *probe_data;
1576
1577         iwl_mvm_prepare_mac_removal(mvm, vif);
1578
1579         if (!(vif->type == NL80211_IFTYPE_AP ||
1580               vif->type == NL80211_IFTYPE_ADHOC))
1581                 iwl_mvm_tcm_rm_vif(mvm, vif);
1582
1583         mutex_lock(&mvm->mutex);
1584
1585         probe_data = rcu_dereference_protected(mvmvif->probe_resp_data,
1586                                                lockdep_is_held(&mvm->mutex));
1587         RCU_INIT_POINTER(mvmvif->probe_resp_data, NULL);
1588         if (probe_data)
1589                 kfree_rcu(probe_data, rcu_head);
1590
1591         if (mvm->bf_allowed_vif == mvmvif) {
1592                 mvm->bf_allowed_vif = NULL;
1593                 vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1594                                        IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1595         }
1596
1597         if (vif->bss_conf.ftm_responder)
1598                 memset(&mvm->ftm_resp_stats, 0, sizeof(mvm->ftm_resp_stats));
1599
1600         iwl_mvm_vif_dbgfs_clean(mvm, vif);
1601
1602         /*
1603          * For AP/GO interface, the tear down of the resources allocated to the
1604          * interface is be handled as part of the stop_ap flow.
1605          */
1606         if (vif->type == NL80211_IFTYPE_AP ||
1607             vif->type == NL80211_IFTYPE_ADHOC) {
1608 #ifdef CONFIG_NL80211_TESTMODE
1609                 if (vif == mvm->noa_vif) {
1610                         mvm->noa_vif = NULL;
1611                         mvm->noa_duration = 0;
1612                 }
1613 #endif
1614                 iwl_mvm_dealloc_int_sta(mvm, &mvmvif->mcast_sta);
1615                 iwl_mvm_dealloc_bcast_sta(mvm, vif);
1616                 goto out_release;
1617         }
1618
1619         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1620                 mvm->p2p_device_vif = NULL;
1621                 iwl_mvm_rm_p2p_bcast_sta(mvm, vif);
1622                 iwl_mvm_binding_remove_vif(mvm, vif);
1623                 iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1624                 mvmvif->phy_ctxt = NULL;
1625         }
1626
1627         if (mvm->vif_count && vif->type != NL80211_IFTYPE_P2P_DEVICE)
1628                 mvm->vif_count--;
1629
1630         iwl_mvm_power_update_mac(mvm);
1631         iwl_mvm_mac_ctxt_remove(mvm, vif);
1632
1633         RCU_INIT_POINTER(mvm->vif_id_to_mac[mvmvif->id], NULL);
1634
1635         if (vif->type == NL80211_IFTYPE_MONITOR)
1636                 mvm->monitor_on = false;
1637
1638 out_release:
1639         mutex_unlock(&mvm->mutex);
1640 }
1641
1642 static int iwl_mvm_mac_config(struct ieee80211_hw *hw, u32 changed)
1643 {
1644         return 0;
1645 }
1646
1647 struct iwl_mvm_mc_iter_data {
1648         struct iwl_mvm *mvm;
1649         int port_id;
1650 };
1651
1652 static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
1653                                       struct ieee80211_vif *vif)
1654 {
1655         struct iwl_mvm_mc_iter_data *data = _data;
1656         struct iwl_mvm *mvm = data->mvm;
1657         struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd;
1658         struct iwl_host_cmd hcmd = {
1659                 .id = MCAST_FILTER_CMD,
1660                 .flags = CMD_ASYNC,
1661                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
1662         };
1663         int ret, len;
1664
1665         /* if we don't have free ports, mcast frames will be dropped */
1666         if (WARN_ON_ONCE(data->port_id >= MAX_PORT_ID_NUM))
1667                 return;
1668
1669         if (vif->type != NL80211_IFTYPE_STATION ||
1670             !vif->bss_conf.assoc)
1671                 return;
1672
1673         cmd->port_id = data->port_id++;
1674         memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
1675         len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4);
1676
1677         hcmd.len[0] = len;
1678         hcmd.data[0] = cmd;
1679
1680         ret = iwl_mvm_send_cmd(mvm, &hcmd);
1681         if (ret)
1682                 IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret);
1683 }
1684
1685 static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm)
1686 {
1687         struct iwl_mvm_mc_iter_data iter_data = {
1688                 .mvm = mvm,
1689         };
1690
1691         lockdep_assert_held(&mvm->mutex);
1692
1693         if (WARN_ON_ONCE(!mvm->mcast_filter_cmd))
1694                 return;
1695
1696         ieee80211_iterate_active_interfaces_atomic(
1697                 mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1698                 iwl_mvm_mc_iface_iterator, &iter_data);
1699 }
1700
1701 static u64 iwl_mvm_prepare_multicast(struct ieee80211_hw *hw,
1702                                      struct netdev_hw_addr_list *mc_list)
1703 {
1704         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1705         struct iwl_mcast_filter_cmd *cmd;
1706         struct netdev_hw_addr *addr;
1707         int addr_count;
1708         bool pass_all;
1709         int len;
1710
1711         addr_count = netdev_hw_addr_list_count(mc_list);
1712         pass_all = addr_count > MAX_MCAST_FILTERING_ADDRESSES ||
1713                    IWL_MVM_FW_MCAST_FILTER_PASS_ALL;
1714         if (pass_all)
1715                 addr_count = 0;
1716
1717         len = roundup(sizeof(*cmd) + addr_count * ETH_ALEN, 4);
1718         cmd = kzalloc(len, GFP_ATOMIC);
1719         if (!cmd)
1720                 return 0;
1721
1722         if (pass_all) {
1723                 cmd->pass_all = 1;
1724                 return (u64)(unsigned long)cmd;
1725         }
1726
1727         netdev_hw_addr_list_for_each(addr, mc_list) {
1728                 IWL_DEBUG_MAC80211(mvm, "mcast addr (%d): %pM\n",
1729                                    cmd->count, addr->addr);
1730                 memcpy(&cmd->addr_list[cmd->count * ETH_ALEN],
1731                        addr->addr, ETH_ALEN);
1732                 cmd->count++;
1733         }
1734
1735         return (u64)(unsigned long)cmd;
1736 }
1737
1738 static void iwl_mvm_configure_filter(struct ieee80211_hw *hw,
1739                                      unsigned int changed_flags,
1740                                      unsigned int *total_flags,
1741                                      u64 multicast)
1742 {
1743         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1744         struct iwl_mcast_filter_cmd *cmd = (void *)(unsigned long)multicast;
1745
1746         mutex_lock(&mvm->mutex);
1747
1748         /* replace previous configuration */
1749         kfree(mvm->mcast_filter_cmd);
1750         mvm->mcast_filter_cmd = cmd;
1751
1752         if (!cmd)
1753                 goto out;
1754
1755         if (changed_flags & FIF_ALLMULTI)
1756                 cmd->pass_all = !!(*total_flags & FIF_ALLMULTI);
1757
1758         if (cmd->pass_all)
1759                 cmd->count = 0;
1760
1761         iwl_mvm_recalc_multicast(mvm);
1762 out:
1763         mutex_unlock(&mvm->mutex);
1764         *total_flags = 0;
1765 }
1766
1767 static void iwl_mvm_config_iface_filter(struct ieee80211_hw *hw,
1768                                         struct ieee80211_vif *vif,
1769                                         unsigned int filter_flags,
1770                                         unsigned int changed_flags)
1771 {
1772         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1773
1774         /* We support only filter for probe requests */
1775         if (!(changed_flags & FIF_PROBE_REQ))
1776                 return;
1777
1778         /* Supported only for p2p client interfaces */
1779         if (vif->type != NL80211_IFTYPE_STATION || !vif->bss_conf.assoc ||
1780             !vif->p2p)
1781                 return;
1782
1783         mutex_lock(&mvm->mutex);
1784         iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
1785         mutex_unlock(&mvm->mutex);
1786 }
1787
1788 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
1789 struct iwl_bcast_iter_data {
1790         struct iwl_mvm *mvm;
1791         struct iwl_bcast_filter_cmd *cmd;
1792         u8 current_filter;
1793 };
1794
1795 static void
1796 iwl_mvm_set_bcast_filter(struct ieee80211_vif *vif,
1797                          const struct iwl_fw_bcast_filter *in_filter,
1798                          struct iwl_fw_bcast_filter *out_filter)
1799 {
1800         struct iwl_fw_bcast_filter_attr *attr;
1801         int i;
1802
1803         memcpy(out_filter, in_filter, sizeof(*out_filter));
1804
1805         for (i = 0; i < ARRAY_SIZE(out_filter->attrs); i++) {
1806                 attr = &out_filter->attrs[i];
1807
1808                 if (!attr->mask)
1809                         break;
1810
1811                 switch (attr->reserved1) {
1812                 case cpu_to_le16(BC_FILTER_MAGIC_IP):
1813                         if (vif->bss_conf.arp_addr_cnt != 1) {
1814                                 attr->mask = 0;
1815                                 continue;
1816                         }
1817
1818                         attr->val = vif->bss_conf.arp_addr_list[0];
1819                         break;
1820                 case cpu_to_le16(BC_FILTER_MAGIC_MAC):
1821                         attr->val = *(__be32 *)&vif->addr[2];
1822                         break;
1823                 default:
1824                         break;
1825                 }
1826                 attr->reserved1 = 0;
1827                 out_filter->num_attrs++;
1828         }
1829 }
1830
1831 static void iwl_mvm_bcast_filter_iterator(void *_data, u8 *mac,
1832                                           struct ieee80211_vif *vif)
1833 {
1834         struct iwl_bcast_iter_data *data = _data;
1835         struct iwl_mvm *mvm = data->mvm;
1836         struct iwl_bcast_filter_cmd *cmd = data->cmd;
1837         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1838         struct iwl_fw_bcast_mac *bcast_mac;
1839         int i;
1840
1841         if (WARN_ON(mvmvif->id >= ARRAY_SIZE(cmd->macs)))
1842                 return;
1843
1844         bcast_mac = &cmd->macs[mvmvif->id];
1845
1846         /*
1847          * enable filtering only for associated stations, but not for P2P
1848          * Clients
1849          */
1850         if (vif->type != NL80211_IFTYPE_STATION || vif->p2p ||
1851             !vif->bss_conf.assoc)
1852                 return;
1853
1854         bcast_mac->default_discard = 1;
1855
1856         /* copy all configured filters */
1857         for (i = 0; mvm->bcast_filters[i].attrs[0].mask; i++) {
1858                 /*
1859                  * Make sure we don't exceed our filters limit.
1860                  * if there is still a valid filter to be configured,
1861                  * be on the safe side and just allow bcast for this mac.
1862                  */
1863                 if (WARN_ON_ONCE(data->current_filter >=
1864                                  ARRAY_SIZE(cmd->filters))) {
1865                         bcast_mac->default_discard = 0;
1866                         bcast_mac->attached_filters = 0;
1867                         break;
1868                 }
1869
1870                 iwl_mvm_set_bcast_filter(vif,
1871                                          &mvm->bcast_filters[i],
1872                                          &cmd->filters[data->current_filter]);
1873
1874                 /* skip current filter if it contains no attributes */
1875                 if (!cmd->filters[data->current_filter].num_attrs)
1876                         continue;
1877
1878                 /* attach the filter to current mac */
1879                 bcast_mac->attached_filters |=
1880                                 cpu_to_le16(BIT(data->current_filter));
1881
1882                 data->current_filter++;
1883         }
1884 }
1885
1886 bool iwl_mvm_bcast_filter_build_cmd(struct iwl_mvm *mvm,
1887                                     struct iwl_bcast_filter_cmd *cmd)
1888 {
1889         struct iwl_bcast_iter_data iter_data = {
1890                 .mvm = mvm,
1891                 .cmd = cmd,
1892         };
1893
1894         if (IWL_MVM_FW_BCAST_FILTER_PASS_ALL)
1895                 return false;
1896
1897         memset(cmd, 0, sizeof(*cmd));
1898         cmd->max_bcast_filters = ARRAY_SIZE(cmd->filters);
1899         cmd->max_macs = ARRAY_SIZE(cmd->macs);
1900
1901 #ifdef CONFIG_IWLWIFI_DEBUGFS
1902         /* use debugfs filters/macs if override is configured */
1903         if (mvm->dbgfs_bcast_filtering.override) {
1904                 memcpy(cmd->filters, &mvm->dbgfs_bcast_filtering.cmd.filters,
1905                        sizeof(cmd->filters));
1906                 memcpy(cmd->macs, &mvm->dbgfs_bcast_filtering.cmd.macs,
1907                        sizeof(cmd->macs));
1908                 return true;
1909         }
1910 #endif
1911
1912         /* if no filters are configured, do nothing */
1913         if (!mvm->bcast_filters)
1914                 return false;
1915
1916         /* configure and attach these filters for each associated sta vif */
1917         ieee80211_iterate_active_interfaces(
1918                 mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1919                 iwl_mvm_bcast_filter_iterator, &iter_data);
1920
1921         return true;
1922 }
1923
1924 static int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
1925 {
1926         struct iwl_bcast_filter_cmd cmd;
1927
1928         if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BCAST_FILTERING))
1929                 return 0;
1930
1931         if (!iwl_mvm_bcast_filter_build_cmd(mvm, &cmd))
1932                 return 0;
1933
1934         return iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, 0,
1935                                     sizeof(cmd), &cmd);
1936 }
1937 #else
1938 static inline int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
1939 {
1940         return 0;
1941 }
1942 #endif
1943
1944 static int iwl_mvm_update_mu_groups(struct iwl_mvm *mvm,
1945                                     struct ieee80211_vif *vif)
1946 {
1947         struct iwl_mu_group_mgmt_cmd cmd = {};
1948
1949         memcpy(cmd.membership_status, vif->bss_conf.mu_group.membership,
1950                WLAN_MEMBERSHIP_LEN);
1951         memcpy(cmd.user_position, vif->bss_conf.mu_group.position,
1952                WLAN_USER_POSITION_LEN);
1953
1954         return iwl_mvm_send_cmd_pdu(mvm,
1955                                     WIDE_ID(DATA_PATH_GROUP,
1956                                             UPDATE_MU_GROUPS_CMD),
1957                                     0, sizeof(cmd), &cmd);
1958 }
1959
1960 static void iwl_mvm_mu_mimo_iface_iterator(void *_data, u8 *mac,
1961                                            struct ieee80211_vif *vif)
1962 {
1963         if (vif->mu_mimo_owner) {
1964                 struct iwl_mu_group_mgmt_notif *notif = _data;
1965
1966                 /*
1967                  * MU-MIMO Group Id action frame is little endian. We treat
1968                  * the data received from firmware as if it came from the
1969                  * action frame, so no conversion is needed.
1970                  */
1971                 ieee80211_update_mu_groups(vif,
1972                                            (u8 *)&notif->membership_status,
1973                                            (u8 *)&notif->user_position);
1974         }
1975 }
1976
1977 void iwl_mvm_mu_mimo_grp_notif(struct iwl_mvm *mvm,
1978                                struct iwl_rx_cmd_buffer *rxb)
1979 {
1980         struct iwl_rx_packet *pkt = rxb_addr(rxb);
1981         struct iwl_mu_group_mgmt_notif *notif = (void *)pkt->data;
1982
1983         ieee80211_iterate_active_interfaces_atomic(
1984                         mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1985                         iwl_mvm_mu_mimo_iface_iterator, notif);
1986 }
1987
1988 static u8 iwl_mvm_he_get_ppe_val(u8 *ppe, u8 ppe_pos_bit)
1989 {
1990         u8 byte_num = ppe_pos_bit / 8;
1991         u8 bit_num = ppe_pos_bit % 8;
1992         u8 residue_bits;
1993         u8 res;
1994
1995         if (bit_num <= 5)
1996                 return (ppe[byte_num] >> bit_num) &
1997                        (BIT(IEEE80211_PPE_THRES_INFO_PPET_SIZE) - 1);
1998
1999         /*
2000          * If bit_num > 5, we have to combine bits with next byte.
2001          * Calculate how many bits we need to take from current byte (called
2002          * here "residue_bits"), and add them to bits from next byte.
2003          */
2004
2005         residue_bits = 8 - bit_num;
2006
2007         res = (ppe[byte_num + 1] &
2008                (BIT(IEEE80211_PPE_THRES_INFO_PPET_SIZE - residue_bits) - 1)) <<
2009               residue_bits;
2010         res += (ppe[byte_num] >> bit_num) & (BIT(residue_bits) - 1);
2011
2012         return res;
2013 }
2014
2015 static void iwl_mvm_cfg_he_sta(struct iwl_mvm *mvm,
2016                                struct ieee80211_vif *vif, u8 sta_id)
2017 {
2018         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2019         struct iwl_he_sta_context_cmd sta_ctxt_cmd = {
2020                 .sta_id = sta_id,
2021                 .tid_limit = IWL_MAX_TID_COUNT,
2022                 .bss_color = vif->bss_conf.bss_color,
2023                 .htc_trig_based_pkt_ext = vif->bss_conf.htc_trig_based_pkt_ext,
2024                 .frame_time_rts_th =
2025                         cpu_to_le16(vif->bss_conf.frame_time_rts_th),
2026         };
2027         int size = fw_has_api(&mvm->fw->ucode_capa,
2028                               IWL_UCODE_TLV_API_MBSSID_HE) ?
2029                    sizeof(sta_ctxt_cmd) :
2030                    sizeof(struct iwl_he_sta_context_cmd_v1);
2031         struct ieee80211_sta *sta;
2032         u32 flags;
2033         int i;
2034
2035         rcu_read_lock();
2036
2037         sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_ctxt_cmd.sta_id]);
2038         if (IS_ERR_OR_NULL(sta)) {
2039                 rcu_read_unlock();
2040                 WARN(1, "Can't find STA to configure HE\n");
2041                 return;
2042         }
2043
2044         if (!sta->he_cap.has_he) {
2045                 rcu_read_unlock();
2046                 return;
2047         }
2048
2049         flags = 0;
2050
2051         /* Block 26-tone RU OFDMA transmissions */
2052         if (mvmvif->he_ru_2mhz_block)
2053                 flags |= STA_CTXT_HE_RU_2MHZ_BLOCK;
2054
2055         /* HTC flags */
2056         if (sta->he_cap.he_cap_elem.mac_cap_info[0] &
2057             IEEE80211_HE_MAC_CAP0_HTC_HE)
2058                 sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_SUPPORT);
2059         if ((sta->he_cap.he_cap_elem.mac_cap_info[1] &
2060               IEEE80211_HE_MAC_CAP1_LINK_ADAPTATION) ||
2061             (sta->he_cap.he_cap_elem.mac_cap_info[2] &
2062               IEEE80211_HE_MAC_CAP2_LINK_ADAPTATION)) {
2063                 u8 link_adap =
2064                         ((sta->he_cap.he_cap_elem.mac_cap_info[2] &
2065                           IEEE80211_HE_MAC_CAP2_LINK_ADAPTATION) << 1) +
2066                          (sta->he_cap.he_cap_elem.mac_cap_info[1] &
2067                           IEEE80211_HE_MAC_CAP1_LINK_ADAPTATION);
2068
2069                 if (link_adap == 2)
2070                         sta_ctxt_cmd.htc_flags |=
2071                                 cpu_to_le32(IWL_HE_HTC_LINK_ADAP_UNSOLICITED);
2072                 else if (link_adap == 3)
2073                         sta_ctxt_cmd.htc_flags |=
2074                                 cpu_to_le32(IWL_HE_HTC_LINK_ADAP_BOTH);
2075         }
2076         if (sta->he_cap.he_cap_elem.mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
2077                 sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_BSR_SUPP);
2078         if (sta->he_cap.he_cap_elem.mac_cap_info[3] &
2079             IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
2080                 sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_OMI_SUPP);
2081         if (sta->he_cap.he_cap_elem.mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
2082                 sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_BQR_SUPP);
2083
2084         /*
2085          * Initialize the PPE thresholds to "None" (7), as described in Table
2086          * 9-262ac of 80211.ax/D3.0.
