drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c

   1 /******************************************************************************
   2  *
   3  * This file is provided under a dual BSD/GPLv2 license.  When using or
   4  * redistributing this file, you may do so under either license.
   5  *
   6  * GPL LICENSE SUMMARY
   7  *
   8  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
   9  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  10  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  11  * Copyright(c) 2018 - 2019 Intel Corporation
  12  *
  13  * This program is free software; you can redistribute it and/or modify
  14  * it under the terms of version 2 of the GNU General Public License as
  15  * published by the Free Software Foundation.
  16  *
  17  * This program is distributed in the hope that it will be useful, but
  18  * WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  20  * General Public License for more details.
  21  *
  22  * The full GNU General Public License is included in this distribution
  23  * in the file called COPYING.
  24  *
  25  * Contact Information:
  26  *  Intel Linux Wireless <linuxwifi@intel.com>
  27  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  28  *
  29  * BSD LICENSE
  30  *
  31  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  32  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  33  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  34  * Copyright(c) 2018 - 2019 Intel Corporation
  35  * All rights reserved.
  36  *
  37  * Redistribution and use in source and binary forms, with or without
  38  * modification, are permitted provided that the following conditions
  39  * are met:
  40  *
  41  *  * Redistributions of source code must retain the above copyright
  42  *    notice, this list of conditions and the following disclaimer.
  43  *  * Redistributions in binary form must reproduce the above copyright
  44  *    notice, this list of conditions and the following disclaimer in
  45  *    the documentation and/or other materials provided with the
  46  *    distribution.
  47  *  * Neither the name Intel Corporation nor the names of its
  48  *    contributors may be used to endorse or promote products derived
  49  *    from this software without specific prior written permission.
  50  *
  51  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  52  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  53  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  54  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  55  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  56  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  57  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  58  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  59  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  60  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  61  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  62  *
  63  *****************************************************************************/
  64 #include <linux/kernel.h>
  65 #include <linux/slab.h>
  66 #include <linux/skbuff.h>
  67 #include <linux/netdevice.h>
  68 #include <linux/etherdevice.h>
  69 #include <linux/ip.h>
  70 #include <linux/if_arp.h>
  71 #include <linux/time.h>
  72 #include <net/mac80211.h>
  73 #include <net/ieee80211_radiotap.h>
  74 #include <net/tcp.h>
  75
  76 #include "iwl-op-mode.h"
  77 #include "iwl-io.h"
  78 #include "mvm.h"
  79 #include "sta.h"
  80 #include "time-event.h"
  81 #include "iwl-eeprom-parse.h"
  82 #include "iwl-phy-db.h"
  83 #include "testmode.h"
  84 #include "fw/error-dump.h"
  85 #include "iwl-prph.h"
  86 #include "iwl-nvm-parse.h"
  87
  88 static const struct ieee80211_iface_limit iwl_mvm_limits[] = {
  89         {
  90                 .max = 1,
  91                 .types = BIT(NL80211_IFTYPE_STATION),
  92         },
  93         {
  94                 .max = 1,
  95                 .types = BIT(NL80211_IFTYPE_AP) |
  96                         BIT(NL80211_IFTYPE_P2P_CLIENT) |
  97                         BIT(NL80211_IFTYPE_P2P_GO),
  98         },
  99         {
 100                 .max = 1,
 101                 .types = BIT(NL80211_IFTYPE_P2P_DEVICE),
 102         },
 103 };
 104
 105 static const struct ieee80211_iface_combination iwl_mvm_iface_combinations[] = {
 106         {
 107                 .num_different_channels = 2,
 108                 .max_interfaces = 3,
 109                 .limits = iwl_mvm_limits,
 110                 .n_limits = ARRAY_SIZE(iwl_mvm_limits),
 111         },
 112 };
 113
 114 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
 115 /*
 116  * Use the reserved field to indicate magic values.
 117  * these values will only be used internally by the driver,
 118  * and won't make it to the fw (reserved will be 0).
 119  * BC_FILTER_MAGIC_IP - configure the val of this attribute to
 120  *      be the vif's ip address. in case there is not a single
 121  *      ip address (0, or more than 1), this attribute will
 122  *      be skipped.
 123  * BC_FILTER_MAGIC_MAC - set the val of this attribute to
 124  *      the LSB bytes of the vif's mac address
 125  */
 126 enum {
 127         BC_FILTER_MAGIC_NONE = 0,
 128         BC_FILTER_MAGIC_IP,
 129         BC_FILTER_MAGIC_MAC,
 130 };
 131
 132 static const struct iwl_fw_bcast_filter iwl_mvm_default_bcast_filters[] = {
 133         {
 134                 /* arp */
 135                 .discard = 0,
 136                 .frame_type = BCAST_FILTER_FRAME_TYPE_ALL,
 137                 .attrs = {
 138                         {
 139                                 /* frame type - arp, hw type - ethernet */
 140                                 .offset_type =
 141                                         BCAST_FILTER_OFFSET_PAYLOAD_START,
 142                                 .offset = sizeof(rfc1042_header),
 143                                 .val = cpu_to_be32(0x08060001),
 144                                 .mask = cpu_to_be32(0xffffffff),
 145                         },
 146                         {
 147                                 /* arp dest ip */
 148                                 .offset_type =
 149                                         BCAST_FILTER_OFFSET_PAYLOAD_START,
 150                                 .offset = sizeof(rfc1042_header) + 2 +
 151                                           sizeof(struct arphdr) +
 152                                           ETH_ALEN + sizeof(__be32) +
 153                                           ETH_ALEN,
 154                                 .mask = cpu_to_be32(0xffffffff),
 155                                 /* mark it as special field */
 156                                 .reserved1 = cpu_to_le16(BC_FILTER_MAGIC_IP),
 157                         },
 158                 },
 159         },
 160         {
 161                 /* dhcp offer bcast */
 162                 .discard = 0,
 163                 .frame_type = BCAST_FILTER_FRAME_TYPE_IPV4,
 164                 .attrs = {
 165                         {
 166                                 /* udp dest port - 68 (bootp client)*/
 167                                 .offset_type = BCAST_FILTER_OFFSET_IP_END,
 168                                 .offset = offsetof(struct udphdr, dest),
 169                                 .val = cpu_to_be32(0x00440000),
 170                                 .mask = cpu_to_be32(0xffff0000),
 171                         },
 172                         {
 173                                 /* dhcp - lsb bytes of client hw address */
 174                                 .offset_type = BCAST_FILTER_OFFSET_IP_END,
 175                                 .offset = 38,
 176                                 .mask = cpu_to_be32(0xffffffff),
 177                                 /* mark it as special field */
 178                                 .reserved1 = cpu_to_le16(BC_FILTER_MAGIC_MAC),
 179                         },
 180                 },
 181         },
 182         /* last filter must be empty */
 183         {},
 184 };
 185 #endif
 186
 187 static const struct cfg80211_pmsr_capabilities iwl_mvm_pmsr_capa = {
 188         .max_peers = IWL_MVM_TOF_MAX_APS,
 189         .report_ap_tsf = 1,
 190         .randomize_mac_addr = 1,
 191
 192         .ftm = {
 193                 .supported = 1,
 194                 .asap = 1,
 195                 .non_asap = 1,
 196                 .request_lci = 1,
 197                 .request_civicloc = 1,
 198                 .max_bursts_exponent = -1, /* all supported */
 199                 .max_ftms_per_burst = 0, /* no limits */
 200                 .bandwidths = BIT(NL80211_CHAN_WIDTH_20_NOHT) |
 201                               BIT(NL80211_CHAN_WIDTH_20) |
 202                               BIT(NL80211_CHAN_WIDTH_40) |
 203                               BIT(NL80211_CHAN_WIDTH_80),
 204                 .preambles = BIT(NL80211_PREAMBLE_LEGACY) |
 205                              BIT(NL80211_PREAMBLE_HT) |
 206                              BIT(NL80211_PREAMBLE_VHT),
 207         },
 208 };
 209
 210 static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
 211                                  enum set_key_cmd cmd,
 212                                  struct ieee80211_vif *vif,
 213                                  struct ieee80211_sta *sta,
 214                                  struct ieee80211_key_conf *key);
 215
 216 static void iwl_mvm_reset_phy_ctxts(struct iwl_mvm *mvm)
 217 {
 218         int i;
 219
 220         memset(mvm->phy_ctxts, 0, sizeof(mvm->phy_ctxts));
 221         for (i = 0; i < NUM_PHY_CTX; i++) {
 222                 mvm->phy_ctxts[i].id = i;
 223                 mvm->phy_ctxts[i].ref = 0;
 224         }
 225 }
 226
 227 struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
 228                                                   const char *alpha2,
 229                                                   enum iwl_mcc_source src_id,
 230                                                   bool *changed)
 231 {
 232         struct ieee80211_regdomain *regd = NULL;
 233         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
 234         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 235         struct iwl_mcc_update_resp *resp;
 236
 237         IWL_DEBUG_LAR(mvm, "Getting regdomain data for %s from FW\n", alpha2);
 238
 239         lockdep_assert_held(&mvm->mutex);
 240
 241         resp = iwl_mvm_update_mcc(mvm, alpha2, src_id);
 242         if (IS_ERR_OR_NULL(resp)) {
 243                 IWL_DEBUG_LAR(mvm, "Could not get update from FW %d\n",
 244                               PTR_ERR_OR_ZERO(resp));
 245                 goto out;
 246         }
 247
 248         if (changed) {
 249                 u32 status = le32_to_cpu(resp->status);
 250
 251                 *changed = (status == MCC_RESP_NEW_CHAN_PROFILE ||
 252                             status == MCC_RESP_ILLEGAL);
 253         }
 254
 255         regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg,
 256                                       __le32_to_cpu(resp->n_channels),
 257                                       resp->channels,
 258                                       __le16_to_cpu(resp->mcc),
 259                                       __le16_to_cpu(resp->geo_info));
 260         /* Store the return source id */
 261         src_id = resp->source_id;
 262         kfree(resp);
 263         if (IS_ERR_OR_NULL(regd)) {
 264                 IWL_DEBUG_LAR(mvm, "Could not get parse update from FW %d\n",
 265                               PTR_ERR_OR_ZERO(regd));
 266                 goto out;
 267         }
 268
 269         IWL_DEBUG_LAR(mvm, "setting alpha2 from FW to %s (0x%x, 0x%x) src=%d\n",
 270                       regd->alpha2, regd->alpha2[0], regd->alpha2[1], src_id);
 271         mvm->lar_regdom_set = true;
 272         mvm->mcc_src = src_id;
 273
 274 out:
 275         return regd;
 276 }
 277
 278 void iwl_mvm_update_changed_regdom(struct iwl_mvm *mvm)
 279 {
 280         bool changed;
 281         struct ieee80211_regdomain *regd;
 282
 283         if (!iwl_mvm_is_lar_supported(mvm))
 284                 return;
 285
 286         regd = iwl_mvm_get_current_regdomain(mvm, &changed);
 287         if (!IS_ERR_OR_NULL(regd)) {
 288                 /* only update the regulatory core if changed */
 289                 if (changed)
 290                         regulatory_set_wiphy_regd(mvm->hw->wiphy, regd);
 291
 292                 kfree(regd);
 293         }
 294 }
 295
 296 struct ieee80211_regdomain *iwl_mvm_get_current_regdomain(struct iwl_mvm *mvm,
 297                                                           bool *changed)
 298 {
 299         return iwl_mvm_get_regdomain(mvm->hw->wiphy, "ZZ",
 300                                      iwl_mvm_is_wifi_mcc_supported(mvm) ?
 301                                      MCC_SOURCE_GET_CURRENT :
 302                                      MCC_SOURCE_OLD_FW, changed);
 303 }
 304
 305 int iwl_mvm_init_fw_regd(struct iwl_mvm *mvm)
 306 {
 307         enum iwl_mcc_source used_src;
 308         struct ieee80211_regdomain *regd;
 309         int ret;
 310         bool changed;
 311         const struct ieee80211_regdomain *r =
 312                         rtnl_dereference(mvm->hw->wiphy->regd);
 313
 314         if (!r)
 315                 return -ENOENT;
 316
 317         /* save the last source in case we overwrite it below */
 318         used_src = mvm->mcc_src;
 319         if (iwl_mvm_is_wifi_mcc_supported(mvm)) {
 320                 /* Notify the firmware we support wifi location updates */
 321                 regd = iwl_mvm_get_current_regdomain(mvm, NULL);
 322                 if (!IS_ERR_OR_NULL(regd))
 323                         kfree(regd);
 324         }
 325
 326         /* Now set our last stored MCC and source */
 327         regd = iwl_mvm_get_regdomain(mvm->hw->wiphy, r->alpha2, used_src,
 328                                      &changed);
 329         if (IS_ERR_OR_NULL(regd))
 330                 return -EIO;
 331
 332         /* update cfg80211 if the regdomain was changed */
 333         if (changed)
 334                 ret = regulatory_set_wiphy_regd_sync_rtnl(mvm->hw->wiphy, regd);
 335         else
 336                 ret = 0;
 337
 338         kfree(regd);
 339         return ret;
 340 }
 341
 342 static const u8 he_if_types_ext_capa_sta[] = {
 343          [0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
 344          [2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
 345          [7] = WLAN_EXT_CAPA8_OPMODE_NOTIF,
 346          [9] = WLAN_EXT_CAPA10_TWT_REQUESTER_SUPPORT,
 347 };
 348
 349 static const struct wiphy_iftype_ext_capab he_iftypes_ext_capa[] = {
 350         {
 351                 .iftype = NL80211_IFTYPE_STATION,
 352                 .extended_capabilities = he_if_types_ext_capa_sta,
 353                 .extended_capabilities_mask = he_if_types_ext_capa_sta,
 354                 .extended_capabilities_len = sizeof(he_if_types_ext_capa_sta),
 355         },
 356 };
 357
 358 int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
 359 {
 360         struct ieee80211_hw *hw = mvm->hw;
 361         int num_mac, ret, i;
 362         static const u32 mvm_ciphers[] = {
 363                 WLAN_CIPHER_SUITE_WEP40,
 364                 WLAN_CIPHER_SUITE_WEP104,
 365                 WLAN_CIPHER_SUITE_TKIP,
 366                 WLAN_CIPHER_SUITE_CCMP,
 367         };
 368 #ifdef CONFIG_PM_SLEEP
 369         bool unified = fw_has_capa(&mvm->fw->ucode_capa,
 370                                    IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
 371 #endif
 372
 373         /* Tell mac80211 our characteristics */
 374         ieee80211_hw_set(hw, SIGNAL_DBM);
 375         ieee80211_hw_set(hw, SPECTRUM_MGMT);
 376         ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
 377         ieee80211_hw_set(hw, WANT_MONITOR_VIF);
 378         ieee80211_hw_set(hw, SUPPORTS_PS);
 379         ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
 380         ieee80211_hw_set(hw, AMPDU_AGGREGATION);
 381         ieee80211_hw_set(hw, TIMING_BEACON_ONLY);
 382         ieee80211_hw_set(hw, CONNECTION_MONITOR);
 383         ieee80211_hw_set(hw, CHANCTX_STA_CSA);
 384         ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
 385         ieee80211_hw_set(hw, SUPPORTS_CLONED_SKBS);
 386         ieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);
 387         ieee80211_hw_set(hw, NEEDS_UNIQUE_STA_ADDR);
 388         ieee80211_hw_set(hw, DEAUTH_NEED_MGD_TX_PREP);
 389         ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);
 390         ieee80211_hw_set(hw, BUFF_MMPDU_TXQ);
 391         ieee80211_hw_set(hw, STA_MMPDU_TXQ);
 392         /*
 393          * On older devices, enabling TX A-MSDU occasionally leads to
 394          * something getting messed up, the command read from the FIFO
 395          * gets out of sync and isn't a TX command, so that we have an
 396          * assert EDC.
 397          *
 398          * It's not clear where the bug is, but since we didn't used to
 399          * support A-MSDU until moving the mac80211 iTXQs, just leave it
 400          * for older devices. We also don't see this issue on any newer
 401          * devices.
 402          */
 403         if (mvm->trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_9000)
 404                 ieee80211_hw_set(hw, TX_AMSDU);
 405         ieee80211_hw_set(hw, TX_FRAG_LIST);
 406
 407         if (iwl_mvm_has_tlc_offload(mvm)) {
 408                 ieee80211_hw_set(hw, TX_AMPDU_SETUP_IN_HW);
 409                 ieee80211_hw_set(hw, HAS_RATE_CONTROL);
 410         }
 411
 412         if (iwl_mvm_has_new_rx_api(mvm))
 413                 ieee80211_hw_set(hw, SUPPORTS_REORDERING_BUFFER);
 414
 415         if (fw_has_capa(&mvm->fw->ucode_capa,
 416                         IWL_UCODE_TLV_CAPA_STA_PM_NOTIF)) {
 417                 ieee80211_hw_set(hw, AP_LINK_PS);
 418         } else if (WARN_ON(iwl_mvm_has_new_tx_api(mvm))) {
 419                 /*
 420                  * we absolutely need this for the new TX API since that comes
 421                  * with many more queues than the current code can deal with
 422                  * for station powersave
 423                  */
 424                 return -EINVAL;
 425         }
 426
 427         if (mvm->trans->num_rx_queues > 1)
 428                 ieee80211_hw_set(hw, USES_RSS);
 429
 430         if (mvm->trans->max_skb_frags)
 431                 hw->netdev_features = NETIF_F_HIGHDMA | NETIF_F_SG;
 432
 433         hw->queues = IEEE80211_MAX_QUEUES;
 434         hw->offchannel_tx_hw_queue = IWL_MVM_OFFCHANNEL_QUEUE;
 435         hw->radiotap_mcs_details |= IEEE80211_RADIOTAP_MCS_HAVE_FEC |
 436                                     IEEE80211_RADIOTAP_MCS_HAVE_STBC;
 437         hw->radiotap_vht_details |= IEEE80211_RADIOTAP_VHT_KNOWN_STBC |
 438                 IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED;
 439
 440         hw->radiotap_timestamp.units_pos =
 441                 IEEE80211_RADIOTAP_TIMESTAMP_UNIT_US |
 442                 IEEE80211_RADIOTAP_TIMESTAMP_SPOS_PLCP_SIG_ACQ;
 443         /* this is the case for CCK frames, it's better (only 8) for OFDM */
 444         hw->radiotap_timestamp.accuracy = 22;
 445
 446         if (!iwl_mvm_has_tlc_offload(mvm))
 447                 hw->rate_control_algorithm = RS_NAME;
 448
 449         hw->uapsd_queues = IWL_MVM_UAPSD_QUEUES;
 450         hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
 451         hw->max_tx_fragments = mvm->trans->max_skb_frags;
 452
 453         BUILD_BUG_ON(ARRAY_SIZE(mvm->ciphers) < ARRAY_SIZE(mvm_ciphers) + 6);
 454         memcpy(mvm->ciphers, mvm_ciphers, sizeof(mvm_ciphers));
 455         hw->wiphy->n_cipher_suites = ARRAY_SIZE(mvm_ciphers);
 456         hw->wiphy->cipher_suites = mvm->ciphers;
 457
 458         if (iwl_mvm_has_new_rx_api(mvm)) {
 459                 mvm->ciphers[hw->wiphy->n_cipher_suites] =
 460                         WLAN_CIPHER_SUITE_GCMP;
 461                 hw->wiphy->n_cipher_suites++;
 462                 mvm->ciphers[hw->wiphy->n_cipher_suites] =
 463                         WLAN_CIPHER_SUITE_GCMP_256;
 464                 hw->wiphy->n_cipher_suites++;
 465         }
 466
 467         /* Enable 11w if software crypto is not enabled (as the
 468          * firmware will interpret some mgmt packets, so enabling it
 469          * with software crypto isn't safe).
 470          */
 471         if (!iwlwifi_mod_params.swcrypto) {
 472                 ieee80211_hw_set(hw, MFP_CAPABLE);
 473                 mvm->ciphers[hw->wiphy->n_cipher_suites] =
 474                         WLAN_CIPHER_SUITE_AES_CMAC;
 475                 hw->wiphy->n_cipher_suites++;
 476                 if (iwl_mvm_has_new_rx_api(mvm)) {
 477                         mvm->ciphers[hw->wiphy->n_cipher_suites] =
 478                                 WLAN_CIPHER_SUITE_BIP_GMAC_128;
 479                         hw->wiphy->n_cipher_suites++;
 480                         mvm->ciphers[hw->wiphy->n_cipher_suites] =
 481                                 WLAN_CIPHER_SUITE_BIP_GMAC_256;
 482                         hw->wiphy->n_cipher_suites++;
 483                 }
 484         }
 485
 486         /* currently FW API supports only one optional cipher scheme */
 487         if (mvm->fw->cs[0].cipher) {
 488                 const struct iwl_fw_cipher_scheme *fwcs = &mvm->fw->cs[0];
 489                 struct ieee80211_cipher_scheme *cs = &mvm->cs[0];
 490
 491                 mvm->hw->n_cipher_schemes = 1;
 492
 493                 cs->cipher = le32_to_cpu(fwcs->cipher);
 494                 cs->iftype = BIT(NL80211_IFTYPE_STATION);
 495                 cs->hdr_len = fwcs->hdr_len;
 496                 cs->pn_len = fwcs->pn_len;
 497                 cs->pn_off = fwcs->pn_off;
 498                 cs->key_idx_off = fwcs->key_idx_off;
 499                 cs->key_idx_mask = fwcs->key_idx_mask;
 500                 cs->key_idx_shift = fwcs->key_idx_shift;
 501                 cs->mic_len = fwcs->mic_len;
 502
 503                 mvm->hw->cipher_schemes = mvm->cs;
 504                 mvm->ciphers[hw->wiphy->n_cipher_suites] = cs->cipher;
 505                 hw->wiphy->n_cipher_suites++;
 506         }
 507
 508         if (fw_has_capa(&mvm->fw->ucode_capa,
 509                         IWL_UCODE_TLV_CAPA_FTM_CALIBRATED)) {
 510                 wiphy_ext_feature_set(hw->wiphy,
 511                                       NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
 512                 hw->wiphy->pmsr_capa = &iwl_mvm_pmsr_capa;
 513         }
 514
 515         ieee80211_hw_set(hw, SINGLE_SCAN_ON_ALL_BANDS);
 516         hw->wiphy->features |=
 517                 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR |
 518                 NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR |
 519                 NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
 520
 521         hw->sta_data_size = sizeof(struct iwl_mvm_sta);
 522         hw->vif_data_size = sizeof(struct iwl_mvm_vif);
 523         hw->chanctx_data_size = sizeof(u16);
 524         hw->txq_data_size = sizeof(struct iwl_mvm_txq);
 525
 526         hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
 527                 BIT(NL80211_IFTYPE_P2P_CLIENT) |
 528                 BIT(NL80211_IFTYPE_AP) |
 529                 BIT(NL80211_IFTYPE_P2P_GO) |
 530                 BIT(NL80211_IFTYPE_P2P_DEVICE) |
 531                 BIT(NL80211_IFTYPE_ADHOC);
 532
 533         hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
 534         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
 535         hw->wiphy->features |= NL80211_FEATURE_HT_IBSS;
 536
 537         hw->wiphy->regulatory_flags |= REGULATORY_ENABLE_RELAX_NO_IR;
 538         if (iwl_mvm_is_lar_supported(mvm))
 539                 hw->wiphy->regulatory_flags |= REGULATORY_WIPHY_SELF_MANAGED;
 540         else
 541                 hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG |
 542                                                REGULATORY_DISABLE_BEACON_HINTS;
 543
 544         hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
 545         hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
 546
 547         hw->wiphy->iface_combinations = iwl_mvm_iface_combinations;
 548         hw->wiphy->n_iface_combinations =
 549                 ARRAY_SIZE(iwl_mvm_iface_combinations);
 550
 551         hw->wiphy->max_remain_on_channel_duration = 10000;
 552         hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
 553
 554         /* Extract MAC address */
 555         memcpy(mvm->addresses[0].addr, mvm->nvm_data->hw_addr, ETH_ALEN);
 556         hw->wiphy->addresses = mvm->addresses;
 557         hw->wiphy->n_addresses = 1;
 558
 559         /* Extract additional MAC addresses if available */
 560         num_mac = (mvm->nvm_data->n_hw_addrs > 1) ?
 561                 min(IWL_MVM_MAX_ADDRESSES, mvm->nvm_data->n_hw_addrs) : 1;
 562
 563         for (i = 1; i < num_mac; i++) {
 564                 memcpy(mvm->addresses[i].addr, mvm->addresses[i-1].addr,
 565                        ETH_ALEN);
 566                 mvm->addresses[i].addr[5]++;
 567                 hw->wiphy->n_addresses++;
 568         }
 569
 570         iwl_mvm_reset_phy_ctxts(mvm);
 571
 572         hw->wiphy->max_scan_ie_len = iwl_mvm_max_scan_ie_len(mvm);
 573
 574         hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
 575
 576         BUILD_BUG_ON(IWL_MVM_SCAN_STOPPING_MASK & IWL_MVM_SCAN_MASK);
 577         BUILD_BUG_ON(IWL_MVM_MAX_UMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK) ||
 578                      IWL_MVM_MAX_LMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK));
 579
 580         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
 581                 mvm->max_scans = IWL_MVM_MAX_UMAC_SCANS;
 582         else
 583                 mvm->max_scans = IWL_MVM_MAX_LMAC_SCANS;
 584
 585         if (mvm->nvm_data->bands[NL80211_BAND_2GHZ].n_channels)
 586                 hw->wiphy->bands[NL80211_BAND_2GHZ] =
 587                         &mvm->nvm_data->bands[NL80211_BAND_2GHZ];
 588         if (mvm->nvm_data->bands[NL80211_BAND_5GHZ].n_channels) {
 589                 hw->wiphy->bands[NL80211_BAND_5GHZ] =
 590                         &mvm->nvm_data->bands[NL80211_BAND_5GHZ];
 591
 592                 if (fw_has_capa(&mvm->fw->ucode_capa,
 593                                 IWL_UCODE_TLV_CAPA_BEAMFORMER) &&
 594                     fw_has_api(&mvm->fw->ucode_capa,
 595                                IWL_UCODE_TLV_API_LQ_SS_PARAMS))
 596                         hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.cap |=
 597                                 IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
 598         }
 599
 600         hw->wiphy->hw_version = mvm->trans->hw_id;
 601
 602         if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM)
 603                 hw->wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
 604         else
 605                 hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 606
 607         hw->wiphy->max_sched_scan_reqs = 1;
 608         hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
 609         hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
 610         /* we create the 802.11 header and zero length SSID IE. */
 611         hw->wiphy->max_sched_scan_ie_len =
 612                 SCAN_OFFLOAD_PROBE_REQ_SIZE - 24 - 2;
 613         hw->wiphy->max_sched_scan_plans = IWL_MAX_SCHED_SCAN_PLANS;
 614         hw->wiphy->max_sched_scan_plan_interval = U16_MAX;
 615
 616         /*
 617          * the firmware uses u8 for num of iterations, but 0xff is saved for
 618          * infinite loop, so the maximum number of iterations is actually 254.
 619          */
 620         hw->wiphy->max_sched_scan_plan_iterations = 254;
 621
 622         hw->wiphy->features |= NL80211_FEATURE_P2P_GO_CTWIN |
 623                                NL80211_FEATURE_LOW_PRIORITY_SCAN |
 624                                NL80211_FEATURE_P2P_GO_OPPPS |
 625                                NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
 626                                NL80211_FEATURE_DYNAMIC_SMPS |
 627                                NL80211_FEATURE_STATIC_SMPS |
 628                                NL80211_FEATURE_SUPPORTS_WMM_ADMISSION;
 629
 630         if (fw_has_capa(&mvm->fw->ucode_capa,
 631                         IWL_UCODE_TLV_CAPA_TXPOWER_INSERTION_SUPPORT))
 632                 hw->wiphy->features |= NL80211_FEATURE_TX_POWER_INSERTION;
 633         if (fw_has_capa(&mvm->fw->ucode_capa,
 634                         IWL_UCODE_TLV_CAPA_QUIET_PERIOD_SUPPORT))
 635                 hw->wiphy->features |= NL80211_FEATURE_QUIET;
 636
 637         if (fw_has_capa(&mvm->fw->ucode_capa,
 638                         IWL_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT))
 639                 hw->wiphy->features |=
 640                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES;
 641
 642         if (fw_has_capa(&mvm->fw->ucode_capa,
 643                         IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT))
 644                 hw->wiphy->features |= NL80211_FEATURE_WFA_TPC_IE_IN_PROBES;
 645
 646         if (fw_has_api(&mvm->fw->ucode_capa,
 647                        IWL_UCODE_TLV_API_SCAN_TSF_REPORT)) {
 648                 wiphy_ext_feature_set(hw->wiphy,
 649                                       NL80211_EXT_FEATURE_SCAN_START_TIME);
 650                 wiphy_ext_feature_set(hw->wiphy,
 651                                       NL80211_EXT_FEATURE_BSS_PARENT_TSF);
 652                 wiphy_ext_feature_set(hw->wiphy,
 653                                       NL80211_EXT_FEATURE_SET_SCAN_DWELL);
 654         }
 655
 656         if (iwl_mvm_is_oce_supported(mvm)) {
 657                 wiphy_ext_feature_set(hw->wiphy,
 658                         NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP);
 659                 wiphy_ext_feature_set(hw->wiphy,
 660                         NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME);
 661                 wiphy_ext_feature_set(hw->wiphy,
 662                         NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION);
 663                 wiphy_ext_feature_set(hw->wiphy,
 664                         NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE);
 665         }
 666
 667         if (mvm->nvm_data->sku_cap_11ax_enable &&
 668             !iwlwifi_mod_params.disable_11ax) {
 669                 hw->wiphy->iftype_ext_capab = he_iftypes_ext_capa;
 670                 hw->wiphy->num_iftype_ext_capab =
 671                         ARRAY_SIZE(he_iftypes_ext_capa);
 672
 673                 ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
 674                 ieee80211_hw_set(hw, SUPPORTS_ONLY_HE_MULTI_BSSID);
 675         }
 676
 677         mvm->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
 678
 679 #ifdef CONFIG_PM_SLEEP
 680         if ((unified || mvm->fw->img[IWL_UCODE_WOWLAN].num_sec) &&
 681             mvm->trans->ops->d3_suspend &&
 682             mvm->trans->ops->d3_resume &&
 683             device_can_wakeup(mvm->trans->dev)) {
 684                 mvm->wowlan.flags |= WIPHY_WOWLAN_MAGIC_PKT |
 685                                      WIPHY_WOWLAN_DISCONNECT |
 686                                      WIPHY_WOWLAN_EAP_IDENTITY_REQ |
 687                                      WIPHY_WOWLAN_RFKILL_RELEASE |
 688                                      WIPHY_WOWLAN_NET_DETECT;
 689                 if (!iwlwifi_mod_params.swcrypto)
 690                         mvm->wowlan.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY |
 691                                              WIPHY_WOWLAN_GTK_REKEY_FAILURE |
 692                                              WIPHY_WOWLAN_4WAY_HANDSHAKE;
 693
 694                 mvm->wowlan.n_patterns = IWL_WOWLAN_MAX_PATTERNS;
 695                 mvm->wowlan.pattern_min_len = IWL_WOWLAN_MIN_PATTERN_LEN;
 696                 mvm->wowlan.pattern_max_len = IWL_WOWLAN_MAX_PATTERN_LEN;
 697                 mvm->wowlan.max_nd_match_sets = IWL_SCAN_MAX_PROFILES;
 698                 hw->wiphy->wowlan = &mvm->wowlan;
 699         }
 700 #endif
 701
 702 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
 703         /* assign default bcast filtering configuration */
 704         mvm->bcast_filters = iwl_mvm_default_bcast_filters;
 705 #endif
 706
 707         ret = iwl_mvm_leds_init(mvm);
 708         if (ret)
 709                 return ret;
 710
 711         if (fw_has_capa(&mvm->fw->ucode_capa,
 712                         IWL_UCODE_TLV_CAPA_TDLS_SUPPORT)) {
 713                 IWL_DEBUG_TDLS(mvm, "TDLS supported\n");
 714                 hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
 715                 ieee80211_hw_set(hw, TDLS_WIDER_BW);
 716         }
 717
 718         if (fw_has_capa(&mvm->fw->ucode_capa,
 719                         IWL_UCODE_TLV_CAPA_TDLS_CHANNEL_SWITCH)) {
 720                 IWL_DEBUG_TDLS(mvm, "TDLS channel switch supported\n");
 721                 hw->wiphy->features |= NL80211_FEATURE_TDLS_CHANNEL_SWITCH;
 722         }
 723
 724         hw->netdev_features |= mvm->cfg->features;
 725         if (!iwl_mvm_is_csum_supported(mvm)) {
 726                 hw->netdev_features &= ~(IWL_TX_CSUM_NETIF_FLAGS |
 727                                          NETIF_F_RXCSUM);
 728                 /* We may support SW TX CSUM */
 729                 if (IWL_MVM_SW_TX_CSUM_OFFLOAD)
 730                         hw->netdev_features |= IWL_TX_CSUM_NETIF_FLAGS;
 731         }
 732
 733         if (mvm->cfg->vht_mu_mimo_supported)
 734                 wiphy_ext_feature_set(hw->wiphy,
 735                                       NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER);
 736
 737         ret = ieee80211_register_hw(mvm->hw);
 738         if (ret) {
 739                 iwl_mvm_leds_exit(mvm);
 740         }
 741
 742         return ret;
 743 }
 744
 745 static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
 746                            struct ieee80211_tx_control *control,
 747                            struct sk_buff *skb)
 748 {
 749         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 750         struct ieee80211_sta *sta = control->sta;
 751         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 752         struct ieee80211_hdr *hdr = (void *)skb->data;
 753         bool offchannel = IEEE80211_SKB_CB(skb)->flags &
 754                 IEEE80211_TX_CTL_TX_OFFCHAN;
 755
 756         if (iwl_mvm_is_radio_killed(mvm)) {
 757                 IWL_DEBUG_DROP(mvm, "Dropping - RF/CT KILL\n");
 758                 goto drop;
 759         }
 760
 761         if (offchannel &&
 762             !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status) &&
 763             !test_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status))
 764                 goto drop;
 765
 766         /* treat non-bufferable MMPDUs on AP interfaces as broadcast */
 767         if ((info->control.vif->type == NL80211_IFTYPE_AP ||
 768              info->control.vif->type == NL80211_IFTYPE_ADHOC) &&
 769             ieee80211_is_mgmt(hdr->frame_control) &&
 770             !ieee80211_is_bufferable_mmpdu(hdr->frame_control))
 771                 sta = NULL;
 772
 773         /* If there is no sta, and it's not offchannel - send through AP */
 774         if (!sta && info->control.vif->type == NL80211_IFTYPE_STATION &&
 775             !offchannel) {
 776                 struct iwl_mvm_vif *mvmvif =
 777                         iwl_mvm_vif_from_mac80211(info->control.vif);
 778                 u8 ap_sta_id = READ_ONCE(mvmvif->ap_sta_id);
 779
 780                 if (ap_sta_id < IWL_MVM_STATION_COUNT) {
 781                         /* mac80211 holds rcu read lock */
 782                         sta = rcu_dereference(mvm->fw_id_to_mac_id[ap_sta_id]);
 783                         if (IS_ERR_OR_NULL(sta))
 784                                 goto drop;
 785                 }
 786         }
 787
 788         if (sta) {
 789                 if (iwl_mvm_tx_skb(mvm, skb, sta))
 790                         goto drop;
 791                 return;
 792         }
 793
 794         if (iwl_mvm_tx_skb_non_sta(mvm, skb))
 795                 goto drop;
 796         return;
 797  drop:
 798         ieee80211_free_txskb(hw, skb);
 799 }
 800
 801 void iwl_mvm_mac_itxq_xmit(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
 802 {
 803         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 804         struct iwl_mvm_txq *mvmtxq = iwl_mvm_txq_from_mac80211(txq);
 805         struct sk_buff *skb = NULL;
 806
 807         /*
 808          * No need for threads to be pending here, they can leave the first
 809          * taker all the work.
 810          *
 811          * mvmtxq->tx_request logic:
 812          *
 813          * If 0, no one is currently TXing, set to 1 to indicate current thread
 814          * will now start TX and other threads should quit.
 815          *
 816          * If 1, another thread is currently TXing, set to 2 to indicate to
 817          * that thread that there was another request. Since that request may
 818          * have raced with the check whether the queue is empty, the TXing
 819          * thread should check the queue's status one more time before leaving.
 820          * This check is done in order to not leave any TX hanging in the queue
 821          * until the next TX invocation (which may not even happen).
 822          *
 823          * If 2, another thread is currently TXing, and it will already double
 824          * check the queue, so do nothing.
 825          */
 826         if (atomic_fetch_add_unless(&mvmtxq->tx_request, 1, 2))
 827                 return;
 828
 829         rcu_read_lock();
 830         do {
 831                 while (likely(!mvmtxq->stopped &&
 832                               (mvm->trans->system_pm_mode ==
 833                                IWL_PLAT_PM_MODE_DISABLED))) {
 834                         skb = ieee80211_tx_dequeue(hw, txq);
 835
 836                         if (!skb) {
 837                                 if (txq->sta)
 838                                         IWL_DEBUG_TX(mvm,
 839                                                      "TXQ of sta %pM tid %d is now empty\n",
 840                                                      txq->sta->addr,
 841                                                      txq->tid);
 842                                 break;
 843                         }
 844
 845                         if (!txq->sta)
 846                                 iwl_mvm_tx_skb_non_sta(mvm, skb);
 847                         else
 848                                 iwl_mvm_tx_skb(mvm, skb, txq->sta);
 849                 }
 850         } while (atomic_dec_return(&mvmtxq->tx_request));
 851         rcu_read_unlock();
 852 }
 853
 854 static void iwl_mvm_mac_wake_tx_queue(struct ieee80211_hw *hw,
 855                                       struct ieee80211_txq *txq)
 856 {
 857         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 858         struct iwl_mvm_txq *mvmtxq = iwl_mvm_txq_from_mac80211(txq);
 859
 860         /*
 861          * Please note that racing is handled very carefully here:
 862          * mvmtxq->txq_id is updated during allocation, and mvmtxq->list is
 863          * deleted afterwards.
 864          * This means that if:
 865          * mvmtxq->txq_id != INVALID_QUEUE && list_empty(&mvmtxq->list):
 866          *      queue is allocated and we can TX.
 867          * mvmtxq->txq_id != INVALID_QUEUE && !list_empty(&mvmtxq->list):
 868          *      a race, should defer the frame.
 869          * mvmtxq->txq_id == INVALID_QUEUE && list_empty(&mvmtxq->list):
 870          *      need to allocate the queue and defer the frame.
 871          * mvmtxq->txq_id == INVALID_QUEUE && !list_empty(&mvmtxq->list):
 872          *      queue is already scheduled for allocation, no need to allocate,
 873          *      should defer the frame.
 874          */
 875
 876         /* If the queue is allocated TX and return. */
 877         if (!txq->sta || mvmtxq->txq_id != IWL_MVM_INVALID_QUEUE) {
 878                 /*
 879                  * Check that list is empty to avoid a race where txq_id is
 880                  * already updated, but the queue allocation work wasn't
 881                  * finished
 882                  */
 883                 if (unlikely(txq->sta && !list_empty(&mvmtxq->list)))
 884                         return;
 885
 886                 iwl_mvm_mac_itxq_xmit(hw, txq);
 887                 return;
 888         }
 889
 890         /* The list is being deleted only after the queue is fully allocated. */
 891         if (!list_empty(&mvmtxq->list))
 892                 return;
 893
 894         list_add_tail(&mvmtxq->list, &mvm->add_stream_txqs);
 895         schedule_work(&mvm->add_stream_wk);
 896 }
 897
 898 #define CHECK_BA_TRIGGER(_mvm, _trig, _tid_bm, _tid, _fmt...)           \
 899         do {                                                            \
 900                 if (!(le16_to_cpu(_tid_bm) & BIT(_tid)))                \
 901                         break;                                          \
 902                 iwl_fw_dbg_collect_trig(&(_mvm)->fwrt, _trig, _fmt);    \
 903         } while (0)
 904
 905 static void
 906 iwl_mvm_ampdu_check_trigger(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 907                             struct ieee80211_sta *sta, u16 tid, u16 rx_ba_ssn,
 908                             enum ieee80211_ampdu_mlme_action action)
 909 {
 910         struct iwl_fw_dbg_trigger_tlv *trig;
 911         struct iwl_fw_dbg_trigger_ba *ba_trig;
 912
 913         trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
 914                                      FW_DBG_TRIGGER_BA);
 915         if (!trig)
 916                 return;
 917
 918         ba_trig = (void *)trig->data;
 919
 920         switch (action) {
 921         case IEEE80211_AMPDU_TX_OPERATIONAL: {
 922                 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 923                 struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
 924
 925                 CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_start, tid,
 926                                  "TX AGG START: MAC %pM tid %d ssn %d\n",
 927                                  sta->addr, tid, tid_data->ssn);
 928                 break;
 929                 }
 930         case IEEE80211_AMPDU_TX_STOP_CONT:
 931                 CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_stop, tid,
 932                                  "TX AGG STOP: MAC %pM tid %d\n",
 933                                  sta->addr, tid);
 934                 break;
 935         case IEEE80211_AMPDU_RX_START:
 936                 CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_start, tid,
 937                                  "RX AGG START: MAC %pM tid %d ssn %d\n",
 938                                  sta->addr, tid, rx_ba_ssn);
 939                 break;
 940         case IEEE80211_AMPDU_RX_STOP:
 941                 CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_stop, tid,
 942                                  "RX AGG STOP: MAC %pM tid %d\n",
 943                                  sta->addr, tid);
 944                 break;
 945         default:
 946                 break;
 947         }
 948 }
 949
 950 static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
 951                                     struct ieee80211_vif *vif,
 952                                     struct ieee80211_ampdu_params *params)
 953 {
 954         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 955         int ret;
 956         struct ieee80211_sta *sta = params->sta;
 957         enum ieee80211_ampdu_mlme_action action = params->action;
 958         u16 tid = params->tid;
 959         u16 *ssn = &params->ssn;
 960         u16 buf_size = params->buf_size;
 961         bool amsdu = params->amsdu;
 962         u16 timeout = params->timeout;
 963
 964         IWL_DEBUG_HT(mvm, "A-MPDU action on addr %pM tid %d: action %d\n",
 965                      sta->addr, tid, action);
 966
 967         if (!(mvm->nvm_data->sku_cap_11n_enable))
 968                 return -EACCES;
 969
 970         mutex_lock(&mvm->mutex);
 971
 972         switch (action) {
 973         case IEEE80211_AMPDU_RX_START:
 974                 if (iwl_mvm_vif_from_mac80211(vif)->ap_sta_id ==
 975                                 iwl_mvm_sta_from_mac80211(sta)->sta_id) {
 976                         struct iwl_mvm_vif *mvmvif;
 977                         u16 macid = iwl_mvm_vif_from_mac80211(vif)->id;
 978                         struct iwl_mvm_tcm_mac *mdata = &mvm->tcm.data[macid];
 979
 980                         mdata->opened_rx_ba_sessions = true;
 981                         mvmvif = iwl_mvm_vif_from_mac80211(vif);
 982                         cancel_delayed_work(&mvmvif->uapsd_nonagg_detected_wk);
 983                 }
 984                 if (!iwl_enable_rx_ampdu()) {
 985                         ret = -EINVAL;
 986                         break;
 987                 }
 988                 ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, *ssn, true, buf_size,
 989                                          timeout);
 990                 break;
 991         case IEEE80211_AMPDU_RX_STOP:
 992                 ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, 0, false, buf_size,
 993                                          timeout);
 994                 break;
 995         case IEEE80211_AMPDU_TX_START:
 996                 if (!iwl_enable_tx_ampdu()) {
 997                         ret = -EINVAL;
 998                         break;
 999                 }
1000                 ret = iwl_mvm_sta_tx_agg_start(mvm, vif, sta, tid, ssn);
1001                 break;
1002         case IEEE80211_AMPDU_TX_STOP_CONT:
1003                 ret = iwl_mvm_sta_tx_agg_stop(mvm, vif, sta, tid);
1004                 break;
1005         case IEEE80211_AMPDU_TX_STOP_FLUSH:
1006         case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
1007                 ret = iwl_mvm_sta_tx_agg_flush(mvm, vif, sta, tid);
1008                 break;
1009         case IEEE80211_AMPDU_TX_OPERATIONAL:
1010                 ret = iwl_mvm_sta_tx_agg_oper(mvm, vif, sta, tid,
1011                                               buf_size, amsdu);
1012                 break;
1013         default:
1014                 WARN_ON_ONCE(1);
1015                 ret = -EINVAL;
1016                 break;
1017         }
1018
1019         if (!ret) {
1020                 u16 rx_ba_ssn = 0;
1021
1022                 if (action == IEEE80211_AMPDU_RX_START)
1023                         rx_ba_ssn = *ssn;
1024
1025                 iwl_mvm_ampdu_check_trigger(mvm, vif, sta, tid,
1026                                             rx_ba_ssn, action);
1027         }
1028         mutex_unlock(&mvm->mutex);
1029
1030         return ret;
1031 }
1032
1033 static void iwl_mvm_cleanup_iterator(void *data, u8 *mac,
1034                                      struct ieee80211_vif *vif)
1035 {
1036         struct iwl_mvm *mvm = data;
1037         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1038
1039         mvmvif->uploaded = false;
1040         mvmvif->ap_sta_id = IWL_MVM_INVALID_STA;
1041
1042         spin_lock_bh(&mvm->time_event_lock);
1043         iwl_mvm_te_clear_data(mvm, &mvmvif->time_event_data);
1044         spin_unlock_bh(&mvm->time_event_lock);
1045
1046         mvmvif->phy_ctxt = NULL;
1047         memset(&mvmvif->bf_data, 0, sizeof(mvmvif->bf_data));
1048         memset(&mvmvif->probe_resp_data, 0, sizeof(mvmvif->probe_resp_data));
1049 }
1050
1051 static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
1052 {
1053         iwl_mvm_stop_device(mvm);
1054
1055         mvm->cur_aid = 0;
1056
1057         mvm->scan_status = 0;
1058         mvm->ps_disabled = false;
1059         mvm->rfkill_safe_init_done = false;
1060
1061         /* just in case one was running */
1062         iwl_mvm_cleanup_roc_te(mvm);
1063         ieee80211_remain_on_channel_expired(mvm->hw);
1064
1065         iwl_mvm_ftm_restart(mvm);
1066
1067         /*
1068          * cleanup all interfaces, even inactive ones, as some might have
1069          * gone down during the HW restart
1070          */
1071         ieee80211_iterate_interfaces(mvm->hw, 0, iwl_mvm_cleanup_iterator, mvm);
1072
1073         mvm->p2p_device_vif = NULL;
1074
1075         iwl_mvm_reset_phy_ctxts(mvm);
1076         memset(mvm->fw_key_table, 0, sizeof(mvm->fw_key_table));
1077         memset(&mvm->last_bt_notif, 0, sizeof(mvm->last_bt_notif));
1078         memset(&mvm->last_bt_ci_cmd, 0, sizeof(mvm->last_bt_ci_cmd));
1079
1080         ieee80211_wake_queues(mvm->hw);
1081
1082         mvm->vif_count = 0;
1083         mvm->rx_ba_sessions = 0;
1084         mvm->fwrt.dump.conf = FW_DBG_INVALID;
1085         mvm->monitor_on = false;
1086
1087         /* keep statistics ticking */
1088         iwl_mvm_accu_radio_stats(mvm);
1089 }
1090
1091 int __iwl_mvm_mac_start(struct iwl_mvm *mvm)
1092 {
1093         int ret;
1094
1095         lockdep_assert_held(&mvm->mutex);
1096
1097         if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status)) {
1098                 /*
1099                  * Now convert the HW_RESTART_REQUESTED flag to IN_HW_RESTART
1100                  * so later code will - from now on - see that we're doing it.
1101                  */
1102                 set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1103                 clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status);
1104                 /* Clean up some internal and mac80211 state on restart */
1105                 iwl_mvm_restart_cleanup(mvm);
1106         }
1107         ret = iwl_mvm_up(mvm);
1108
1109         iwl_dbg_tlv_time_point(&mvm->fwrt, IWL_FW_INI_TIME_POINT_POST_INIT,
1110                                NULL);
1111         iwl_dbg_tlv_time_point(&mvm->fwrt, IWL_FW_INI_TIME_POINT_PERIODIC,
1112                                NULL);
1113
1114         if (ret && test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
1115                 /* Something went wrong - we need to finish some cleanup
1116                  * that normally iwl_mvm_mac_restart_complete() below
1117                  * would do.
1118                  */
1119                 clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1120         }
1121
1122         return ret;
1123 }
1124
1125 static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
1126 {
1127         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1128         int ret;
1129
1130         mutex_lock(&mvm->mutex);
1131         ret = __iwl_mvm_mac_start(mvm);
1132         mutex_unlock(&mvm->mutex);
1133
1134         return ret;
1135 }
1136
1137 static void iwl_mvm_restart_complete(struct iwl_mvm *mvm)
1138 {
1139         int ret;
1140
1141         mutex_lock(&mvm->mutex);
1142
1143         clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1144
1145         ret = iwl_mvm_update_quotas(mvm, true, NULL);
1146         if (ret)
1147                 IWL_ERR(mvm, "Failed to update quotas after restart (%d)\n",
1148                         ret);
1149
1150         iwl_mvm_send_recovery_cmd(mvm, ERROR_RECOVERY_END_OF_RECOVERY);
1151
1152         /*
1153          * If we have TDLS peers, remove them. We don't know the last seqno/PN
1154          * of packets the FW sent out, so we must reconnect.
1155          */
1156         iwl_mvm_teardown_tdls_peers(mvm);
1157
1158         mutex_unlock(&mvm->mutex);
1159 }
1160
1161 static void
1162 iwl_mvm_mac_reconfig_complete(struct ieee80211_hw *hw,
1163                               enum ieee80211_reconfig_type reconfig_type)
1164 {
1165         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1166
1167         switch (reconfig_type) {
1168         case IEEE80211_RECONFIG_TYPE_RESTART:
1169                 iwl_mvm_restart_complete(mvm);
1170                 break;
1171         case IEEE80211_RECONFIG_TYPE_SUSPEND:
1172                 break;
1173         }
1174 }
1175
1176 void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
1177 {
1178         lockdep_assert_held(&mvm->mutex);
1179
1180         /* firmware counters are obviously reset now, but we shouldn't
1181          * partially track so also clear the fw_reset_accu counters.
1182          */
1183         memset(&mvm->accu_radio_stats, 0, sizeof(mvm->accu_radio_stats));
1184
1185         /* async_handlers_wk is now blocked */
1186
1187         /*
1188          * The work item could be running or queued if the
1189          * ROC time event stops just as we get here.
1190          */
1191         flush_work(&mvm->roc_done_wk);
1192
1193         iwl_mvm_stop_device(mvm);
1194
1195         iwl_mvm_async_handlers_purge(mvm);
1196         /* async_handlers_list is empty and will stay empty: HW is stopped */
1197
1198         /* the fw is stopped, the aux sta is dead: clean up driver state */
1199         iwl_mvm_del_aux_sta(mvm);
1200
1201         /*
1202          * Clear IN_HW_RESTART and HW_RESTART_REQUESTED flag when stopping the
1203          * hw (as restart_complete() won't be called in this case) and mac80211
1204          * won't execute the restart.