2087          */
2088         memset(&sta_ctxt_cmd.pkt_ext, 7, sizeof(sta_ctxt_cmd.pkt_ext));
2089
2090         /* If PPE Thresholds exist, parse them into a FW-familiar format. */
2091         if (sta->he_cap.he_cap_elem.phy_cap_info[6] &
2092             IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT) {
2093                 u8 nss = (sta->he_cap.ppe_thres[0] &
2094                           IEEE80211_PPE_THRES_NSS_MASK) + 1;
2095                 u8 ru_index_bitmap =
2096                         (sta->he_cap.ppe_thres[0] &
2097                          IEEE80211_PPE_THRES_RU_INDEX_BITMASK_MASK) >>
2098                         IEEE80211_PPE_THRES_RU_INDEX_BITMASK_POS;
2099                 u8 *ppe = &sta->he_cap.ppe_thres[0];
2100                 u8 ppe_pos_bit = 7; /* Starting after PPE header */
2101
2102                 /*
2103                  * FW currently supports only nss == MAX_HE_SUPP_NSS
2104                  *
2105                  * If nss > MAX: we can ignore values we don't support
2106                  * If nss < MAX: we can set zeros in other streams
2107                  */
2108                 if (nss > MAX_HE_SUPP_NSS) {
2109                         IWL_INFO(mvm, "Got NSS = %d - trimming to %d\n", nss,
2110                                  MAX_HE_SUPP_NSS);
2111                         nss = MAX_HE_SUPP_NSS;
2112                 }
2113
2114                 for (i = 0; i < nss; i++) {
2115                         u8 ru_index_tmp = ru_index_bitmap << 1;
2116                         u8 bw;
2117
2118                         for (bw = 0; bw < MAX_HE_CHANNEL_BW_INDX; bw++) {
2119                                 ru_index_tmp >>= 1;
2120                                 if (!(ru_index_tmp & 1))
2121                                         continue;
2122
2123                                 sta_ctxt_cmd.pkt_ext.pkt_ext_qam_th[i][bw][1] =
2124                                         iwl_mvm_he_get_ppe_val(ppe,
2125                                                                ppe_pos_bit);
2126                                 ppe_pos_bit +=
2127                                         IEEE80211_PPE_THRES_INFO_PPET_SIZE;
2128                                 sta_ctxt_cmd.pkt_ext.pkt_ext_qam_th[i][bw][0] =
2129                                         iwl_mvm_he_get_ppe_val(ppe,
2130                                                                ppe_pos_bit);
2131                                 ppe_pos_bit +=
2132                                         IEEE80211_PPE_THRES_INFO_PPET_SIZE;
2133                         }
2134                 }
2135
2136                 flags |= STA_CTXT_HE_PACKET_EXT;
2137         } else if ((sta->he_cap.he_cap_elem.phy_cap_info[9] &
2138                     IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_MASK) !=
2139                   IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_RESERVED) {
2140                 int low_th = -1;
2141                 int high_th = -1;
2142
2143                 /* Take the PPE thresholds from the nominal padding info */
2144                 switch (sta->he_cap.he_cap_elem.phy_cap_info[9] &
2145                         IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_MASK) {
2146                 case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_0US:
2147                         low_th = IWL_HE_PKT_EXT_NONE;
2148                         high_th = IWL_HE_PKT_EXT_NONE;
2149                         break;
2150                 case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_8US:
2151                         low_th = IWL_HE_PKT_EXT_BPSK;
2152                         high_th = IWL_HE_PKT_EXT_NONE;
2153                         break;
2154                 case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_16US:
2155                         low_th = IWL_HE_PKT_EXT_NONE;
2156                         high_th = IWL_HE_PKT_EXT_BPSK;
2157                         break;
2158                 }
2159
2160                 /* Set the PPE thresholds accordingly */
2161                 if (low_th >= 0 && high_th >= 0) {
2162                         struct iwl_he_pkt_ext *pkt_ext =
2163                                 (struct iwl_he_pkt_ext *)&sta_ctxt_cmd.pkt_ext;
2164
2165                         for (i = 0; i < MAX_HE_SUPP_NSS; i++) {
2166                                 u8 bw;
2167
2168                                 for (bw = 0; bw < MAX_HE_CHANNEL_BW_INDX;
2169                                      bw++) {
2170                                         pkt_ext->pkt_ext_qam_th[i][bw][0] =
2171                                                 low_th;
2172                                         pkt_ext->pkt_ext_qam_th[i][bw][1] =
2173                                                 high_th;
2174                                 }
2175                         }
2176
2177                         flags |= STA_CTXT_HE_PACKET_EXT;
2178                 }
2179         }
2180         rcu_read_unlock();
2181
2182         /* Mark MU EDCA as enabled, unless none detected on some AC */
2183         flags |= STA_CTXT_HE_MU_EDCA_CW;
2184         for (i = 0; i < IEEE80211_NUM_ACS; i++) {
2185                 struct ieee80211_he_mu_edca_param_ac_rec *mu_edca =
2186                         &mvmvif->queue_params[i].mu_edca_param_rec;
2187                 u8 ac = iwl_mvm_mac80211_ac_to_ucode_ac(i);
2188
2189                 if (!mvmvif->queue_params[i].mu_edca) {
2190                         flags &= ~STA_CTXT_HE_MU_EDCA_CW;
2191                         break;
2192                 }
2193
2194                 sta_ctxt_cmd.trig_based_txf[ac].cwmin =
2195                         cpu_to_le16(mu_edca->ecw_min_max & 0xf);
2196                 sta_ctxt_cmd.trig_based_txf[ac].cwmax =
2197                         cpu_to_le16((mu_edca->ecw_min_max & 0xf0) >> 4);
2198                 sta_ctxt_cmd.trig_based_txf[ac].aifsn =
2199                         cpu_to_le16(mu_edca->aifsn);
2200                 sta_ctxt_cmd.trig_based_txf[ac].mu_time =
2201                         cpu_to_le16(mu_edca->mu_edca_timer);
2202         }
2203
2204         if (vif->bss_conf.multi_sta_back_32bit)
2205                 flags |= STA_CTXT_HE_32BIT_BA_BITMAP;
2206
2207         if (vif->bss_conf.ack_enabled)
2208                 flags |= STA_CTXT_HE_ACK_ENABLED;
2209
2210         if (vif->bss_conf.uora_exists) {
2211                 flags |= STA_CTXT_HE_TRIG_RND_ALLOC;
2212
2213                 sta_ctxt_cmd.rand_alloc_ecwmin =
2214                         vif->bss_conf.uora_ocw_range & 0x7;
2215                 sta_ctxt_cmd.rand_alloc_ecwmax =
2216                         (vif->bss_conf.uora_ocw_range >> 3) & 0x7;
2217         }
2218
2219         if (vif->bss_conf.nontransmitted) {
2220                 flags |= STA_CTXT_HE_REF_BSSID_VALID;
2221                 ether_addr_copy(sta_ctxt_cmd.ref_bssid_addr,
2222                                 vif->bss_conf.transmitter_bssid);
2223                 sta_ctxt_cmd.max_bssid_indicator =
2224                         vif->bss_conf.bssid_indicator;
2225                 sta_ctxt_cmd.bssid_index = vif->bss_conf.bssid_index;
2226                 sta_ctxt_cmd.ema_ap = vif->bss_conf.ema_ap;
2227                 sta_ctxt_cmd.profile_periodicity =
2228                         vif->bss_conf.profile_periodicity;
2229         }
2230
2231         sta_ctxt_cmd.flags = cpu_to_le32(flags);
2232
2233         if (iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(STA_HE_CTXT_CMD,
2234                                                  DATA_PATH_GROUP, 0),
2235                                  0, size, &sta_ctxt_cmd))
2236                 IWL_ERR(mvm, "Failed to config FW to work HE!\n");
2237 }
2238
2239 static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
2240                                              struct ieee80211_vif *vif,
2241                                              struct ieee80211_bss_conf *bss_conf,
2242                                              u32 changes)
2243 {
2244         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2245         int ret;
2246
2247         /*
2248          * Re-calculate the tsf id, as the master-slave relations depend on the
2249          * beacon interval, which was not known when the station interface was
2250          * added.
2251          */
2252         if (changes & BSS_CHANGED_ASSOC && bss_conf->assoc) {
2253                 if (vif->bss_conf.he_support &&
2254                     !iwlwifi_mod_params.disable_11ax)
2255                         iwl_mvm_cfg_he_sta(mvm, vif, mvmvif->ap_sta_id);
2256
2257                 iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
2258         }
2259
2260         /* Update MU EDCA params */
2261         if (changes & BSS_CHANGED_QOS && mvmvif->associated &&
2262             bss_conf->assoc && vif->bss_conf.he_support &&
2263             !iwlwifi_mod_params.disable_11ax)
2264                 iwl_mvm_cfg_he_sta(mvm, vif, mvmvif->ap_sta_id);
2265
2266         /*
2267          * If we're not associated yet, take the (new) BSSID before associating
2268          * so the firmware knows. If we're already associated, then use the old
2269          * BSSID here, and we'll send a cleared one later in the CHANGED_ASSOC
2270          * branch for disassociation below.
2271          */
2272         if (changes & BSS_CHANGED_BSSID && !mvmvif->associated)
2273                 memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
2274
2275         ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, mvmvif->bssid);
2276         if (ret)
2277                 IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
2278
2279         /* after sending it once, adopt mac80211 data */
2280         memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
2281         mvmvif->associated = bss_conf->assoc;
2282
2283         if (changes & BSS_CHANGED_ASSOC) {
2284                 if (bss_conf->assoc) {
2285                         /* clear statistics to get clean beacon counter */
2286                         iwl_mvm_request_statistics(mvm, true);
2287                         memset(&mvmvif->beacon_stats, 0,
2288                                sizeof(mvmvif->beacon_stats));
2289
2290                         /* add quota for this interface */
2291                         ret = iwl_mvm_update_quotas(mvm, true, NULL);
2292                         if (ret) {
2293                                 IWL_ERR(mvm, "failed to update quotas\n");
2294                                 return;
2295                         }
2296
2297                         if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
2298                                      &mvm->status) &&
2299                             !fw_has_capa(&mvm->fw->ucode_capa,
2300                                          IWL_UCODE_TLV_CAPA_SESSION_PROT_CMD)) {
2301                                 /*
2302                                  * If we're restarting then the firmware will
2303                                  * obviously have lost synchronisation with
2304                                  * the AP. It will attempt to synchronise by
2305                                  * itself, but we can make it more reliable by
2306                                  * scheduling a session protection time event.
2307                                  *
2308                                  * The firmware needs to receive a beacon to
2309                                  * catch up with synchronisation, use 110% of
2310                                  * the beacon interval.
2311                                  *
2312                                  * Set a large maximum delay to allow for more
2313                                  * than a single interface.
2314                                  *
2315                                  * For new firmware versions, rely on the
2316                                  * firmware. This is relevant for DCM scenarios
2317                                  * only anyway.
2318                                  */
2319                                 u32 dur = (11 * vif->bss_conf.beacon_int) / 10;
2320                                 iwl_mvm_protect_session(mvm, vif, dur, dur,
2321                                                         5 * dur, false);
2322                         }
2323
2324                         iwl_mvm_sf_update(mvm, vif, false);
2325                         iwl_mvm_power_vif_assoc(mvm, vif);
2326                         if (vif->p2p) {
2327                                 iwl_mvm_update_smps(mvm, vif,
2328                                                     IWL_MVM_SMPS_REQ_PROT,
2329                                                     IEEE80211_SMPS_DYNAMIC);
2330                         }
2331                 } else if (mvmvif->ap_sta_id != IWL_MVM_INVALID_STA) {
2332                         /*
2333                          * If update fails - SF might be running in associated
2334                          * mode while disassociated - which is forbidden.
2335                          */
2336                         ret = iwl_mvm_sf_update(mvm, vif, false);
2337                         WARN_ONCE(ret &&
2338                                   !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
2339                                             &mvm->status),
2340                                   "Failed to update SF upon disassociation\n");
2341
2342                         /*
2343                          * If we get an assert during the connection (after the
2344                          * station has been added, but before the vif is set
2345                          * to associated), mac80211 will re-add the station and
2346                          * then configure the vif. Since the vif is not
2347                          * associated, we would remove the station here and
2348                          * this would fail the recovery.
2349                          */
2350                         if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
2351                                       &mvm->status)) {
2352                                 /*
2353                                  * Remove AP station now that
2354                                  * the MAC is unassoc
2355                                  */
2356                                 ret = iwl_mvm_rm_sta_id(mvm, vif,
2357                                                         mvmvif->ap_sta_id);
2358                                 if (ret)
2359                                         IWL_ERR(mvm,
2360                                                 "failed to remove AP station\n");
2361
2362                                 mvmvif->ap_sta_id = IWL_MVM_INVALID_STA;
2363                         }
2364
2365                         /* remove quota for this interface */
2366                         ret = iwl_mvm_update_quotas(mvm, false, NULL);
2367                         if (ret)
2368                                 IWL_ERR(mvm, "failed to update quotas\n");
2369
2370                         /* this will take the cleared BSSID from bss_conf */
2371                         ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
2372                         if (ret)
2373                                 IWL_ERR(mvm,
2374                                         "failed to update MAC %pM (clear after unassoc)\n",
2375                                         vif->addr);
2376                 }
2377
2378                 /*
2379                  * The firmware tracks the MU-MIMO group on its own.
2380                  * However, on HW restart we should restore this data.
2381                  */
2382                 if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
2383                     (changes & BSS_CHANGED_MU_GROUPS) && vif->mu_mimo_owner) {
2384                         ret = iwl_mvm_update_mu_groups(mvm, vif);
2385                         if (ret)
2386                                 IWL_ERR(mvm,
2387                                         "failed to update VHT MU_MIMO groups\n");
2388                 }
2389
2390                 iwl_mvm_recalc_multicast(mvm);
2391                 iwl_mvm_configure_bcast_filter(mvm);
2392
2393                 /* reset rssi values */
2394                 mvmvif->bf_data.ave_beacon_signal = 0;
2395
2396                 iwl_mvm_bt_coex_vif_change(mvm);
2397                 iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_TT,
2398                                     IEEE80211_SMPS_AUTOMATIC);
2399                 if (fw_has_capa(&mvm->fw->ucode_capa,
2400                                 IWL_UCODE_TLV_CAPA_UMAC_SCAN))
2401                         iwl_mvm_config_scan(mvm);
2402         }
2403
2404         if (changes & BSS_CHANGED_BEACON_INFO) {
2405                 /*
2406                  * We received a beacon from the associated AP so
2407                  * remove the session protection.
2408                  * A firmware with the new API will remove it automatically.
2409                  */
2410                 if (!fw_has_capa(&mvm->fw->ucode_capa,
2411                                  IWL_UCODE_TLV_CAPA_SESSION_PROT_CMD))
2412                         iwl_mvm_stop_session_protection(mvm, vif);
2413
2414                 iwl_mvm_sf_update(mvm, vif, false);
2415                 WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
2416         }
2417
2418         if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS | BSS_CHANGED_QOS |
2419                        /*
2420                         * Send power command on every beacon change,
2421                         * because we may have not enabled beacon abort yet.
2422                         */
2423                        BSS_CHANGED_BEACON_INFO)) {
2424                 ret = iwl_mvm_power_update_mac(mvm);
2425                 if (ret)
2426                         IWL_ERR(mvm, "failed to update power mode\n");
2427         }
2428
2429         if (changes & BSS_CHANGED_TXPOWER) {
2430                 IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2431                                 bss_conf->txpower);
2432                 iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2433         }
2434
2435         if (changes & BSS_CHANGED_CQM) {
2436                 IWL_DEBUG_MAC80211(mvm, "cqm info_changed\n");
2437                 /* reset cqm events tracking */
2438                 mvmvif->bf_data.last_cqm_event = 0;
2439                 if (mvmvif->bf_data.bf_enabled) {
2440                         ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
2441                         if (ret)
2442                                 IWL_ERR(mvm,
2443                                         "failed to update CQM thresholds\n");
2444                 }
2445         }
2446
2447         if (changes & BSS_CHANGED_ARP_FILTER) {
2448                 IWL_DEBUG_MAC80211(mvm, "arp filter changed\n");
2449                 iwl_mvm_configure_bcast_filter(mvm);
2450         }
2451 }
2452
2453 static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
2454                                  struct ieee80211_vif *vif)
2455 {
2456         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2457         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2458         int ret, i;
2459
2460         mutex_lock(&mvm->mutex);
2461
2462         /* Send the beacon template */
2463         ret = iwl_mvm_mac_ctxt_beacon_changed(mvm, vif);
2464         if (ret)
2465                 goto out_unlock;
2466
2467         /*
2468          * Re-calculate the tsf id, as the master-slave relations depend on the
2469          * beacon interval, which was not known when the AP interface was added.