1205          * But make sure to cleanup interfaces that have gone down before/during
1206          * HW restart was requested.
1207          */
1208         if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) ||
1209             test_and_clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
1210                                &mvm->status))
1211                 ieee80211_iterate_interfaces(mvm->hw, 0,
1212                                              iwl_mvm_cleanup_iterator, mvm);
1213
1214         /* We shouldn't have any UIDs still set.  Loop over all the UIDs to
1215          * make sure there's nothing left there and warn if any is found.
1216          */
1217         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1218                 int i;
1219
1220                 for (i = 0; i < mvm->max_scans; i++) {
1221                         if (WARN_ONCE(mvm->scan_uid_status[i],
1222                                       "UMAC scan UID %d status was not cleaned\n",
1223                                       i))
1224                                 mvm->scan_uid_status[i] = 0;
1225                 }
1226         }
1227 }
1228
1229 static void iwl_mvm_mac_stop(struct ieee80211_hw *hw)
1230 {
1231         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1232
1233         flush_work(&mvm->async_handlers_wk);
1234         flush_work(&mvm->add_stream_wk);
1235
1236         /*
1237          * Lock and clear the firmware running bit here already, so that
1238          * new commands coming in elsewhere, e.g. from debugfs, will not
1239          * be able to proceed. This is important here because one of those
1240          * debugfs files causes the firmware dump to be triggered, and if we
1241          * don't stop debugfs accesses before canceling that it could be
1242          * retriggered after we flush it but before we've cleared the bit.
1243          */
1244         clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status);
1245
1246         cancel_delayed_work_sync(&mvm->cs_tx_unblock_dwork);
1247         cancel_delayed_work_sync(&mvm->scan_timeout_dwork);
1248         iwl_fw_free_dump_desc(&mvm->fwrt);
1249
1250         mutex_lock(&mvm->mutex);
1251         __iwl_mvm_mac_stop(mvm);
1252         mutex_unlock(&mvm->mutex);
1253
1254         /*
1255          * The worker might have been waiting for the mutex, let it run and
1256          * discover that its list is now empty.
1257          */
1258         cancel_work_sync(&mvm->async_handlers_wk);
1259 }
1260
1261 static struct iwl_mvm_phy_ctxt *iwl_mvm_get_free_phy_ctxt(struct iwl_mvm *mvm)
1262 {
1263         u16 i;
1264
1265         lockdep_assert_held(&mvm->mutex);
1266
1267         for (i = 0; i < NUM_PHY_CTX; i++)
1268                 if (!mvm->phy_ctxts[i].ref)
1269                         return &mvm->phy_ctxts[i];
1270
1271         IWL_ERR(mvm, "No available PHY context\n");
1272         return NULL;
1273 }
1274
1275 static int iwl_mvm_set_tx_power(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1276                                 s16 tx_power)
1277 {
1278         int len;
1279         union {
1280                 struct iwl_dev_tx_power_cmd v5;
1281                 struct iwl_dev_tx_power_cmd_v4 v4;
1282         } cmd = {
1283                 .v5.v3.set_mode = cpu_to_le32(IWL_TX_POWER_MODE_SET_MAC),
1284                 .v5.v3.mac_context_id =
1285                         cpu_to_le32(iwl_mvm_vif_from_mac80211(vif)->id),
1286                 .v5.v3.pwr_restriction = cpu_to_le16(8 * tx_power),
1287         };
1288
1289         if (tx_power == IWL_DEFAULT_MAX_TX_POWER)
1290                 cmd.v5.v3.pwr_restriction = cpu_to_le16(IWL_DEV_MAX_TX_POWER);
1291
1292         if (fw_has_api(&mvm->fw->ucode_capa,
1293                        IWL_UCODE_TLV_API_REDUCE_TX_POWER))
1294                 len = sizeof(cmd.v5);
1295         else if (fw_has_capa(&mvm->fw->ucode_capa,
1296                              IWL_UCODE_TLV_CAPA_TX_POWER_ACK))
1297                 len = sizeof(cmd.v4);
1298         else
1299                 len = sizeof(cmd.v4.v3);
1300
1301         return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, 0, len, &cmd);
1302 }
1303
1304 static int iwl_mvm_post_channel_switch(struct ieee80211_hw *hw,
1305                                        struct ieee80211_vif *vif)
1306 {
1307         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1308         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1309         int ret;
1310
1311         mutex_lock(&mvm->mutex);
1312
1313         if (mvmvif->csa_failed) {
1314                 mvmvif->csa_failed = false;
1315                 ret = -EIO;
1316                 goto out_unlock;
1317         }
1318
1319         if (vif->type == NL80211_IFTYPE_STATION) {
1320                 struct iwl_mvm_sta *mvmsta;
1321
1322                 mvmvif->csa_bcn_pending = false;
1323                 mvmsta = iwl_mvm_sta_from_staid_protected(mvm,
1324                                                           mvmvif->ap_sta_id);
1325
1326                 if (WARN_ON(!mvmsta)) {
1327                         ret = -EIO;
1328                         goto out_unlock;
1329                 }
1330
1331                 if (!fw_has_capa(&mvm->fw->ucode_capa,
1332                                  IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD))
1333                         iwl_mvm_sta_modify_disable_tx(mvm, mvmsta, false);
1334
1335                 iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
1336
1337                 if (!fw_has_capa(&mvm->fw->ucode_capa,
1338                                  IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
1339                         ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
1340                         if (ret)
1341                                 goto out_unlock;
1342
1343                         iwl_mvm_stop_session_protection(mvm, vif);
1344                 }
1345         }
1346
1347         mvmvif->ps_disabled = false;
1348
1349         ret = iwl_mvm_power_update_ps(mvm);
1350
1351 out_unlock:
1352         mutex_unlock(&mvm->mutex);
1353
1354         return ret;
1355 }
1356
1357 static void iwl_mvm_abort_channel_switch(struct ieee80211_hw *hw,
1358                                          struct ieee80211_vif *vif)
1359 {
1360         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1361         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1362         struct iwl_chan_switch_te_cmd cmd = {
1363                 .mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
1364                                                           mvmvif->color)),
1365                 .action = cpu_to_le32(FW_CTXT_ACTION_REMOVE),
1366         };
1367
1368         IWL_DEBUG_MAC80211(mvm, "Abort CSA on mac %d\n", mvmvif->id);
1369
1370         mutex_lock(&mvm->mutex);
1371         WARN_ON(iwl_mvm_send_cmd_pdu(mvm,
1372                                      WIDE_ID(MAC_CONF_GROUP,
1373                                              CHANNEL_SWITCH_TIME_EVENT_CMD),
1374                                      0, sizeof(cmd), &cmd));
1375         mutex_unlock(&mvm->mutex);
1376
1377         WARN_ON(iwl_mvm_post_channel_switch(hw, vif));
1378 }
1379
1380 static void iwl_mvm_channel_switch_disconnect_wk(struct work_struct *wk)
1381 {
1382         struct iwl_mvm *mvm;
1383         struct iwl_mvm_vif *mvmvif;
1384         struct ieee80211_vif *vif;
1385
1386         mvmvif = container_of(wk, struct iwl_mvm_vif, csa_work.work);
1387         vif = container_of((void *)mvmvif, struct ieee80211_vif, drv_priv);
1388         mvm = mvmvif->mvm;
1389
1390         iwl_mvm_abort_channel_switch(mvm->hw, vif);
1391         ieee80211_chswitch_done(vif, false);
1392 }
1393
1394 static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
1395                                      struct ieee80211_vif *vif)
1396 {
1397         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1398         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1399         int ret;
1400
1401         mvmvif->mvm = mvm;
1402         RCU_INIT_POINTER(mvmvif->probe_resp_data, NULL);
1403
1404         /*
1405          * Not much to do here. The stack will not allow interface
1406          * types or combinations that we didn't advertise, so we
1407          * don't really have to check the types.
1408          */
1409
1410         mutex_lock(&mvm->mutex);
1411
1412         /* make sure that beacon statistics don't go backwards with FW reset */
1413         if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
1414                 mvmvif->beacon_stats.accu_num_beacons +=
1415                         mvmvif->beacon_stats.num_beacons;
1416
1417         /* Allocate resources for the MAC context, and add it to the fw  */
1418         ret = iwl_mvm_mac_ctxt_init(mvm, vif);
1419         if (ret)
1420                 goto out_unlock;
1421
1422         rcu_assign_pointer(mvm->vif_id_to_mac[mvmvif->id], vif);
1423
1424         /* Counting number of interfaces is needed for legacy PM */
1425         if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1426                 mvm->vif_count++;
1427
1428         /*
1429          * The AP binding flow can be done only after the beacon
1430          * template is configured (which happens only in the mac80211
1431          * start_ap() flow), and adding the broadcast station can happen
1432          * only after the binding.
1433          * In addition, since modifying the MAC before adding a bcast
1434          * station is not allowed by the FW, delay the adding of MAC context to
1435          * the point where we can also add the bcast station.
1436          * In short: there's not much we can do at this point, other than
1437          * allocating resources :)
1438          */
1439         if (vif->type == NL80211_IFTYPE_AP ||
1440             vif->type == NL80211_IFTYPE_ADHOC) {
1441                 ret = iwl_mvm_alloc_bcast_sta(mvm, vif);
1442                 if (ret) {
1443                         IWL_ERR(mvm, "Failed to allocate bcast sta\n");
1444                         goto out_release;
1445                 }
1446
1447                 /*
1448                  * Only queue for this station is the mcast queue,
1449                  * which shouldn't be in TFD mask anyway
1450                  */
1451                 ret = iwl_mvm_allocate_int_sta(mvm, &mvmvif->mcast_sta,
1452                                                0, vif->type,
1453                                                IWL_STA_MULTICAST);
1454                 if (ret)
1455                         goto out_release;
1456
1457                 iwl_mvm_vif_dbgfs_register(mvm, vif);
1458                 goto out_unlock;
1459         }
1460
1461         mvmvif->features |= hw->netdev_features;
1462
1463         ret = iwl_mvm_mac_ctxt_add(mvm, vif);
1464         if (ret)
1465                 goto out_release;
1466
1467         ret = iwl_mvm_power_update_mac(mvm);
1468         if (ret)
1469                 goto out_remove_mac;
1470
1471         /* beacon filtering */
1472         ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
1473         if (ret)
1474                 goto out_remove_mac;
1475
1476         if (!mvm->bf_allowed_vif &&
1477             vif->type == NL80211_IFTYPE_STATION && !vif->p2p) {
1478                 mvm->bf_allowed_vif = mvmvif;
1479                 vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
1480                                      IEEE80211_VIF_SUPPORTS_CQM_RSSI;
1481         }
1482
1483         /*
1484          * P2P_DEVICE interface does not have a channel context assigned to it,
1485          * so a dedicated PHY context is allocated to it and the corresponding
1486          * MAC context is bound to it at this stage.
1487          */
1488         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1489
1490                 mvmvif->phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
1491                 if (!mvmvif->phy_ctxt) {
1492                         ret = -ENOSPC;
1493                         goto out_free_bf;
1494                 }
1495
1496                 iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
1497                 ret = iwl_mvm_binding_add_vif(mvm, vif);
1498                 if (ret)
1499                         goto out_unref_phy;
1500
1501                 ret = iwl_mvm_add_p2p_bcast_sta(mvm, vif);
1502                 if (ret)
1503                         goto out_unbind;
1504
1505                 /* Save a pointer to p2p device vif, so it can later be used to
1506                  * update the p2p device MAC when a GO is started/stopped */
1507                 mvm->p2p_device_vif = vif;
1508         }
1509
1510         iwl_mvm_tcm_add_vif(mvm, vif);
1511         INIT_DELAYED_WORK(&mvmvif->csa_work,
1512                           iwl_mvm_channel_switch_disconnect_wk);
1513
1514         if (vif->type == NL80211_IFTYPE_MONITOR)
1515                 mvm->monitor_on = true;
1516
1517         iwl_mvm_vif_dbgfs_register(mvm, vif);
1518         goto out_unlock;
1519
1520  out_unbind:
1521         iwl_mvm_binding_remove_vif(mvm, vif);
1522  out_unref_phy:
1523         iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1524  out_free_bf:
1525         if (mvm->bf_allowed_vif == mvmvif) {
1526                 mvm->bf_allowed_vif = NULL;
1527                 vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1528                                        IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1529         }
1530  out_remove_mac:
1531         mvmvif->phy_ctxt = NULL;
1532         iwl_mvm_mac_ctxt_remove(mvm, vif);
1533  out_release:
1534         if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1535                 mvm->vif_count--;
1536  out_unlock:
1537         mutex_unlock(&mvm->mutex);
1538
1539         return ret;
1540 }
1541
1542 static void iwl_mvm_prepare_mac_removal(struct iwl_mvm *mvm,
1543                                         struct ieee80211_vif *vif)
1544 {
1545         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1546                 /*
1547                  * Flush the ROC worker which will flush the OFFCHANNEL queue.
1548                  * We assume here that all the packets sent to the OFFCHANNEL
1549                  * queue are sent in ROC session.
1550                  */
1551                 flush_work(&mvm->roc_done_wk);
1552         }
1553 }
1554
1555 static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
1556                                          struct ieee80211_vif *vif)
1557 {
1558         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1559         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1560         struct iwl_probe_resp_data *probe_data;
1561
1562         iwl_mvm_prepare_mac_removal(mvm, vif);
1563
1564         if (!(vif->type == NL80211_IFTYPE_AP ||
1565               vif->type == NL80211_IFTYPE_ADHOC))
1566                 iwl_mvm_tcm_rm_vif(mvm, vif);
1567
1568         mutex_lock(&mvm->mutex);
1569
1570         probe_data = rcu_dereference_protected(mvmvif->probe_resp_data,
1571                                                lockdep_is_held(&mvm->mutex));
1572         RCU_INIT_POINTER(mvmvif->probe_resp_data, NULL);
1573         if (probe_data)
1574                 kfree_rcu(probe_data, rcu_head);
1575
1576         if (mvm->bf_allowed_vif == mvmvif) {
1577                 mvm->bf_allowed_vif = NULL;
1578                 vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1579                                        IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1580         }
1581
1582         if (vif->bss_conf.ftm_responder)
1583                 memset(&mvm->ftm_resp_stats, 0, sizeof(mvm->ftm_resp_stats));
1584
1585         iwl_mvm_vif_dbgfs_clean(mvm, vif);
1586
1587         /*
1588          * For AP/GO interface, the tear down of the resources allocated to the
1589          * interface is be handled as part of the stop_ap flow.
1590          */
1591         if (vif->type == NL80211_IFTYPE_AP ||
1592             vif->type == NL80211_IFTYPE_ADHOC) {
1593 #ifdef CONFIG_NL80211_TESTMODE
1594                 if (vif == mvm->noa_vif) {
1595                         mvm->noa_vif = NULL;
1596                         mvm->noa_duration = 0;
1597                 }
1598 #endif
1599                 iwl_mvm_dealloc_int_sta(mvm, &mvmvif->mcast_sta);
1600                 iwl_mvm_dealloc_bcast_sta(mvm, vif);
1601                 goto out_release;
1602         }
1603
1604         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1605                 mvm->p2p_device_vif = NULL;
1606                 iwl_mvm_rm_p2p_bcast_sta(mvm, vif);
1607                 iwl_mvm_binding_remove_vif(mvm, vif);
1608                 iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1609                 mvmvif->phy_ctxt = NULL;
1610         }
1611
1612         if (mvm->vif_count && vif->type != NL80211_IFTYPE_P2P_DEVICE)
1613                 mvm->vif_count--;
1614
1615         iwl_mvm_power_update_mac(mvm);
1616         iwl_mvm_mac_ctxt_remove(mvm, vif);
1617
1618         RCU_INIT_POINTER(mvm->vif_id_to_mac[mvmvif->id], NULL);
1619
1620         if (vif->type == NL80211_IFTYPE_MONITOR)
1621                 mvm->monitor_on = false;
1622
1623 out_release:
1624         mutex_unlock(&mvm->mutex);
1625 }
1626
1627 static int iwl_mvm_mac_config(struct ieee80211_hw *hw, u32 changed)
1628 {
1629         return 0;
1630 }
1631
1632 struct iwl_mvm_mc_iter_data {
1633         struct iwl_mvm *mvm;
1634         int port_id;
1635 };
1636
1637 static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
1638                                       struct ieee80211_vif *vif)
1639 {
1640         struct iwl_mvm_mc_iter_data *data = _data;
1641         struct iwl_mvm *mvm = data->mvm;
1642         struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd;
1643         struct iwl_host_cmd hcmd = {
1644                 .id = MCAST_FILTER_CMD,
1645                 .flags = CMD_ASYNC,
1646                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
1647         };
1648         int ret, len;
1649
1650         /* if we don't have free ports, mcast frames will be dropped */
1651         if (WARN_ON_ONCE(data->port_id >= MAX_PORT_ID_NUM))
1652                 return;
1653
1654         if (vif->type != NL80211_IFTYPE_STATION ||
1655             !vif->bss_conf.assoc)
1656                 return;
1657
1658         cmd->port_id = data->port_id++;
1659         memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
1660         len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4);
1661
1662         hcmd.len[0] = len;
1663         hcmd.data[0] = cmd;
1664
1665         ret = iwl_mvm_send_cmd(mvm, &hcmd);
1666         if (ret)
1667                 IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret);
1668 }
1669
1670 static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm)
1671 {
1672         struct iwl_mvm_mc_iter_data iter_data = {
1673                 .mvm = mvm,
1674         };
1675
1676         lockdep_assert_held(&mvm->mutex);
1677
1678         if (WARN_ON_ONCE(!mvm->mcast_filter_cmd))
1679                 return;
1680
1681         ieee80211_iterate_active_interfaces_atomic(
1682                 mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1683                 iwl_mvm_mc_iface_iterator, &iter_data);
1684 }
1685
1686 static u64 iwl_mvm_prepare_multicast(struct ieee80211_hw *hw,
1687                                      struct netdev_hw_addr_list *mc_list)
1688 {
1689         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1690         struct iwl_mcast_filter_cmd *cmd;
1691         struct netdev_hw_addr *addr;
1692         int addr_count;
1693         bool pass_all;
1694         int len;
1695
1696         addr_count = netdev_hw_addr_list_count(mc_list);
1697         pass_all = addr_count > MAX_MCAST_FILTERING_ADDRESSES ||
1698                    IWL_MVM_FW_MCAST_FILTER_PASS_ALL;
1699         if (pass_all)
1700                 addr_count = 0;
1701
1702         len = roundup(sizeof(*cmd) + addr_count * ETH_ALEN, 4);
1703         cmd = kzalloc(len, GFP_ATOMIC);
1704         if (!cmd)
1705                 return 0;
1706
1707         if (pass_all) {
1708                 cmd->pass_all = 1;
1709                 return (u64)(unsigned long)cmd;
1710         }
1711
1712         netdev_hw_addr_list_for_each(addr, mc_list) {
1713                 IWL_DEBUG_MAC80211(mvm, "mcast addr (%d): %pM\n",
1714                                    cmd->count, addr->addr);
1715                 memcpy(&cmd->addr_list[cmd->count * ETH_ALEN],
1716                        addr->addr, ETH_ALEN);
1717                 cmd->count++;
1718         }
1719
1720         return (u64)(unsigned long)cmd;
1721 }
1722
1723 static void iwl_mvm_configure_filter(struct ieee80211_hw *hw,
1724                                      unsigned int changed_flags,
1725                                      unsigned int *total_flags,
1726                                      u64 multicast)
1727 {
1728         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1729         struct iwl_mcast_filter_cmd *cmd = (void *)(unsigned long)multicast;
1730
1731         mutex_lock(&mvm->mutex);
1732
1733         /* replace previous configuration */
1734         kfree(mvm->mcast_filter_cmd);
1735         mvm->mcast_filter_cmd = cmd;
1736
1737         if (!cmd)
1738                 goto out;
1739
1740         if (changed_flags & FIF_ALLMULTI)
1741                 cmd->pass_all = !!(*total_flags & FIF_ALLMULTI);
1742
1743         if (cmd->pass_all)
1744                 cmd->count = 0;
1745
1746         iwl_mvm_recalc_multicast(mvm);
1747 out:
1748         mutex_unlock(&mvm->mutex);
1749         *total_flags = 0;
1750 }
1751
1752 static void iwl_mvm_config_iface_filter(struct ieee80211_hw *hw,
1753                                         struct ieee80211_vif *vif,
1754                                         unsigned int filter_flags,
1755                                         unsigned int changed_flags)
1756 {
1757         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1758
1759         /* We support only filter for probe requests */
1760         if (!(changed_flags & FIF_PROBE_REQ))
1761                 return;
1762
1763         /* Supported only for p2p client interfaces */
1764         if (vif->type != NL80211_IFTYPE_STATION || !vif->bss_conf.assoc ||
1765             !vif->p2p)
1766                 return;
1767
1768         mutex_lock(&mvm->mutex);
1769         iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
1770         mutex_unlock(&mvm->mutex);
1771 }
1772
1773 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
1774 struct iwl_bcast_iter_data {
1775         struct iwl_mvm *mvm;
1776         struct iwl_bcast_filter_cmd *cmd;
1777         u8 current_filter;
1778 };
1779
1780 static void
1781 iwl_mvm_set_bcast_filter(struct ieee80211_vif *vif,
1782                          const struct iwl_fw_bcast_filter *in_filter,
1783                          struct iwl_fw_bcast_filter *out_filter)
1784 {
1785         struct iwl_fw_bcast_filter_attr *attr;
1786         int i;
1787
1788         memcpy(out_filter, in_filter, sizeof(*out_filter));
1789
1790         for (i = 0; i < ARRAY_SIZE(out_filter->attrs); i++) {
1791                 attr = &out_filter->attrs[i];
1792
1793                 if (!attr->mask)
1794                         break;
1795
1796                 switch (attr->reserved1) {
1797                 case cpu_to_le16(BC_FILTER_MAGIC_IP):
1798                         if (vif->bss_conf.arp_addr_cnt != 1) {
1799                                 attr->mask = 0;
1800                                 continue;
1801                         }
1802
1803                         attr->val = vif->bss_conf.arp_addr_list[0];
1804                         break;
1805                 case cpu_to_le16(BC_FILTER_MAGIC_MAC):
1806                         attr->val = *(__be32 *)&vif->addr[2];
1807                         break;
1808                 default:
1809                         break;
1810                 }
1811                 attr->reserved1 = 0;
1812                 out_filter->num_attrs++;
1813         }
1814 }
1815
1816 static void iwl_mvm_bcast_filter_iterator(void *_data, u8 *mac,
1817                                           struct ieee80211_vif *vif)
1818 {
1819         struct iwl_bcast_iter_data *data = _data;
1820         struct iwl_mvm *mvm = data->mvm;
1821         struct iwl_bcast_filter_cmd *cmd = data->cmd;
1822         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1823         struct iwl_fw_bcast_mac *bcast_mac;
1824         int i;
1825
1826         if (WARN_ON(mvmvif->id >= ARRAY_SIZE(cmd->macs)))
1827                 return;
1828
1829         bcast_mac = &cmd->macs[mvmvif->id];
1830
1831         /*
1832          * enable filtering only for associated stations, but not for P2P
1833          * Clients
1834          */
1835         if (vif->type != NL80211_IFTYPE_STATION || vif->p2p ||
1836             !vif->bss_conf.assoc)
1837                 return;
1838
1839         bcast_mac->default_discard = 1;
1840
1841         /* copy all configured filters */
1842         for (i = 0; mvm->bcast_filters[i].attrs[0].mask; i++) {
1843                 /*
1844                  * Make sure we don't exceed our filters limit.
1845                  * if there is still a valid filter to be configured,
1846                  * be on the safe side and just allow bcast for this mac.