2470          */
2471         if (vif->type == NL80211_IFTYPE_AP)
2472                 iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
2473
2474         mvmvif->ap_assoc_sta_count = 0;
2475
2476         /* Add the mac context */
2477         ret = iwl_mvm_mac_ctxt_add(mvm, vif);
2478         if (ret)
2479                 goto out_unlock;
2480
2481         /* Perform the binding */
2482         ret = iwl_mvm_binding_add_vif(mvm, vif);
2483         if (ret)
2484                 goto out_remove;
2485
2486         /*
2487          * This is not very nice, but the simplest:
2488          * For older FWs adding the mcast sta before the bcast station may
2489          * cause assert 0x2b00.
2490          * This is fixed in later FW so make the order of removal depend on
2491          * the TLV
2492          */
2493         if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE)) {
2494                 ret = iwl_mvm_add_mcast_sta(mvm, vif);
2495                 if (ret)
2496                         goto out_unbind;
2497                 /*
2498                  * Send the bcast station. At this stage the TBTT and DTIM time
2499                  * events are added and applied to the scheduler
2500                  */
2501                 ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
2502                 if (ret) {
2503                         iwl_mvm_rm_mcast_sta(mvm, vif);
2504                         goto out_unbind;
2505                 }
2506         } else {
2507                 /*
2508                  * Send the bcast station. At this stage the TBTT and DTIM time
2509                  * events are added and applied to the scheduler
2510                  */
2511                 ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
2512                 if (ret)
2513                         goto out_unbind;
2514                 ret = iwl_mvm_add_mcast_sta(mvm, vif);
2515                 if (ret) {
2516                         iwl_mvm_send_rm_bcast_sta(mvm, vif);
2517                         goto out_unbind;
2518                 }
2519         }
2520
2521         /* must be set before quota calculations */
2522         mvmvif->ap_ibss_active = true;
2523
2524         /* send all the early keys to the device now */
2525         for (i = 0; i < ARRAY_SIZE(mvmvif->ap_early_keys); i++) {
2526                 struct ieee80211_key_conf *key = mvmvif->ap_early_keys[i];
2527
2528                 if (!key)
2529                         continue;
2530
2531                 mvmvif->ap_early_keys[i] = NULL;
2532
2533                 ret = __iwl_mvm_mac_set_key(hw, SET_KEY, vif, NULL, key);
2534                 if (ret)
2535                         goto out_quota_failed;
2536         }
2537
2538         if (vif->type == NL80211_IFTYPE_AP && !vif->p2p) {
2539                 iwl_mvm_vif_set_low_latency(mvmvif, true,
2540                                             LOW_LATENCY_VIF_TYPE);
2541                 iwl_mvm_send_low_latency_cmd(mvm, true, mvmvif->id);
2542         }
2543
2544         /* power updated needs to be done before quotas */
2545         iwl_mvm_power_update_mac(mvm);
2546
2547         ret = iwl_mvm_update_quotas(mvm, false, NULL);
2548         if (ret)
2549                 goto out_quota_failed;
2550
2551         /* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2552         if (vif->p2p && mvm->p2p_device_vif)
2553                 iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2554
2555         iwl_mvm_bt_coex_vif_change(mvm);
2556
2557         /* we don't support TDLS during DCM */
2558         if (iwl_mvm_phy_ctx_count(mvm) > 1)
2559                 iwl_mvm_teardown_tdls_peers(mvm);
2560
2561         iwl_mvm_ftm_restart_responder(mvm, vif);
2562
2563         goto out_unlock;
2564
2565 out_quota_failed:
2566         iwl_mvm_power_update_mac(mvm);
2567         mvmvif->ap_ibss_active = false;
2568         iwl_mvm_send_rm_bcast_sta(mvm, vif);
2569         iwl_mvm_rm_mcast_sta(mvm, vif);
2570 out_unbind:
2571         iwl_mvm_binding_remove_vif(mvm, vif);
2572 out_remove:
2573         iwl_mvm_mac_ctxt_remove(mvm, vif);
2574 out_unlock:
2575         mutex_unlock(&mvm->mutex);
2576         return ret;
2577 }
2578
2579 static void iwl_mvm_stop_ap_ibss(struct ieee80211_hw *hw,
2580                                  struct ieee80211_vif *vif)
2581 {
2582         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2583         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2584
2585         iwl_mvm_prepare_mac_removal(mvm, vif);
2586
2587         mutex_lock(&mvm->mutex);
2588
2589         /* Handle AP stop while in CSA */
2590         if (rcu_access_pointer(mvm->csa_vif) == vif) {
2591                 iwl_mvm_remove_time_event(mvm, mvmvif,
2592                                           &mvmvif->time_event_data);
2593                 RCU_INIT_POINTER(mvm->csa_vif, NULL);
2594                 mvmvif->csa_countdown = false;
2595         }
2596
2597         if (rcu_access_pointer(mvm->csa_tx_blocked_vif) == vif) {
2598                 RCU_INIT_POINTER(mvm->csa_tx_blocked_vif, NULL);
2599                 mvm->csa_tx_block_bcn_timeout = 0;
2600         }
2601
2602         mvmvif->ap_ibss_active = false;
2603         mvm->ap_last_beacon_gp2 = 0;
2604
2605         if (vif->type == NL80211_IFTYPE_AP && !vif->p2p) {
2606                 iwl_mvm_vif_set_low_latency(mvmvif, false,
2607                                             LOW_LATENCY_VIF_TYPE);
2608                 iwl_mvm_send_low_latency_cmd(mvm, false,  mvmvif->id);
2609         }
2610
2611         iwl_mvm_bt_coex_vif_change(mvm);
2612
2613         /* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2614         if (vif->p2p && mvm->p2p_device_vif)
2615                 iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2616
2617         iwl_mvm_update_quotas(mvm, false, NULL);
2618
2619         /*
2620          * This is not very nice, but the simplest:
2621          * For older FWs removing the mcast sta before the bcast station may
2622          * cause assert 0x2b00.
2623          * This is fixed in later FW (which will stop beaconing when removing
2624          * bcast station).
2625          * So make the order of removal depend on the TLV
2626          */
2627         if (!fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE))
2628                 iwl_mvm_rm_mcast_sta(mvm, vif);
2629         iwl_mvm_send_rm_bcast_sta(mvm, vif);
2630         if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE))
2631                 iwl_mvm_rm_mcast_sta(mvm, vif);
2632         iwl_mvm_binding_remove_vif(mvm, vif);
2633
2634         iwl_mvm_power_update_mac(mvm);
2635
2636         iwl_mvm_mac_ctxt_remove(mvm, vif);
2637
2638         mutex_unlock(&mvm->mutex);
2639 }
2640
2641 static void
2642 iwl_mvm_bss_info_changed_ap_ibss(struct iwl_mvm *mvm,
2643                                  struct ieee80211_vif *vif,
2644                                  struct ieee80211_bss_conf *bss_conf,
2645                                  u32 changes)
2646 {
2647         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2648
2649         /* Changes will be applied when the AP/IBSS is started */
2650         if (!mvmvif->ap_ibss_active)
2651                 return;
2652
2653         if (changes & (BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_HT |
2654                        BSS_CHANGED_BANDWIDTH | BSS_CHANGED_QOS) &&
2655             iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL))
2656                 IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
2657
2658         /* Need to send a new beacon template to the FW */
2659         if (changes & BSS_CHANGED_BEACON &&
2660             iwl_mvm_mac_ctxt_beacon_changed(mvm, vif))
2661                 IWL_WARN(mvm, "Failed updating beacon data\n");
2662
2663         if (changes & BSS_CHANGED_TXPOWER) {
2664                 IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2665                                 bss_conf->txpower);
2666                 iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2667         }
2668
2669         if (changes & BSS_CHANGED_FTM_RESPONDER) {
2670                 int ret = iwl_mvm_ftm_start_responder(mvm, vif);
2671
2672                 if (ret)
2673                         IWL_WARN(mvm, "Failed to enable FTM responder (%d)\n",
2674                                  ret);
2675         }
2676
2677 }
2678
2679 static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw,
2680                                      struct ieee80211_vif *vif,
2681                                      struct ieee80211_bss_conf *bss_conf,
2682                                      u32 changes)
2683 {
2684         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2685
2686         mutex_lock(&mvm->mutex);
2687
2688         if (changes & BSS_CHANGED_IDLE && !bss_conf->idle)
2689                 iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true);
2690
2691         switch (vif->type) {
2692         case NL80211_IFTYPE_STATION:
2693                 iwl_mvm_bss_info_changed_station(mvm, vif, bss_conf, changes);
2694                 break;
2695         case NL80211_IFTYPE_AP:
2696         case NL80211_IFTYPE_ADHOC:
2697                 iwl_mvm_bss_info_changed_ap_ibss(mvm, vif, bss_conf, changes);
2698                 break;
2699         case NL80211_IFTYPE_MONITOR:
2700                 if (changes & BSS_CHANGED_MU_GROUPS)
2701                         iwl_mvm_update_mu_groups(mvm, vif);
2702                 break;
2703         default:
2704                 /* shouldn't happen */
2705                 WARN_ON_ONCE(1);
2706         }
2707
2708         mutex_unlock(&mvm->mutex);
2709 }
2710
2711 static int iwl_mvm_mac_hw_scan(struct ieee80211_hw *hw,
2712                                struct ieee80211_vif *vif,
2713                                struct ieee80211_scan_request *hw_req)
2714 {
2715         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2716         int ret;
2717
2718         if (hw_req->req.n_channels == 0 ||
2719             hw_req->req.n_channels > mvm->fw->ucode_capa.n_scan_channels)
2720                 return -EINVAL;
2721
2722         mutex_lock(&mvm->mutex);
2723         ret = iwl_mvm_reg_scan_start(mvm, vif, &hw_req->req, &hw_req->ies);
2724         mutex_unlock(&mvm->mutex);
2725
2726         return ret;
2727 }
2728
2729 static void iwl_mvm_mac_cancel_hw_scan(struct ieee80211_hw *hw,
2730                                        struct ieee80211_vif *vif)
2731 {
2732         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2733
2734         mutex_lock(&mvm->mutex);
2735
2736         /* Due to a race condition, it's possible that mac80211 asks
2737          * us to stop a hw_scan when it's already stopped.  This can
2738          * happen, for instance, if we stopped the scan ourselves,
2739          * called ieee80211_scan_completed() and the userspace called
2740          * cancel scan scan before ieee80211_scan_work() could run.
2741          * To handle that, simply return if the scan is not running.
2742         */
2743         if (mvm->scan_status & IWL_MVM_SCAN_REGULAR)
2744                 iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true);
2745
2746         mutex_unlock(&mvm->mutex);
2747 }
2748
2749 static void
2750 iwl_mvm_mac_allow_buffered_frames(struct ieee80211_hw *hw,
2751                                   struct ieee80211_sta *sta, u16 tids,
2752                                   int num_frames,
2753                                   enum ieee80211_frame_release_type reason,
2754                                   bool more_data)
2755 {
2756         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2757
2758         /* Called when we need to transmit (a) frame(s) from mac80211 */
2759
2760         iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2761                                           tids, more_data, false);
2762 }
2763
2764 static void
2765 iwl_mvm_mac_release_buffered_frames(struct ieee80211_hw *hw,
2766                                     struct ieee80211_sta *sta, u16 tids,
2767                                     int num_frames,
2768                                     enum ieee80211_frame_release_type reason,
2769                                     bool more_data)
2770 {
2771         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2772
2773         /* Called when we need to transmit (a) frame(s) from agg or dqa queue */
2774
2775         iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2776                                           tids, more_data, true);
2777 }
2778
2779 static void __iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
2780                                      enum sta_notify_cmd cmd,
2781                                      struct ieee80211_sta *sta)
2782 {
2783         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2784         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
2785         unsigned long txqs = 0, tids = 0;
2786         int tid;
2787
2788         /*
2789          * If we have TVQM then we get too high queue numbers - luckily
2790          * we really shouldn't get here with that because such hardware
2791          * should have firmware supporting buffer station offload.
2792          */
2793         if (WARN_ON(iwl_mvm_has_new_tx_api(mvm)))
2794                 return;
2795
2796         spin_lock_bh(&mvmsta->lock);
2797         for (tid = 0; tid < ARRAY_SIZE(mvmsta->tid_data); tid++) {
2798                 struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
2799
2800                 if (tid_data->txq_id == IWL_MVM_INVALID_QUEUE)
2801                         continue;
2802
2803                 __set_bit(tid_data->txq_id, &txqs);
2804
2805                 if (iwl_mvm_tid_queued(mvm, tid_data) == 0)
2806                         continue;
2807
2808                 __set_bit(tid, &tids);
2809         }
2810
2811         switch (cmd) {
2812         case STA_NOTIFY_SLEEP:
2813                 for_each_set_bit(tid, &tids, IWL_MAX_TID_COUNT)
2814                         ieee80211_sta_set_buffered(sta, tid, true);
2815
2816                 if (txqs)
2817                         iwl_trans_freeze_txq_timer(mvm->trans, txqs, true);
2818                 /*
2819                  * The fw updates the STA to be asleep. Tx packets on the Tx
2820                  * queues to this station will not be transmitted. The fw will
2821                  * send a Tx response with TX_STATUS_FAIL_DEST_PS.
2822                  */
2823                 break;
2824         case STA_NOTIFY_AWAKE:
2825                 if (WARN_ON(mvmsta->sta_id == IWL_MVM_INVALID_STA))
2826                         break;
2827
2828                 if (txqs)
2829                         iwl_trans_freeze_txq_timer(mvm->trans, txqs, false);
2830                 iwl_mvm_sta_modify_ps_wake(mvm, sta);
2831                 break;
2832         default:
2833                 break;
2834         }
2835         spin_unlock_bh(&mvmsta->lock);
2836 }
2837
2838 static void iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
2839                                    struct ieee80211_vif *vif,
2840                                    enum sta_notify_cmd cmd,
2841                                    struct ieee80211_sta *sta)
2842 {
2843         __iwl_mvm_mac_sta_notify(hw, cmd, sta);
2844 }
2845
2846 void iwl_mvm_sta_pm_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
2847 {
2848         struct iwl_rx_packet *pkt = rxb_addr(rxb);
2849         struct iwl_mvm_pm_state_notification *notif = (void *)pkt->data;
2850         struct ieee80211_sta *sta;
2851         struct iwl_mvm_sta *mvmsta;
2852         bool sleeping = (notif->type != IWL_MVM_PM_EVENT_AWAKE);
2853
2854         if (WARN_ON(notif->sta_id >= ARRAY_SIZE(mvm->fw_id_to_mac_id)))
2855                 return;
2856
2857         rcu_read_lock();
2858         sta = rcu_dereference(mvm->fw_id_to_mac_id[notif->sta_id]);
2859         if (WARN_ON(IS_ERR_OR_NULL(sta))) {
2860                 rcu_read_unlock();
2861                 return;
2862         }
2863
2864         mvmsta = iwl_mvm_sta_from_mac80211(sta);
2865
2866         if (!mvmsta->vif ||
2867             mvmsta->vif->type != NL80211_IFTYPE_AP) {
2868                 rcu_read_unlock();
2869                 return;
2870         }
2871
2872         if (mvmsta->sleeping != sleeping) {
2873                 mvmsta->sleeping = sleeping;
2874                 __iwl_mvm_mac_sta_notify(mvm->hw,
2875                         sleeping ? STA_NOTIFY_SLEEP : STA_NOTIFY_AWAKE,
2876                         sta);
2877                 ieee80211_sta_ps_transition(sta, sleeping);
2878         }
2879
2880         if (sleeping) {
2881                 switch (notif->type) {
2882                 case IWL_MVM_PM_EVENT_AWAKE:
2883                 case IWL_MVM_PM_EVENT_ASLEEP:
2884                         break;
2885                 case IWL_MVM_PM_EVENT_UAPSD:
2886                         ieee80211_sta_uapsd_trigger(sta, IEEE80211_NUM_TIDS);
2887                         break;
2888                 case IWL_MVM_PM_EVENT_PS_POLL:
2889                         ieee80211_sta_pspoll(sta);
2890                         break;
2891                 default:
2892                         break;
2893                 }
2894         }
2895
2896         rcu_read_unlock();
2897 }
2898
2899 static void iwl_mvm_sta_pre_rcu_remove(struct ieee80211_hw *hw,
2900                                        struct ieee80211_vif *vif,
2901                                        struct ieee80211_sta *sta)
2902 {
2903         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2904         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
2905
2906         /*
2907          * This is called before mac80211 does RCU synchronisation,
2908          * so here we already invalidate our internal RCU-protected
2909          * station pointer. The rest of the code will thus no longer
2910          * be able to find the station this way, and we don't rely
2911          * on further RCU synchronisation after the sta_state()
2912          * callback deleted the station.