1847                  */
1848                 if (WARN_ON_ONCE(data->current_filter >=
1849                                  ARRAY_SIZE(cmd->filters))) {
1850                         bcast_mac->default_discard = 0;
1851                         bcast_mac->attached_filters = 0;
1852                         break;
1853                 }
1854
1855                 iwl_mvm_set_bcast_filter(vif,
1856                                          &mvm->bcast_filters[i],
1857                                          &cmd->filters[data->current_filter]);
1858
1859                 /* skip current filter if it contains no attributes */
1860                 if (!cmd->filters[data->current_filter].num_attrs)
1861                         continue;
1862
1863                 /* attach the filter to current mac */
1864                 bcast_mac->attached_filters |=
1865                                 cpu_to_le16(BIT(data->current_filter));
1866
1867                 data->current_filter++;
1868         }
1869 }
1870
1871 bool iwl_mvm_bcast_filter_build_cmd(struct iwl_mvm *mvm,
1872                                     struct iwl_bcast_filter_cmd *cmd)
1873 {
1874         struct iwl_bcast_iter_data iter_data = {
1875                 .mvm = mvm,
1876                 .cmd = cmd,
1877         };
1878
1879         if (IWL_MVM_FW_BCAST_FILTER_PASS_ALL)
1880                 return false;
1881
1882         memset(cmd, 0, sizeof(*cmd));
1883         cmd->max_bcast_filters = ARRAY_SIZE(cmd->filters);
1884         cmd->max_macs = ARRAY_SIZE(cmd->macs);
1885
1886 #ifdef CONFIG_IWLWIFI_DEBUGFS
1887         /* use debugfs filters/macs if override is configured */
1888         if (mvm->dbgfs_bcast_filtering.override) {
1889                 memcpy(cmd->filters, &mvm->dbgfs_bcast_filtering.cmd.filters,
1890                        sizeof(cmd->filters));
1891                 memcpy(cmd->macs, &mvm->dbgfs_bcast_filtering.cmd.macs,
1892                        sizeof(cmd->macs));
1893                 return true;
1894         }
1895 #endif
1896
1897         /* if no filters are configured, do nothing */
1898         if (!mvm->bcast_filters)
1899                 return false;
1900
1901         /* configure and attach these filters for each associated sta vif */
1902         ieee80211_iterate_active_interfaces(
1903                 mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1904                 iwl_mvm_bcast_filter_iterator, &iter_data);
1905
1906         return true;
1907 }
1908
1909 static int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
1910 {
1911         struct iwl_bcast_filter_cmd cmd;
1912
1913         if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BCAST_FILTERING))
1914                 return 0;
1915
1916         if (!iwl_mvm_bcast_filter_build_cmd(mvm, &cmd))
1917                 return 0;
1918
1919         return iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, 0,
1920                                     sizeof(cmd), &cmd);
1921 }
1922 #else
1923 static inline int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
1924 {
1925         return 0;
1926 }
1927 #endif
1928
1929 static int iwl_mvm_update_mu_groups(struct iwl_mvm *mvm,
1930                                     struct ieee80211_vif *vif)
1931 {
1932         struct iwl_mu_group_mgmt_cmd cmd = {};
1933
1934         memcpy(cmd.membership_status, vif->bss_conf.mu_group.membership,
1935                WLAN_MEMBERSHIP_LEN);
1936         memcpy(cmd.user_position, vif->bss_conf.mu_group.position,
1937                WLAN_USER_POSITION_LEN);
1938
1939         return iwl_mvm_send_cmd_pdu(mvm,
1940                                     WIDE_ID(DATA_PATH_GROUP,
1941                                             UPDATE_MU_GROUPS_CMD),
1942                                     0, sizeof(cmd), &cmd);
1943 }
1944
1945 static void iwl_mvm_mu_mimo_iface_iterator(void *_data, u8 *mac,
1946                                            struct ieee80211_vif *vif)
1947 {
1948         if (vif->mu_mimo_owner) {
1949                 struct iwl_mu_group_mgmt_notif *notif = _data;
1950
1951                 /*
1952                  * MU-MIMO Group Id action frame is little endian. We treat
1953                  * the data received from firmware as if it came from the
1954                  * action frame, so no conversion is needed.
1955                  */
1956                 ieee80211_update_mu_groups(vif,
1957                                            (u8 *)&notif->membership_status,
1958                                            (u8 *)&notif->user_position);
1959         }
1960 }
1961
1962 void iwl_mvm_mu_mimo_grp_notif(struct iwl_mvm *mvm,
1963                                struct iwl_rx_cmd_buffer *rxb)
1964 {
1965         struct iwl_rx_packet *pkt = rxb_addr(rxb);
1966         struct iwl_mu_group_mgmt_notif *notif = (void *)pkt->data;
1967
1968         ieee80211_iterate_active_interfaces_atomic(
1969                         mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1970                         iwl_mvm_mu_mimo_iface_iterator, notif);
1971 }
1972
1973 static u8 iwl_mvm_he_get_ppe_val(u8 *ppe, u8 ppe_pos_bit)
1974 {
1975         u8 byte_num = ppe_pos_bit / 8;
1976         u8 bit_num = ppe_pos_bit % 8;
1977         u8 residue_bits;
1978         u8 res;
1979
1980         if (bit_num <= 5)
1981                 return (ppe[byte_num] >> bit_num) &
1982                        (BIT(IEEE80211_PPE_THRES_INFO_PPET_SIZE) - 1);
1983
1984         /*
1985          * If bit_num > 5, we have to combine bits with next byte.
1986          * Calculate how many bits we need to take from current byte (called
1987          * here "residue_bits"), and add them to bits from next byte.
1988          */
1989
1990         residue_bits = 8 - bit_num;
1991
1992         res = (ppe[byte_num + 1] &
1993                (BIT(IEEE80211_PPE_THRES_INFO_PPET_SIZE - residue_bits) - 1)) <<
1994               residue_bits;
1995         res += (ppe[byte_num] >> bit_num) & (BIT(residue_bits) - 1);
1996
1997         return res;
1998 }
1999
2000 static void iwl_mvm_cfg_he_sta(struct iwl_mvm *mvm,
2001                                struct ieee80211_vif *vif, u8 sta_id)
2002 {
2003         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2004         struct iwl_he_sta_context_cmd sta_ctxt_cmd = {
2005                 .sta_id = sta_id,
2006                 .tid_limit = IWL_MAX_TID_COUNT,
2007                 .bss_color = vif->bss_conf.bss_color,
2008                 .htc_trig_based_pkt_ext = vif->bss_conf.htc_trig_based_pkt_ext,
2009                 .frame_time_rts_th =
2010                         cpu_to_le16(vif->bss_conf.frame_time_rts_th),
2011         };
2012         int size = fw_has_api(&mvm->fw->ucode_capa,
2013                               IWL_UCODE_TLV_API_MBSSID_HE) ?
2014                    sizeof(sta_ctxt_cmd) :
2015                    sizeof(struct iwl_he_sta_context_cmd_v1);
2016         struct ieee80211_sta *sta;
2017         u32 flags;
2018         int i;
2019
2020         rcu_read_lock();
2021
2022         sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_ctxt_cmd.sta_id]);
2023         if (IS_ERR(sta)) {
2024                 rcu_read_unlock();
2025                 WARN(1, "Can't find STA to configure HE\n");
2026                 return;
2027         }
2028
2029         if (!sta->he_cap.has_he) {
2030                 rcu_read_unlock();
2031                 return;
2032         }
2033
2034         flags = 0;
2035
2036         /* Block 26-tone RU OFDMA transmissions */
2037         if (mvmvif->he_ru_2mhz_block)
2038                 flags |= STA_CTXT_HE_RU_2MHZ_BLOCK;
2039
2040         /* HTC flags */
2041         if (sta->he_cap.he_cap_elem.mac_cap_info[0] &
2042             IEEE80211_HE_MAC_CAP0_HTC_HE)
2043                 sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_SUPPORT);
2044         if ((sta->he_cap.he_cap_elem.mac_cap_info[1] &
2045               IEEE80211_HE_MAC_CAP1_LINK_ADAPTATION) ||
2046             (sta->he_cap.he_cap_elem.mac_cap_info[2] &
2047               IEEE80211_HE_MAC_CAP2_LINK_ADAPTATION)) {
2048                 u8 link_adap =
2049                         ((sta->he_cap.he_cap_elem.mac_cap_info[2] &
2050                           IEEE80211_HE_MAC_CAP2_LINK_ADAPTATION) << 1) +
2051                          (sta->he_cap.he_cap_elem.mac_cap_info[1] &
2052                           IEEE80211_HE_MAC_CAP1_LINK_ADAPTATION);
2053
2054                 if (link_adap == 2)
2055                         sta_ctxt_cmd.htc_flags |=
2056                                 cpu_to_le32(IWL_HE_HTC_LINK_ADAP_UNSOLICITED);
2057                 else if (link_adap == 3)
2058                         sta_ctxt_cmd.htc_flags |=
2059                                 cpu_to_le32(IWL_HE_HTC_LINK_ADAP_BOTH);
2060         }
2061         if (sta->he_cap.he_cap_elem.mac_cap_info[2] & IEEE80211_HE_MAC_CAP2_BSR)
2062                 sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_BSR_SUPP);
2063         if (sta->he_cap.he_cap_elem.mac_cap_info[3] &
2064             IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
2065                 sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_OMI_SUPP);
2066         if (sta->he_cap.he_cap_elem.mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
2067                 sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_BQR_SUPP);
2068
2069         /*
2070          * Initialize the PPE thresholds to "None" (7), as described in Table
2071          * 9-262ac of 80211.ax/D3.0.
2072          */
2073         memset(&sta_ctxt_cmd.pkt_ext, 7, sizeof(sta_ctxt_cmd.pkt_ext));
2074
2075         /* If PPE Thresholds exist, parse them into a FW-familiar format. */
2076         if (sta->he_cap.he_cap_elem.phy_cap_info[6] &
2077             IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT) {
2078                 u8 nss = (sta->he_cap.ppe_thres[0] &
2079                           IEEE80211_PPE_THRES_NSS_MASK) + 1;
2080                 u8 ru_index_bitmap =
2081                         (sta->he_cap.ppe_thres[0] &
2082                          IEEE80211_PPE_THRES_RU_INDEX_BITMASK_MASK) >>
2083                         IEEE80211_PPE_THRES_RU_INDEX_BITMASK_POS;
2084                 u8 *ppe = &sta->he_cap.ppe_thres[0];
2085                 u8 ppe_pos_bit = 7; /* Starting after PPE header */
2086
2087                 /*
2088                  * FW currently supports only nss == MAX_HE_SUPP_NSS
2089                  *
2090                  * If nss > MAX: we can ignore values we don't support
2091                  * If nss < MAX: we can set zeros in other streams
2092                  */
2093                 if (nss > MAX_HE_SUPP_NSS) {
2094                         IWL_INFO(mvm, "Got NSS = %d - trimming to %d\n", nss,
2095                                  MAX_HE_SUPP_NSS);
2096                         nss = MAX_HE_SUPP_NSS;
2097                 }
2098
2099                 for (i = 0; i < nss; i++) {
2100                         u8 ru_index_tmp = ru_index_bitmap << 1;
2101                         u8 bw;
2102
2103                         for (bw = 0; bw < MAX_HE_CHANNEL_BW_INDX; bw++) {
2104                                 ru_index_tmp >>= 1;
2105                                 if (!(ru_index_tmp & 1))
2106                                         continue;
2107
2108                                 sta_ctxt_cmd.pkt_ext.pkt_ext_qam_th[i][bw][1] =
2109                                         iwl_mvm_he_get_ppe_val(ppe,
2110                                                                ppe_pos_bit);
2111                                 ppe_pos_bit +=
2112                                         IEEE80211_PPE_THRES_INFO_PPET_SIZE;
2113                                 sta_ctxt_cmd.pkt_ext.pkt_ext_qam_th[i][bw][0] =
2114                                         iwl_mvm_he_get_ppe_val(ppe,
2115                                                                ppe_pos_bit);
2116                                 ppe_pos_bit +=
2117                                         IEEE80211_PPE_THRES_INFO_PPET_SIZE;
2118                         }
2119                 }
2120
2121                 flags |= STA_CTXT_HE_PACKET_EXT;
2122         } else if ((sta->he_cap.he_cap_elem.phy_cap_info[9] &
2123                     IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_MASK) !=
2124                   IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_RESERVED) {
2125                 int low_th = -1;
2126                 int high_th = -1;
2127
2128                 /* Take the PPE thresholds from the nominal padding info */
2129                 switch (sta->he_cap.he_cap_elem.phy_cap_info[9] &
2130                         IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_MASK) {
2131                 case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_0US:
2132                         low_th = IWL_HE_PKT_EXT_NONE;
2133                         high_th = IWL_HE_PKT_EXT_NONE;
2134                         break;
2135                 case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_8US:
2136                         low_th = IWL_HE_PKT_EXT_BPSK;
2137                         high_th = IWL_HE_PKT_EXT_NONE;
2138                         break;
2139                 case IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_16US:
2140                         low_th = IWL_HE_PKT_EXT_NONE;
2141                         high_th = IWL_HE_PKT_EXT_BPSK;
2142                         break;
2143                 }
2144
2145                 /* Set the PPE thresholds accordingly */
2146                 if (low_th >= 0 && high_th >= 0) {
2147                         struct iwl_he_pkt_ext *pkt_ext =
2148                                 (struct iwl_he_pkt_ext *)&sta_ctxt_cmd.pkt_ext;
2149
2150                         for (i = 0; i < MAX_HE_SUPP_NSS; i++) {
2151                                 u8 bw;
2152
2153                                 for (bw = 0; bw < MAX_HE_CHANNEL_BW_INDX;
2154                                      bw++) {
2155                                         pkt_ext->pkt_ext_qam_th[i][bw][0] =
2156                                                 low_th;
2157                                         pkt_ext->pkt_ext_qam_th[i][bw][1] =
2158                                                 high_th;
2159                                 }
2160                         }
2161
2162                         flags |= STA_CTXT_HE_PACKET_EXT;
2163                 }
2164         }
2165         rcu_read_unlock();
2166
2167         /* Mark MU EDCA as enabled, unless none detected on some AC */
2168         flags |= STA_CTXT_HE_MU_EDCA_CW;
2169         for (i = 0; i < IEEE80211_NUM_ACS; i++) {
2170                 struct ieee80211_he_mu_edca_param_ac_rec *mu_edca =
2171                         &mvmvif->queue_params[i].mu_edca_param_rec;
2172                 u8 ac = iwl_mvm_mac80211_ac_to_ucode_ac(i);
2173
2174                 if (!mvmvif->queue_params[i].mu_edca) {
2175                         flags &= ~STA_CTXT_HE_MU_EDCA_CW;
2176                         break;
2177                 }
2178
2179                 sta_ctxt_cmd.trig_based_txf[ac].cwmin =
2180                         cpu_to_le16(mu_edca->ecw_min_max & 0xf);
2181                 sta_ctxt_cmd.trig_based_txf[ac].cwmax =
2182                         cpu_to_le16((mu_edca->ecw_min_max & 0xf0) >> 4);
2183                 sta_ctxt_cmd.trig_based_txf[ac].aifsn =
2184                         cpu_to_le16(mu_edca->aifsn);
2185                 sta_ctxt_cmd.trig_based_txf[ac].mu_time =
2186                         cpu_to_le16(mu_edca->mu_edca_timer);
2187         }
2188
2189         if (vif->bss_conf.multi_sta_back_32bit)
2190                 flags |= STA_CTXT_HE_32BIT_BA_BITMAP;
2191
2192         if (vif->bss_conf.ack_enabled)
2193                 flags |= STA_CTXT_HE_ACK_ENABLED;
2194
2195         if (vif->bss_conf.uora_exists) {
2196                 flags |= STA_CTXT_HE_TRIG_RND_ALLOC;
2197
2198                 sta_ctxt_cmd.rand_alloc_ecwmin =
2199                         vif->bss_conf.uora_ocw_range & 0x7;
2200                 sta_ctxt_cmd.rand_alloc_ecwmax =
2201                         (vif->bss_conf.uora_ocw_range >> 3) & 0x7;
2202         }
2203
2204         if (vif->bss_conf.nontransmitted) {
2205                 flags |= STA_CTXT_HE_REF_BSSID_VALID;
2206                 ether_addr_copy(sta_ctxt_cmd.ref_bssid_addr,
2207                                 vif->bss_conf.transmitter_bssid);
2208                 sta_ctxt_cmd.max_bssid_indicator =
2209                         vif->bss_conf.bssid_indicator;
2210                 sta_ctxt_cmd.bssid_index = vif->bss_conf.bssid_index;
2211                 sta_ctxt_cmd.ema_ap = vif->bss_conf.ema_ap;
2212                 sta_ctxt_cmd.profile_periodicity =
2213                         vif->bss_conf.profile_periodicity;
2214         }
2215
2216         sta_ctxt_cmd.flags = cpu_to_le32(flags);
2217
2218         if (iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(STA_HE_CTXT_CMD,
2219                                                  DATA_PATH_GROUP, 0),
2220                                  0, size, &sta_ctxt_cmd))
2221                 IWL_ERR(mvm, "Failed to config FW to work HE!\n");
2222 }
2223
2224 static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
2225                                              struct ieee80211_vif *vif,
2226                                              struct ieee80211_bss_conf *bss_conf,
2227                                              u32 changes)
2228 {
2229         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2230         int ret;
2231
2232         /*
2233          * Re-calculate the tsf id, as the master-slave relations depend on the
2234          * beacon interval, which was not known when the station interface was
2235          * added.
2236          */
2237         if (changes & BSS_CHANGED_ASSOC && bss_conf->assoc) {
2238                 if (vif->bss_conf.he_support &&
2239                     !iwlwifi_mod_params.disable_11ax)
2240                         iwl_mvm_cfg_he_sta(mvm, vif, mvmvif->ap_sta_id);
2241
2242                 iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
2243         }
2244
2245         /* Update MU EDCA params */
2246         if (changes & BSS_CHANGED_QOS && mvmvif->associated &&
2247             bss_conf->assoc && vif->bss_conf.he_support &&
2248             !iwlwifi_mod_params.disable_11ax)
2249                 iwl_mvm_cfg_he_sta(mvm, vif, mvmvif->ap_sta_id);
2250
2251         /*
2252          * If we're not associated yet, take the (new) BSSID before associating
2253          * so the firmware knows. If we're already associated, then use the old
2254          * BSSID here, and we'll send a cleared one later in the CHANGED_ASSOC
2255          * branch for disassociation below.
2256          */
2257         if (changes & BSS_CHANGED_BSSID && !mvmvif->associated)
2258                 memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
2259
2260         ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, mvmvif->bssid);
2261         if (ret)
2262                 IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
2263
2264         /* after sending it once, adopt mac80211 data */
2265         memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
2266         mvmvif->associated = bss_conf->assoc;
2267
2268         if (changes & BSS_CHANGED_ASSOC) {
2269                 if (bss_conf->assoc) {
2270                         /* clear statistics to get clean beacon counter */
2271                         iwl_mvm_request_statistics(mvm, true);
2272                         memset(&mvmvif->beacon_stats, 0,
2273                                sizeof(mvmvif->beacon_stats));
2274
2275                         /* add quota for this interface */
2276                         ret = iwl_mvm_update_quotas(mvm, true, NULL);
2277                         if (ret) {
2278                                 IWL_ERR(mvm, "failed to update quotas\n");
2279                                 return;
2280                         }
2281
2282                         if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
2283                                      &mvm->status) &&
2284                             !fw_has_capa(&mvm->fw->ucode_capa,
2285                                          IWL_UCODE_TLV_CAPA_SESSION_PROT_CMD)) {
2286                                 /*
2287                                  * If we're restarting then the firmware will
2288                                  * obviously have lost synchronisation with
2289                                  * the AP. It will attempt to synchronise by
2290                                  * itself, but we can make it more reliable by
2291                                  * scheduling a session protection time event.
2292                                  *
2293                                  * The firmware needs to receive a beacon to
2294                                  * catch up with synchronisation, use 110% of
2295                                  * the beacon interval.
2296                                  *
2297                                  * Set a large maximum delay to allow for more
2298                                  * than a single interface.
2299                                  *
2300                                  * For new firmware versions, rely on the
2301                                  * firmware. This is relevant for DCM scenarios
2302                                  * only anyway.
2303                                  */
2304                                 u32 dur = (11 * vif->bss_conf.beacon_int) / 10;
2305                                 iwl_mvm_protect_session(mvm, vif, dur, dur,
2306                                                         5 * dur, false);
2307                         }
2308
2309                         iwl_mvm_sf_update(mvm, vif, false);
2310                         iwl_mvm_power_vif_assoc(mvm, vif);
2311                         if (vif->p2p) {
2312                                 iwl_mvm_update_smps(mvm, vif,
2313                                                     IWL_MVM_SMPS_REQ_PROT,
2314                                                     IEEE80211_SMPS_DYNAMIC);
2315                         }
2316                 } else if (mvmvif->ap_sta_id != IWL_MVM_INVALID_STA) {
2317                         /*
2318                          * If update fails - SF might be running in associated
2319                          * mode while disassociated - which is forbidden.
2320                          */
2321                         ret = iwl_mvm_sf_update(mvm, vif, false);
2322                         WARN_ONCE(ret &&
2323                                   !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
2324                                             &mvm->status),
2325                                   "Failed to update SF upon disassociation\n");
2326
2327                         /*
2328                          * If we get an assert during the connection (after the
2329                          * station has been added, but before the vif is set
2330                          * to associated), mac80211 will re-add the station and
2331                          * then configure the vif. Since the vif is not
2332                          * associated, we would remove the station here and
2333                          * this would fail the recovery.
2334                          */
2335                         if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
2336                                       &mvm->status)) {
2337                                 /*
2338                                  * Remove AP station now that
2339                                  * the MAC is unassoc
2340                                  */
2341                                 ret = iwl_mvm_rm_sta_id(mvm, vif,
2342                                                         mvmvif->ap_sta_id);
2343                                 if (ret)
2344                                         IWL_ERR(mvm,
2345                                                 "failed to remove AP station\n");
2346
2347                                 mvmvif->ap_sta_id = IWL_MVM_INVALID_STA;
2348                         }
2349
2350                         /* remove quota for this interface */
2351                         ret = iwl_mvm_update_quotas(mvm, false, NULL);
2352                         if (ret)
2353                                 IWL_ERR(mvm, "failed to update quotas\n");
2354
2355                         /* this will take the cleared BSSID from bss_conf */
2356                         ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
2357                         if (ret)
2358                                 IWL_ERR(mvm,
2359                                         "failed to update MAC %pM (clear after unassoc)\n",
2360                                         vif->addr);
2361                 }
2362
2363                 /*
2364                  * The firmware tracks the MU-MIMO group on its own.
2365                  * However, on HW restart we should restore this data.
2366                  */
2367                 if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
2368                     (changes & BSS_CHANGED_MU_GROUPS) && vif->mu_mimo_owner) {
2369                         ret = iwl_mvm_update_mu_groups(mvm, vif);
2370                         if (ret)
2371                                 IWL_ERR(mvm,
2372                                         "failed to update VHT MU_MIMO groups\n");
2373                 }
2374
2375                 iwl_mvm_recalc_multicast(mvm);
2376                 iwl_mvm_configure_bcast_filter(mvm);
2377
2378                 /* reset rssi values */
2379                 mvmvif->bf_data.ave_beacon_signal = 0;
2380
2381                 iwl_mvm_bt_coex_vif_change(mvm);
2382                 iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_TT,
2383                                     IEEE80211_SMPS_AUTOMATIC);
2384                 if (fw_has_capa(&mvm->fw->ucode_capa,
2385                                 IWL_UCODE_TLV_CAPA_UMAC_SCAN))
2386                         iwl_mvm_config_scan(mvm);
2387         }
2388
2389         if (changes & BSS_CHANGED_BEACON_INFO) {
2390                 /*
2391                  * We received a beacon from the associated AP so
2392                  * remove the session protection.
2393                  * A firmware with the new API will remove it automatically.
2394                  */
2395                 if (!fw_has_capa(&mvm->fw->ucode_capa,
2396                                  IWL_UCODE_TLV_CAPA_SESSION_PROT_CMD))
2397                         iwl_mvm_stop_session_protection(mvm, vif);
2398
2399                 iwl_mvm_sf_update(mvm, vif, false);
2400                 WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
2401         }
2402
2403         if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS | BSS_CHANGED_QOS |
2404                        /*
2405                         * Send power command on every beacon change,
2406                         * because we may have not enabled beacon abort yet.
2407                         */
2408                        BSS_CHANGED_BEACON_INFO)) {
2409                 ret = iwl_mvm_power_update_mac(mvm);
2410                 if (ret)
2411                         IWL_ERR(mvm, "failed to update power mode\n");
2412         }
2413
2414         if (changes & BSS_CHANGED_TXPOWER) {
2415                 IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2416                                 bss_conf->txpower);
2417                 iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2418         }
2419
2420         if (changes & BSS_CHANGED_CQM) {
2421                 IWL_DEBUG_MAC80211(mvm, "cqm info_changed\n");
2422                 /* reset cqm events tracking */
2423                 mvmvif->bf_data.last_cqm_event = 0;
2424                 if (mvmvif->bf_data.bf_enabled) {
2425                         ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
2426                         if (ret)
2427                                 IWL_ERR(mvm,
2428                                         "failed to update CQM thresholds\n");
2429                 }
2430         }
2431
2432         if (changes & BSS_CHANGED_ARP_FILTER) {
2433                 IWL_DEBUG_MAC80211(mvm, "arp filter changed\n");
2434                 iwl_mvm_configure_bcast_filter(mvm);
2435         }
2436 }
2437
2438 static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
2439                                  struct ieee80211_vif *vif)
2440 {
2441         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2442         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2443         int ret, i;
2444
2445         mutex_lock(&mvm->mutex);
2446
2447         /* Send the beacon template */
2448         ret = iwl_mvm_mac_ctxt_beacon_changed(mvm, vif);
2449         if (ret)
2450                 goto out_unlock;
2451
2452         /*
2453          * Re-calculate the tsf id, as the master-slave relations depend on the
2454          * beacon interval, which was not known when the AP interface was added.
2455          */
2456         if (vif->type == NL80211_IFTYPE_AP)
2457                 iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
2458
2459         mvmvif->ap_assoc_sta_count = 0;
2460
2461         /* Add the mac context */
2462         ret = iwl_mvm_mac_ctxt_add(mvm, vif);
2463         if (ret)
2464                 goto out_unlock;
2465
2466         /* Perform the binding */
2467         ret = iwl_mvm_binding_add_vif(mvm, vif);
2468         if (ret)
2469                 goto out_remove;
2470
2471         /*
2472          * This is not very nice, but the simplest:
2473          * For older FWs adding the mcast sta before the bcast station may
2474          * cause assert 0x2b00.