2913          */
2914         mutex_lock(&mvm->mutex);
2915         if (sta == rcu_access_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id]))
2916                 rcu_assign_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id],
2917                                    ERR_PTR(-ENOENT));
2918
2919         mutex_unlock(&mvm->mutex);
2920 }
2921
2922 static void iwl_mvm_check_uapsd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
2923                                 const u8 *bssid)
2924 {
2925         int i;
2926
2927         if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
2928                 struct iwl_mvm_tcm_mac *mdata;
2929
2930                 mdata = &mvm->tcm.data[iwl_mvm_vif_from_mac80211(vif)->id];
2931                 ewma_rate_init(&mdata->uapsd_nonagg_detect.rate);
2932                 mdata->opened_rx_ba_sessions = false;
2933         }
2934
2935         if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT))
2936                 return;
2937
2938         if (vif->p2p && !iwl_mvm_is_p2p_scm_uapsd_supported(mvm)) {
2939                 vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2940                 return;
2941         }
2942
2943         if (!vif->p2p &&
2944             (iwlwifi_mod_params.uapsd_disable & IWL_DISABLE_UAPSD_BSS)) {
2945                 vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2946                 return;
2947         }
2948
2949         for (i = 0; i < IWL_MVM_UAPSD_NOAGG_LIST_LEN; i++) {
2950                 if (ether_addr_equal(mvm->uapsd_noagg_bssids[i].addr, bssid)) {
2951                         vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2952                         return;
2953                 }
2954         }
2955
2956         vif->driver_flags |= IEEE80211_VIF_SUPPORTS_UAPSD;
2957 }
2958
2959 static void
2960 iwl_mvm_tdls_check_trigger(struct iwl_mvm *mvm,
2961                            struct ieee80211_vif *vif, u8 *peer_addr,
2962                            enum nl80211_tdls_operation action)
2963 {
2964         struct iwl_fw_dbg_trigger_tlv *trig;
2965         struct iwl_fw_dbg_trigger_tdls *tdls_trig;
2966
2967         trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
2968                                      FW_DBG_TRIGGER_TDLS);
2969         if (!trig)
2970                 return;
2971
2972         tdls_trig = (void *)trig->data;
2973
2974         if (!(tdls_trig->action_bitmap & BIT(action)))
2975                 return;
2976
2977         if (tdls_trig->peer_mode &&
2978             memcmp(tdls_trig->peer, peer_addr, ETH_ALEN) != 0)
2979                 return;
2980
2981         iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
2982                                 "TDLS event occurred, peer %pM, action %d",
2983                                 peer_addr, action);
2984 }
2985
2986 struct iwl_mvm_he_obss_narrow_bw_ru_data {
2987         bool tolerated;
2988 };
2989
2990 static void iwl_mvm_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
2991                                                     struct cfg80211_bss *bss,
2992                                                     void *_data)
2993 {
2994         struct iwl_mvm_he_obss_narrow_bw_ru_data *data = _data;
2995         const struct element *elem;
2996
2997         elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY, bss->ies->data,
2998                                   bss->ies->len);
2999
3000         if (!elem || elem->datalen < 10 ||
3001             !(elem->data[10] &
3002               WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT)) {
3003                 data->tolerated = false;
3004         }
3005 }
3006
3007 static void iwl_mvm_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
3008                                                struct ieee80211_vif *vif)
3009 {
3010         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3011         struct iwl_mvm_he_obss_narrow_bw_ru_data iter_data = {
3012                 .tolerated = true,
3013         };
3014
3015         if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR)) {
3016                 mvmvif->he_ru_2mhz_block = false;
3017                 return;
3018         }
3019
3020         cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
3021                           iwl_mvm_check_he_obss_narrow_bw_ru_iter,
3022                           &iter_data);
3023
3024         /*
3025          * If there is at least one AP on radar channel that cannot
3026          * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
3027          */
3028         mvmvif->he_ru_2mhz_block = !iter_data.tolerated;
3029 }
3030
3031 static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
3032                                  struct ieee80211_vif *vif,
3033                                  struct ieee80211_sta *sta,
3034                                  enum ieee80211_sta_state old_state,
3035                                  enum ieee80211_sta_state new_state)
3036 {
3037         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3038         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3039         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
3040         int ret;
3041
3042         IWL_DEBUG_MAC80211(mvm, "station %pM state change %d->%d\n",
3043                            sta->addr, old_state, new_state);
3044
3045         /* this would be a mac80211 bug ... but don't crash */
3046         if (WARN_ON_ONCE(!mvmvif->phy_ctxt))
3047                 return -EINVAL;
3048
3049         /*
3050          * If we are in a STA removal flow and in DQA mode:
3051          *
3052          * This is after the sync_rcu part, so the queues have already been
3053          * flushed. No more TXs on their way in mac80211's path, and no more in
3054          * the queues.
3055          * Also, we won't be getting any new TX frames for this station.
3056          * What we might have are deferred TX frames that need to be taken care
3057          * of.
3058          *
3059          * Drop any still-queued deferred-frame before removing the STA, and
3060          * make sure the worker is no longer handling frames for this STA.
3061          */
3062         if (old_state == IEEE80211_STA_NONE &&
3063             new_state == IEEE80211_STA_NOTEXIST) {
3064                 flush_work(&mvm->add_stream_wk);
3065
3066                 /*
3067                  * No need to make sure deferred TX indication is off since the
3068                  * worker will already remove it if it was on
3069                  */
3070         }
3071
3072         mutex_lock(&mvm->mutex);
3073         /* track whether or not the station is associated */
3074         mvm_sta->sta_state = new_state;
3075
3076         if (old_state == IEEE80211_STA_NOTEXIST &&
3077             new_state == IEEE80211_STA_NONE) {
3078                 /*
3079                  * Firmware bug - it'll crash if the beacon interval is less
3080                  * than 16. We can't avoid connecting at all, so refuse the
3081                  * station state change, this will cause mac80211 to abandon
3082                  * attempts to connect to this AP, and eventually wpa_s will
3083                  * blacklist the AP...
3084                  */
3085                 if (vif->type == NL80211_IFTYPE_STATION &&
3086                     vif->bss_conf.beacon_int < 16) {
3087                         IWL_ERR(mvm,
3088                                 "AP %pM beacon interval is %d, refusing due to firmware bug!\n",
3089                                 sta->addr, vif->bss_conf.beacon_int);
3090                         ret = -EINVAL;
3091                         goto out_unlock;
3092                 }
3093
3094                 if (sta->tdls &&
3095                     (vif->p2p ||
3096                      iwl_mvm_tdls_sta_count(mvm, NULL) ==
3097                                                 IWL_MVM_TDLS_STA_COUNT ||
3098                      iwl_mvm_phy_ctx_count(mvm) > 1)) {
3099                         IWL_DEBUG_MAC80211(mvm, "refusing TDLS sta\n");
3100                         ret = -EBUSY;
3101                         goto out_unlock;
3102                 }
3103
3104                 ret = iwl_mvm_add_sta(mvm, vif, sta);
3105                 if (sta->tdls && ret == 0) {
3106                         iwl_mvm_recalc_tdls_state(mvm, vif, true);
3107                         iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3108                                                    NL80211_TDLS_SETUP);
3109                 }
3110
3111                 sta->max_rc_amsdu_len = 1;
3112         } else if (old_state == IEEE80211_STA_NONE &&
3113                    new_state == IEEE80211_STA_AUTH) {
3114                 /*
3115                  * EBS may be disabled due to previous failures reported by FW.
3116                  * Reset EBS status here assuming environment has been changed.
3117                  */
3118                 mvm->last_ebs_successful = true;
3119                 iwl_mvm_check_uapsd(mvm, vif, sta->addr);
3120                 ret = 0;
3121         } else if (old_state == IEEE80211_STA_AUTH &&
3122                    new_state == IEEE80211_STA_ASSOC) {
3123                 if (vif->type == NL80211_IFTYPE_AP) {
3124                         vif->bss_conf.he_support = sta->he_cap.has_he;
3125                         mvmvif->ap_assoc_sta_count++;
3126                         iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3127                         if (vif->bss_conf.he_support &&
3128                             !iwlwifi_mod_params.disable_11ax)
3129                                 iwl_mvm_cfg_he_sta(mvm, vif, mvm_sta->sta_id);
3130                 } else if (vif->type == NL80211_IFTYPE_STATION) {
3131                         vif->bss_conf.he_support = sta->he_cap.has_he;
3132
3133                         mvmvif->he_ru_2mhz_block = false;
3134                         if (sta->he_cap.has_he)
3135                                 iwl_mvm_check_he_obss_narrow_bw_ru(hw, vif);
3136
3137                         iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3138                 }
3139
3140                 iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3141                                      false);
3142                 ret = iwl_mvm_update_sta(mvm, vif, sta);
3143         } else if (old_state == IEEE80211_STA_ASSOC &&
3144                    new_state == IEEE80211_STA_AUTHORIZED) {
3145                 ret = 0;
3146
3147                 /* we don't support TDLS during DCM */
3148                 if (iwl_mvm_phy_ctx_count(mvm) > 1)
3149                         iwl_mvm_teardown_tdls_peers(mvm);
3150
3151                 if (sta->tdls)
3152                         iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3153                                                    NL80211_TDLS_ENABLE_LINK);
3154
3155                 /* enable beacon filtering */
3156                 WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
3157
3158                 /*
3159                  * Now that the station is authorized, i.e., keys were already
3160                  * installed, need to indicate to the FW that
3161                  * multicast data frames can be forwarded to the driver
3162                  */
3163                 iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3164
3165                 iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3166                                      true);
3167         } else if (old_state == IEEE80211_STA_AUTHORIZED &&
3168                    new_state == IEEE80211_STA_ASSOC) {
3169                 /* Multicast data frames are no longer allowed */
3170                 iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3171
3172                 /* disable beacon filtering */
3173                 ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
3174                 WARN_ON(ret &&
3175                         !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
3176                                   &mvm->status));
3177                 ret = 0;
3178         } else if (old_state == IEEE80211_STA_ASSOC &&
3179                    new_state == IEEE80211_STA_AUTH) {
3180                 if (vif->type == NL80211_IFTYPE_AP) {
3181                         mvmvif->ap_assoc_sta_count--;
3182                         iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3183                 }
3184                 ret = 0;
3185         } else if (old_state == IEEE80211_STA_AUTH &&
3186                    new_state == IEEE80211_STA_NONE) {
3187                 ret = 0;
3188         } else if (old_state == IEEE80211_STA_NONE &&
3189                    new_state == IEEE80211_STA_NOTEXIST) {
3190                 ret = iwl_mvm_rm_sta(mvm, vif, sta);
3191                 if (sta->tdls) {
3192                         iwl_mvm_recalc_tdls_state(mvm, vif, false);
3193                         iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3194                                                    NL80211_TDLS_DISABLE_LINK);
3195                 }
3196
3197                 if (unlikely(ret &&
3198                              test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
3199                                       &mvm->status)))
3200                         ret = 0;
3201         } else {
3202                 ret = -EIO;
3203         }
3204  out_unlock:
3205         mutex_unlock(&mvm->mutex);
3206
3207         if (sta->tdls && ret == 0) {
3208                 if (old_state == IEEE80211_STA_NOTEXIST &&
3209                     new_state == IEEE80211_STA_NONE)
3210                         ieee80211_reserve_tid(sta, IWL_MVM_TDLS_FW_TID);
3211                 else if (old_state == IEEE80211_STA_NONE &&
3212                          new_state == IEEE80211_STA_NOTEXIST)
3213                         ieee80211_unreserve_tid(sta, IWL_MVM_TDLS_FW_TID);
3214         }
3215
3216         return ret;
3217 }
3218
3219 static int iwl_mvm_mac_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
3220 {
3221         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3222
3223         mvm->rts_threshold = value;
3224
3225         return 0;
3226 }
3227
3228 static void iwl_mvm_sta_rc_update(struct ieee80211_hw *hw,
3229                                   struct ieee80211_vif *vif,
3230                                   struct ieee80211_sta *sta, u32 changed)
3231 {
3232         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3233         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3234
3235         if (changed & (IEEE80211_RC_BW_CHANGED |
3236                        IEEE80211_RC_SUPP_RATES_CHANGED |
3237                        IEEE80211_RC_NSS_CHANGED))
3238                 iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3239                                      true);
3240
3241         if (vif->type == NL80211_IFTYPE_STATION &&
3242             changed & IEEE80211_RC_NSS_CHANGED)
3243                 iwl_mvm_sf_update(mvm, vif, false);
3244 }
3245
3246 static int iwl_mvm_mac_conf_tx(struct ieee80211_hw *hw,
3247                                struct ieee80211_vif *vif, u16 ac,
3248                                const struct ieee80211_tx_queue_params *params)
3249 {
3250         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3251         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3252
3253         mvmvif->queue_params[ac] = *params;
3254
3255         /*
3256          * No need to update right away, we'll get BSS_CHANGED_QOS
3257          * The exception is P2P_DEVICE interface which needs immediate update.
3258          */
3259         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
3260                 int ret;
3261
3262                 mutex_lock(&mvm->mutex);
3263                 ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3264                 mutex_unlock(&mvm->mutex);
3265                 return ret;
3266         }
3267         return 0;
3268 }
3269
3270 static void iwl_mvm_mac_mgd_prepare_tx(struct ieee80211_hw *hw,
3271                                        struct ieee80211_vif *vif,
3272                                        u16 req_duration)
3273 {
3274         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3275         u32 duration = IWL_MVM_TE_SESSION_PROTECTION_MAX_TIME_MS;
3276         u32 min_duration = IWL_MVM_TE_SESSION_PROTECTION_MIN_TIME_MS;
3277
3278         if (req_duration > duration)
3279                 duration = req_duration;
3280
3281         mutex_lock(&mvm->mutex);
3282         /* Try really hard to protect the session and hear a beacon
3283          * The new session protection command allows us to protect the
3284          * session for a much longer time since the firmware will internally
3285          * create two events: a 300TU one with a very high priority that
3286          * won't be fragmented which should be enough for 99% of the cases,
3287          * and another one (which we configure here to be 900TU long) which
3288          * will have a slightly lower priority, but more importantly, can be
3289          * fragmented so that it'll allow other activities to run.
3290          */
3291         if (fw_has_capa(&mvm->fw->ucode_capa,
3292                         IWL_UCODE_TLV_CAPA_SESSION_PROT_CMD))
3293                 iwl_mvm_schedule_session_protection(mvm, vif, 900,
3294                                                     min_duration, false);
3295         else
3296                 iwl_mvm_protect_session(mvm, vif, duration,
3297                                         min_duration, 500, false);
3298         mutex_unlock(&mvm->mutex);
3299 }
3300
3301 static int iwl_mvm_mac_sched_scan_start(struct ieee80211_hw *hw,
3302                                         struct ieee80211_vif *vif,
3303                                         struct cfg80211_sched_scan_request *req,
3304                                         struct ieee80211_scan_ies *ies)
3305 {
3306         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3307
3308         int ret;
3309
3310         mutex_lock(&mvm->mutex);
3311
3312         if (!vif->bss_conf.idle) {
3313                 ret = -EBUSY;
3314                 goto out;
3315         }
3316
3317         ret = iwl_mvm_sched_scan_start(mvm, vif, req, ies, IWL_MVM_SCAN_SCHED);
3318
3319 out:
3320         mutex_unlock(&mvm->mutex);
3321         return ret;
3322 }
3323
3324 static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
3325                                        struct ieee80211_vif *vif)
3326 {
3327         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3328         int ret;
3329
3330         mutex_lock(&mvm->mutex);
3331
3332         /* Due to a race condition, it's possible that mac80211 asks
3333          * us to stop a sched_scan when it's already stopped.  This
3334          * can happen, for instance, if we stopped the scan ourselves,
3335          * called ieee80211_sched_scan_stopped() and the userspace called
3336          * stop sched scan scan before ieee80211_sched_scan_stopped_work()
3337          * could run.  To handle this, simply return if the scan is
3338          * not running.
3339         */
3340         if (!(mvm->scan_status & IWL_MVM_SCAN_SCHED)) {
3341                 mutex_unlock(&mvm->mutex);
3342                 return 0;
3343         }
3344
3345         ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, false);
3346         mutex_unlock(&mvm->mutex);
3347         iwl_mvm_wait_for_async_handlers(mvm);
3348
3349         return ret;
3350 }
3351
3352 static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
3353                                  enum set_key_cmd cmd,
3354                                  struct ieee80211_vif *vif,
3355                                  struct ieee80211_sta *sta,
3356                                  struct ieee80211_key_conf *key)
3357 {
3358         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3359         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3360         struct iwl_mvm_sta *mvmsta;
3361         struct iwl_mvm_key_pn *ptk_pn;
3362         int keyidx = key->keyidx;
3363         int ret, i;
3364         u8 key_offset;
3365
3366         if (iwlwifi_mod_params.swcrypto) {
3367                 IWL_DEBUG_MAC80211(mvm, "leave - hwcrypto disabled\n");
3368                 return -EOPNOTSUPP;
3369         }
3370
3371         switch (key->cipher) {
3372         case WLAN_CIPHER_SUITE_TKIP:
3373                 if (!mvm->trans->trans_cfg->gen2) {
3374                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3375                         key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3376                 } else if (vif->type == NL80211_IFTYPE_STATION) {
3377                         key->flags |= IEEE80211_KEY_FLAG_PUT_MIC_SPACE;
3378                 } else {
3379                         IWL_DEBUG_MAC80211(mvm, "Use SW encryption for TKIP\n");
3380                         return -EOPNOTSUPP;
3381                 }
3382                 break;
3383         case WLAN_CIPHER_SUITE_CCMP:
3384         case WLAN_CIPHER_SUITE_GCMP:
3385         case WLAN_CIPHER_SUITE_GCMP_256:
3386                 if (!iwl_mvm_has_new_tx_api(mvm))
3387                         key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3388                 break;
3389         case WLAN_CIPHER_SUITE_AES_CMAC:
3390         case WLAN_CIPHER_SUITE_BIP_GMAC_128:
3391         case WLAN_CIPHER_SUITE_BIP_GMAC_256:
3392                 WARN_ON_ONCE(!ieee80211_hw_check(hw, MFP_CAPABLE));
3393                 break;
3394         case WLAN_CIPHER_SUITE_WEP40:
3395         case WLAN_CIPHER_SUITE_WEP104:
3396                 if (vif->type == NL80211_IFTYPE_STATION)
3397                         break;
3398                 if (iwl_mvm_has_new_tx_api(mvm))
3399                         return -EOPNOTSUPP;
3400                 /* support HW crypto on TX */
3401                 return 0;
3402         default:
3403                 /* currently FW supports only one optional cipher scheme */
3404                 if (hw->n_cipher_schemes &&
3405                     hw->cipher_schemes->cipher == key->cipher)
3406                         key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3407                 else
3408                         return -EOPNOTSUPP;
3409         }
3410
3411         switch (cmd) {
3412         case SET_KEY:
3413                 if ((vif->type == NL80211_IFTYPE_ADHOC ||
3414                      vif->type == NL80211_IFTYPE_AP) && !sta) {
3415                         /*
3416                          * GTK on AP interface is a TX-only key, return 0;
3417                          * on IBSS they're per-station and because we're lazy
3418                          * we don't support them for RX, so do the same.
3419                          * CMAC/GMAC in AP/IBSS modes must be done in software.
3420                          */
3421                         if (key->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
3422                             key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
3423                             key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256)
3424                                 ret = -EOPNOTSUPP;
3425                         else
3426                                 ret = 0;
3427
3428                         if (key->cipher != WLAN_CIPHER_SUITE_GCMP &&
3429                             key->cipher != WLAN_CIPHER_SUITE_GCMP_256 &&
3430                             !iwl_mvm_has_new_tx_api(mvm)) {
3431                                 key->hw_key_idx = STA_KEY_IDX_INVALID;
3432                                 break;
3433                         }
3434
3435                         if (!mvmvif->ap_ibss_active) {
3436                                 for (i = 0;
3437                                      i < ARRAY_SIZE(mvmvif->ap_early_keys);
3438                                      i++) {
3439                                         if (!mvmvif->ap_early_keys[i]) {
3440                                                 mvmvif->ap_early_keys[i] = key;
3441                                                 break;
3442                                         }
3443                                 }
3444
3445                                 if (i >= ARRAY_SIZE(mvmvif->ap_early_keys))
3446                                         ret = -ENOSPC;
3447
3448                                 break;
3449                         }
3450                 }
3451
3452                 /* During FW restart, in order to restore the state as it was,
3453                  * don't try to reprogram keys we previously failed for.
3454                  */
3455                 if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
3456                     key->hw_key_idx == STA_KEY_IDX_INVALID) {
3457                         IWL_DEBUG_MAC80211(mvm,
3458                                            "skip invalid idx key programming during restart\n");
3459                         ret = 0;
3460                         break;
3461                 }
3462
3463                 if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
3464                     sta && iwl_mvm_has_new_rx_api(mvm) &&
3465                     key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
3466                     (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
3467                      key->cipher == WLAN_CIPHER_SUITE_GCMP ||
3468                      key->cipher == WLAN_CIPHER_SUITE_GCMP_256)) {
3469                         struct ieee80211_key_seq seq;
3470                         int tid, q;
3471
3472                         mvmsta = iwl_mvm_sta_from_mac80211(sta);
3473                         WARN_ON(rcu_access_pointer(mvmsta->ptk_pn[keyidx]));
3474                         ptk_pn = kzalloc(struct_size(ptk_pn, q,
3475                                                      mvm->trans->num_rx_queues),
3476                                          GFP_KERNEL);
3477                         if (!ptk_pn) {
3478                                 ret = -ENOMEM;
3479                                 break;
3480                         }
3481
3482                         for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++) {
3483                                 ieee80211_get_key_rx_seq(key, tid, &seq);
3484                                 for (q = 0; q < mvm->trans->num_rx_queues; q++)
3485                                         memcpy(ptk_pn->q[q].pn[tid],
3486                                                seq.ccmp.pn,
3487                                                IEEE80211_CCMP_PN_LEN);
3488                         }
3489
3490                         rcu_assign_pointer(mvmsta->ptk_pn[keyidx], ptk_pn);
3491                 }
3492
3493                 /* in HW restart reuse the index, otherwise request a new one */
3494                 if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
3495                         key_offset = key->hw_key_idx;
3496                 else
3497                         key_offset = STA_KEY_IDX_INVALID;
3498
3499                 IWL_DEBUG_MAC80211(mvm, "set hwcrypto key\n");
3500                 ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, key_offset);
3501                 if (ret) {
3502                         IWL_WARN(mvm, "set key failed\n");
3503                         key->hw_key_idx = STA_KEY_IDX_INVALID;
3504                         /*
3505                          * can't add key for RX, but we don't need it
3506                          * in the device for TX so still return 0,
3507                          * unless we have new TX API where we cannot
3508                          * put key material into the TX_CMD
3509                          */
3510                         if (iwl_mvm_has_new_tx_api(mvm))
3511                                 ret = -EOPNOTSUPP;
3512                         else
3513                                 ret = 0;
3514                 }
3515
3516                 break;
3517         case DISABLE_KEY:
3518                 ret = -ENOENT;
3519                 for (i = 0; i < ARRAY_SIZE(mvmvif->ap_early_keys); i++) {
3520                         if (mvmvif->ap_early_keys[i] == key) {
3521                                 mvmvif->ap_early_keys[i] = NULL;
3522                                 ret = 0;
3523                         }
3524                 }
3525
3526                 /* found in pending list - don't do anything else */
3527                 if (ret == 0)
3528                         break;
3529
3530                 if (key->hw_key_idx == STA_KEY_IDX_INVALID) {
3531                         ret = 0;
3532                         break;
3533                 }
3534
3535                 if (sta && iwl_mvm_has_new_rx_api(mvm) &&
3536                     key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
3537                     (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
3538                      key->cipher == WLAN_CIPHER_SUITE_GCMP ||
3539                      key->cipher == WLAN_CIPHER_SUITE_GCMP_256)) {
3540                         mvmsta = iwl_mvm_sta_from_mac80211(sta);
3541                         ptk_pn = rcu_dereference_protected(
3542                                                 mvmsta->ptk_pn[keyidx],
3543                                                 lockdep_is_held(&mvm->mutex));
3544                         RCU_INIT_POINTER(mvmsta->ptk_pn[keyidx], NULL);
3545                         if (ptk_pn)
3546                                 kfree_rcu(ptk_pn, rcu_head);
3547                 }
3548
3549                 IWL_DEBUG_MAC80211(mvm, "disable hwcrypto key\n");
3550                 ret = iwl_mvm_remove_sta_key(mvm, vif, sta, key);
3551                 break;
3552         default:
3553                 ret = -EINVAL;
3554         }
3555
3556         return ret;
3557 }
3558
3559 static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
3560                                enum set_key_cmd cmd,
3561                                struct ieee80211_vif *vif,
3562                                struct ieee80211_sta *sta,
3563                                struct ieee80211_key_conf *key)
3564 {
3565         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3566         int ret;
3567
3568         mutex_lock(&mvm->mutex);
3569         ret = __iwl_mvm_mac_set_key(hw, cmd, vif, sta, key);
3570         mutex_unlock(&mvm->mutex);
3571
3572         return ret;
3573 }
3574
3575 static void iwl_mvm_mac_update_tkip_key(struct ieee80211_hw *hw,
3576                                         struct ieee80211_vif *vif,
3577                                         struct ieee80211_key_conf *keyconf,
3578                                         struct ieee80211_sta *sta,
3579                                         u32 iv32, u16 *phase1key)
3580 {
3581         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3582
3583         if (keyconf->hw_key_idx == STA_KEY_IDX_INVALID)
3584                 return;
3585
3586         iwl_mvm_update_tkip_key(mvm, vif, keyconf, sta, iv32, phase1key);
3587 }
3588
3589
3590 static bool iwl_mvm_rx_aux_roc(struct iwl_notif_wait_data *notif_wait,
3591                                struct iwl_rx_packet *pkt, void *data)
3592 {
3593         struct iwl_mvm *mvm =
3594                 container_of(notif_wait, struct iwl_mvm, notif_wait);
3595         struct iwl_hs20_roc_res *resp;
3596         int resp_len = iwl_rx_packet_payload_len(pkt);
3597         struct iwl_mvm_time_event_data *te_data = data;
3598
3599         if (WARN_ON(pkt->hdr.cmd != HOT_SPOT_CMD))
3600                 return true;
3601
3602         if (WARN_ON_ONCE(resp_len != sizeof(*resp))) {
3603                 IWL_ERR(mvm, "Invalid HOT_SPOT_CMD response\n");
3604                 return true;
3605         }
3606
3607         resp = (void *)pkt->data;
3608
3609         IWL_DEBUG_TE(mvm,
3610                      "Aux ROC: Received response from ucode: status=%d uid=%d\n",
3611                      resp->status, resp->event_unique_id);
3612
3613         te_data->uid = le32_to_cpu(resp->event_unique_id);
3614         IWL_DEBUG_TE(mvm, "TIME_EVENT_CMD response - UID = 0x%x\n",
3615                      te_data->uid);
3616
3617         spin_lock_bh(&mvm->time_event_lock);
3618         list_add_tail(&te_data->list, &mvm->aux_roc_te_list);
3619         spin_unlock_bh(&mvm->time_event_lock);
3620
3621         return true;
3622 }
3623
3624 #define AUX_ROC_MIN_DURATION MSEC_TO_TU(100)
3625 #define AUX_ROC_MIN_DELAY MSEC_TO_TU(200)
3626 #define AUX_ROC_MAX_DELAY MSEC_TO_TU(600)
3627 #define AUX_ROC_SAFETY_BUFFER MSEC_TO_TU(20)
3628 #define AUX_ROC_MIN_SAFETY_BUFFER MSEC_TO_TU(10)
3629 static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm,
3630                                     struct ieee80211_channel *channel,
3631                                     struct ieee80211_vif *vif,
3632                                     int duration)
3633 {
3634         int res;
3635         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3636         struct iwl_mvm_time_event_data *te_data = &mvmvif->hs_time_event_data;
3637         static const u16 time_event_response[] = { HOT_SPOT_CMD };
3638         struct iwl_notification_wait wait_time_event;
3639         u32 dtim_interval = vif->bss_conf.dtim_period *
3640                 vif->bss_conf.beacon_int;
3641         u32 req_dur, delay;
3642         struct iwl_hs20_roc_req aux_roc_req = {
3643                 .action = cpu_to_le32(FW_CTXT_ACTION_ADD),
3644                 .id_and_color =
3645                         cpu_to_le32(FW_CMD_ID_AND_COLOR(MAC_INDEX_AUX, 0)),
3646                 .sta_id_and_color = cpu_to_le32(mvm->aux_sta.sta_id),
3647         };
3648         struct iwl_hs20_roc_req_tail *tail = iwl_mvm_chan_info_cmd_tail(mvm,
3649                 &aux_roc_req.channel_info);
3650         u16 len = sizeof(aux_roc_req) - iwl_mvm_chan_info_padding(mvm);
3651
3652         /* Set the channel info data */
3653         iwl_mvm_set_chan_info(mvm, &aux_roc_req.channel_info, channel->hw_value,
3654                               iwl_mvm_phy_band_from_nl80211(channel->band),
3655                               PHY_VHT_CHANNEL_MODE20,
3656                               0);
3657
3658         /* Set the time and duration */
3659         tail->apply_time = cpu_to_le32(iwl_mvm_get_systime(mvm));
3660
3661         delay = AUX_ROC_MIN_DELAY;
3662         req_dur = MSEC_TO_TU(duration);
3663
3664         /*
3665          * If we are associated we want the delay time to be at least one
3666          * dtim interval so that the FW can wait until after the DTIM and
3667          * then start the time event, this will potentially allow us to
3668          * remain off-channel for the max duration.
3669          * Since we want to use almost a whole dtim interval we would also
3670          * like the delay to be for 2-3 dtim intervals, in case there are
3671          * other time events with higher priority.
3672          */
3673         if (vif->bss_conf.assoc) {
3674                 delay = min_t(u32, dtim_interval * 3, AUX_ROC_MAX_DELAY);
3675                 /* We cannot remain off-channel longer than the DTIM interval */
3676                 if (dtim_interval <= req_dur) {
3677                         req_dur = dtim_interval - AUX_ROC_SAFETY_BUFFER;
3678                         if (req_dur <= AUX_ROC_MIN_DURATION)
3679                                 req_dur = dtim_interval -
3680                                         AUX_ROC_MIN_SAFETY_BUFFER;
3681                 }
3682         }
3683
3684         tail->duration = cpu_to_le32(req_dur);
3685         tail->apply_time_max_delay = cpu_to_le32(delay);
3686
3687         IWL_DEBUG_TE(mvm,
3688                      "ROC: Requesting to remain on channel %u for %ums (requested = %ums, max_delay = %ums, dtim_interval = %ums)\n",
3689                      channel->hw_value, req_dur, duration, delay,
3690                      dtim_interval);
3691         /* Set the node address */
3692         memcpy(tail->node_addr, vif->addr, ETH_ALEN);
3693
3694         lockdep_assert_held(&mvm->mutex);
3695
3696         spin_lock_bh(&mvm->time_event_lock);
3697
3698         if (WARN_ON(te_data->id == HOT_SPOT_CMD)) {
3699                 spin_unlock_bh(&mvm->time_event_lock);
3700                 return -EIO;
3701         }
3702
3703         te_data->vif = vif;
3704         te_data->duration = duration;
3705         te_data->id = HOT_SPOT_CMD;
3706
3707         spin_unlock_bh(&mvm->time_event_lock);
3708
3709         /*
3710          * Use a notification wait, which really just processes the
3711          * command response and doesn't wait for anything, in order
3712          * to be able to process the response and get the UID inside
3713          * the RX path. Using CMD_WANT_SKB doesn't work because it
3714          * stores the buffer and then wakes up this thread, by which
3715          * time another notification (that the time event started)
3716          * might already be processed unsuccessfully.
3717          */
3718         iwl_init_notification_wait(&mvm->notif_wait, &wait_time_event,
3719                                    time_event_response,
3720                                    ARRAY_SIZE(time_event_response),
3721                                    iwl_mvm_rx_aux_roc, te_data);
3722
3723         res = iwl_mvm_send_cmd_pdu(mvm, HOT_SPOT_CMD, 0, len,
3724                                    &aux_roc_req);
3725
3726         if (res) {
3727                 IWL_ERR(mvm, "Couldn't send HOT_SPOT_CMD: %d\n", res);
3728                 iwl_remove_notification(&mvm->notif_wait, &wait_time_event);
3729                 goto out_clear_te;
3730         }
3731
3732         /* No need to wait for anything, so just pass 1 (0 isn't valid) */
3733         res = iwl_wait_notification(&mvm->notif_wait, &wait_time_event, 1);
3734         /* should never fail */
3735         WARN_ON_ONCE(res);
3736
3737         if (res) {
3738  out_clear_te:
3739                 spin_lock_bh(&mvm->time_event_lock);
3740                 iwl_mvm_te_clear_data(mvm, te_data);
3741                 spin_unlock_bh(&mvm->time_event_lock);
3742         }
3743
3744         return res;
3745 }
3746
3747 static int iwl_mvm_roc(struct ieee80211_hw *hw,
3748                        struct ieee80211_vif *vif,
3749                        struct ieee80211_channel *channel,
3750                        int duration,
3751                        enum ieee80211_roc_type type)
3752 {
3753         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3754         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3755         struct cfg80211_chan_def chandef;
3756         struct iwl_mvm_phy_ctxt *phy_ctxt;
3757         int ret, i;
3758
3759         IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value,
3760                            duration, type);
3761
3762         /*
3763          * Flush the done work, just in case it's still pending, so that
3764          * the work it does can complete and we can accept new frames.
3765          */
3766         flush_work(&mvm->roc_done_wk);
3767
3768         mutex_lock(&mvm->mutex);
3769
3770         switch (vif->type) {
3771         case NL80211_IFTYPE_STATION:
3772                 if (fw_has_capa(&mvm->fw->ucode_capa,
3773                                 IWL_UCODE_TLV_CAPA_HOTSPOT_SUPPORT)) {
3774                         /* Use aux roc framework (HS20) */
3775                         ret = iwl_mvm_send_aux_roc_cmd(mvm, channel,
3776                                                        vif, duration);
3777                         goto out_unlock;
3778                 }
3779                 IWL_ERR(mvm, "hotspot not supported\n");
3780                 ret = -EINVAL;
3781                 goto out_unlock;
3782         case NL80211_IFTYPE_P2P_DEVICE:
3783                 /* handle below */
3784                 break;
3785         default:
3786                 IWL_ERR(mvm, "vif isn't P2P_DEVICE: %d\n", vif->type);
3787                 ret = -EINVAL;
3788                 goto out_unlock;
3789         }
3790
3791         for (i = 0; i < NUM_PHY_CTX; i++) {
3792                 phy_ctxt = &mvm->phy_ctxts[i];
3793                 if (phy_ctxt->ref == 0 || mvmvif->phy_ctxt == phy_ctxt)
3794                         continue;
3795
3796                 if (phy_ctxt->ref && channel == phy_ctxt->channel) {
3797                         /*
3798                          * Unbind the P2P_DEVICE from the current PHY context,
3799                          * and if the PHY context is not used remove it.