2475          * This is fixed in later FW so make the order of removal depend on
2476          * the TLV
2477          */
2478         if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE)) {
2479                 ret = iwl_mvm_add_mcast_sta(mvm, vif);
2480                 if (ret)
2481                         goto out_unbind;
2482                 /*
2483                  * Send the bcast station. At this stage the TBTT and DTIM time
2484                  * events are added and applied to the scheduler
2485                  */
2486                 ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
2487                 if (ret) {
2488                         iwl_mvm_rm_mcast_sta(mvm, vif);
2489                         goto out_unbind;
2490                 }
2491         } else {
2492                 /*
2493                  * Send the bcast station. At this stage the TBTT and DTIM time
2494                  * events are added and applied to the scheduler
2495                  */
2496                 ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
2497                 if (ret)
2498                         goto out_unbind;
2499                 ret = iwl_mvm_add_mcast_sta(mvm, vif);
2500                 if (ret) {
2501                         iwl_mvm_send_rm_bcast_sta(mvm, vif);
2502                         goto out_unbind;
2503                 }
2504         }
2505
2506         /* must be set before quota calculations */
2507         mvmvif->ap_ibss_active = true;
2508
2509         /* send all the early keys to the device now */
2510         for (i = 0; i < ARRAY_SIZE(mvmvif->ap_early_keys); i++) {
2511                 struct ieee80211_key_conf *key = mvmvif->ap_early_keys[i];
2512
2513                 if (!key)
2514                         continue;
2515
2516                 mvmvif->ap_early_keys[i] = NULL;
2517
2518                 ret = __iwl_mvm_mac_set_key(hw, SET_KEY, vif, NULL, key);
2519                 if (ret)
2520                         goto out_quota_failed;
2521         }
2522
2523         if (vif->type == NL80211_IFTYPE_AP && !vif->p2p) {
2524                 iwl_mvm_vif_set_low_latency(mvmvif, true,
2525                                             LOW_LATENCY_VIF_TYPE);
2526                 iwl_mvm_send_low_latency_cmd(mvm, true, mvmvif->id);
2527         }
2528
2529         /* power updated needs to be done before quotas */
2530         iwl_mvm_power_update_mac(mvm);
2531
2532         ret = iwl_mvm_update_quotas(mvm, false, NULL);
2533         if (ret)
2534                 goto out_quota_failed;
2535
2536         /* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2537         if (vif->p2p && mvm->p2p_device_vif)
2538                 iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2539
2540         iwl_mvm_bt_coex_vif_change(mvm);
2541
2542         /* we don't support TDLS during DCM */
2543         if (iwl_mvm_phy_ctx_count(mvm) > 1)
2544                 iwl_mvm_teardown_tdls_peers(mvm);
2545
2546         iwl_mvm_ftm_restart_responder(mvm, vif);
2547
2548         goto out_unlock;
2549
2550 out_quota_failed:
2551         iwl_mvm_power_update_mac(mvm);
2552         mvmvif->ap_ibss_active = false;
2553         iwl_mvm_send_rm_bcast_sta(mvm, vif);
2554         iwl_mvm_rm_mcast_sta(mvm, vif);
2555 out_unbind:
2556         iwl_mvm_binding_remove_vif(mvm, vif);
2557 out_remove:
2558         iwl_mvm_mac_ctxt_remove(mvm, vif);
2559 out_unlock:
2560         mutex_unlock(&mvm->mutex);
2561         return ret;
2562 }
2563
2564 static void iwl_mvm_stop_ap_ibss(struct ieee80211_hw *hw,
2565                                  struct ieee80211_vif *vif)
2566 {
2567         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2568         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2569
2570         iwl_mvm_prepare_mac_removal(mvm, vif);
2571
2572         mutex_lock(&mvm->mutex);
2573
2574         /* Handle AP stop while in CSA */
2575         if (rcu_access_pointer(mvm->csa_vif) == vif) {
2576                 iwl_mvm_remove_time_event(mvm, mvmvif,
2577                                           &mvmvif->time_event_data);
2578                 RCU_INIT_POINTER(mvm->csa_vif, NULL);
2579                 mvmvif->csa_countdown = false;
2580         }
2581
2582         if (rcu_access_pointer(mvm->csa_tx_blocked_vif) == vif) {
2583                 RCU_INIT_POINTER(mvm->csa_tx_blocked_vif, NULL);
2584                 mvm->csa_tx_block_bcn_timeout = 0;
2585         }
2586
2587         mvmvif->ap_ibss_active = false;
2588         mvm->ap_last_beacon_gp2 = 0;
2589
2590         if (vif->type == NL80211_IFTYPE_AP && !vif->p2p) {
2591                 iwl_mvm_vif_set_low_latency(mvmvif, false,
2592                                             LOW_LATENCY_VIF_TYPE);
2593                 iwl_mvm_send_low_latency_cmd(mvm, false,  mvmvif->id);
2594         }
2595
2596         iwl_mvm_bt_coex_vif_change(mvm);
2597
2598         /* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2599         if (vif->p2p && mvm->p2p_device_vif)
2600                 iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2601
2602         iwl_mvm_update_quotas(mvm, false, NULL);
2603
2604         /*
2605          * This is not very nice, but the simplest:
2606          * For older FWs removing the mcast sta before the bcast station may
2607          * cause assert 0x2b00.
2608          * This is fixed in later FW (which will stop beaconing when removing
2609          * bcast station).
2610          * So make the order of removal depend on the TLV
2611          */
2612         if (!fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE))
2613                 iwl_mvm_rm_mcast_sta(mvm, vif);
2614         iwl_mvm_send_rm_bcast_sta(mvm, vif);
2615         if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE))
2616                 iwl_mvm_rm_mcast_sta(mvm, vif);
2617         iwl_mvm_binding_remove_vif(mvm, vif);
2618
2619         iwl_mvm_power_update_mac(mvm);
2620
2621         iwl_mvm_mac_ctxt_remove(mvm, vif);
2622
2623         mutex_unlock(&mvm->mutex);
2624 }
2625
2626 static void
2627 iwl_mvm_bss_info_changed_ap_ibss(struct iwl_mvm *mvm,
2628                                  struct ieee80211_vif *vif,
2629                                  struct ieee80211_bss_conf *bss_conf,
2630                                  u32 changes)
2631 {
2632         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2633
2634         /* Changes will be applied when the AP/IBSS is started */
2635         if (!mvmvif->ap_ibss_active)
2636                 return;
2637
2638         if (changes & (BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_HT |
2639                        BSS_CHANGED_BANDWIDTH | BSS_CHANGED_QOS) &&
2640             iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL))
2641                 IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
2642
2643         /* Need to send a new beacon template to the FW */
2644         if (changes & BSS_CHANGED_BEACON &&
2645             iwl_mvm_mac_ctxt_beacon_changed(mvm, vif))
2646                 IWL_WARN(mvm, "Failed updating beacon data\n");
2647
2648         if (changes & BSS_CHANGED_TXPOWER) {
2649                 IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2650                                 bss_conf->txpower);
2651                 iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2652         }
2653
2654         if (changes & BSS_CHANGED_FTM_RESPONDER) {
2655                 int ret = iwl_mvm_ftm_start_responder(mvm, vif);
2656
2657                 if (ret)
2658                         IWL_WARN(mvm, "Failed to enable FTM responder (%d)\n",
2659                                  ret);
2660         }
2661
2662 }
2663
2664 static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw,
2665                                      struct ieee80211_vif *vif,
2666                                      struct ieee80211_bss_conf *bss_conf,
2667                                      u32 changes)
2668 {
2669         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2670
2671         mutex_lock(&mvm->mutex);
2672
2673         if (changes & BSS_CHANGED_IDLE && !bss_conf->idle)
2674                 iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true);
2675
2676         switch (vif->type) {
2677         case NL80211_IFTYPE_STATION:
2678                 iwl_mvm_bss_info_changed_station(mvm, vif, bss_conf, changes);
2679                 break;
2680         case NL80211_IFTYPE_AP:
2681         case NL80211_IFTYPE_ADHOC:
2682                 iwl_mvm_bss_info_changed_ap_ibss(mvm, vif, bss_conf, changes);
2683                 break;
2684         case NL80211_IFTYPE_MONITOR:
2685                 if (changes & BSS_CHANGED_MU_GROUPS)
2686                         iwl_mvm_update_mu_groups(mvm, vif);
2687                 break;
2688         default:
2689                 /* shouldn't happen */
2690                 WARN_ON_ONCE(1);
2691         }
2692
2693         mutex_unlock(&mvm->mutex);
2694 }
2695
2696 static int iwl_mvm_mac_hw_scan(struct ieee80211_hw *hw,
2697                                struct ieee80211_vif *vif,
2698                                struct ieee80211_scan_request *hw_req)
2699 {
2700         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2701         int ret;
2702
2703         if (hw_req->req.n_channels == 0 ||
2704             hw_req->req.n_channels > mvm->fw->ucode_capa.n_scan_channels)
2705                 return -EINVAL;
2706
2707         mutex_lock(&mvm->mutex);
2708         ret = iwl_mvm_reg_scan_start(mvm, vif, &hw_req->req, &hw_req->ies);
2709         mutex_unlock(&mvm->mutex);
2710
2711         return ret;
2712 }
2713
2714 static void iwl_mvm_mac_cancel_hw_scan(struct ieee80211_hw *hw,
2715                                        struct ieee80211_vif *vif)
2716 {
2717         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2718
2719         mutex_lock(&mvm->mutex);
2720
2721         /* Due to a race condition, it's possible that mac80211 asks
2722          * us to stop a hw_scan when it's already stopped.  This can
2723          * happen, for instance, if we stopped the scan ourselves,
2724          * called ieee80211_scan_completed() and the userspace called
2725          * cancel scan scan before ieee80211_scan_work() could run.
2726          * To handle that, simply return if the scan is not running.
2727         */
2728         if (mvm->scan_status & IWL_MVM_SCAN_REGULAR)
2729                 iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true);
2730
2731         mutex_unlock(&mvm->mutex);
2732 }
2733
2734 static void
2735 iwl_mvm_mac_allow_buffered_frames(struct ieee80211_hw *hw,
2736                                   struct ieee80211_sta *sta, u16 tids,
2737                                   int num_frames,
2738                                   enum ieee80211_frame_release_type reason,
2739                                   bool more_data)
2740 {
2741         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2742
2743         /* Called when we need to transmit (a) frame(s) from mac80211 */
2744
2745         iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2746                                           tids, more_data, false);
2747 }
2748
2749 static void
2750 iwl_mvm_mac_release_buffered_frames(struct ieee80211_hw *hw,
2751                                     struct ieee80211_sta *sta, u16 tids,
2752                                     int num_frames,
2753                                     enum ieee80211_frame_release_type reason,
2754                                     bool more_data)
2755 {
2756         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2757
2758         /* Called when we need to transmit (a) frame(s) from agg or dqa queue */
2759
2760         iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2761                                           tids, more_data, true);
2762 }
2763
2764 static void __iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
2765                                      enum sta_notify_cmd cmd,
2766                                      struct ieee80211_sta *sta)
2767 {
2768         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2769         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
2770         unsigned long txqs = 0, tids = 0;
2771         int tid;
2772
2773         /*
2774          * If we have TVQM then we get too high queue numbers - luckily
2775          * we really shouldn't get here with that because such hardware
2776          * should have firmware supporting buffer station offload.
2777          */
2778         if (WARN_ON(iwl_mvm_has_new_tx_api(mvm)))
2779                 return;
2780
2781         spin_lock_bh(&mvmsta->lock);
2782         for (tid = 0; tid < ARRAY_SIZE(mvmsta->tid_data); tid++) {
2783                 struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
2784
2785                 if (tid_data->txq_id == IWL_MVM_INVALID_QUEUE)
2786                         continue;
2787
2788                 __set_bit(tid_data->txq_id, &txqs);
2789
2790                 if (iwl_mvm_tid_queued(mvm, tid_data) == 0)
2791                         continue;
2792
2793                 __set_bit(tid, &tids);
2794         }
2795
2796         switch (cmd) {
2797         case STA_NOTIFY_SLEEP:
2798                 for_each_set_bit(tid, &tids, IWL_MAX_TID_COUNT)
2799                         ieee80211_sta_set_buffered(sta, tid, true);
2800
2801                 if (txqs)
2802                         iwl_trans_freeze_txq_timer(mvm->trans, txqs, true);
2803                 /*
2804                  * The fw updates the STA to be asleep. Tx packets on the Tx
2805                  * queues to this station will not be transmitted. The fw will
2806                  * send a Tx response with TX_STATUS_FAIL_DEST_PS.
2807                  */
2808                 break;
2809         case STA_NOTIFY_AWAKE:
2810                 if (WARN_ON(mvmsta->sta_id == IWL_MVM_INVALID_STA))
2811                         break;
2812
2813                 if (txqs)
2814                         iwl_trans_freeze_txq_timer(mvm->trans, txqs, false);
2815                 iwl_mvm_sta_modify_ps_wake(mvm, sta);
2816                 break;
2817         default:
2818                 break;
2819         }
2820         spin_unlock_bh(&mvmsta->lock);
2821 }
2822
2823 static void iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
2824                                    struct ieee80211_vif *vif,
2825                                    enum sta_notify_cmd cmd,
2826                                    struct ieee80211_sta *sta)
2827 {
2828         __iwl_mvm_mac_sta_notify(hw, cmd, sta);
2829 }
2830
2831 void iwl_mvm_sta_pm_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
2832 {
2833         struct iwl_rx_packet *pkt = rxb_addr(rxb);
2834         struct iwl_mvm_pm_state_notification *notif = (void *)pkt->data;
2835         struct ieee80211_sta *sta;
2836         struct iwl_mvm_sta *mvmsta;
2837         bool sleeping = (notif->type != IWL_MVM_PM_EVENT_AWAKE);
2838
2839         if (WARN_ON(notif->sta_id >= ARRAY_SIZE(mvm->fw_id_to_mac_id)))
2840                 return;
2841
2842         rcu_read_lock();
2843         sta = rcu_dereference(mvm->fw_id_to_mac_id[notif->sta_id]);
2844         if (WARN_ON(IS_ERR_OR_NULL(sta))) {
2845                 rcu_read_unlock();
2846                 return;
2847         }
2848
2849         mvmsta = iwl_mvm_sta_from_mac80211(sta);
2850
2851         if (!mvmsta->vif ||
2852             mvmsta->vif->type != NL80211_IFTYPE_AP) {
2853                 rcu_read_unlock();
2854                 return;
2855         }
2856
2857         if (mvmsta->sleeping != sleeping) {
2858                 mvmsta->sleeping = sleeping;
2859                 __iwl_mvm_mac_sta_notify(mvm->hw,
2860                         sleeping ? STA_NOTIFY_SLEEP : STA_NOTIFY_AWAKE,
2861                         sta);
2862                 ieee80211_sta_ps_transition(sta, sleeping);
2863         }
2864
2865         if (sleeping) {
2866                 switch (notif->type) {
2867                 case IWL_MVM_PM_EVENT_AWAKE:
2868                 case IWL_MVM_PM_EVENT_ASLEEP:
2869                         break;
2870                 case IWL_MVM_PM_EVENT_UAPSD:
2871                         ieee80211_sta_uapsd_trigger(sta, IEEE80211_NUM_TIDS);
2872                         break;
2873                 case IWL_MVM_PM_EVENT_PS_POLL:
2874                         ieee80211_sta_pspoll(sta);
2875                         break;
2876                 default:
2877                         break;
2878                 }
2879         }
2880
2881         rcu_read_unlock();
2882 }
2883
2884 static void iwl_mvm_sta_pre_rcu_remove(struct ieee80211_hw *hw,
2885                                        struct ieee80211_vif *vif,
2886                                        struct ieee80211_sta *sta)
2887 {
2888         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2889         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
2890
2891         /*
2892          * This is called before mac80211 does RCU synchronisation,
2893          * so here we already invalidate our internal RCU-protected
2894          * station pointer. The rest of the code will thus no longer
2895          * be able to find the station this way, and we don't rely
2896          * on further RCU synchronisation after the sta_state()
2897          * callback deleted the station.
2898          */
2899         mutex_lock(&mvm->mutex);
2900         if (sta == rcu_access_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id]))
2901                 rcu_assign_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id],
2902                                    ERR_PTR(-ENOENT));
2903
2904         mutex_unlock(&mvm->mutex);
2905 }
2906
2907 static void iwl_mvm_check_uapsd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
2908                                 const u8 *bssid)
2909 {
2910         int i;
2911
2912         if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
2913                 struct iwl_mvm_tcm_mac *mdata;
2914
2915                 mdata = &mvm->tcm.data[iwl_mvm_vif_from_mac80211(vif)->id];
2916                 ewma_rate_init(&mdata->uapsd_nonagg_detect.rate);
2917                 mdata->opened_rx_ba_sessions = false;
2918         }
2919
2920         if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT))
2921                 return;
2922
2923         if (vif->p2p && !iwl_mvm_is_p2p_scm_uapsd_supported(mvm)) {
2924                 vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2925                 return;
2926         }
2927
2928         if (!vif->p2p &&
2929             (iwlwifi_mod_params.uapsd_disable & IWL_DISABLE_UAPSD_BSS)) {
2930                 vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2931                 return;
2932         }
2933
2934         for (i = 0; i < IWL_MVM_UAPSD_NOAGG_LIST_LEN; i++) {
2935                 if (ether_addr_equal(mvm->uapsd_noagg_bssids[i].addr, bssid)) {
2936                         vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2937                         return;
2938                 }
2939         }
2940
2941         vif->driver_flags |= IEEE80211_VIF_SUPPORTS_UAPSD;
2942 }
2943
2944 static void
2945 iwl_mvm_tdls_check_trigger(struct iwl_mvm *mvm,
2946                            struct ieee80211_vif *vif, u8 *peer_addr,
2947                            enum nl80211_tdls_operation action)
2948 {
2949         struct iwl_fw_dbg_trigger_tlv *trig;
2950         struct iwl_fw_dbg_trigger_tdls *tdls_trig;
2951
2952         trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
2953                                      FW_DBG_TRIGGER_TDLS);
2954         if (!trig)
2955                 return;
2956
2957         tdls_trig = (void *)trig->data;
2958
2959         if (!(tdls_trig->action_bitmap & BIT(action)))
2960                 return;
2961
2962         if (tdls_trig->peer_mode &&
2963             memcmp(tdls_trig->peer, peer_addr, ETH_ALEN) != 0)
2964                 return;
2965
2966         iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
2967                                 "TDLS event occurred, peer %pM, action %d",
2968                                 peer_addr, action);
2969 }
2970
2971 struct iwl_mvm_he_obss_narrow_bw_ru_data {
2972         bool tolerated;
2973 };
2974
2975 static void iwl_mvm_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
2976                                                     struct cfg80211_bss *bss,
2977                                                     void *_data)
2978 {
2979         struct iwl_mvm_he_obss_narrow_bw_ru_data *data = _data;
2980         const struct element *elem;
2981
2982         elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY, bss->ies->data,
2983                                   bss->ies->len);
2984
2985         if (!elem || elem->datalen < 10 ||
2986             !(elem->data[10] &
2987               WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT)) {
2988                 data->tolerated = false;
2989         }
2990 }
2991
2992 static void iwl_mvm_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
2993                                                struct ieee80211_vif *vif)
2994 {
2995         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2996         struct iwl_mvm_he_obss_narrow_bw_ru_data iter_data = {
2997                 .tolerated = true,
2998         };
2999
3000         if (!(vif->bss_conf.chandef.chan->flags & IEEE80211_CHAN_RADAR)) {
3001                 mvmvif->he_ru_2mhz_block = false;
3002                 return;
3003         }
3004
3005         cfg80211_bss_iter(hw->wiphy, &vif->bss_conf.chandef,
3006                           iwl_mvm_check_he_obss_narrow_bw_ru_iter,
3007                           &iter_data);
3008
3009         /*
3010          * If there is at least one AP on radar channel that cannot
3011          * tolerate 26-tone RU UL OFDMA transmissions using HE TB PPDU.
3012          */
3013         mvmvif->he_ru_2mhz_block = !iter_data.tolerated;
3014 }
3015
3016 static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
3017                                  struct ieee80211_vif *vif,
3018                                  struct ieee80211_sta *sta,
3019                                  enum ieee80211_sta_state old_state,
3020                                  enum ieee80211_sta_state new_state)
3021 {
3022         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3023         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3024         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
3025         int ret;
3026
3027         IWL_DEBUG_MAC80211(mvm, "station %pM state change %d->%d\n",
3028                            sta->addr, old_state, new_state);
3029
3030         /* this would be a mac80211 bug ... but don't crash */
3031         if (WARN_ON_ONCE(!mvmvif->phy_ctxt))
3032                 return -EINVAL;
3033
3034         /*
3035          * If we are in a STA removal flow and in DQA mode:
3036          *
3037          * This is after the sync_rcu part, so the queues have already been
3038          * flushed. No more TXs on their way in mac80211's path, and no more in
3039          * the queues.
3040          * Also, we won't be getting any new TX frames for this station.
3041          * What we might have are deferred TX frames that need to be taken care
3042          * of.
3043          *
3044          * Drop any still-queued deferred-frame before removing the STA, and
3045          * make sure the worker is no longer handling frames for this STA.
3046          */
3047         if (old_state == IEEE80211_STA_NONE &&
3048             new_state == IEEE80211_STA_NOTEXIST) {
3049                 flush_work(&mvm->add_stream_wk);
3050
3051                 /*
3052                  * No need to make sure deferred TX indication is off since the
3053                  * worker will already remove it if it was on
3054                  */
3055         }
3056
3057         mutex_lock(&mvm->mutex);
3058         /* track whether or not the station is associated */
3059         mvm_sta->sta_state = new_state;
3060
3061         if (old_state == IEEE80211_STA_NOTEXIST &&
3062             new_state == IEEE80211_STA_NONE) {
3063                 /*
3064                  * Firmware bug - it'll crash if the beacon interval is less
3065                  * than 16. We can't avoid connecting at all, so refuse the
3066                  * station state change, this will cause mac80211 to abandon
3067                  * attempts to connect to this AP, and eventually wpa_s will
3068                  * blacklist the AP...
3069                  */
3070                 if (vif->type == NL80211_IFTYPE_STATION &&
3071                     vif->bss_conf.beacon_int < 16) {
3072                         IWL_ERR(mvm,
3073                                 "AP %pM beacon interval is %d, refusing due to firmware bug!\n",
3074                                 sta->addr, vif->bss_conf.beacon_int);
3075                         ret = -EINVAL;
3076                         goto out_unlock;
3077                 }
3078
3079                 if (sta->tdls &&
3080                     (vif->p2p ||
3081                      iwl_mvm_tdls_sta_count(mvm, NULL) ==
3082                                                 IWL_MVM_TDLS_STA_COUNT ||
3083                      iwl_mvm_phy_ctx_count(mvm) > 1)) {
3084                         IWL_DEBUG_MAC80211(mvm, "refusing TDLS sta\n");
3085                         ret = -EBUSY;
3086                         goto out_unlock;
3087                 }
3088
3089                 ret = iwl_mvm_add_sta(mvm, vif, sta);
3090                 if (sta->tdls && ret == 0) {
3091                         iwl_mvm_recalc_tdls_state(mvm, vif, true);
3092                         iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3093                                                    NL80211_TDLS_SETUP);
3094                 }
3095
3096                 sta->max_rc_amsdu_len = 1;
3097         } else if (old_state == IEEE80211_STA_NONE &&
3098                    new_state == IEEE80211_STA_AUTH) {
3099                 /*
3100                  * EBS may be disabled due to previous failures reported by FW.
3101                  * Reset EBS status here assuming environment has been changed.
3102                  */
3103                 mvm->last_ebs_successful = true;
3104                 iwl_mvm_check_uapsd(mvm, vif, sta->addr);
3105                 ret = 0;
3106         } else if (old_state == IEEE80211_STA_AUTH &&
3107                    new_state == IEEE80211_STA_ASSOC) {
3108                 if (vif->type == NL80211_IFTYPE_AP) {
3109                         vif->bss_conf.he_support = sta->he_cap.has_he;
3110                         mvmvif->ap_assoc_sta_count++;
3111                         iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3112                         if (vif->bss_conf.he_support &&
3113                             !iwlwifi_mod_params.disable_11ax)
3114                                 iwl_mvm_cfg_he_sta(mvm, vif, mvm_sta->sta_id);
3115                 } else if (vif->type == NL80211_IFTYPE_STATION) {
3116                         vif->bss_conf.he_support = sta->he_cap.has_he;
3117
3118                         mvmvif->he_ru_2mhz_block = false;
3119                         if (sta->he_cap.has_he)
3120                                 iwl_mvm_check_he_obss_narrow_bw_ru(hw, vif);
3121
3122                         iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3123                 }
3124
3125                 iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3126                                      false);
3127                 ret = iwl_mvm_update_sta(mvm, vif, sta);
3128         } else if (old_state == IEEE80211_STA_ASSOC &&
3129                    new_state == IEEE80211_STA_AUTHORIZED) {
3130                 ret = 0;
3131
3132                 /* we don't support TDLS during DCM */
3133                 if (iwl_mvm_phy_ctx_count(mvm) > 1)
3134                         iwl_mvm_teardown_tdls_peers(mvm);
3135
3136                 if (sta->tdls)
3137                         iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3138                                                    NL80211_TDLS_ENABLE_LINK);
3139
3140                 /* enable beacon filtering */
3141                 WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
3142
3143                 /*
3144                  * Now that the station is authorized, i.e., keys were already
3145                  * installed, need to indicate to the FW that
3146                  * multicast data frames can be forwarded to the driver
3147                  */
3148                 iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3149
3150                 iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3151                                      true);
3152         } else if (old_state == IEEE80211_STA_AUTHORIZED &&
3153                    new_state == IEEE80211_STA_ASSOC) {
3154                 /* Multicast data frames are no longer allowed */
3155                 iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3156
3157                 /* disable beacon filtering */
3158                 ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
3159                 WARN_ON(ret &&
3160                         !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
3161                                   &mvm->status));
3162                 ret = 0;
3163         } else if (old_state == IEEE80211_STA_ASSOC &&
3164                    new_state == IEEE80211_STA_AUTH) {
3165                 if (vif->type == NL80211_IFTYPE_AP) {
3166                         mvmvif->ap_assoc_sta_count--;
3167                         iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3168                 }
3169                 ret = 0;
3170         } else if (old_state == IEEE80211_STA_AUTH &&
3171                    new_state == IEEE80211_STA_NONE) {
3172                 ret = 0;
3173         } else if (old_state == IEEE80211_STA_NONE &&
3174                    new_state == IEEE80211_STA_NOTEXIST) {
3175                 ret = iwl_mvm_rm_sta(mvm, vif, sta);
3176                 if (sta->tdls) {
3177                         iwl_mvm_recalc_tdls_state(mvm, vif, false);
3178                         iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
3179                                                    NL80211_TDLS_DISABLE_LINK);
3180                 }
3181
3182                 if (unlikely(ret &&
3183                              test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
3184                                       &mvm->status)))
3185                         ret = 0;
3186         } else {
3187                 ret = -EIO;
3188         }
3189  out_unlock:
3190         mutex_unlock(&mvm->mutex);
3191
3192         if (sta->tdls && ret == 0) {
3193                 if (old_state == IEEE80211_STA_NOTEXIST &&
3194                     new_state == IEEE80211_STA_NONE)
3195                         ieee80211_reserve_tid(sta, IWL_MVM_TDLS_FW_TID);
3196                 else if (old_state == IEEE80211_STA_NONE &&
3197                          new_state == IEEE80211_STA_NOTEXIST)
3198                         ieee80211_unreserve_tid(sta, IWL_MVM_TDLS_FW_TID);
3199         }
3200
3201         return ret;
3202 }
3203
3204 static int iwl_mvm_mac_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
3205 {
3206         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3207
3208         mvm->rts_threshold = value;
3209
3210         return 0;
3211 }
3212
3213 static void iwl_mvm_sta_rc_update(struct ieee80211_hw *hw,
3214                                   struct ieee80211_vif *vif,
3215                                   struct ieee80211_sta *sta, u32 changed)
3216 {
3217         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3218         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3219
3220         if (changed & (IEEE80211_RC_BW_CHANGED |
3221                        IEEE80211_RC_SUPP_RATES_CHANGED |
3222                        IEEE80211_RC_NSS_CHANGED))
3223                 iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
3224                                      true);
3225
3226         if (vif->type == NL80211_IFTYPE_STATION &&
3227             changed & IEEE80211_RC_NSS_CHANGED)
3228                 iwl_mvm_sf_update(mvm, vif, false);
3229 }
3230
3231 static int iwl_mvm_mac_conf_tx(struct ieee80211_hw *hw,
3232                                struct ieee80211_vif *vif, u16 ac,
3233                                const struct ieee80211_tx_queue_params *params)
3234 {
3235         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3236         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3237
3238         mvmvif->queue_params[ac] = *params;
3239
3240         /*
3241          * No need to update right away, we'll get BSS_CHANGED_QOS
3242          * The exception is P2P_DEVICE interface which needs immediate update.