3800                          */
3801                         ret = iwl_mvm_binding_remove_vif(mvm, vif);
3802                         if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3803                                 goto out_unlock;
3804
3805                         iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3806
3807                         /* Bind the P2P_DEVICE to the current PHY Context */
3808                         mvmvif->phy_ctxt = phy_ctxt;
3809
3810                         ret = iwl_mvm_binding_add_vif(mvm, vif);
3811                         if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3812                                 goto out_unlock;
3813
3814                         iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3815                         goto schedule_time_event;
3816                 }
3817         }
3818
3819         /* Need to update the PHY context only if the ROC channel changed */
3820         if (channel == mvmvif->phy_ctxt->channel)
3821                 goto schedule_time_event;
3822
3823         cfg80211_chandef_create(&chandef, channel, NL80211_CHAN_NO_HT);
3824
3825         /*
3826          * Change the PHY context configuration as it is currently referenced
3827          * only by the P2P Device MAC
3828          */
3829         if (mvmvif->phy_ctxt->ref == 1) {
3830                 ret = iwl_mvm_phy_ctxt_changed(mvm, mvmvif->phy_ctxt,
3831                                                &chandef, 1, 1);
3832                 if (ret)
3833                         goto out_unlock;
3834         } else {
3835                 /*
3836                  * The PHY context is shared with other MACs. Need to remove the
3837                  * P2P Device from the binding, allocate an new PHY context and
3838                  * create a new binding
3839                  */
3840                 phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3841                 if (!phy_ctxt) {
3842                         ret = -ENOSPC;
3843                         goto out_unlock;
3844                 }
3845
3846                 ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &chandef,
3847                                                1, 1);
3848                 if (ret) {
3849                         IWL_ERR(mvm, "Failed to change PHY context\n");
3850                         goto out_unlock;
3851                 }
3852
3853                 /* Unbind the P2P_DEVICE from the current PHY context */
3854                 ret = iwl_mvm_binding_remove_vif(mvm, vif);
3855                 if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3856                         goto out_unlock;
3857
3858                 iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3859
3860                 /* Bind the P2P_DEVICE to the new allocated PHY context */
3861                 mvmvif->phy_ctxt = phy_ctxt;
3862
3863                 ret = iwl_mvm_binding_add_vif(mvm, vif);
3864                 if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3865                         goto out_unlock;
3866
3867                 iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3868         }
3869
3870 schedule_time_event:
3871         /* Schedule the time events */
3872         ret = iwl_mvm_start_p2p_roc(mvm, vif, duration, type);
3873
3874 out_unlock:
3875         mutex_unlock(&mvm->mutex);
3876         IWL_DEBUG_MAC80211(mvm, "leave\n");
3877         return ret;
3878 }
3879
3880 static int iwl_mvm_cancel_roc(struct ieee80211_hw *hw,
3881                               struct ieee80211_vif *vif)
3882 {
3883         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3884
3885         IWL_DEBUG_MAC80211(mvm, "enter\n");
3886
3887         mutex_lock(&mvm->mutex);
3888         iwl_mvm_stop_roc(mvm, vif);
3889         mutex_unlock(&mvm->mutex);
3890
3891         IWL_DEBUG_MAC80211(mvm, "leave\n");
3892         return 0;
3893 }
3894
3895 struct iwl_mvm_ftm_responder_iter_data {
3896         bool responder;
3897         struct ieee80211_chanctx_conf *ctx;
3898 };
3899
3900 static void iwl_mvm_ftm_responder_chanctx_iter(void *_data, u8 *mac,
3901                                                struct ieee80211_vif *vif)
3902 {
3903         struct iwl_mvm_ftm_responder_iter_data *data = _data;
3904
3905         if (rcu_access_pointer(vif->chanctx_conf) == data->ctx &&
3906             vif->type == NL80211_IFTYPE_AP && vif->bss_conf.ftmr_params)
3907                 data->responder = true;
3908 }
3909
3910 static bool iwl_mvm_is_ftm_responder_chanctx(struct iwl_mvm *mvm,
3911                                              struct ieee80211_chanctx_conf *ctx)
3912 {
3913         struct iwl_mvm_ftm_responder_iter_data data = {
3914                 .responder = false,
3915                 .ctx = ctx,
3916         };
3917
3918         ieee80211_iterate_active_interfaces_atomic(mvm->hw,
3919                                         IEEE80211_IFACE_ITER_NORMAL,
3920                                         iwl_mvm_ftm_responder_chanctx_iter,
3921                                         &data);
3922         return data.responder;
3923 }
3924
3925 static int __iwl_mvm_add_chanctx(struct iwl_mvm *mvm,
3926                                  struct ieee80211_chanctx_conf *ctx)
3927 {
3928         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3929         struct iwl_mvm_phy_ctxt *phy_ctxt;
3930         bool responder = iwl_mvm_is_ftm_responder_chanctx(mvm, ctx);
3931         struct cfg80211_chan_def *def = responder ? &ctx->def : &ctx->min_def;
3932         int ret;
3933
3934         lockdep_assert_held(&mvm->mutex);
3935
3936         IWL_DEBUG_MAC80211(mvm, "Add channel context\n");
3937
3938         phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3939         if (!phy_ctxt) {
3940                 ret = -ENOSPC;
3941                 goto out;
3942         }
3943
3944         ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, def,
3945                                        ctx->rx_chains_static,
3946                                        ctx->rx_chains_dynamic);
3947         if (ret) {
3948                 IWL_ERR(mvm, "Failed to add PHY context\n");
3949                 goto out;
3950         }
3951
3952         iwl_mvm_phy_ctxt_ref(mvm, phy_ctxt);
3953         *phy_ctxt_id = phy_ctxt->id;
3954 out:
3955         return ret;
3956 }
3957
3958 static int iwl_mvm_add_chanctx(struct ieee80211_hw *hw,
3959                                struct ieee80211_chanctx_conf *ctx)
3960 {
3961         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3962         int ret;
3963
3964         mutex_lock(&mvm->mutex);
3965         ret = __iwl_mvm_add_chanctx(mvm, ctx);
3966         mutex_unlock(&mvm->mutex);
3967
3968         return ret;
3969 }
3970
3971 static void __iwl_mvm_remove_chanctx(struct iwl_mvm *mvm,
3972                                      struct ieee80211_chanctx_conf *ctx)
3973 {
3974         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3975         struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3976
3977         lockdep_assert_held(&mvm->mutex);
3978
3979         iwl_mvm_phy_ctxt_unref(mvm, phy_ctxt);
3980 }
3981
3982 static void iwl_mvm_remove_chanctx(struct ieee80211_hw *hw,
3983                                    struct ieee80211_chanctx_conf *ctx)
3984 {
3985         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3986
3987         mutex_lock(&mvm->mutex);
3988         __iwl_mvm_remove_chanctx(mvm, ctx);
3989         mutex_unlock(&mvm->mutex);
3990 }
3991
3992 static void iwl_mvm_change_chanctx(struct ieee80211_hw *hw,
3993                                    struct ieee80211_chanctx_conf *ctx,
3994                                    u32 changed)
3995 {
3996         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3997         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3998         struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3999         bool responder = iwl_mvm_is_ftm_responder_chanctx(mvm, ctx);
4000         struct cfg80211_chan_def *def = responder ? &ctx->def : &ctx->min_def;
4001
4002         if (WARN_ONCE((phy_ctxt->ref > 1) &&
4003                       (changed & ~(IEEE80211_CHANCTX_CHANGE_WIDTH |
4004                                    IEEE80211_CHANCTX_CHANGE_RX_CHAINS |
4005                                    IEEE80211_CHANCTX_CHANGE_RADAR |
4006                                    IEEE80211_CHANCTX_CHANGE_MIN_WIDTH)),
4007                       "Cannot change PHY. Ref=%d, changed=0x%X\n",
4008                       phy_ctxt->ref, changed))
4009                 return;
4010
4011         mutex_lock(&mvm->mutex);
4012
4013         /* we are only changing the min_width, may be a noop */
4014         if (changed == IEEE80211_CHANCTX_CHANGE_MIN_WIDTH) {
4015                 if (phy_ctxt->width == def->width)
4016                         goto out_unlock;
4017
4018                 /* we are just toggling between 20_NOHT and 20 */
4019                 if (phy_ctxt->width <= NL80211_CHAN_WIDTH_20 &&
4020                     def->width <= NL80211_CHAN_WIDTH_20)
4021                         goto out_unlock;
4022         }
4023
4024         iwl_mvm_bt_coex_vif_change(mvm);
4025         iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, def,
4026                                  ctx->rx_chains_static,
4027                                  ctx->rx_chains_dynamic);
4028
4029 out_unlock:
4030         mutex_unlock(&mvm->mutex);
4031 }
4032
4033 static int __iwl_mvm_assign_vif_chanctx(struct iwl_mvm *mvm,
4034                                         struct ieee80211_vif *vif,
4035                                         struct ieee80211_chanctx_conf *ctx,
4036                                         bool switching_chanctx)
4037 {
4038         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
4039         struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
4040         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4041         int ret;
4042
4043         lockdep_assert_held(&mvm->mutex);
4044
4045         mvmvif->phy_ctxt = phy_ctxt;
4046
4047         switch (vif->type) {
4048         case NL80211_IFTYPE_AP:
4049                 /* only needed if we're switching chanctx (i.e. during CSA) */
4050                 if (switching_chanctx) {
4051                         mvmvif->ap_ibss_active = true;
4052                         break;
4053                 }
4054                 /* fall through */
4055         case NL80211_IFTYPE_ADHOC:
4056                 /*
4057                  * The AP binding flow is handled as part of the start_ap flow
4058                  * (in bss_info_changed), similarly for IBSS.
4059                  */
4060                 ret = 0;
4061                 goto out;
4062         case NL80211_IFTYPE_STATION:
4063                 mvmvif->csa_bcn_pending = false;
4064                 break;
4065         case NL80211_IFTYPE_MONITOR:
4066                 /* always disable PS when a monitor interface is active */
4067                 mvmvif->ps_disabled = true;
4068                 break;
4069         default:
4070                 ret = -EINVAL;
4071                 goto out;
4072         }
4073
4074         ret = iwl_mvm_binding_add_vif(mvm, vif);
4075         if (ret)
4076                 goto out;
4077
4078         /*
4079          * Power state must be updated before quotas,
4080          * otherwise fw will complain.
4081          */
4082         iwl_mvm_power_update_mac(mvm);
4083
4084         /* Setting the quota at this stage is only required for monitor
4085          * interfaces. For the other types, the bss_info changed flow
4086          * will handle quota settings.
4087          */
4088         if (vif->type == NL80211_IFTYPE_MONITOR) {
4089                 mvmvif->monitor_active = true;
4090                 ret = iwl_mvm_update_quotas(mvm, false, NULL);
4091                 if (ret)
4092                         goto out_remove_binding;
4093
4094                 ret = iwl_mvm_add_snif_sta(mvm, vif);
4095                 if (ret)
4096                         goto out_remove_binding;
4097
4098         }
4099
4100         /* Handle binding during CSA */
4101         if (vif->type == NL80211_IFTYPE_AP) {
4102                 iwl_mvm_update_quotas(mvm, false, NULL);
4103                 iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
4104         }
4105
4106         if (switching_chanctx && vif->type == NL80211_IFTYPE_STATION) {
4107                 mvmvif->csa_bcn_pending = true;
4108
4109                 if (!fw_has_capa(&mvm->fw->ucode_capa,
4110                                  IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
4111                         u32 duration = 3 * vif->bss_conf.beacon_int;
4112
4113                         /* Protect the session to make sure we hear the first
4114                          * beacon on the new channel.
4115                          */
4116                         iwl_mvm_protect_session(mvm, vif, duration, duration,
4117                                                 vif->bss_conf.beacon_int / 2,
4118                                                 true);
4119                 }
4120
4121                 iwl_mvm_update_quotas(mvm, false, NULL);
4122         }
4123
4124         goto out;
4125
4126 out_remove_binding:
4127         iwl_mvm_binding_remove_vif(mvm, vif);
4128         iwl_mvm_power_update_mac(mvm);
4129 out:
4130         if (ret)
4131                 mvmvif->phy_ctxt = NULL;
4132         return ret;
4133 }
4134 static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
4135                                       struct ieee80211_vif *vif,
4136                                       struct ieee80211_chanctx_conf *ctx)
4137 {
4138         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4139         int ret;
4140
4141         mutex_lock(&mvm->mutex);
4142         ret = __iwl_mvm_assign_vif_chanctx(mvm, vif, ctx, false);
4143         mutex_unlock(&mvm->mutex);
4144
4145         return ret;
4146 }
4147
4148 static void __iwl_mvm_unassign_vif_chanctx(struct iwl_mvm *mvm,
4149                                            struct ieee80211_vif *vif,
4150                                            struct ieee80211_chanctx_conf *ctx,
4151                                            bool switching_chanctx)
4152 {
4153         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4154         struct ieee80211_vif *disabled_vif = NULL;
4155
4156         lockdep_assert_held(&mvm->mutex);
4157
4158         iwl_mvm_remove_time_event(mvm, mvmvif, &mvmvif->time_event_data);
4159
4160         switch (vif->type) {
4161         case NL80211_IFTYPE_ADHOC:
4162                 goto out;
4163         case NL80211_IFTYPE_MONITOR:
4164                 mvmvif->monitor_active = false;
4165                 mvmvif->ps_disabled = false;
4166                 iwl_mvm_rm_snif_sta(mvm, vif);
4167                 break;
4168         case NL80211_IFTYPE_AP:
4169                 /* This part is triggered only during CSA */
4170                 if (!switching_chanctx || !mvmvif->ap_ibss_active)
4171                         goto out;
4172
4173                 mvmvif->csa_countdown = false;
4174
4175                 /* Set CS bit on all the stations */
4176                 iwl_mvm_modify_all_sta_disable_tx(mvm, mvmvif, true);
4177
4178                 /* Save blocked iface, the timeout is set on the next beacon */
4179                 rcu_assign_pointer(mvm->csa_tx_blocked_vif, vif);
4180
4181                 mvmvif->ap_ibss_active = false;
4182                 break;
4183         case NL80211_IFTYPE_STATION:
4184                 if (!switching_chanctx)
4185                         break;
4186
4187                 disabled_vif = vif;
4188
4189                 if (!fw_has_capa(&mvm->fw->ucode_capa,
4190                                  IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD))
4191                         iwl_mvm_mac_ctxt_changed(mvm, vif, true, NULL);
4192                 break;
4193         default:
4194                 break;
4195         }
4196
4197         iwl_mvm_update_quotas(mvm, false, disabled_vif);
4198         iwl_mvm_binding_remove_vif(mvm, vif);
4199
4200 out:
4201         mvmvif->phy_ctxt = NULL;
4202         iwl_mvm_power_update_mac(mvm);
4203 }
4204
4205 static void iwl_mvm_unassign_vif_chanctx(struct ieee80211_hw *hw,
4206                                          struct ieee80211_vif *vif,
4207                                          struct ieee80211_chanctx_conf *ctx)
4208 {
4209         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4210
4211         mutex_lock(&mvm->mutex);
4212         __iwl_mvm_unassign_vif_chanctx(mvm, vif, ctx, false);
4213         mutex_unlock(&mvm->mutex);
4214 }
4215
4216 static int
4217 iwl_mvm_switch_vif_chanctx_swap(struct iwl_mvm *mvm,
4218                                 struct ieee80211_vif_chanctx_switch *vifs)
4219 {
4220         int ret;
4221
4222         mutex_lock(&mvm->mutex);
4223         __iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
4224         __iwl_mvm_remove_chanctx(mvm, vifs[0].old_ctx);
4225
4226         ret = __iwl_mvm_add_chanctx(mvm, vifs[0].new_ctx);
4227         if (ret) {
4228                 IWL_ERR(mvm, "failed to add new_ctx during channel switch\n");
4229                 goto out_reassign;
4230         }
4231
4232         ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
4233                                            true);
4234         if (ret) {
4235                 IWL_ERR(mvm,
4236                         "failed to assign new_ctx during channel switch\n");
4237                 goto out_remove;
4238         }
4239
4240         /* we don't support TDLS during DCM - can be caused by channel switch */
4241         if (iwl_mvm_phy_ctx_count(mvm) > 1)
4242                 iwl_mvm_teardown_tdls_peers(mvm);
4243
4244         goto out;
4245
4246 out_remove:
4247         __iwl_mvm_remove_chanctx(mvm, vifs[0].new_ctx);
4248
4249 out_reassign:
4250         if (__iwl_mvm_add_chanctx(mvm, vifs[0].old_ctx)) {
4251                 IWL_ERR(mvm, "failed to add old_ctx back after failure.\n");
4252                 goto out_restart;
4253         }
4254
4255         if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
4256                                          true)) {
4257                 IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
4258                 goto out_restart;
4259         }
4260
4261         goto out;
4262
4263 out_restart:
4264         /* things keep failing, better restart the hw */
4265         iwl_mvm_nic_restart(mvm, false);
4266
4267 out:
4268         mutex_unlock(&mvm->mutex);
4269
4270         return ret;
4271 }
4272
4273 static int
4274 iwl_mvm_switch_vif_chanctx_reassign(struct iwl_mvm *mvm,
4275                                     struct ieee80211_vif_chanctx_switch *vifs)
4276 {
4277         int ret;
4278
4279         mutex_lock(&mvm->mutex);
4280         __iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
4281
4282         ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
4283                                            true);
4284         if (ret) {
4285                 IWL_ERR(mvm,
4286                         "failed to assign new_ctx during channel switch\n");
4287                 goto out_reassign;
4288         }
4289
4290         goto out;
4291
4292 out_reassign:
4293         if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
4294                                          true)) {
4295                 IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
4296                 goto out_restart;
4297         }
4298
4299         goto out;
4300
4301 out_restart:
4302         /* things keep failing, better restart the hw */
4303         iwl_mvm_nic_restart(mvm, false);
4304
4305 out:
4306         mutex_unlock(&mvm->mutex);
4307
4308         return ret;
4309 }
4310
4311 static int iwl_mvm_switch_vif_chanctx(struct ieee80211_hw *hw,
4312                                       struct ieee80211_vif_chanctx_switch *vifs,
4313                                       int n_vifs,
4314                                       enum ieee80211_chanctx_switch_mode mode)
4315 {
4316         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4317         int ret;
4318
4319         /* we only support a single-vif right now */
4320         if (n_vifs > 1)
4321                 return -EOPNOTSUPP;
4322
4323         switch (mode) {
4324         case CHANCTX_SWMODE_SWAP_CONTEXTS:
4325                 ret = iwl_mvm_switch_vif_chanctx_swap(mvm, vifs);
4326                 break;
4327         case CHANCTX_SWMODE_REASSIGN_VIF:
4328                 ret = iwl_mvm_switch_vif_chanctx_reassign(mvm, vifs);
4329                 break;
4330         default:
4331                 ret = -EOPNOTSUPP;
4332                 break;
4333         }
4334
4335         return ret;
4336 }
4337
4338 static int iwl_mvm_tx_last_beacon(struct ieee80211_hw *hw)
4339 {
4340         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4341
4342         return mvm->ibss_manager;
4343 }
4344
4345 static int iwl_mvm_set_tim(struct ieee80211_hw *hw,
4346                            struct ieee80211_sta *sta,
4347                            bool set)
4348 {
4349         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4350         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
4351
4352         if (!mvm_sta || !mvm_sta->vif) {
4353                 IWL_ERR(mvm, "Station is not associated to a vif\n");
4354                 return -EINVAL;
4355         }
4356
4357         return iwl_mvm_mac_ctxt_beacon_changed(mvm, mvm_sta->vif);
4358 }
4359
4360 #ifdef CONFIG_NL80211_TESTMODE
4361 static const struct nla_policy iwl_mvm_tm_policy[IWL_MVM_TM_ATTR_MAX + 1] = {
4362         [IWL_MVM_TM_ATTR_CMD] = { .type = NLA_U32 },
4363         [IWL_MVM_TM_ATTR_NOA_DURATION] = { .type = NLA_U32 },
4364         [IWL_MVM_TM_ATTR_BEACON_FILTER_STATE] = { .type = NLA_U32 },
4365 };
4366
4367 static int __iwl_mvm_mac_testmode_cmd(struct iwl_mvm *mvm,
4368                                       struct ieee80211_vif *vif,
4369                                       void *data, int len)
4370 {
4371         struct nlattr *tb[IWL_MVM_TM_ATTR_MAX + 1];
4372         int err;
4373         u32 noa_duration;
4374
4375         err = nla_parse_deprecated(tb, IWL_MVM_TM_ATTR_MAX, data, len,
4376                                    iwl_mvm_tm_policy, NULL);
4377         if (err)
4378                 return err;
4379
4380         if (!tb[IWL_MVM_TM_ATTR_CMD])
4381                 return -EINVAL;
4382
4383         switch (nla_get_u32(tb[IWL_MVM_TM_ATTR_CMD])) {
4384         case IWL_MVM_TM_CMD_SET_NOA:
4385                 if (!vif || vif->type != NL80211_IFTYPE_AP || !vif->p2p ||
4386                     !vif->bss_conf.enable_beacon ||
4387                     !tb[IWL_MVM_TM_ATTR_NOA_DURATION])
4388                         return -EINVAL;
4389
4390                 noa_duration = nla_get_u32(tb[IWL_MVM_TM_ATTR_NOA_DURATION]);
4391                 if (noa_duration >= vif->bss_conf.beacon_int)
4392                         return -EINVAL;
4393
4394                 mvm->noa_duration = noa_duration;
4395                 mvm->noa_vif = vif;
4396
4397                 return iwl_mvm_update_quotas(mvm, true, NULL);
4398         case IWL_MVM_TM_CMD_SET_BEACON_FILTER:
4399                 /* must be associated client vif - ignore authorized */
4400                 if (!vif || vif->type != NL80211_IFTYPE_STATION ||
4401                     !vif->bss_conf.assoc || !vif->bss_conf.dtim_period ||
4402                     !tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE])
4403                         return -EINVAL;
4404
4405                 if (nla_get_u32(tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE]))
4406                         return iwl_mvm_enable_beacon_filter(mvm, vif, 0);
4407                 return iwl_mvm_disable_beacon_filter(mvm, vif, 0);
4408         }
4409
4410         return -EOPNOTSUPP;
4411 }
4412
4413 static int iwl_mvm_mac_testmode_cmd(struct ieee80211_hw *hw,
4414                                     struct ieee80211_vif *vif,
4415                                     void *data, int len)
4416 {
4417         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4418         int err;
4419
4420         mutex_lock(&mvm->mutex);
4421         err = __iwl_mvm_mac_testmode_cmd(mvm, vif, data, len);
4422         mutex_unlock(&mvm->mutex);
4423
4424         return err;
4425 }
4426 #endif
4427
4428 static void iwl_mvm_channel_switch(struct ieee80211_hw *hw,
4429                                    struct ieee80211_vif *vif,
4430                                    struct ieee80211_channel_switch *chsw)
4431 {
4432         /* By implementing this operation, we prevent mac80211 from
4433          * starting its own channel switch timer, so that we can call
4434          * ieee80211_chswitch_done() ourselves at the right time
4435          * (which is when the absence time event starts).