3243          */
3244         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
3245                 int ret;
3246
3247                 mutex_lock(&mvm->mutex);
3248                 ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3249                 mutex_unlock(&mvm->mutex);
3250                 return ret;
3251         }
3252         return 0;
3253 }
3254
3255 static void iwl_mvm_mac_mgd_prepare_tx(struct ieee80211_hw *hw,
3256                                        struct ieee80211_vif *vif,
3257                                        u16 req_duration)
3258 {
3259         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3260         u32 duration = IWL_MVM_TE_SESSION_PROTECTION_MAX_TIME_MS;
3261         u32 min_duration = IWL_MVM_TE_SESSION_PROTECTION_MIN_TIME_MS;
3262
3263         if (req_duration > duration)
3264                 duration = req_duration;
3265
3266         mutex_lock(&mvm->mutex);
3267         /* Try really hard to protect the session and hear a beacon
3268          * The new session protection command allows us to protect the
3269          * session for a much longer time since the firmware will internally
3270          * create two events: a 300TU one with a very high priority that
3271          * won't be fragmented which should be enough for 99% of the cases,
3272          * and another one (which we configure here to be 900TU long) which
3273          * will have a slightly lower priority, but more importantly, can be
3274          * fragmented so that it'll allow other activities to run.
3275          */
3276         if (fw_has_capa(&mvm->fw->ucode_capa,
3277                         IWL_UCODE_TLV_CAPA_SESSION_PROT_CMD))
3278                 iwl_mvm_schedule_session_protection(mvm, vif, 900,
3279                                                     min_duration);
3280         else
3281                 iwl_mvm_protect_session(mvm, vif, duration,
3282                                         min_duration, 500, false);
3283         mutex_unlock(&mvm->mutex);
3284 }
3285
3286 static int iwl_mvm_mac_sched_scan_start(struct ieee80211_hw *hw,
3287                                         struct ieee80211_vif *vif,
3288                                         struct cfg80211_sched_scan_request *req,
3289                                         struct ieee80211_scan_ies *ies)
3290 {
3291         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3292
3293         int ret;
3294
3295         mutex_lock(&mvm->mutex);
3296
3297         if (!vif->bss_conf.idle) {
3298                 ret = -EBUSY;
3299                 goto out;
3300         }
3301
3302         ret = iwl_mvm_sched_scan_start(mvm, vif, req, ies, IWL_MVM_SCAN_SCHED);
3303
3304 out:
3305         mutex_unlock(&mvm->mutex);
3306         return ret;
3307 }
3308
3309 static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
3310                                        struct ieee80211_vif *vif)
3311 {
3312         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3313         int ret;
3314
3315         mutex_lock(&mvm->mutex);
3316
3317         /* Due to a race condition, it's possible that mac80211 asks
3318          * us to stop a sched_scan when it's already stopped.  This
3319          * can happen, for instance, if we stopped the scan ourselves,
3320          * called ieee80211_sched_scan_stopped() and the userspace called
3321          * stop sched scan scan before ieee80211_sched_scan_stopped_work()
3322          * could run.  To handle this, simply return if the scan is
3323          * not running.
3324         */
3325         if (!(mvm->scan_status & IWL_MVM_SCAN_SCHED)) {
3326                 mutex_unlock(&mvm->mutex);
3327                 return 0;
3328         }
3329
3330         ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, false);
3331         mutex_unlock(&mvm->mutex);
3332         iwl_mvm_wait_for_async_handlers(mvm);
3333
3334         return ret;
3335 }
3336
3337 static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
3338                                  enum set_key_cmd cmd,
3339                                  struct ieee80211_vif *vif,
3340                                  struct ieee80211_sta *sta,
3341                                  struct ieee80211_key_conf *key)
3342 {
3343         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3344         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3345         struct iwl_mvm_sta *mvmsta;
3346         struct iwl_mvm_key_pn *ptk_pn;
3347         int keyidx = key->keyidx;
3348         int ret, i;
3349         u8 key_offset;
3350
3351         if (iwlwifi_mod_params.swcrypto) {
3352                 IWL_DEBUG_MAC80211(mvm, "leave - hwcrypto disabled\n");
3353                 return -EOPNOTSUPP;
3354         }
3355
3356         switch (key->cipher) {
3357         case WLAN_CIPHER_SUITE_TKIP:
3358                 if (!mvm->trans->trans_cfg->gen2) {
3359                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3360                         key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3361                 } else if (vif->type == NL80211_IFTYPE_STATION) {
3362                         key->flags |= IEEE80211_KEY_FLAG_PUT_MIC_SPACE;
3363                 } else {
3364                         IWL_DEBUG_MAC80211(mvm, "Use SW encryption for TKIP\n");
3365                         return -EOPNOTSUPP;
3366                 }
3367                 break;
3368         case WLAN_CIPHER_SUITE_CCMP:
3369         case WLAN_CIPHER_SUITE_GCMP:
3370         case WLAN_CIPHER_SUITE_GCMP_256:
3371                 if (!iwl_mvm_has_new_tx_api(mvm))
3372                         key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3373                 break;
3374         case WLAN_CIPHER_SUITE_AES_CMAC:
3375         case WLAN_CIPHER_SUITE_BIP_GMAC_128:
3376         case WLAN_CIPHER_SUITE_BIP_GMAC_256:
3377                 WARN_ON_ONCE(!ieee80211_hw_check(hw, MFP_CAPABLE));
3378                 break;
3379         case WLAN_CIPHER_SUITE_WEP40:
3380         case WLAN_CIPHER_SUITE_WEP104:
3381                 if (vif->type == NL80211_IFTYPE_STATION)
3382                         break;
3383                 if (iwl_mvm_has_new_tx_api(mvm))
3384                         return -EOPNOTSUPP;
3385                 /* support HW crypto on TX */
3386                 return 0;
3387         default:
3388                 /* currently FW supports only one optional cipher scheme */
3389                 if (hw->n_cipher_schemes &&
3390                     hw->cipher_schemes->cipher == key->cipher)
3391                         key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3392                 else
3393                         return -EOPNOTSUPP;
3394         }
3395
3396         switch (cmd) {
3397         case SET_KEY:
3398                 if ((vif->type == NL80211_IFTYPE_ADHOC ||
3399                      vif->type == NL80211_IFTYPE_AP) && !sta) {
3400                         /*
3401                          * GTK on AP interface is a TX-only key, return 0;
3402                          * on IBSS they're per-station and because we're lazy
3403                          * we don't support them for RX, so do the same.
3404                          * CMAC/GMAC in AP/IBSS modes must be done in software.
3405                          */
3406                         if (key->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
3407                             key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
3408                             key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256)
3409                                 ret = -EOPNOTSUPP;
3410                         else
3411                                 ret = 0;
3412
3413                         if (key->cipher != WLAN_CIPHER_SUITE_GCMP &&
3414                             key->cipher != WLAN_CIPHER_SUITE_GCMP_256 &&
3415                             !iwl_mvm_has_new_tx_api(mvm)) {
3416                                 key->hw_key_idx = STA_KEY_IDX_INVALID;
3417                                 break;
3418                         }
3419
3420                         if (!mvmvif->ap_ibss_active) {
3421                                 for (i = 0;
3422                                      i < ARRAY_SIZE(mvmvif->ap_early_keys);
3423                                      i++) {
3424                                         if (!mvmvif->ap_early_keys[i]) {
3425                                                 mvmvif->ap_early_keys[i] = key;
3426                                                 break;
3427                                         }
3428                                 }
3429
3430                                 if (i >= ARRAY_SIZE(mvmvif->ap_early_keys))
3431                                         ret = -ENOSPC;
3432
3433                                 break;
3434                         }
3435                 }
3436
3437                 /* During FW restart, in order to restore the state as it was,
3438                  * don't try to reprogram keys we previously failed for.
3439                  */
3440                 if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
3441                     key->hw_key_idx == STA_KEY_IDX_INVALID) {
3442                         IWL_DEBUG_MAC80211(mvm,
3443                                            "skip invalid idx key programming during restart\n");
3444                         ret = 0;
3445                         break;
3446                 }
3447
3448                 if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
3449                     sta && iwl_mvm_has_new_rx_api(mvm) &&
3450                     key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
3451                     (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
3452                      key->cipher == WLAN_CIPHER_SUITE_GCMP ||
3453                      key->cipher == WLAN_CIPHER_SUITE_GCMP_256)) {
3454                         struct ieee80211_key_seq seq;
3455                         int tid, q;
3456
3457                         mvmsta = iwl_mvm_sta_from_mac80211(sta);
3458                         WARN_ON(rcu_access_pointer(mvmsta->ptk_pn[keyidx]));
3459                         ptk_pn = kzalloc(struct_size(ptk_pn, q,
3460                                                      mvm->trans->num_rx_queues),
3461                                          GFP_KERNEL);
3462                         if (!ptk_pn) {
3463                                 ret = -ENOMEM;
3464                                 break;
3465                         }
3466
3467                         for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++) {
3468                                 ieee80211_get_key_rx_seq(key, tid, &seq);
3469                                 for (q = 0; q < mvm->trans->num_rx_queues; q++)
3470                                         memcpy(ptk_pn->q[q].pn[tid],
3471                                                seq.ccmp.pn,
3472                                                IEEE80211_CCMP_PN_LEN);
3473                         }
3474
3475                         rcu_assign_pointer(mvmsta->ptk_pn[keyidx], ptk_pn);
3476                 }
3477
3478                 /* in HW restart reuse the index, otherwise request a new one */
3479                 if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
3480                         key_offset = key->hw_key_idx;
3481                 else
3482                         key_offset = STA_KEY_IDX_INVALID;
3483
3484                 IWL_DEBUG_MAC80211(mvm, "set hwcrypto key\n");
3485                 ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, key_offset);
3486                 if (ret) {
3487                         IWL_WARN(mvm, "set key failed\n");
3488                         key->hw_key_idx = STA_KEY_IDX_INVALID;
3489                         /*
3490                          * can't add key for RX, but we don't need it
3491                          * in the device for TX so still return 0,
3492                          * unless we have new TX API where we cannot
3493                          * put key material into the TX_CMD
3494                          */
3495                         if (iwl_mvm_has_new_tx_api(mvm))
3496                                 ret = -EOPNOTSUPP;
3497                         else
3498                                 ret = 0;
3499                 }
3500
3501                 break;
3502         case DISABLE_KEY:
3503                 ret = -ENOENT;
3504                 for (i = 0; i < ARRAY_SIZE(mvmvif->ap_early_keys); i++) {
3505                         if (mvmvif->ap_early_keys[i] == key) {
3506                                 mvmvif->ap_early_keys[i] = NULL;
3507                                 ret = 0;
3508                         }
3509                 }
3510
3511                 /* found in pending list - don't do anything else */
3512                 if (ret == 0)
3513                         break;
3514
3515                 if (key->hw_key_idx == STA_KEY_IDX_INVALID) {
3516                         ret = 0;
3517                         break;
3518                 }
3519
3520                 if (sta && iwl_mvm_has_new_rx_api(mvm) &&
3521                     key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
3522                     (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
3523                      key->cipher == WLAN_CIPHER_SUITE_GCMP ||
3524                      key->cipher == WLAN_CIPHER_SUITE_GCMP_256)) {
3525                         mvmsta = iwl_mvm_sta_from_mac80211(sta);
3526                         ptk_pn = rcu_dereference_protected(
3527                                                 mvmsta->ptk_pn[keyidx],
3528                                                 lockdep_is_held(&mvm->mutex));
3529                         RCU_INIT_POINTER(mvmsta->ptk_pn[keyidx], NULL);
3530                         if (ptk_pn)
3531                                 kfree_rcu(ptk_pn, rcu_head);
3532                 }
3533
3534                 IWL_DEBUG_MAC80211(mvm, "disable hwcrypto key\n");
3535                 ret = iwl_mvm_remove_sta_key(mvm, vif, sta, key);
3536                 break;
3537         default:
3538                 ret = -EINVAL;
3539         }
3540
3541         return ret;
3542 }
3543
3544 static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
3545                                enum set_key_cmd cmd,
3546                                struct ieee80211_vif *vif,
3547                                struct ieee80211_sta *sta,
3548                                struct ieee80211_key_conf *key)
3549 {
3550         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3551         int ret;
3552
3553         mutex_lock(&mvm->mutex);
3554         ret = __iwl_mvm_mac_set_key(hw, cmd, vif, sta, key);
3555         mutex_unlock(&mvm->mutex);
3556
3557         return ret;
3558 }
3559
3560 static void iwl_mvm_mac_update_tkip_key(struct ieee80211_hw *hw,
3561                                         struct ieee80211_vif *vif,
3562                                         struct ieee80211_key_conf *keyconf,
3563                                         struct ieee80211_sta *sta,
3564                                         u32 iv32, u16 *phase1key)
3565 {
3566         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3567
3568         if (keyconf->hw_key_idx == STA_KEY_IDX_INVALID)
3569                 return;
3570
3571         iwl_mvm_update_tkip_key(mvm, vif, keyconf, sta, iv32, phase1key);
3572 }
3573
3574
3575 static bool iwl_mvm_rx_aux_roc(struct iwl_notif_wait_data *notif_wait,
3576                                struct iwl_rx_packet *pkt, void *data)
3577 {
3578         struct iwl_mvm *mvm =
3579                 container_of(notif_wait, struct iwl_mvm, notif_wait);
3580         struct iwl_hs20_roc_res *resp;
3581         int resp_len = iwl_rx_packet_payload_len(pkt);
3582         struct iwl_mvm_time_event_data *te_data = data;
3583
3584         if (WARN_ON(pkt->hdr.cmd != HOT_SPOT_CMD))
3585                 return true;
3586
3587         if (WARN_ON_ONCE(resp_len != sizeof(*resp))) {
3588                 IWL_ERR(mvm, "Invalid HOT_SPOT_CMD response\n");
3589                 return true;
3590         }
3591
3592         resp = (void *)pkt->data;
3593
3594         IWL_DEBUG_TE(mvm,
3595                      "Aux ROC: Received response from ucode: status=%d uid=%d\n",
3596                      resp->status, resp->event_unique_id);
3597
3598         te_data->uid = le32_to_cpu(resp->event_unique_id);
3599         IWL_DEBUG_TE(mvm, "TIME_EVENT_CMD response - UID = 0x%x\n",
3600                      te_data->uid);
3601
3602         spin_lock_bh(&mvm->time_event_lock);
3603         list_add_tail(&te_data->list, &mvm->aux_roc_te_list);
3604         spin_unlock_bh(&mvm->time_event_lock);
3605
3606         return true;
3607 }
3608
3609 #define AUX_ROC_MIN_DURATION MSEC_TO_TU(100)
3610 #define AUX_ROC_MIN_DELAY MSEC_TO_TU(200)
3611 #define AUX_ROC_MAX_DELAY MSEC_TO_TU(600)
3612 #define AUX_ROC_SAFETY_BUFFER MSEC_TO_TU(20)
3613 #define AUX_ROC_MIN_SAFETY_BUFFER MSEC_TO_TU(10)
3614 static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm,
3615                                     struct ieee80211_channel *channel,
3616                                     struct ieee80211_vif *vif,
3617                                     int duration)
3618 {
3619         int res;
3620         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3621         struct iwl_mvm_time_event_data *te_data = &mvmvif->hs_time_event_data;
3622         static const u16 time_event_response[] = { HOT_SPOT_CMD };
3623         struct iwl_notification_wait wait_time_event;
3624         u32 dtim_interval = vif->bss_conf.dtim_period *
3625                 vif->bss_conf.beacon_int;
3626         u32 req_dur, delay;
3627         struct iwl_hs20_roc_req aux_roc_req = {
3628                 .action = cpu_to_le32(FW_CTXT_ACTION_ADD),
3629                 .id_and_color =
3630                         cpu_to_le32(FW_CMD_ID_AND_COLOR(MAC_INDEX_AUX, 0)),
3631                 .sta_id_and_color = cpu_to_le32(mvm->aux_sta.sta_id),
3632         };
3633         struct iwl_hs20_roc_req_tail *tail = iwl_mvm_chan_info_cmd_tail(mvm,
3634                 &aux_roc_req.channel_info);
3635         u16 len = sizeof(aux_roc_req) - iwl_mvm_chan_info_padding(mvm);
3636
3637         /* Set the channel info data */
3638         iwl_mvm_set_chan_info(mvm, &aux_roc_req.channel_info, channel->hw_value,
3639                               iwl_mvm_phy_band_from_nl80211(channel->band),
3640                               PHY_VHT_CHANNEL_MODE20,
3641                               0);
3642
3643         /* Set the time and duration */
3644         tail->apply_time = cpu_to_le32(iwl_mvm_get_systime(mvm));
3645
3646         delay = AUX_ROC_MIN_DELAY;
3647         req_dur = MSEC_TO_TU(duration);
3648
3649         /*
3650          * If we are associated we want the delay time to be at least one
3651          * dtim interval so that the FW can wait until after the DTIM and
3652          * then start the time event, this will potentially allow us to
3653          * remain off-channel for the max duration.
3654          * Since we want to use almost a whole dtim interval we would also
3655          * like the delay to be for 2-3 dtim intervals, in case there are
3656          * other time events with higher priority.
3657          */
3658         if (vif->bss_conf.assoc) {
3659                 delay = min_t(u32, dtim_interval * 3, AUX_ROC_MAX_DELAY);
3660                 /* We cannot remain off-channel longer than the DTIM interval */
3661                 if (dtim_interval <= req_dur) {
3662                         req_dur = dtim_interval - AUX_ROC_SAFETY_BUFFER;
3663                         if (req_dur <= AUX_ROC_MIN_DURATION)
3664                                 req_dur = dtim_interval -
3665                                         AUX_ROC_MIN_SAFETY_BUFFER;
3666                 }
3667         }
3668
3669         tail->duration = cpu_to_le32(req_dur);
3670         tail->apply_time_max_delay = cpu_to_le32(delay);
3671
3672         IWL_DEBUG_TE(mvm,
3673                      "ROC: Requesting to remain on channel %u for %ums (requested = %ums, max_delay = %ums, dtim_interval = %ums)\n",
3674                      channel->hw_value, req_dur, duration, delay,
3675                      dtim_interval);
3676         /* Set the node address */
3677         memcpy(tail->node_addr, vif->addr, ETH_ALEN);
3678
3679         lockdep_assert_held(&mvm->mutex);
3680
3681         spin_lock_bh(&mvm->time_event_lock);
3682
3683         if (WARN_ON(te_data->id == HOT_SPOT_CMD)) {
3684                 spin_unlock_bh(&mvm->time_event_lock);
3685                 return -EIO;
3686         }
3687
3688         te_data->vif = vif;
3689         te_data->duration = duration;
3690         te_data->id = HOT_SPOT_CMD;
3691
3692         spin_unlock_bh(&mvm->time_event_lock);
3693
3694         /*
3695          * Use a notification wait, which really just processes the
3696          * command response and doesn't wait for anything, in order
3697          * to be able to process the response and get the UID inside
3698          * the RX path. Using CMD_WANT_SKB doesn't work because it
3699          * stores the buffer and then wakes up this thread, by which
3700          * time another notification (that the time event started)
3701          * might already be processed unsuccessfully.
3702          */
3703         iwl_init_notification_wait(&mvm->notif_wait, &wait_time_event,
3704                                    time_event_response,
3705                                    ARRAY_SIZE(time_event_response),
3706                                    iwl_mvm_rx_aux_roc, te_data);
3707
3708         res = iwl_mvm_send_cmd_pdu(mvm, HOT_SPOT_CMD, 0, len,
3709                                    &aux_roc_req);
3710
3711         if (res) {
3712                 IWL_ERR(mvm, "Couldn't send HOT_SPOT_CMD: %d\n", res);
3713                 iwl_remove_notification(&mvm->notif_wait, &wait_time_event);
3714                 goto out_clear_te;
3715         }
3716
3717         /* No need to wait for anything, so just pass 1 (0 isn't valid) */
3718         res = iwl_wait_notification(&mvm->notif_wait, &wait_time_event, 1);
3719         /* should never fail */
3720         WARN_ON_ONCE(res);
3721
3722         if (res) {
3723  out_clear_te:
3724                 spin_lock_bh(&mvm->time_event_lock);
3725                 iwl_mvm_te_clear_data(mvm, te_data);
3726                 spin_unlock_bh(&mvm->time_event_lock);
3727         }
3728
3729         return res;
3730 }
3731
3732 static int iwl_mvm_roc(struct ieee80211_hw *hw,
3733                        struct ieee80211_vif *vif,
3734                        struct ieee80211_channel *channel,
3735                        int duration,
3736                        enum ieee80211_roc_type type)
3737 {
3738         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3739         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3740         struct cfg80211_chan_def chandef;
3741         struct iwl_mvm_phy_ctxt *phy_ctxt;
3742         int ret, i;
3743
3744         IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value,
3745                            duration, type);
3746
3747         /*
3748          * Flush the done work, just in case it's still pending, so that
3749          * the work it does can complete and we can accept new frames.
3750          */
3751         flush_work(&mvm->roc_done_wk);
3752
3753         mutex_lock(&mvm->mutex);
3754
3755         switch (vif->type) {
3756         case NL80211_IFTYPE_STATION:
3757                 if (fw_has_capa(&mvm->fw->ucode_capa,
3758                                 IWL_UCODE_TLV_CAPA_HOTSPOT_SUPPORT)) {
3759                         /* Use aux roc framework (HS20) */
3760                         ret = iwl_mvm_send_aux_roc_cmd(mvm, channel,
3761                                                        vif, duration);
3762                         goto out_unlock;
3763                 }
3764                 IWL_ERR(mvm, "hotspot not supported\n");
3765                 ret = -EINVAL;
3766                 goto out_unlock;
3767         case NL80211_IFTYPE_P2P_DEVICE:
3768                 /* handle below */
3769                 break;
3770         default:
3771                 IWL_ERR(mvm, "vif isn't P2P_DEVICE: %d\n", vif->type);
3772                 ret = -EINVAL;
3773                 goto out_unlock;
3774         }
3775
3776         for (i = 0; i < NUM_PHY_CTX; i++) {
3777                 phy_ctxt = &mvm->phy_ctxts[i];
3778                 if (phy_ctxt->ref == 0 || mvmvif->phy_ctxt == phy_ctxt)
3779                         continue;
3780
3781                 if (phy_ctxt->ref && channel == phy_ctxt->channel) {
3782                         /*
3783                          * Unbind the P2P_DEVICE from the current PHY context,
3784                          * and if the PHY context is not used remove it.
3785                          */
3786                         ret = iwl_mvm_binding_remove_vif(mvm, vif);
3787                         if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3788                                 goto out_unlock;
3789
3790                         iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3791
3792                         /* Bind the P2P_DEVICE to the current PHY Context */
3793                         mvmvif->phy_ctxt = phy_ctxt;
3794
3795                         ret = iwl_mvm_binding_add_vif(mvm, vif);
3796                         if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3797                                 goto out_unlock;
3798
3799                         iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3800                         goto schedule_time_event;
3801                 }
3802         }
3803
3804         /* Need to update the PHY context only if the ROC channel changed */
3805         if (channel == mvmvif->phy_ctxt->channel)
3806                 goto schedule_time_event;
3807
3808         cfg80211_chandef_create(&chandef, channel, NL80211_CHAN_NO_HT);
3809
3810         /*
3811          * Change the PHY context configuration as it is currently referenced
3812          * only by the P2P Device MAC
3813          */
3814         if (mvmvif->phy_ctxt->ref == 1) {
3815                 ret = iwl_mvm_phy_ctxt_changed(mvm, mvmvif->phy_ctxt,
3816                                                &chandef, 1, 1);
3817                 if (ret)
3818                         goto out_unlock;
3819         } else {
3820                 /*
3821                  * The PHY context is shared with other MACs. Need to remove the
3822                  * P2P Device from the binding, allocate an new PHY context and
3823                  * create a new binding
3824                  */
3825                 phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3826                 if (!phy_ctxt) {
3827                         ret = -ENOSPC;
3828                         goto out_unlock;
3829                 }
3830
3831                 ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &chandef,
3832                                                1, 1);
3833                 if (ret) {
3834                         IWL_ERR(mvm, "Failed to change PHY context\n");
3835                         goto out_unlock;
3836                 }
3837
3838                 /* Unbind the P2P_DEVICE from the current PHY context */
3839                 ret = iwl_mvm_binding_remove_vif(mvm, vif);
3840                 if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3841                         goto out_unlock;
3842
3843                 iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3844
3845                 /* Bind the P2P_DEVICE to the new allocated PHY context */
3846                 mvmvif->phy_ctxt = phy_ctxt;
3847
3848                 ret = iwl_mvm_binding_add_vif(mvm, vif);
3849                 if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3850                         goto out_unlock;
3851
3852                 iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3853         }
3854
3855 schedule_time_event:
3856         /* Schedule the time events */
3857         ret = iwl_mvm_start_p2p_roc(mvm, vif, duration, type);
3858
3859 out_unlock:
3860         mutex_unlock(&mvm->mutex);
3861         IWL_DEBUG_MAC80211(mvm, "leave\n");
3862         return ret;
3863 }
3864
3865 static int iwl_mvm_cancel_roc(struct ieee80211_hw *hw,
3866                               struct ieee80211_vif *vif)
3867 {
3868         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3869
3870         IWL_DEBUG_MAC80211(mvm, "enter\n");
3871
3872         mutex_lock(&mvm->mutex);
3873         iwl_mvm_stop_roc(mvm, vif);
3874         mutex_unlock(&mvm->mutex);
3875
3876         IWL_DEBUG_MAC80211(mvm, "leave\n");
3877         return 0;
3878 }
3879
3880 struct iwl_mvm_ftm_responder_iter_data {
3881         bool responder;
3882         struct ieee80211_chanctx_conf *ctx;
3883 };
3884
3885 static void iwl_mvm_ftm_responder_chanctx_iter(void *_data, u8 *mac,
3886                                                struct ieee80211_vif *vif)
3887 {
3888         struct iwl_mvm_ftm_responder_iter_data *data = _data;
3889
3890         if (rcu_access_pointer(vif->chanctx_conf) == data->ctx &&
3891             vif->type == NL80211_IFTYPE_AP && vif->bss_conf.ftmr_params)
3892                 data->responder = true;
3893 }
3894
3895 static bool iwl_mvm_is_ftm_responder_chanctx(struct iwl_mvm *mvm,
3896                                              struct ieee80211_chanctx_conf *ctx)
3897 {
3898         struct iwl_mvm_ftm_responder_iter_data data = {
3899                 .responder = false,
3900                 .ctx = ctx,
3901         };
3902
3903         ieee80211_iterate_active_interfaces_atomic(mvm->hw,
3904                                         IEEE80211_IFACE_ITER_NORMAL,
3905                                         iwl_mvm_ftm_responder_chanctx_iter,
3906                                         &data);
3907         return data.responder;
3908 }
3909
3910 static int __iwl_mvm_add_chanctx(struct iwl_mvm *mvm,
3911                                  struct ieee80211_chanctx_conf *ctx)
3912 {
3913         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3914         struct iwl_mvm_phy_ctxt *phy_ctxt;
3915         bool responder = iwl_mvm_is_ftm_responder_chanctx(mvm, ctx);
3916         struct cfg80211_chan_def *def = responder ? &ctx->def : &ctx->min_def;
3917         int ret;
3918
3919         lockdep_assert_held(&mvm->mutex);
3920
3921         IWL_DEBUG_MAC80211(mvm, "Add channel context\n");
3922
3923         phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3924         if (!phy_ctxt) {
3925                 ret = -ENOSPC;
3926                 goto out;
3927         }
3928
3929         ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, def,
3930                                        ctx->rx_chains_static,
3931                                        ctx->rx_chains_dynamic);
3932         if (ret) {
3933                 IWL_ERR(mvm, "Failed to add PHY context\n");
3934                 goto out;
3935         }
3936
3937         iwl_mvm_phy_ctxt_ref(mvm, phy_ctxt);
3938         *phy_ctxt_id = phy_ctxt->id;
3939 out:
3940         return ret;
3941 }
3942
3943 static int iwl_mvm_add_chanctx(struct ieee80211_hw *hw,
3944                                struct ieee80211_chanctx_conf *ctx)
3945 {
3946         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3947         int ret;
3948
3949         mutex_lock(&mvm->mutex);
3950         ret = __iwl_mvm_add_chanctx(mvm, ctx);
3951         mutex_unlock(&mvm->mutex);
3952
3953         return ret;
3954 }
3955
3956 static void __iwl_mvm_remove_chanctx(struct iwl_mvm *mvm,
3957                                      struct ieee80211_chanctx_conf *ctx)
3958 {
3959         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3960         struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3961
3962         lockdep_assert_held(&mvm->mutex);
3963
3964         iwl_mvm_phy_ctxt_unref(mvm, phy_ctxt);
3965 }
3966
3967 static void iwl_mvm_remove_chanctx(struct ieee80211_hw *hw,
3968                                    struct ieee80211_chanctx_conf *ctx)
3969 {
3970         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3971
3972         mutex_lock(&mvm->mutex);
3973         __iwl_mvm_remove_chanctx(mvm, ctx);
3974         mutex_unlock(&mvm->mutex);
3975 }
3976
3977 static void iwl_mvm_change_chanctx(struct ieee80211_hw *hw,
3978                                    struct ieee80211_chanctx_conf *ctx,
3979                                    u32 changed)
3980 {
3981         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3982         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3983         struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3984         bool responder = iwl_mvm_is_ftm_responder_chanctx(mvm, ctx);
3985         struct cfg80211_chan_def *def = responder ? &ctx->def : &ctx->min_def;
3986
3987         if (WARN_ONCE((phy_ctxt->ref > 1) &&
3988                       (changed & ~(IEEE80211_CHANCTX_CHANGE_WIDTH |
3989                                    IEEE80211_CHANCTX_CHANGE_RX_CHAINS |
3990                                    IEEE80211_CHANCTX_CHANGE_RADAR |
3991                                    IEEE80211_CHANCTX_CHANGE_MIN_WIDTH)),
3992                       "Cannot change PHY. Ref=%d, changed=0x%X\n",
3993                       phy_ctxt->ref, changed))
3994                 return;
3995
3996         mutex_lock(&mvm->mutex);
3997
3998         /* we are only changing the min_width, may be a noop */
3999         if (changed == IEEE80211_CHANCTX_CHANGE_MIN_WIDTH) {
4000                 if (phy_ctxt->width == def->width)
4001                         goto out_unlock;
4002
4003                 /* we are just toggling between 20_NOHT and 20 */
4004                 if (phy_ctxt->width <= NL80211_CHAN_WIDTH_20 &&
4005                     def->width <= NL80211_CHAN_WIDTH_20)
4006                         goto out_unlock;
4007         }
4008
4009         iwl_mvm_bt_coex_vif_change(mvm);
4010         iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, def,
4011                                  ctx->rx_chains_static,
4012                                  ctx->rx_chains_dynamic);
4013
4014 out_unlock:
4015         mutex_unlock(&mvm->mutex);
4016 }
4017
4018 static int __iwl_mvm_assign_vif_chanctx(struct iwl_mvm *mvm,
4019                                         struct ieee80211_vif *vif,
4020                                         struct ieee80211_chanctx_conf *ctx,
4021                                         bool switching_chanctx)
4022 {
4023         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
4024         struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
4025         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4026         int ret;
4027
4028         lockdep_assert_held(&mvm->mutex);
4029
4030         mvmvif->phy_ctxt = phy_ctxt;
4031
4032         switch (vif->type) {
4033         case NL80211_IFTYPE_AP:
4034                 /* only needed if we're switching chanctx (i.e. during CSA) */
4035                 if (switching_chanctx) {
4036                         mvmvif->ap_ibss_active = true;
4037                         break;
4038                 }
4039                 /* fall through */
4040         case NL80211_IFTYPE_ADHOC:
4041                 /*
4042                  * The AP binding flow is handled as part of the start_ap flow
4043                  * (in bss_info_changed), similarly for IBSS.
4044                  */
4045                 ret = 0;
4046                 goto out;
4047         case NL80211_IFTYPE_STATION:
4048                 mvmvif->csa_bcn_pending = false;
4049                 break;
4050         case NL80211_IFTYPE_MONITOR:
4051                 /* always disable PS when a monitor interface is active */
4052                 mvmvif->ps_disabled = true;
4053                 break;
4054         default:
4055                 ret = -EINVAL;
4056                 goto out;
4057         }
4058
4059         ret = iwl_mvm_binding_add_vif(mvm, vif);
4060         if (ret)
4061                 goto out;
4062
4063         /*
4064          * Power state must be updated before quotas,
4065          * otherwise fw will complain.
4066          */
4067         iwl_mvm_power_update_mac(mvm);
4068
4069         /* Setting the quota at this stage is only required for monitor
4070          * interfaces. For the other types, the bss_info changed flow
4071          * will handle quota settings.
4072          */
4073         if (vif->type == NL80211_IFTYPE_MONITOR) {
4074                 mvmvif->monitor_active = true;
4075                 ret = iwl_mvm_update_quotas(mvm, false, NULL);
4076                 if (ret)
4077                         goto out_remove_binding;
4078
4079                 ret = iwl_mvm_add_snif_sta(mvm, vif);
4080                 if (ret)
4081                         goto out_remove_binding;
4082
4083         }
4084
4085         /* Handle binding during CSA */
4086         if (vif->type == NL80211_IFTYPE_AP) {
4087                 iwl_mvm_update_quotas(mvm, false, NULL);
4088                 iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
4089         }
4090
4091         if (switching_chanctx && vif->type == NL80211_IFTYPE_STATION) {
4092                 mvmvif->csa_bcn_pending = true;
4093
4094                 if (!fw_has_capa(&mvm->fw->ucode_capa,
4095                                  IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
4096                         u32 duration = 3 * vif->bss_conf.beacon_int;
4097
4098                         /* Protect the session to make sure we hear the first
4099                          * beacon on the new channel.
4100                          */
4101                         iwl_mvm_protect_session(mvm, vif, duration, duration,
4102                                                 vif->bss_conf.beacon_int / 2,
4103                                                 true);
4104                 }
4105
4106                 iwl_mvm_update_quotas(mvm, false, NULL);
4107         }
4108
4109         goto out;
4110
4111 out_remove_binding:
4112         iwl_mvm_binding_remove_vif(mvm, vif);
4113         iwl_mvm_power_update_mac(mvm);
4114 out:
4115         if (ret)
4116                 mvmvif->phy_ctxt = NULL;
4117         return ret;
4118 }
4119 static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
4120                                       struct ieee80211_vif *vif,
4121                                       struct ieee80211_chanctx_conf *ctx)
4122 {
4123         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4124         int ret;
4125
4126         mutex_lock(&mvm->mutex);
4127         ret = __iwl_mvm_assign_vif_chanctx(mvm, vif, ctx, false);
4128         mutex_unlock(&mvm->mutex);
4129
4130         return ret;
4131 }
4132
4133 static void __iwl_mvm_unassign_vif_chanctx(struct iwl_mvm *mvm,
4134                                            struct ieee80211_vif *vif,
4135                                            struct ieee80211_chanctx_conf *ctx,
4136                                            bool switching_chanctx)
4137 {
4138         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4139         struct ieee80211_vif *disabled_vif = NULL;
4140
4141         lockdep_assert_held(&mvm->mutex);
4142
4143         iwl_mvm_remove_time_event(mvm, mvmvif, &mvmvif->time_event_data);
4144
4145         switch (vif->type) {
4146         case NL80211_IFTYPE_ADHOC:
4147                 goto out;
4148         case NL80211_IFTYPE_MONITOR:
4149                 mvmvif->monitor_active = false;
4150                 mvmvif->ps_disabled = false;
4151                 iwl_mvm_rm_snif_sta(mvm, vif);
4152                 break;
4153         case NL80211_IFTYPE_AP:
4154                 /* This part is triggered only during CSA */
4155                 if (!switching_chanctx || !mvmvif->ap_ibss_active)
4156                         goto out;
4157
4158                 mvmvif->csa_countdown = false;
4159
4160                 /* Set CS bit on all the stations */
4161                 iwl_mvm_modify_all_sta_disable_tx(mvm, mvmvif, true);
4162
4163                 /* Save blocked iface, the timeout is set on the next beacon */
4164                 rcu_assign_pointer(mvm->csa_tx_blocked_vif, vif);
4165
4166                 mvmvif->ap_ibss_active = false;
4167                 break;
4168         case NL80211_IFTYPE_STATION:
4169                 if (!switching_chanctx)
4170                         break;
4171
4172                 disabled_vif = vif;
4173
4174                 if (!fw_has_capa(&mvm->fw->ucode_capa,
4175                                  IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD))
4176                         iwl_mvm_mac_ctxt_changed(mvm, vif, true, NULL);
4177                 break;
4178         default:
4179                 break;
4180         }
4181
4182         iwl_mvm_update_quotas(mvm, false, disabled_vif);
4183         iwl_mvm_binding_remove_vif(mvm, vif);
4184
4185 out:
4186         mvmvif->phy_ctxt = NULL;
4187         iwl_mvm_power_update_mac(mvm);
4188 }
4189
4190 static void iwl_mvm_unassign_vif_chanctx(struct ieee80211_hw *hw,
4191                                          struct ieee80211_vif *vif,
4192                                          struct ieee80211_chanctx_conf *ctx)
4193 {
4194         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4195
4196         mutex_lock(&mvm->mutex);
4197         __iwl_mvm_unassign_vif_chanctx(mvm, vif, ctx, false);
4198         mutex_unlock(&mvm->mutex);
4199 }
4200
4201 static int
4202 iwl_mvm_switch_vif_chanctx_swap(struct iwl_mvm *mvm,
4203                                 struct ieee80211_vif_chanctx_switch *vifs)
4204 {
4205         int ret;
4206
4207         mutex_lock(&mvm->mutex);
4208         __iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
4209         __iwl_mvm_remove_chanctx(mvm, vifs[0].old_ctx);
4210
4211         ret = __iwl_mvm_add_chanctx(mvm, vifs[0].new_ctx);
4212         if (ret) {
4213                 IWL_ERR(mvm, "failed to add new_ctx during channel switch\n");
4214                 goto out_reassign;
4215         }
4216
4217         ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
4218                                            true);
4219         if (ret) {
4220                 IWL_ERR(mvm,
4221                         "failed to assign new_ctx during channel switch\n");
4222                 goto out_remove;
4223         }
4224
4225         /* we don't support TDLS during DCM - can be caused by channel switch */
4226         if (iwl_mvm_phy_ctx_count(mvm) > 1)
4227                 iwl_mvm_teardown_tdls_peers(mvm);
4228
4229         goto out;
4230
4231 out_remove:
4232         __iwl_mvm_remove_chanctx(mvm, vifs[0].new_ctx);
4233
4234 out_reassign:
4235         if (__iwl_mvm_add_chanctx(mvm, vifs[0].old_ctx)) {
4236                 IWL_ERR(mvm, "failed to add old_ctx back after failure.\n");
4237                 goto out_restart;
4238         }
4239
4240         if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
4241                                          true)) {
4242                 IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
4243                 goto out_restart;
4244         }
4245
4246         goto out;
4247
4248 out_restart:
4249         /* things keep failing, better restart the hw */
4250         iwl_mvm_nic_restart(mvm, false);
4251
4252 out:
4253         mutex_unlock(&mvm->mutex);
4254
4255         return ret;
4256 }
4257
4258 static int
4259 iwl_mvm_switch_vif_chanctx_reassign(struct iwl_mvm *mvm,
4260                                     struct ieee80211_vif_chanctx_switch *vifs)
4261 {
4262         int ret;
4263
4264         mutex_lock(&mvm->mutex);
4265         __iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
4266
4267         ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
4268                                            true);
4269         if (ret) {
4270                 IWL_ERR(mvm,
4271                         "failed to assign new_ctx during channel switch\n");
4272                 goto out_reassign;
4273         }
4274
4275         goto out;
4276
4277 out_reassign:
4278         if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
4279                                          true)) {
4280                 IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
4281                 goto out_restart;
4282         }
4283
4284         goto out;
4285
4286 out_restart:
4287         /* things keep failing, better restart the hw */
4288         iwl_mvm_nic_restart(mvm, false);
4289
4290 out:
4291         mutex_unlock(&mvm->mutex);
4292
4293         return ret;
4294 }
4295
4296 static int iwl_mvm_switch_vif_chanctx(struct ieee80211_hw *hw,
4297                                       struct ieee80211_vif_chanctx_switch *vifs,
4298                                       int n_vifs,
4299                                       enum ieee80211_chanctx_switch_mode mode)
4300 {
4301         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4302         int ret;
4303
4304         /* we only support a single-vif right now */
4305         if (n_vifs > 1)
4306                 return -EOPNOTSUPP;
4307
4308         switch (mode) {
4309         case CHANCTX_SWMODE_SWAP_CONTEXTS:
4310                 ret = iwl_mvm_switch_vif_chanctx_swap(mvm, vifs);
4311                 break;
4312         case CHANCTX_SWMODE_REASSIGN_VIF:
4313                 ret = iwl_mvm_switch_vif_chanctx_reassign(mvm, vifs);
4314                 break;
4315         default:
4316                 ret = -EOPNOTSUPP;
4317                 break;
4318         }
4319
4320         return ret;
4321 }
4322
4323 static int iwl_mvm_tx_last_beacon(struct ieee80211_hw *hw)
4324 {
4325         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4326
4327         return mvm->ibss_manager;
4328 }
4329
4330 static int iwl_mvm_set_tim(struct ieee80211_hw *hw,
4331                            struct ieee80211_sta *sta,
4332                            bool set)
4333 {
4334         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4335         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
4336
4337         if (!mvm_sta || !mvm_sta->vif) {
4338                 IWL_ERR(mvm, "Station is not associated to a vif\n");
4339                 return -EINVAL;
4340         }
4341
4342         return iwl_mvm_mac_ctxt_beacon_changed(mvm, mvm_sta->vif);
4343 }
4344
4345 #ifdef CONFIG_NL80211_TESTMODE
4346 static const struct nla_policy iwl_mvm_tm_policy[IWL_MVM_TM_ATTR_MAX + 1] = {
4347         [IWL_MVM_TM_ATTR_CMD] = { .type = NLA_U32 },
4348         [IWL_MVM_TM_ATTR_NOA_DURATION] = { .type = NLA_U32 },
4349         [IWL_MVM_TM_ATTR_BEACON_FILTER_STATE] = { .type = NLA_U32 },
4350 };
4351
4352 static int __iwl_mvm_mac_testmode_cmd(struct iwl_mvm *mvm,
4353                                       struct ieee80211_vif *vif,
4354                                       void *data, int len)
4355 {
4356         struct nlattr *tb[IWL_MVM_TM_ATTR_MAX + 1];
4357         int err;
4358         u32 noa_duration;
4359
4360         err = nla_parse_deprecated(tb, IWL_MVM_TM_ATTR_MAX, data, len,
4361                                    iwl_mvm_tm_policy, NULL);
4362         if (err)
4363                 return err;
4364
4365         if (!tb[IWL_MVM_TM_ATTR_CMD])
4366                 return -EINVAL;
4367
4368         switch (nla_get_u32(tb[IWL_MVM_TM_ATTR_CMD])) {
4369         case IWL_MVM_TM_CMD_SET_NOA:
4370                 if (!vif || vif->type != NL80211_IFTYPE_AP || !vif->p2p ||
4371                     !vif->bss_conf.enable_beacon ||
4372                     !tb[IWL_MVM_TM_ATTR_NOA_DURATION])
4373                         return -EINVAL;
4374
4375                 noa_duration = nla_get_u32(tb[IWL_MVM_TM_ATTR_NOA_DURATION]);
4376                 if (noa_duration >= vif->bss_conf.beacon_int)
4377                         return -EINVAL;
4378
4379                 mvm->noa_duration = noa_duration;
4380                 mvm->noa_vif = vif;
4381
4382                 return iwl_mvm_update_quotas(mvm, true, NULL);
4383         case IWL_MVM_TM_CMD_SET_BEACON_FILTER:
4384                 /* must be associated client vif - ignore authorized */
4385                 if (!vif || vif->type != NL80211_IFTYPE_STATION ||
4386                     !vif->bss_conf.assoc || !vif->bss_conf.dtim_period ||
4387                     !tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE])
4388                         return -EINVAL;
4389
4390                 if (nla_get_u32(tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE]))
4391                         return iwl_mvm_enable_beacon_filter(mvm, vif, 0);
4392                 return iwl_mvm_disable_beacon_filter(mvm, vif, 0);
4393         }
4394
4395         return -EOPNOTSUPP;
4396 }
4397
4398 static int iwl_mvm_mac_testmode_cmd(struct ieee80211_hw *hw,
4399                                     struct ieee80211_vif *vif,
4400                                     void *data, int len)
4401 {
4402         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4403         int err;
4404
4405         mutex_lock(&mvm->mutex);
4406         err = __iwl_mvm_mac_testmode_cmd(mvm, vif, data, len);
4407         mutex_unlock(&mvm->mutex);
4408
4409         return err;
4410 }
4411 #endif
4412
4413 static void iwl_mvm_channel_switch(struct ieee80211_hw *hw,
4414                                    struct ieee80211_vif *vif,
4415                                    struct ieee80211_channel_switch *chsw)
4416 {
4417         /* By implementing this operation, we prevent mac80211 from
4418          * starting its own channel switch timer, so that we can call
4419          * ieee80211_chswitch_done() ourselves at the right time
4420          * (which is when the absence time event starts).
4421          */
4422
4423         IWL_DEBUG_MAC80211(IWL_MAC80211_GET_MVM(hw),
4424                            "dummy channel switch op\n");
4425 }
4426
4427 static int iwl_mvm_schedule_client_csa(struct iwl_mvm *mvm,
4428                                        struct ieee80211_vif *vif,
4429                                        struct ieee80211_channel_switch *chsw)
4430 {
4431         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4432         struct iwl_chan_switch_te_cmd cmd = {
4433                 .mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
4434                                                           mvmvif->color)),
4435                 .action = cpu_to_le32(FW_CTXT_ACTION_ADD),
4436                 .tsf = cpu_to_le32(chsw->timestamp),
4437                 .cs_count = chsw->count,
4438                 .cs_mode = chsw->block_tx,
4439         };
4440
4441         lockdep_assert_held(&mvm->mutex);
4442
4443         if (chsw->delay)
4444                 cmd.cs_delayed_bcn_count =
4445                         DIV_ROUND_UP(chsw->delay, vif->bss_conf.beacon_int);
4446
4447         return iwl_mvm_send_cmd_pdu(mvm,
4448                                     WIDE_ID(MAC_CONF_GROUP,
4449                                             CHANNEL_SWITCH_TIME_EVENT_CMD),
4450                                     0, sizeof(cmd), &cmd);
4451 }
4452
4453 static int iwl_mvm_old_pre_chan_sw_sta(struct iwl_mvm *mvm,
4454                                        struct ieee80211_vif *vif,
4455                                        struct ieee80211_channel_switch *chsw)
4456 {
4457         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4458         u32 apply_time;
4459
4460         /* Schedule the time event to a bit before beacon 1,
4461          * to make sure we're in the new channel when the
4462          * GO/AP arrives. In case count <= 1 immediately schedule the
4463          * TE (this might result with some packet loss or connection
4464          * loss).