4436          */
4437
4438         IWL_DEBUG_MAC80211(IWL_MAC80211_GET_MVM(hw),
4439                            "dummy channel switch op\n");
4440 }
4441
4442 static int iwl_mvm_schedule_client_csa(struct iwl_mvm *mvm,
4443                                        struct ieee80211_vif *vif,
4444                                        struct ieee80211_channel_switch *chsw)
4445 {
4446         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4447         struct iwl_chan_switch_te_cmd cmd = {
4448                 .mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
4449                                                           mvmvif->color)),
4450                 .action = cpu_to_le32(FW_CTXT_ACTION_ADD),
4451                 .tsf = cpu_to_le32(chsw->timestamp),
4452                 .cs_count = chsw->count,
4453                 .cs_mode = chsw->block_tx,
4454         };
4455
4456         lockdep_assert_held(&mvm->mutex);
4457
4458         if (chsw->delay)
4459                 cmd.cs_delayed_bcn_count =
4460                         DIV_ROUND_UP(chsw->delay, vif->bss_conf.beacon_int);
4461
4462         return iwl_mvm_send_cmd_pdu(mvm,
4463                                     WIDE_ID(MAC_CONF_GROUP,
4464                                             CHANNEL_SWITCH_TIME_EVENT_CMD),
4465                                     0, sizeof(cmd), &cmd);
4466 }
4467
4468 static int iwl_mvm_old_pre_chan_sw_sta(struct iwl_mvm *mvm,
4469                                        struct ieee80211_vif *vif,
4470                                        struct ieee80211_channel_switch *chsw)
4471 {
4472         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4473         u32 apply_time;
4474
4475         /* Schedule the time event to a bit before beacon 1,
4476          * to make sure we're in the new channel when the
4477          * GO/AP arrives. In case count <= 1 immediately schedule the
4478          * TE (this might result with some packet loss or connection
4479          * loss).
4480          */
4481         if (chsw->count <= 1)
4482                 apply_time = 0;
4483         else
4484                 apply_time = chsw->device_timestamp +
4485                         ((vif->bss_conf.beacon_int * (chsw->count - 1) -
4486                           IWL_MVM_CHANNEL_SWITCH_TIME_CLIENT) * 1024);
4487
4488         if (chsw->block_tx)
4489                 iwl_mvm_csa_client_absent(mvm, vif);
4490
4491         if (mvmvif->bf_data.bf_enabled) {
4492                 int ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
4493
4494                 if (ret)
4495                         return ret;
4496         }
4497
4498         iwl_mvm_schedule_csa_period(mvm, vif, vif->bss_conf.beacon_int,
4499                                     apply_time);
4500
4501         return 0;
4502 }
4503
4504 #define IWL_MAX_CSA_BLOCK_TX 1500
4505 static int iwl_mvm_pre_channel_switch(struct ieee80211_hw *hw,
4506                                       struct ieee80211_vif *vif,
4507                                       struct ieee80211_channel_switch *chsw)
4508 {
4509         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4510         struct ieee80211_vif *csa_vif;
4511         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4512         int ret;
4513
4514         mutex_lock(&mvm->mutex);
4515
4516         mvmvif->csa_failed = false;
4517
4518         IWL_DEBUG_MAC80211(mvm, "pre CSA to freq %d\n",
4519                            chsw->chandef.center_freq1);
4520
4521         iwl_fw_dbg_trigger_simple_stop(&mvm->fwrt,
4522                                        ieee80211_vif_to_wdev(vif),
4523                                        FW_DBG_TRIGGER_CHANNEL_SWITCH);
4524
4525         switch (vif->type) {
4526         case NL80211_IFTYPE_AP:
4527                 csa_vif =
4528                         rcu_dereference_protected(mvm->csa_vif,
4529                                                   lockdep_is_held(&mvm->mutex));
4530                 if (WARN_ONCE(csa_vif && csa_vif->csa_active,
4531                               "Another CSA is already in progress")) {
4532                         ret = -EBUSY;
4533                         goto out_unlock;
4534                 }
4535
4536                 /* we still didn't unblock tx. prevent new CS meanwhile */
4537                 if (rcu_dereference_protected(mvm->csa_tx_blocked_vif,
4538                                               lockdep_is_held(&mvm->mutex))) {
4539                         ret = -EBUSY;
4540                         goto out_unlock;
4541                 }
4542
4543                 rcu_assign_pointer(mvm->csa_vif, vif);
4544
4545                 if (WARN_ONCE(mvmvif->csa_countdown,
4546                               "Previous CSA countdown didn't complete")) {
4547                         ret = -EBUSY;
4548                         goto out_unlock;
4549                 }
4550
4551                 mvmvif->csa_target_freq = chsw->chandef.chan->center_freq;
4552
4553                 break;
4554         case NL80211_IFTYPE_STATION:
4555                 if (chsw->block_tx) {
4556                         /*
4557                          * In case of undetermined / long time with immediate
4558                          * quiet monitor status to gracefully disconnect
4559                          */
4560                         if (!chsw->count ||
4561                             chsw->count * vif->bss_conf.beacon_int >
4562                             IWL_MAX_CSA_BLOCK_TX)
4563                                 schedule_delayed_work(&mvmvif->csa_work,
4564                                                       msecs_to_jiffies(IWL_MAX_CSA_BLOCK_TX));
4565                 }
4566
4567                 if (!fw_has_capa(&mvm->fw->ucode_capa,
4568                                  IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
4569                         ret = iwl_mvm_old_pre_chan_sw_sta(mvm, vif, chsw);
4570                         if (ret)
4571                                 goto out_unlock;
4572                 } else {
4573                         iwl_mvm_schedule_client_csa(mvm, vif, chsw);
4574                 }
4575
4576                 mvmvif->csa_count = chsw->count;
4577                 mvmvif->csa_misbehave = false;
4578                 break;
4579         default:
4580                 break;
4581         }
4582
4583         mvmvif->ps_disabled = true;
4584
4585         ret = iwl_mvm_power_update_ps(mvm);
4586         if (ret)
4587                 goto out_unlock;
4588
4589         /* we won't be on this channel any longer */
4590         iwl_mvm_teardown_tdls_peers(mvm);
4591
4592 out_unlock:
4593         mutex_unlock(&mvm->mutex);
4594
4595         return ret;
4596 }
4597
4598 static void iwl_mvm_channel_switch_rx_beacon(struct ieee80211_hw *hw,
4599                                              struct ieee80211_vif *vif,
4600                                              struct ieee80211_channel_switch *chsw)
4601 {
4602         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4603         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4604         struct iwl_chan_switch_te_cmd cmd = {
4605                 .mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
4606                                                           mvmvif->color)),
4607                 .action = cpu_to_le32(FW_CTXT_ACTION_MODIFY),
4608                 .tsf = cpu_to_le32(chsw->timestamp),
4609                 .cs_count = chsw->count,
4610                 .cs_mode = chsw->block_tx,
4611         };
4612
4613         if (!fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_CS_MODIFY))
4614                 return;
4615
4616         if (chsw->count >= mvmvif->csa_count && chsw->block_tx) {
4617                 if (mvmvif->csa_misbehave) {
4618                         /* Second time, give up on this AP*/
4619                         iwl_mvm_abort_channel_switch(hw, vif);
4620                         ieee80211_chswitch_done(vif, false);
4621                         mvmvif->csa_misbehave = false;
4622                         return;
4623                 }
4624                 mvmvif->csa_misbehave = true;
4625         }
4626         mvmvif->csa_count = chsw->count;
4627
4628         IWL_DEBUG_MAC80211(mvm, "Modify CSA on mac %d\n", mvmvif->id);
4629
4630         WARN_ON(iwl_mvm_send_cmd_pdu(mvm,
4631                                      WIDE_ID(MAC_CONF_GROUP,
4632                                              CHANNEL_SWITCH_TIME_EVENT_CMD),
4633                                      CMD_ASYNC, sizeof(cmd), &cmd));
4634 }
4635
4636 static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop)
4637 {
4638         int i;
4639
4640         if (!iwl_mvm_has_new_tx_api(mvm)) {
4641                 if (drop) {
4642                         mutex_lock(&mvm->mutex);
4643                         iwl_mvm_flush_tx_path(mvm,
4644                                 iwl_mvm_flushable_queues(mvm) & queues, 0);
4645                         mutex_unlock(&mvm->mutex);
4646                 } else {
4647                         iwl_trans_wait_tx_queues_empty(mvm->trans, queues);
4648                 }
4649                 return;
4650         }
4651
4652         mutex_lock(&mvm->mutex);
4653         for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
4654                 struct ieee80211_sta *sta;
4655
4656                 sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
4657                                                 lockdep_is_held(&mvm->mutex));
4658                 if (IS_ERR_OR_NULL(sta))
4659                         continue;
4660
4661                 if (drop)
4662                         iwl_mvm_flush_sta_tids(mvm, i, 0xFFFF, 0);
4663                 else
4664                         iwl_mvm_wait_sta_queues_empty(mvm,
4665                                         iwl_mvm_sta_from_mac80211(sta));
4666         }
4667         mutex_unlock(&mvm->mutex);
4668 }
4669
4670 static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
4671                               struct ieee80211_vif *vif, u32 queues, bool drop)
4672 {
4673         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4674         struct iwl_mvm_vif *mvmvif;
4675         struct iwl_mvm_sta *mvmsta;
4676         struct ieee80211_sta *sta;
4677         int i;
4678         u32 msk = 0;
4679
4680         if (!vif) {
4681                 iwl_mvm_flush_no_vif(mvm, queues, drop);
4682                 return;
4683         }
4684
4685         if (vif->type != NL80211_IFTYPE_STATION)
4686                 return;
4687
4688         /* Make sure we're done with the deferred traffic before flushing */
4689         flush_work(&mvm->add_stream_wk);
4690
4691         mutex_lock(&mvm->mutex);
4692         mvmvif = iwl_mvm_vif_from_mac80211(vif);
4693
4694         /* flush the AP-station and all TDLS peers */
4695         for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
4696                 sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
4697                                                 lockdep_is_held(&mvm->mutex));
4698                 if (IS_ERR_OR_NULL(sta))
4699                         continue;
4700
4701                 mvmsta = iwl_mvm_sta_from_mac80211(sta);
4702                 if (mvmsta->vif != vif)
4703                         continue;
4704
4705                 /* make sure only TDLS peers or the AP are flushed */
4706                 WARN_ON(i != mvmvif->ap_sta_id && !sta->tdls);
4707
4708                 if (drop) {
4709                         if (iwl_mvm_flush_sta(mvm, mvmsta, false, 0))
4710                                 IWL_ERR(mvm, "flush request fail\n");
4711                 } else {
4712                         msk |= mvmsta->tfd_queue_msk;
4713                         if (iwl_mvm_has_new_tx_api(mvm))
4714                                 iwl_mvm_wait_sta_queues_empty(mvm, mvmsta);
4715                 }
4716         }
4717
4718         mutex_unlock(&mvm->mutex);
4719
4720         /* this can take a while, and we may need/want other operations
4721          * to succeed while doing this, so do it without the mutex held
4722          */
4723         if (!drop && !iwl_mvm_has_new_tx_api(mvm))
4724                 iwl_trans_wait_tx_queues_empty(mvm->trans, msk);
4725 }
4726
4727 static int iwl_mvm_mac_get_survey(struct ieee80211_hw *hw, int idx,
4728                                   struct survey_info *survey)
4729 {
4730         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4731         int ret;
4732
4733         memset(survey, 0, sizeof(*survey));
4734
4735         /* only support global statistics right now */
4736         if (idx != 0)
4737                 return -ENOENT;
4738
4739         if (!fw_has_capa(&mvm->fw->ucode_capa,
4740                          IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
4741                 return -ENOENT;
4742
4743         mutex_lock(&mvm->mutex);
4744
4745         if (iwl_mvm_firmware_running(mvm)) {
4746                 ret = iwl_mvm_request_statistics(mvm, false);
4747                 if (ret)
4748                         goto out;
4749         }
4750
4751         survey->filled = SURVEY_INFO_TIME |
4752                          SURVEY_INFO_TIME_RX |
4753                          SURVEY_INFO_TIME_TX |
4754                          SURVEY_INFO_TIME_SCAN;
4755         survey->time = mvm->accu_radio_stats.on_time_rf +
4756                        mvm->radio_stats.on_time_rf;
4757         do_div(survey->time, USEC_PER_MSEC);
4758
4759         survey->time_rx = mvm->accu_radio_stats.rx_time +
4760                           mvm->radio_stats.rx_time;
4761         do_div(survey->time_rx, USEC_PER_MSEC);
4762
4763         survey->time_tx = mvm->accu_radio_stats.tx_time +
4764                           mvm->radio_stats.tx_time;
4765         do_div(survey->time_tx, USEC_PER_MSEC);
4766
4767         survey->time_scan = mvm->accu_radio_stats.on_time_scan +
4768                             mvm->radio_stats.on_time_scan;
4769         do_div(survey->time_scan, USEC_PER_MSEC);
4770
4771         ret = 0;
4772  out:
4773         mutex_unlock(&mvm->mutex);
4774         return ret;
4775 }
4776
4777 static void iwl_mvm_set_sta_rate(u32 rate_n_flags, struct rate_info *rinfo)
4778 {
4779         switch (rate_n_flags & RATE_MCS_CHAN_WIDTH_MSK) {
4780         case RATE_MCS_CHAN_WIDTH_20:
4781                 rinfo->bw = RATE_INFO_BW_20;
4782                 break;
4783         case RATE_MCS_CHAN_WIDTH_40:
4784                 rinfo->bw = RATE_INFO_BW_40;
4785                 break;
4786         case RATE_MCS_CHAN_WIDTH_80:
4787                 rinfo->bw = RATE_INFO_BW_80;
4788                 break;
4789         case RATE_MCS_CHAN_WIDTH_160:
4790                 rinfo->bw = RATE_INFO_BW_160;
4791                 break;
4792         }
4793
4794         if (rate_n_flags & RATE_MCS_HT_MSK) {
4795                 rinfo->flags |= RATE_INFO_FLAGS_MCS;
4796                 rinfo->mcs = u32_get_bits(rate_n_flags, RATE_HT_MCS_INDEX_MSK);
4797                 rinfo->nss = u32_get_bits(rate_n_flags,
4798                                           RATE_HT_MCS_NSS_MSK) + 1;
4799                 if (rate_n_flags & RATE_MCS_SGI_MSK)
4800                         rinfo->flags |= RATE_INFO_FLAGS_SHORT_GI;
4801         } else if (rate_n_flags & RATE_MCS_VHT_MSK) {
4802                 rinfo->flags |= RATE_INFO_FLAGS_VHT_MCS;
4803                 rinfo->mcs = u32_get_bits(rate_n_flags,
4804                                           RATE_VHT_MCS_RATE_CODE_MSK);
4805                 rinfo->nss = u32_get_bits(rate_n_flags,
4806                                           RATE_VHT_MCS_NSS_MSK) + 1;
4807                 if (rate_n_flags & RATE_MCS_SGI_MSK)
4808                         rinfo->flags |= RATE_INFO_FLAGS_SHORT_GI;
4809         } else if (rate_n_flags & RATE_MCS_HE_MSK) {
4810                 u32 gi_ltf = u32_get_bits(rate_n_flags,
4811                                           RATE_MCS_HE_GI_LTF_MSK);
4812
4813                 rinfo->flags |= RATE_INFO_FLAGS_HE_MCS;
4814                 rinfo->mcs = u32_get_bits(rate_n_flags,
4815                                           RATE_VHT_MCS_RATE_CODE_MSK);
4816                 rinfo->nss = u32_get_bits(rate_n_flags,
4817                                           RATE_VHT_MCS_NSS_MSK) + 1;
4818
4819                 if (rate_n_flags & RATE_MCS_HE_106T_MSK) {
4820                         rinfo->bw = RATE_INFO_BW_HE_RU;
4821                         rinfo->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_106;
4822                 }
4823
4824                 switch (rate_n_flags & RATE_MCS_HE_TYPE_MSK) {
4825                 case RATE_MCS_HE_TYPE_SU:
4826                 case RATE_MCS_HE_TYPE_EXT_SU:
4827                         if (gi_ltf == 0 || gi_ltf == 1)
4828                                 rinfo->he_gi = NL80211_RATE_INFO_HE_GI_0_8;
4829                         else if (gi_ltf == 2)
4830                                 rinfo->he_gi = NL80211_RATE_INFO_HE_GI_1_6;
4831                         else if (rate_n_flags & RATE_MCS_SGI_MSK)
4832                                 rinfo->he_gi = NL80211_RATE_INFO_HE_GI_0_8;
4833                         else
4834                                 rinfo->he_gi = NL80211_RATE_INFO_HE_GI_3_2;
4835                         break;
4836                 case RATE_MCS_HE_TYPE_MU:
4837                         if (gi_ltf == 0 || gi_ltf == 1)
4838                                 rinfo->he_gi = NL80211_RATE_INFO_HE_GI_0_8;
4839                         else if (gi_ltf == 2)
4840                                 rinfo->he_gi = NL80211_RATE_INFO_HE_GI_1_6;
4841                         else
4842                                 rinfo->he_gi = NL80211_RATE_INFO_HE_GI_3_2;
4843                         break;
4844                 case RATE_MCS_HE_TYPE_TRIG:
4845                         if (gi_ltf == 0 || gi_ltf == 1)
4846                                 rinfo->he_gi = NL80211_RATE_INFO_HE_GI_1_6;
4847                         else
4848                                 rinfo->he_gi = NL80211_RATE_INFO_HE_GI_3_2;
4849                         break;
4850                 }
4851
4852                 if (rate_n_flags & RATE_HE_DUAL_CARRIER_MODE_MSK)
4853                         rinfo->he_dcm = 1;
4854         } else {
4855                 switch (u32_get_bits(rate_n_flags, RATE_LEGACY_RATE_MSK)) {
4856                 case IWL_RATE_1M_PLCP:
4857                         rinfo->legacy = 10;
4858                         break;
4859                 case IWL_RATE_2M_PLCP:
4860                         rinfo->legacy = 20;
4861                         break;
4862                 case IWL_RATE_5M_PLCP:
4863                         rinfo->legacy = 55;
4864                         break;
4865                 case IWL_RATE_11M_PLCP:
4866                         rinfo->legacy = 110;
4867                         break;
4868                 case IWL_RATE_6M_PLCP:
4869                         rinfo->legacy = 60;
4870                         break;
4871                 case IWL_RATE_9M_PLCP:
4872                         rinfo->legacy = 90;
4873                         break;
4874                 case IWL_RATE_12M_PLCP:
4875                         rinfo->legacy = 120;
4876                         break;
4877                 case IWL_RATE_18M_PLCP:
4878                         rinfo->legacy = 180;
4879                         break;
4880                 case IWL_RATE_24M_PLCP:
4881                         rinfo->legacy = 240;
4882                         break;
4883                 case IWL_RATE_36M_PLCP:
4884                         rinfo->legacy = 360;
4885                         break;
4886                 case IWL_RATE_48M_PLCP:
4887                         rinfo->legacy = 480;
4888                         break;
4889                 case IWL_RATE_54M_PLCP:
4890                         rinfo->legacy = 540;
4891                         break;
4892                 }
4893         }
4894 }
4895
4896 static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,
4897                                        struct ieee80211_vif *vif,
4898                                        struct ieee80211_sta *sta,
4899                                        struct station_info *sinfo)
4900 {
4901         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4902         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4903         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
4904
4905         if (mvmsta->avg_energy) {
4906                 sinfo->signal_avg = mvmsta->avg_energy;
4907                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
4908         }
4909
4910         if (iwl_mvm_has_tlc_offload(mvm)) {
4911                 struct iwl_lq_sta_rs_fw *lq_sta = &mvmsta->lq_sta.rs_fw;
4912
4913                 iwl_mvm_set_sta_rate(lq_sta->last_rate_n_flags, &sinfo->txrate);
4914                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
4915         }
4916
4917         /* if beacon filtering isn't on mac80211 does it anyway */
4918         if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
4919                 return;
4920
4921         if (!vif->bss_conf.assoc)
4922                 return;
4923
4924         mutex_lock(&mvm->mutex);
4925
4926         if (mvmvif->ap_sta_id != mvmsta->sta_id)
4927                 goto unlock;
4928
4929         if (iwl_mvm_request_statistics(mvm, false))
4930                 goto unlock;
4931
4932         sinfo->rx_beacon = mvmvif->beacon_stats.num_beacons +
4933                            mvmvif->beacon_stats.accu_num_beacons;
4934         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_RX);
4935         if (mvmvif->beacon_stats.avg_signal) {
4936                 /* firmware only reports a value after RXing a few beacons */
4937                 sinfo->rx_beacon_signal_avg = mvmvif->beacon_stats.avg_signal;
4938                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG);
4939         }
4940  unlock:
4941         mutex_unlock(&mvm->mutex);
4942 }
4943
4944 static void iwl_mvm_event_mlme_callback(struct iwl_mvm *mvm,
4945                                         struct ieee80211_vif *vif,
4946                                         const struct ieee80211_event *event)
4947 {
4948 #define CHECK_MLME_TRIGGER(_cnt, _fmt...)                               \
4949         do {                                                            \
4950                 if ((trig_mlme->_cnt) && --(trig_mlme->_cnt))           \
4951                         break;                                          \
4952                 iwl_fw_dbg_collect_trig(&(mvm)->fwrt, trig, _fmt);      \
4953         } while (0)
4954
4955         struct iwl_fw_dbg_trigger_tlv *trig;
4956         struct iwl_fw_dbg_trigger_mlme *trig_mlme;
4957
4958         trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
4959                                      FW_DBG_TRIGGER_MLME);
4960         if (!trig)
4961                 return;
4962
4963         trig_mlme = (void *)trig->data;
4964
4965         if (event->u.mlme.data == ASSOC_EVENT) {
4966                 if (event->u.mlme.status == MLME_DENIED)
4967                         CHECK_MLME_TRIGGER(stop_assoc_denied,
4968                                            "DENIED ASSOC: reason %d",
4969                                             event->u.mlme.reason);
4970                 else if (event->u.mlme.status == MLME_TIMEOUT)
4971                         CHECK_MLME_TRIGGER(stop_assoc_timeout,
4972                                            "ASSOC TIMEOUT");
4973         } else if (event->u.mlme.data == AUTH_EVENT) {
4974                 if (event->u.mlme.status == MLME_DENIED)
4975                         CHECK_MLME_TRIGGER(stop_auth_denied,
4976                                            "DENIED AUTH: reason %d",
4977                                            event->u.mlme.reason);
4978                 else if (event->u.mlme.status == MLME_TIMEOUT)
4979                         CHECK_MLME_TRIGGER(stop_auth_timeout,
4980                                            "AUTH TIMEOUT");
4981         } else if (event->u.mlme.data == DEAUTH_RX_EVENT) {
4982                 CHECK_MLME_TRIGGER(stop_rx_deauth,
4983                                    "DEAUTH RX %d", event->u.mlme.reason);
4984         } else if (event->u.mlme.data == DEAUTH_TX_EVENT) {
4985                 CHECK_MLME_TRIGGER(stop_tx_deauth,
4986                                    "DEAUTH TX %d", event->u.mlme.reason);
4987         }
4988 #undef CHECK_MLME_TRIGGER
4989 }
4990
4991 static void iwl_mvm_event_bar_rx_callback(struct iwl_mvm *mvm,
4992                                           struct ieee80211_vif *vif,
4993                                           const struct ieee80211_event *event)
4994 {
4995         struct iwl_fw_dbg_trigger_tlv *trig;
4996         struct iwl_fw_dbg_trigger_ba *ba_trig;
4997
4998         trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
4999                                      FW_DBG_TRIGGER_BA);
5000         if (!trig)
5001                 return;
5002
5003         ba_trig = (void *)trig->data;
5004
5005         if (!(le16_to_cpu(ba_trig->rx_bar) & BIT(event->u.ba.tid)))
5006                 return;
5007
5008         iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
5009                                 "BAR received from %pM, tid %d, ssn %d",
5010                                 event->u.ba.sta->addr, event->u.ba.tid,
5011                                 event->u.ba.ssn);
5012 }
5013
5014 static void iwl_mvm_mac_event_callback(struct ieee80211_hw *hw,
5015                                        struct ieee80211_vif *vif,
5016                                        const struct ieee80211_event *event)
5017 {
5018         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
5019
5020         switch (event->type) {
5021         case MLME_EVENT:
5022                 iwl_mvm_event_mlme_callback(mvm, vif, event);
5023                 break;
5024         case BAR_RX_EVENT:
5025                 iwl_mvm_event_bar_rx_callback(mvm, vif, event);
5026                 break;
5027         case BA_FRAME_TIMEOUT:
5028                 iwl_mvm_event_frame_timeout_callback(mvm, vif, event->u.ba.sta,
5029                                                      event->u.ba.tid);
5030                 break;
5031         default:
5032                 break;
5033         }
5034 }
5035
5036 void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm,
5037                                      struct iwl_mvm_internal_rxq_notif *notif,
5038                                      u32 size)
5039 {
5040         u32 qmask = BIT(mvm->trans->num_rx_queues) - 1;
5041         int ret;
5042
5043
5044         if (!iwl_mvm_has_new_rx_api(mvm))
5045                 return;
5046
5047         if (notif->sync) {
5048                 notif->cookie = mvm->queue_sync_cookie;
5049                 atomic_set(&mvm->queue_sync_counter,
5050                            mvm->trans->num_rx_queues);
5051         }
5052
5053         ret = iwl_mvm_notify_rx_queue(mvm, qmask, (u8 *)notif,
5054                                       size, !notif->sync);
5055         if (ret) {
5056                 IWL_ERR(mvm, "Failed to trigger RX queues sync (%d)\n", ret);
5057                 goto out;
5058         }
5059
5060         if (notif->sync) {
5061                 lockdep_assert_held(&mvm->mutex);
5062                 ret = wait_event_timeout(mvm->rx_sync_waitq,
5063                                          atomic_read(&mvm->queue_sync_counter) == 0 ||
5064                                          iwl_mvm_is_radio_killed(mvm),
5065                                          HZ);
5066                 WARN_ON_ONCE(!ret && !iwl_mvm_is_radio_killed(mvm));
5067         }
5068
5069 out:
5070         atomic_set(&mvm->queue_sync_counter, 0);
5071         if (notif->sync)
5072                 mvm->queue_sync_cookie++;
5073 }
5074
5075 static void iwl_mvm_sync_rx_queues(struct ieee80211_hw *hw)
5076 {
5077         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
5078         struct iwl_mvm_internal_rxq_notif data = {
5079                 .type = IWL_MVM_RXQ_EMPTY,
5080                 .sync = 1,
5081         };
5082
5083         mutex_lock(&mvm->mutex);
5084         iwl_mvm_sync_rx_queues_internal(mvm, &data, sizeof(data));
5085         mutex_unlock(&mvm->mutex);
5086 }
5087
5088 static int
5089 iwl_mvm_mac_get_ftm_responder_stats(struct ieee80211_hw *hw,
5090                                     struct ieee80211_vif *vif,
5091                                     struct cfg80211_ftm_responder_stats *stats)
5092 {
5093         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
5094         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
5095
5096         if (vif->p2p || vif->type != NL80211_IFTYPE_AP ||
5097             !mvmvif->ap_ibss_active || !vif->bss_conf.ftm_responder)
5098                 return -EINVAL;
5099
5100         mutex_lock(&mvm->mutex);
5101         *stats = mvm->ftm_resp_stats;
5102         mutex_unlock(&mvm->mutex);
5103
5104         stats->filled = BIT(NL80211_FTM_STATS_SUCCESS_NUM) |
5105                         BIT(NL80211_FTM_STATS_PARTIAL_NUM) |
5106                         BIT(NL80211_FTM_STATS_FAILED_NUM) |
5107                         BIT(NL80211_FTM_STATS_ASAP_NUM) |
5108                         BIT(NL80211_FTM_STATS_NON_ASAP_NUM) |
5109                         BIT(NL80211_FTM_STATS_TOTAL_DURATION_MSEC) |
5110                         BIT(NL80211_FTM_STATS_UNKNOWN_TRIGGERS_NUM) |
5111                         BIT(NL80211_FTM_STATS_RESCHEDULE_REQUESTS_NUM) |
5112                         BIT(NL80211_FTM_STATS_OUT_OF_WINDOW_TRIGGERS_NUM);
5113
5114         return 0;
5115 }
5116
5117 static int iwl_mvm_start_pmsr(struct ieee80211_hw *hw,
5118                               struct ieee80211_vif *vif,
5119                               struct cfg80211_pmsr_request *request)
5120 {
5121         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
5122         int ret;
5123
5124         mutex_lock(&mvm->mutex);
5125         ret = iwl_mvm_ftm_start(mvm, vif, request);
5126         mutex_unlock(&mvm->mutex);
5127
5128         return ret;
5129 }
5130
5131 static void iwl_mvm_abort_pmsr(struct ieee80211_hw *hw,
5132                                struct ieee80211_vif *vif,
5133                                struct cfg80211_pmsr_request *request)
5134 {
5135         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
5136
5137         mutex_lock(&mvm->mutex);
5138         iwl_mvm_ftm_abort(mvm, request);
5139         mutex_unlock(&mvm->mutex);
5140 }
5141
5142 static bool iwl_mvm_can_hw_csum(struct sk_buff *skb)
5143 {
5144         u8 protocol = ip_hdr(skb)->protocol;
5145
5146         if (!IS_ENABLED(CONFIG_INET))
5147                 return false;
5148
5149         return protocol == IPPROTO_TCP || protocol == IPPROTO_UDP;
5150 }
5151
5152 static bool iwl_mvm_mac_can_aggregate(struct ieee80211_hw *hw,
5153                                       struct sk_buff *head,
5154                                       struct sk_buff *skb)
5155 {
5156         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
5157
5158         /* For now don't aggregate IPv6 in AMSDU */
5159         if (skb->protocol != htons(ETH_P_IP))
5160                 return false;
5161
5162         if (!iwl_mvm_is_csum_supported(mvm))
5163                 return true;
5164
5165         return iwl_mvm_can_hw_csum(skb) == iwl_mvm_can_hw_csum(head);
5166 }
5167
5168 const struct ieee80211_ops iwl_mvm_hw_ops = {
5169         .tx = iwl_mvm_mac_tx,
5170         .wake_tx_queue = iwl_mvm_mac_wake_tx_queue,
5171         .ampdu_action = iwl_mvm_mac_ampdu_action,
5172         .get_antenna = iwl_mvm_op_get_antenna,
5173         .start = iwl_mvm_mac_start,
5174         .reconfig_complete = iwl_mvm_mac_reconfig_complete,
5175         .stop = iwl_mvm_mac_stop,
5176         .add_interface = iwl_mvm_mac_add_interface,
5177         .remove_interface = iwl_mvm_mac_remove_interface,
5178         .config = iwl_mvm_mac_config,
5179         .prepare_multicast = iwl_mvm_prepare_multicast,
5180         .configure_filter = iwl_mvm_configure_filter,
5181         .config_iface_filter = iwl_mvm_config_iface_filter,
5182         .bss_info_changed = iwl_mvm_bss_info_changed,
5183         .hw_scan = iwl_mvm_mac_hw_scan,
5184         .cancel_hw_scan = iwl_mvm_mac_cancel_hw_scan,
5185         .sta_pre_rcu_remove = iwl_mvm_sta_pre_rcu_remove,
5186         .sta_state = iwl_mvm_mac_sta_state,
5187         .sta_notify = iwl_mvm_mac_sta_notify,
5188         .allow_buffered_frames = iwl_mvm_mac_allow_buffered_frames,
5189         .release_buffered_frames = iwl_mvm_mac_release_buffered_frames,
5190         .set_rts_threshold = iwl_mvm_mac_set_rts_threshold,
5191         .sta_rc_update = iwl_mvm_sta_rc_update,
5192         .conf_tx = iwl_mvm_mac_conf_tx,
5193         .mgd_prepare_tx = iwl_mvm_mac_mgd_prepare_tx,
5194         .mgd_protect_tdls_discover = iwl_mvm_mac_mgd_protect_tdls_discover,
5195         .flush = iwl_mvm_mac_flush,
5196         .sched_scan_start = iwl_mvm_mac_sched_scan_start,
5197         .sched_scan_stop = iwl_mvm_mac_sched_scan_stop,
5198         .set_key = iwl_mvm_mac_set_key,
5199         .update_tkip_key = iwl_mvm_mac_update_tkip_key,
5200         .remain_on_channel = iwl_mvm_roc,
5201         .cancel_remain_on_channel = iwl_mvm_cancel_roc,
5202         .add_chanctx = iwl_mvm_add_chanctx,
5203         .remove_chanctx = iwl_mvm_remove_chanctx,
5204         .change_chanctx = iwl_mvm_change_chanctx,
5205         .assign_vif_chanctx = iwl_mvm_assign_vif_chanctx,
5206         .unassign_vif_chanctx = iwl_mvm_unassign_vif_chanctx,
5207         .switch_vif_chanctx = iwl_mvm_switch_vif_chanctx,
5208
5209         .start_ap = iwl_mvm_start_ap_ibss,
5210         .stop_ap = iwl_mvm_stop_ap_ibss,
5211         .join_ibss = iwl_mvm_start_ap_ibss,
5212         .leave_ibss = iwl_mvm_stop_ap_ibss,
5213
5214         .tx_last_beacon = iwl_mvm_tx_last_beacon,
5215
5216         .set_tim = iwl_mvm_set_tim,
5217
5218         .channel_switch = iwl_mvm_channel_switch,
5219         .pre_channel_switch = iwl_mvm_pre_channel_switch,
5220         .post_channel_switch = iwl_mvm_post_channel_switch,
5221         .abort_channel_switch = iwl_mvm_abort_channel_switch,
5222         .channel_switch_rx_beacon = iwl_mvm_channel_switch_rx_beacon,
5223
5224         .tdls_channel_switch = iwl_mvm_tdls_channel_switch,
5225         .tdls_cancel_channel_switch = iwl_mvm_tdls_cancel_channel_switch,
5226         .tdls_recv_channel_switch = iwl_mvm_tdls_recv_channel_switch,
5227
5228         .event_callback = iwl_mvm_mac_event_callback,
5229
5230         .sync_rx_queues = iwl_mvm_sync_rx_queues,
5231
5232         CFG80211_TESTMODE_CMD(iwl_mvm_mac_testmode_cmd)
5233
5234 #ifdef CONFIG_PM_SLEEP
5235         /* look at d3.c */
5236         .suspend = iwl_mvm_suspend,
5237         .resume = iwl_mvm_resume,
5238         .set_wakeup = iwl_mvm_set_wakeup,
5239         .set_rekey_data = iwl_mvm_set_rekey_data,
5240 #if IS_ENABLED(CONFIG_IPV6)
5241         .ipv6_addr_change = iwl_mvm_ipv6_addr_change,
5242 #endif
5243         .set_default_unicast_key = iwl_mvm_set_default_unicast_key,
5244 #endif
5245         .get_survey = iwl_mvm_mac_get_survey,
5246         .sta_statistics = iwl_mvm_mac_sta_statistics,
5247         .get_ftm_responder_stats = iwl_mvm_mac_get_ftm_responder_stats,
5248         .start_pmsr = iwl_mvm_start_pmsr,
5249         .abort_pmsr = iwl_mvm_abort_pmsr,
5250
5251         .can_aggregate_in_amsdu = iwl_mvm_mac_can_aggregate,
5252 #ifdef CONFIG_IWLWIFI_DEBUGFS
5253         .sta_add_debugfs = iwl_mvm_sta_add_debugfs,
5254 #endif
5255 };