4465          */
4466         if (chsw->count <= 1)
4467                 apply_time = 0;
4468         else
4469                 apply_time = chsw->device_timestamp +
4470                         ((vif->bss_conf.beacon_int * (chsw->count - 1) -
4471                           IWL_MVM_CHANNEL_SWITCH_TIME_CLIENT) * 1024);
4472
4473         if (chsw->block_tx)
4474                 iwl_mvm_csa_client_absent(mvm, vif);
4475
4476         if (mvmvif->bf_data.bf_enabled) {
4477                 int ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
4478
4479                 if (ret)
4480                         return ret;
4481         }
4482
4483         iwl_mvm_schedule_csa_period(mvm, vif, vif->bss_conf.beacon_int,
4484                                     apply_time);
4485
4486         return 0;
4487 }
4488
4489 #define IWL_MAX_CSA_BLOCK_TX 1500
4490 static int iwl_mvm_pre_channel_switch(struct ieee80211_hw *hw,
4491                                       struct ieee80211_vif *vif,
4492                                       struct ieee80211_channel_switch *chsw)
4493 {
4494         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4495         struct ieee80211_vif *csa_vif;
4496         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4497         int ret;
4498
4499         mutex_lock(&mvm->mutex);
4500
4501         mvmvif->csa_failed = false;
4502
4503         IWL_DEBUG_MAC80211(mvm, "pre CSA to freq %d\n",
4504                            chsw->chandef.center_freq1);
4505
4506         iwl_fw_dbg_trigger_simple_stop(&mvm->fwrt,
4507                                        ieee80211_vif_to_wdev(vif),
4508                                        FW_DBG_TRIGGER_CHANNEL_SWITCH);
4509
4510         switch (vif->type) {
4511         case NL80211_IFTYPE_AP:
4512                 csa_vif =
4513                         rcu_dereference_protected(mvm->csa_vif,
4514                                                   lockdep_is_held(&mvm->mutex));
4515                 if (WARN_ONCE(csa_vif && csa_vif->csa_active,
4516                               "Another CSA is already in progress")) {
4517                         ret = -EBUSY;
4518                         goto out_unlock;
4519                 }
4520
4521                 /* we still didn't unblock tx. prevent new CS meanwhile */
4522                 if (rcu_dereference_protected(mvm->csa_tx_blocked_vif,
4523                                               lockdep_is_held(&mvm->mutex))) {
4524                         ret = -EBUSY;
4525                         goto out_unlock;
4526                 }
4527
4528                 rcu_assign_pointer(mvm->csa_vif, vif);
4529
4530                 if (WARN_ONCE(mvmvif->csa_countdown,
4531                               "Previous CSA countdown didn't complete")) {
4532                         ret = -EBUSY;
4533                         goto out_unlock;
4534                 }
4535
4536                 mvmvif->csa_target_freq = chsw->chandef.chan->center_freq;
4537
4538                 break;
4539         case NL80211_IFTYPE_STATION:
4540                 if (chsw->block_tx) {
4541                         /*
4542                          * In case of undetermined / long time with immediate
4543                          * quiet monitor status to gracefully disconnect
4544                          */
4545                         if (!chsw->count ||
4546                             chsw->count * vif->bss_conf.beacon_int >
4547                             IWL_MAX_CSA_BLOCK_TX)
4548                                 schedule_delayed_work(&mvmvif->csa_work,
4549                                                       msecs_to_jiffies(IWL_MAX_CSA_BLOCK_TX));
4550                 }
4551
4552                 if (!fw_has_capa(&mvm->fw->ucode_capa,
4553                                  IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
4554                         ret = iwl_mvm_old_pre_chan_sw_sta(mvm, vif, chsw);
4555                         if (ret)
4556                                 goto out_unlock;
4557                 } else {
4558                         iwl_mvm_schedule_client_csa(mvm, vif, chsw);
4559                 }
4560
4561                 mvmvif->csa_count = chsw->count;
4562                 mvmvif->csa_misbehave = false;
4563                 break;
4564         default:
4565                 break;
4566         }
4567
4568         mvmvif->ps_disabled = true;
4569
4570         ret = iwl_mvm_power_update_ps(mvm);
4571         if (ret)
4572                 goto out_unlock;
4573
4574         /* we won't be on this channel any longer */
4575         iwl_mvm_teardown_tdls_peers(mvm);
4576
4577 out_unlock:
4578         mutex_unlock(&mvm->mutex);
4579
4580         return ret;
4581 }
4582
4583 static void iwl_mvm_channel_switch_rx_beacon(struct ieee80211_hw *hw,
4584                                              struct ieee80211_vif *vif,
4585                                              struct ieee80211_channel_switch *chsw)
4586 {
4587         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4588         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4589         struct iwl_chan_switch_te_cmd cmd = {
4590                 .mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
4591                                                           mvmvif->color)),
4592                 .action = cpu_to_le32(FW_CTXT_ACTION_MODIFY),
4593                 .tsf = cpu_to_le32(chsw->timestamp),
4594                 .cs_count = chsw->count,
4595                 .cs_mode = chsw->block_tx,
4596         };
4597
4598         if (!fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_CS_MODIFY))
4599                 return;
4600
4601         if (chsw->count >= mvmvif->csa_count && chsw->block_tx) {
4602                 if (mvmvif->csa_misbehave) {
4603                         /* Second time, give up on this AP*/
4604                         iwl_mvm_abort_channel_switch(hw, vif);
4605                         ieee80211_chswitch_done(vif, false);
4606                         mvmvif->csa_misbehave = false;
4607                         return;
4608                 }
4609                 mvmvif->csa_misbehave = true;
4610         }
4611         mvmvif->csa_count = chsw->count;
4612
4613         IWL_DEBUG_MAC80211(mvm, "Modify CSA on mac %d\n", mvmvif->id);
4614
4615         WARN_ON(iwl_mvm_send_cmd_pdu(mvm,
4616                                      WIDE_ID(MAC_CONF_GROUP,
4617                                              CHANNEL_SWITCH_TIME_EVENT_CMD),
4618                                      CMD_ASYNC, sizeof(cmd), &cmd));
4619 }
4620
4621 static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop)
4622 {
4623         int i;
4624
4625         if (!iwl_mvm_has_new_tx_api(mvm)) {
4626                 if (drop) {
4627                         mutex_lock(&mvm->mutex);
4628                         iwl_mvm_flush_tx_path(mvm,
4629                                 iwl_mvm_flushable_queues(mvm) & queues, 0);
4630                         mutex_unlock(&mvm->mutex);
4631                 } else {
4632                         iwl_trans_wait_tx_queues_empty(mvm->trans, queues);
4633                 }
4634                 return;
4635         }
4636
4637         mutex_lock(&mvm->mutex);
4638         for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
4639                 struct ieee80211_sta *sta;
4640
4641                 sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
4642                                                 lockdep_is_held(&mvm->mutex));
4643                 if (IS_ERR_OR_NULL(sta))
4644                         continue;
4645
4646                 if (drop)
4647                         iwl_mvm_flush_sta_tids(mvm, i, 0xFF, 0);
4648                 else
4649                         iwl_mvm_wait_sta_queues_empty(mvm,
4650                                         iwl_mvm_sta_from_mac80211(sta));
4651         }
4652         mutex_unlock(&mvm->mutex);
4653 }
4654
4655 static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
4656                               struct ieee80211_vif *vif, u32 queues, bool drop)
4657 {
4658         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4659         struct iwl_mvm_vif *mvmvif;
4660         struct iwl_mvm_sta *mvmsta;
4661         struct ieee80211_sta *sta;
4662         int i;
4663         u32 msk = 0;
4664
4665         if (!vif) {
4666                 iwl_mvm_flush_no_vif(mvm, queues, drop);
4667                 return;
4668         }
4669
4670         if (vif->type != NL80211_IFTYPE_STATION)
4671                 return;
4672
4673         /* Make sure we're done with the deferred traffic before flushing */
4674         flush_work(&mvm->add_stream_wk);
4675
4676         mutex_lock(&mvm->mutex);
4677         mvmvif = iwl_mvm_vif_from_mac80211(vif);
4678
4679         /* flush the AP-station and all TDLS peers */
4680         for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
4681                 sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
4682                                                 lockdep_is_held(&mvm->mutex));
4683                 if (IS_ERR_OR_NULL(sta))
4684                         continue;
4685
4686                 mvmsta = iwl_mvm_sta_from_mac80211(sta);
4687                 if (mvmsta->vif != vif)
4688                         continue;
4689
4690                 /* make sure only TDLS peers or the AP are flushed */
4691                 WARN_ON(i != mvmvif->ap_sta_id && !sta->tdls);
4692
4693                 if (drop) {
4694                         if (iwl_mvm_flush_sta(mvm, mvmsta, false, 0))
4695                                 IWL_ERR(mvm, "flush request fail\n");
4696                 } else {
4697                         msk |= mvmsta->tfd_queue_msk;
4698                         if (iwl_mvm_has_new_tx_api(mvm))
4699                                 iwl_mvm_wait_sta_queues_empty(mvm, mvmsta);
4700                 }
4701         }
4702
4703         mutex_unlock(&mvm->mutex);
4704
4705         /* this can take a while, and we may need/want other operations
4706          * to succeed while doing this, so do it without the mutex held
4707          */
4708         if (!drop && !iwl_mvm_has_new_tx_api(mvm))
4709                 iwl_trans_wait_tx_queues_empty(mvm->trans, msk);
4710 }
4711
4712 static int iwl_mvm_mac_get_survey(struct ieee80211_hw *hw, int idx,
4713                                   struct survey_info *survey)
4714 {
4715         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4716         int ret;
4717
4718         memset(survey, 0, sizeof(*survey));
4719
4720         /* only support global statistics right now */
4721         if (idx != 0)
4722                 return -ENOENT;
4723
4724         if (!fw_has_capa(&mvm->fw->ucode_capa,
4725                          IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
4726                 return -ENOENT;
4727
4728         mutex_lock(&mvm->mutex);
4729
4730         if (iwl_mvm_firmware_running(mvm)) {
4731                 ret = iwl_mvm_request_statistics(mvm, false);
4732                 if (ret)
4733                         goto out;
4734         }
4735
4736         survey->filled = SURVEY_INFO_TIME |
4737                          SURVEY_INFO_TIME_RX |
4738                          SURVEY_INFO_TIME_TX |
4739                          SURVEY_INFO_TIME_SCAN;
4740         survey->time = mvm->accu_radio_stats.on_time_rf +
4741                        mvm->radio_stats.on_time_rf;
4742         do_div(survey->time, USEC_PER_MSEC);
4743
4744         survey->time_rx = mvm->accu_radio_stats.rx_time +
4745                           mvm->radio_stats.rx_time;
4746         do_div(survey->time_rx, USEC_PER_MSEC);
4747
4748         survey->time_tx = mvm->accu_radio_stats.tx_time +
4749                           mvm->radio_stats.tx_time;
4750         do_div(survey->time_tx, USEC_PER_MSEC);
4751
4752         survey->time_scan = mvm->accu_radio_stats.on_time_scan +
4753                             mvm->radio_stats.on_time_scan;
4754         do_div(survey->time_scan, USEC_PER_MSEC);
4755
4756         ret = 0;
4757  out:
4758         mutex_unlock(&mvm->mutex);
4759         return ret;
4760 }
4761
4762 static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,
4763                                        struct ieee80211_vif *vif,
4764                                        struct ieee80211_sta *sta,
4765                                        struct station_info *sinfo)
4766 {
4767         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4768         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4769         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
4770
4771         if (mvmsta->avg_energy) {
4772                 sinfo->signal_avg = mvmsta->avg_energy;
4773                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
4774         }
4775
4776         /* if beacon filtering isn't on mac80211 does it anyway */
4777         if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
4778                 return;
4779
4780         if (!vif->bss_conf.assoc)
4781                 return;
4782
4783         mutex_lock(&mvm->mutex);
4784
4785         if (mvmvif->ap_sta_id != mvmsta->sta_id)
4786                 goto unlock;
4787
4788         if (iwl_mvm_request_statistics(mvm, false))
4789                 goto unlock;
4790
4791         sinfo->rx_beacon = mvmvif->beacon_stats.num_beacons +
4792                            mvmvif->beacon_stats.accu_num_beacons;
4793         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_RX);
4794         if (mvmvif->beacon_stats.avg_signal) {
4795                 /* firmware only reports a value after RXing a few beacons */
4796                 sinfo->rx_beacon_signal_avg = mvmvif->beacon_stats.avg_signal;
4797                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG);
4798         }
4799  unlock:
4800         mutex_unlock(&mvm->mutex);
4801 }
4802
4803 static void iwl_mvm_event_mlme_callback(struct iwl_mvm *mvm,
4804                                         struct ieee80211_vif *vif,
4805                                         const struct ieee80211_event *event)
4806 {
4807 #define CHECK_MLME_TRIGGER(_cnt, _fmt...)                               \
4808         do {                                                            \
4809                 if ((trig_mlme->_cnt) && --(trig_mlme->_cnt))           \
4810                         break;                                          \
4811                 iwl_fw_dbg_collect_trig(&(mvm)->fwrt, trig, _fmt);      \
4812         } while (0)
4813
4814         struct iwl_fw_dbg_trigger_tlv *trig;
4815         struct iwl_fw_dbg_trigger_mlme *trig_mlme;
4816
4817         trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
4818                                      FW_DBG_TRIGGER_MLME);
4819         if (!trig)
4820                 return;
4821
4822         trig_mlme = (void *)trig->data;
4823
4824         if (event->u.mlme.data == ASSOC_EVENT) {
4825                 if (event->u.mlme.status == MLME_DENIED)
4826                         CHECK_MLME_TRIGGER(stop_assoc_denied,
4827                                            "DENIED ASSOC: reason %d",
4828                                             event->u.mlme.reason);
4829                 else if (event->u.mlme.status == MLME_TIMEOUT)
4830                         CHECK_MLME_TRIGGER(stop_assoc_timeout,
4831                                            "ASSOC TIMEOUT");
4832         } else if (event->u.mlme.data == AUTH_EVENT) {
4833                 if (event->u.mlme.status == MLME_DENIED)
4834                         CHECK_MLME_TRIGGER(stop_auth_denied,
4835                                            "DENIED AUTH: reason %d",
4836                                            event->u.mlme.reason);
4837                 else if (event->u.mlme.status == MLME_TIMEOUT)
4838                         CHECK_MLME_TRIGGER(stop_auth_timeout,
4839                                            "AUTH TIMEOUT");
4840         } else if (event->u.mlme.data == DEAUTH_RX_EVENT) {
4841                 CHECK_MLME_TRIGGER(stop_rx_deauth,
4842                                    "DEAUTH RX %d", event->u.mlme.reason);
4843         } else if (event->u.mlme.data == DEAUTH_TX_EVENT) {
4844                 CHECK_MLME_TRIGGER(stop_tx_deauth,
4845                                    "DEAUTH TX %d", event->u.mlme.reason);
4846         }
4847 #undef CHECK_MLME_TRIGGER
4848 }
4849
4850 static void iwl_mvm_event_bar_rx_callback(struct iwl_mvm *mvm,
4851                                           struct ieee80211_vif *vif,
4852                                           const struct ieee80211_event *event)
4853 {
4854         struct iwl_fw_dbg_trigger_tlv *trig;
4855         struct iwl_fw_dbg_trigger_ba *ba_trig;
4856
4857         trig = iwl_fw_dbg_trigger_on(&mvm->fwrt, ieee80211_vif_to_wdev(vif),
4858                                      FW_DBG_TRIGGER_BA);
4859         if (!trig)
4860                 return;
4861
4862         ba_trig = (void *)trig->data;
4863
4864         if (!(le16_to_cpu(ba_trig->rx_bar) & BIT(event->u.ba.tid)))
4865                 return;
4866
4867         iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
4868                                 "BAR received from %pM, tid %d, ssn %d",
4869                                 event->u.ba.sta->addr, event->u.ba.tid,
4870                                 event->u.ba.ssn);
4871 }
4872
4873 static void iwl_mvm_mac_event_callback(struct ieee80211_hw *hw,
4874                                        struct ieee80211_vif *vif,
4875                                        const struct ieee80211_event *event)
4876 {
4877         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4878
4879         switch (event->type) {
4880         case MLME_EVENT:
4881                 iwl_mvm_event_mlme_callback(mvm, vif, event);
4882                 break;
4883         case BAR_RX_EVENT:
4884                 iwl_mvm_event_bar_rx_callback(mvm, vif, event);
4885                 break;
4886         case BA_FRAME_TIMEOUT:
4887                 iwl_mvm_event_frame_timeout_callback(mvm, vif, event->u.ba.sta,
4888                                                      event->u.ba.tid);
4889                 break;
4890         default:
4891                 break;
4892         }
4893 }
4894
4895 void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm,
4896                                      struct iwl_mvm_internal_rxq_notif *notif,
4897                                      u32 size)
4898 {
4899         u32 qmask = BIT(mvm->trans->num_rx_queues) - 1;
4900         int ret;
4901
4902
4903         if (!iwl_mvm_has_new_rx_api(mvm))
4904                 return;
4905
4906         if (notif->sync) {
4907                 notif->cookie = mvm->queue_sync_cookie;
4908                 atomic_set(&mvm->queue_sync_counter,
4909                            mvm->trans->num_rx_queues);
4910         }
4911
4912         ret = iwl_mvm_notify_rx_queue(mvm, qmask, (u8 *)notif,
4913                                       size, !notif->sync);
4914         if (ret) {
4915                 IWL_ERR(mvm, "Failed to trigger RX queues sync (%d)\n", ret);
4916                 goto out;
4917         }
4918
4919         if (notif->sync) {
4920                 lockdep_assert_held(&mvm->mutex);
4921                 ret = wait_event_timeout(mvm->rx_sync_waitq,
4922                                          atomic_read(&mvm->queue_sync_counter) == 0 ||
4923                                          iwl_mvm_is_radio_killed(mvm),
4924                                          HZ);
4925                 WARN_ON_ONCE(!ret && !iwl_mvm_is_radio_killed(mvm));
4926         }
4927
4928 out:
4929         atomic_set(&mvm->queue_sync_counter, 0);
4930         if (notif->sync)
4931                 mvm->queue_sync_cookie++;
4932 }
4933
4934 static void iwl_mvm_sync_rx_queues(struct ieee80211_hw *hw)
4935 {
4936         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4937         struct iwl_mvm_internal_rxq_notif data = {
4938                 .type = IWL_MVM_RXQ_EMPTY,
4939                 .sync = 1,
4940         };
4941
4942         mutex_lock(&mvm->mutex);
4943         iwl_mvm_sync_rx_queues_internal(mvm, &data, sizeof(data));
4944         mutex_unlock(&mvm->mutex);
4945 }
4946
4947 static int
4948 iwl_mvm_mac_get_ftm_responder_stats(struct ieee80211_hw *hw,
4949                                     struct ieee80211_vif *vif,
4950                                     struct cfg80211_ftm_responder_stats *stats)
4951 {
4952         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4953         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4954
4955         if (vif->p2p || vif->type != NL80211_IFTYPE_AP ||
4956             !mvmvif->ap_ibss_active || !vif->bss_conf.ftm_responder)
4957                 return -EINVAL;
4958
4959         mutex_lock(&mvm->mutex);
4960         *stats = mvm->ftm_resp_stats;
4961         mutex_unlock(&mvm->mutex);
4962
4963         stats->filled = BIT(NL80211_FTM_STATS_SUCCESS_NUM) |
4964                         BIT(NL80211_FTM_STATS_PARTIAL_NUM) |
4965                         BIT(NL80211_FTM_STATS_FAILED_NUM) |
4966                         BIT(NL80211_FTM_STATS_ASAP_NUM) |
4967                         BIT(NL80211_FTM_STATS_NON_ASAP_NUM) |
4968                         BIT(NL80211_FTM_STATS_TOTAL_DURATION_MSEC) |
4969                         BIT(NL80211_FTM_STATS_UNKNOWN_TRIGGERS_NUM) |
4970                         BIT(NL80211_FTM_STATS_RESCHEDULE_REQUESTS_NUM) |
4971                         BIT(NL80211_FTM_STATS_OUT_OF_WINDOW_TRIGGERS_NUM);
4972
4973         return 0;
4974 }
4975
4976 static int iwl_mvm_start_pmsr(struct ieee80211_hw *hw,
4977                               struct ieee80211_vif *vif,
4978                               struct cfg80211_pmsr_request *request)
4979 {
4980         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4981         int ret;
4982
4983         mutex_lock(&mvm->mutex);
4984         ret = iwl_mvm_ftm_start(mvm, vif, request);
4985         mutex_unlock(&mvm->mutex);
4986
4987         return ret;
4988 }
4989
4990 static void iwl_mvm_abort_pmsr(struct ieee80211_hw *hw,
4991                                struct ieee80211_vif *vif,
4992                                struct cfg80211_pmsr_request *request)
4993 {
4994         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4995
4996         mutex_lock(&mvm->mutex);
4997         iwl_mvm_ftm_abort(mvm, request);
4998         mutex_unlock(&mvm->mutex);
4999 }
5000
5001 static bool iwl_mvm_can_hw_csum(struct sk_buff *skb)
5002 {
5003         u8 protocol = ip_hdr(skb)->protocol;
5004
5005         if (!IS_ENABLED(CONFIG_INET))
5006                 return false;
5007
5008         return protocol == IPPROTO_TCP || protocol == IPPROTO_UDP;
5009 }
5010
5011 static bool iwl_mvm_mac_can_aggregate(struct ieee80211_hw *hw,
5012                                       struct sk_buff *head,
5013                                       struct sk_buff *skb)
5014 {
5015         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
5016
5017         /* For now don't aggregate IPv6 in AMSDU */
5018         if (skb->protocol != htons(ETH_P_IP))
5019                 return false;
5020
5021         if (!iwl_mvm_is_csum_supported(mvm))
5022                 return true;
5023
5024         return iwl_mvm_can_hw_csum(skb) == iwl_mvm_can_hw_csum(head);
5025 }
5026
5027 const struct ieee80211_ops iwl_mvm_hw_ops = {
5028         .tx = iwl_mvm_mac_tx,
5029         .wake_tx_queue = iwl_mvm_mac_wake_tx_queue,
5030         .ampdu_action = iwl_mvm_mac_ampdu_action,
5031         .start = iwl_mvm_mac_start,
5032         .reconfig_complete = iwl_mvm_mac_reconfig_complete,
5033         .stop = iwl_mvm_mac_stop,
5034         .add_interface = iwl_mvm_mac_add_interface,
5035         .remove_interface = iwl_mvm_mac_remove_interface,
5036         .config = iwl_mvm_mac_config,
5037         .prepare_multicast = iwl_mvm_prepare_multicast,
5038         .configure_filter = iwl_mvm_configure_filter,
5039         .config_iface_filter = iwl_mvm_config_iface_filter,
5040         .bss_info_changed = iwl_mvm_bss_info_changed,
5041         .hw_scan = iwl_mvm_mac_hw_scan,
5042         .cancel_hw_scan = iwl_mvm_mac_cancel_hw_scan,
5043         .sta_pre_rcu_remove = iwl_mvm_sta_pre_rcu_remove,
5044         .sta_state = iwl_mvm_mac_sta_state,
5045         .sta_notify = iwl_mvm_mac_sta_notify,
5046         .allow_buffered_frames = iwl_mvm_mac_allow_buffered_frames,
5047         .release_buffered_frames = iwl_mvm_mac_release_buffered_frames,
5048         .set_rts_threshold = iwl_mvm_mac_set_rts_threshold,
5049         .sta_rc_update = iwl_mvm_sta_rc_update,
5050         .conf_tx = iwl_mvm_mac_conf_tx,
5051         .mgd_prepare_tx = iwl_mvm_mac_mgd_prepare_tx,
5052         .mgd_protect_tdls_discover = iwl_mvm_mac_mgd_protect_tdls_discover,
5053         .flush = iwl_mvm_mac_flush,
5054         .sched_scan_start = iwl_mvm_mac_sched_scan_start,
5055         .sched_scan_stop = iwl_mvm_mac_sched_scan_stop,
5056         .set_key = iwl_mvm_mac_set_key,
5057         .update_tkip_key = iwl_mvm_mac_update_tkip_key,
5058         .remain_on_channel = iwl_mvm_roc,
5059         .cancel_remain_on_channel = iwl_mvm_cancel_roc,
5060         .add_chanctx = iwl_mvm_add_chanctx,
5061         .remove_chanctx = iwl_mvm_remove_chanctx,
5062         .change_chanctx = iwl_mvm_change_chanctx,
5063         .assign_vif_chanctx = iwl_mvm_assign_vif_chanctx,
5064         .unassign_vif_chanctx = iwl_mvm_unassign_vif_chanctx,
5065         .switch_vif_chanctx = iwl_mvm_switch_vif_chanctx,
5066
5067         .start_ap = iwl_mvm_start_ap_ibss,
5068         .stop_ap = iwl_mvm_stop_ap_ibss,
5069         .join_ibss = iwl_mvm_start_ap_ibss,
5070         .leave_ibss = iwl_mvm_stop_ap_ibss,
5071
5072         .tx_last_beacon = iwl_mvm_tx_last_beacon,
5073
5074         .set_tim = iwl_mvm_set_tim,
5075
5076         .channel_switch = iwl_mvm_channel_switch,
5077         .pre_channel_switch = iwl_mvm_pre_channel_switch,
5078         .post_channel_switch = iwl_mvm_post_channel_switch,
5079         .abort_channel_switch = iwl_mvm_abort_channel_switch,
5080         .channel_switch_rx_beacon = iwl_mvm_channel_switch_rx_beacon,
5081
5082         .tdls_channel_switch = iwl_mvm_tdls_channel_switch,
5083         .tdls_cancel_channel_switch = iwl_mvm_tdls_cancel_channel_switch,
5084         .tdls_recv_channel_switch = iwl_mvm_tdls_recv_channel_switch,
5085
5086         .event_callback = iwl_mvm_mac_event_callback,
5087
5088         .sync_rx_queues = iwl_mvm_sync_rx_queues,
5089
5090         CFG80211_TESTMODE_CMD(iwl_mvm_mac_testmode_cmd)
5091
5092 #ifdef CONFIG_PM_SLEEP
5093         /* look at d3.c */
5094         .suspend = iwl_mvm_suspend,
5095         .resume = iwl_mvm_resume,
5096         .set_wakeup = iwl_mvm_set_wakeup,
5097         .set_rekey_data = iwl_mvm_set_rekey_data,
5098 #if IS_ENABLED(CONFIG_IPV6)
5099         .ipv6_addr_change = iwl_mvm_ipv6_addr_change,
5100 #endif
5101         .set_default_unicast_key = iwl_mvm_set_default_unicast_key,
5102 #endif
5103         .get_survey = iwl_mvm_mac_get_survey,
5104         .sta_statistics = iwl_mvm_mac_sta_statistics,
5105         .get_ftm_responder_stats = iwl_mvm_mac_get_ftm_responder_stats,
5106         .start_pmsr = iwl_mvm_start_pmsr,
5107         .abort_pmsr = iwl_mvm_abort_pmsr,
5108
5109         .can_aggregate_in_amsdu = iwl_mvm_mac_can_aggregate,
5110 #ifdef CONFIG_IWLWIFI_DEBUGFS
5111         .sta_add_debugfs = iwl_mvm_sta_add_debugfs,
5112 #endif
5113 };